Anomaly detection system, anomaly detection method, and program

Abstract

An inquiry data acquisition unit (101) of this abnormality detection system (1) acquires inquiry data pertaining to an inquiry from each of a plurality of users who use a service. An abnormality detection unit (102) detects an abnormality pertaining to the service on the basis of the inquiry data.

Description

[Technical Field]

[0001] The present disclosure relates to an anomaly detection system, an anomaly detection method, and a program. [Background technology]

[0002] Conventionally, technologies for detecting anomalies related to services used by users have been studied. For example, Patent Document 1 describes an anomaly detection system that sets monitoring rules for monitoring the operating status of a server computer based on the usage history of a web service. By setting monitoring rules according to the usage history of the web service, the anomaly detection system of Patent Document 1 improves the monitoring accuracy of the web service, improves the service quality of the web service, and reduces operating costs. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2013-030071 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the anomaly detection system of Patent Document 1 does not necessarily include information useful for anomaly detection in the usage history, so even if monitoring rules are set based on the usage history, the accuracy of anomaly detection cannot be sufficiently improved. In this regard, if inquiries from multiple users of a service could be utilized for anomaly detection in the service, the accuracy of anomaly detection could be improved. However, conventional technologies, including the technology of Patent Document 1, have not utilized such information.

[0005] One of the objectives of the present disclosure is to improve the accuracy of anomaly detection. [Means for solving the problem]

[0006] The anomaly detection system according to the present disclosure includes an inquiry data acquisition unit that acquires inquiry data regarding inquiries from each of a plurality of users who use a service, and an anomaly detection unit that detects an anomaly related to the service based on the inquiry data. [Effects of the Invention]

[0007] According to the present disclosure, the accuracy of anomaly detection can be improved. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 illustrates an example of a hardware configuration of an anomaly detection system. [Figure 2] FIG. 10 is a diagram illustrating an example of an inquiry page. [Figure 3] FIG. 10 is a diagram showing an example of a time-series change in the number of accesses to an inquiry page. [Figure 4] FIG. 10 is a diagram illustrating an example of a notification displayed on the administrator terminal. [Figure 5] FIG. 1 is a diagram illustrating an example of functions realized by the anomaly detection system. [Figure 6] FIG. 10 is a diagram illustrating an example of an inquiry database. [Figure 7] FIG. 10 is a diagram illustrating an example of processing executed in the anomaly detection system. [Figure 8] FIG. 10 is a diagram illustrating an example of functions realized by a modified anomaly detection system. DETAILED DESCRIPTION OF THE INVENTION

[0009] [1. Hardware configuration of the anomaly detection system] An example of an embodiment of an anomaly detection system, an anomaly detection method, and a program according to the present disclosure will be described. FIG. 1 is a diagram illustrating an example of the hardware configuration of an anomaly detection system. For example, the anomaly detection system 1 includes a server 10, a communication device 20, a user terminal 30, and an administrator terminal 40. Each of the server 10, the communication device 20, the user terminal 30, and the administrator terminal 40 can be connected to a network N. For example, the network N is the Internet, a public communication line, or a LAN.

[0010] The server 10 is a server computer. In this embodiment, a case where a telecommunications carrier manages the server 10 is taken as an example. For example, the server 10 includes a control unit 11, a storage unit 12, and a communication unit 13. The control unit 11 includes at least one processor. The storage unit 12 includes at least one of a volatile memory such as RAM and a non-volatile memory such as flash memory. The communication unit 13 includes at least one of a communication interface for wired communication and a communication interface for wireless communication.

[0011] The communication device 20 is a device that communicates with other devices. For example, the communication device 20 is a device managed by a telecommunications carrier. The communication device 20 may be a device for wireless communication or a device for wired communication. The communication device 20 relays at least one of user calls and data communications. For example, the communication device 20 is a base station of a public communication line, a private branch exchange, a wireless LAN access point, a router, a hub, a repeater, a modem, or a server computer used in virtualization technology. The communication device 20 may be a device of a telecommunications carrier that provides users with a fully virtualized cloud-native mobile network.

[0012] The user terminal 30 is a user's computer. For example, the user terminal 30 is a smartphone, a tablet, a personal computer, or a wearable terminal. For example, the user terminal 30 includes a control unit 31, a memory unit 32, a communication unit 33, an operation unit 34, and a display unit 35. The hardware configurations of the control unit 31, the memory unit 32, and the communication unit 33 may be similar to those of the control unit 11, the memory unit 12, and the communication unit 13, respectively. The operation unit 34 is an input device such as a touch panel or a mouse. The display unit 35 is a display such as a liquid crystal or organic electroluminescence (EL) display.

[0013] The administrator terminal 40 is a computer of an administrator who manages the service that is the target of anomaly detection. In this embodiment, a communication service provided by a communication carrier will be described as an example of the service. The service may be any service and is not limited to a communication service. For example, the service may be an e-commerce service, a travel reservation service, an online flea market service, a financial service, a payment service, a video distribution service, or other services.

[0014] For example, the administrator terminal 40 is a smartphone, a tablet, a personal computer, or a wearable terminal. For example, the administrator terminal 40 includes a control unit 41, a storage unit 42, a communication unit 43, an operation unit 44, and a display unit 45. The hardware configurations of the control unit 41, the storage unit 42, the communication unit 43, the operation unit 44, and the display unit 45 may be similar to those of the control unit 11, the storage unit 12, the communication unit 13, the operation unit 34, and the display unit 35, respectively.

[0015] The programs stored in the storage units 12, 32, and 42 may be supplied to each computer via the network N. Each computer may also include at least one of a reading unit (e.g., a memory card slot) that reads a computer-readable information storage medium and an input / output unit (e.g., a USB port) that inputs and outputs data to and from an external device. For example, a program stored in an information storage medium may be supplied to each computer via at least one of the reading unit and the input / output unit.

[0016] Furthermore, the anomaly detection system 1 only needs to include at least one computer. The computers included in the anomaly detection system 1 are not limited to the example in FIG. 1. For example, the anomaly detection system 1 may include only the server 10. In this case, the communication device 20, the user terminal 30, and the administrator terminal 40 exist outside the anomaly detection system 1. The anomaly detection system 1 may include only the server 10 and the administrator terminal 40. In this case, the communication device 20 and the user terminal 30 exist outside the anomaly detection system 1. The anomaly detection system 1 may include other computers not shown in FIG. 1.

[0017] [2. Overview of the Anomaly Detection System] In this embodiment, the communication device 20 is taken as an example to be a server computer having a containerized network function (CNF). Furthermore, the user terminal 30 is taken as an example to be a smartphone. The communication device 20 relays communications between a large number of user terminals 30. For example, when the amount of communication that the communication device 20 must process reaches the amount of communication that the communication device 20 can process, an abnormality may occur in the service. The amount of communication can be expressed by a known index such as bps.

[0018] For example, when an abnormality occurs in a service, the administrator identifies the communication device 20 related to the abnormality and performs recovery work. It is conceivable that an abnormality is detected when the amount of communication processed by the communication device 20 exceeds a threshold, but there are cases where the communication device 20 can process a larger amount of communication than the upper limit set by the administrator. There are also cases where the communication device 20 can only process a lower amount of communication than the upper limit set by the administrator. There are also cases where the administrator himself does not know the upper limit of the communication device 20. For this reason, even if the amount of communication of the communication device 20 reaches a certain level, it does not necessarily correspond to an abnormality. The same applies to other services. It is difficult for the administrator to detect the occurrence of an abnormality by only monitoring the state of the communication device 20.

[0019] Therefore, in this embodiment, the server 10 detects an abnormality in a service based on inquiry data related to user inquiries about the service. The inquiry data is data indicating at least one of the inquiry status and the inquiry content. The inquiry status is the number of inquiries, the amount of change in the number of inquiries, the inquiry frequency, or a combination thereof. The inquiry content is the specific content made by the user.

[0020] In this embodiment, as an example of inquiry data, access status data regarding user access status to an inquiry page will be described. An inquiry page is a page that contains answers to inquiries about a service. An inquiry page is also called a help page. The inquiry page may be a website displayed on a browser, or may be a page displayed on an application dedicated to the service. For example, when an abnormality occurs in a service, a user operates the user terminal 30 to access the inquiry page.

[0021] FIG. 2 is a diagram showing an example of an inquiry page. In this embodiment, the server 10 provides the inquiry page P to the user terminal 30 as an example, but a computer other than the server 10 may also provide the inquiry page to the user terminal 30. The server 10 only needs to be able to acquire inquiry data, one example of which is access status data. The computer that generates the inquiry data may be a computer other than the server 10.

[0022] For example, the server 10 manages multiple inquiry pages P. Each inquiry page P contains answers to at least one of inquiries that the administrator anticipates in advance and inquiries that have been made in the past. In the example of FIG. 2, the inquiry page P includes an input form for the user to input keywords. When the user inputs any keyword into the input form, the server 10 searches for inquiry pages P that match the keyword among the multiple inquiry pages P. The user can select any inquiry page P from the search results of the server 10. Note that the server 10 may manage only one inquiry page P. In other words, there may be only one inquiry page P.

[0023] For example, a user can move to another inquiry page P by selecting a link displayed on the inquiry page P without entering a keyword. The inquiry page P itself may be any page that is used in known services. The inquiry page P is not limited to the example of this embodiment. For example, the inquiry page P may be a page containing content called FAQ (Frequently Asked Questions), a page where inquiries can be made via chat, or any other page. When an abnormality occurs in a service, a large number of users may access the inquiry page P. In this case, the number of accesses to the inquiry page P increases.

[0024] FIG. 3 is a diagram showing an example of a time-series change in the number of accesses to inquiry page P. The horizontal axis of FIG. 3 is the time axis. The right end of the time axis in FIG. 3 is the current time. The vertical axis of FIG. 3 is an axis showing the number of accesses to inquiry page P. In the example of FIG. 3, the number of accesses to inquiry page P has recently increased sharply. In this case, some kind of abnormality has occurred in the service, so it is possible that a large number of users are accessing inquiry page P. When server 10 detects an increase in the number of accesses to inquiry page P, it transmits a notification to administrator terminal 40 urging it to check the status of communication device 20.

[0025] FIG. 4 is a diagram showing an example of a notification displayed on the administrator terminal 40. For example, when the administrator terminal 40 receives a notification from the server 10, it causes the display unit 45 to display an administrator screen SC showing the time-series change in the number of accesses to an inquiry page P. In a case where there are multiple inquiry pages P as in the present embodiment, the administrator screen SC may display the number of accesses to each individual inquiry page P or the number of accesses to each category of inquiry pages. The administrator checks the administrator screen SC and performs maintenance on the communication device 20. The maintenance of the communication device 20 itself may be performed by a known method.

[0026] As described above, the anomaly detection system 1 detects anomalies in a service based on the number of accesses to the inquiry page P. Even if an anomaly that cannot be detected by a normal anomaly detection algorithm occurs, the anomaly detection system 1 can notify the administrator of the possibility of an anomaly occurring based on a time-series change in the number of accesses to the inquiry page P. By checking the status of the communication device 20, the administrator can become aware of the anomaly, even if it is an anomaly that cannot be detected by a normal anomaly detection algorithm. Details of the anomaly detection system 1 will be described below.

[0027] [3. Functions realized by the anomaly detection system] Fig. 5 is a diagram showing an example of functions realized by the anomaly detection system 1. Note that the functions of the communication device 20 are similar to those of known services, and therefore are omitted from Fig. 5.

[0028] [3-1. Functions realized by the server] For example, the server 10 includes a data storage unit 100, an inquiry data acquisition unit 101, and an anomaly detection unit 102. The data storage unit 100 is realized by the storage unit 12. The inquiry data acquisition unit 101 and the anomaly detection unit 102 are each realized by the control unit 11.

[0029] [Data storage section] The data storage unit 100 stores data necessary for anomaly detection. For example, the data storage unit 100 stores an inquiry database DB.

[0030] 6 is a diagram showing an example of an inquiry database DB. The inquiry database DB is a database in which inquiry data is stored. In this embodiment, access status data corresponds to inquiry data, so the access status data is stored as inquiry data in the inquiry database. An example of inquiry data other than the access status will be described in a modified example below.

[0031] For example, the inquiry database DB associates page identification information capable of identifying each of a plurality of inquiry pages P, a period to be counted, and access status data, which is an example of inquiry data. The inquiry database DB may store any data related to user inquiries. For example, the inquiry database DB may store the amount of change in the number of accesses to the inquiry page P, or an index other than the number of accesses to the inquiry page P (for example, viewing time).

[0032] In the example of Figure 6, a subdirectory in the URL of inquiry page P corresponds to the page identification information. The page identification information may be any information that can identify inquiry page P. For example, the page identification information may be the title (page name) of inquiry page P, an ID assigned to inquiry page P, or other information. The aggregation period is a time division for aggregating the number of accesses. The number of accesses is aggregated for each aggregation period. The aggregation period may be of any length. For example, the aggregation period may be 30 seconds, 1 minute, 5 minutes, 10 minutes, 30 minutes, 1 hour, or another length. The length of the aggregation period may vary depending on the time of day, day of the week, etc.

[0033] The access status data indicates the number of accesses during a period of time covered by the aggregation. For example, when the server 10 receives access to a certain inquiry page P during a certain period of time covered by the aggregation, the server 10 increments the number of accesses indicated by the access status data associated with the period of time covered by the aggregation and the inquiry page P. The number of accesses may be any index used in general access analysis. For example, the number of page views or the number of sessions may be used as the number of accesses. The access status data may be obtained using a general access analysis method.

[0034] The data stored in the data storage unit 100 is not limited to the above examples. The data storage unit 100 can store any data related to anomaly detection. For example, the data storage unit 100 stores various thresholds referenced during anomaly detection, programs required for anomaly detection processing, or other data.

[0035] [Inquiry Data Acquisition Department] The inquiry data acquisition unit 101 acquires inquiry data relating to inquiries from each of a plurality of users who use the service. In this embodiment, the inquiry data acquisition unit 101 acquires access status data relating to the access status of each of a plurality of users to an inquiry page of the service as the inquiry data.

[0036] In this embodiment, the inquiry data acquisition unit 101 refers to the inquiry database DB and acquires inquiry data. For example, the inquiry data acquisition unit 101 acquires inquiry data for a collection period that is the target of anomaly detection (for example, the most recent collection period or the most recent multiple collection periods). The inquiry data acquisition unit 101 may acquire inquiry data regardless of the collection period. The inquiry data acquisition unit 101 may acquire each of the multiple pieces of inquiry data from a computer or information storage medium other than the server 10.

[0037] In this embodiment, the inquiry data acquisition unit 101 acquires access status data relating to access status for the server 10, which is a server different from the communication device 20 that provides a service to each of the multiple users and provides an inquiry page P to each of the multiple users. The server 10 and the communication device 20 are physically different computers. Therefore, the computer for providing the service and the computer for accepting inquiries are different from each other. In this embodiment, an example is given in which the administrator who manages the server 10 and the administrator who manages the communication device 20 are the same, but these administrators may be different from each other.

[0038] The communication device 20 is an example of a service providing server. Therefore, the description of the communication device 20 can be replaced with the description of the service providing server. The service providing server may be a server computer other than the communication device 20. For example, the service providing server is a server computer accessed by the user terminal 30. The service providing server may be a server computer accessed by a computer other than the user terminal 30 when a user uses a service.

[0039] The server 10 is an example of a page providing server. Therefore, the term "server 10" can be read as "page providing server." The page providing server may be a server computer other than the server 10. For example, a query page P may be provided to a user by each of multiple server computers. That is, a server computer that manages a certain query page P may be different from a server computer that manages another query page P. Note that the service providing server and the page providing server may be the same server.

[0040] [Anomaly detection section] The anomaly detection unit 102 detects anomalies related to the service based on the inquiry data. In this embodiment, an anomaly detection criterion is set as a criterion for detecting anomalies. For example, when the inquiry data is expressed as a numerical value, the anomaly detection criterion indicates a threshold value that constitutes an anomaly. For example, the anomaly detection unit 102 detects an anomaly when the numerical value indicated by the inquiry data is equal to or greater than the threshold value that is the anomaly detection criterion. The anomaly detection criterion may be determined according to the inquiry data. Depending on the content indicated by the inquiry data, the anomaly detection unit 102 may detect an anomaly when the numerical value indicated by the inquiry data is less than the threshold value that is the anomaly detection criterion.

[0041] In this embodiment, the case where the access status data corresponds to an example of inquiry data will be taken as an example. The anomaly detection unit 102 detects an anomaly based on the access status data. For example, the anomaly detection unit 102 detects an anomaly when the number of accesses indicated by the access status data is equal to or greater than a threshold. The anomaly detection unit 102 does not detect an anomaly when the number of accesses indicated by the access status data is less than the threshold.

[0042] In the case where there are multiple inquiry pages P as in this embodiment, the anomaly detection unit 102 calculates the total value of the number of accesses indicated by the access status data of each of the multiple inquiry pages P. The total value may be a simple sum or may be calculated based on a weighting factor. The anomaly detection unit 102 detects an anomaly when the total value of the number of accesses is equal to or greater than a threshold value. The anomaly detection unit 102 does not detect an anomaly when the total value of the number of accesses is less than the threshold value.

[0043] When a collection period is set as in the present embodiment, the anomaly detection unit 102 may detect an anomaly based on the access status data for each of the multiple collection periods. For example, the anomaly detection unit 102 detects an anomaly based on a time-series change in the number of accesses indicated by the access status data for each of the multiple collection periods. The anomaly detection unit 102 calculates the amount of change (increase) between the number of accesses in a certain collection period and the number of accesses in the next collection period. The anomaly detection unit 102 detects an anomaly when the amount of change is equal to or greater than a threshold. The anomaly detection unit 102 does not detect an anomaly when the amount of change is less than the threshold. The anomaly detection unit 102 may detect an anomaly by calculating the amount of change spanning three or more collection periods.

[0044] The method by which the anomaly detection unit 102 detects anomalies is not limited to the above example. For example, the anomaly detection unit 102 may detect anomalies based on a learning model that uses a machine learning technique. In this case, the learning model learns training data that indicates the relationship between training query data and the presence or absence of an anomaly. The learning model may be any of supervised learning, semi-supervised learning, and unsupervised learning. The anomaly detection unit 102 inputs query data (query data for estimation) that is the target of anomaly detection to the learning model. The learning model calculates feature quantities of the input query data and outputs the presence or absence of an anomaly according to the feature quantities. The anomaly detection unit 102 detects anomalies by obtaining output from the learning model.

[0045] [3-2. Functions implemented on user devices] For example, the user terminal 30 includes a data storage unit 300 and an access unit 301. The data storage unit 300 is realized by the storage unit 32. The access unit 301 is realized by the control unit 31.

[0046] [Data storage section] The data storage unit 300 stores data necessary for the user to use the service and data necessary for the user to make an inquiry. For example, the data storage unit 300 stores a browser or a service-specific application. The data storage unit 300 may also store data necessary for the user to use at least one of a plurality of services.

[0047] [Access section] The access unit 301 accesses the inquiry page P based on a user operation. The access to the inquiry page P may be performed by a known method such as an HTTP request. The access unit 301 displays the inquiry page P on the display unit 35 based on the data of the inquiry page P received from the server 10.

[0048] [3-3. Functions realized on the administrator terminal] For example, the administrator terminal 40 includes a data storage unit 400, an operation reception unit 401, and a display control unit 402. The data storage unit 400 is realized by the storage unit 42. The operation reception unit 401 and the display control unit 402 are realized by the control unit 41.

[0049] [Data storage section] The data storage unit 400 stores data necessary for the administrator's work. For example, the data storage unit 400 stores data necessary for displaying the administrator screen SC. The data storage unit 400 may also store maintenance tools necessary for the administrator's work. The maintenance tools themselves may be publicly known tools, and may be, for example, tools that can monitor the status of at least one of hardware and software.

[0050] [Operation reception section] The operation reception unit 401 receives various operations by the administrator. For example, the operation reception unit 401 receives operations on the administrator screen SC.

[0051] [Display control section] The display control unit 402 causes various screens to be displayed on the display unit 45. For example, the display control unit 402 causes the display unit 45 to display an administrator screen SC.

[0052] [4. Processing performed by the anomaly detection system] FIG. 7 is a diagram showing an example of processing executed by the anomaly detection system 1. The processing of FIG. 7 is executed by the control units 11, 31, and 41 executing programs stored in the storage units 12, 32, and 42, respectively. The processing of each step in FIG. 7 is an example of a step included in the anomaly detection method according to the present disclosure. The processing of S1 to S6 is executed every time the inquiry page P is accessed. The processing of S7 to S11 is executed every time the timing for determining an anomaly detection arrives (for example, the end of the aggregation period or a timing specified by the administrator). The timing for determining an anomaly detection arrives repeatedly, either periodically or irregularly.

[0053] 7, when a user specifies the URL of inquiry page P in a browser, user terminal 30 transmits an access request for inquiry page P to server 10 (S1). When server 10 receives the access request from user terminal 30 (S2), it transmits data of inquiry page P to user terminal 30 (S3). When user terminal 30 receives the data of inquiry page P from server 10 (S4), it displays inquiry page P on display unit 35 (S5). Server 10 updates inquiry database DB so as to increase the number of accesses to inquiry page P in the aggregation period to which the current time belongs (S6).

[0054] When the time to determine whether or not an abnormality exists arrives, the server 10 acquires inquiry data for each of a plurality of aggregation periods based on the inquiry database DB (S7). The server 10 calculates the total value of the change in the number of accesses to the inquiry page P based on the inquiry data acquired in S7 (S8). The server 10 determines whether the total value calculated in S8 is equal to or greater than a threshold value (S9). If it is determined in S9 that the total value is equal to or greater than the threshold value (S9: Y), the server 10 detects a service abnormality (S10). The server 10 executes processing to display an administrator screen SC between the server 10 and the administrator terminal 40 (S11), and this processing ends. If it is determined in S9 that the change is less than the threshold value (S9: N), the server 10 does not detect a service abnormality, and this processing ends.

[0055] [5. Summary of embodiments] The anomaly detection system 1 of this embodiment acquires inquiry data related to inquiries from each of multiple users who use the service. The server 10 detects anomalies related to the service based on the inquiry data. The anomaly detection system 1 can detect anomalies based on the inquiry data, even if an anomaly that cannot be detected by a normal anomaly detection algorithm occurs, thereby improving the accuracy of anomaly detection. The anomaly detection system 1 can quickly detect anomalies even if an anomaly that cannot be detected by a normal anomaly detection algorithm occurs. For example, the anomaly detection system 1 can notify an administrator of an anomaly detected based on the inquiry data, requesting that the administrator check the status of the communication device 20. The administrator may be able to notice the anomaly even if an unknown anomaly that has never occurred before occurs.

[0056] Furthermore, the anomaly detection system 1 acquires access status data relating to the access status of each of a plurality of users to the inquiry page P as inquiry data. The anomaly detection system 1 detects anomalies based on the access status data. When an anomaly occurs in a service, it is conceivable that a user who senses something is wrong will first access the inquiry page P. By analyzing such user behavior, the anomaly detection system 1 can improve the accuracy of anomaly detection. By analyzing such user behavior, the anomaly detection system 1 can quickly detect anomalies. For example, the anomaly detection system 1 can detect anomalies based on access status data, which is easy to acquire (for example, data that can be acquired using known access analysis techniques), making it easier to build an anomaly detection mechanism.

[0057] Furthermore, the anomaly detection system 1 acquires access status data relating to the access status of the server 10, which is a server different from the communication device 20 that provides services to each of the multiple users and provides an inquiry page P to each of the multiple users. The anomaly detection system 1 can detect anomalies by analyzing the status of the server 10 that provides user support such as inquiries without providing services directly to users, rather than the status of the communication device 20 that provides services directly to users. The anomaly detection system 1 can detect anomalies that cannot be detected from the status of the communication device 20 that provides services directly to users.

[0058] [6. Modifications] The present disclosure is not limited to the above-described embodiments, and may be modified as appropriate without departing from the spirit of the present disclosure.

[0059] 8 is a diagram showing an example of functions realized by the anomaly detection system 1 of the modified example. The anomaly detection system 1 of the modified example includes an inquiry-related service identification unit 103, an inquiry count acquisition unit 104, a status data acquisition unit 105, a relevance identification unit 106, an expertise information acquisition unit 107, a campaign information acquisition unit 108, and a distribution content information acquisition unit 109. The inquiry-related service identification unit 103, the inquiry count acquisition unit 104, the status data acquisition unit 105, the relevance identification unit 106, the expertise information acquisition unit 107, the campaign information acquisition unit 108, and the distribution content information acquisition unit 109 are realized by the control unit 11.

[0060] [6-1. Variation 1] For example, the server 10 manages various inquiry pages P. For this reason, there may be a mixture of inquiry pages P that are closely related to abnormalities in the service and inquiry pages P that are not so closely related to abnormalities in the service. The index for abnormality detection may be calculated based on a calculation formula in which a weighting coefficient according to the inquiry page P is determined, rather than simply (equally) adding up the number of accesses to each of the multiple inquiry pages P. The inquiry data acquisition unit 101 of the first modification acquires access status data for each of the multiple inquiry pages P, as in the embodiment.

[0061] The anomaly detection unit 102 of the first modification calculates an index related to anomaly detection based on the access status data of each of a plurality of inquiry pages P and a calculation formula in which the coefficient of an inquiry page P that is relatively relevant to anomaly detection is higher than the coefficient of an inquiry page P that is relatively unrelated to anomaly detection, and detects anomalies based on the index. The calculation formula is assumed to be stored in the data storage unit 100. The calculation formula may be written in the anomaly detection program.

[0062] An inquiry page P that is relatively relevant to anomaly detection is a page that includes content related to anomalies. For example, a page related to troubleshooting corresponds to an inquiry page P that is relevant to anomaly detection. A page that provides directions to a call center that is the contact point for inquiries when an abnormality occurs corresponds to an inquiry page P that is relevant to anomaly detection. Information indicating whether an inquiry page P is relatively relevant to anomaly detection is assumed to be stored in the data storage unit 100. The server 10 can identify which inquiry page P is relatively relevant to anomaly detection based on the information. Information indicating which inquiry page P is relatively relevant to anomaly detection is assumed to be stored in the data storage unit 100. The server 10 identifies an inquiry page P that is relatively relevant to anomaly detection based on the information. The information may be a numerical value indicating the level of relevance to anomaly detection (for example, a level of relevance of three or more levels).

[0063] An inquiry page P that is relatively unrelated to anomaly detection is a page other than an inquiry page P that is relatively related to anomaly detection. For example, an inquiry page P that is relatively unrelated to anomaly detection is a page that does not include content related to anomalies. For example, a page that provides information about the service to beginners to the service corresponds to an inquiry page P that is relatively unrelated to anomaly detection. A page that provides information about the service's pricing plans corresponds to an inquiry page P that is relatively unrelated to anomaly detection. Information indicating which inquiry pages P are relatively unrelated to anomaly detection is assumed to be stored in the data storage unit 100. The server 10 identifies an inquiry page P that is relatively unrelated to anomaly detection based on the information.

[0064] For example, the calculation formula of variant example 1 is substituted with the number of accesses indicated by the access information data of each of the multiple inquiry pages P. A coefficient is set in the calculation formula for each inquiry page P. The more relevant the inquiry page P is to anomaly detection, the higher the coefficient of that inquiry page P. The less relevant the inquiry page P is to anomaly detection, the lower the coefficient of that inquiry page P. The anomaly detection unit 102 may determine the level of relevance of the inquiry page P based on the information described above. The anomaly detection unit 102 calculates an index for anomaly detection by substituting the number of accesses indicated by the access information data of each of the multiple inquiry pages P into the calculation formula. The index is the level of suspicion of anomaly. The higher the index, the higher the suspicion of anomaly. The lower the index, the lower the suspicion of anomaly.

[0065] For example, the anomaly detection unit 102 detects an anomaly when the index for anomaly detection is equal to or greater than a threshold. The anomaly detection unit 102 does not detect an anomaly when the index for anomaly detection is less than the threshold. The anomaly detection unit 102 may substitute the amount of change in the number of accesses into the calculation formula, rather than the number of accesses indicated by the access information data of each of the multiple inquiry pages P. The method for calculating the amount of change is as described in the embodiment. The anomaly detection unit 102 may calculate the index for anomaly detection by substituting the amount of change spanning three or more aggregation periods into the calculation formula of Modification 1.

[0066] The anomaly detection system 1 of Variation 1 calculates an index for anomaly detection based on access status data for each of a plurality of inquiry pages and a calculation formula in which the coefficient of an inquiry page P that is relatively relevant to anomaly detection is higher than the coefficient of an inquiry page P that is relatively unrelated to anomaly detection, and detects anomalies based on the index. This allows the anomaly detection system 1 to detect anomalies by taking into account the relevance of each inquiry page P to anomaly detection, thereby further improving the accuracy of anomaly detection. For example, the anomaly detection system 1 can prevent erroneous detection of an anomaly when the number of accesses to an inquiry page P for beginners (an example of an inquiry page P that is relatively unrelated to anomaly detection) increases due to a new membership campaign. The anomaly detection system 1 can more accurately detect anomalies by using an index that emphasizes the number of accesses to inquiry pages P that are particularly relevant to anomaly detection.

[0067] [6-2. Variation 2] For example, in the embodiment, an example has been given in which the access status data corresponds to the inquiry data, but the inquiry data may be data related to an inquiry made by a user. The inquiry data is not limited to the access status data. In Modification 2, other examples of inquiry data will be described. The inquiry data acquisition unit 101 of Modification 2 acquires, as inquiry data, keyword data related to keywords entered by each of a plurality of users in a search on an inquiry page P of a service.

[0068] For example, when the server 10 receives keyword data from the user terminal 30, it stores the keyword data in the inquiry database DB. In the second modification, an example is given in which keyword data is stored in the inquiry database DB for each aggregation period, but keyword data may also be stored in the inquiry database DB regardless of the aggregation period. It is assumed that the data storage unit 100 stores an index that is referenced in a search for the inquiry page P. The server 10 executes a search for the inquiry page P based on the keyword data and the index of the inquiry page P. A publicly known search engine can be used to search for the inquiry page P.

[0069] The anomaly detection unit 102 of the second modification detects an anomaly based on keyword data. For example, the data storage unit 100 stores a dictionary database in which words related to anomalies are stored. The dictionary database may be created by an administrator or by another person. For example, words such as "cannot access," "cannot connect," and "system down" are stored in the dictionary database. The anomaly detection unit 102 counts the number of hits for words in the dictionary database based on the keyword data. The anomaly detection unit 102 may count the number of hits for each counting period. The anomaly detection unit 102 detects an anomaly when the number of hits is equal to or greater than a threshold. The anomaly detection unit 102 does not detect an anomaly when the number of hits is less than the threshold.

[0070] The method by which the anomaly detection unit 102 detects anomalies based on keyword data is not limited to the above example. For example, the anomaly detection unit 102 may perform sentiment analysis on keyword data instead of using a dictionary database, and detect anomalies based on the results of the sentiment analysis. The sentiment analysis itself may be a known method. The anomaly detection unit 102 counts the number of negative keywords, which is the number of negative keywords, through sentiment analysis. The anomaly detection unit 102 detects an anomaly when the number of negative keywords is equal to or greater than a threshold. The anomaly detection unit 102 does not detect an anomaly when the number of negative keywords is less than the threshold. As another example, the anomaly detection unit 102 may input keyword data to a learning model that has learned the relationship between training keywords and the presence or absence of anomalies, and detect anomalies based on the estimation results of the learning model.

[0071] The anomaly detection system 1 of Variation 2 acquires, as inquiry data, keyword data related to keywords entered by each of multiple users in a search on the inquiry page of a service. The anomaly detection system 1 detects anomalies based on the keyword data. Because the keywords entered by users directly reflect the users' opinions, the anomaly detection system 1 can further improve the accuracy of anomaly detection by utilizing the keyword data, even if an anomaly occurs that cannot be detected by a normal anomaly detection algorithm. For example, even if a keyword related to an inquiry about content that is not provided on the inquiry page P is entered, the anomaly detection system 1 can detect an anomaly.

[0072] [6-3. Variation 3] For example, the inquiry data acquisition unit 101 may acquire, as inquiry data, message data relating to messages input by each of a plurality of users in response to a chat of the service. The chat may run on an inquiry page P, or may run in a location different from the inquiry page P. Responses to the user's messages may be input by an operator, or may be generated by a machine learning (artificial intelligence) model. The chat itself may be a type adopted in known services.

[0073] When the server 10 of the third modification receives message data from the user terminal 30, the server 10 stores the message data in the inquiry database DB. In the third modification, an example is given in which message data is stored in the inquiry database DB for each aggregation period, but message data may be stored in the inquiry database DB regardless of the aggregation period. Note that the data storage unit 100 may also store response data regarding responses to the user's message. When a user inputs multiple messages in succession, the message data for each message is stored in the inquiry database DB.

[0074] The anomaly detection unit 102 of the third modification detects an anomaly based on message data. For example, the data storage unit 100 stores a dictionary database in which words related to anomalies are stored. The dictionary database may be the same as that of the second modification. The anomaly detection unit 102 counts the number of hits for words in the dictionary database based on the message data. The anomaly detection unit 102 may count the number of hits for each counting period. The anomaly detection unit 102 detects an anomaly when the number of hits is equal to or greater than a threshold. The anomaly detection unit 102 does not detect an anomaly when the number of hits is less than the threshold.

[0075] The method by which the anomaly detection unit 102 detects anomalies based on message data is not limited to the above example. For example, the anomaly detection unit 102 may perform sentiment analysis on the message data, rather than using a dictionary database, and detect anomalies based on the results of the sentiment analysis. The sentiment analysis itself may be a known method. The anomaly detection unit 102 counts the number of negative messages, which is the number of negative messages, through sentiment analysis. The anomaly detection unit 102 detects an anomaly when the number of negative messages is equal to or greater than a threshold. The anomaly detection unit 102 does not detect an anomaly when the number of negative messages is less than the threshold. As another example, the anomaly detection unit 102 may input message data to a learning model that has learned the relationship between training messages and the presence or absence of anomalies, and detect anomalies based on the estimation results of the learning model.

[0076] The anomaly detection system 1 of Variation 3 acquires, as inquiry data, message data related to messages entered by each of multiple users in a chat service. The anomaly detection system 1 detects anomalies based on the message data. Because the messages entered by users directly reflect the users' opinions, the anomaly detection system 1 can further improve the accuracy of anomaly detection by utilizing the message data, even if an anomaly occurs that cannot be detected by a normal anomaly detection algorithm. For example, even if a message related to an inquiry about content not provided for the inquiry page P is entered, the anomaly detection system 1 can detect the anomaly.

[0077] [6-4. Variation 4] For example, the inquiry data acquisition unit 101 may acquire, as inquiry data, voice data relating to voices uttered by each of a plurality of users to a call center of a service. Inquiries to the call center may be made from the user terminal 30, or may be made from a telephone other than the user terminal 30. The voice is the content of a call between a call center operator and the user. The call center may respond to user inquiries using an automated voice instead of an operator. The voice data may represent the voice itself, or may represent text transcribed by a transcription program.

[0078] The server 10 of the fourth modification is communicably connected to a call center system via a network N. The call center system records the voice uttered by the user and generates voice data. When the server 10 receives the voice data from the call center system, it stores the voice data in an inquiry database DB. In the fourth modification, an example is given in which voice data is stored in the inquiry database DB for each aggregation period, but voice data may also be stored in the inquiry database DB regardless of the aggregation period. Note that the data storage unit 100 may also store response data regarding the operator's response to the user's inquiry. When a user makes multiple inquiries in succession, the voice data of each inquiry is stored in the inquiry database DB.

[0079] The anomaly detection unit 102 of Modification 4 detects an anomaly based on voice data. For example, if the voice data represents voice itself, the anomaly detection unit 102 may convert the voice represented by the voice data into text and then detect an anomaly. The data storage unit 100 stores a dictionary database in which words related to anomalies are stored. The dictionary database may be the same as that of Modification 2. The anomaly detection unit 102 counts the number of hits for words in the dictionary database based on the voice data. The anomaly detection unit 102 may count the number of hits for each counting period. The anomaly detection unit 102 detects an anomaly when the number of hits is equal to or greater than a threshold. The anomaly detection unit 102 does not detect an anomaly when the number of hits is less than the threshold.

[0080] The method by which the anomaly detection unit 102 detects anomalies based on voice data is not limited to the above example. For example, the anomaly detection unit 102 may perform sentiment analysis on the voice data, rather than using a dictionary database, and detect anomalies based on the results of the sentiment analysis. The sentiment analysis itself may be a known method. The anomaly detection unit 102 counts the number of negative words, which is the number of negative words, through sentiment analysis. The anomaly detection unit 102 detects an anomaly when the number of negative words is equal to or greater than a threshold. The anomaly detection unit 102 does not detect an anomaly when the number of negative words is less than the threshold. As another example, the anomaly detection unit 102 may input voice data to a learning model that has learned the relationship between training messages and the presence or absence of an anomaly, and detect an anomaly based on the estimation results of the learning model.

[0081] The anomaly detection system 1 of Variation 4 acquires, as inquiry data, voice data relating to voices spoken by each of a plurality of users to a service call center. The anomaly detection system 1 detects anomalies based on the voice data. Because the voices spoken by the users directly reflect the users' opinions, the anomaly detection system 1 can further improve the accuracy of anomaly detection by utilizing the voice data, even if an anomaly occurs that cannot be detected by a normal anomaly detection algorithm. For example, even if a voice is spoken relating to an inquiry about content that is not provided as an inquiry page P, the anomaly detection system 1 can detect the anomaly.

[0082] [6-5. Variation 5] For example, in the embodiment, an example has been given in which there is one service that is the target of anomaly detection, but there may be multiple services that are the target of anomaly detection. The inquiry data acquisition unit 101 of Modification 5 acquires inquiry data for each of the multiple services. The inquiry data for each of the multiple services may have different contents. For example, the inquiry data for a certain service A may be access status data, and the inquiry data for another service B may be voice data. The inquiry data for each of the multiple services may be any combination.

[0083] For example, the server 10 may provide each of a plurality of services to a user. A computer other than the server 10 may provide at least one of the plurality of services to a user. The server 10 may acquire inquiry data from another computer. In the inquiry database DB of the fifth modification, service identification information capable of identifying each of a plurality of services and inquiry data for the service are stored in association with each other. The inquiry data for each service may not be stored in a single inquiry database DB, but may be stored in separate inquiry database DBs. Inquiries for a plurality of services may be centrally received at a single window. In this case, the server 10 identifies which service the inquiry is for depending on the content of the inquiry.

[0084] The anomaly detection system 1 includes an inquiry-related service identification unit 103. The inquiry-related service identification unit 103 identifies an inquiry-related service related to the inquiry content indicated by the inquiry data, based on the inquiry data of each of the multiple services and a dictionary database in which words specific to each of the multiple services are registered. In Variation 5, a case will be described in which the inquiry content indicated by the inquiry data is a character string (text), but the inquiry content may also be voice.

[0085] The inquiry-related service identification unit 103 identifies at least one inquiry-related service for the inquiry data. The inquiry-related service identification unit 103 may identify multiple inquiry-related services for the inquiry data. Since some inquiry data is not related to the service that is the target of anomaly detection, the inquiry-related service identification unit 103 may not identify any inquiry-related services for the inquiry data.

[0086] For example, for each service, a determination criterion is provided to indicate that the inquiry content is related to that service. The inquiry-related service identification unit 103 determines whether the inquiry data satisfies the determination criterion for each of the multiple services. The inquiry-related service identification unit 103 determines whether the inquiry data satisfies the determination criterion. If there is a service for which the inquiry data satisfies the inquiry determination criterion, the inquiry-related service identification unit 103 identifies that service as an inquiry-related service. If there is no service for which the inquiry data satisfies the inquiry determination criterion, the inquiry-related service identification unit 103 does not identify an inquiry-related service because the inquiry data is not related to the service that is the target of anomaly detection.

[0087] The judgment criterion may be any criterion that can be judged based on the content of the inquiry (for example, text, image, or video). The judgment criterion may be any criterion. An example of a judgment criterion is that the content of the inquiry includes a word in a dictionary database. In this embodiment, the inquiry-related service identification unit 103 identifies an inquiry-related service for the inquiry data based on each of the multiple inquiry data and a dictionary database in which words specific to each of the multiple services are registered. The inquiry-related service identification unit 103 determines whether the inquiry data includes a word stored in the dictionary database of each of the multiple services.

[0088] For example, when the inquiry data includes a word stored in a dictionary database of a certain service, the inquiry-related service identifying unit 103 identifies a service in the dictionary database in which the word is stored as the inquiry-related service. When the inquiry data includes n or more words (n: an integer greater than or equal to 2) stored in the dictionary database of a certain service, the inquiry-related service identifying unit 103 may identify a service in the dictionary database in which the word is stored as the inquiry-related service. Of multiple services, the inquiry-related service identifying unit 103 may identify a service in which the inquiry data includes a relatively large number of words as the inquiry-related service.

[0089] The determination criteria may be criteria other than the dictionary database. The inquiry-related service identification unit 103 may identify an inquiry-related service based on criteria other than the dictionary database. For example, the determination criteria may be simply that the inquiry data indicates a service name, rather than a dictionary database storing multiple words. In this case, the inquiry-related service identification unit 103 identifies a service with the service name indicated by the inquiry data as the inquiry-related service. For example, if the inquiry data includes images or videos, the inquiry-related service identification unit 103 may identify the inquiry-related service by performing image analysis on the images or videos included in the inquiry data. The image analysis may be any method, such as optical character recognition or pattern matching.

[0090] For example, the judgment criterion may be the output of a learning model that uses a machine learning technique. The machine learning technique may be any of various known techniques. For example, the learning model may be created by any of supervised learning, semi-supervised learning, or unsupervised learning. The learning model may be a model used in natural language processing or image analysis. The learning model has learned training data including training inquiry data and a label indicating at least one of a plurality of services. The inquiry-related service identification unit 103 inputs the inquiry data to the learning model. The learning model calculates features of the inquiry data and outputs a label according to the features. The inquiry-related service identification unit 103 may identify the service indicated by the label as the inquiry-related service.

[0091] The anomaly detection unit 102 of Modification 5 detects an anomaly further based on an inquiry-related service. For example, if the access status data described in the embodiment is inquiry data, the anomaly detection unit 102 increases the number of accesses to a service identified as an inquiry-related service. That is, the anomaly detection unit 102 increases the number of accesses to the inquiry page P for each service. The anomaly detection unit 102 detects an anomaly in a service based on the number of accesses to each of the multiple services. For example, the anomaly detection unit 102 detects an anomaly in a service among the multiple services whose number of accesses has exceeded a threshold. As in the embodiment, the anomaly detection unit 102 may detect an anomaly in a service among the multiple services whose change in the number of accesses has exceeded a threshold. Note that, in Modification 5, inquiry data other than the access status data described in the embodiment (for example, the inquiry data described in Modifications 1 to 4) may also be used.

[0092] The anomaly detection system 1 of Variation 5 acquires inquiry data for each of a plurality of services. Based on the inquiry data for each of the plurality of services and a dictionary database in which words specific to each of the plurality of services are registered, the anomaly detection system 1 identifies inquiry-related services related to the inquiry content indicated by the inquiry data. The anomaly detection system 1 further detects anomalies based on the inquiry-related services. The anomaly detection system 1 can appropriately detect anomalies related to not only one service but also each of a plurality of services. For example, if an anomaly occurs in one of a plurality of services, even if an anomaly is not detected based on indicators such as the CPU usage rate of the server computer used by that service, a user who actually uses the service may feel uneasy. Because users sometimes make inquiries about services in real time, the anomaly detection system 1 can quickly detect anomalies by analyzing such inquiries.

[0093] [6-6. Variation 6] For example, if the anomaly detection system 1 is capable of detecting anomalies for each of a plurality of services, the inquiry data acquisition unit 101 acquires inquiry data for each of the plurality of services. This is the same as in Variation 5. The anomaly detection system 1 of Variation 6 includes an inquiry count acquisition unit 104. The inquiry count acquisition unit 104 acquires the number of inquiries, which is the number of inquiries for each of the plurality of services. The number of accesses described in the embodiments is an example of the number of inquiries. The number of messages in the chat in Variation 3 and the number of voices in Variation 4 are also examples of the number of inquiries.

[0094] The anomaly detection unit 102 of the sixth modification detects an anomaly related to a configuration specific to a service that receives a relatively large number of inquiries among multiple services. A specific configuration is a configuration (e.g., hardware or software) that is used only for a specific service. For example, the configuration specific to a service is a server computer that a user accesses to use the service, software installed on the server computer, other computers that cooperate with the server computer, or software installed on the user terminal 30. When the number of inquiries for only a specific service among multiple services is equal to or exceeds a threshold, the anomaly detection unit 102 detects an anomaly related to the configuration specific to the specific service. The anomaly detection unit 102 notifies the administrator that an anomaly in the specific configuration has been detected.

[0095] The anomaly detection system 1 of variant 6 acquires inquiry data for each of a plurality of services. The anomaly detection system 1 acquires the number of inquiries, which is the number of inquiries for each of the plurality of services. The anomaly detection system 1 detects an anomaly related to a configuration specific to a service that has a relatively large number of inquiries among the plurality of services. This allows the anomaly detection system 1 to detect that an anomaly has occurred in a configuration specific to a particular service, thereby enabling accurate estimation of the cause of the anomaly. As a result, the service in which the anomaly occurred can be restored more quickly.

[0096] [6-7. Variation 7] For example, instead of an increase in the number of inquiries for a specific service as in Variation 6, the number of inquiries for each of multiple services may increase evenly. In this case, an abnormality in a configuration common to the multiple services may be detected. The inquiry data acquisition unit 101 of Variation 7 is the same as that of Variation 6. The anomaly detection system 1 of Variation 7 includes the inquiry count acquisition unit 104 described in Variation 6.

[0097] The anomaly detection unit 102 of the seventh modification detects an anomaly related to a configuration common to the multiple services when the number of inquiries for each of the multiple services is equal to or greater than a threshold. A configuration common to the multiple services is a configuration (e.g., hardware or software) that is not used only by a specific service but is used by each of the multiple services. For example, the configuration common to the multiple services is another computer that cooperates with each server computer of the multiple services, software installed on the other computer, a computer that cooperates with the other computer, or software (e.g., a so-called super app) common to the multiple services installed on the user terminal 30. The anomaly detection unit 102 detects an anomaly related to the configuration common to the multiple services when the number of inquiries for each of the multiple services is equal to or greater than a threshold evenly. The anomaly detection unit 102 notifies the administrator that an anomaly in the common configuration has been detected.

[0098] The anomaly detection system 1 of variant 7 acquires inquiry data for each of the multiple services. The anomaly detection system 1 acquires the number of inquiries, which is the number of inquiries for each of the multiple services. When the number of inquiries for each of the multiple services is equal to or greater than a threshold, the anomaly detection system 1 detects an anomaly related to a configuration common to the multiple services. Because the anomaly detection system 1 can detect that an anomaly has occurred in a configuration common to the multiple services, it can accurately estimate the cause of the anomaly. As a result, each of the multiple services in which an anomaly has occurred can be quickly restored.

[0099] [6-8. Variation 8] For example, the anomaly detection system 1 may detect an anomaly by using not only inquiry data but also status data relating to the status of various devices such as the communication device 20. The anomaly detection system 1 of Modification 8 includes a status data acquisition unit 105. The status data acquisition unit 105 acquires status data relating to the status of devices used in the service. The device is one type of hardware described in the embodiment. For example, the device may be a server computer, a personal computer, a tablet, a smartphone, another computer, a memory, or a power supply in addition to the communication device 20.

[0100] The status data may indicate the pinpoint status of the device at a certain point in time, but in the second variant, the status data is data regarding changes in the status of the device over time. The status of the device can also be referred to as the load of the device providing the service. The status of the device may refer to the hardware status or the software status. For example, the status of the device may be communication volume, CPU usage, memory usage, power consumption, communication speed, temperature, or a combination of these. The status of the device may be an index known as golden signal metrics or other indexes used in known benchmark tests. The method of acquiring the status data of the device may also be a known method.

[0101] The data storage unit 100 of the eighth modification stores status data acquired from a device such as the communication device 20. The status data acquisition unit 105 acquires the status data stored in the data storage unit 100. The status data acquisition unit 105 may acquire status data from each system of a plurality of services. For example, the status data acquisition unit 105 periodically requests status data from each system of a plurality of services. Each system transmits the latest status data to the server 10 in response to the request. The status data acquisition unit 105 periodically acquires the latest status data from each system.

[0102] The anomaly detection unit 102 of the eighth modification detects an anomaly further based on the status data. For example, the anomaly detection unit 102 detects an anomaly when a numerical value indicated by the status data is equal to or greater than a threshold. The anomaly detection unit 102 may also detect an anomaly when an amount of change in the numerical value indicated by the status data is equal to or greater than a threshold. The anomaly detection unit 102 may also detect an anomaly by inputting a time-series change in the status data into a model created using a machine learning technique.

[0103] For example, the anomaly detection unit 102 may determine that an anomaly has occurred when an anomaly is detected by both the anomaly detection method based on inquiry data described in the embodiment and the anomaly detection method based on status data described in Modification 8. The anomaly detection unit 102 may determine that an anomaly has occurred when an anomaly is detected by either the anomaly detection method based on inquiry data described in the embodiment or the anomaly detection method based on status data described in Modification 8. It is assumed that information indicating to which service the device from which the status data was obtained belongs is stored in the data storage unit 100. The anomaly detection unit 102 may detect an anomaly in the service associated with certain status data when, for example, a numerical value indicated by the status data is equal to or greater than a threshold value.

[0104] The anomaly detection system 1 of Variation 8 acquires status data relating to the status of devices used in the service. The anomaly detection system 1 detects anomalies further based on the status data. By using both the inquiry data and the device status data, the anomaly detection system 1 can improve the accuracy of detecting anomalies.

[0105] [6-9. Variation 9] For example, there are various devices used to provide services. Some of the status data in Variation 8 is related to anomalies, while others are not so related to anomalies. Therefore, the server 10 may identify status data that is related to the inquiry data from among the various status data. Hereinafter, this status data will be referred to as association data. The server 10 may detect an anomaly based on the association data among the multiple status data. Status data other than the association data is not used in anomaly detection.

[0106] The anomaly detection system 1 of the ninth modification includes a correlation identification unit 106. The correlation identification unit 106 identifies state data that is correlated with inquiry data from among a plurality of state data. The correlation identification unit 106 identifies correlated data that is correlated with inquiry data from among the plurality of state data. The correlation is a correlation between inquiry data. For example, if an increase in the inquiry data is equal to or greater than a threshold, the increase in the state data is also equal to or greater than the threshold, then there is a correlation between the inquiry data and the state data. If a decrease in the inquiry data is equal to or greater than a threshold, then there is a correlation between the inquiry data and the state data.

[0107] For example, if the time difference between the time when the inquiry data changes and the time when the status data changes is less than a threshold, the inquiry data and the status data are related. If the time difference between the time when the inquiry data changes and the time when the status data changes steadily falls within a predetermined range, the inquiry data and the status data are related. For example, the relationship identification unit 106 calculates the time-series change in the number of inquiries for each service based on each of the multiple pieces of inquiry data. This calculation method is as described in the embodiment.

[0108] For example, the relationship identification unit 106 performs clustering of the time-series changes in the number of inquiries for each of the multiple services and the time-series changes in the status indicated by each of the multiple status data, based on a known clustering method. The clustering can be performed based on a known method. For example, the relationship identification unit 106 performs clustering based on k-means clustering, hierarchical clustering, DBSCAN clustering, or another clustering method. The relationship identification unit 106 performs clustering so that items with similar time-series changes belong to the same cluster. The relationship identification unit 106 identifies, from the multiple status data, status data that belongs to the same cluster as the time-series change in the number of inquiries for a certain service as related data that is related to the inquiry data for that service.

[0109] The anomaly detection unit 102 of the modification 9 detects an anomaly based on correlated state data from among the plurality of state data. The anomaly detection unit 102 does not refer to state data that is not correlated data from among the plurality of state data when detecting an anomaly. The modification 9 is different in that state data identified as correlated data from among the plurality of state data is used for anomaly detection, but is otherwise similar to the anomaly detection unit 102 of the modification 8.

[0110] The anomaly detection system 1 of the ninth modification identifies, from a plurality of pieces of state data, state data that is related to the inquiry data. The anomaly detection system 1 detects an anomaly based on the related state data from the plurality of pieces of state data. By detecting an anomaly based on the state data that is related to the inquiry data, the anomaly detection system 1 can improve the accuracy of detecting an anomaly.

[0111] [6-10. Variation 10] For example, as in Modifications 2 to 4, when a user inputs the content of an inquiry, the inquiry data may contain highly specialized words that directly indicate an abnormality, such as "traffic," "access," or "system failure." Such inquiry data is considered to be particularly useful for detecting an abnormality. Therefore, the server 10 may detect an abnormality by placing more importance on inquiry data that contains highly specialized words than on other inquiry data.

[0112] The anomaly detection system 1 of Variation 10 includes an expertise information acquisition unit 107. The expertise information acquisition unit 107 acquires expertise information regarding the expertise of words included in each of the multiple pieces of inquiry data. The expertise information indicates the degree of expertise of the words. Variation 10 takes as an example a case where the expertise information is expressed numerically, but the expertise information may also be expressed as letters or symbols. In Variation 10, the higher the numerical value indicated by the expertise information, the higher the expertise. The expertise information of the words may be stored in the dictionary database described in Variation 2, etc., or may be stored in a database other than the dictionary database.

[0113] The anomaly detection unit 102 of the tenth modification detects anomalies based on the expertise information of each of a plurality of pieces of inquiry data. For example, when a piece of inquiry data includes a word associated with expertise information, the anomaly detection unit 102 increases the index of anomaly detection based on the expertise indicated by the expertise information associated with the word. The anomaly detection unit 102 calculates the index of anomaly detection so that the higher the expertise indicated by the expertise information, the higher the index of anomaly detection. In the second modification and other modifications, an example was given in which the index of anomaly detection increases by 1 regardless of the content of a piece of inquiry data. However, in the tenth modification, if the expertise indicated by the expertise information is high, the index of anomaly detection for a piece of inquiry data increases by a value of 2 or more.

[0114] For example, suppose the expertise information indicates three levels of expertise. If the inquiry data contains a word with an expertise level of 3, the anomaly detection unit 102 increases the anomaly detection index by 3 for each piece of inquiry data. If the inquiry data contains a word with an expertise level of 2, the anomaly detection unit 102 increases the anomaly detection index by 2 for each piece of inquiry data. If the inquiry data contains a word with an expertise level of 1, the anomaly detection unit 102 increases the anomaly detection index by 1 for each piece of inquiry data.

[0115] The anomaly detection system 1 of Variation 10 acquires expertise information regarding the expertise of words included in each of the multiple pieces of inquiry data. The anomaly detection system 1 detects anomalies based on the expertise information for each of the multiple pieces of inquiry data. This enables the anomaly detection system 1 to detect anomalies by placing emphasis on inquiry data that include more specialized words, thereby improving the accuracy of anomaly detection.

[0116] [6-11. Variation 11] For example, if a campaign is being held for a certain service, inquiries may increase even if no abnormality has occurred in the service. In this case, there is a possibility that the inquiries may become noise for anomaly detection. For this reason, the server 10 may change the criteria for anomaly detection, taking into account whether or not a campaign is being held.

[0117] The anomaly detection system 1 of the eleventh modification includes a campaign information acquisition unit 108. The campaign information acquisition unit 108 acquires campaign information related to campaigns in services. The campaign information indicates identification information of the service for which the campaign is being held and the period during which the campaign is being held. The campaign information may also indicate the content of the campaign. The campaign information is assumed to be stored in the data storage unit 100. The campaign information may be registered in the data storage unit 100 by an administrator, or may be registered in the data storage unit 100 by another person.

[0118] The anomaly detection unit 102 of the eleventh modification detects an anomaly further based on campaign information. For example, the anomaly detection unit 102 determines whether a campaign is being held for the service that is the target of anomaly detection, based on the campaign information. The anomaly detection unit 102 increases the threshold for detecting an anomaly for the service for which it is determined that a campaign is being held. During the campaign period, the anomaly detection unit 102 detects an anomaly based on the increased threshold. Although the method for determining the threshold differs from the embodiment, other points are similar to the embodiment.

[0119] The anomaly detection system 1 of Variation 11 acquires campaign information related to a campaign for a service. The anomaly detection system 1 detects anomalies further based on the campaign information. This allows the anomaly detection system 1 to detect anomalies while taking into account noise that may occur due to the holding of a campaign, and therefore can appropriately detect anomalies even when a campaign is held.

[0120] [6-12. Variation 12] For example, a service that is the subject of anomaly detection may be introduced in a distribution service such as a television program, online video distribution, or live distribution. In this case, inquiries may increase even if no abnormality occurs in the service. In this case, there is a possibility that the inquiries may become noise for anomaly detection. For this reason, the server 10 may change the criteria for anomaly detection, taking into account the content of the distribution service.

[0121] The anomaly detection system 1 of the 12th modification includes a distribution content information acquisition unit 109. The distribution content information acquisition unit 109 acquires distribution content information related to the distribution content of a distribution service that can distribute information related to services. The distribution content information indicates the distribution date and time of the distribution service and the distribution content of the distribution service. The distribution content information is assumed to be stored in the data storage unit 100. The distribution content information may be registered in the data storage unit 100 by an administrator, or may be registered in the data storage unit 100 by another person. In the 12th modification, the distribution content information indicates whether the content is related to a service that is the target of anomaly detection.

[0122] The anomaly detection unit 102 of the twelfth modification detects an anomaly based on distribution content information. For example, the anomaly detection unit 102 determines whether or not the service for which anomaly detection is to be performed is introduced in the distribution service based on the distribution content information. When it is determined that the service for which anomaly detection is to be performed is introduced in the distribution service, the anomaly detection unit 102 increases the threshold for detecting an anomaly of the service. During the distribution period or periods before and after the period, the anomaly detection unit 102 detects an anomaly based on the increased threshold. Although the method for determining the threshold differs from that of the embodiment, other points are similar to those of the embodiment.

[0123] The anomaly detection system 1 of Variation 12 acquires distribution content information about the distribution content of a distribution service that can distribute information about the service. The anomaly detection system 1 detects anomalies based on the distribution content information. This allows the anomaly detection system 1 to perform anomaly detection that takes into account noise that may be generated by distribution in the distribution service, and therefore can appropriately detect anomalies even when distribution in the distribution service is being performed.

[0124] [6-13. Other variations] For example, the above modifications may be combined.

[0125] For example, in the embodiment, the case where the main processing is executed by the server 10 has been described, but the processing described as being executed by the server 10 may be executed by the administrator terminal 40 or another computer. The processing described as being executed by the server 10 may be shared among multiple computers.

[0126] For example, if the inquiry-related service identification unit 103 is unable to identify the service, it may identify the post as an inquiry related to the service based on the posting time, operation information indicating the service provision status of the service, maintenance information indicating the time periods when the service is unavailable on the service side, promotion information indicating advertising activities such as commercials or news on the service side indicating the time periods when the service is scheduled to be provided, or system alert information on the service side, and for example, if the time the inquiry was made matches the operation hours (service provision hours) of the service side.

[0127] [7. Notes] For example, the anomaly detection system can be configured as follows. (1) an inquiry data acquisition unit that acquires inquiry data relating to inquiries made by each of a plurality of users who use the service; an anomaly detection unit that detects an anomaly related to the service based on the inquiry data; Anomaly detection systems, including: (2) the inquiry data acquisition unit acquires, as the inquiry data, access status data relating to an access status of each of the plurality of users to an inquiry page of the service; the anomaly detection unit detects the anomaly based on the access status data. (1) An anomaly detection system according to the present invention. (3) the inquiry data acquisition unit acquires the access status data relating to the access status to a page providing server that is a server different from a service providing server that provides the service to each of the plurality of users and that provides the inquiry page to each of the plurality of users; (2) An anomaly detection system according to the present invention. (4) the inquiry data acquisition unit acquires the access status data for each of the plurality of inquiry pages; the anomaly detection unit calculates an index related to the anomaly detection based on the access status data of each of the plurality of inquiry pages and a calculation formula in which a coefficient of the inquiry page relatively related to anomaly detection is higher than a coefficient of the inquiry page relatively not related to anomaly detection, and detects the anomaly based on the index; An anomaly detection system according to (2) or (3). (5) the inquiry data acquisition unit acquires, as the inquiry data, keyword data relating to a keyword input by each of the plurality of users in a search on an inquiry page of the service; the anomaly detection unit detects the anomaly based on the keyword data; The anomaly detection system according to any one of (1) to (4). (6) the inquiry data acquisition unit acquires, as the inquiry data, message data relating to a message input by each of the plurality of users in response to a chat of the service; The abnormality detection unit detects the abnormality based on the message data. The anomaly detection system according to any one of (1) to (5). (7) the inquiry data acquisition unit acquires, as the inquiry data, voice data relating to voices uttered by each of the plurality of users from a call center of the service; The abnormality detection unit detects the abnormality based on the voice data. The anomaly detection system according to any one of (1) to (6). (8) the inquiry data acquisition unit acquires the inquiry data for each of the plurality of services; the anomaly detection system further includes an inquiry-related service identification unit that identifies an inquiry-related service related to an inquiry content indicated by the inquiry data, based on the inquiry data for each of the plurality of services and a dictionary database in which words specific to each of the plurality of services are registered; the anomaly detection unit detects the anomaly further based on the inquiry-related service; The anomaly detection system according to any one of (1) to (7). (9) the inquiry data acquisition unit acquires the inquiry data for each of the plurality of services; the anomaly detection system further includes an inquiry number acquisition unit that acquires an inquiry number, which is the number of inquiries for each of the plurality of services; the anomaly detection unit detects the anomaly related to a configuration specific to the service for which the number of inquiries is relatively large among the plurality of services; The anomaly detection system according to any one of (1) to (8). (10) the inquiry data acquisition unit acquires the inquiry data for each of the plurality of services; the anomaly detection system further includes an inquiry number acquisition unit that acquires an inquiry number, which is the number of inquiries for each of the plurality of services; the anomaly detection unit detects the anomaly related to a configuration common to the plurality of services when the number of inquiries for each of the plurality of services is equal to or greater than a threshold; The anomaly detection system according to any one of (1) to (9). (11) the anomaly detection system further includes a status data acquisition unit that acquires status data relating to a status of a device used in the service; the abnormality detection unit detects the abnormality further based on the status data. The anomaly detection system according to any one of (1) to (10). (12) the anomaly detection system further includes a correlation specifying unit that specifies, from the plurality of status data, the status data that is correlated with the inquiry data; the abnormality detection unit detects the abnormality based on the correlated status data among the plurality of status data. (11) An anomaly detection system according to (11). (13) the anomaly detection system further includes an expertise information acquisition unit that acquires expertise information regarding expertise of words included in each of the plurality of pieces of inquiry data; the anomaly detection unit detects the anomaly based on the expertise information of each of the plurality of inquiry data. The anomaly detection system according to any one of (1) to (12). (14) the anomaly detection system further includes a campaign information acquisition unit that acquires campaign information related to a campaign in the service; the anomaly detection unit detects the anomaly further based on the campaign information. The anomaly detection system according to any one of (1) to (13). (15) the anomaly detection system further includes a distribution content information acquisition unit that acquires distribution content information related to distribution content in a distribution service that can distribute information related to the service; The anomaly detection unit detects the anomaly based on the distribution content information. The anomaly detection system according to any one of (1) to (14).

Claims

1. an inquiry data acquisition unit that acquires, as inquiry data related to inquiries by each of a plurality of users who use the service, access status data related to access status of each of the plurality of users to an inquiry page of the service, the access status data for each of the plurality of inquiry pages; an anomaly detection unit that calculates an index related to the anomaly detection based on the access status data of each of the plurality of inquiry pages and a calculation formula in which a coefficient of the inquiry page that is relatively relevant to anomaly detection is higher than a coefficient of the inquiry page that is relatively not relevant to anomaly detection, and detects an anomaly related to the service based on the index; Anomaly detection systems, including:

2. An inquiry data acquisition unit that acquires inquiry data relating to inquiries from each of a plurality of users who use a service, the inquiry data being for each of the plurality of services; an inquiry-related service identifying unit that identifies an inquiry-related service related to the inquiry content indicated by the inquiry data based on the inquiry data for each of the plurality of services and a dictionary database in which words specific to each of the plurality of services are registered; an anomaly detection unit that detects an anomaly related to the service based on the inquiry data and the inquiry-related service; Anomaly detection systems, including:

3. An inquiry data acquisition unit that acquires inquiry data relating to inquiries from each of a plurality of users who use a service, the inquiry data being for each of the plurality of services; an inquiry number acquisition unit that acquires an inquiry number, which is the number of inquiries for each of the plurality of services, based on the inquiry data for each of the plurality of services; an anomaly detection unit that detects an anomaly related to a configuration common to the plurality of services when the number of inquiries for each of the plurality of services is equal to or greater than a threshold; Anomaly detection systems, including:

4. An inquiry data acquisition unit that acquires inquiry data regarding inquiries made by each of a plurality of users who use the service; a status data acquisition unit that acquires status data relating to the status of a device used in the service; a correlation specifying unit that specifies, from among the plurality of status data, the status data that is correlated with the inquiry data; an anomaly detection unit that detects an anomaly related to the service based on the associated status data among the plurality of status data; Anomaly detection systems, including:

5. An inquiry data acquisition unit that acquires inquiry data regarding inquiries made by each of a plurality of users who use the service; a technicality information acquisition unit that acquires technicality information related to the technicality of words included in each of the plurality of pieces of inquiry data; an anomaly detection unit that detects an anomaly related to the service based on the expertise information of each of the plurality of inquiry data; Anomaly detection systems, including:

6. the inquiry data acquisition unit acquires the access status data relating to the access status to a page providing server that is a server different from a service providing server that provides the service to each of the plurality of users and that provides the inquiry page to each of the plurality of users; The anomaly detection system according to claim 1 .

7. the inquiry data acquisition unit acquires, as the inquiry data, keyword data relating to a keyword input by each of the plurality of users in a search on an inquiry page of the service; the anomaly detection unit detects the anomaly based on the keyword data; The anomaly detection system according to any one of claims 2 to 5.

8. the inquiry data acquisition unit acquires, as the inquiry data, message data relating to a message input by each of the plurality of users in response to a chat of the service; The abnormality detection unit detects the abnormality based on the message data. The anomaly detection system according to any one of claims 2 to 5.

9. the inquiry data acquisition unit acquires, as the inquiry data, voice data relating to voices uttered by each of the plurality of users from a call center of the service; The abnormality detection unit detects the abnormality based on the voice data. The anomaly detection system according to any one of claims 2 to 5.

10. the inquiry data acquisition unit acquires the inquiry data for each of the plurality of services; the anomaly detection system further includes an inquiry number acquisition unit that acquires an inquiry number, which is the number of inquiries for each of the plurality of services; the anomaly detection unit detects the anomaly related to a configuration specific to the service for which the number of inquiries is relatively large among the plurality of services; The anomaly detection system according to any one of claims 1 to 6.

11. the anomaly detection system further includes a campaign information acquisition unit that acquires campaign information related to a campaign in the service; the anomaly detection unit detects the anomaly further based on the campaign information. The anomaly detection system according to any one of claims 1 to 6.

12. the anomaly detection system further includes a distribution content information acquisition unit that acquires distribution content information related to distribution content in a distribution service that can distribute information related to the service; The anomaly detection unit detects the anomaly based on the distribution content information. The anomaly detection system according to any one of claims 1 to 6.

13. an inquiry data acquisition step of acquiring, as inquiry data relating to inquiries by each of a plurality of users using the service, access status data relating to access status of each of the plurality of users to an inquiry page of the service, the access status data for each of the plurality of inquiry pages; an anomaly detection step of calculating an index related to the anomaly detection based on the access status data of each of the plurality of inquiry pages and a calculation formula in which a coefficient of the inquiry page relatively related to anomaly detection is higher than a coefficient of the inquiry page relatively not related to anomaly detection, and detecting an anomaly related to the service based on the index; An anomaly detection method comprising:

14. an inquiry data acquisition unit that acquires, as inquiry data related to inquiries made by each of a plurality of users using the service, access status data related to access status of each of the plurality of users to an inquiry page of the service, the access status data for each of the plurality of inquiry pages; an anomaly detection unit that calculates an index related to the anomaly detection based on the access status data of each of the plurality of inquiry pages and a calculation formula in which a coefficient of the inquiry page that is relatively relevant to anomaly detection is higher than a coefficient of the inquiry page that is relatively not relevant to anomaly detection, and detects an anomaly related to the service based on the index; A program that allows a computer to function as a

Images