Anomaly detection system, anomaly detection method, and program

Abstract

A post data acquisition unit (101) of an abnormality detection system (1) acquires each of a plurality of post data sets on a social networking service (SNS). From among a plurality of services to be subject to abnormality detection, a post-related services identification unit (102) identifies a post-related service that is related to each of the plurality of post data sets. An emotion analysis execution unit (103) executes emotion analysis on each of the plurality of post data sets. An abnormality detection unit (104) detects an abnormality related to each of the plurality of services on the basis of: the post-related service identified for each of the plurality of post data sets; and the result of the emotion analysis executed for each of the plurality of post data sets.

Description

Technical Field

[0001] The present disclosure relates to an anomaly detection system, an anomaly detection method, and a program.

Background Art

[0002] Conventionally, techniques for detecting anomalies related to services used by users have been studied. For example, Patent Document 1 describes an anomaly detection device that determines whether posted data in an SNS (Social Networking Service) contains a negative expression. The anomaly detection device of Patent Document 1 determines that posted data containing a predetermined keyword does not contain a negative expression. The anomaly detection device of Patent Document 1 detects an anomaly when the number of posts containing a negative expression at the current time increases by a predetermined threshold or more compared to the number of posts containing a negative expression in a predetermined past time.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, since the anomaly detection device of Patent Document 1 is intended to detect an anomaly in a single service, it cannot be applied to a case where there are multiple services to be detected for anomalies. For this reason, the anomaly detection device of Patent Document 1 cannot detect an anomaly related to each of a plurality of services based on each of a plurality of posted data in an SNS when there are a plurality of services to be detected for anomalies.

[0005] One object of the present disclosure is to appropriately detect an anomaly related to each of a plurality of services to be detected for anomalies.

Means for Solving the Problems

[0006] The anomaly detection system relating to this disclosure includes: a post data acquisition unit that acquires each of a plurality of post data in a social networking service (SNS); a post-related service identification unit that identifies a post-related service related to each of the plurality of post data from among a plurality of services that are the target of anomaly detection; a sentiment analysis execution unit that performs sentiment analysis on each of the plurality of post data; and an anomaly detection unit that detects anomalies relating to each of the plurality of services based on the post-related service identified for each of the plurality of post data and the results of the sentiment analysis performed on each of the plurality of post data. [Effects of the Invention]

[0007] According to this disclosure, anomalies can be appropriately detected for each of the multiple services that are subject to anomaly detection. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows an example of the hardware configuration of an anomaly detection system. [Figure 2] This figure shows an example of a submission database where submitted data is stored. [Figure 3] This figure shows an example of the time-series change in the number of negative posts. [Figure 4] This figure shows an example of the administrator screen displayed on the management tool. [Figure 5] This figure shows an example of the functions implemented by the anomaly detection system. [Figure 6] This is a diagram showing an example of a dictionary database. [Figure 7] This figure shows an example of an anomaly detection database. [Figure 8] This figure shows an example of the process performed by the anomaly detection system. [Figure 9] This figure shows an example of the functions implemented in the modified anomaly detection system. [Modes for carrying out the invention]

[0009] [1. Hardware configuration of the anomaly detection system] An example of an embodiment of the anomaly detection system, anomaly detection method, and program related to this disclosure will be described. Figure 1 is a diagram showing an example of the hardware configuration of the anomaly detection system. For example, the anomaly detection system 1 includes an anomaly detection server 10, an SNS (Social networking service) server 20, a user terminal 30, and an administrator terminal 40. Each of the anomaly detection server 10, SNS server 20, user terminal 30, and administrator terminal 40 is connectable to a network N. For example, network N is the internet, a public communication line, or a LAN.

[0010] The anomaly detection server 10 is a server computer. In this embodiment, the anomaly detection server 10 is managed by an administrator responsible for anomaly detection. The administrator may be the service provider that is the target of anomaly detection, or it may be another party different from the service provider. For example, the anomaly detection server 10 includes a control unit 11, a storage unit 12, and a communication unit 13. The control unit 11 includes at least one processor. The storage unit 12 includes at least one of volatile memory such as RAM and non-volatile memory such as flash memory. The communication unit 13 includes at least one of a communication interface for wired communication and a communication interface for wireless communication.

[0011] The SNS server 20 is a server computer. The SNS server 20 is managed by the SNS operating company. In this embodiment, we take the example of a case where the SNS operating company is different from the administrator, but the SNS operating company may be the same as the administrator. For example, the SNS server 20 includes a control unit 21, a storage unit 22, and a communication unit 23. The hardware configuration of the control unit 21, the storage unit 22, and the communication unit 23 may be the same as that of the control unit 11, the storage unit 12, and the communication unit 13, respectively.

[0012] User terminal 30 is a computer belonging to a user who uses at least one of several services subject to anomaly detection, as well as the SNS. The user may use all of the services or only some of them. Each of the services is provided by a computer not shown in Figure 1. This computer is connected to network N. For example, the user may operate user terminal 30 to connect to this computer and use the service. The user may also use the service without operating user terminal 30 in particular.

[0013] For example, the user terminal 30 is a smartphone, tablet, personal computer, or wearable device. For example, the user terminal 30 includes a control unit 31, a storage unit 32, a communication unit 33, an operation unit 34, and a display unit 35. The hardware configurations of the control unit 31, the storage unit 32, and the communication unit 33 may be the same as those of the control unit 11, the storage unit 12, and the communication unit 13, respectively. The operation unit 34 is an input device such as a touch panel or a mouse. The display unit 35 is a display such as a liquid crystal or organic EL.

[0014] The administrator terminal 40 is the administrator's computer. For example, the administrator terminal 40 is a smartphone, tablet, personal computer, or wearable device. For example, the administrator terminal 40 includes a control unit 41, a storage unit 42, a communication unit 43, an operation unit 44, and a display unit 45. The hardware configuration of the control unit 41, storage unit 42, communication unit 43, operation unit 44, and display unit 45 may be the same as that of the control unit 11, storage unit 12, communication unit 13, operation unit 34, and display unit 35, respectively.

[0015] Note that the programs stored in the storage units 12, 22, 32, and 42 may be supplied via the network N. Each computer may also include at least one of a reading unit (e.g., a memory card slot) for reading a computer-readable information storage medium and an input / output unit (e.g., a USB port) for inputting / outputting data to / from an external device. For example, the program stored in the information storage medium may be supplied via at least one of the reading unit and the input / output unit.

[0016] Also, the abnormality detection system 1 may include at least one computer. The computers included in the abnormality detection system 1 are not limited to the example of FIG. 1. For example, the abnormality detection system 1 may include only the abnormality detection server 10. In this case, each of the SNS server 20, the user terminal 30, and the administrator terminal 40 exists outside the abnormality detection system 1. The abnormality detection system 1 may include only the abnormality detection server 10 and the administrator terminal 40. In this case, each of the SNS server 20 and the user terminal 30 exists outside the abnormality detection system 1. The abnormality detection system 1 may include other computers not shown in FIG. 1.

[0017] [2. Outline of Abnormality Detection System] In the present embodiment, the abnormality detection system 1 detects an abnormality regarding each of a plurality of services by analyzing post data regarding posts on the SNS. An abnormality is a state that deviates from a predetermined standard. An abnormality is a state where a user cannot use a service or a state where it is difficult for a user to use a service. A failure is one aspect of an abnormality. An abnormality may include a state before developing into a failure.

[0018] An abnormality occurs in at least one of the hardware and software used for service provision. In a service, an abnormality may occur in any hardware. For example, an abnormality may occur in a server computer, a personal computer, a tablet, a smartphone, other computers, communication devices, cables, memories, power supplies, or other hardware. Similarly, for software, an abnormality may occur in any software.

[0019] For example, when an abnormality occurs in a service, a user may post on an SNS indicating that an abnormality has occurred in the service. Such a post may include negative expressions regarding the service. Since various posts are made on the SNS, even if a user makes a post including a negative expression, the post may not be related to the service abnormality. Further, even if a user makes any post regarding the service, the post may not be related to the service abnormality.

[0020] FIG. 2 is a diagram showing an example of a post database in which post data is stored. For example, the storage unit 12 of the abnormality detection server 10 stores the post database DB1. In the example of FIG. 2, in the post database DB1, post identification information (in FIG. 2, "No" indicating a record of the post database DB1) that can identify individual post data and the post data are stored in an associated manner. The post data indicates the post date and time, the poster, and the post content. Note that the post database DB1 may be stored in the storage unit 22 of the SNS server 20.

[0021] For example, when a user operates the user terminal 30 and makes a new post to the SNS, the SNS server 20 generates post identification information for that new post. The SNS server 20 generates post data indicating the current date and time of posting, the user who made the post, and the content of the new post. The SNS server 20 associates the generated post identification information and post data with each other and records them in the storage unit 22. The anomaly detection server 10 retrieves post data for various posts from the SNS server 20 and stores it in the post database DB1.

[0022] For example, the anomaly detection server 10 determines whether the content of a post is related to a service by determining whether the content of the post data contains words related to the service. For example, if anomalies are detected in three services, such as the online shopping service "AAA Shopping," the financial service "BBB Bank," and the communication service "CCC Mobile," then if a post contains the names of these services, it will be determined that the post is related to the service with those names.

[0023] For example, when a post is made about a certain service, the anomaly detection server 10 performs sentiment analysis on the content of the post. In this embodiment, if the content of the post contains negative expressions, the anomaly detection server increases the number of negative posts. The number of negative posts serves as an indicator for anomaly detection. The number of negative posts is calculated for each service that is subject to anomaly detection. The higher the number of negative posts for a service, the more negative posts are being made about that service on the SNS.

[0024] In this embodiment, the anomaly detection server 10 calculates the number of negative posts for each service for each aggregation period that is subject to aggregation. The length of the aggregation period may be any length. For example, the aggregation period may be 10 seconds, 30 seconds, 1 minute, 5 minutes, 10 minutes, 1 hour, or any other length. The anomaly detection server 10 detects anomalies based on the time-series changes in the number of negative posts for each service during the aggregation period.

[0025] Figure 3 shows an example of the time-series change in the number of negative posts. In the example in Figure 3, there are three services that are subject to anomaly detection. The number of services subject to anomaly detection can be any number. The number of services subject to anomaly detection is not limited to three. For example, there may be two services subject to anomaly detection, or four or more. In this embodiment, we give an example where there are multiple services subject to anomaly detection, but there may be just one service subject to anomaly detection.

[0026] For example, the anomaly detection server 10 aggregates the number of negative posts for each of the following services: the online shopping service "AAA Shopping," the financial service "BBB Bank," and the telecommunications service "CCC Mobile." In the example shown in Figure 3, around 10:00 AM on August 1, 2023, the number of negative posts for the online shopping service "AAA Shopping" increased sharply. The number of negative posts for the financial service "BBB Bank" and the telecommunications service "CCC Mobile" remained relatively unchanged.

[0027] In the example shown in Figure 3, the anomaly detection server 10 detects an anomaly in the online shopping service "AAA Shopping" around 10:00 AM on August 1, 2023. The anomaly detection server 10 sends a notification to the administrator terminal 40 indicating that an anomaly has been detected in the online shopping service "AAA Shopping". Upon receiving the notification, the administrator terminal 40 issues an alert to the administrator. The administrator opens the management tool installed on the administrator terminal 40 to check the status of the online shopping service "AAA Shopping".

[0028] Figure 4 shows an example of an administrator screen displayed on the management tool. For example, the administrator screen SC displays the time-series changes in the number of negative posts for each service. When the administrator checks the administrator screen SC, they check the status of the online shopping service "AAA Shopping" and perform recovery work as needed. Recovery work for abnormalities that occur in the service may be performed using publicly known methods. For example, the administrator checks the CPU load rate, memory usage, or communication volume of the server computer for the online shopping service "AAA Shopping" from the administrator screen SC and performs maintenance work.

[0029] As described above, the anomaly detection system 1 identifies the service related to the content of the post data from among multiple services. Hereafter, this service will be referred to as the post-related service. The anomaly detection system 1 performs sentiment analysis on the content of the post data. Based on the identification of the post-related service and the results of the sentiment analysis, the anomaly detection system 1 detects anomalies. By utilizing posts on social networking services, the anomaly detection system 1 can appropriately detect anomalies related to each of the multiple services. The details of the anomaly detection system 1 will be explained below.

[0030] [3. Functions realized by the anomaly detection system] Figure 5 shows an example of the functions implemented by the anomaly detection system 1.

[0031] [3-1. Functions implemented by the anomaly detection server] For example, the anomaly detection server 10 includes a data storage unit 100, a post data acquisition unit 101, a post-related service identification unit 102, a sentiment analysis execution unit 103, and an anomaly detection unit 104. The data storage unit 100 is implemented by a storage unit 12. Each of the post data acquisition unit 101, the post-related service identification unit 102, the sentiment analysis execution unit 103, and the anomaly detection unit 104 is implemented by a control unit 11.

[0032] [Data Storage Unit] The data storage unit 100 stores a posting database DB1, a dictionary database DB2, and an anomaly detection database DB3. An example of the posting database DB1 is shown in Figure 2. The posting database DB1 may store arbitrary data related to SNS posts. The data stored in the posting database DB1 is not limited to the example in Figure 2. For example, the posting database DB1 may store posting data from each of multiple SNS. That is, the anomaly detection system 1 may detect anomalies in each of multiple services by analyzing the posting data from each of the multiple SNS.

[0033] Figure 6 shows an example of the dictionary database DB2. The dictionary database DB2 is a database that stores service-specific terms. Service-specific terms are terms that allow a service to be inferred. A term may be a single word or consist of multiple words. For example, service-specific terms may be the service name, an abbreviation of the service name, the name of the service provider, an abbreviation of the service provider's name, the content of the service, or the location where the service is provided.

[0034] In this embodiment, the data storage unit 100 stores the dictionary database DB2 for each of the multiple services. That is, for each service, a dictionary database DB2 is prepared that stores words specific to that service. For example, suppose there are three dictionary databases: one for the online shopping service "AAA Shopping", one for the financial service "BBB Bank", and one for the communication service "CCC Mobile".

[0035] Figure 6 shows an example of a dictionary database DB2 for the online shopping service "AAA Shopping". The dictionary database DB2 in Figure 6 stores words specific to the online shopping service "AAA Shopping," such as "AAA Shopping," "AAA," "shopping cart," "shipping fee," "order," and "product." The dictionary database DB2 may be prepared by the administrator or by another party. The dictionary database DB2 may contain words that frequently appear on the product pages of the online shopping service "AAA Shopping."

[0036] For example, the dictionary database DB2 for the financial service "BBB Bank" stores words such as "BBB Bank," "BBB," "transfer," "ATM," "online banking," and "bank." The dictionary database DB2 for the communication service "CCC Mobile" stores words such as "CCC Mobile," "CCC," "radio waves," "smartphone," "base station," and "antenna." If another service becomes the target of anomaly detection, the dictionary database DB2 for that other service stores words specific to that other service. In this way, the data storage unit 100 stores the dictionary database DB2 for each of the multiple services.

[0037] Furthermore, the dictionary databases DB2 of multiple services may be integrated into one. In this case, the integrated dictionary database DB2 shall store service identification information that can identify which service each word belongs to. The posting-related service identification unit 102, described later, identifies the posting-related service by referring to the service identification information associated with a word when the content of a posting data contains a word stored in the integrated dictionary database DB2.

[0038] Figure 7 shows an example of an anomaly detection database DB3. The anomaly detection database DB3 is a database that stores data related to anomaly detection for each of multiple services. For example, the anomaly detection database DB3 stores service identification information, aggregation period, and the number of negative posts. The anomaly detection database DB3 may store arbitrary data related to anomaly detection. For example, the anomaly detection database DB3 may store the change in the number of negative posts, or other indicators other than the number of negative posts.

[0039] In the example in Figure 7, the service name corresponds to the service identification information. The service identification information can be any information that can identify an individual service. For example, the service identification information may be the service ID, the service provider name, or other information. In the example in Figure 7, the aggregation period is shown to be 1 minute, but as mentioned above, the aggregation period can be of any length. The aggregation period may also differ for each service. The number of negative posts is calculated by the anomaly detection unit 104, which will be described later.

[0040] The data stored in the data storage unit 100 is not limited to the examples above. The data storage unit 100 can store any data related to anomaly detection. For example, the data storage unit 100 can store various thresholds referenced during anomaly detection, programs necessary for anomaly detection processing, or other data.

[0041] [Data acquisition section for submitted posts] The post data acquisition unit 101 acquires each of multiple post data from the SNS (Social Networking Service). In this embodiment, the post data acquisition unit 101 refers to the post database DB1 and acquires each of the multiple post data. For example, the post data acquisition unit 101 acquires post data whose posting time falls within the aggregation period. The post data acquisition unit 101 may acquire post data regardless of the aggregation period. The post data acquisition unit 101 may acquire each of the multiple post data from a computer other than the anomaly detection server 10 (for example, the SNS server 20) or an information storage medium.

[0042] [Department for Identifying Posting-Related Services] The post-related service identification unit 102 identifies the post-related service associated with each of the multiple post data from among the multiple services that are subject to anomaly detection. In this embodiment, the case in which the post content indicated by the post data is a string (text) is described, but the post content may also be an image or a video. The post content may be a combination of two or more of the string, image, and video. The post content indicated by the post data may include not only the body of the post but also information indicating the classification of the post, such as a hashtag.

[0043] The posting-related service identification unit 102 identifies at least one posting-related service for each post data. The posting-related service identification unit 102 may also identify multiple posting-related services for each post data. Since SNS also contains posting data that is not related to the service being detected for anomalies, the posting-related service identification unit 102 may not identify any posting-related services for each post data.

[0044] For example, each service has its own set of criteria to indicate whether the content is related to that service. The posting-related service identification unit 102 determines whether the posted data satisfies the criteria for each of the multiple services. The posting-related service identification unit 102 determines whether the posted data satisfies the criteria. If there is a service for which the posted data satisfies the posting criteria, the posting-related service identification unit 102 identifies that service as a posting-related service. If there is no service for which the posted data satisfies the posting criteria, the posting-related service identification unit 102 does not identify it as a posting-related service because the posted data is unrelated to the service targeted for anomaly detection.

[0045] The criteria for determination can be any criteria that can be determined based on the content of the post (e.g., text, images, or videos). The criteria for determination can be arbitrary. One example of a criterion is that the content of the post contains words from the dictionary database DB2. In this embodiment, the post-related service identification unit 102 identifies the post-related service for each of the multiple post data based on each of the multiple post data and the dictionary database DB2 in which words specific to each of the multiple services are registered. The post-related service identification unit 102 determines whether or not the post data contains words stored in the dictionary database DB2 of each of the multiple services.

[0046] For example, the posting-related service identification unit 102 identifies the service of the dictionary database DB2 in which a word is stored as a posting-related service if the posted data contains a word stored in the dictionary database DB2 of a certain service. The posting-related service identification unit 102 may also identify the service of the dictionary database DB2 in which a word is stored as a posting-related service if the posted data contains n (n: an integer of 2 or more) or more words stored in the dictionary database DB2 of a certain service. The posting-related service identification unit 102 may also identify a service among several services in which the posted data contains a relatively large number of words as a posting-related service.

[0047] The criteria for determination may be other than those of the dictionary database DB2. The posting-related service identification unit 102 may identify posting-related services based on criteria other than those of the dictionary database DB2. For example, instead of using the dictionary database DB2 which stores multiple words, the criterion may simply be that the posting data indicates a service name. In this case, the posting-related service identification unit 102 identifies the service indicated by the service name in the posting data as a posting-related service. For example, if the posting data includes an image or video, the posting-related service identification unit 102 may identify the posting-related service by performing image analysis on the image or video included in the posting data. The image analysis may be any method such as optical character recognition or pattern matching.

[0048] For example, the judgment criteria may be the output of a learning model that utilizes machine learning techniques. The machine learning techniques may be various known techniques. For example, the learning model may be created using supervised learning, semi-supervised learning, or unsupervised learning. The learning model may be a model used in natural language processing or image analysis. The learning model is trained on training data that includes training post data and labels indicating at least one of several services. The post-related service identification unit 102 inputs the post data to the learning model. The learning model calculates the features of the post data and outputs labels corresponding to those features. The post-related service identification unit 102 may identify the service indicated by the label as a post-related service.

[0049] [Emotional Analysis Execution Department] The sentiment analysis execution unit 103 performs sentiment analysis on each of the multiple posted data. Sentiment analysis is the process of analyzing the feelings of the poster. Various known methods can be used for sentiment analysis itself. In this embodiment, the sentiment analysis execution unit 103 performs dictionary-based sentiment analysis as an example, but the sentiment analysis execution unit 103 may perform machine learning-based, pattern-based, or rule-based sentiment analysis. In this embodiment, the sentiment analysis execution unit 103 analyzes whether the posted data is negative or not based on a known sentiment analysis method as an example. The sentiment analysis execution unit 103 may also analyze whether the posted data is positive or not based on a known sentiment analysis method.

[0050] For example, the sentiment analysis execution unit 103 performs sentiment analysis on the content of a post by determining whether each of the multiple post data contains a negative expression. A negative expression is a word that indicates a negative meaning. The negative expression itself may be an expression used in known sentiment analysis methods. The sentiment analysis execution unit 103 determines whether the post data contains a negative expression based on a negative expression database, which is a dictionary in which negative expressions are stored. The sentiment analysis execution unit 103 identifies the post data that contains a negative expression. The sentiment analysis execution unit 103 may identify m (where m is an integer of 2 or more) or more post data that contain a negative expression.

[0051] Furthermore, since users who post words related to anomalies may have negative feelings towards the service, the sentiment analysis execution unit 103 may perform sentiment analysis by determining whether or not the posted data contains words related to anomalies, rather than by using negative expressions. In this case, the sentiment analysis execution unit 103 performs sentiment analysis on the posted data based on the anomaly-related database, which is a dictionary containing words related to anomalies.

[0052] Furthermore, the sentiment analysis execution unit 103 may perform sentiment analysis on the posted data based on a learning model that has learned training data showing the relationship between training posted data and the results of sentiment analysis on the posted data (for example, labels indicating whether it is negative or not). The learning model may be supervised learning, semi-supervised learning, or unsupervised learning. The sentiment analysis execution unit 103 inputs the posted data to be analyzed into the learning model. The learning model calculates the features of the posted data and outputs the results of sentiment analysis according to the features. The sentiment analysis execution unit 103 obtains the output from the learning model.

[0053] [Anomaly detection unit] The anomaly detection unit 104 detects anomalies related to each of the multiple services based on the posting-related services identified for each of the multiple posting data and the results of the sentiment analysis performed for each of the multiple posting data. Anomaly detection can also be described as anomaly determination or estimation.

[0054] For example, each service has its own set of anomaly detection criteria. These anomaly detection criteria may be common to multiple services. The anomaly detection unit 104 determines whether the anomaly detection criteria for each of the multiple services are met, based on the posting-related services identified for each of the multiple posting data and the results of the sentiment analysis performed for each of the multiple posting data. The anomaly detection unit 104 detects anomalies in services where the anomaly detection criteria are met. The anomaly detection unit 104 does not detect anomalies in services where the anomaly detection criteria are not met.

[0055] In this embodiment, we take the case where the anomaly detection criterion is the number of negative posts as an example. For example, the anomaly detection unit 104 aggregates the number of negative posts, which is the number of post data containing negative expressions, for each service, and detects anomalies in each of the multiple services based on the number of negative posts for each of the multiple services. The anomaly detection unit 104 stores the aggregated result of the number of negative posts in the anomaly detection database DB3. In this embodiment, the anomaly detection unit 104 aggregates the number of negative posts for each aggregation period. The anomaly detection unit 104 refers to the posting time of post data for which a certain post-related service has been identified, and aggregates the number of negative posts for the post-related service based on the results of sentiment analysis on the post data for which the posting time is included in the aggregation period.

[0056] For example, the anomaly detection unit 104 detects an anomaly in a service among multiple services if the number of negative posts exceeds a threshold. The threshold may be common to all services or may be defined for each service. The threshold may be common to all aggregation periods or may be defined for each aggregation period. The threshold may be specified by the administrator or determined based on the past performance of posts related to each service. The anomaly detection unit 104 may detect an anomaly in a service if the number of negative posts in one aggregation period exceeds a threshold. The anomaly detection unit 104 may detect an anomaly in a service if the number of negative posts in multiple consecutive aggregation periods exceeds a threshold.

[0057] For example, the anomaly detection unit 104 increments the number of negative posts for a posting service if the posted data for that posting service contains negative expressions. The anomaly detection unit 104 may also increment the number of negative posts for a posting service if the posted data for that posting service contains m or more negative expressions. If a machine learning-based, pattern-based, or rule-based sentiment analysis method is used, the anomaly detection unit 104 may also increment the number of negative posts for a posting service if these sentiment analysis methods estimate that the posted data for that posting service is a negative post.

[0058] For example, the anomaly detection unit 104 detects anomalies in multiple services based on the time-series changes in the number of negative posts for each of the multiple services. The anomaly detection unit 104 calculates the amount of change (increase) between the number of negative posts in one aggregation period and the number of negative posts in the next aggregation period. The anomaly detection unit 104 detects anomalies in services among the multiple services where the amount of change is greater than or equal to a threshold. This threshold may be common to all services or may be defined for each service. This threshold may be common to all aggregation periods or may be defined for each aggregation period. The anomaly detection unit 104 may also detect anomalies by calculating the amount of change that spans three or more aggregation periods.

[0059] For example, the anomaly detection unit 104 detects anomalies related to configurations specific to a service that has a relatively large number of negative posts among multiple services. A specific configuration is a configuration (e.g., hardware or software) used only by a particular service. For example, a configuration specific to a service could be a server computer accessed by a user to use that service, software installed on that server computer, other computers that interact with that server computer, or software installed on the user terminal 30. The anomaly detection unit 104 detects an anomaly related to the configuration specific to a particular service when, among multiple services, only the number of negative posts for that particular service exceeds a threshold.

[0060] For example, the anomaly detection unit 104 detects an anomaly related to a configuration common to multiple services when the number of negative posts for each of the multiple services exceeds a threshold. A configuration common to multiple services is a configuration (e.g., hardware or software) that is used by each of the multiple services, rather than being used by only one specific service. For example, a configuration common to multiple services could be other computers that interact with the server computers of each of the multiple services, software installed on those other computers, computers that interact with those other computers, or software common to multiple services installed on the user terminal 30 (e.g., a so-called super application). The anomaly detection unit 104 detects an anomaly related to a configuration common to multiple services when the number of negative posts for each of the multiple services exceeds a threshold across the board.

[0061] The method by which the anomaly detection unit 104 detects anomalies is not limited to the above example. For example, the anomaly detection unit 104 may detect anomalies based on a learning model that utilizes machine learning techniques. In this case, the learning model is trained with training data that takes as input the post-related services identified for training post data and the results of sentiment analysis of the said post data, and outputs whether or not an anomaly exists. The learning model may use supervised learning, semi-supervised learning, or unsupervised learning. The anomaly detection unit 104 inputs the post-related services and sentiment analysis results for each of the multiple post data sets into the learning model. The learning model calculates the features of the input data and outputs whether or not an anomaly exists according to the features. The anomaly detection unit 104 detects anomalies by obtaining the output from the learning model.

[0062] [3-2. Functions implemented by the SNS server] For example, the SNS server 20 includes a data storage unit 200 and an SNS provision unit 201. The data storage unit 200 is implemented by a storage unit 22. The SNS provision unit 201 is implemented by a control unit 21.

[0063] [Data Storage Unit] The data storage unit 200 stores data related to social networking services (SNS). For example, the data storage unit 200 stores post data related to posts made on SNS. The data storage unit 200 may store a database similar to the post database DB1, or it may store a database with a different data structure from the post database DB1. The data storage unit 200 can store various types of data from known SNS.

[0064] [SNS provision department] The SNS provider unit 201 provides SNS to each of the multiple users. The processing performed by the SNS provider unit 201 may be the same as the processing performed on a known SNS. For example, the SNS provider unit 201 displays a screen related to SNS posting to the user terminal 30. The SNS provider unit 201 receives data related to the posting entered by the user from the user terminal 30. Based on this data, the SNS provider unit 201 records the posting data in the data storage unit 200. The SNS server 20 transmits the posting data to the anomaly detection server 10.

[0065] [3-3. Functions implemented on the user terminal] For example, the user terminal 30 includes a data storage unit 300 and a posting unit 301. The data storage unit 300 is implemented by a storage unit 32. The posting unit 301 is implemented by a control unit 31.

[0066] [Data Storage Unit] The data storage unit 300 stores data necessary for the user to use the social networking service (SNS). For example, the data storage unit 300 stores a browser or an SNS-specific application. The data storage unit 300 may also store data necessary for the user to use at least one of multiple services.

[0067] [Submission Section] The posting unit 301 transmits data related to the user's post to the SNS server 20.

[0068] [3-4. Functions implemented on the administrator terminal] For example, the administrator terminal 40 includes a data storage unit 400, an operation reception unit 401, and a display control unit 402. The data storage unit 400 is implemented by a storage unit 42. The operation reception unit 401 and the display control unit 402 are implemented by a control unit 41.

[0069] [Data Storage Unit] The data storage unit 400 stores data necessary for the administrator's work. For example, the data storage unit 400 stores data necessary for displaying the administrator screen SC. The data storage unit 400 may also store maintenance tools necessary for the administrator's work. The maintenance tools themselves may be well-known tools, for example, any tool capable of monitoring the status of at least one of hardware and software.

[0070] [Operation Reception Section] The operation reception unit 401 receives various operations from the administrator. For example, the operation reception unit 401 receives operations on the administrator screen SC.

[0071] [Display Control Unit] The display control unit 402 displays various screens on the display unit 45. For example, the display control unit 402 displays the administrator screen SC on the display unit 45.

[0072] [4. Process executed by the anomaly detection system] Figure 8 shows an example of the processing performed by the anomaly detection system 1. The control units 11, 21, 31, and 41 execute the programs stored in the storage units 12, 22, 32, and 42, respectively, thereby executing the processing shown in Figure 8. Each step in Figure 8 is an example of the steps included in the anomaly detection method according to this disclosure.

[0073] As shown in Figure 8, the SNS server 20 performs the process of providing SNS to the user via the user terminal 30 (S1). In S1, the SNS server 20 receives data related to posts entered by the user from the user terminal 30. The SNS server 20 generates post data and records it in the storage unit 22. The anomaly detection server 10 performs the process of acquiring post data via the SNS server 20 (S2). In S2, the SNS server 20 transmits all or part of the post data on SNS to the anomaly detection server 10. The anomaly detection server 10 stores the post data acquired from the SNS server 20 in the post database DB1.

[0074] The anomaly detection server 10 identifies posting-related services associated with the posted data based on the dictionary database DB2 (S3). The processing in S3 is as described in the processing of the posting-related service identification unit 102. The anomaly detection server 10 performs sentiment analysis on the posted data (S4). The processing in S4 is as described in the processing of the sentiment analysis execution unit 103. The subsequent processing in S5 to S11 corresponds to the processing of the anomaly detection unit 104.

[0075] The anomaly detection server 10 calculates the number of negative expressions for each of the multiple services during the aggregation period (S5). The calculation results in S5 are stored in the anomaly detection database DB3. Based on the anomaly detection database DB3, the anomaly detection server 10 calculates the change in the number of negative expressions for each of the multiple services (S6). The anomaly detection server 10 determines whether there are any services whose change calculated in S6 is greater than or equal to a threshold (S7).

[0076] In S7, if it is determined that the change amount of a particular service exceeds a threshold (S7: specific), the anomaly detection server 10 detects a configuration anomaly specific to that particular service (S8). The anomaly detection server 10 then executes a process to display the administrator screen SC with the administrator terminal 40 (S9), and this process ends. In S7, if the change amounts of multiple services each exceed a threshold (S7: multiple), the anomaly detection server 10 detects a configuration anomaly common to the multiple services (S10), and proceeds to the process in S9. In S7, if the change amounts of any service do not exceed a threshold (S7: none), this process ends.

[0077] [5. Summary of Embodiments] The anomaly detection system 1 of this embodiment detects anomalies related to each of multiple services based on the identified post-related services for each of the multiple post data on the SNS and the results of sentiment analysis performed on each of the multiple post data. By utilizing post data that directly reflects users' opinions on the services, the anomaly detection system 1 can appropriately detect anomalies related to each of multiple services, not just one service. For example, even if an anomaly occurs in one of the multiple services, and indicators such as the CPU usage rate of the server computer used by that service do not detect the anomaly, users who actually use the service may feel something is wrong. Users may make posts in real time indicating the possibility of an anomaly occurring in the service, so the anomaly detection system 1 can quickly detect anomalies by analyzing the post data of such posts.

[0078] Furthermore, the anomaly detection system 1 identifies the service associated with a given post based on each of the multiple post data and a dictionary database DB2 containing words specific to each of the multiple services. This allows the anomaly detection system 1 to accurately identify which service the post data is related to. As a result, the accuracy of anomaly detection is improved. For example, the anomaly detection system 1 could also identify which service a post data is related to by determining whether or not the post data contains a service name. However, in this case, if the post data does not contain a service name, the anomaly detection system 1 would consider the post data unrelated to a service and would not refer to the post data for anomaly detection. In this respect, the anomaly detection system 1 can identify the service to which the post data is related even if the post data does not contain a service name. As a result, the anomaly detection system 1 can refer to more post data for anomaly detection, thus improving the accuracy of anomaly detection.

[0079] Furthermore, the anomaly detection system 1 performs sentiment analysis of the content of a post by determining whether each of the multiple post data contains negative expressions. The anomaly detection system 1 aggregates the number of negative posts, which is the number of post data containing negative expressions, for each service. Based on the number of negative posts for each of the multiple services, the anomaly detection system 1 detects anomalies in each of the multiple services. As a result, the anomaly detection system 1 detects anomalies based on indicators directly related to anomaly detection, such as the number of negative posts, thus improving the accuracy of anomaly detection. For example, the anomaly detection system 1 can display the number of negative posts for each service on the administrator screen SC, thereby presenting administrators with easily understandable indicators such as the number of negative posts.

[0080] Furthermore, the anomaly detection system 1 detects anomalies in multiple services based on the time-series changes in the number of negative posts for each of the multiple services. This improves the accuracy of anomaly detection because it detects anomalies based on indicators directly related to anomaly detection, such as the time-series changes in the number of negative posts. For example, the anomaly detection system 1 can display the time-series changes in the number of negative posts for each service on the administrator screen SC, thereby presenting administrators with easily understandable indicators such as changes in the number of negative posts.

[0081] Furthermore, the anomaly detection system 1 detects anomalies related to the configuration specific to the service with a relatively high number of negative posts among multiple services. This allows the anomaly detection system 1 to detect that an anomaly has occurred in the configuration specific to a particular service, enabling it to accurately estimate the cause of the anomaly. As a result, the recovery of the service experiencing the anomaly is accelerated.

[0082] Furthermore, the anomaly detection system 1 detects an anomaly related to a common configuration across multiple services when the number of negative posts for each of the multiple services exceeds a threshold. This allows the anomaly detection system 1 to detect an anomaly in a common configuration across multiple services, enabling it to accurately estimate the cause of the anomaly. As a result, the recovery of each of the multiple services experiencing the anomaly is accelerated.

[0083] [6. Variant] This disclosure is not limited to the embodiments described above. This disclosure may be modified as appropriate without departing from the spirit of this disclosure.

[0084] Figure 9 shows an example of the functions implemented in the modified anomaly detection system 1. The modified anomaly detection system 1 includes a general relationship identification unit 105, a status data acquisition unit 106, a relationship identification unit 107, a specialization information acquisition unit 108, a campaign information acquisition unit 109, and a distribution content information acquisition unit 110. The general relationship identification unit 105, the status data acquisition unit 106, the relationship identification unit 107, the specialization information acquisition unit 108, the campaign information acquisition unit 109, and the distribution content information acquisition unit 110 are implemented by the control unit 11.

[0085] [6-1. Variation 1] For example, in this embodiment, the posting-related service identification unit 102 identifies whether individual posting data is related to a specific service. Depending on the posting data, it may also represent general posting content that spans multiple services. For example, if a single business operator provides multiple services, a user may input a post containing the name of that business operator as a post that spans all of those services. For example, if the businesses that provide each of the multiple services have a common name, a user may input a post containing that common name as a post that spans all of those services. The anomaly detection system 1 may detect an anomaly based on posting data that shows such posts.

[0086] The anomaly detection system 1 of Modification 1 includes a general-related identification unit 105. The general-related identification unit 105 identifies post data that is related to the general aspects of multiple services based on each of the multiple post data. For example, there are criteria for determining whether a post is related to the general aspects of multiple services. The general-related identification unit 105 determines whether the post data satisfies the criteria for each of the multiple services. The general-related identification unit 105 determines whether the post data satisfies the criteria. If the post data satisfies the posting criteria, the general-related identification unit 105 identifies the post data as post data related to the general aspects of multiple services.

[0087] The criteria for determination in Modification 1 may be arbitrary. One example of a criterion is that the post data contains a word from a dictionary that registers words that represent the general aspects of multiple services. For example, the general-related identification unit 105 identifies post data that is related to the general aspects of multiple services based on each of the multiple post data and a database in which words from a dictionary that registers words that represent the general aspects of multiple services are registered. The general-related identification unit 105 identifies post data that is related to the general aspects of multiple services if the post data contains a word stored in the database. The general-related identification unit 105 may also identify post data that is related to the general aspects of multiple services if the post data contains k (k: an integer of 2 or more) or more words stored in the database.

[0088] Furthermore, the criteria for determination may be other than the dictionary database. For example, instead of a database containing multiple words, the criteria may simply be that the submitted data represents the names of businesses that provide multiple services, or a name common to multiple businesses. In this case, the general related identification unit 105 identifies the submitted data as submitted data related to multiple services in general when the submitted data represents these names.

[0089] For example, the judgment criteria may be the output of a learning model that utilizes machine learning techniques. The machine learning techniques may be various known techniques. For example, the learning model may be created using supervised learning, semi-supervised learning, or unsupervised learning. The learning model may also be a model used in natural language processing or image analysis. The learning model is trained with training data that includes training post data and labels indicating whether or not it is related to multiple services in general. The general relevance identification unit 105 inputs the post data to the learning model. The learning model calculates the features of the post data and outputs labels corresponding to those features. The general relevance identification unit 105 may refer to the labels output from the learning model and identify post data that is related to multiple services in general.

[0090] In Modification 1, the sentiment analysis execution unit 103 also performs sentiment analysis on the post data identified by the general-related identification unit 105. The sentiment analysis method is as described in the embodiment. In Modification 1, the anomaly detection unit 104 further detects anomalies related to each of the multiple services based on the post data identified by the general-related identification unit 105. For example, the anomaly detection unit 104 aggregates the number of negative expressions in the post data identified by the general-related identification unit 105.

[0091] For example, the anomaly detection unit 104 detects a common configuration anomaly across multiple services when the number of negative expressions in the posted data identified by the general-related identification unit 105 is greater than or equal to a threshold. The anomaly detection unit 104 calculates the change in the number of negative expressions in the posted data identified by the general-related identification unit 105. The anomaly detection unit 104 detects a common configuration anomaly across multiple services when this change is greater than or equal to a threshold. The anomaly detection unit 104 may also detect a common configuration anomaly across multiple services based on the posted data identified by the general-related identification unit 105 and other methods such as the learning model described in the embodiment.

[0092] The anomaly detection system 1 of the modified version 1 identifies post data related to the overall services of multiple services based on each of the multiple post data. The anomaly detection system 1 further detects anomalies related to each of the multiple services based on the post data identified by the overall related identification unit 105. As a result, the anomaly detection system 1 can appropriately detect anomalies related to the overall services of multiple services.

[0093] [6-2. Variation 2] For example, the anomaly detection system 1 may detect anomalies not only using posting data on social networking services, but also using status data relating to the state of devices used in each of the multiple services. The anomaly detection system 1 of Modification 2 includes a status data acquisition unit 106. The status data acquisition unit 106 acquires status data relating to the state of devices used in each of the multiple services. The device is a type of hardware described in the embodiment. For example, the device is a server computer, personal computer, tablet, smartphone, other computer, communication equipment, memory, or power supply.

[0094] The status data may represent the pinpoint state of the device at a specific point in time, but in Modification 2, the status data is assumed to be data relating to the time-series changes in the device's state. The device state can also be the load on the device providing the service. The device state may refer to hardware status or software status. For example, the device state may be communication volume, CPU usage, memory usage, power consumption, communication speed, temperature, or a combination of these. The device state may be an indicator known as a golden signal metric, or other indicators used in well-known benchmark tests. The method for acquiring the device status data may also be a well-known method.

[0095] In the modified example 2, the data storage unit 100 stores status data acquired from each system of multiple services. The status data acquisition unit 106 acquires the status data stored in the data storage unit 100. The status data acquisition unit 106 may acquire status data from each system of multiple services. For example, the status data acquisition unit 106 periodically requests status data from each system of multiple services. Each system sends the latest status data to the anomaly detection server 10 in response to the request. The status data acquisition unit 106 periodically acquires the latest status data from each system.

[0096] In the modified version 2, the anomaly detection unit 104 detects anomalies related to each of the multiple services based on the status data of each of the multiple services. For example, the anomaly detection unit 104 detects an anomaly related to a service if there is a service among the multiple services where the numerical value indicated by the status data is greater than or equal to a threshold. The anomaly detection unit 104 may also detect an anomaly related to a service if there is a service among the multiple services where the amount of change in the numerical value indicated by the status data is greater than or equal to a threshold. The anomaly detection unit 104 may also detect anomalies by inputting the time-series changes in the status data into a model created using machine learning techniques.

[0097] For example, the anomaly detection unit 104 may determine that an anomaly has occurred if an anomaly is detected by both the anomaly detection method based on SNS posting data described in the embodiment and the anomaly detection method based on status data described in Modification 2. The anomaly detection unit 104 may also determine that an anomaly has occurred if an anomaly is detected by either the anomaly detection method based on SNS posting data described in the embodiment or the anomaly detection method based on status data described in Modification 2. It is assumed that information indicating which service the device from which the status data was acquired belongs to is stored in the data storage unit 100. The anomaly detection unit 104 detects an anomaly in the service associated with a certain status data when the numerical value indicated by that status data exceeds a threshold, etc.

[0098] The anomaly detection system 1 in modified example 2 acquires status data regarding the state of devices used in each of the multiple services. The anomaly detection system 1 further detects anomalies related to each of the multiple services based on the status data of each of the multiple services. The anomaly detection system 1 can improve the accuracy of anomaly detection by utilizing both the posting data on SNS and the device status data.

[0099] [6-3. Modified Example 3] For example, various devices can be used to provide a service. Among the state data in Modification 2, some are related to anomalies, while others are not. Therefore, the anomaly detection server 10 may identify state data that is related to SNS posting data from among the various state data. Hereafter, this state data will be referred to as related data. The anomaly detection server 10 may detect anomalies based on the related data among multiple state data. State data other than related data will not be used for anomaly detection.

[0100] The anomaly detection system 1 of the modified example 3 includes a relevance identification unit 107. The relevance identification unit 107 identifies relevance data from among multiple state data for each of multiple services that are related to the posted data for which the service has been identified as a posting-related service. Relevance refers to the correlation between the posted data and the status data. For example, if the increase in the amount of posted data exceeds a threshold, and the increase in the amount of status data also exceeds a threshold, then there is a relevance between the posted data and the status data. If the decrease in the amount of posted data exceeds a threshold, and the decrease in the amount of status data also exceeds a threshold, then there is a relevance between the posted data and the status data.

[0101] For example, if the time difference between when the posted data changes and when the status data changes is less than a threshold, then the posted data and the status data are related. If the time difference between when the posted data changes and when the status data changes consistently falls within a predetermined range, then the posted data and the status data are related. For example, the relationship identification unit 107 calculates the time-series change in the number of negative posts for each service based on each of the multiple posted data. This calculation method is as described in the embodiment.

[0102] For example, the relevance identification unit 107 performs clustering of the time-series changes in the number of negative posts for each of the multiple services and the time-series changes in the state represented by each of the multiple state data, based on known clustering methods. Clustering can be performed based on known methods. For example, the relevance identification unit 107 performs clustering based on k-means clustering, hierarchical clustering, DBSCAN clustering, or other clustering methods. The relevance identification unit 107 performs clustering so that data with similar time-series changes belong to the same cluster. The relevance identification unit 107 identifies state data from among the multiple state data that belong to the same cluster as the time-series changes in the number of negative posts for a certain service as relevance data related to the post data for that service.

[0103] The anomaly detection unit 104 in Modification 3 detects anomalies in a service based on the relevant data of that service from among the multiple state data of each of the multiple services. The anomaly detection unit 104 does not refer to state data that is not relevant data among the multiple state data when detecting anomalies. It differs in that state data identified as relevant data among the multiple state data is used for anomaly detection, but otherwise it is the same as the anomaly detection unit 104 in Modification 2.

[0104] The anomaly detection system 1 in modified example 3 identifies related data from among the multiple state data of each of the multiple services that are related to the posted data for which the service in question has been identified as a posting-related service. The anomaly detection system 1 detects anomalies in the service based on the related data of the service in question from among the multiple state data of each of the multiple services. The anomaly detection system 1 can improve the accuracy of anomaly detection by detecting anomalies based on state data related to posted data on the SNS.

[0105] [6-4. Modification 4] For example, some posted data may contain highly specialized terms that directly describe anomalies, such as "traffic," "access," or "system failure." Such posted data is considered particularly useful for detecting anomalies. Therefore, the anomaly detection server 10 may prioritize posted data containing highly specialized terms over other posted data and detect anomalies accordingly.

[0106] The anomaly detection system 1 includes an expertise information acquisition unit 108. The expertise information acquisition unit 108 acquires expertise information regarding the expertise of words contained in each of the multiple submitted data. The expertise information indicates the degree of expertise of the word. In the modified example 4, the expertise information is given as an example in which it is expressed numerically, but the expertise information may also be expressed in characters or symbols. In the modified example 4, the higher the numerical value indicated by the expertise information, the higher the level of expertise. The expertise information of the word may be stored in the dictionary database DB2, or it may be stored in a database other than the dictionary database DB2.

[0107] In Modification 4, the anomaly detection unit 104 detects anomalies in each of the multiple services based on the expertise information of each of the multiple posted data. For example, if a posted data contains a negative expression and also contains a word associated with expertise information, the anomaly detection unit 104 increases the number of negative posts based on the expertise indicated by the expertise information associated with that word. The anomaly detection unit 104 calculates the number of negative posts such that the higher the expertise indicated by the expertise information, the higher the number of negative posts. In the embodiment, an example was given where the number of negative posts increased by 1 regardless of the type of post if a posted data contained a negative expression, but in Modification 4, if the expertise indicated by the expertise information is high, the number of negative posts for a single posted data increases by a value of 2 or more.

[0108] For example, suppose the level of expertise indicated by the expertise information is three levels. If the anomaly detection unit 104 finds that a post containing a word with expertise level 3 also contains a negative expression, it increases the number of negative posts by 3 for each such post. If the anomaly detection unit 104 finds that a post containing a word with expertise level 2 also contains a negative expression, it increases the number of negative posts by 2 for each such post. If the anomaly detection unit 104 finds that a post containing a word with expertise level 1 also contains a negative expression, it increases the number of negative posts by 1 for each such post.

[0109] Note that the processing of the anomaly detection unit 104 in Modification 4 is not limited to the above example. For example, if the anomaly detection unit 104 detects an anomaly based on an indicator other than the number of negative posts, the anomaly detection unit 104 may consider expertise information in the calculation of the other indicator. If there is post data in a certain service that contains words associated with expertise information, the anomaly detection unit 104 calculates the indicator for that service such that the higher the expertise indicated by the expertise information, the higher the indicator for that service. The calculation formula necessary for calculating the indicator is stored in the data storage unit 100.

[0110] The anomaly detection system 1 in modified example 4 acquires expertise information regarding the expertise of words contained in each of the multiple posted data. The anomaly detection system 1 then detects anomalies in each of the multiple services based on the expertise information of each of the multiple posted data. As a result, the anomaly detection system 1 can prioritize the detection of anomalies in posted data containing more specialized words, thereby improving the accuracy of anomaly detection.

[0111] [6-5. Variation 5] For example, if a campaign is being held for a particular service, even if no abnormalities are occurring within that service, the number of posts about that service on social media may increase. Furthermore, some users may post negative comments about the campaign. Such posts can become noise for anomaly detection. For this reason, the anomaly detection server 10 may change its criteria for anomaly detection, taking into account whether or not a campaign is being held.

[0112] The anomaly detection system 1 of Modification 5 includes a campaign information acquisition unit 109. The campaign information acquisition unit 109 acquires campaign information for each of the multiple services. The campaign information indicates the identification information of the service in which the campaign is being held and the duration of the campaign. The campaign information may also indicate the content of the campaign. The campaign information is stored in the data storage unit 100. The campaign information may be registered in the data storage unit 100 by an administrator or by another person.

[0113] In Modification 5, the anomaly detection unit 104 detects anomalies in each of the multiple services based on the campaign information. For example, the anomaly detection unit 104 identifies a service from among the multiple services in which a campaign is being held, based on the campaign information. The anomaly detection unit 104 increases the threshold for detecting anomalies in the identified service. During the campaign period, the anomaly detection unit 104 detects anomalies based on the increased threshold. The method for determining the threshold differs from the embodiment, but other aspects are the same as the embodiment.

[0114] The anomaly detection system 1 in Modification 5 acquires campaign information for each of the multiple services. Based on the campaign information, the anomaly detection system 1 detects anomalies in each of the multiple services. As a result, the anomaly detection system 1 can perform anomaly detection that takes into account the noise that may be generated by the holding of campaigns, so it can properly detect anomalies even when campaigns are being held.

[0115] [6-6. Variation 6] For example, a service that is subject to anomaly detection may be featured in television programs, online video streaming, or live streaming services. In this case, even if no anomaly occurs in the service, the number of posts about the service on social media may increase. Furthermore, some users may post negative comments about the streamed content. Such posts can become noise for anomaly detection. For this reason, the anomaly detection server 10 may change its criteria for anomaly detection, taking into account the content streamed in the streaming service.

[0116] The anomaly detection system 1 includes a distribution content information acquisition unit 110. The distribution content information acquisition unit 110 acquires distribution content information regarding the content of a distribution service that can distribute information about each of multiple services. The distribution content information indicates the date and time of distribution in the distribution service and the content of distribution in the distribution service. The distribution content information is stored in the data storage unit 100. The distribution content information may be registered in the data storage unit 100 by an administrator or by another person. In the modified example 6, the distribution content information indicates whether or not it relates to the service that is the target of anomaly detection.

[0117] In Modification 6, the anomaly detection unit 104 detects anomalies in each of the multiple services based on the distribution content information. For example, the anomaly detection unit 104 identifies the service to be introduced in the distribution service from among the multiple services based on the distribution content information. The anomaly detection unit 104 increases the threshold for detecting anomalies in the identified service. During the distribution period or the period immediately before and after, the anomaly detection unit 104 detects anomalies based on the increased threshold. The method for determining the threshold differs from the embodiment, but other aspects are the same as the embodiment.

[0118] The anomaly detection system 1 in modified example 6 acquires distribution content information regarding the content of a distribution service that can distribute information about each of multiple services. The anomaly detection system 1 further detects anomalies in each of the multiple services based on the distribution content information. As a result, the anomaly detection system 1 can perform anomaly detection that takes into account the noise that may be generated by distribution in the distribution service, and can appropriately detect anomalies even if distribution is performed in the distribution service.

[0119] [6-7. Other variations] For example, the above variations may be combined.

[0120] For example, the anomaly detection system 1 can be applied to services other than e-commerce services, financial services, and communication services. For instance, the anomaly detection system 1 may detect anomalies in other services such as travel booking services, payment services, online flea market services, or video streaming services.

[0121] For example, in this embodiment, the case in which the main processing is performed on the anomaly detection server 10 has been described, but the processing described as being performed on the anomaly detection server 10 may also be performed on the administrator terminal 40 or another computer. The processing described as being performed on the anomaly detection server 10 may also be shared among multiple computers.

[0122] For example, the sentiment analysis execution unit 103 may perform sentiment analysis on SNS posting data posted by some users or other users excluding those some users. Here, "some users" may refer to users who are subscribed to a predetermined subscription service on the SNS, or users whose user activities, such as the frequency of posting data containing negative expressions on the SNS or their login frequency, meet predetermined conditions. This allows the sentiment analysis execution unit 103 to omit sentiment analysis on posting data of users who may not be included as targets for sentiment analysis, such as bots. Furthermore, "some users" may refer to users whose posting data metrics, such as the number of impressions on the SNS, exceed predetermined values ​​at predetermined frequencies during a predetermined period, or users whose account metrics, such as the number of followers on the SNS, exceed predetermined values ​​at predetermined frequencies during a predetermined period. This allows the sentiment analysis execution unit 103 to perform sentiment analysis on posting data of users who have influence equivalent to so-called influencers. Furthermore, "some users" may refer to users whose profiles on the SNS are classified into predetermined categories. Here, the sentiment analysis execution unit 103 determines, for example, whether a user's account name or profile name falls into the person category, excluding character names, etc., and if it falls into the person category, it performs sentiment analysis on the account image and the posted data posted by the corresponding user. Furthermore, "some users" may refer to users whose account images on the SNS fall into a predetermined category. Here, the sentiment analysis execution unit 103 determines, for example, whether an account image falls into the person category by inputting the account image into a trained machine learning model, and if it falls into the person category, it performs sentiment analysis on the account image and the posted data posted by the corresponding user.

[0123] For example, if the posting-related service identification unit 102 is unable to identify a service, it may identify a post as being related to that service based on the posting time, operation information indicating the service provider's service provision status, maintenance information indicating the service provider's service unavailable times, promotional information indicating advertising activities such as commercials and news from the service provider that indicate the scheduled service provision times, or system alert information from the service provider. For example, if the posting time matches the service provider's operation time (service provision time), the unit may identify the post as being related to that service.

[0124] [7. Addendum] For example, an anomaly detection system can also be configured as follows: (1) A post data acquisition unit that acquires each of multiple post data in an SNS (Social Networking Service), A posting-related service identification unit identifies posting-related services related to each of the multiple posting data among the multiple services that are subject to anomaly detection, A sentiment analysis execution unit that performs sentiment analysis on each of the aforementioned multiple posted data, An anomaly detection unit detects anomalies related to each of the multiple services based on the post-related services identified for each of the multiple post data and the results of the sentiment analysis performed for each of the multiple post data. An anomaly detection system including... (2) The posting-related service identification unit identifies the posting-related service for each of the multiple posting data and a dictionary database in which words specific to each of the multiple services are registered, based on each of the multiple posting data and the posting-related service for each of the posting data. (1) An anomaly detection system as described above. (3) The sentiment analysis execution unit performs the sentiment analysis on the post data by determining whether each of the plurality of post data contains a negative expression. The anomaly detection unit aggregates the number of negative posts, which is the number of post data containing the negative expression, for each of the multiple services, and detects the anomaly for each of the multiple services based on the number of negative posts for each of the multiple services. An anomaly detection system as described in (1) or (2). (4) The anomaly detection unit detects anomalies in each of the multiple services based on the time-series changes in the number of negative posts for each of the multiple services. (3) An anomaly detection system as described above. (5) The anomaly detection unit detects the anomaly related to a configuration specific to the service among the multiple services that has a relatively large number of negative posts. An anomaly detection system as described in (3) or (4). (6) The anomaly detection unit detects the anomaly relating to a configuration common to the multiple services when the number of negative posts for each of the multiple services is above a threshold. An anomaly detection system as described in any of (3) to (5). (7) The anomaly detection system further includes a general-related identification unit that identifies the posted data relating to the overall services based on each of the plurality of posted data, The anomaly detection unit further detects the anomaly relating to each of the multiple services based on the posted data identified by the general related identification unit. An anomaly detection system as described in any of (1) to (6). (8) The anomaly detection system further includes a status data acquisition unit that acquires status data relating to the status of devices used in each of the multiple services, The anomaly detection unit further detects anomalies relating to each of the multiple services based on the status data of each of the multiple services. An anomaly detection system as described in any of (1) to (7). (9) The anomaly detection system further includes a relevance identification unit that identifies relevance data among the multiple status data for each of the multiple services that is related to the post data for which the service has been identified as the post-related service, The anomaly detection unit detects an anomaly in a service based on the relationship data of that service, from among the multiple state data of each of the multiple services. (8) An anomaly detection system as described above. (10) The anomaly detection system further includes an expert information acquisition unit that acquires expert information regarding the expertise of words contained in each of the plurality of posted data, The anomaly detection unit further detects anomalies in each of the multiple services based on the expertise information of each of the multiple posted data. An anomaly detection system as described in any of (1) to (9). (11) The anomaly detection system further includes a campaign information acquisition unit that acquires campaign information relating to campaigns in each of the plurality of services, The anomaly detection unit further detects the anomaly in each of the multiple services based on the campaign information. An anomaly detection system as described in any of (1) to (10). (12) The anomaly detection system further includes a distribution content information acquisition unit that acquires distribution content information relating to the distribution content in a distribution service capable of distributing information about each of the plurality of services, The anomaly detection unit further detects the anomaly in each of the multiple services based on the distribution content information. An anomaly detection system as described in any of (1) to (11).

Claims

1. A post data acquisition unit that acquires each of multiple post data in an SNS (Social networking service), A posting-related service identification unit identifies posting-related services related to each of the multiple posting data among the multiple services that are subject to anomaly detection, A sentiment analysis execution unit that performs sentiment analysis on each of the aforementioned multiple posted data, A general-relevance identification unit identifies the posted data related to the multiple services by determining whether each of the multiple posted data contains a word in a dictionary in which a word representing the multiple services in general is registered, or by determining whether each of the multiple posted data contains the name of the business operator providing the multiple services or a name common to each of the businesses providing each of the multiple services, or by inputting each of the multiple posted data into a learning model that has been trained with training data including training posted data and labels indicating whether or not it is related to the multiple services in general, and using the labels output from the learning model, An anomaly detection unit detects anomalies relating to each of the multiple services based on the post-related services identified for each of the multiple post data and the results of the sentiment analysis performed for each of the multiple post data, and detects anomalies common to the multiple services based on the number of negative expressions in the sentiment analysis for the post data identified by the general related identification unit. An anomaly detection system including...

2. The posting-related service identification unit identifies the posting-related service for each of the multiple posting data and a dictionary database in which words specific to each of the multiple services are registered, based on each of the multiple posting data and the posting-related service for each of the posting data. The anomaly detection system according to claim 1.

3. The sentiment analysis execution unit performs the sentiment analysis on the post data by determining whether each of the plurality of post data contains a negative expression. The anomaly detection unit aggregates the number of negative posts, which is the number of post data containing the negative expression, for each of the multiple services, and detects the anomaly for each of the multiple services based on the number of negative posts for each of the multiple services. An anomaly detection system according to claim 1 or 2.

4. The anomaly detection unit detects anomalies in each of the multiple services based on the time-series changes in the number of negative posts for each of the multiple services. The anomaly detection system according to claim 3.

5. The anomaly detection unit detects the anomaly related to a configuration specific to the service among the multiple services that has a relatively large number of negative posts. The anomaly detection system according to claim 3.

6. The anomaly detection unit detects the anomaly relating to a configuration common to the multiple services when the number of negative posts for each of the multiple services is above a threshold. The anomaly detection system according to claim 3.

7. A post data acquisition unit that acquires each of a plurality of post data in an SNS (Social networking service), A posting-related service identification unit identifies posting-related services related to each of the multiple posting data among the multiple services that are subject to anomaly detection, A sentiment analysis execution unit that performs sentiment analysis on each of the aforementioned multiple posted data, A status data acquisition unit that acquires status data relating to the status of devices used in each of the aforementioned multiple services from a data storage unit, computer, or information storage medium that stores such status data, A relationship identification unit identifies, among the multiple state data for each of the multiple services, the relationship data related to the post data for which the service is identified as a post-related service, based on the relationship between the changes in the post data and the changes in the state data. An anomaly detection unit detects anomalies related to the service without referring to the status data of the service that is not the relevance data of the service, based on the relevance data of the service, the post-related service identified for each of the multiple post data, and the result of the sentiment analysis performed for each of the multiple post data. An anomaly detection system including...

8. A post data acquisition unit that acquires each of a plurality of post data in an SNS (Social networking service), A posting-related service identification unit identifies posting-related services related to each of the multiple posting data among the multiple services that are subject to anomaly detection, A sentiment analysis execution unit that performs sentiment analysis on each of the aforementioned multiple posted data, A data storage unit or computer or information storage medium that stores expertise information relating to the degree of expertise of the words contained in each of the aforementioned plurality of posted data, and an expertise information acquisition unit that acquires such expertise information from the data storage unit, computer or information storage medium, An anomaly detection unit detects an anomaly related to each of the multiple services by increasing the number of negative posts by an amount corresponding to the degree, based on the post-related service identified for each of the multiple post data, the result of the sentiment analysis performed for each of the multiple post data, and the expertise information for each of the multiple post data. An anomaly detection system including...

9. A post data acquisition unit that acquires each of a plurality of post data in an SNS (Social networking service), A posting-related service identification unit identifies posting-related services related to each of the multiple posting data among the multiple services that are subject to anomaly detection, A sentiment analysis execution unit that performs sentiment analysis on each of the aforementioned multiple posted data, A campaign information acquisition unit that acquires campaign information relating to campaigns in each of the aforementioned multiple services from a data storage unit, computer, or information storage medium that stores such campaign information, An anomaly detection unit detects anomalies in each of the multiple services based on the campaign information, the threshold for the service in which the campaign is being held among the multiple services, the post-related service identified for each of the multiple post data, the result of the sentiment analysis performed for each of the multiple post data, and the threshold. An anomaly detection system including...

10. A post data acquisition unit that acquires each of a plurality of post data in an SNS (Social networking service), A posting-related service identification unit identifies posting-related services related to each of the multiple posting data among the multiple services that are subject to anomaly detection, A sentiment analysis execution unit that performs sentiment analysis on each of the aforementioned multiple posted data, A distribution content information acquisition unit that acquires distribution content information from a data storage unit, computer, or information storage medium that stores distribution content information relating to the distribution content of a distribution service capable of distributing information relating to each of the aforementioned multiple services, An anomaly detection unit detects anomalies related to each of the multiple services based on the distribution content information, the threshold for the service introduced by the distribution service from among the multiple services, the posting-related service identified for each of the multiple posting data, the result of the sentiment analysis performed for each of the multiple posting data, and the threshold. An anomaly detection system including...

11. A post data acquisition step that acquires each of multiple post data in an SNS (Social networking service), A post-related service identification step that identifies the post-related service associated with each of the multiple post data among the multiple services that are subject to anomaly detection, A sentiment analysis execution step which performs sentiment analysis on each of the aforementioned multiple post data, A general relevance identification step to identify the post data related to the multiple services in general by determining whether each of the multiple post data contains a word in a dictionary in which a word representing the multiple services in general is registered, or by determining whether each of the multiple post data contains the name of the business operator providing the multiple services or a name common to each of the businesses providing each of the multiple services, or by inputting each of the multiple post data into a learning model that has been trained with training data including training post data and labels indicating whether or not it is related to the multiple services in general, and using the labels output from the learning model, An anomaly detection step that detects anomalies relating to each of the multiple services based on the post-related services identified for each of the multiple post data and the results of the sentiment analysis performed for each of the multiple post data, and detects anomalies common to the multiple services based on the number of negative expressions in the sentiment analysis for the post data identified by the general related identification unit, An anomaly detection method including

12. A post data acquisition unit that acquires each of multiple post data in an SNS (Social Networking Service), A posting-related service identification unit identifies the posting-related service associated with each of the multiple posting data among the multiple services that are subject to anomaly detection. A sentiment analysis execution unit that performs sentiment analysis on each of the aforementioned multiple posted data, A general-relevance identification unit identifies the post data related to the multiple services by determining whether each of the multiple post data contains a word in a dictionary in which a word representing the multiple services in general is registered, or by determining whether each of the multiple post data contains the name of the business operator providing the multiple services or a name common to each of the businesses providing each of the multiple services, or by inputting each of the multiple post data into a learning model that has been trained with training data including training post data and labels indicating whether or not it is related to the multiple services in general, and using the labels output from the learning model, An anomaly detection unit detects anomalies relating to each of the multiple services based on the post-related services identified for each of the multiple post data and the results of the sentiment analysis performed for each of the multiple post data, and detects anomalies common to the multiple services based on the number of negative expressions in the sentiment analysis for the post data identified by the general related identification unit. A program that makes a computer function.

Images