JP2021177284A - Method, program, and device for estimating abnormality/change using multiple pieces of submission time series data - Google Patents

Abstract

To provide a method for estimating abnormality or change, capable of further accurately estimating information regarding the abnormality of change in a prescribed event.SOLUTION: A present method for estimating abnormality or change includes: a step for generating a feature quantity regarding composition or connection of event time series data and submission time series data from event time series data regarding a prescribed event and a plurality of pieces of submission time series data for each of a plurality of submission groups regarding a plurality of pieces of topic information that can be related to an abnormality or change of the event; and a step for inputting the generated feature quantity into a constructed model for estimating abnormality or change, and determining information regarding the abnormality or change of the event on the basis of the output from the model. In this case, it is preferable to generate the feature quantity from the event time series data and the submission time series data by using an auto encoder. Further, it is also preferable that the auto encoder is a full connection type, an RNN or an LSTM auto encoder.SELECTED DRAWING: Figure 1

Description

The present invention relates to a technique for estimating an abnormality or change of a predetermined event from time series data related to the event.

In recent years, technology for detecting the occurrence of various phenomena from information posted on networking services such as SNS (Social Networking Service) and mini-blogs has attracted a great deal of attention.

For example, Non-Patent Document 1 discloses a technique for detecting an event using stream data of Twitter (registered trademark). Specifically, in this technology, the trend function of Twitter (registered trademark) is used to extract hashtags that are currently being talked about, get tweets about them, and create a vector according to the number of appearances. , Further clustering processing is performed. Next, ranking is performed according to the size of the cluster obtained here, and the event currently being talked about and its tweet are determined.

Further, Patent Document 1 discloses an information presenting device that presents a congested area on an electronic map and information related to the congestion in the area. Specifically, in this device, (a) the score calculated by the standard deviation of the difference between the current vital statistics and the normal vital statistics, and (b) the magnification between the current vital statistics and the normal vital statistics. The sum of the score and the calculated score is used as the congestion index, and when the congestion index is equal to or higher than the threshold value, it is assumed that a vital abnormality has occurred.

In addition, this information presentation device collects tweets containing the name of the POI (Point of Interest) that exists around the mesh that detected the vital abnormality in the text for each POI, and the number of posts is larger than usual. Filtering is performed on the tweets containing the rising POI. Next, the substrings that match a specific pattern such as "(event name) is held" or "participate in (event name)" are extracted and the event name that caused the demographic abnormality is displayed. -ing

JP-A-2015-225128

Mateusz Fedoryszak, Brent Frederick, Vijay Rajaram and Changtao Zhong, "Real-time Event Detection on Social Data Streams", KDD 2019: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp.2774-2782, <URL : https://doi.org/10.1145/3292500.3330689>, 2019

However, in the conventional technology as described above, there is still a problem that there are many cases where an erroneous judgment is made regarding the occurrence or abnormality of a phenomenon such as an event.

For example, in the technology described in Non-Patent Document 1, since the occurrence of an event is estimated by relying only on the data related to Twitter (registered trademark), it is assumed that an event that has not actually occurred is occurring. There is a possibility that it will be detected. As an easy-to-understand example, regarding the live holding of a popular artist, the situation where a large number of tweets related to the live were posted in response to the advance notice, the live was actually performed and congestion occurred at the event venue. It is possible to judge that the situation is present.

In this regard, the technique described in Patent Document 1 takes into consideration the actual vital dynamics and gives meaning by posting to the mesh in which congestion actually occurs, so that people are not actually gathered. It is possible to avoid the situation where the occurrence of an event accompanied by an abnormal vital dynamics is linked to the situation.

However, in the technique described in Patent Document 1, the method used for the above meaning is limited to simple pattern matching. Therefore, the result tends to be pulled by the topic with a large number of tweets, and the accuracy in estimating the cause of the abnormality is inevitably deteriorated. For example, in a situation where a demographic anomaly occurs due to watching a baseball game, if a popular artist announces that a live event will be held on the same day, the demographic anomaly is mistakenly presumed to be due to the live event. There is a possibility that it will end up. Furthermore, since a uniform threshold value is set in the process of determining the occurrence of abnormal demographics, there is a problem that erroneous detection or omission of detection may occur depending on the difference in the scale of the event, for example.

Therefore, an object of the present invention is to provide an abnormality or change estimation method, a program, and an apparatus capable of more accurately estimating information relating to an abnormality or change in a predetermined event.

According to the present invention, the event time series data relating to a predetermined event and a plurality of posting time series data for each of a plurality of posting groups relating to a plurality of topic information that may be related to an abnormality or change of the event are used. A step to generate a feature amount related to the synthesis or concatenation of the event time series data and the posting time series data, and
It is characterized by including a step of inputting the feature amount into the constructed abnormality or change estimation model and determining information related to the abnormality or change of the event based on the output from the abnormality or change estimation model. , A method of estimating anomalies or changes in a computer is provided.

As an embodiment of the abnormality or change estimation method according to the present invention, it is also preferable to generate the feature amount from the event time series data and the posting time series data by using an auto-encoder.

Further, the autoencoder is preferably a fully coupled autoencoder, a recurrent neural network (RNN) autoencoder, or a long-short term memory (LSTM) autoencoder.

Further, in the embodiment using the autoencoder, it is also preferable to generate the feature amount by using the autoencoder from the whole of the event time series data and the plurality of posting time series data. Alternatively, a plurality of feature quantity portions are generated using the autoencoder from each of the plurality of sets that are a pair of each of the plurality of posting time series data and the event time series data, and from these plurality of feature quantity portions. It is also preferable to generate the feature amount.

Further, in the embodiment using the above autoencoder, the event is an event related to a predetermined area, and there is a point that may be related to an abnormality or change of the event within a predetermined range including the area.
The feature amount is generated by using the autoencoder from the event time series data, the posting time series data, the information related to the degree of separation between the area and the point, and / or the type information of the point. It is also preferable.

Further, in the embodiment using the above autoencoder,
(A) The event time series data, the posting time series data, and
(B) From the degree of deviation from the statistical value of the number of posts in the number of posts in a predetermined period, the attribute information of the poster of the post, and / or the information related to the attached data attached to the post. It is also preferable to generate the feature amount using the autoencoder.

Further, it is preferable that the plurality of topic information in the abnormality or change estimation method according to the present invention includes a set of one range and one topic type related to the attribute information of the poster of the post.

Further, the information relating to the abnormality or change of the event in the abnormality or change estimation method according to the present invention can be obtained.
(A) Information on whether or not an abnormality or change has occurred in the event, and / or
(B) It is also preferable to include the topic information that is presumed to be related to the abnormality or change that occurred in the event.

According to the present invention,
From the event time-series data related to a predetermined event and the multiple posting time-series data for each of the plurality of posting groups related to a plurality of topic information that may be related to the abnormality or change of the event, the event time-series data and the relevant event. A feature amount generation means for generating a feature amount related to the synthesis or concatenation of posted time series data, and
A computer is used as an abnormality or change information determining means for inputting the feature quantity into the constructed abnormality or change estimation model and determining information related to the abnormality or change of the event based on the output from the abnormality or change estimation model. An anomaly or change estimation program that works is provided.

According to the present invention, further
From the event time-series data related to a predetermined event and the multiple posting time-series data for each of the plurality of posting groups related to a plurality of topic information that may be related to the abnormality or change of the event, the event time-series data and the relevant event. A feature amount generation means for generating a feature amount related to the synthesis or concatenation of posted time series data, and
It has an abnormality or change information determining means for inputting the feature quantity into the constructed abnormality or change estimation model and determining information related to the abnormality or change of the event based on the output from the abnormality or change estimation model. Anomalous or change estimators are provided.

According to the abnormality or change estimation method, program and apparatus of the present invention, information related to an abnormality or change in a predetermined event can be estimated more accurately.

It is a schematic diagram which shows one Embodiment of the abnormality / change estimation apparatus which performs the abnormality / change estimation processing using the abnormality / change estimation model which concerns on this invention. It is a schematic diagram including a table for explaining the post-topic linking process. It is a schematic diagram for demonstrating another embodiment about the autoencoder which concerns on this invention. It is a schematic diagram for demonstrating another embodiment about the generation processing of the synthetic feature amount which concerns on this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[Abnormality / change estimation method, device]
FIG. 1 is a schematic diagram showing an embodiment of an abnormality / change estimation device that performs an abnormality / change estimation process using the abnormality / change estimation model according to the present invention.

The abnormality / change estimation device 2 of the present embodiment shown in FIG. 1 is
(A) Fully coupled auto-encoder 11F and
(B) An abnormality / change estimation model 12 is provided, and the occurrence of an abnormality or change (hereinafter also referred to as “abnormality / change”) in the event is estimated based on the event time series data related to the captured predetermined event. It is a possible device.

Of these, the fully coupled autoencoder 11F of (A) above is
(A1) Event time-series data related to the event, for example, vital time-series data (related to an event with a set discrete person) and
(A2) From the plurality of posting time-series data for each of the plurality of "posting" groups related to the plurality of "topic information" that may be related to the abnormality / change of the event, the event time-series data and the posting time-series data. A "synthetic feature amount", which is a feature amount related to the synthesis of

Here, the vital time series data of the above (a1) can be, for example, data on the number of mobile terminals (users) for each unit time in a predetermined period in a preset area mesh (predetermined area). In this case, the number of mobile terminals may be acquired from a communication management server capable of collecting information on mobile terminals that are connected to the base station related to the area mesh. Alternatively, the location information of the mobile terminal is acquired from the application that performs positioning by GPS (Global Positioning System) installed in the user's mobile terminal with the permission to that effect, and the mobile phone is based on the location information. It is also possible to derive the number of terminals.

In addition, the plurality of "posts" group related to the plurality of "topic information" in the above (a2) is, for example, the event among posts in networking services such as SNS (Social Networking Service) and mini-blog (mini-blog). It can be a set of linked "posts" such as "watching sports", "live", "train delay", etc., which may be related to abnormalities / changes in (for example, demographics).

Incidentally, the "posts" group can be collected from, for example, a post management server managed by a business operator using a public search API (Application Programming Interface). Further, the process of associating a post with a topic will be described in detail later with reference to FIG.

The fully-coupled autoencoder 11F of the above (A) performs feature quantity synthesis processing on such event time series data and a plurality of posting time series data for each "topic information", and "composite feature quantity" from the intermediate layer. It is possible to output.

On the other hand, the abnormality / change estimation model 12 of the above (B) uses the generated "composite feature amount" as an input to determine and output "information related to the abnormality / change" in the event. Here, this "information related to anomalies / changes" is, for example,
(B1) Information on whether or not an abnormality or change has occurred in the event (for example, vital statistics), for example, the population (number of mobile terminal users) in the area mesh increases by a predetermined amount or more in a certain time zone of a certain day. Or it is presumed to be related to the information indicating a decrease, and (b2) anomalies / changes (for example, an increase or decrease of the population in a certain time zone of a certain day or more) that occurred in the event (for example, vital statistics). It can be information that includes "topic information", for example, one or both of the information that a "live" has been held.

As described above, according to the abnormality / change estimation device 2, not only the event time series data related to a predetermined event but also the posting time series data related to only one topic, but also the cause / factor candidate of the abnormality / change. Since the feature amount is generated by incorporating the posting time series data related to a plurality of "topic information", the "information related to the abnormality / change" of the event should be estimated more accurately based on the feature amount. Is possible.

In particular, since the feature amount is used in consideration of the posting time series data related to a plurality of "topic information" that are candidates for the cause / factor of the abnormality / change, what is one aspect of "information related to the abnormality / change"? However, it is possible to more accurately estimate information on what is the cause / factor of the abnormality / change of the event, for example, information that the population has increased more than a predetermined value due to the "live" being held. It is also possible. In other words, by considering the transition of a plurality of candidate topics, it is possible to identify the cause / factor in the abnormality / change of the event.

For example, in the area mesh around the "multipurpose stadium" as a POI that can handle a wide variety of events, in the situation where a vital abnormality occurred due to "watching a baseball game", a popular artist announced in advance that a live concert would be held at the same time. Consider the case. Even in such a case, according to the abnormality / change estimation device 2, both the correlation between the vital transition and the "watching baseball" transition and the correlation between the vital transition and the "live" transition have been learned. By utilizing the model, it is possible to accurately estimate that the cause / factor of the vital abnormality is "watching baseball" with higher accuracy.

Further, the abnormality / change estimation device 2 detects an abnormality / change in the event without relying on setting a uniform threshold value for the data value of the event time series data as in the prior art. It is possible. Therefore, depending on the attributes of the poster who posts the "topic information", the absolute number of posts may be small in the first place, but even in such a case, the cause / factor of the abnormality / change can be determined at each time. It is possible to make a more preferable estimation in consideration of the relevance / similarity of the transition pattern of the series data.

Incidentally, the generation of the feature amount in the abnormality / change estimation device 2 is not limited to the form of generating the "composite feature amount" by using the autoencoder as described above. For example, the event time-series data of the above (a1) and the plurality of posting time-series data of the above (a2) are concatenated to form a feature amount, and the abnormality / change estimation model 12 uses this feature amount as an input for the event. It may be constructed as a model that outputs "information related to abnormalities / changes".

However, as the feature amount to be input to the anomaly / change estimation model 12, the "composite feature amount" in which the features of each time series data as described above interact and are fused (and therefore, the dimension is compressed as a result) is used. By adopting it, it is possible to estimate "information related to anomalies / changes" in the event more accurately with less calculation processing load. Furthermore, by generating a "composite feature amount" that reflects the correlation between the characteristics of the event time series data and the characteristics of each posted time series data, "topic information" that is highly correlated with the event. It is also possible to identify.

The autoencoder that generates such a "composite feature amount" is not limited to the fully coupled autoencoder shown in FIG. For example, as will be described in detail later with reference to FIG. 3, a recurrent neural network (RNN, Recurrent Neural Networks) autoencoder or a long-short term memory (LSTM) autoencoder has this “synthetic feature”. It may be used to generate a "quantity".

As a matter of course, the applicable cases of the abnormality / change estimation device 2 (the abnormality / change estimation method in the above) are not limited to those that capture vital statistics as an event as described above. In fact, if it is an event that can acquire time-series data about it and can change due to some cause / factor, various kinds of events can be handled by the abnormality / change estimation device 2.

For example, the following (a) to (e) can be mentioned as applicable cases of the abnormality / change estimation device 2 (the abnormality / change estimation method in).
(A) The cause of an abnormality (rapid increase or decrease) in the amount of electricity used in a certain household or area is estimated using the posting time series data related to a plurality of "topic information", that is, by a plurality of topic transitions.
(B) The cause of an abnormality (rapid increase or decrease) in the network traffic volume at a certain base station is estimated using the posting time series data related to a plurality of "topic information", that is, by a plurality of topic transitions.

(C) The cause of a change (rise or fall) in the stock price of a certain company more than a predetermined value is estimated using the posting time series data related to a plurality of "topic information", that is, by a plurality of topic transitions.
(D) Estimate the cause of the change (increase or decrease) in the approval rating of a political party or the number of seats won (in elections) using the posting time series data related to multiple "topic information", that is, by multiple topic transitions. do.
(E) The cause of the change (improvement or decrease) in the index showing the satisfaction level of the administrative service by a local public body is determined by using the posting time series data related to the posting by the relevant residents regarding multiple "topic information", that is. Estimated from the transition of multiple topics in the relevant inhabitants.

By the way, as the index of (e) above, for example, "citizen satisfaction with administrative services" <URL: https://s-kantan.jp/city-ushiku-ibaraki-u/offer/userLoginDispNon.action?tempSeq=11892&accessFrom =>, "City version SDGs index" <URL: https://prtimes.jp/main/html/rd/p/000000011.000000266.html>, etc. can be mentioned.

<Topic linking to posts>
Here, the process of associating the "topic information" with the above-mentioned "post" will be described with reference to FIG. FIG. 2 is a schematic diagram including a table for explaining the associating process.

According to the example shown in Fig. 2, a vital abnormality (for example, an increase in the number of mobile terminals) occurred in the regional mesh around xxx station around noon on December 1, 2019, and at the same time. Posts are acquired from the post management server 3 of the business operator.

Next, for each post included in these post groups or for the post group, a post-topic linking process is performed, and a topic (topic information) presumed to be related to the post (group) is given. There is. In the example of FIG. 2, the topic "train delay" is given to the acquired post.

Examples of the post-topic linking process that enables the addition of such topic information include the following (a) to (f).
(A) A word dictionary in which words are associated with each topic is prepared in advance, words appearing at a frequency higher than a predetermined frequency in the acquired post group are extracted, and the associated topics of the words are referred to. Make it a topic to be given.
(B) Prepare a hashtag dictionary in which hashtags are associated with each topic in advance, extract hashtags attached to the acquired posts with a frequency equal to or higher than a predetermined frequency, and associate the hashtags with each other. The topic to be given is the topic to be given.
(C) Using a large-scale corpus, build a topic model that estimates topics from posts, such as LDA (Latent Dirichlet Allocation) and DTM (Dynamic Topic Model), and input the acquired posts into the topic model. And output the topic to be given.
(D) Unlike the above (c), a topic model that estimates the topic composition ratio from the combined system of a plurality of posts is constructed in advance, and all posts posted in a certain time slot (for example, a predetermined one hour). Is input to the topic model after combining the above, and based on the output topic composition ratio, the topic having the predetermined or more or the maximum composition ratio is set as the topic to be given.

(E) Using a large-scale corpus, build and acquire a neural network (NN, Neural Networks) topic model that estimates topics from posts vectorized by word vectorization means such as word2vec, doc2vec, and fastText. Input the posted post to the relevant NN topic model and output the topic to be assigned. Here, it is also preferable that the correct topic in the learning data is a label given to the post, and the output layer of the NN topic model is set to a layer having the same number of neurons as all the labels used for the correct answer.
(F) As a case of performing topic estimation without prior learning (when setting a model by unsupervised learning), a topic model is constructed from the actually posted posts, for example, "word" train "and word" delay ". A rule such as "Train delay" is set in advance for topics related to posts that include both, and after identifying the topics of each post, the topics whose composition ratio is equal to or greater than the specified ratio are assigned. It may be a topic.

[Autoencoder configuration, model configuration]
Hereinafter, the configuration of the autoencoder and the abnormality / change estimation model according to the present invention will be described in detail.

Similarly, according to FIG. 1, the fully coupled autoencoder 11F is
It is composed of a fully connected neural network algorithm consisting of three layers (a) an input layer, (b) an intermediate layer, and (c) an output layer, and is the result of learning to output the input data as it is. It is a encoder that can extract the feature amount of the data from the obtained intermediate layer (b). Incidentally, in FIG. 1, the intermediate layer of the above (b) is composed of one layer in an easy-to-understand manner, but is not limited to this. This intermediate layer may be composed of a plurality of layers, and one of the layers may be set as a layer for extracting "synthetic features".

Specifically, in the present embodiment, the fully coupled autoencoder 11F is used for each of the input layer (a) and the output layer (c).
(A) "Event time series data", in Fig. 1, vital time series data and
(B) Multiple "posted time series data", in Fig. 1, the same "concatenated data" that concatenates "sports watching" time series data, "live" time series data, "train delay" time series data, and so on. Supervised learning is performed using the "group", and a feature quantity extraction process such as extracting a "synthetic feature quantity" as a quantity that characterizes this "concatenated data group" from the intermediate layer of the above (b) is performed.

Here, the "event time series data" is, for example, multidimensional data (for example, every 15 minutes) of "amount related to an event" for each unit time (for example, every 15 minutes) of a predetermined data collection period (for example, one day) in the target area mesh. For example, it can be 96 (= 24 × 60/15) dimension data). Here, the "quantity related to the event" may be, for example, the number of mobile terminals (users) as long as it is vital time series data.

On the other hand, the "posting time series data" is, for example, multidimensional data (for example, 24 (= 24 ×)) of the “amount related to posting” for each unit time (for example, every 60 minutes) of a predetermined data collection period (for example, one day). It can be 60/60) dimensional data). Here, the "amount related to posting" may be the number of posts (for each linked topic), or may be a post appearance probability value, and various other values as long as it represents the degree of posting. Can be adopted as "amount related to posting". Further, the "amount related to posting" of each "posting time series data" may be standardized (for example, to a value of 0 to 1). Of course, it is also possible to leave the scale information of the data related to the collected posts as it is without standardizing.

Further, it is more preferable that the data collection period related to the "event time series data" and the plurality of data collection periods related to the "posting time series data" for each of the plurality of topics are all the same period, and at least most of each other. It is preferable to set the overlapping period. For example, it is preferable that the data collection period of the "event time series data" and the plurality of "posting time series data" is the same day (for example, one day on December 1, 2019). As a result, both time-series data can be synchronized, and the realistic correlation of the time-varying changes of both time-series data can be reflected in the generated "composite feature amount".

Further, the unit time (divided time slot) may be different between the "event time series data" and the "posting time series data". For example, there are cases where it is preferable to set the unit time related to the "posted time series data" to be longer than the unit time related to the "event time series data" due to circumstances such as restrictions on API requests. On the other hand, it is preferable to arrange the same unit time (for example, 1 hour) among the "posting time series data" for each of a plurality of topics.

By aligning the data collection period and unit time in this way, for example, the transition of vital time series data in one day when the event of "watching sports" occurred and the excitement of posts related to the topic "watching sports" Since the correlation with the transition of the condition on the same day can be learned by including it in the synthetic feature amount, for example, even if a popular artist announces the "live" in advance on the same day, "sports" with high accuracy. It is expected that it will be possible to estimate vital abnormalities due to "watching games".

Further, in the above-mentioned "concatenated data group" used for each of the input layer of the above (a) and the output layer of the above (c), for example, the "event time series data" is 96-dimensional data and is a topic. If the number is 5, and each "posting time series data" is 24-dimensional data, it will be 216 (= 96 + 5 * 24) -dimensional data. In this case, the number of neurons in each of the input layer (a) and the output layer (c) can be set to 216, which is the same number. Of course, the number of neurons in the middle layer (number of dimensions as a synthetic feature amount) in the above (b) is set to a number less than 216, for example, 54.

Here, as a modification mode, the target event is an event related to a predetermined area mesh, and the POI (for example, an event venue) as a point that can be related to an abnormality / change of the event within a predetermined range including the area mesh. When one or more of the above are present, the above-mentioned "concatenated data group" used for the input / output layer is the "event time series data" of the above (a) and the plurality of "posting time" of the above (b). In addition to "series data"
(C) Information related to the degree of separation between the area mesh (for example, the center) and (each) POI (for example, distance), and (d) (each) POI type information (for example, classified and set in advance. (Each) POI category such as "event venue" or "multipurpose ground")
It is also preferable to use data in which either one or both of them are concatenated.

As a result, information related to POI related to the abnormality / change of the event can be included in the "composite feature amount", and after that, it is possible to carry out more accurate estimation processing in consideration of the existence of POI. Become. For example, the separation degree information in (c) above can be considered as an index showing the degree of influence of POI on the estimation result, and the type information in (d) above is, for example, the type of event that causes vital abnormalities. Is likely to be limited by the POI category, so it is also preferable to reflect both in the "synthetic feature amount".

As a further modification, the above-mentioned "concatenated data group" is added to the above-mentioned "event time-series data" in (a) and the plurality of "posting time-series data" in (a) above, or further described above. (C) and / or the addition of the above (d)
(E) Degree of deviation from the statistical value of the number of posts in the number of posts in a predetermined period (for example, one day) (for example, the average value of the number of posts per day in one year) (for example, difference or deviation value)
(F) Attribute information of the poster of the acquired post (for example, gender, age group, etc.), and (g) Information related to the attached data (for example, image) attached to the acquired post (for example, the feature amount of the image). )
It is also preferable to concatenate at least one of the data.

Here, the degree of dissociation in (e) above is considered to be larger than usual when an abnormality occurs in the event, and incorporating it into the feature amount is effective in improving the accuracy of abnormality estimation. Can be.

In addition, the attribute information in (f) above indicates abnormalities / changes in the event, such as a tendency for young people to easily participate in a certain live performance and a tendency for men to easily participate in a certain sport watching. On the other hand, it is fully conceivable that the attributes will have an effect depending on the cause / factor, and incorporating it into the feature quantity can also contribute to the improvement of estimation accuracy. The attribute information of the poster can be estimated from the posted text by analyzing the posted text by a known analysis method such as machine learning.

Furthermore, regarding the attached data information in (g) above, it is conceivable that the attached information such as an image may be related to the content of the post and the topic associated with it, and this may also be incorporated into the feature quantity. , It can be effective in improving the accuracy of abnormality estimation. The image feature amount as information related to the attached data can be calculated by using a known object detection algorithm such as YOLO (You Look Only Once) using CNN (Convolutional Neural Networks).

Similarly, according to FIG. 1, the anomaly / change estimation model 12 is composed of a DNN (Deep Neural Networks) algorithm including a multi-layer of an input layer, a hidden layer, and an output layer, and is generated by a fully coupled autoencoder 11F. It is an estimator that uses the obtained "synthetic features" as the input layer and outputs "information related to abnormalities / changes" in the event as each neuron value in the output layer.

Of course, the anomaly / change estimation model 12 can be constructed by various other machine learning algorithms as long as the "composite feature amount" can be input, but in the present embodiment, the anomaly / change detection and the abnormality can be constructed. In order to estimate the cause / factor at once, a DNN suitable for it is adopted. Specifically, as one preferred embodiment, a DNN algorithm in which the output of the output layer is a One-Hot vector is used.

That is, the output of the output layer in the present embodiment is, for example, in the case of "there is an abnormal vitality and the cause / factor is watching sports", as shown in FIG.
"No abnormality""Watchingsports""Live""Traindelay" ・ ・ ・
(0, 1, 0, 0, ...)
Will be. In this case, the number of dimensions of this output (One-Hot vector) (the number of neurons in the output layer) is (the number of topic of cause / factor candidates) + 1.

Here, in constructing the abnormality / change estimation model 12, for example, learning data created by manually assigning a label indicating the cause / factor of the abnormality / change to the generated synthetic feature amount may be used. good. Here, as the label to be given, for example, the topic determined at the time of the above-mentioned post-topic linking process can be adopted. It is also preferable to adopt the above-mentioned "no abnormality" label in order to detect an abnormality / change and estimate the cause / factor of the abnormality at once.

Incidentally, as a matter of course, the abnormality / change estimation model 12 may be a model that outputs other "information related to the abnormality / change". For example, the likelihood for each item (for example, the topic described above) preset as the cause / factor of the abnormality / change may be output, or one cause / factor with the highest likelihood (for example, one). It may output the topic).

In addition, as a change mode of the topic setting, a plurality of topics (topic information) related to each posting time series data (furthermore, a label for constructing the abnormality / change estimation model 12) are set as one related to the attribute information of the poster. It is also possible to include a set of a range and one topic type. For example, as multiple topics: "(Posters are more than 50% female) Live A",
・ "(Posters are more than 50% male) Live B",
・ "(Posted by more than 50% of young people (for example, 34 years old or younger)) Watching sports A",
・ "Watching sports B",
·"train delay",···
May be set. This makes it possible to obtain more detailed information related to the attributes of the estimated cause / factor.

FIG. 3 is a schematic diagram for explaining another embodiment of the autoencoder according to the present invention.

Up to this point, the fully coupled autoencoder 11F (FIG. 1) has been described as a means for generating the "composite feature amount", but as another embodiment, the RNN autoencoder 11R and the LSTM autoencoder 11L shown in FIG. 3 have been used. It is also possible to adopt it.

According to FIG. 3, also in the RNN autoencoder 11R (and the LSTM autoencoder 11L), as in the fully coupled autoencoder 11F, a "concatenated data group" in which the event time series data and a plurality of posting time series data are concatenated is input. As a layer, learning is performed so that the output layer at that time is the same as the "connected data group", and a process of extracting a synthetic feature amount from the "intermediate layer" obtained as a result is performed.

However, in the RNN autoencoder 11R (and LSTM autoencoder 11L), unlike the fully coupled autoencoder 11F, "connection" as an input layer is performed every unit time (for example, every 15 minutes) in a predetermined period (for example, one day). By taking in neuron values from a plurality of neurons corresponding to the unit time in the "data group", an "intermediate layer" consisting of a plurality of neurons that determines their own neuron values is sequentially generated.

More specifically, if the unit time set in the "concatenated data group" (event time series data and multiple posting time series data) is T _i (i = 1, 2, ..., n), Each neuron in the middle layer generated for the unit time T _{j + 1} (j = 1, 2, ···, n-1)
(A) Neuron values from multiple neurons corresponding to the _{unit time T j + 1} in the "connected data group" as the input layer,
(B) Determines its own neuron value based on the weighted linear sum of the neuron values of the corresponding neurons in the middle layer of the previous unit time T _j.

That is, in the RNN autoencoder 11R (and LSTM autoencoder 11L), the "intermediate layer" for a certain unit time is recursively generated in consideration of the output of the previous (past) "intermediate layer". It is. Here, the finally generated "intermediate layer"("intermediatelayer" with a unit time T _n ) is extracted and output as a composite feature amount.

The LSTM autoencoder 11L is used in the RNN autoencoder 11R.
(A) A forgetting gate that controls the time course of retention / forgetting in each element stored in a memory cell provided in the "intermediate layer", and (b) an input gate and an output gate for avoiding inconsistent weight updates. For example, it is an encoder that can realize long-term dependencies to generate a new "intermediate layer" by reflecting the information of the "intermediate layer" in the distant past. ..

Using such RNN autoencoder 11R and LSTM autoencoder 11L, continuous time change information (relationship with past data) in feature extraction target data (event time series data and a plurality of posting time series data) By reflecting the relevant information) in the composite feature amount, it is possible to estimate the anomaly / change that basically occurs over time with more accuracy.

By the way, the RNN autoencoder 11R and the LSTM autoencoder 11L have the above-mentioned (c) to (g) described above in addition to the event time series data and the plurality of posting time series data as the input "concatenated data group". It may be set to handle a concatenated piece of information and output the combined feature amount.

FIG. 4 is a schematic diagram for explaining another embodiment of the synthetic feature amount generation process according to the present invention.

Up to this point, as the data to be input to the autoencoder (11F, 11R or 11L) when generating the "composite feature amount", the "concatenated data group" consisting of the entire event time series data and a plurality of posting time series data is used. I have explained the form.

On the other hand, as shown in FIG. 4, in the present embodiment,
(A) Generate a plurality of pairs (“event / post concatenation pair”) which are concatenated pairs of the event time series data and each of the plurality of post time series data.
(B) For each of the generated "event / post concatenated pairs", feature quantity synthesis processing is performed by an autoencoder (11F, 11R or 11L) prepared individually to generate a plurality of "composite feature quantity portions". ,
(C) A "composite feature amount" is generated by connecting a plurality of generated "feature amount portions".

In this way, by first generating a plurality of "synthetic feature parts" from a plurality of "event / post concatenated pairs", a time change of event time series data and one post are made in each "synthetic feature part". It is possible to directly reflect the correlation of time series data with time changes. As a result, by using the "composite features" generated after this, it is possible to more accurately estimate the abnormalities / changes that have a strong influence on the degree of correlation, and the causes / factors. It will be possible.

Incidentally, also in the present embodiment, at least one or all of the plurality of "event / post concatenated pairs" is added to the event time series data and the plurality of post time series data, and the above-mentioned (c) to (c) to ( Information such as (g)) can also be linked.

For example, the circumstances of whether or not information such as (c) to (g) above can be collected may differ depending on the topic or contributor related to the posting time series data that constitutes the "event / posting concatenated pair". exist. Therefore, it is possible to incorporate information such as (c) to (g) above only for the "event / post concatenated pair" related to the posting time series data that can be collected in this way.

[Abnormality / change estimation device, abnormality / change estimation program]
Hereinafter, returning to FIG. 1, the autoencoder (11F, 11R or 11L) as described above and the abnormality / change estimation model 12 are mounted, and the presence / absence of abnormality / change occurrence in a predetermined event and the presence / absence of abnormality / change occurrence in a predetermined event, and An abnormality / change estimation device 2 that enables output of information related to the cause / factor of an abnormality / change that has occurred as an estimation result will be described.

As shown in FIG. 1, the abnormality / change estimation device 2 includes an input unit 21, a feature amount / model generation unit 22, an abnormality / change determination unit 23, and an output unit 24. Of these, the feature quantity / model generation unit 22 and the abnormality / change determination unit 23 are the main parts that implement one embodiment of the abnormality / change estimation method according to the present invention, and the abnormality / change estimation program according to the present invention. One embodiment can be regarded as a function of a stored processor memory.

From this, the abnormality / change estimation device 2 may be a dedicated device for abnormality / change estimation, but is equipped with the abnormality / change estimation program according to the present invention, for example, a cloud server, a non-cloud server device, or a personal computer. -It is also possible to use a computer (PC), a notebook type or tablet type computer, a smartphone, or the like.

Similarly, in FIG. 1, the input unit 21 of the abnormality / change estimation device 2 has a communication function, and is, for example, an externally installed server (for example, a communication management server of a communication company and a posting management server of a networking service company). Receives information related to a predetermined event (for example, the number of mobile terminals) and information related to posting (for example, posted data), and event time series data (for example, demographic time series data) having a predetermined data format and a plurality of posts. Time-series data (for example, time-series data of the number of posts for each topic) is generated and stored in the feature amount / model generation unit 22.

The feature amount / model generation unit 22
(A) Using an autoencoder (11F, 11R or 11), a composite feature amount of event time series data and a plurality of posted time series data is generated, and the generated composite feature amount is abnormal with the training data with a correct answer label. -The change estimation model 12 is constructed, the abnormality / change estimation model 12 is provided to the abnormality / change determination unit 23, and the abnormality / change estimation model 12 is provided.
(B) Similarly, using an autoencoder (11F, 11R or 11), a synthetic feature amount is generated by a concatenated data group (or event / post concatenated pair) including the event time series data to be estimated, and the generated synthetic feature amount is generated. Is output to the abnormality / change determination unit 23.

The abnormality / change determination unit 23 uses the received abnormality / change estimation model 12 to determine "presence / absence of abnormality / change occurrence and information on its cause / factor" in the event from the similarly received synthetic features. Then, it is output to the output unit 24.

The output unit 24 displays, for example, the received "information on the presence / absence of an abnormality / change and its cause / factor" on a display or transmits it to an external information processing device (when a communication function is provided). To do. Here, the information displayed and transmitted is, for example, "Around xx: xx on December 1, 2019, there is a rapid increase in population due to train delays (80% increase compared to normal) around xxx station. Information such as "occurrence".

As described in detail above, according to the present invention, not only the event time series data related to a predetermined event, but also the posting time series data related to only one topic, the cause of the abnormality / change of the event, Since the feature amount is generated by incorporating the posting time series data related to multiple topic information that is a factor candidate, it is possible to estimate the information related to the abnormality / change of the event more accurately based on the feature amount. It will be possible.

Further, the present invention can be applied to various events as long as it is an event for which time series data can be acquired and which can fluctuate due to some cause / factor.

For example, in the case of applying vital statistics (collective dispersal of people) as the event, according to the present invention, the presence or absence of vital abnormalities can be determined by utilizing a plurality of posting time series data. Depending on the embodiment, it is possible to estimate the cause / factor of the vital abnormalities that have occurred. From this, it is considered that the present invention greatly contributes to the accurate grasp of the characteristics of urban fluctuations at the time of an event, a disaster, or the issuance of an emergency, and the appropriate implementation of the flow control there. Furthermore, it is considered that the invention can contribute to suitable operation in the event of such a situation in smart cities, which are expected to become widespread in various places in the future.

With respect to the various embodiments of the present invention described above, various changes, modifications and omissions within the scope of the technical idea and viewpoint of the present invention can be easily made by those skilled in the art. The above explanation is just an example and does not attempt to restrict anything. The present invention is limited only to the scope of claims and their equivalents.

11F Fully coupled autoencoder 11R RNN autoencoder 11L RSTM autoencoder 12 Abnormality / change estimation model 2 Abnormality / change estimation device 21 Input unit 22 Feature / model generation unit 23 Abnormality / change determination unit 24 Output unit

Claims (11)

From the event time-series data related to a predetermined event and the multiple posting time-series data for each of the plurality of posting groups related to a plurality of topic information that may be related to the abnormality or change of the event, the event time-series data and the relevant event. Steps to generate features related to composition or concatenation of posting time series data,
It is characterized by including a step of inputting the feature amount into the constructed abnormality or change estimation model and determining information related to the abnormality or change of the event based on the output from the abnormality or change estimation model. , Anomaly or change estimation method in a computer. The abnormality or change estimation method according to claim 1, wherein the feature amount is generated from the event time series data and the posting time series data by using an auto-encoder. The autoencoder is a fully coupled autoencoder, a recurrent neural network (RNN) autoencoder, or a long-short term memory (LSTM) autoencoder. Item 2. The method for estimating an abnormality or change according to Item 2. The abnormality or change estimation method according to claim 2 or 3, wherein the feature amount is generated by using the autoencoder from the whole of the event time series data and the plurality of posting time series data. A plurality of feature quantity portions are generated from each of the plurality of pairs of the plurality of posted time series data and the event time series data by using the autoencoder, and the feature quantity portions are used to generate the feature quantity portions. The abnormality or change estimation method according to claim 2 or 3, wherein a feature amount is generated. The event is an event related to a predetermined area, and there is a point within a predetermined range including the area that may be related to an abnormality or change of the event.
The feature amount is generated by using the autoencoder from the event time series data, the posting time series data, the information related to the degree of separation between the area and the point, and / or the type information of the point. The abnormality or change estimation method according to any one of claims 2 to 5, wherein the abnormality or change is estimated. The event time series data, the posting time series data, and
Based on the degree of deviation from the statistical value of the number of posts in the number of posts in a predetermined period, the attribute information of the poster of the post, and / or the information related to the attached data attached to the post, the autoencoder The abnormality or change estimation method according to any one of claims 2 to 6, wherein the feature amount is generated by using an encoder. The abnormality or abnormality according to any one of claims 1 to 7, wherein the plurality of topic information includes a set of one range and one topic type related to the attribute information of the poster of the post. Change estimation method. The information relating to the abnormality or change of the event includes information relating to whether or not the abnormality or change has occurred in the event and / or the topic information presumed to be related to the abnormality or change occurring in the event. The abnormality or change estimation method according to any one of claims 1 to 8, wherein the abnormality or change is estimated. From the event time-series data related to a predetermined event and the multiple posting time-series data for each of the plurality of posting groups related to a plurality of topic information that may be related to the abnormality or change of the event, the event time-series data and the relevant event. A feature amount generation means for generating a feature amount related to the synthesis or concatenation of posted time series data, and
A computer is used as an abnormality or change information determining means for inputting the feature quantity into the constructed abnormality or change estimation model and determining information related to the abnormality or change of the event based on the output from the abnormality or change estimation model. An anomaly or change estimation program characterized by functioning. From the event time-series data related to a predetermined event and the multiple posting time-series data for each of the plurality of posting groups related to a plurality of topic information that may be related to the abnormality or change of the event, the event time-series data and the relevant event. A feature amount generation means for generating a feature amount related to the synthesis or concatenation of posted time series data, and
It has an abnormality or change information determining means for inputting the feature quantity into the constructed abnormality or change estimation model and determining information related to the abnormality or change of the event based on the output from the abnormality or change estimation model. An abnormality or change estimation device.

Images