JP2008140100A - Information processor, data determination method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform determination of abnormality and spike-like noise in time-series data. <P>SOLUTION: A time-series data generation part 102 creates time-series data from data accumulated in a log storage part 101. An abnormality detection part 103 detects abnormal data whose data value is not normal in the time-series data. For a plurality of following data within a fixed time from the abnormal data as prediction object data, a spike determination part 106 calculates a prediction range of data value for each prediction object data, compares an actual data value of each prediction object data with the prediction range of data value, calculates the probability that the actual data value of each prediction object data is contained in the prediction range, and determines which of abnormal data and spike-like noise the abnormal data is based on the calculated probability. When the spike-like noise is determined, a data conversion part 107 substitutes the data in the log storage part 101 by a normal value that is alternative to the value of spike-like noise. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a technique for removing noise mixed in time-series data aligned along a time axis, for example.

Conventionally, when noise is mixed in time-series data, as described in JP-A-5-12240 and JP-A-2003-10188, noise is removed to improve detection accuracy and measurement system.
Japanese Patent Laid-Open No. 5-12240 JP 2003-10188 A

  In time-series data generated from the number of accesses obtained by collecting network logs in network anomaly detection, there are anomalies due to attacks such as worms, changes in normal state, and spike noise as data change points.

This spike noise suddenly occurs at a value that is higher than or equal to the abnormal value, and immediately returns to a normal value.
As shown in (1) of FIG. 2, when the numerical value increases rapidly, it is unclear at that time whether the rapid increase in numerical value is spike noise or abnormal.
As shown in (2) of FIG. 2, it may be later revealed that the rapid increase in the numerical value of (1) in FIG.

  On the other hand, as shown in (3) of FIG. 2, if the rapid increase in the numerical value of (1) in FIG. Therefore, it is necessary to remove spike noise.

In addition, it is necessary to detect an abnormal state as quickly as possible in network anomaly detection. However, if spike noise remains in the network, the spike noise level is high, so the detection of the beginning of the anomaly is detected. May be delayed ((3) in FIG. 2).
For example, if the normal state gradually changes due to the influence of a worm or the like, it can be said that the influence on the detection of the start of the abnormal state is great.

  Furthermore, even when the number of accesses increases and it is determined that there is an abnormality, there is a case where the result is a change in the normal state ((4) in FIG. 2), and all the data determined as not normal is removed. It is not possible.

  On the other hand, when noise is removed by the conventional technique, there is only a distinction between data being normal or abnormal, or normal or noise, and there is a problem that it is impossible to distinguish between abnormalities in network data and spike noise.

  The main object of the present invention is to solve the above-described problems, and to perform highly accurate abnormality detection.

An information processing apparatus according to the present invention includes:
An abnormal data detector that monitors time-series data arranged along the time axis and detects abnormal data in which data values are not normal in the time-series data;
A plurality of data within a certain time period from the abnormal data on the time axis is set as the prediction target data, the prediction range of the data value is calculated for each prediction target data, and the actual data value and the data value of each prediction target data are calculated. A non-normal data determination unit that compares the prediction range and determines whether the abnormal data is abnormal data or noise based on a comparison result.

  According to the present invention, when abnormal data is detected, it is determined whether the detected abnormal data is abnormal or sudden noise. Therefore, highly accurate abnormality detection can be performed.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a configuration of a log analysis apparatus and the like according to Embodiment 1 of the present invention.
In FIG. 1, a log analysis device 10 (information processing device) analyzes a log output by the log collection device 20 and notifies an analysis result.
The log collection device 20 collects and outputs logs by monitoring the network.
The display device 105 displays the analysis result of the log analysis device 10.

In the log analysis device 10, the log storage unit 101 stores the log output from the log collection device 20.
The time series data generation unit 102 arranges the data accumulated in the log storage unit 101 along the time axis, and creates time series data.
The abnormality detection unit 103 monitors time-series data arranged along the time axis, and detects abnormal data whose data values are not normal in the time-series data. The abnormality detection unit 103 is an example of an abnormal data detection unit.
The notification unit 104 notifies the detection of abnormal data.
When abnormal data is detected, the spike determination unit 106 determines whether it is spike noise or abnormal data. The spike determination unit 106 is an example of an abnormal data determination unit.
The data conversion unit 107 calculates a normal value that replaces the value of the abnormal data, and replaces the data in the log storage unit 101. The data conversion unit 107 is an example of a data rewriting unit.

  The spike determination unit 106 calculates a prediction range of data values for each prediction target data using a plurality of subsequent data within a certain time from the abnormal data on the time axis, and calculates the prediction range of the data value for each prediction target data. And the prediction range of the data value are compared, the probability that the actual data value of each prediction target data is included in the prediction range is calculated, and based on the calculated probability, the abnormal data is detected as abnormal data and noise. It is determined which one.

More specifically, the spike determination unit 106 calculates the prediction range of the data value for each prediction target data by reflecting the abnormal data value of the abnormal data, and sets the first prediction range of each prediction target data. In addition, the normal data value is reflected instead of the abnormal data value of the abnormal data, and the prediction range of the data value is calculated for each prediction target data to obtain the second prediction range of each prediction target data.
Then, the spike determination unit 106 compares the actual data value with the first prediction range for each prediction target data, and determines the probability that the actual data value of each prediction target data is included in the first prediction range. And the actual data value for each prediction target data is compared with the second prediction range, and the probability that the actual data value of each prediction target data is included in the second prediction range is calculated. And the first probability and the second probability calculated are compared to determine whether the abnormal data is abnormal data or noise.
Detailed operation examples of the spike determination unit 106 and other elements will be described later.

Next, a hardware configuration example of the log analysis device 10 shown in the present embodiment and the embodiments described below will be described.
FIG. 6 is a diagram illustrating an example of hardware resources of the log analysis device 10 according to the present embodiment and the embodiments described below. 6 is merely an example of the hardware configuration of the log analysis device 10, and the hardware configuration of the log analysis device 10 is not limited to the configuration illustrated in FIG. Also good.

6, the log analysis apparatus 10 includes a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, a processing unit, a microprocessor, a microcomputer, and a processor) that executes a program. The CPU 911 is connected to, for example, a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a display device 901, a keyboard 902, a mouse 903, and a magnetic disk device 920 via a bus 912. Control hardware devices. Further, the CPU 911 may be connected to an FDD 904 (Flexible Disk Drive), a compact disk device 905 (CDD), a printer device 906, and a scanner device 907. Further, instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of a storage device or a storage unit.
The communication board 915, the keyboard 902, the scanner device 907, the FDD 904, and the like are examples of an input unit and an input device.
Further, the communication board 915, the display device 901, the printer device 906, and the like are examples of an output unit and an output device.

The communication board 915 is connected to a LAN (Local Area Network), the Internet, a WAN (Wide Area Network), etc., for example.
The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924. The programs in the program group 923 are executed by the CPU 911, the operating system 921, and the window system 922.

The program group 923 stores programs that execute the functions described as “˜unit” and “˜means” in the description of the present embodiment and the following embodiments. The program is read and executed by the CPU 911.
In the file group 924, in the following description, “determination of”, “calculation of”, “comparison of”, “generation of”, “replacement of”, “detection of”, “ Information, data, signal values, variable values, and parameters indicating the result of the processing described as “setting” are stored as items of “˜file” and “˜database”. The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, Used for CPU operations such as calculation, calculation, processing, editing, output, printing, and display. Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
The arrows in the flowchart described below mainly indicate input / output of data and signals. The data and signal values are the RAM 914 memory, FDD 904 flexible disk, CDD 905 compact disk, magnetic disk device 920 magnetic disk, In addition, it is recorded on a recording medium such as an optical disc, a mini disc, or a DVD. Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

  In addition, what is described as “to part” and “to means” in the description of this embodiment and the following embodiments is “to circuit”, “to apparatus”, “to device”, and “to”. It may be “means”, and may be “˜step”, “˜procedure”, and “˜processing”. That is, what is described as “˜unit” and “˜means” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as “˜unit” and “˜means” of the present embodiment and the embodiments described below. Alternatively, the procedures and methods of “˜unit” and “˜means” of the present embodiment and the embodiments described below are executed by a computer.

  As described above, the log analysis apparatus 10 according to the present embodiment and the embodiments described below includes a CPU as a processing device, a memory as a storage device, a magnetic disk, an input device such as a keyboard, a mouse, and a communication board. A computer provided with a display device, a communication board, etc., which realizes the functions indicated as “to part” and “to means” by using these processing devices, storage devices, input devices, and output devices as described above. It is.

Next, an operation example (data determination method) of the log analysis apparatus 10 will be described with reference to FIG.
In the log analyzer 10, the time-series data generation unit 102 extracts data from the log storage unit 101, and generates time-series data by aligning the extracted data along the time axis (step S1).
The abnormality detection unit 103 analyzes the time series data (step S2).
As a result of the analysis, it is determined whether or not it is normal (step S4) (step S5) (step S3) (unnormal data detection step).
This anomaly detection method includes a method in which time series data is subjected to singular value decomposition to calculate feature amounts, and feature amounts corresponding to each time point in the time series are detected using an index such as Mahalanobis distance, or AR There are methods using a time series model such as (Auto Regressive) and ARMA (Auto Regressive Moving Average).
When the abnormality detection unit 103 detects data that is not normal at the time point N, the abnormality detection unit 103 notifies the detection of the abnormal state via the notification unit 104 and displays it on the display device 105 (step S6).
Further, the spike determination unit 106 is notified of the detection of an abnormal state (step S7).

Next, an operation example (non-normal data determination step) of the spike determination unit 106 will be described with reference to FIG.
The spike determination unit 106 acquires the time series data of the period T1 immediately before the time point N from the log storage unit 101 via the time series data generation unit 102 (step S8).
When X (i) is expressed as data at time point i, the time-series data acquired here is X (N−T1), X (N−T1 + 1),..., X (N−1).
X (N−T1), X (N−T1 + 1),..., X (N−1), X (N) time-series data is added to this, and spike determination unit A time series model such as AR or ARMA is used to calculate a prediction value P (N + 1) and a prediction error PE (N + 1) at time N + 1 (step S9).
Next, a value (actual value) X (N + 1) at time N + 1 is obtained from the log storage unit 101 via the time series data generation unit 102 (step S10).
It is checked whether the actual measurement value X (N + 1) satisfies the condition of the formula (1). (Step S11)
P (N + 1) -PE (N + 1) <X (N + 1) <P (N + 1) + PE (N + 1)

  Next, using the data from X (N−T1 + 1) to X (N + 1), the prediction value P (N + 2) and the prediction error PE (N + 2) at time N + 2 are calculated. Next, the value (measured value) X (N + 2) of the time point N + 2 is obtained from the log storage unit 101 via the time series data generation unit 102, and the measured value X (N + 2) is the predicted value P as in the case of the time point N + 1. Check whether it is within the range of (N + 2) ± prediction error PE (N + 2).

  The range of these P (N + i) ± PE (N + i) is the range of the predicted value of the data at N + i calculated by reflecting the abnormal data value (actual value) of the abnormal data X (N), It corresponds to the first prediction range.

  The operations from step S9 to step S11 are repeated for a certain period T2 (that is, from X (N + T2)) (steps S12 and S23), and all the data included in the period T2 (from X (N + 1) to X (N + T2)) The probability R1 of the actually measured value that falls within the range of predicted value ± prediction error is obtained (step S13).

Note that data (X (N + 1)... X (N + T2)) included in the period T2 is an example of prediction target data.
The probability R1 is a probability obtained by comparing the actual data value and the first prediction range for each prediction target data, and the actual data value of each prediction target data is included in the first prediction range. It represents the probability and is an example of the first probability.

On the other hand, the spike determination unit 106 calls the data conversion unit 107 to acquire normal data X ′ (N) corresponding to the time point N (step S14), and replaces the abnormal data X (N) with X ′ (N). (Step S15).
Next, the spike determination unit 106 uses the time-series data in which X (N) is replaced with X ′ (N), and calculates the prediction value and the prediction error at the time point N + i by the same method as in steps S9 to S11. (Step S16) Compare with the actual measurement value to see whether the actual measurement value is within the range of predicted value ± prediction error (Steps S17 to S18).

  Note that the range of the predicted value ± prediction error of the data at the time of (N + i) calculated in step S16 is the normal data value (X ′ (N) instead of the abnormal data value of the abnormal data X (N). (Data value) is a range of the predicted value of the data at N + i calculated and reflects the second predicted range.

  Then, the spike determination unit 106 repeats the operation from step S16 to step S18 for a certain period T2 (that is, from X (N + T2)) (steps S19 and S24), and all the data (X (N + 1)) included in the period T2 To R (all data from X to (N + T2)), the probability R2 that the measured value falls within the range of predicted value ± prediction error is obtained (step S20).

  The probability R2 is a probability obtained by comparing the actual data value and the second prediction range for each prediction target data, and the actual data value of each prediction target data is included in the second prediction range. It represents the probability and is an example of the second probability.

Next, the spike determination unit 106 compares the probability R1 and the probability R2 (step S21).
When R1 <R2, that is, when the actual measurement value of the prediction target data is close to the prediction when the value of the time point N is replaced with the normal data X ′ (N), the data at the time point N that is not normal is a sudden spike. The spike determination unit 106 notifies the data conversion unit 107 of the determination as noise.
Receiving the notification from the spike determination unit 106, the data conversion unit 107 replaces the data at the time point N in the log storage unit 101 with normal data X ′ (N) corresponding to the time point N (step S22).

An operation when the data conversion unit 107 calculates normal data X ′ (N) with respect to data X (N) at the time N that is not normal will be described.
The data conversion unit 107 receives the time series data of the period T3 immediately before the time point N from the log storage unit 101 via the time series data generation unit 102, X (N−T3), X (N−T3 + 1),. , X (N−1).
A time series model such as AR or ARMA is used for this time series data, and a predicted value P (N) at time N is calculated and used as normal data for time N.
Then, the data conversion unit 107 notifies the spike determination unit 106 of normal data X ′ (N) in step S14 of FIG.
Further, the data conversion unit 107 rewrites the data in the log storage unit 101 to normal data X ′ (N) in step S22 of FIG.

  As described above, when abnormal data is detected, it is determined whether it is abnormal or sudden spike noise, and only spike noise is removed to improve the accuracy of subsequent abnormality detection. Can do.

  In the above description, the probability R2 in which the actual measurement value is included in the predicted value ± prediction error reflecting the normal data X ′ (N) is calculated, and the probability R1 and the probability R2 are compared. Instead of calculating the probability R2, a threshold value for the probability R1 may be determined in advance, and it may be determined whether the noise is abnormal or spike noise depending on whether the probability R1 exceeds the threshold value.

As described above, in the present embodiment,
(A) means for collecting the number of packets in the network log and the number of packets for each flag,
(B) means for storing the collected logs;
(C) means for generating time-series data changing along the time axis from the log saved by the storage means;
(D) means for analyzing time-series data and detecting abnormal data;
(E) means for notifying that abnormal data has been detected;
(F) means for determining whether the detected abnormal data is abnormal or spike noise;
(G) having means for converting the value of the spike-like noise into a value estimated from a value of a certain period before the spike noise;
In the means to determine whether the detected abnormal data is abnormal or spike noise,
(H) Using time series models such as AR and ARMA,
(I) A log analysis apparatus and the like that determines whether an actual measurement value falls within the confidence interval and determines whether it is abnormal or spike noise has been described.

  Further, in the present embodiment, a means for estimating and converting a value to replace spike-like noise is used as a value to replace spike-like noise, using data before data determined to be spike-like noise, such as AR and ARMA. A log analysis apparatus that uses a time series model to estimate and use a value to replace spike noise has been described.

Embodiment 2. FIG.
In the first embodiment, whether or not the abnormal data is spike noise depending on whether the actually measured value at the time N is close to the one predicted using the normal data as it is or the one predicted by replacing the normal data with the normal data. It was judged.
In the present embodiment, the spike determination unit 106 uses a plurality of data following the abnormal data on the time axis as the prediction target data, calculates the prediction range of the data value for each prediction target data, and actually performs the prediction for each prediction target data. Whether the abnormal data is abnormal data or noise based on the coincidence between the actual data value trajectory of the prediction target data and the predicted range trajectory Determine.

Specifically, in the present embodiment, the spike determination unit 106 uses the data of the period T4 immediately before the time N (time N−T4, N−T4 + 1,... N−1 data) to For a period T5 after N, the predicted values of the data at the time points N + 1, N + 2,..., N + T5 are calculated, and the actual values at the time points N, N + 1, N + 2,. See how it will go.
In the case of convergence, data that is not normal is determined as spike noise.

FIG. 5 is a diagram illustrating a determination method of the spike determination unit 106 according to the present embodiment.
In the upper part of FIG. 5, in the range from N + 1 to N + T5, the locus of the predicted value (broken line) and the actually measured value (solid line) tend to coincide, and the actually measured value converges to the predicted value. It can be determined that the noise is a noise.
On the other hand, in the lower part of FIG. 5, in the range from N + 1 to N + T5, the locus of the predicted value (broken line) and the actually measured value (solid line) does not tend to match, and the actually measured value does not converge to the predicted value. Can be determined not to be spike noise.
In FIG. 5, a prediction value that does not consider the prediction error is used as an example of the prediction range. However, as in the first embodiment, the prediction value ± prediction error is used as the prediction range, and the prediction value ± The prediction error may be compared with the actual measurement value.

Also in the present embodiment, when the spike determination unit 106 detects spike noise, the data conversion unit 107 replaces the spike noise data in the log storage unit 101 with a normal data value.
In the present embodiment, the configuration of the log analysis device 10 and the like is the same as that in FIG.

  Thus, according to the present embodiment, since it is determined whether or not the spiked noise is based on whether or not the actual measurement value for a certain period after the detection of abnormal data converges to the predicted value, a small amount of calculation is required. Spike noise can be determined by the amount.

  As described above, in this embodiment, a log analysis device that uses a time series model such as AR or AMRA and determines whether detected abnormal data is abnormal or spike noise depending on whether or not the actual measurement value converges to the estimated value. Explained.

Embodiment 3 FIG.
In the first embodiment, the spike determination unit 106 uses the data calculated using a time series model such as AR or ARMA as the normal data for the abnormal data X (N) at the time point N to perform the second prediction. Range was calculated.
On the other hand, in the present embodiment, the spike determination unit 106 uses each data value of a plurality of data preceding the abnormal data on the time axis as a normal data value instead of the abnormal data value. A second prediction range of the target data is calculated.

That is, in the present embodiment, the data conversion unit 107 sets the average value of the data in the period T6 immediately before the time point N (data of the time points N−T6, N−T6 + 1,... N−1) to the normal value with respect to the time point N. Calculated as the value X ′ (N).
Then, the spike determination unit 106 calculates the second prediction range using the normal value X ′ (N), and thereafter, the data at the time N is spiked in the procedure shown in the first embodiment. It is determined whether or not it is noise.
Also in the present embodiment, when the spike determination unit 106 detects spike noise, the data conversion unit 107 replaces the spike noise data in the log storage unit 101 with normal data values. The normal data value in this case is the average value of the data in the period T6.
In the present embodiment, the configuration of the log analysis device 10 and the like is the same as that in FIG.

  As described above, according to the present embodiment, the normal value used in place of the abnormal data at time N is the average value of a plurality of data preceding time N, so that spike noise is reduced with a small amount of calculation. Judgment can be made.

  As described above, in the present embodiment, the log analyzer that uses the average value of data before data determined to be spike-like noise as a value to replace spike-like noise has been described.

FIG. 3 is a diagram illustrating a configuration example of a log analysis apparatus according to the first embodiment. The figure which shows the relationship between spike-like noise, a normal state, and abnormality. FIG. 3 is a flowchart showing an operation example of the log analysis apparatus according to the first embodiment. FIG. 3 is a flowchart showing an operation example of the log analysis apparatus according to the first embodiment. FIG. 10 is a diagram illustrating an example of a spike determination method of the log analysis apparatus according to the second embodiment. The figure which shows the hardware structural example of the log analyzer which concerns on Embodiment 1-3.

Explanation of symbols

  10 log analysis device, 20 log collection device, 101 log storage unit, 102 time series data generation unit, 103 abnormality detection unit, 104 notification unit, 105 display device, 106 spike determination unit, 107 data conversion unit.

Claims (10)

An abnormal data detector that monitors time-series data arranged along the time axis and detects abnormal data in which data values are not normal in the time-series data;
A plurality of data within a certain time period from the abnormal data on the time axis is set as the prediction target data, the prediction range of the data value is calculated for each prediction target data, and the actual data value and the data value of each prediction target data are calculated. An information processing apparatus comprising: an abnormal data determination unit that compares a prediction range and determines whether the abnormal data is abnormal data or noise based on a comparison result. The abnormal data determination unit
For each prediction target data, the actual data value is compared with the prediction range of the data value, the probability that the actual data value of each prediction target data is included in the prediction range is calculated, and the abnormal state is based on the calculated probability The information processing apparatus according to claim 1, wherein it is determined whether the data is abnormal data or noise. The abnormal data determination unit
Reflecting the abnormal data value of the abnormal data to calculate the prediction range of the data value for each prediction target data, as the first prediction range of each prediction target data,
Reflecting the normal data value instead of the abnormal data value of the non-normal data to calculate the prediction range of the data value for each prediction target data, the second prediction range of each prediction target data,
For each prediction target data, the actual data value is compared with the first prediction range, the probability that the actual data value of each prediction target data is included in the first prediction range is calculated as the first probability,
For each prediction target data, the actual data value is compared with the second prediction range, and the probability that the actual data value of each prediction target data is included in the second prediction range is calculated as the second probability.
The information processing apparatus according to claim 1, wherein the calculated first probability and the second probability are compared to determine whether the abnormal data is abnormal data or noise. The abnormal data determination unit
A data value calculated using a time series model for a plurality of data preceding the abnormal data on the time axis is used as a normal data value instead of the abnormal data value. The information processing apparatus according to claim 3, wherein a second prediction range is calculated. The abnormal data determination unit
Calculating a second prediction range of each prediction target data using an average value of a plurality of data values preceding the abnormal data on the time axis as a normal data value instead of the abnormal data value The information processing apparatus according to claim 3. The abnormal data determination unit
A plurality of data following the abnormal data on the time axis is set as prediction target data, a prediction range of data values is calculated for each prediction target data, and an actual data value and a prediction range of data values are calculated for each prediction target data. The comparison is performed, and it is determined whether the abnormal data is abnormal data or noise based on a coincidence state between a trajectory of an actual data value of the prediction target data and a trajectory of the prediction range. The information processing apparatus according to 1. The information processing apparatus further includes:
A log storage unit for storing a log that is a source of the time-series data;
A data rewriting unit for rewriting the log in the log storage unit from an abnormal data value of the abnormal data to a normal data value when the abnormal data determination unit determines that the abnormal data is noise; The information processing apparatus according to claim 1, further comprising: The data rewriting unit
A normal data value is calculated using a time series model for a plurality of data preceding the abnormal data on the time axis, and the log in the log storage unit is rewritten with the calculated normal data value. The information processing apparatus according to claim 7. A non-normal data detection step in which a computer monitors time-series data arranged along a time axis and detects abnormal data in which data values are not normal in the time-series data;
A computer sets a plurality of data within a certain time from the abnormal data on the time axis as prediction target data, calculates a prediction range of data values for each prediction target data, and sets an actual data value for each prediction target data A data determination method comprising: comparing a prediction range of data values, and determining whether the abnormal data is abnormal data or noise based on a comparison result. An abnormal data detection process for monitoring time-series data arranged along the time axis and detecting abnormal data whose data values are not normal in the time-series data;
A plurality of data within a certain time period from the abnormal data on the time axis is set as the prediction target data, the prediction range of the data value is calculated for each prediction target data, and the actual data value and the data value of each prediction target data are calculated. A program that compares a predicted range and causes a computer to execute an abnormal data determination process that determines whether the abnormal data is abnormal data or noise based on a comparison result.

Images