Information processing method, information processing program, and information processing device

Abstract

To provide an information processing method or the like capable of quickly responding to detection of unknown abnormalities.SOLUTION: An information processing method causes a computer to execute processing for acquiring data to be analyzed, inputting the acquired data to be analyzed into a learning model that outputs a plurality of feature quantities from the input data, calculating an analysis result from the plurality of feature quantities of the data to be analyzed based on a weight for each of the plurality of feature quantities, and outputting the calculated analysis result.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present invention relates to an information processing method for outputting analysis results based on a plurality of feature quantities for data to be analyzed. [Background technology]

[0002] Systems for detecting anomalous phenomena have been proposed. As an example of detecting anomalous phenomena, a system for detecting anomalies in document content has been proposed. For example, Patent Document 1 proposes a data analysis device that compares the financial data of multiple companies to identify data obtained as a result of window dressing or the like as an abnormal value. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2006-252259 Summary of the Invention [Problem to be solved by the invention]

[0004] The data analysis described in Patent Document 1 compares data from multiple companies to detect data anomalies. Therefore, even if the analyzed company improves its business performance or falls into a slump for legitimate reasons, the data may be detected as an anomaly.

[0005] On the other hand, anomaly detection using learning models may fail to detect anomalous data that has trends different from those of the training data used during learning. To address this issue, a method called HITL (Human in the Loop) has been proposed, in which the behavior of a learning model is manually controlled. In HITL, when controlling a learning model, the labels in the existing training data are re-trained. Re-training using a small amount of re-labeled data may not be able to respond quickly to changes. This is because if only a small amount of re-labeling is performed due to constraints on labor and speed, or if it is unclear which labels to re-label, it is difficult to effectively control the model output. Furthermore, if the existing training data does not contain anything similar to the new data, it is difficult to effectively control the model output.

[0006] The present invention has been made in view of the above circumstances, and its purpose is to provide an information processing method and the like that can quickly respond to the detection of unknown abnormalities. [Means for solving the problem]

[0007] An information processing method according to one aspect of the present application includes acquiring data to be analyzed, and processing the data from input data. Abnormality from multiple perspectives The acquired data to be analyzed is input into a learning model that outputs the Abnormality from multiple perspectives Based on the weighting of each, The anomaly levels from multiple perspectives output by the learning model from ,indicates whether the data being analyzed is abnormal or not. Calculates the analysis results and outputs the calculated analysis results The method receives from an expert a determination result as to whether the data to be analyzed is abnormal and a viewpoint that should be noted when determining whether the data to be analyzed is abnormal, and if the analysis result and the determination result differ, corrects the weight corresponding to the viewpoint that should be noted, recalculates the analysis result based on the corrected weight, and corrects the weight until the analysis result and the determination result match. The processing is performed by a computer. [Effects of the Invention]

[0008] According to one aspect of the present application, it is possible to quickly respond to the detection of an unknown abnormality. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is an explanatory diagram illustrating an example of the configuration of a detection system. [Figure 2] FIG. 2 is a block diagram showing the hardware configuration of a detection server. [Figure 3] FIG. 2 is a block diagram showing a hardware configuration of a monitoring terminal. [Figure 4] FIG. 10 is an explanatory diagram illustrating an example of a detection model. [Figure 5] FIG. 10 is an explanatory diagram illustrating an example of a weight DB. [Figure 6] 10 is a flowchart illustrating an example of a procedure for a generation process. [Figure 7] 10 is a flowchart illustrating an example of a procedure for a detection process. [Figure 8] 10 is a flowchart illustrating an example of a procedure for adjustment processing. [Figure 9] FIG. 10 is an explanatory diagram showing another example of a detection model. [Figure 10] 10 is a flowchart illustrating another example of the procedure of the detection process. [Figure 11] FIG. 10 is an explanatory diagram showing an example of a weight adjustment screen. [Figure 12] FIG. 10 is an explanatory diagram showing another example of a detection model. [Figure 13] 10 is a flowchart illustrating an example of a procedure for a re-learning process. DETAILED DESCRIPTION OF THE INVENTION

[0010] The following describes an embodiment with reference to the drawings. FIG. 1 is an explanatory diagram showing an example of the configuration of a detection system. The detection system 100 includes a detection server 1 and a monitoring terminal 2. The detection server 1 and the monitoring terminal 2 are connected to each other via a network N so that they can communicate with each other. The detection server 1 detects abnormalities in data. The monitoring terminal 2 is a terminal used to monitor the operation of the detection server 1 and to periodically verify whether the judgments made by the detection server 1 are appropriate.

[0011] The detection server 1 is configured as a server computer, a workstation, a PC (Personal Computer), etc. The detection server 1 may also be configured as a multi-computer consisting of multiple computers, a virtual machine virtually constructed by software, or a quantum computer. Furthermore, the functions of the detection server 1 may be realized as a cloud service.

[0012] The monitoring terminal 2 is configured as a notebook computer, a tablet computer, a smartphone, etc. Although only one monitoring terminal 2 is shown in FIG. 1, there may be two or more monitoring terminals.

[0013] 2 is a block diagram showing the hardware configuration of the detection server 1. The detection server 1 includes a control unit 11, a main memory unit 12, an auxiliary memory unit 13, a communication unit 15, and a reading unit 16. The control unit 11, the main memory unit 12, the auxiliary memory unit 13, the communication unit 15, and the reading unit 16 are connected by a bus B.

[0014] The control unit 11 has one or more arithmetic processing devices such as a central processing unit (CPU), a micro-processing unit (MPU), a graphics processing unit (GPU), etc. The control unit 11 reads and executes a control program 1P (program, program product) stored in the auxiliary storage unit 13, thereby performing various information processing, control processing, etc. related to the detection server 1, and realizing functional units such as an acquisition unit, an input unit, a reception unit, and an output unit.

[0015] The main memory unit 12 is a static random access memory (SRAM), a dynamic random access memory (DRAM), a flash memory, etc. The main memory unit 12 mainly temporarily stores data required for the control unit 11 to execute arithmetic processing.

[0016] The auxiliary storage unit 13 is a hard disk or an SSD (Solid State Drive), etc., and stores the control program 1P and various DBs (Databases) required for the control unit 11 to execute processing. The auxiliary storage unit 13 stores an analysis target DB 131, a determination result DB 132, a weight DB 133, etc. The auxiliary storage unit 13 also stores a detection model 14. The auxiliary storage unit 13 may be an external storage device connected to the detection server 1. The various DBs, etc. stored in the auxiliary storage unit 13 may be stored in a database server or cloud storage different from the detection server 1.

[0017] The communication unit 15 communicates with the monitoring terminal 2 via the network N. In addition, the control unit 11 may use the communication unit 15 to download the control program 1P from another computer via the network N or the like and store it in the auxiliary storage unit 13.

[0018] The reading unit 16 reads the portable storage medium 1a including a CD (Compact Disc)-ROM and a DVD (Digital Versatile Disc)-ROM. The control unit 11 may read the control program 1P from the portable storage medium 1a via the reading unit 16 and store it in the auxiliary storage unit 13. The control unit 11 may also read the control program 1P from the semiconductor memory 1b.

[0019] 3 is a block diagram showing the hardware configuration of the monitoring terminal 2. The monitoring terminal 2 includes a control unit 21, a main memory unit 22, an auxiliary memory unit 23, a communication unit 24, an input unit 25, and a display unit 26. Each component is connected by a bus B.

[0020] The control unit 21 has one or more arithmetic processing units such as a CPU, an MPU, a GPU, etc. The control unit 21 provides various functions by reading and executing a control program 2P (program, program product) stored in the auxiliary storage unit 23.

[0021] The main memory unit 22 is an SRAM, a DRAM, a flash memory, etc. The main memory unit 22 mainly temporarily stores data necessary for the control unit 21 to execute arithmetic processing.

[0022] The auxiliary storage unit 23 is a hard disk or an SSD, etc., and stores various data necessary for the control unit 21 to execute processing. The auxiliary storage unit 23 may be an external storage device connected to the monitoring terminal 2. The various DBs, etc. stored in the auxiliary storage unit 23 may be stored in a database server or cloud storage.

[0023] The communication unit 24 communicates with the detection server 1 via the network N. In addition, the control unit 21 may use the communication unit 24 to download the control program 2P from another computer via the network N or the like, and store it in the auxiliary storage unit 23.

[0024] The input unit 25 is a keyboard and a mouse. The display unit 26 includes a liquid crystal display panel or the like. The display unit 26 displays the determination results output by the detection server 1. The input unit 25 and the display unit 26 may be integrated to form a touch panel display. The monitoring terminal 2 may display on an external display device.

[0025] FIG. 4 is an explanatory diagram showing an example of a detection model. The detection model 14 receives multiple sets of values ​​as input, determines whether the combination of values ​​in the sets of values ​​is normal or abnormal, and outputs the result. In the following description, the detection model 14 detects, for example, a company's window dressing. The detection model 14 may determine whether a value is normal or abnormal on medical data (detecting anomalies in vital signs monitors, detecting anomalies in clinical tests, etc.), insurance application data (detecting fraudulent claims in medical insurance claims, etc.), factory operation data (detecting operational anomalies, failure detection, and falsification of product inspection data based on production machine logs, etc.). The detection model 14 receives financial data such as sales, gross profit margins, liabilities, and assets as input, and outputs a determination result of whether a combination of these values ​​is normal or abnormal. If an abnormality is detected, it is possible that the values ​​have been artificially altered.

[0026] The detection model 14 includes an unsupervised learning model 141, a supervised learning model 142, and an attention mechanism 143. The unsupervised learning model 141 discriminates whether input data (data to be analyzed) is known or unknown, and outputs the discrimination result. Here, the known / unknown discrimination corresponds to determining whether the input data was used as training data for the supervised learning model 142 (whether the input data is similar to the data used). For example, the unsupervised learning model 141 is implemented with k-Nearest Neighbor (k-NN), Gaussian Mixture Model (GMM), Auto Encoder (AE), etc. The unsupervised learning model 141 derives a deviation score between the input data and past data used as training data. The unsupervised learning model 141 determines that the input data is unknown data when the derived deviation score is equal to or greater than a predetermined threshold, and determines that the input data is known data when the deviation score is smaller than the threshold. Note that the learning model 141 may also be a supervised learning model. In this case, training data is created in which the input data is labeled as known or unknown, and supervised learning is performed using the created training data to generate the learning model 141.

[0027] The supervised learning model 142 receives financial data as input and outputs the degree of anomaly for each feature. Note that the degree of anomaly does not necessarily have to be a single numerical value, but may be a vector representing the degree of anomaly from multiple perspectives. The supervised learning model 142 performs deep learning to learn the features of the financial data, thereby generating a learning model that receives financial data as input and outputs the degree of anomaly for each of multiple perspectives that indicate anomaly. The supervised learning model 142 is configured using a logistic regression model, gradient boosting, multilayer perceptron, etc. Note that the input data does not have to be data from a certain point in time, but may also be time-series data. Image data or audio data may also be used as input data.

[0028] The anomaly degree for each perspective output from the intermediate layer (extraction layer) of the supervised learning model 142 is input to the attention mechanism 143. It is desirable that the perspective corresponds to the input data. Here, the anomaly degrees for four perspectives corresponding to the input data, namely, sales, gross profit margin, liabilities, and assets, are input to the attention mechanism 143. The attention mechanism 143 calculates a weighted sum of each anomaly degree. The attention mechanism 143 determines whether the data is normal or abnormal based on the calculated sum, and outputs the result (analysis result) from the output layer. The normal or abnormal determination is performed, for example, as follows: if the calculated sum is equal to or greater than a predetermined threshold, it is determined to be abnormal, and if the calculated sum is less than the predetermined threshold, it is determined to be normal. The attention mechanism 143 calculates a weighted sum of each anomaly degree, but it may also calculate a value obtained by weighting and multiplying each anomaly degree.

[0029] As mentioned above, it is desirable for the perspective to correspond to the input data because this makes it easier to determine how to reflect the expert's advice in the weights. For example, if the expert advises that more attention should be paid to liabilities compared to other values, the weight for liabilities can be increased relatively. Therefore, as long as the weights can be easily adjusted based on the expert's advice, the perspective does not need to correspond one-to-one to the input data. For example, if the input data includes sales and total assets, the intermediate layer may output the anomaly degree for total asset turnover in addition to the anomaly degrees for sales and total assets. This is because the total asset turnover is calculated from sales and total assets, and therefore its relationship with the input data is clear.

[0030] FIG. 5 is an explanatory diagram showing an example of a weight DB. The weight DB 133 stores weights used by the attention mechanism 143. The weight DB 133 includes an ID column, a classification column, a date and time column, an operation column, a sales column, a gross profit margin column, a liability column, and an asset column. The ID column stores an ID that identifies a set of weights. The classification column stores the classification of input data that uses the weight. The date and time column stores the date and time when the weight was defined. The operation column stores whether or not the weight is used in operation. The sales column, gross profit margin column, liability column, and asset column store weights for sales, gross profit margin, liability, and asset, respectively.

[0031] Next, the information processing performed in the detection system 100 will be described. FIG. 6 is a flowchart showing an example of the procedure of the generation processing. The generation processing is processing for generating a supervised learning model 142 and an attention mechanism 143. The control unit 11 of the detection server 1 acquires training data (step S1). The training data includes financial data to be input and labels (correct values) indicating whether the financial data is normal or abnormal. The control unit 11 trains the unsupervised learning model 141 using the financial data included in the training data (step S2).

[0032] Furthermore, the control unit 11 performs training of the supervised learning model 142 using the training data (step S3). The control unit 11 inputs financial data, which is the training data, to the input layer of the supervised learning model 142, and acquires a judgment result from the output layer after undergoing arithmetic processing in the intermediate layer and processing in the attention mechanism 143. The judgment result output from the output layer may be a discrete value (for example, a value of "0" or "1") or a continuous probability value (for example, a value ranging from "0" to "1").

[0033] The control unit 11 compares the output judgment result with the label of the training data, i.e., the correct value, and optimizes parameters such as the coupling coefficients between neurons used in the calculation process in the intermediate layer and the coefficients of the activation function, as well as the weights used by the attention mechanism 143, so that the judgment result output by the attention mechanism 143 approaches the correct value. There are no particular limitations on the method for optimizing the parameters and weights, but for example, the control unit 11 optimizes various parameters and weights using the backpropagation method.

[0034] The control unit 11 repeatedly executes steps S2 and S3 depending on the number of data in the training data. The control unit 11 stores the learning results (step S4) and ends the process. Thereafter, abnormal financial data is detected using the learned detection model 14.

[0035] FIG. 7 is a flowchart showing an example of the detection process procedure. The detection process is a process of detecting abnormal financial data using a trained detection model 14. The control unit 11 of the detection server 1 acquires input data to be processed from the analysis target DB 131 (step S11). The control unit 11 determines whether the input data is known or unknown using the unsupervised learning model 141 (step S12). The control unit 11 determines whether the input data is normal / abnormal using the supervised learning model 142 (step S13). The control unit 11 outputs the result (step S14) and ends the process. The output result is preferably a determination result of whether the input data is known / unknown, along with the normal / abnormal determination result. The output result is stored in the determination result DB 132. If the input data is determined to be unknown, the reliability of the normal / abnormal determination result is considered to be low, so the normal / abnormal determination is preferably performed by a person such as an expert.

[0036] Furthermore, if the normality / abnormality judgment result of input data determined to be unknown differs from the judgment made by the expert, there is a possibility that the detection model 14 will make an incorrect judgment of normality / abnormality when similar financial data is subsequently input, so the detection model 14 is adjusted. When making the adjustment, an expert is asked to verify the unknown data. Advice is obtained from the expert regarding matters that should be noted when judging whether the unknown data is normal or abnormal. Based on the advice, the weights of the attention mechanism 143 are changed. Specifically, the weights for the perspectives that correspond to the matters that should be noted pointed out by the expert are changed.

[0037] FIG. 8 is a flowchart showing an example of the adjustment process. The control unit 11 of the detection server 1 modifies the weight of the attention mechanism 143 (step S21). The weight modification step is set to a small value. If the weight value is between 0 and 1, the modification step is set to, for example, 0.001. The control unit 11 performs verification (step S22). The control unit 11 inputs unknown data into the detection model 14 after modifying the weight of the attention mechanism 143, and obtains a determination result. The control unit 11 determines whether the determination result is correct (step S23). If the control unit 11 determines that the determination result is incorrect (NO in step S23), it modifies the weight (step S21). For example, if the weight was increased by 0.001 the first time, it is further increased by 0.001 the second time. If the control unit 11 determines that the determination result is correct (YES in step S23), it stores the modified weight (step S24) and ends the process. It is desirable to newly store the attention mechanism 143 with adjusted weights without overwriting it. Then, the detection model 14 is changed so that both the attention mechanism 143 before and after the adjustment can be used.

[0038] Fig. 9 is an explanatory diagram showing another example of a detection model. The detection model 14 shown in Fig. 9 includes an unsupervised learning model 141, a supervised learning model 142, a first attention mechanism 1431, a second attention mechanism 1432, and a selection mechanism 144. Comparing the detection model 14 shown in Fig. 9 with the detection model 14 shown in Fig. 4, the attention mechanism 143 is composed of two mechanisms: a first attention mechanism 1431 and a second attention mechanism 1432, and a selection mechanism 144 that switches between the two attention mechanisms is added. The first attention mechanism 1431 is an attention mechanism generated by learning, and the second attention mechanism 1432 is an attention mechanism whose weights are adjusted based on unknown data.

[0039] FIG. 10 is a flowchart showing another example of the detection process. The detection process shown in FIG. 10 is a process using the detection model shown in FIG. 9. The control unit 11 of the detection server 1 acquires input data (step S31). The control unit 11 inputs the input to the supervised learning model 142 and determines whether the input data is known (step S32). If the control unit 11 determines that the input data is known (YES in step S32), it selects an attention mechanism for known data (step S33). The control unit 11 controls the selection mechanism 144 so that the anomaly levels for multiple perspectives output by the supervised learning model 142 are input to the first attention mechanism 1431. If the control unit 11 does not determine that the input data is known (NO in step S32), it selects an attention mechanism for unknown data (step S34). The control unit 11 controls the selection mechanism 144 so that the anomaly levels for multiple perspectives output by the supervised learning model 142 are input to the second attention mechanism 1432. The control unit 11 makes a determination (step S35). The control unit 11 acquires the determination result output by the first attention mechanism 1431 or the second attention mechanism 1432. The control unit 11 outputs the determination result (step S36).

[0040] This embodiment provides the following advantages. In conventional technology, in order to handle unknown data for which an accurate normal / abnormal determination cannot be performed, it is necessary to retrain the supervised learning model 142. Because processing using a certain amount of training data is required, the operation of the detection system 100 must be stopped for a significant period of time. However, this embodiment adjusts the attention mechanism 143 to handle unknown data, thereby making it possible to shorten the time that the operation of the detection system 100 is stopped.

[0041] In the above description, in order to deal with unknown data, rather than adjusting the weights of the attention mechanism 143, re-learning may be performed. The procedure is as follows: Change the weights for the perspectives corresponding to the noteworthy matters pointed out by the experts. Re-learn the attention mechanism 143 with the changed weights using training data. Use the detection model 14 using the re-learned attention mechanism 143 to determine whether the input data is normal or abnormal.

[0042] In the above description, input data is classified as unknown or known, and two attention mechanisms are switched based on the classification results, but this is not limited to this. During learning, the unsupervised learning model 141 clusters the input data to obtain multiple classifications. An attention mechanism is prepared corresponding to each classification, and each is trained. During operation, the unsupervised learning model 141 determines the classification of the input data, and an anomaly is detected using the attention mechanism corresponding to the determined classification.

[0043] When an attention mechanism is prepared for each classification, if the unsupervised learning model 141 cannot determine which classification the input data belongs to, it is determined to be unknown data. Then, a new attention mechanism is added to process the unknown data.

[0044] FIG. 11 is an explanatory diagram showing an example of the weight adjustment screen. The weight adjustment screen includes a current display 111, input data 112, judgment result 113, slider 114, save button 115, overwrite box 116, and cancel button 117. The current display 111 displays the weight currently being used. If there are multiple sets of weights currently being used, the set of weights to be edited or referenced is displayed. The input data 112 displays the unknown data that was used to adjust the weight. The judgment result 113 displays the judgment result using the current weight. The weight can be changed using the slider 114. When the save button 115 is selected, the weight set using the slider 114 is stored in the weight DB 133. At this time, if the overwrite box 116 is not checked, it is saved as a new value. If the overwrite box 116 is checked, the weight is overwritten. When the cancel button 117 is selected, the user returns to the previous screen or the weight adjustment screen is closed.

[0045] As another example of the detection model 14, a case where the attention mechanism 143 learns weights will be described. FIG. 12 is an explanatory diagram showing another example of the detection model. The detection model 14 includes a supervised learning model 142, an attention mechanism 143, a product-sum operation unit 145, and a threshold determination unit 146. The attention mechanism 143 (attention model) is a model that performs supervised learning. The attention mechanism 143 receives the output of the supervised learning model 142 as input data and outputs weights (w1, w2, w3, w4) corresponding to the output of the supervised learning model 142. The supervised learning model 142 is similar to that described above, so its description will be omitted. The product-sum operation unit 145 weights the output value of the supervised learning model 142 based on the output of the attention mechanism 143, and calculates a judgment value. The threshold determination unit 146 compares the judgment value with a predetermined threshold and performs binarization of the judgment result as 0 (normal) or 1 (abnormal). 12, the number of output nodes of the supervised learning model 142 is four, the same as the number of items in the input data, but is not limited to this. The number of output nodes may be two, three, or five or more. Furthermore, if an expert has adjusted the weights to (w1', w2', w3', w4'), these weight values ​​may be used as teachers in the learning of the attention mechanism 143, and may be learned simultaneously with the degree of anomaly.

[0046] When generating the detection model 14, various parameters of the supervised learning model 142 are optimized based on the training data, and various parameters of the attention mechanism 143 are also optimized.

[0047] During operation of the detection model 14, the normal / abnormal judgment results of the detection model 14 are randomly extracted and verified by an expert. If any judgment results by the detection model 14 differ from those by the expert, training data for re-learning is generated by associating the output of the supervised learning model 142, which is input data to the attention mechanism 143, with the weights to be output by the attention mechanism 143. FIG. 13 is a flowchart showing an example of the re-learning process procedure. The control unit 11 selects training data (step S41). The control unit 11 performs learning (step S42). The control unit 11 inputs the output of the supervised learning model 142 included in the training data to the attention mechanism 143. The control unit 11 compares the weights output by the attention mechanism 143 with the correct data included in the training data, and optimizes parameters such as the coupling coefficients between neurons used in calculation processing in the intermediate layer and the coefficients of the activation function so that the weights output by the attention mechanism 143 approach the correct values. The control unit 11 determines whether there is unprocessed training data (step S43). If the control unit 11 determines that there is unprocessed training data (YES in step S43), the process returns to step S41 and re-learning is performed using the unprocessed training data. If the control unit 11 determines that there is no unprocessed training data (NO in step S43), the control unit 11 stores the optimized parameters (step S44) and ends the process.

[0048] When using the detection model 14 shown in FIG. 12, if unknown data is discovered during operation, the unknown data can be handled simply by re-learning the attention mechanism 143.

[0049] The technical features (constituent elements) described in each embodiment can be combined with each other, and by combining them, new technical features can be formed. The embodiments disclosed herein are to be considered as illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0050] 100 Detection System 1. Detection Server 11 Control section 12 Main memory 13 Auxiliary storage 131 Analysis target DB 132 Judgment result DB 133 Weight DB 14 Detection Model 141 Learning Model 142 Learning Model 143 Attention mechanism 1431 1st Attention Mechanism 1432 2nd Attention Mechanism 144 Selection Mechanism 15 Communications Department 16 Reading unit 1P control program 1a Portable storage media 1b semiconductor memory 2. Monitoring terminal 21 Control section 22 Main memory 23 Auxiliary storage 24 Communications Department 25 Input section 26 Display section 2P control program B Bus N Network

Claims

1. Obtain the data to be analyzed, The acquired data to be analyzed is input into a learning model that outputs the degree of anomaly from multiple perspectives based on the input data. calculating an analysis result indicating whether the data to be analyzed is abnormal or not from the degrees of anomaly from the multiple perspectives output by the learning model based on the weights for each of the degrees of anomaly from the multiple perspectives; Output the calculated analysis results, Accepting from the expert a determination result as to whether the data to be analyzed is abnormal or not and a viewpoint that should be noted when determining whether the data to be analyzed is abnormal or not; If the analysis result and the determination result differ, modify the weight corresponding to the notable aspect; recalculating the analysis results based on the modified weights; Modifying the weights until the analysis result and the determination result match. An information processing method characterized in that the processing is executed by a computer.

2. The acquired data to be analyzed is input to a second learning model that determines whether the input data is a known type of data or an unknown type of data; If the second learning model determines that the data to be analyzed is data of an unknown type, a determination result of whether the data to be analyzed is abnormal or not and a viewpoint that should be noted when determining whether the data to be analyzed is abnormal or not are received from the expert.

2. The information processing method according to claim 1,

3. a plurality of sets of weights are obtained, each set being a weight for each of the anomaly degrees from the plurality of viewpoints; Store multiple sets of weights obtained 3. The information processing method according to claim 1 or 2.

4. When the analysis target data is determined to be of a known type, a set of weights associated with the determined type is obtained; If the data to be analyzed is determined to be of an unknown type, a weight for each of the anomaly degrees from the multiple viewpoints is accepted.

3. The information processing method according to claim 2.

5. When data to be analyzed is input, the acquired data to be analyzed is input to an attention model that outputs weights for the anomaly degrees from the multiple viewpoints; Obtain weights from the attention model 2. The information processing method according to claim 1,

6. Obtain the data to be analyzed, The acquired data to be analyzed is input into a learning model that outputs the degree of anomaly from multiple perspectives based on the input data. calculating an analysis result indicating whether the data to be analyzed is abnormal or not from the degrees of anomaly from the multiple perspectives output by the learning model based on the weights for each of the degrees of anomaly from the multiple perspectives; Output the calculated analysis results, Accepting from the expert a determination result as to whether the data to be analyzed is abnormal or not and a viewpoint that should be noted when determining whether the data to be analyzed is abnormal or not; If the analysis result and the determination result differ, modify the weight corresponding to the notable aspect; recalculating the analysis results based on the modified weights; Modifying the weights until the analysis result and the determination result match. An information processing program that causes a computer to execute a process.

7. an acquisition unit that acquires data to be analyzed; an input unit that inputs the acquired data to be analyzed into a learning model that outputs anomaly levels from multiple perspectives based on the input data; a calculation unit that calculates an analysis result indicating whether the analysis target data is abnormal or not from the degrees of abnormality from the multiple perspectives output by the learning model based on weights for each of the degrees of abnormality from the multiple perspectives; an output unit that outputs the calculated analysis results; a receiving unit that receives, from the expert, a determination result as to whether the analysis target data is abnormal or not and a viewpoint that should be noted when determining whether the analysis target data is abnormal or not; a correction unit that corrects the weight corresponding to the notable aspect when the analysis result and the determination result differ, the calculation unit recalculates the analysis result based on the modified weight; The correction unit corrects the weights until the analysis result and the determination result match.

1. An information processing device comprising:

Images