Anomaly detection and adjustment device, anomaly detection and adjustment method, and anomaly detection and adjustment program

Abstract

To provide an abnormality detection adjustment device, abnormality detection adjustment method, and abnormality detection adjustment program, which allow even a person without expertise to intuitively adjust parameters for controlling severity of abnormality detection by various detection methods.SOLUTION: An abnormality detection adjustment device displays an abnormality detection number adjustment interface that allows a detection number index to be adjusted on the basis of an algorithm adjustment parameter master, and acquires a determination result of setting the abnormality detection number in an abnormality detection result, a detection result determined to be abnormal by a detection method on business data on the basis of the selected detection number index selected via the abnormality detection number adjustment interface.SELECTED DRAWING: Figure 4

Description

Technical Field

[0001] The present invention relates to an abnormality detection adjustment device, an abnormality detection adjustment method, and an abnormality detection adjustment program.

Background Art

[0002] Patent Document 1 discloses a configuration in which an abnormality detection threshold value, which is a criterion for determining normal / abnormal health status in data analysis of health measurement data, can be manually set from the outside.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, in the invention described in Patent Document 1, there is a problem that only threshold value resetting specialized for individual data can be performed, and general-purpose and intuitive parameter setting cannot be performed according to various detection methods.

[0005] The present invention has been made in view of the above problems, and an object thereof is to provide an abnormality detection adjustment device, an abnormality detection adjustment method, and an abnormality detection adjustment program that enable a person without specialized knowledge to intuitively adjust parameters for controlling the strictness of abnormality detection by various detection methods.

Means for Solving the Problems

[0006] To solve the above-mentioned problems and achieve the objective, the present invention provides an anomaly detection adjustment device comprising a storage unit and a control unit, wherein the storage unit comprises a detection storage means for storing detection results detected by each detection method on business data, and an algorithm adjustment parameter master which associates the detection method, parameters that serve as an anomaly detection criterion, values ​​for each parameter, and a detection count index adjusted to increase as the number of anomaly detections by the detection method increases, and the control unit comprises an adjustment display means for displaying an anomaly detection count adjustment interface that can adjust the detection count index based on the algorithm adjustment parameter master, and a result acquisition means for acquiring a determination result which sets the number of anomaly detections of the anomaly detection results, which are detection results that are determined to be anomalies by the detection method on the business data, based on a selected detection count index selected via the anomaly detection count adjustment interface.

[0007] Furthermore, in the anomaly detection adjustment device according to the present invention, the adjustment display means is characterized by displaying an anomaly detection count adjustment slider bar that can adjust the detection count index based on the algorithm adjustment parameter master.

[0008] Furthermore, in the anomaly detection adjustment device according to the present invention, the storage unit further comprises an anomaly determination definition, which is a definition of an anomaly determination on the business data, and an anomaly determination definition master, which is set by associating the detection method with the storage unit, and the adjustment display means displays the anomaly determination definition in a selectable manner, and when a selected anomaly determination definition is selected, displays an anomaly detection count adjustment interface that can adjust the detection count index associated with the detection method corresponding to the selected anomaly determination definition based on the anomaly determination definition master and the algorithm adjustment parameter master.

[0009] Furthermore, the anomaly detection adjustment device according to the present invention is characterized in that the control unit further comprises a result output means for outputting the number of data items set in the detection result and the judgment result.

[0010] Furthermore, in the anomaly detection adjustment device according to the present invention, the storage unit further comprises an anomaly rank adjustment parameter master which is set by associating an anomaly rank index adjusted to increase according to the degree of anomaly of the anomaly detection result with the values ​​of the parameter that adjusts the anomaly rank, the adjustment display means further displays an anomaly rank distribution adjustment interface which can distribute and adjust the anomaly rank index based on the anomaly rank adjustment parameter master, the result acquisition means further acquires a distribution result which sets the number of anomaly detection cases distributed to each anomaly rank based on the selected anomaly rank index selected via the anomaly rank distribution adjustment interface, and the control unit further comprises a result output means which outputs the number of anomaly detection cases and the distribution result.

[0011] Furthermore, in the abnormality detection and adjustment device according to the present invention, the adjustment display means is characterized in that it displays an abnormality rank distribution adjustment slider bar that can distribute and adjust the abnormality rank index based on the abnormality rank adjustment parameter master.

[0012] Furthermore, in the abnormality detection adjustment device according to the present invention, the abnormality rank is characterized in that it includes an abnormality rank 1 for sorting abnormality detection results of abnormalities that are smaller than the average value of abnormalities indicating the degree of abnormality of the abnormality detection result, an abnormality rank 2 for sorting abnormality detection results of abnormalities that are equal to or greater than the average value of abnormalities and smaller than the sum of the average value of abnormalities and the standard deviation of abnormalities, and an abnormality rank 3 for sorting abnormality detection results of abnormalities that are equal to or greater than the sum of the average value of abnormalities and the standard deviation of abnormalities.

[0013] Furthermore, in the abnormality detection adjustment device according to the present invention, the abnormality rank is characterized in that it includes abnormality rank 1 for sorting abnormality detection results of abnormality levels that are smaller than the product of the average value of the abnormality level indicating the degree of abnormality of the abnormality result and the value of the parameter; abnormality rank 2 for sorting abnormality detection results of abnormality levels that are greater than or equal to the product of the product of the average value of the abnormality level and the value of the parameter, and smaller than the product of the sum of the average value of the abnormality level and the standard deviation of the abnormality level and the value of the parameter; and abnormality rank 3 for sorting abnormality detection results of abnormality levels that are greater than or equal to the product of the sum of the average value of the abnormality level and the standard deviation of the abnormality level and the value of the parameter.

[0014] Furthermore, the anomaly detection adjustment method according to the present invention is an anomaly detection adjustment method to be executed by an anomaly detection adjustment device comprising a storage unit and a control unit, wherein the storage unit comprises a detection storage means for storing detection results detected by each detection method for business data, and an algorithm adjustment parameter master which associates the detection method, parameters that serve as an anomaly detection criterion, values ​​for each parameter, and a detection count index adjusted to increase as the number of anomaly detections by the detection method increases, and is characterized by comprising an adjustment display step executed by the control unit which displays an anomaly detection count adjustment interface that can adjust the detection count index based on the algorithm adjustment parameter master, and a result acquisition step which acquires a determination result which sets the number of anomaly detections of the anomaly detection results that are the detection results determined to be anomaly by the detection method for the business data, based on the selected detection count index selected via the anomaly detection count adjustment interface.

[0015] Furthermore, the anomaly detection adjustment program according to the present invention is an anomaly detection adjustment program to be executed by an anomaly detection adjustment device comprising a storage unit and a control unit, wherein the storage unit comprises a detection storage means for storing detection results detected by each detection method on business data, and an algorithm adjustment parameter master which associates the detection method, parameters that serve as an anomaly detection criterion, values ​​for each parameter, and a detection count index adjusted to increase as the number of anomaly detections by the detection method increases, and the control unit is characterized by executing an adjustment display step which displays an anomaly detection count adjustment interface that can adjust the detection count index based on the algorithm adjustment parameter master, and a result acquisition step which acquires a determination result which sets the number of anomaly detections of the anomaly detection results that are the detection results determined to be anomaly by the detection method on the business data, based on the selected detection count index selected via the anomaly detection count adjustment interface. [Effects of the Invention]

[0016] The present invention has the effect of easily adjusting the parameters that control the severity of anomaly detection when detecting signs of accounting fraud early using accounting and sales transaction data. Furthermore, the present invention has the effect of narrowing down the data that should be prioritized for review by adjusting the number of detections. Furthermore, the present invention has the effect of simplifying the settings related to anomaly detection when operating internal controls. Furthermore, the present invention has the effect of allowing even personnel without knowledge of statistics to set up anomaly detection. Furthermore, the present invention has the effect of promoting customer autonomy by eliminating the difficulty of statistics and making settings easy to understand visually. Furthermore, the present invention has the effect of improving operational efficiency by preventing fraud and errors. Furthermore, the present invention has the effect of adjusting the scale of parameters set for each detection method, the relative magnitudes of parameters and the relative magnitudes of the number of detections for each method, and the data that should be prioritized for review among the data detected as anomalies. [Brief explanation of the drawing]

[0017] [Figure 1] Figure 1 is a schematic diagram of the functions in this embodiment. [Figure 2] Figure 2 is a schematic diagram of the functions in this embodiment. [Figure 3] Figure 3 is a schematic diagram of the functions in this embodiment. [Figure 4] Figure 4 is a block diagram showing an example of the configuration of the anomaly detection and adjustment device in this embodiment. [Figure 5] Figure 5 shows an example of an abnormality determination definition master in this embodiment. [Figure 6] Figure 6 shows an example of an abnormality detection data definition master in this embodiment. [Figure 7] Figure 7 shows an example of an abnormality detection data stored parameter definition master in this embodiment. [Figure 8]FIG. 8 is a diagram showing an example of an abnormal determination data result set definition master in the present embodiment. [Figure 9] FIG. 9 is a diagram showing an example of an abnormal determination definition data mapping master in the present embodiment. [Figure 10] FIG. 10 is a diagram showing an example of an algorithm adjustment parameter master in the present embodiment. [Figure 11] FIG. 11 is a diagram showing an example of the magnitude relationship between the value of a parameter and the number of detected cases in the present embodiment. [Figure 12] FIG. 12 is a diagram showing an example of an abnormality degree rank adjustment parameter master in the present embodiment. [Figure 13] FIG. 13 is a flowchart showing an example of the processing of an abnormality detection adjustment device in the present embodiment. [Figure 14] FIG. 14 is a diagram showing an example of an alert definition parameter setting process in the present embodiment. [Figure 15] FIG. 15 is a diagram showing an example of an alert definition parameter setting process in the present embodiment. [Figure 16] FIG. 16 is a diagram showing an example of an alert definition parameter setting process in the present embodiment. [Figure 17] FIG. 17 is a diagram showing an example of an alert definition parameter setting process in the present embodiment. [Figure 18] FIG. 18 is a diagram showing an example of an alert definition parameter setting process in the present embodiment. [Figure 19] FIG. 19 is a diagram showing an example of an alert definition parameter setting process in the present embodiment. [Figure 20] FIG. 20 is a diagram showing an example of an alert definition parameter setting process in the present embodiment. [Figure 21] FIG. 21 is a diagram showing an example of an alert definition parameter setting process in the present embodiment. [Figure 22] FIG. 22 is a diagram showing an example of a detected case number adjustment process in the present embodiment. [Figure 23]Figure 23 shows an example of the detection count adjustment process in this embodiment. [Figure 24] Figure 24 shows an example of the detection count adjustment process in this embodiment. [Figure 25] Figure 25 shows an example of the detection count adjustment process in this embodiment. [Figure 26] Figure 26 shows an example of the detection count adjustment process in this embodiment. [Figure 27] Figure 27 shows an example of the detection count adjustment process in this embodiment. [Figure 28] Figure 28 shows an example of the abnormality rank distribution process in this embodiment. [Figure 29] Figure 29 shows an example of the abnormality rank distribution process in this embodiment. [Figure 30] Figure 30 shows an example of the abnormality rank distribution process in this embodiment. [Figure 31] Figure 31 shows an example of the abnormality rank distribution process in this embodiment. [Figure 32] Figure 32 shows an example of the abnormality rank distribution process in this embodiment. [Modes for carrying out the invention]

[0018] Embodiments of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to these embodiments.

[0019] [1. Overview] First, the outline of the present invention will be described with reference to Figures 1 to 3. Figures 1 to 3 are schematic diagrams of the functions in this embodiment.

[0020] Traditionally, adjusting the strictness of anomaly detection in business data was difficult for those without specialized knowledge because the scale of the parameters varied depending on the detection method. This could lead to situations where all data had to be reviewed without being able to adjust the number of detected data items, and there was a risk that all data could not be reviewed if a large number of data items were detected as anomalies. Therefore, there was a need for a mechanism to easily adjust the strictness of detection, particularly to narrow down the data that should be given priority, by adjusting parameters for each detection method. In addition, there was a need for a mechanism to check the detection results according to the parameters in order to know how much the number of detected items changes according to the adjusted parameters. In other words, a mechanism that allows parameters to be adjusted for each detection method, and a mechanism that allows the results according to the adjusted parameters, were necessary.

[0021] In other words, conventionally, the scale of the parameters to be set differed for each detection method (for example, in the mean standard deviation method, the parameter to be adjusted was the significance level, and the appropriate parameter range was 0 to 0.5; in the interquartile range method, the parameter to be adjusted was the interquartile range multiplier, and the appropriate parameter range was approximately 0.5 to 2.5), making it difficult to set appropriate values ​​and difficult to set values ​​manually. Therefore, a mechanism was needed to adjust parameters using a selection format rather than manual input.

[0022] Therefore, as shown in Figure 1, in this embodiment, the parameter values ​​are separated for each detection method, and the parameters are set on the same screen. By providing a mechanism that allows users to intuitively set the parameters to be adjusted in the form of a slider bar, users do not need to directly set the values, and users do not need to consider the scale of the parameter values.

[0023] Furthermore, conventionally, the relationship between the magnitude of parameters and the magnitude of the number of detected cases differed for each method (for example, increasing the parameter value tended to increase the number of detected cases, and increasing the parameter value tended to decrease the number of detected cases). As a result, it was unclear whether to set the parameter larger or smaller when the goal was to reduce the number of detected cases, and a mechanism was needed to adjust the parameters in a way that showed the changes in the number of detected cases.

[0024] Therefore, as shown in Figure 2, in this embodiment, by setting the parameter adjustment direction in correspondence with the increase or decrease in the number of detected items, it is possible to adjust the parameters while knowing the increase or decrease in the number of detected items, by displaying explanations such as "Detect only important items": decrease the number of detected items, and "Detect broadly": increase the number of detected items, and by providing a mechanism to display the result of the number of detected items after adjustment, it is possible to adjust the parameters while knowing the increase or decrease in the number of detected items, and to adjust the parameters while checking the fluctuation in the number of detected items.

[0025] Furthermore, in the past, it was necessary to prioritize which data to review among the data detected as anomaly. Therefore, anomaly ranks were automatically assigned to the data detected as anomaly, but this could lead to a situation where all data detected as anomaly had to be reviewed, and it was not possible to adjust the number of data that should be reviewed preferentially. Thus, a mechanism was needed that could adjust the assignment of anomaly ranks and narrow down the data that should be reviewed preferentially.

[0026] Therefore, as shown in Figure 3, in this embodiment, a parameter for adjusting the distribution of abnormality ranks is set, similar to the parameter for adjusting the number of detected cases. By providing a mechanism to display the results of the rank distribution after adjusting the parameters, it is possible to narrow down the data that should be checked preferentially (those with a high degree of abnormality), and to adjust while checking the changes in the distribution of abnormality ranks.

[0027] [2. Structure] An example of the configuration of the abnormality detection and adjustment device 100 according to this embodiment will be described with reference to Figures 4 to 12. Figure 4 is a block diagram showing an example of the configuration of the abnormality detection and adjustment device 100 in this embodiment.

[0028] As shown in Figure 4, the anomaly detection and adjustment device 100 is a commercially available desktop personal computer. However, the anomaly detection and adjustment device 100 is not limited to stationary information processing devices such as desktop personal computers, but may also be portable information processing devices such as commercially available notebook personal computers, PDAs (Personal Digital Assistants), smartphones, and tablet personal computers.

[0029] The anomaly detection and adjustment device 100 comprises a control unit 102, a communication interface unit 104, a storage unit 106, and an input / output interface unit 108. Each part of the anomaly detection and adjustment device 100 is connected to communicate via any communication path.

[0030] The communication interface unit 104 connects the anomaly detection and adjustment device 100 to the network 300 via communication devices such as routers and wired or wireless communication lines such as dedicated lines. The communication interface unit 104 has the function of communicating data with other devices via communication lines. Here, the network 300 has the function of connecting the anomaly detection and adjustment device 100 and the server 200 so that they can communicate with each other, and is, for example, the Internet or a LAN (Local Area Network).

[0031] The input / output interface unit 108 is connected to an input device 112 and an output device 114. The output device 114 can be a monitor (including a touch panel), a speaker, or a printer. The input device 112 can be a keyboard, a mouse, a microphone, or a monitor that works in conjunction with a mouse to provide pointing device functionality. In the following, the output device 114 may be referred to as the monitor 114 or printer 114, and the input device 112 may be referred to as the keyboard 112 or mouse 112.

[0032] The storage unit 106 stores various databases, tables, and files. The storage unit 106 also stores computer programs that work in cooperation with the OS (Operating System) to give instructions to the CPU (Central Processing Unit) to perform various processes. As the storage unit 106, for example, memory devices such as RAM (Random Access Memory) and ROM (Read Only Memory), fixed disk devices such as hard disks, flexible disks, and optical disks can be used. The storage unit 106 includes an abnormality judgment definition master 106a, an abnormality judgment data definition master 106b, an abnormality judgment data stored parameter definition master 106c, an abnormality judgment data result set definition master 106d, an abnormality judgment definition data mapping master 106e, a detection database 106f, an algorithm adjustment parameter master 106g, and an abnormality rank adjustment parameter master 106h.

[0033] The anomaly detection definition master 106a is a master that manages anomaly detection definitions, which are definitions of anomalies in business data. Here, the anomaly detection definition master 106a may have anomaly detection definitions, which are definitions of anomalies in business data, and detection methods linked together.

[0034] Now, with reference to Figure 5, an example of the abnormality determination definition master 106a in this embodiment will be described. Figure 5 is a diagram showing an example of the abnormality determination definition master 106a in this embodiment.

[0035] As shown in Figure 5, in the anomaly determination definition master 106a of this embodiment, the anomaly determination definition, detection method (algorithm), status, and anomaly degree adjustment parameter are linked and set.

[0036] Returning to Figure 4, the anomaly determination data definition master 106b is a master that manages the data of the stored procedure used to obtain the data for anomaly determination.

[0037] Now, with reference to Figure 6, an example of the abnormality determination data definition master 106b in this embodiment will be described. Figure 6 is a diagram showing an example of the abnormality determination data definition master 106b in this embodiment.

[0038] As shown in Figure 6, in the abnormality determination data definition master 106b of this embodiment, data definitions and stored procedures are linked and configured.

[0039] Returning to Figure 4, the Anomaly Determination Data Stored Parameter Definition Master 106c is a master that manages the data for the parameters of the stored procedure used to obtain data for anomaly determination.

[0040] Now, with reference to Figure 7, an example of the abnormality detection data stored parameter definition master 106c in this embodiment will be described. Figure 7 is a diagram showing an example of the abnormality detection data stored parameter definition master 106c in this embodiment.

[0041] As shown in Figure 7, in the abnormality detection data stored parameter definition master 106c of this embodiment, the data definition, parameter name, and parameter value are linked and set.

[0042] Returning to Figure 4, the anomaly determination data result set definition master 106d is a master that manages the column data of the result set of the stored procedure that retrieves the data used for determination, as the data used for anomaly determination.

[0043] Now, with reference to Figure 8, an example of the abnormality determination data result set definition master 106d in this embodiment will be described. Figure 8 is a diagram showing an example of the abnormality determination data result set definition master 106d in this embodiment.

[0044] As shown in Figure 8, in the abnormality determination data result set definition master 106d of this embodiment, the data definition and the item name are linked and set.

[0045] Returning to Figure 4, the anomaly detection definition data mapping master 106e is a master that manages the data definitions used in the anomaly detection definition.

[0046] Here, with reference to Figure 9, an example of the anomaly determination definition data mapping master 106e in this embodiment will be described. Figure 9 is a diagram showing an example of the anomaly determination definition data mapping master 106e in this embodiment.

[0047] As shown in Figure 9, in the abnormality determination definition data mapping master 106e of this embodiment, the abnormality determination definition and the data definition are linked and set together.

[0048] Returning to Figure 4, the detection database 106f stores the detection results obtained from each detection method for the business data.

[0049] The algorithm adjustment parameter master 106g is a master that associates detection methods, parameters that serve as anomaly detection criteria, values ​​for each parameter, and a detection count index that is adjusted to increase as the number of anomalies detected by the detection method increases.

[0050] Here, an example of the algorithm adjustment parameter master 106g in this embodiment will be described with reference to Figures 10 and 11. Figure 10 is a diagram showing an example of the algorithm adjustment parameter master 106g in this embodiment. Figure 11 is a diagram showing an example of the relationship between the parameter value and the number of detections in this embodiment.

[0051] As shown in Figure 10, in this embodiment, the algorithm adjustment parameter master 106g manages values ​​for each detection method (algorithm) × parameter. Furthermore, as shown in Figure 11, in this embodiment, for detection methods where the relationship between the number of detected items and the parameter value differs, the master is managed so that the values ​​decrease in index order, and the number of detected items increases as the index increases.

[0052] Returning to Figure 4, the anomaly rank adjustment parameter master 106h is a master set by associating the values ​​of the parameter that adjusts the anomaly rank with the anomaly rank index, which is adjusted to increase according to the degree of anomaly in the anomaly detection result. Here, the anomaly rank may include anomaly rank 1 for distributing anomaly detection results with an anomaly rank smaller than the average anomaly score, anomaly rank 2 for distributing anomaly detection results with an anomaly score greater than or equal to the average anomaly score and less than the sum of the average anomaly score and the standard deviation of the anomaly score, and anomaly rank 3 for distributing anomaly detection results with an anomaly score greater than or equal to the sum of the average anomaly score and the standard deviation of the anomaly score. Furthermore, the anomaly rank may include anomaly rank 1 for sorting anomaly detection results with an anomaly level smaller than the product of the average anomaly level and the parameter value; anomaly rank 2 for sorting anomaly detection results with an anomaly level that is greater than or equal to the product of the average anomaly level and the parameter value, and less than the product of the sum of the average anomaly level and the standard deviation of the anomaly level and the parameter value; and anomaly rank 3 for sorting anomaly detection results with an anomaly level that is greater than or equal to the product of the sum of the average anomaly level and the standard deviation of the anomaly level and the parameter value.

[0053] Here, with reference to Figure 12, an example of the abnormality rank adjustment parameter master 106h in this embodiment will be described. Figure 12 is a diagram showing an example of the abnormality rank adjustment parameter master 106h in this embodiment.

[0054] As shown in Figure 12, in the abnormality rank adjustment parameter master 106h of this embodiment, the values ​​of the parameters that adjust the abnormality rank are managed, and as the index increases, the distribution of abnormality ranks is adjusted in a direction that reduces the number of data with a high degree of abnormality.

[0055] Returning to Figure 4, the control unit 102 is a CPU or the like that comprehensively controls the abnormality detection adjustment device 100. The control unit 102 has an internal memory for storing control programs such as the OS, programs that define various processing procedures, and required data, and executes various information processing based on these stored programs. Functionally, the control unit 102 comprises an adjustment display unit 102a, a result acquisition unit 102b, and a result output unit 102c.

[0056] The adjustment display unit 102a displays an anomaly detection count adjustment interface that allows adjustment of the detection count index. Here, the adjustment display unit 102a may display an anomaly detection count adjustment interface that allows adjustment of the detection count index based on the algorithm adjustment parameter master 106g. Alternatively, the adjustment display unit 102a may display an anomaly detection count adjustment slider bar that allows adjustment of the detection count index based on the algorithm adjustment parameter master 106g. Furthermore, the adjustment display unit 102a may display an anomaly judgment definition in a selectable manner, and if a selected anomaly judgment definition is selected, it may display an anomaly detection count adjustment interface that allows adjustment of the detection count index associated with the detection method corresponding to the selected anomaly judgment definition based on the anomaly judgment definition master 106a and the algorithm adjustment parameter master 106g. Additionally, the adjustment display unit 102a may display an anomaly rank distribution adjustment interface that allows distribution adjustment of the anomaly rank index based on the anomaly rank adjustment parameter master 106h. Furthermore, the adjustment display unit 102a may display an abnormality rank distribution adjustment slider bar that allows for the distribution and adjustment of the abnormality rank index based on the abnormality rank adjustment parameter master 106h.

[0057] The result acquisition unit 102b acquires a determination result that sets the number of abnormal detection results, which are detection results that are determined to be abnormal by a detection method applied to business data. Here, the result acquisition unit 102b may acquire a determination result that sets the number of abnormal detection results, which are detection results that are determined to be abnormal by a detection method applied to business data, based on a selected detection count index selected via the abnormality count adjustment interface. Alternatively, the result acquisition unit 102b may acquire a distribution result that sets the number of abnormality rank distributions, which are obtained by distributing the number of abnormality detections to each abnormality rank, based on a selected abnormality rank index selected via the abnormality rank distribution adjustment interface.

[0058] The result output unit 102c outputs the judgment result. Here, the result output unit 102c may output the number of data items set as the detection result and the judgment result. Alternatively, the result output unit 102c may output the number of anomaly detections and the sorting result.

[0059] [3. Specific Examples] A specific example of this embodiment will be described with reference to Figures 13 to 32.

[0060] [Anomaly detection and adjustment process] Here, with reference to Figure 13, an example of the abnormality detection and adjustment process in this embodiment will be described. Figure 13 is a flowchart showing an example of the process of the abnormality detection and adjustment device 100 in this embodiment.

[0061] As shown in Figure 13, the adjustment display unit 102a displays an abnormality determination definition on the output device 114 so that it can be selected, and acquires the selected abnormality determination definition selected by the user via the input device 112 (step SA-1).

[0062] Then, the adjustment display unit 102a displays an anomaly detection count adjustment slider bar on the output device 114, which allows adjustment of the detection count index based on the algorithm adjustment parameter master 106g, and obtains the selected detection count index selected by the user via the input device 112 using the anomaly detection count adjustment slider bar (step SA-2).

[0063] Then, the result acquisition unit 102b acquires a determination result that sets the number of abnormal detection results, which are detection results that are determined to be abnormal by the detection method applied to the business data, based on the selected detection count index (step SA-3).

[0064] Then, the adjustment display unit 102a displays an abnormality rank distribution adjustment slider bar on the output device 114, which allows for the distribution and adjustment of the abnormality rank index based on the abnormality rank adjustment parameter master 106h, and obtains the selected abnormality rank index selected by the user via the input device 112 using the abnormality rank distribution adjustment slider bar (step SA-4).

[0065] Then, the result acquisition unit 102b acquires a distribution result in which the number of detected anomalies is distributed to each anomaly rank based on the selected anomaly rank index, and sets the number of anomaly rank distribution items (step SA-5).

[0066] Then, the result output unit 102c displays the number of data items and judgment results set for detection results, as well as the number of abnormal detections and distribution results, on the output device 114 (step SA-6), and terminates the process.

[0067] Here, an example of the alert definition parameter setting process in this embodiment will be described with reference to Figures 14 to 21. Figures 14 to 21 are diagrams showing an example of the alert definition parameter setting process in this embodiment.

[0068] In this embodiment, when the settings for the data, methods, and update content of the results used for anomaly detection are completed, the values ​​of the parameters that adjust the index and anomaly rank are set when the alert definition parameter setting screen, which adjusts the severity of anomaly detection and the distribution of anomaly ranks, is launched, as shown in Figure 14.

[0069] As shown in Figure 15, in this embodiment, an abnormality detection definition that adjusts parameters created by the user is selected.

[0070] As shown in Figure 16, in this embodiment, parameters corresponding to the detection method set in the selected anomaly detection definition are acquired, and the parameter values ​​for adjusting the index and the number of detections are set, allowing the user to intuitively set the parameters without being aware of the method. Here, as shown in Figure 17, in this embodiment, there are detection methods (for example, the significance level of the mean standard deviation) where the parameter values ​​for the index are not evenly spaced but have varying magnitudes depending on the algorithm, but by adjusting the values ​​using a slider bar, the user can intuitively adjust to values ​​in different ranges, and it is possible to adjust so that the number of detections does not fluctuate drastically. Thus, in this embodiment, parameter values ​​can be selected in the form of a slider bar, the parameter values ​​to be adjusted for each detection method can be extracted, and adjustments can be made so that the number of detections does not fluctuate drastically even when changing values ​​in different ranges, and parameter adjustments can be made on the same screen regardless of the detection method.

[0071] As shown in Figure 18, in this embodiment, the detection count parameter is adjusted by the user moving a slider bar left or right, allowing the user to observe the change in the result and understand the relationship between the magnitudes of the parameter values ​​and the magnitudes of the detection counts. Thus, in this embodiment, the direction in which the parameter is adjusted affects the detection result, the result of the detection count after parameter adjustment is displayed in real time, and it can be set in a slider bar format, making it intuitive to adjust.

[0072] As shown in Figure 19, in this embodiment, the abnormality rank distribution is adjusted by moving the slider bar left or right by the user, allowing the user to check the changes in the results and adjust the number of data points that should be given particular importance among the data detected as abnormal. Thus, in this embodiment, the direction in which the parameter is adjusted is displayed as to how it affects the number of data points that should be given importance, the abnormality rank data after parameter adjustment is displayed in real time, and it can be set in a slider bar format, making it intuitive to adjust.

[0073] In this embodiment, as shown in Figure 20, once parameter adjustment is completed on the alert definition parameter setting screen, and as shown in Figure 21, when the user presses the registration button, the values ​​corresponding to the indices set on the sliders for the parameter that adjusts the number of detected cases and the parameter that adjusts the distribution of abnormality ranks are updated.

[0074] Furthermore, an example of the detection count adjustment process in this embodiment will be described with reference to Figures 22 to 27. Figures 22 to 27 are diagrams showing an example of the detection count adjustment process in this embodiment.

[0075] As shown in Figure 22, in this embodiment, data of the algorithm associated with the anomaly detection definition selected by the user is acquired.

[0076] As shown in Figure 23, in this embodiment, data used for anomaly detection is obtained based on the stored procedure data, the stored procedure parameter data, and the result set data.

[0077] As shown in Figure 24, in this embodiment, anomaly detection is performed based on the algorithm data. Specifically, as shown in Figure 24, in the anomaly detection using the interquartile range in this embodiment, the range for anomaly detection is adjusted by the interquartile range magnification, the data set in the column names of the anomaly judgment definition are plotted in ascending order, and since the test is on the upper side, only data exceeding the upper limit is considered anomaly.

[0078] As shown in Figure 25, in this embodiment, the judgment result is displayed which includes a ratio of TRUE (abnormal) values ​​to the total number of data items used for the judgment: 1%, and the number of such values: 10.

[0079] Then, as shown in Figure 26, in this embodiment, the parameters are adjusted on the alert definition parameter setting screen to create the algorithm data. That is, as shown in Figure 26, in this embodiment, the interquartile range magnification is changed to a value corresponding to the index set by the slider bar.

[0080] As shown in Figure 27, in this embodiment, anomaly detection is performed and a judgment result is created based on the adjusted algorithm data and the data used for anomaly detection. In this embodiment, the data used for anomaly detection remains unchanged before and after parameter adjustment. As shown in Figure 27, in this embodiment, the judgment result is displayed which includes a ratio of TRUE (anomaly) to the total number of data points used for judgment: 0.2%, and the number of such points: 2.

[0081] Furthermore, an example of the abnormality rank distribution process in this embodiment will be described with reference to Figures 28 to 32. Figures 28 to 32 are diagrams showing an example of the abnormality rank distribution process in this embodiment.

[0082] As shown in Figure 28, in this embodiment, the distribution of anomaly ranks is based on a numerical value called "anomaly degree," and the method for calculating the "anomaly degree" differs depending on the detection method used for anomaly detection. Assuming that normal data has an anomaly rank of "0," and that data with a higher anomaly rank has a stronger degree of anomaly (data that should be checked with priority), a judgment is performed, and the data is divided into normal data (judgment result: FALSE) or abnormal data (judgment result: TRUE), and the anomaly degree is also calculated. Then, as shown in Figure 28, in this embodiment, based on the anomaly degree, the data is ranked into normal data ("anomaly rank: 0"), abnormal data with an "anomaly rank: 1" (degree of anomaly: low), abnormal data with an "anomaly rank: 2" (degree of anomaly: medium), and abnormal data with an "anomaly rank: 3" (degree of anomaly: high).

[0083] For example, as shown in Figure 29, in this embodiment, the abnormality rank of normal data is assigned to 0, the mean and standard deviation of the abnormality among the data determined to be abnormal are calculated, and the abnormality rank is assigned based on the mean and standard deviation of the abnormality.

[0084] As shown in Figure 30, in this embodiment, among the data determined to be abnormal, data where abnormality < "average abnormality" is assigned an "abnormality rank: 1", data where "average abnormality" ≤ abnormality < "average abnormality + 1 × standard deviation" is assigned an "abnormality rank: 2", and data where "average abnormality + 1 × standard deviation" ≤ abnormality is assigned an "abnormality rank: 3".

[0085] As shown in Figure 31, in this embodiment, the distribution of abnormality ranks is adjusted. In this way, in this embodiment, the distribution of abnormality ranks can be adjusted, allowing for the selection of data that should be prioritized for review. Specifically, as shown in Figure 32, in this embodiment, among the data determined to be abnormal, data where abnormality < "average abnormality" × adjustment parameter is assigned an "abnormality rank: 1", data where "average abnormality" × adjustment parameter ≤ abnormality < "average abnormality + 1 × standard deviation" × adjustment parameter is assigned an "abnormality rank: 2", and data where "average abnormality + 1 × standard deviation" × adjustment parameter ≤ abnormality is assigned an "abnormality rank: 3".

[0086] [4. Contribution to the United Nations-led Sustainable Development Goals (SDGs)] This embodiment can contribute to improving operational efficiency and promoting appropriate management decisions by companies, thereby contributing to SDGs Goals 8 and 9.

[0087] Furthermore, this embodiment can contribute to reducing waste and promoting paperless and digital processes, thereby contributing to SDGs Goals 12, 13, and 15.

[0088] Furthermore, this embodiment can contribute to strengthening control and governance, thereby enabling contributions to SDG Goal 16.

[0089] [5. Other Embodiments] In addition to the embodiments described above, the present invention may be implemented in various different embodiments within the scope of the technical idea described in the claims.

[0090] For example, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods.

[0091] Furthermore, the processing procedures, control procedures, specific names, information including parameters such as registration data and search conditions for each process, screen examples, and database configuration shown in this specification and in the drawings may be changed at will unless otherwise specified.

[0092] Furthermore, with respect to the anomaly detection and adjustment device 100, each component shown in the illustration is a functional concept and does not necessarily need to be physically configured as shown.

[0093] For example, the processing functions of the anomaly detection and adjustment device 100, particularly those performed by the control unit 102, may be implemented in whole or in part by a CPU and a program interpreted and executed by the CPU, or they may be implemented as wired logic hardware. The program is recorded on a non-temporary computer-readable recording medium containing programmed instructions for causing the information processing device to execute the processing described in this embodiment, and is mechanically read by the anomaly detection and adjustment device 100 as needed. That is, a storage unit such as ROM or HDD (Hard Disk Drive) contains a computer program that works in cooperation with the OS to give instructions to the CPU and perform various processing. This computer program is executed by being loaded into RAM and works in cooperation with the CPU to constitute the control unit.

[0094] Furthermore, this computer program may be stored on an application program server connected to the anomaly detection and adjustment device 100 via any network, and it is possible to download all or part of it as needed.

[0095] Furthermore, the program for executing the processing described in this embodiment may be stored on a non-temporary computer-readable recording medium, or it may be configured as a program product. Here, "recording medium" includes any "portable physical medium" such as memory cards, USB (Universal Serial Bus) memory, SD (Secure Digital) cards, flexible disks, magneto-optical disks, ROMs, EPROMs (Erasable Programmable Read Only Memory), EEPROMs (Registered Trademark) (Electrically Erasable and Programmable Read Only Memory), CD-ROMs (Compact Disk Read Only Memory), MOs (Magneto-Optical disks), DVDs (Digital Versatile Disks), and Blu-ray (Registered Trademark) Discs.

[0096] Furthermore, "program" refers to a data processing method described in any language or writing method, regardless of its format, such as source code or binary code. Note that "program" is not necessarily limited to a single, monolithic structure; it also includes distributed structures consisting of multiple modules or libraries, and those that work in cooperation with other programs, such as an operating system, to achieve their functions. Regarding the specific configuration and reading procedures for reading the recording medium in each device shown in this embodiment, as well as the installation procedures after reading, well-known configurations and procedures can be used.

[0097] The various databases stored in the memory unit 106 include memory devices such as RAM and ROM, fixed disk devices such as hard disks, flexible disks, and optical disks, and store various programs, tables, databases, and web page files used for various processes and website provision.

[0098] Furthermore, the anomaly detection and adjustment device 100 may be configured as an information processing device such as a known personal computer or workstation, or as an information processing device to which any peripheral device is connected. Alternatively, the anomaly detection and adjustment device 100 may be implemented by installing software (including programs or data, etc.) that enables the processing described in this embodiment onto the device.

[0099] Furthermore, the specific forms of distribution and integration of the devices are not limited to those shown in the figures, and all or part of them can be configured by functionally or physically distributing and integrating them in any unit according to various additions or functional loads. In other words, the embodiments described above may be implemented in any combination, or the embodiments may be implemented selectively. [Industrial applicability]

[0100] This invention is useful in various industries, including the retail industry. [Explanation of Symbols]

[0101] 100 Anomaly detection and adjustment device 102 Control Unit 102a Adjustment display section 102b Result acquisition part 102c Result Output Section 104 Communication Interface Section 106 Storage section 106a Anomaly detection definition master 106b Anomaly detection data definition master 106c Anomaly detection data stored parameter definition master 106d Anomaly detection data result set definition master 106e Anomaly detection definition data mapping master 106f Detection Database 106g Algorithm Adjustment Parameter Master 106h Anomaly Rank Adjustment Parameter Master 108 Input / Output Interface Section 112 Input device 114 Output device 200 servers 300 Networks

Claims

1. An anomaly detection and adjustment device comprising a memory unit and a control unit, The aforementioned storage unit is An anomaly detection definition, which is the definition of anomaly detection in business data, and an anomaly detection definition master, which is set by linking the detection method, A detection storage means for storing the detection results detected by each of the detection methods for the aforementioned business data, An algorithm adjustment parameter master is set by linking the aforementioned detection method, parameters that serve as anomaly detection criteria, the values ​​for each parameter, and a detection count index that is adjusted to increase as the number of anomalies detected by the aforementioned detection method increases. Equipped with, The control unit, An adjustment display means that displays an anomaly detection count adjustment interface that allows the selection of anomaly detection definitions, and when a selected anomaly detection definition is selected, allows the adjustment of the detection count index associated with the detection method corresponding to the selected anomaly detection definition based on the anomaly detection definition master and the algorithm adjustment parameter master. A result acquisition means that acquires a determination result that sets the number of anomaly detection results, which are detection results that are determined to be abnormal by the detection method applied to the business data, based on the selected detection count index selected via the anomaly detection count adjustment interface, An anomaly detection and adjustment device characterized by being equipped with the following features.

2. An anomaly detection and adjustment device comprising a memory unit and a control unit, The aforementioned storage unit is A detection storage means that stores the detection results detected by each detection method for business data, An algorithm adjustment parameter master is set by linking the aforementioned detection method, parameters that serve as anomaly detection criteria, the values ​​for each parameter, and a detection count index that is adjusted to increase as the number of anomalies detected by the aforementioned detection method increases. An abnormality rank index adjusted to increase according to the degree of abnormality in the abnormality detection result, and an abnormality rank adjustment parameter master set by associating the values ​​of the parameter that adjusts the abnormality rank, Equipped with, The control unit, An adjustment display means that displays an anomaly detection count adjustment interface that allows adjustment of the detection count index based on the algorithm adjustment parameter master, and displays an anomaly rank distribution adjustment interface that allows distribution adjustment of the anomaly rank index based on the anomaly rank adjustment parameter master, A result acquisition means that acquires a determination result which sets the number of anomaly detection results which are detection results which are determined to be abnormal by the detection method on the business data, based on the selected detection count index selected via the anomaly detection count adjustment interface, and acquires a distribution result which sets the number of anomaly rank distributions which are obtained by distributing the number of anomaly detections to each anomaly rank, based on the selected anomaly rank index selected via the anomaly rank distribution adjustment interface, An anomaly detection and adjustment device characterized by being equipped with the following features.

3. The aforementioned anomaly detection count adjustment interface is: The anomaly detection adjustment device according to claim 1 or 2, characterized in that it is an anomaly detection count adjustment slider bar.

4. The aforementioned storage unit is An anomaly determination definition, which is the definition of an anomaly determination on the aforementioned business data, and an anomaly determination definition master set by linking it with the aforementioned detection method. Furthermore, The adjustment display means is An anomaly detection adjustment device according to claim 2, characterized in that it displays the anomaly determination definitions in a selectable manner, and when a selected anomaly determination definition is selected, it displays an anomaly detection count adjustment interface that can adjust the detection count index associated with the detection method corresponding to the selected anomaly determination definition based on the anomaly determination definition master and the algorithm adjustment parameter master, and it displays an anomaly rank distribution adjustment interface that can distribute and adjust the anomaly rank index based on the anomaly rank adjustment parameter master.

5. The control unit, The number of data items set in the detection result, and the result output means for outputting the judgment result, An anomaly detection and adjustment device according to claim 1 or 2, further comprising the above.

6. The control unit, The number of anomaly detections and the result output means for outputting the distribution results, The abnormality detection and adjustment device according to claim 2, further comprising the above.

7. The adjustment display means is The anomaly detection adjustment device according to claim 2, characterized in that it displays an anomaly detection count adjustment interface that can adjust the detection count index based on the algorithm adjustment parameter master, and displays an anomaly rank distribution adjustment slider bar that can distribute and adjust the anomaly rank index based on the anomaly rank adjustment parameter master.

8. The aforementioned abnormality rank is, An anomaly detection adjustment device according to claim 2, characterized in that it includes an anomaly rank 1 for sorting anomaly detection results of an anomaly level that is smaller than the average value of the anomaly level indicating the degree of anomaly of the anomaly detection result, an anomaly rank 2 for sorting anomaly detection results of an anomaly level that is equal to or greater than the average value of the anomaly level and smaller than the sum of the average value of the anomaly level and the standard deviation of the anomaly level, and an anomaly rank 3 for sorting anomaly detection results of an anomaly level that is equal to or greater than the sum of the average value of the anomaly level and the standard deviation of the anomaly level.

9. The aforementioned abnormality rank is, An anomaly detection adjustment device according to claim 2, characterized in that it includes an anomaly rank 1 for sorting anomaly detection results of an anomaly degree that is less than the product of the average value of the anomaly degree indicating the degree of anomaly of the anomaly detection result and the value of the parameter; an anomaly rank 2 for sorting anomaly detection results of an anomaly degree that is greater than or equal to the product of the product of the average value of the anomaly degree and the value of the parameter, and less than the product of the sum of the average value of the anomaly degree and the standard deviation of the anomaly degree and the value of the parameter; and an anomaly rank 3 for sorting anomaly detection results of an anomaly degree that is greater than or equal to the product of the sum of the average value of the anomaly degree and the standard deviation of the anomaly degree and the value of the parameter.

10. An anomaly detection and adjustment method performed by an anomaly detection and adjustment device comprising a memory unit and a control unit, The aforementioned storage unit is An anomaly detection definition, which is the definition of anomaly detection in business data, and an anomaly detection definition master, which is set by linking the detection method, A detection storage means for storing the detection results detected by each of the detection methods for the aforementioned business data, An algorithm adjustment parameter master is set by linking the aforementioned detection method, parameters that serve as anomaly detection criteria, the values ​​for each parameter, and a detection count index that is adjusted to increase as the number of anomalies detected by the aforementioned detection method increases. Equipped with, The control unit is executed as follows: An adjustment display step that displays the anomaly detection count adjustment interface, which allows the selection of the anomaly detection definitions, and when a selected anomaly detection definition is selected, allows the adjustment of the detection count index associated with the detection method corresponding to the selected anomaly detection definition based on the anomaly detection definition master and the algorithm adjustment parameter master. A result acquisition step of acquiring a determination result that sets the number of anomaly detection results, which are detection results that are determined to be abnormal by the detection method applied to the business data, based on the selected detection count index selected via the anomaly detection count adjustment interface, An anomaly detection adjustment method characterized by including the following.

11. An anomaly detection and adjustment method performed by an anomaly detection and adjustment device comprising a memory unit and a control unit, The aforementioned storage unit is A detection storage means that stores the detection results detected by each detection method for business data, An algorithm adjustment parameter master is set by linking the aforementioned detection method, parameters that serve as anomaly detection criteria, the values ​​for each parameter, and a detection count index that is adjusted to increase as the number of anomalies detected by the aforementioned detection method increases. An abnormality rank index adjusted to increase according to the degree of abnormality in the abnormality detection result, and an abnormality rank adjustment parameter master set by associating the values ​​of the parameter that adjusts the abnormality rank, Equipped with, The control unit is executed as follows: An adjustment display step that displays an anomaly detection count adjustment interface that allows adjustment of the detection count index based on the algorithm adjustment parameter master, and an anomaly rank distribution adjustment interface that allows distribution adjustment of the anomaly rank index based on the anomaly rank adjustment parameter master, A result acquisition step involves obtaining a determination result that sets the number of anomaly detection results, which are detection results that are determined to be abnormal by the detection method applied to the business data, based on the selected detection count index selected via the anomaly detection count adjustment interface, and obtaining a distribution result that sets the number of anomaly rank distributions, which are obtained by distributing the number of anomaly detection results to each anomaly rank, based on the selected anomaly rank index selected via the anomaly rank distribution adjustment interface. An anomaly detection adjustment method characterized by including the following.

12. An anomaly detection adjustment program to be executed by an anomaly detection adjustment device comprising a memory unit and a control unit, The aforementioned storage unit is An anomaly detection definition, which is the definition of anomaly detection in business data, and an anomaly detection definition master, which is set by linking the detection method, A detection storage means for storing the detection results detected by each of the detection methods for the aforementioned business data, An algorithm adjustment parameter master is set by linking the aforementioned detection method, parameters that serve as anomaly detection criteria, the values ​​for each parameter, and a detection count index that is adjusted to increase as the number of anomalies detected by the aforementioned detection method increases. Equipped with, In the control unit, An adjustment display step that displays the anomaly detection count adjustment interface, which allows the selection of the anomaly detection definitions, and when a selected anomaly detection definition is selected, allows the adjustment of the detection count index associated with the detection method corresponding to the selected anomaly detection definition based on the anomaly detection definition master and the algorithm adjustment parameter master. A result acquisition step of acquiring a determination result that sets the number of anomaly detection results, which are detection results that are determined to be abnormal by the detection method applied to the business data, based on the selected detection count index selected via the anomaly detection count adjustment interface, An anomaly detection adjustment program to enable the execution of the program.

13. An anomaly detection adjustment program to be executed by an anomaly detection adjustment device comprising a memory unit and a control unit, The aforementioned storage unit is A detection storage means that stores the detection results detected by each detection method for business data, An algorithm adjustment parameter master is set by linking the aforementioned detection method, parameters that serve as anomaly detection criteria, the values ​​for each parameter, and a detection count index that is adjusted to increase as the number of anomalies detected by the aforementioned detection method increases. An abnormality rank index adjusted to increase according to the degree of abnormality in the abnormality detection result, and an abnormality rank adjustment parameter master set by associating the values ​​of the parameter that adjusts the abnormality rank, Equipped with, In the control unit, An adjustment display step that displays an anomaly detection count adjustment interface that allows adjustment of the detection count index based on the algorithm adjustment parameter master, and an anomaly rank distribution adjustment interface that allows distribution adjustment of the anomaly rank index based on the anomaly rank adjustment parameter master, A result acquisition step involves obtaining a determination result that sets the number of anomaly detection results, which are detection results that are determined to be abnormal by the detection method applied to the business data, based on the selected detection count index selected via the anomaly detection count adjustment interface, and obtaining a distribution result that sets the number of anomaly rank distributions, which are obtained by distributing the number of anomaly detection results to each anomaly rank, based on the selected anomaly rank index selected via the anomaly rank distribution adjustment interface. An anomaly detection adjustment program to enable the execution of the program.

Images