JP2023064481A - Anomaly detection apparatus, anomaly detection method, anomaly detection program, and backbone information system - Google Patents

Abstract

To make it possible to detect anomaly of data in each work in a backbone information system with a small-scale configuration.SOLUTION: A backbone information system configured by consolidating a plurality of resource element management apparatuses for managing various resource elements includes the resource element management apparatuses and an anomaly detection apparatus arranged in the system. The anomaly detection apparatus includes an abnormal value definition setting unit which configures, for each of the resource element management apparatuses, settings for abnormal value detection processing of an abnormal value detection data. An acquisition unit acquires, from a corresponding resource element management apparatus, abnormal value detection data to be subjected to the abnormal detection processing set by the abnormal value definition setting unit. An abnormal value definition execution unit executes the abnormal detection processing on the abnormal value detection data acquired from the resource element management apparatus. A storage control unit controls a storage unit to store a result of the abnormal value detection processing executed by the abnormal value definition execution unit.SELECTED DRAWING: Figure 4

Description

The present invention relates to an anomaly detection device, an anomaly detection method, an anomaly detection program, and a backbone information system.

Today, a core information system is known in which a plurality of resource element management devices such as an inventory management device, a sales management device, and an accounting management device are integrated into one system for managing various resource elements owned by a company. there is

When detecting data anomalies in such a core information system, it is necessary to set a detection method and processing in consideration of the characteristics of the data to be detected.

JP 2019-211919 A

However, the characteristics of this data differ for each business such as inventory management, sales management, and accounting management. For this reason, in the conventional backbone information system, it is necessary to construct an abnormality detection device specialized for each task for each task, which causes the problem of increasing the scale of the system.

The present invention has been made in view of the above problems, and an abnormality detection device, an abnormality detection method, and an abnormality detection program that enable detection of anomalies in the data of each task in a core information system with a small-scale configuration. and to provide core information systems.

In order to solve the above-described problems and achieve the object, an anomaly detection device according to the present invention is provided for a backbone information system in which a plurality of resource element management devices for managing various resource elements are integrated into one system. , an anomaly detection device provided in a system together with each resource element management device, wherein the anomaly detection device performs settings for performing abnormal value detection processing of abnormal value detection data for each resource element management device. a value definition setting unit; an acquisition unit that acquires abnormal value detection data for performing abnormal value detection processing set by the abnormal value definition setting unit from a corresponding resource element management device; an abnormal value definition executing unit that performs abnormal value detection processing on the abnormal value detection data obtained from the abnormal value detection data; It is characterized by

Further, in order to solve the above-described problems and achieve the object, the anomaly detection method according to the present invention provides a core information system in which a plurality of resource element management devices for managing various resource elements are integrated into one system. On the other hand, in the anomaly detection method of an anomaly detection device provided in the system together with each resource element management device, in the anomaly detection device, an anomaly value definition setting unit sets abnormal value detection data for each resource element management device. an abnormal value definition setting step for performing settings for performing abnormal value detection processing; an acquisition step of acquiring data from an element management device; an abnormal value definition execution step in which an abnormal value definition executing unit performs abnormal value detection processing on data for abnormal value detection acquired from a resource element management device; and storage control. and a storage control step of storing and controlling the abnormal value detection processing result by the abnormal value definition execution unit in the storage unit.

Further, in order to solve the above-described problems and achieve the object, an anomaly detection program according to the present invention is provided in a core information system in which a plurality of resource element management devices for managing various resource elements are integrated into one system. On the other hand, an anomaly detection program for an anomaly detection device provided in the system together with each resource element management device, which causes a computer to perform anomaly value detection processing of the anomaly value detection data for each resource element management device an anomaly value definition setting unit for setting an anomaly value definition setting unit; an acquisition unit for acquiring anomaly value detection data for performing an anomaly value detection process set by the anomaly value definition setting unit from a corresponding resource element management device; Abnormal value definition execution unit that performs abnormal value detection processing on abnormal value detection data acquired from the management device, and storage control that stores and controls the abnormal value detection processing results by the abnormal value definition execution unit in the storage unit It is characterized by functioning as a part.

Further, in order to solve the above-described problems and achieve the object, a core information system according to the present invention is a core information system in which a plurality of resource element management devices for managing various resource elements are integrated into one system. An anomaly detection device is provided in the system together with each resource element management device, and the anomaly detection device is set for performing anomaly value detection processing of the anomaly value detection data for each resource element management device. an anomaly value definition setting unit that performs anomaly value definition setting unit, an acquisition unit that acquires the anomaly value detection data for performing anomaly value detection processing set by the anomaly value definition setting unit from the corresponding resource element management device, and a resource element management device an abnormal value definition execution unit that performs abnormal value detection processing on the abnormal value detection data acquired from the abnormal value definition execution unit; , is characterized by having

ADVANTAGE OF THE INVENTION According to this invention, it is effective in the ability to implement|achieve the abnormality detection of the data of each business in a backbone information system with a small-scale structure.

FIG. 1 is a block diagram showing the system configuration of a backbone information system according to an embodiment. FIG. 2 is a block diagram of an anomaly detection device provided in the backbone information system of the embodiment. FIG. 3 is a diagram showing an anomaly detection system as a reference example. FIG. 4 is a diagram showing an outline of an anomaly detection device provided in the backbone information system according to the embodiment. FIG. 5 is a diagram showing a list of detection definition items set by the abnormal value definition setting unit. FIG. 6 is a diagram showing an example of a definition setting screen. FIG. 7 is a diagram showing an example of a determination result corresponding to a setting example of the determination result table definition. FIG. 8 is a flow chart showing the flow of the abnormality detection operation in the abnormality detection device 9. As shown in FIG. FIG. 9 is a flowchart showing a detailed processing flow of data acquisition processing. FIG. 10 is a flowchart showing a detailed processing flow of data preprocessing. FIG. 11 is a flowchart showing a detailed flow of change point detection processing. FIG. 12 is a flowchart showing the detailed flow of the abnormality detection process. FIG. 13 is a flow chart showing the detailed flow of the first half of the data update process. FIG. 14 is a flowchart showing the detailed flow of the second half of the data update process. FIG. 15 is a diagram for explaining a specific example of data update processing for the determination result table. 16A and 16B are diagrams for explaining a specific example of the determination message creation process. FIG. 17 is a diagram showing a list of field names that can be set for specific fields of the result message template. FIG. 18 is a diagram showing an example of an abnormal value determination data acquisition definition. FIG. 19 is a diagram showing an example of stored parameter definition. FIG. 20 is a diagram showing an example of an abnormal value determination data acquisition mapping definition. FIG. 21 is a diagram showing an example of a preprocessing definition. FIG. 22 is a diagram illustrating an example of aggregation definition. FIG. 23 is a diagram showing an example of an abnormal value determination definition. FIG. 24 is a diagram showing a specific example of an abnormal value determination definition. FIG. 25 is a diagram showing an example of extraction conditions. FIG. 26 is a diagram showing an example of change point definitions. FIG. 27 is a diagram showing an example of a change point definition that is set when the average/standard deviation is used to obtain points at which the difference from the previous month is abnormal when arranged in chronological order. FIG. 28 is a diagram showing an example of an anomaly degree rank table in which anomaly degree rank data is stored or updated. FIG. 29 is a diagram showing an example of an anomaly rank additional information table in which anomaly rank additional data is stored or updated. FIG. 30 is a diagram showing an example of an anomaly degree determination result attached information table in which attached information data is stored or updated. FIG. 31 is a diagram showing an example of a result message table in which result message data is stored or updated. FIG. 32 is a diagram showing an example of set values that are set in the abnormal value determination data acquisition definition table when inventory turnover abnormality detection is performed. FIG. 33 is a diagram showing an example of setting values that are set in the stored parameter definition table when inventory turnover abnormality detection is performed. FIG. 34 is a diagram showing an example of set values set in the abnormal value determination data acquisition mapping definition table when inventory turnover abnormality detection is performed. FIG. 35 is a diagram showing an example of set values set in the abnormal value determination definition table when inventory turnover abnormality detection is performed. FIG. 36 is a diagram showing an example of set values set in the message template table when stock turnover abnormality detection is performed. FIG. 37 is a diagram showing a list of determination result table definitions set for the determination result table when inventory turnover abnormality detection is performed. FIG. 38 is a diagram showing an example of a determination result table definition set for the determination result table when inventory turnover abnormality detection is performed. FIG. 39 is a flow chart of data acquisition for inventory turnover abnormality detection operation. FIG. 40 is a flow chart of data pre-processing and change point detection of inventory turnover abnormality detection operation. FIG. 41 is a diagram for explaining the change point detection operation when the change point definition is set. FIG. 42 is a flow chart of abnormality detection of inventory turnover abnormality detection operation. FIG. 43 is a flow chart of data update of inventory turnover abnormality detection operation. FIG. 44 is another flow chart of data update of inventory turnover abnormality detection operation. FIG. 45 is a diagram for explaining threshold calculation and anomaly detection operation in the anomalous value definition executing unit. FIG. 46 is a diagram for explaining the ranking process of the degree of abnormality. FIG. 47 is a diagram for explaining data displayed on the setting screen for the determination result table definition. FIG. 48 is a diagram showing an example of a setting screen for defining a determination result table. FIG. 49 is a diagram showing how the update table name of the abnormal value definition determination table is updated to the update table name input by the business operator. FIG. 50 is a diagram showing the determination result table definition specified via the determination result table definition setting screen. FIG. 51 is a diagram showing an example of a determination result table. FIG. 52 is a schematic diagram for explaining update processing of various data for the determination result table. FIG. 53 is a diagram for explaining the update processing of the abnormality degree rank data. FIG. 54 is a diagram for explaining the operation of creating and updating result messages. FIG. 55 is a diagram showing examples of fiscal years and months, product names, and inventory turnover values in which an inventory turnover ratio indicating an abnormal value is detected. FIG. 56 is a diagram showing an example of a result display screen. FIG. 57 is a diagram showing an example of a detail screen of the result display screen.

DESCRIPTION OF THE PREFERRED EMBODIMENTS A backbone information system, which is an embodiment to which the present invention is applied, will be described in detail below with reference to the drawings. The following description of the embodiments does not limit the present invention.

[System configuration]
First, FIG. 1 is a block diagram showing the system configuration of a core information system (ERP: Enterprise Resources Planning) according to an embodiment. The backbone information system of this embodiment includes an inventory management device 1, a sales management device 2, an accounting management device 3, and a production management device 4 as an example of a plurality of resource element management devices that manage various resource elements owned by a company. , payroll management device 5 and personnel management device 6 are integrated into a core information system. Further, in the backbone information system of the embodiment, an abnormality detection device 9 and a business database 7 common to each of the management devices 1 to 6, which perform abnormality detection processing of data of each business of each management device 1 to 6, are provided. It is

Each of the management devices 1 to 6, business database 7, and anomaly detection device 9 may be provided in, for example, one personal computer device, or may be provided as physically different devices. When each of the management devices 1 to 6, the business database 7 and the anomaly detection device 9 are provided in an information processing device such as a personal computer device, each of the management devices 1 to 6 and the anomaly detection device 9 are controlled by a control unit described below. 12 and an electrical connection function 8 such as a bus line. Further, when the management devices 1 to 6 and the abnormality detection device 9 are provided as physically different devices, the management devices 1 to 6 and the abnormality detection device 9 are connected to a wide area network such as the Internet or a local area network (LAN). network) and other private networks.

The business database 7 stores business data of each business, abnormal value determination definition data, abnormal value determination result data, and the like. Details will be described later.

[Hardware configuration of anomaly detection device]
FIG. 2 is a block diagram showing the hardware configuration of the abnormality detection device 9. As shown in FIG. As an example, as the anomaly detection device 9, a desktop personal computer device, a notebook personal computer device, or a tablet personal computer device can be used. As the abnormality detection device 9, a PDA (Personal Digital Assistants) device or a portable information processing device such as a smart phone can be used.

Such an abnormality detection device 9 has a storage unit 11, a control unit 12, a communication interface unit 13, and an input/output interface unit 14, as shown in FIG.

An input device 15 and an output device 16 are connected to the input/output interface section 14 . A monitor device (including a home television) can be used as the output device 16 . As the input device 15, in addition to a keyboard device, a mouse device and a microphone device, a monitor device that realizes a pointing device function in cooperation with a mouse device can be used.

As the storage unit 11, for example, a storage device such as a ROM (Read Only Memory), a RAM (Random Access Memory), an HDD (Hard Disk Drive), or an SSD (Solid State Drive) can be used. The storage unit 11 stores an anomaly detection program for performing an anomaly detection process for data of each business, anomaly value detection data acquired from the management devices 1 to 6 of each business when an anomaly is detected, anomaly value detection processing results, and the like. is stored.

Further, as an example, when each of the management devices 1 to 6, business database 7, and anomaly detection device 9 shown in FIG. The control program for each of the management devices 1 to 6 is stored in the storage unit 11 together with the abnormality detection program, and the storage unit 11 is used as the business database 7 . Thereby, the abnormality detection device 9 operates as one core information system (ERP: Enterprise Resources Planning).

(Functional configuration of anomaly detection device)
By executing the abnormality detection program stored in the storage unit 11, the control unit 12 controls the abnormal value definition setting unit 21, the abnormal value definition execution unit 22, the storage control unit 23, the acquisition unit 24, the analysis unit 25, and the display unit 25. It functions as the control unit 26 .

The abnormal value definition setting unit 21 sets definitions (abnormal value definitions) of data for detecting abnormal values among the data handled by each of the management apparatuses 1 to 6 . The abnormal value definition executing unit 22 performs abnormal value detection processing on the data acquired by the acquiring unit 24 based on the abnormal value definition. The acquisition unit 24 acquires data corresponding to the abnormal value definition from each of the management devices 1-6. The storage control unit 23 controls storage of the abnormal value detection results and the like in the storage unit 11 . The analysis unit 25 analyzes the abnormal value detection results, and the display control unit 26 controls the display of the analysis results on the output device 16 .

[Reference example]
Here, FIG. 3 shows an anomaly detection system as a reference example. In order to perform data anomaly detection, it is necessary to collect data to be detected by the data collection function, and set a detection method and necessary processing in consideration of the characteristics of the data. Since the characteristics of this data differ from business to business, usually an anomaly detection system specialized for each business is constructed, such as the reference example in FIG.

Therefore, the format of the data to be used is fixed, and the detection method and detection processing are also fixed detection methods and detection processing.

In the anomaly detection system as a reference example, as shown in FIG. 3, each process of "data preparation", "execution of anomaly detection", and "display of results in graphs and diagrams" is often independent.

Furthermore, in the anomaly detection system that serves as a reference example, since business data and detection results are held in separate systems, it is necessary to process and analyze the data.

[Outline of anomaly detection device]
FIG. 4 is a diagram showing an outline of the anomaly detection device 9 provided in the backbone information system of the embodiment. As shown in FIG. 4, the anomaly detection device 9 uses an anomaly value definition setting unit 21 to set various data acquisition settings, anomaly value determinations, data update settings, schedules, etc. acquired from any of the management devices 1 to 6, for example. Set and update definitions. The setting and updating of these various definitions are performed on the business database 7 provided as a common database for each of the management devices 1 to 6 and the abnormality detection device 9 of the core information system. As a result, in the business database 7, for example, data acquisition content definitions, used algorithms and parameters, preprocessing, aggregation definitions, change point definitions, extraction conditions, abnormality degree ranks, message definitions, result table definitions, schedule definitions, etc. Various definitions are stored or updated.

Further, in the abnormality detection device 9, the abnormal value definition execution unit 22 performs abnormal value determination processing based on various definitions acquired from the business database 7. FIG. In addition, the storage control unit 23 stores or updates the result data of the abnormal value determination process in the result table of the business database 7 .

In addition, in the abnormality detection device 9, the acquisition unit 24 acquires the result data of the abnormal value determination process from the result table of the business database 7, the analysis unit 25 performs analysis, and the display control unit 26 outputs the analysis result. 16 for display control.

(Overview of data acquisition settings)
As described above, the mission-critical information system of the embodiment generates a result table of arbitrary items required for analysis from acquisition items and detection definition items that are determined according to the work for anomaly detection, and uses it for work analysis. make it possible. FIG. 5 is a diagram showing a list of detection definition items set by the abnormal value definition setting unit 21. As shown in FIG. As shown in FIG. 5, various definitions such as "common", "business data", and "when there is change point data" can be set. Also, definitions of "average or standard deviation", "interquartile range" and "outlier range" can be set for each algorithm used to detect abnormal values.

The definition of "common" is a definition that can be set in common for each business, and includes a definition identification number (definition ID: an ID that identifies the definition), a definition name, and an execution Guid (generated each time anomaly detection processing is executed). unique value), index (order), judgment result (TRUE/FALSE), etc. can be set.

The definition ID and definition name are set in a 32-character varchar type, for example. Also, the execution Guid is set in the uniqueidentifier type. Also, the index is set in the int type, and the determination result (TRUE/FALSE) is set in the bit type.

Among such common definitions, definition ID, execution Guid, index, and determination result are essential setting items.

Business data is defined with column names that capture various stored procedures. This column name is the column name obtained from the determination data. Also, the business data is set so as to be handled in a type suitable for the acquired data.

A change point and a change point rank can be set as column names that can be set in the case where there is change point data. Whether or not the change point is a change point (TRUE/FALSE) is set in a bit type. The change point rank is set in the int type for the case of an increase (1), the case of no change (0), and the setting of a decrease (-1).

As the "average/standard deviation" that can be set for each algorithm, the reference point difference, degree of reference point deviation, average difference, abnormality degree rank, group key ID, standardized score, etc. can be set. The reference point difference is the difference from the upper limit/lower limit, and is set as a decimal real number with 15 digits in total and 6 digits below the decimal point. The reference point deviation degree is the degree of deviation from the upper limit/lower limit value, and is set as a decimal real number with 15 digits in total and 6 digits below the decimal point. The average difference is the difference from the average, and is set as a decimal real number with a total of 15 digits and 6 digits after the decimal point.

The degree-of-abnormality rank is the rank of the degree of abnormality that is ranked, and is set in the int type. The group key ID is an ID that serves as a key for attached information, and is set in a 10-character varchar type, for example. The standardized score is a standardized value and is set as a decimal real number with a total of 15 digits and 6 digits after the decimal point.

As the "interquartile range" that can be set for each algorithm, a percentile, a reference point difference, a reference point deviation degree, an abnormality degree rank, a group key ID, and the like can be set. Percentiles are set as real decimal numbers with 15 digits total and 6 digits after the decimal point.

The reference point difference is the difference between the upper and lower limits, and is set as a decimal real number with 15 digits in total and 6 digits below the decimal point. The reference point deviation degree is the degree of deviation from the upper limit/lower limit value, and is set as a decimal real number with 15 digits in total and 6 digits below the decimal point. The anomaly degree rank is an anomaly rank and is set in an int type. The group key ID is an ID that serves as a key for attached information, and is set in a 10-character varchar type, for example.

As the "outlier range" that can be set for each algorithm, the reference point difference, degree of reference point deviation, upper limit, lower limit, abnormality degree rank, group key ID, and the like can be set. The reference point difference is the difference between the upper and lower limits, and is set as a decimal real number with 15 digits in total and 6 digits below the decimal point. The reference point deviation degree is the degree of deviation from the upper limit/lower limit value, and is set as a decimal real number with 15 digits in total and 6 digits below the decimal point.

The upper and lower limits are set as real decimal numbers with a total of 15 digits and 6 digits after the decimal point. The anomaly degree rank is an anomaly rank and is set in an int type. The group key ID is an ID that serves as a key for attached information, and is set in a 10-character varchar type, for example.

(Example of definition setting screen)
FIG. 6 is a diagram showing an example of a definition setting screen. Such a definition setting screen is displayed on the output device 16 by the display control unit 26 shown in FIG. On the definition setting screen illustrated in FIG. 6, data acquisition definition, abnormal value determination definition, message template, determination result table definition, and schedule determination definition can be selected. Among these, the display control unit 26 displays the definition setting screen selected by the business operator. FIG. 6 shows an example in which the setting screen for the determination result table definition is displayed by the display control unit 26 when the business operator selects the setting for the determination result table definition.

The display control unit 26 displays an input field for the definition ID and an input field for the update table name on the determination result table definition setting screen. The example of FIG. 6 is an example in which "UriageNebikiKingaku01 (sales discount amount detection 01)" is entered in the input field for the definition ID. Also, the example in FIG. 6 is an example in which "UriageNebikiKingakuJudgementResult01" is entered in the input field for the update table name.

In addition, the display control unit 26 displays a list of acquired data column names for selecting items to be saved from among the data acquired at the time of abnormal value determination, and selects items to be saved from items associated with abnormal value determination results. Lists the abnormal value judgment result column names for The acquired data column name corresponds to the column name of the “business data” category shown in FIG. Also, the abnormal value determination result column name corresponds to the column name of the classification of "common", "when there is change point data", and "each algorithm" shown in FIG.

Although it is an example, as an acquisition data column name, fiscal year and month (integer type), department code (department CD: character string type: 32 digits), person in charge CD (character string type: 32 digits), person in charge name ( Character string type: 32 digits) and sales discount amount (decimal type) are displayed.

As an example, the abnormal value determination result column names include definition ID (character string type: 32 digits), execution Guid (identifier), index (integer type), determination result (logical type), group key ID ( String type: 32 digits) and standardized score (decimal type) are displayed. In addition, reference point difference (decimal type), reference point deviation degree (decimal type), average difference (decimal type), and abnormality level (integer type) are displayed as abnormal value determination result column names.

When the business operator operates the ">>" button, the abnormal value definition setting unit 21 shown in FIG. 2 sets all the items listed as the acquired data column name and the abnormal value determination result column name as setting items. . In this case, as shown in FIG. 6, the display control unit 26 displays all the item names of the acquired data column name and the abnormal value determination result column name in the setting item display area.

Conversely, when the business operator operates the "<<" button, the abnormal value definition setting unit 21 cancels the setting of all items of the once set acquired data string name and abnormal value determination result string name. In this case, the display control unit 26 hides all the item names displayed in the setting item display area.

In addition, when the business operator operates the ">" button, the abnormality definition setting unit 21 selects the currently selected item among the items displayed as the acquired data column name and the abnormal value determination result column name. set. In this case, the display control unit 26 adds the item name of the item selected when the “>” button is operated to the setting item display area and displays it. On the other hand, when the business operator operates the "<" button, the abnormality definition setting unit 21 cancels the setting of the item selected from the setting item display area. In this case, the display control unit 26 hides the item name of the item selected from the setting item display area.

In this way, the anomaly detection device 9 displays a setting screen for a definition selected by the business operator from among the data acquisition definition, the abnormal value determination definition, the message template, the determination result table definition, and the schedule determination definition. Then, among the various setting items displayed on the setting screen, the setting item selected by the business operator is set as the definition. As a result, in the definition example of the judgment result table shown in FIG. 6, the judgment result (UriageNebikiKingakuJudgementResult01) shown in FIG.

[Error detection operation]
FIG. 8 is a flow chart showing the flow of the abnormality detection operation in the abnormality detection device 9. As shown in FIG. The control unit 12 of the abnormality detection device 9 operates based on the abnormality detection program, and sequentially advances the processing from step S1 in the flowchart of FIG. In step S1, the acquisition unit 24 shown in FIG. 2 performs determination based on the abnormal value determination definition, the abnormal value determination data acquisition definition, and the stored procedure parameter definition set via the definition setting screen shown in FIG. Get the data to use.

In step S2, the abnormal value definition execution unit 22 shown in FIG. 2 performs preprocessing such as missing interpolation and standardization based on the preprocessing definition and aggregation conditions, and aggregates data. In step S3, the abnormal value definition execution unit 22 detects a change point of the time-series data based on the change point definition when there is a change point described above.

In step S4, the abnormal value definition execution unit 22 executes an abnormality detection process based on a statistically calculated threshold value or an arbitrarily designated threshold value based on the abnormal value determination definition, the extraction condition, and the abnormality degree rank definition. . At this time, the abnormal value definition executing unit 22 also ranks the degree of abnormality. In step S5, the storage control unit 23 shown in FIG. 2 updates the abnormal value determination definition, the determination result table information, and the determination result for the result message template. At this time, the storage control unit 23 also updates supplementary information.

(data acquisition processing)
FIG. 9 is a flowchart showing a detailed flow of data acquisition processing in step S1. As shown in FIG. 9, when it comes to the data acquisition process, the acquisition unit 24 first, in step S11, detects an abnormality stored in the business database 7 based on the definition ID described with reference to FIGS. Get the value judgment definition.

Next, in step S12, the acquisition unit 24 acquires the abnormal value determination data acquisition definition and the parameter definition of the stored procedure from the business database 7 based on the data acquisition definition ID. The abnormal value determination definition, the abnormal value determination data acquisition definition, and the stored parameter definition are examples of the data acquisition content definition.

Then, in step S13, the acquisition unit 24 acquires business data (an example of abnormal value detection data) from the business database 7 based on the parameter definition of the stored procedure. In addition, since parameter definitions for stored procedures can be set, it is possible to specify the business data to be used. As a result, the process proceeds to data preprocessing in step S2.

By performing such data acquisition processing, acquisition results of necessary business data can be universally handled regardless of the format of the business system or target data. Therefore, the items of the acquisition result set can be made into a dictionary, and the data preprocessing, change point detection processing, and abnormal value detection processing described below can be shared.

(data preprocessing)
Next, FIG. 10 is a flowchart showing the detailed processing flow of the data preprocessing in step S2. When the data acquisition process described with reference to FIG. 9 is completed, the process proceeds from step S13 in FIG. 9 to step S21 in FIG. In step S21, the acquisition unit 24 acquires from the business database 7 a preprocessing definition in which preprocessing methods such as fixed value missing interpolation, mean value missing interpolation, standardization, and maximum/minimum standardization are set.

If the preprocessing definition exists, the abnormal value definition execution unit 22 preprocesses the determination data based on the acquired preprocessing definition to generate preprocessed data in step S22. On the other hand, if there is no preprocessing, the acquisition unit 24 acquires aggregation conditions in which aggregation units (keys) and aggregation methods are set from the business database 7 based on the definition ID in step S23.

If no aggregation condition exists, the process proceeds directly to step S31 in the flowchart of FIG. On the other hand, if there is an aggregation condition, the abnormal value definition executing unit 22 aggregates the determination data based on the aggregation condition in step S24 to generate post-aggregation data. After this, the process proceeds to step S31 in the flowchart of FIG. Data can be processed by setting such preprocessing of data.

(Change point detection processing)
Next, FIG. 11 is a flow chart showing the detailed flow of the change point detection process described in step S3 of the flow chart of FIG. When the process proceeds from step S23 or step S24 in the flowchart of FIG. 10 to step S31 in the flowchart of FIG. As the change point definition, for example, a moving average or a comparison target, which is a past record, is set. The degree of change is calculated based on this comparison target and the actual value.

Also, as the change point definition, a method for calculating the degree of change is set, which indicates what is the degree of change between the comparison target and the actual result (for example, difference, ratio, rate of change, or the like). Also, as a change point definition, a change point detection method is set that indicates how to detect a change point (for example, a threshold value, average absolute error rate, or total absolute error rate) with respect to the degree of change. It is

If there is no change point definition, the process proceeds directly to step S41 in FIG. On the other hand, if there is a change point definition, the abnormal value definition execution unit 22 detects a change point in the determination data based on the acquired change point definition in step S32, and detects the change point. Generate data. After that, the process proceeds to step S41 in FIG.

This kind of change point detection process evaluates points that have gone up or gone down simply by setting the object to be compared (past performance/moving average), the method of calculating the degree of change, and the method of detecting the change point. be able to.

(abnormality detection processing)
Next, FIG. 12 is a flow chart showing the detailed flow of the abnormality detection process described in step S4 of the flow chart of FIG. When the process proceeds from step S31 or step S32 in the flowchart of FIG. 11 to step S41, the abnormal value definition execution unit 22 executes abnormal value determination processing based on the algorithm of the abnormal value determination definition. Algorithms for determining abnormal values include algorithms that can freely set thresholds (rule base, aggregation, ratio), and algorithms that statistically calculate thresholds (average standard deviation, interquartile range, outlier range). is set.

When the algorithm of the abnormal value determination definition is a statistical method, the process proceeds to step S44, the abnormal value definition execution unit 22 calculates the threshold value, performs the abnormality detection process, and proceeds to step S45. In step S45, the acquisition unit 24 acquires the abnormal value rank definition stored in the abnormality degree rank definition database from the business database 7 based on the definition ID. In the anomaly degree rank definition, the number of anomaly classifications is set. In step S46, the abnormal value definition executing unit 22 ranks the abnormal detection results based on the number of abnormal classifications indicated by the abnormal degree rank definition, and advances the process to step S47. If there is no anomaly degree rank definition, the anomaly value definition execution unit 22 divides the anomaly detection result into a plurality of ranks such as three, performs ranking, and advances the process to step S47.

In step S47, the acquisition unit 24 acquires the extraction conditions from the business database 7 based on the definition ID. As an extraction condition, for example, a threshold of XX or more is set for this item. If the extraction condition does not exist, the process proceeds directly to step S51 in the flowchart of FIG. On the other hand, if the extraction condition exists, the process proceeds to step S43, and the abnormal value definition execution unit 22 determines an abnormal value based on the threshold indicated by the extraction condition. Thereafter, the process proceeds to step S51 in the flowchart of FIG.

On the other hand, in step S41 described above, if the algorithm set in the abnormal value determination definition is a method other than the statistical method, the process proceeds to step S42. In step S42, the acquisition unit 24 acquires the above extraction conditions from the business database 7 based on the definition ID. Then, in step S43, the abnormal value definition executing unit 22 determines an abnormal value based on the threshold indicated by the extraction condition. Thereafter, the process proceeds to step S51 in the flowchart of FIG.

Such anomaly detection processing can be executed by specifying parameters in JSON (JavaScript (registered trademark) Object Notation) format according to the anomaly detection method to be used. Moreover, by sorting the data according to the rank of the degree of anomaly, it is possible to extract and check the data that should be particularly observed among the data determined to be abnormal. Moreover, by setting extraction conditions separately from the anomaly detection method, data extraction can be performed based on the threshold value after the determination by the statistical method. For example, it is possible to detect data with a high discount amount based on the average standard deviation, and extract data with a sales amount of 500,000 yen or less. Then, among the sales amount of 500,000 yen or less, data with a large discount amount can be detected.

(data update processing)
Next, the data formed when the abnormality detection process is completed includes preprocessing data, determination result data (data indicating whether or not there is an abnormality), abnormality degree data (data indicating the degree of abnormality), and change point data. In addition, the data formed when the anomaly detection process is completed is anomaly degree rank data (rank calculated based on the anomaly degree: average or standard deviation data of the anomaly degree) and attached information data (internally supplementary information such as the calculated threshold value). The storage control unit 23 uses these data to update various data related to abnormal value detection stored in the business database 7 .

13 and 14 are flow charts showing the detailed flow of the data update process described in step S5 of the flow chart of FIG. First, in the flowchart of FIG. 13, in step S51, the acquisition unit 24 acquires an abnormal value determination definition from the business database 7 based on the definition ID. In step S52, the storage control unit 23 stores the determination results (preprocessing data, determination result data, change point data, anomaly degree data) are stored or updated.

In step S<b>53 , the storage control unit 23 stores or updates the determination result (attached information data) in the abnormal value determination result attached information table (storage area) provided in the business database 7 . Specifically, the table of anomalous value judgment result ancillary information contains the upper and lower limits of the values calculated when using the mean or standard deviation method, and the values calculated when using the interquartile range method. Ancillary information such as upper and lower bounds, thresholds for multiplication factors used in the outlier range method, etc. are stored or updated.

In step S<b>54 , the memory control unit 23 stores or updates the determination result (abnormality degree rank data) in the abnormality degree rank table (storage area) provided in the business database 7 . The anomaly rank is the rank of the anomaly for the detected record. When the process of step S54 is completed, the process proceeds to step S55 of FIG.

In step S55 of FIG. 14 , the storage control unit 23 stores or updates the anomaly degree rank additional data in the table (storage area) of the anomaly degree rank additional information provided in the business database 7 . The anomaly rank additional data has each value of the weighted average of the current anomaly degree average and the previous anomaly degree average, and the weighted average of the current anomaly degree standard deviation and the previous anomaly degree standard deviation, which are necessary for the anomaly degree rank calculation. are doing.

In step S56, the acquisition unit 24 acquires the result message template (template information of the message to be output) stored in the business database 7 based on the definition ID.

In step S57, based on the obtained result message template, the storage control unit 23 generates result message data by replacing predetermined fields in the template with the original data. Then, in step S<b>58 , the storage control unit 23 stores or updates the determination result (generated result message data) in the result message table (storage area) provided in the business database 7 .

In such data update processing, the items of the determination result table are rearranged according to the acquisition items of the data acquisition definition execution result, the detection method, and the set processing, so that the determination result table can be updated according to the definition. Also, since the anomaly detection message and the like are created in advance, they can be immediately visualized (displayed). In addition, by updating the determination results in the business database 7, transaction data and anomaly detection data acquired in real time can be integrated and utilized for analysis.

(Concrete example of data update processing for judgment result table)
Next, FIG. 15 is a diagram for explaining a specific example of data update processing for the determination result table explained in step S52. FIG. 15(a) shows an example of post-preprocessing data. As an example, as shown in FIG. 15(a), the preprocessed data consists of data for each item of index, sales number, fiscal year/month, person in charge code, sales amount, and discount amount. there is

FIG. 15B shows an example of determination result data. Although it is an example, as shown in FIG. 15(b), the determination result data consists of data for each item of an index and a determination result (FALSE or TRUE). FIG. 15(c) shows an example of additional data when calculating the average/standard deviation. As an example, as shown in FIG. 15(c), the additional data consists of data for each item of index, reference point difference, degree of reference deviation, and average difference.

FIG. 15(d) shows an example of the determination result table. As shown in FIG. 15(d), the determination result table is composed of data for each item of definition ID, execution Guid, index, determination result, fiscal year/month, person in charge code, discount amount, and degree of reference point deviation. ing. At the time of recording or updating, the storage control unit 23 reads data of items provided in the determination result table from each data of FIGS. 15(a) to 15(c) and stores or updates the data.

That is, the storage control unit 23 reads the data of each item of the fiscal year/month, the person in charge code, and the discount amount from the preprocessed data shown in FIG. Store or update the data for each item of fiscal year/month, person in charge code, and discount amount. Similarly, the storage control unit 23 reads the data of the determination result item from the determination result data shown in FIG. 15(b), and stores or updates the data of the determination result item in the determination result table shown in FIG. 15(d). do. Similarly, the storage control unit 23 reads the data of the degree of reference point deviation item from the additional data shown in FIG. Store or update.

(Concrete example of result message creation processing)
Next, FIG. 16 is a diagram for explaining a specific example of the determination message creation processing explained in steps S56 to S58. Specific fields (fields enclosed in curly braces) are set in advance in the result message template acquired in step S56, and a result message is generated based on the determination result and stored or updated in the result message table. Also, certain fields can be updated by performing calculations internally.

FIG. 16(a) is an example of a result message template of "Person in charge CD: {Tantousha CD} detected". FIG. 16(a) is an example of a result message template saying "the upper limit is exceeded by {Difference} circles (upper limit {Upper})". As shown in FIG. 16(a), column names of, for example, the determination result table or the attached information table are set in curly brackets in advance.

As a result, the storage control unit 23 reads out the person-in-charge code from the determination result table shown in FIG. 16(b), and stores or updates the result message table shown in FIG. 16(d). Similarly, the storage control unit 23 reads the upper limit value from the attached information table shown in FIG. 16(c), and stores or updates the result message table shown in FIG. 16(d). Thereby, a result message can be automatically generated based on the determination result.

FIG. 17 is a diagram showing a list of field names that can be set for specific fields (fields enclosed in curly braces) of the result message template. As shown in FIG. 17, common classification field names include "Algorithm (algorithm name (Japanese))", "JudgementColumnValue (column value used for judgment)", "Difference (judgment column and upper limit, lower limit Absolute value of difference between values)”, “Upper (upper limit)” and “Lower (lower limit)” can be set.

In addition, the field names for classifying the mean and standard deviation are "ColumnName (name of judgment column)", "Side (one of two sides, upper side or lower side)", "SignificanceLevel (confidence interval value)" and "Key (aggregation key column name)” can be set. As the field names of the interquartile range classification, "ColumnName (judgment column name)", "IqrMagnification (magnification)" and "Key (aggregation key column name)" can be set. In addition, the field names for outlier range classification are "TargetColumnName (judgment column name)", "BaseColumnName (comparison column name (reference column name))", "Type (multiplication method)" and "Multiplier (multiplier)". rate)” can be set.

[Abnormal value judgment data acquisition definition]
Next, FIG. 18 shows an example of the abnormal value determination data acquisition definition database in which the abnormal value determination data acquisition definitions acquired in step S12 of the flowchart of FIG. 9 are set. As shown in FIG. 18A, the abnormal value determination data acquisition definition database contains a data acquisition definition ID that is an ID that uniquely defines acquired data, a data acquisition definition name that is the name of acquired data (for display during setting). is set. The data acquisition definition ID and data acquisition definition name are information determined regardless of the business (information that is not changed by business).

In addition, in the abnormal value determination data acquisition definition database, the display order that is the order of display, the stored procedure name that is the name of the stored procedure for acquiring data, and the display name of the stored procedure (for display when setting) name is set. These display order, stored name and display name are information that is changed depending on the business.

FIG. 18B is a diagram showing a specific example of an abnormal value determination data acquisition definition set in such an abnormal value determination data acquisition definition database. FIG. 18(b) is an example of a data acquisition definition for acquiring sales data used for abnormal value determination. In this example, the data acquisition definition ID is "SampleDataDefinition", the data acquisition definition name is "Definition for acquiring sales data", the display order is "0", the stored name is "pr_GetUriageData", and the display name is "Sales data acquisition stored procedure”.

In the anomaly detection device 9 , a stored procedure for acquiring data from a table is stored in advance in the business database 7 in order to determine acquisition data. This stored procedure changes the business data to be used.

Next, FIG. 19 is a diagram showing an example of stored parameter definitions acquired from the stored parameter definition table of the business database 7 in step S12 of the flowchart of FIG. The stored parameter definition has a data acquisition definition ID, which is an ID that uniquely defines acquired data, as shown in FIG. 19(a). This data acquisition definition ID is information determined regardless of business (information that is not changed by business).

In addition, the stored parameter definition includes a serial number that is the number of the parameter, a parameter name that is the name of the stored parameter, and a parameter type that indicates the type of stored parameter (0: fixed value, 1: current time, 2: table value function). Prepare. The stored parameter definition also comprises a parameter value that indicates the value of the stored parameter (fixed value if parameter type is '0', NULL if '1', table valued function name if '2'). . In addition, the stored parameter definition includes significant digits, integer digits, and decimal digits in addition to the parameter type name, which is the stored parameter type name.

FIG. 19B is a diagram showing a specific example of stored parameter definition. The example in FIG. 19B is an example of a stored parameter definition that specifies "202009" for the parameter (p_KaikeiYYMMFrom) of the stored parameter. In this case, "SampleDataDefinition" is set as the data acquisition definition ID, and "0" is set as the serial number. Also, "p_KaikeiYYMMFrom" is set as the parameter name, and "0" is set as the parameter type. Also, "202009" is set as the parameter value, and "int type" is set as the parameter type name. Further, "4" is set as significant digits, "10" is set as integer digits, and "0" is set as decimal digits.

Next, in the anomaly detection device 9, the item dictionary of the result set of the stored procedure (stored) is managed as a master. FIG. 20 is a diagram showing an example of an abnormal value determination data acquisition mapping definition acquired from the abnormal value determination data acquisition mapping definition table of the business database 7. As shown in FIG. As shown in FIG. 20A, the abnormal value determination data acquisition mapping definition includes a data acquisition definition ID that uniquely defines acquired data, and an item number that is a stored result set number. Also, the abnormal value determination data acquisition mapping definition includes an item name that is the name of the stored result set, an item display name that is the Japanese display name of the stored result set, and a type name that is the type of the stored result set. In addition, significant digits, integer digits, and decimal digits are set for the abnormal value determination data acquisition mapping definition.

FIG. 20(b) is a diagram showing a specific example of such an abnormal value determination data acquisition mapping definition. The example of FIG. 20(b) is an example of managing an item dictionary of sales data on a master. In the example of FIG. 20(b), the data acquisition definition ID is "SampleDataDefinition", the item number is "1", the item name is "KaikeiYYMM", the item display name is "fiscal year and month", and the type is "int type". , significant digits, integer digits, and decimal digits are set as "NULL". In the example of FIG. 20(b), the data acquisition definition ID is "SampleDataDefinition", the item number is "2", the item name is "TantoushaCD", the item display name is "person in charge code", and the type is "varchar type ”, significant digits as “10”, and integer digits and decimal digits as “NULL”.

In the example of FIG. 20B, the data acquisition definition ID is "SampleDataDefinition", the item number is "3", the item name is "TantoushaName", the item display name is "person in charge", and the type is "varchar type , significant digits as "30", and integer digits and decimal digits as "NULL". In the example of FIG. 20B, the data acquisition definition ID is "SampleDataDefinition", the item number is "4", the item name is "UriageKingaku", the item display name is "sales amount", the type is "decimal", In this example, the significant digits are set to "21", the integer digits to "15", and the decimal digits to "6".

[Preprocessing definition]
Next, the preprocessing definition described in step S21 of the flowchart of FIG. 10 will be described. The anomaly detection device 9 can set a preprocessing definition when processing the original data before executing the anomaly detection process ( FIG. 8 : step S4). FIG. 21 is a diagram showing an example of a preprocessing definition acquired from the preprocessing definition database of the business database 7. As shown in FIG. The example of FIG. 21 shows an example of the preprocessing definition when it is desired to interpolate the mean missing values in the "DenpyouUriageNebikiHontaiKagaku" column. In the example of FIG. 21, the definition ID of the preprocessing definition is "TestDefinitionID". Also, the execution order, which is the order in which the preprocessing is executed, is "0". In addition, the preprocessing definition indicating that the preprocessing content is saved in JSON format is "value":"","preprocess_type":"MissingMeanSubstuition","column_name" as shown in curly brackets in FIG. :"DenpyouUriageNebikiHontaiKagaku"".

In this preprocessing definition, "value" indicates a value to be interpolated when performing fixed value missing interpolation. This "value" is not set except for fixed value missing interpolation. "preprocess_type" indicates the name of the preprocessing method, and "column_name" indicates the column name for preprocessing.

Such preprocessing definitions can be set for maximum-minimum standardization, mean value missing interpolation, fixed value missing interpolation, or standardization.

[Aggregation definition]
Next, the aggregation definition, which is the aggregation condition explained in step S23 of the flowchart of FIG. 10, will be explained. FIG. 22 is a diagram showing an example of a tabulation definition acquired from the tabulation definition database of the business database 7. As shown in FIG. As shown in FIG. 22( a ), the aggregation definition has a group key column 1 . The group key column 1 is set with the name of the key column. If there is more than one, separate them with commas. The aggregate definition also has aggregate column 1 . The name of the column to be aggregated is set in this aggregate column 1 . Aggregation column 1 is an essential setting item when performing aggregation. Also, when calculating the ratio, the column name of the tallying target item corresponding to the denominator is set to the tallying column 1 .

Also, the aggregation definition has a group key column 2, an aggregation column 2, a join key item, and an aggregation method. Group key column 2 is set with the key item column name of aggregation corresponding to the numerator when the ratio is used. Also, in the tally column 2, a tally target item column name corresponding to the numerator when using a ratio is set. Also, in the join key item, a key to be joined when calculating the ratio of the aggregated results of the denominator and numerator is set when the ratio is used. Also, in the tabulation method, a tabulation method indicating whether to perform normal tabulation or to perform ratio calculation is set.

FIG. 22(b) is a diagram showing a specific example of the aggregation definition. For example, when calculating the main sales amount for each person in charge and fiscal year and month, "SampleDefinition1" is set for the definition ID of the summary definition, "TantoushaCD,KaikeiYYMM" is set for the group key column 1, and the summary column 1 is set to "UriageHontaiKingaku". In addition, "Aggregate" is set for the aggregation method.

On the other hand, when calculating the sales discount main amount/sales main amount (=discount rate) for each person in charge and fiscal year and month, "SampleDefinition2" is set for the definition ID of the summary definition, and the group key column 1 is set to "TantoushaCD, KaikeiYYMM". Also, "UriageHontaiKingaku" is set in the aggregate column 1, "TantoushaCD,KaikeiYYMM" is set in the group key column 2, and "UriageNebikiHontaiKingaku" is set in the aggregate column 2. Also, "TantoushaCD, KaikeiYYMM" is set as the join key item, and "Rate" is set as the aggregation method.

[Abnormal value judgment definition]
Next, the definition of abnormal value determination described in step S11 of the flowchart of FIG. 9 will be described. FIG. 23 is a diagram showing an example of an abnormal value determination definition acquired from the abnormal value determination definition database of the business database. The abnormal value judgment definition is a definition for specifying the calculation method used for judgment, and as shown in FIG. 23, definition ID, definition name, display order, comment, algorithm, definition, data acquisition definition ID and update table name It has

A definition name is the name of the definition. The display order is the screen display order (for setting display). A comment is a comment that describes the details of the definition. Algorithm is the algorithm name of the judgment method. The definition describes, for example, settings required for the algorithm in Json format. For the data acquisition definition ID, the ID of the acquisition definition set in the abnormal value determination data acquisition definition used for determination is specified. The update table name is the name of the table to which the determination result is updated.

FIG. 24 is a diagram showing a specific example of an abnormal value determination definition. FIG. 24(a) shows an example of an abnormal value judgment definition in the case where a rule is defined for the sales discount main amount and an abnormal value judgment is made. In this case, the definition ID is set to "SampleDefinition1" and the definition name is set to, for example, "Sample Definition 1". In addition, the display order is set to "1", and the comment "judgment of discount amount abnormality based on rules" is added. Also, "Rule" is set as the determination algorithm (algorithm), and "SampleSelectDefinitionID" is set as the data acquisition definition ID. Then, "SampleRuleResultTable" is set as the update table name.

Further, FIG. 24(a) shows an example of an abnormal value judgment definition in the case of judging an abnormal value of the sales discount main amount using the average standard deviation. In this case, the definition ID is set to "SampleDefinition2" and the definition name is, for example, "SampleDefinition2". In addition, the display order is set to "2", and the comment "abnormal judgment of discount amount based on average standard deviation" is attached. In addition, the judgment algorithm is set to "MeanStandardDeviation", and the definition is enclosed in curly brackets as "column_name":"DenpyouUriageNebikiHontaiKingaku","side":"Upper","significance_level":0.05,"key": null" is described. Further, "SampleSelectDefinitionID" is set as the data acquisition definition ID, and "SampleMeanStandardDeviationResultTable" is set as the update table name.

FIG. 24(b) shows an example of an abnormal value judgment definition when judging an abnormal value of the sales discount main amount using the interquartile range. In this case, the definition ID is set to "SampleDefinition3", and the definition name is, for example, "Sample definition 3". In addition, the display order is set to "3", and the comment "abnormal determination of discount amount by interquartile range" is attached. In addition, the judgment algorithm is set to "InterquartileRange", and the definition includes ""column_name":"DenpyouUriageNebikiHontaiKingaku","side":"Upper","iqr_magnification":1.5,"key" :null” is described. Furthermore, "SampleSelectDefinitionID" is set as the data acquisition definition ID, and "SampleInterquartileRangeResultTable" is set as the update table name.

FIG. 24(b) shows an example of an abnormal value determination definition for the abnormal value determination of the sales discount main amount based on the moving average of the sales discount main amount using the outlier range. In this case, the definition ID is set to "SampleDefinition4" and the definition name is, for example, "Sample Definition 4". In addition, the display order is set to "4", and the comment "abnormal determination of discount amount due to outlier range" is added. In addition, the determination algorithm is set to "OutlierRange", and the definition includes "target_column_name":"DenpyouUriageNebikiHontaiKingaku","base_column_name":"DenpyouUriageNebikiHontaiKingakuMovingAverage","type":"Threshold"," key":null,"rate":0.2" is described. Further, "SampleSelectDefinitionID" is set as the data acquisition definition ID, and "SampleOutlierRangeResultTable" is set as the update table name.

Next, when "rule base" is set for the determination algorithm of the abnormal value determination definition, "extraction condition definition", which is a desired rule, is set. This extraction condition definition setting is an essential setting item when abnormal values are extracted based on a threshold value. FIG. 25 is a diagram showing an example of extraction condition definitions acquired from the extraction condition definition database of the business database 7. As shown in FIG. As the extraction condition definition, as shown in FIG. 25A, definition ID, position number, conjunction, front parenthesis, extraction column name, operator, threshold value, data type, comparison column name, and rear parenthesis are set. A definition ID is an ID uniquely assigned to one definition. On the other hand, the position No. to the back parenthesis is information that changes depending on the business.

Position No. indicates the order of application, and conjunctions (AND, OR) for designating a plurality of conditions are set as conjunctions. Front parentheses are set when specifying multiple conditions in parentheses. A column name specifying a condition is specified as an extraction column name. An equal sign or inequality sign is set for the operator. The threshold of the extraction string is set as the threshold. This threshold cannot be set when a comparison column is set. A data type is set in the data type. A comparison column name is set when comparing condition columns and items. This comparison column cannot be set if a threshold is set. Trailing parentheses are set when specifying multiple conditions in parentheses.

FIG. 25(b) is an example of setting an extraction condition in the case where the main amount of sales discount is 20,000 yen or more as an abnormal value. In this case, the definition ID is, for example, "SampleDefinition1" and the position number is "0". The extraction column name is set to "DenpyouUriageNebikiHontaiKingaku", and the threshold is set to "20000 (yen)". Then, the operator is set to "≧" and the data type is set to "decimal".

[Change point definition]
Next, the change point definition acquired in step S31 of the flowchart of FIG. 11 will be described. FIG. 26 is a diagram showing an example of a change point definition acquired from the change point definition database of the business database 7. As shown in FIG. As shown in FIG. 26, as the change point definition, definition ID, time series name, key item, target column name, comparison target, change degree calculation type, number, change point detection type, upper limit and lower limit are set. . Among these, the definition ID is an ID uniquely assigned to one definition. On the other hand, the time series name to the lower limit is information that changes depending on the business.

The definition ID is an ID that distinguishes between methods of abnormal value determination. A time series name is a column name for sorting data in sequential order. A key item is set when there are multiple series. When there are multiple sequences, multiple sequences are set in this key item by separating them with commas. The target column name is the name of the column whose change point is to be detected. For the comparison target, a comparison target such as "0: past performance, 1: moving average" is set.

A method for calculating the degree of change is set in the degree of change calculation type. When "Difference" is set as the degree-of-change calculation type, it means that a method of calculating the degree of change as the difference from the object to be compared has been set. Further, when "Ratio" is set as the degree-of-change calculation type, it means that a method of calculating a ratio to a comparison target as the degree of change has been set. Also, when "ChangeRate" is set as the degree-of-change calculation type, it means that a method of calculating the rate of change with respect to the comparison target as the degree of change has been set.

The number differs depending on the setting of the comparison target. When "past performance" is set as the comparison target, the number indicates how many previous performances are to be compared. Further, when "moving average" is set as the comparison target, the number indicates how many points in the past to calculate the moving average.

The change point detection type is a method of calculating a reference point for the degree of change. When "Threshold" is set in the change point detection type, it means that a method of calculating a reference point using a threshold has been set. Also, when "MeanStandardDeviation" is set, it means that a method of calculating the reference point using the mean standard deviation has been set. Also, when "InterquartileRange" is set for the change point detection type, it means that a method of calculating a reference point using an interquartile range has been set.

The upper limit is the upper limit of the degree of change. This upper limit is always set when the change point detection type is threshold. The lower bound is the lower bound of the degree of change. This lower limit is always set when the change point detection type is threshold.

FIG. 27 is a diagram showing an example of a change point definition that is set when the average/standard deviation is used to obtain points at which the difference from the previous month is abnormal when arranged in chronological order. In this example, for example, "SampleDefinition2" is set as the definition ID, and "KaikeiYYMM" is set as the time series name. Also, "TantoushaCD" is set as the key item, and "DenpyouUriageNebikiHontaiKingaku" is set as the target column name. Also, "0" is set as the comparison target, "Difference" is set as the change degree calculation type, and "1" is set as the number. Also, "MeanStandardDeviation" is set as the change point detection type.

[Table design]
Next, the anomaly detection device 9 stores or updates various data generated by executing the anomaly detection process as described above, including the calculation process, in various tables as calculation results. As an example, the anomaly detection device 9 includes acquired data (data after processing if data has been processed), determination result data (TRUE/FALSE as to whether it was an abnormal value), degree of anomaly data (degree of anomaly in the case of an abnormal value ) are stored or updated for various tables. In addition, the anomaly detection device 9 includes anomaly degree additional data (intermediate information used for anomaly degree calculation), change point data (results when the change point is judged), and judgment result additional data (judgment result Additional information used in the calculation process) is stored or updated in various tables.

(Judgment result table)
Acquisition data, determination result data, change point data, and the like are stored or updated in the determination result table described in step S52 of the flowchart of FIG. This determination result table is automatically created based on the items to be updated when the definition is created.

(Abnormality rank table)
FIG. 28 is a diagram showing an example of an anomaly degree rank table in which the anomaly degree rank data described in step S54 of the flowchart of FIG. 13 is stored or updated. As shown in FIG. 28, in the anomaly degree rank table, definition ID, execution Guid, index and rank are recorded or updated by the anomaly rank data. The definition ID is an ID that uniquely defines the definition of abnormal value determination. Execution Guid is the Guid value at runtime. The index is an index indicating which record of the determination result data. The rank is a rank given according to the degree of abnormality (the larger one is the more abnormal).

(Abnormality rank table)
FIG. 29 is a diagram showing an example of an anomaly degree rank additional information table in which the anomaly degree rank additional data described in step S55 of the flowchart of FIG. 14 is stored or updated. The anomaly degree rank added data is average or standard deviation data used for intermediate calculation when calculating the degree of anomaly. As shown in FIG. 29, in the anomaly degree rank additional information table, each item of definition ID, execution Guid, average and standard deviation is recorded or updated by the anomaly degree rank additional data. The definition ID is an ID that uniquely defines the definition of abnormal value determination. Execution Guid is the Guid value at runtime. Average is the average value of the degree of anomaly of the anomalous data. The standard deviation is the standard deviation of the degree of anomaly of the anomalous data.

(Abnormality degree determination result attached information table)
FIG. 30 is a diagram showing an example of an abnormality degree determination result attached information table in which the attached information data described in step S53 of the flowchart of FIG. 13 is stored or updated. The attached information data is a threshold value or a multiplication factor internally obtained when determining whether or not there is an abnormality. In the anomaly degree determination result attribute information table, each item of definition ID, execution Guid, group ID, upper limit, lower limit, and multiplication rate is stored or updated by this attribute information data.

The definition ID is an ID that uniquely defines the definition of abnormal value determination. Execution Guid is the Guid value at runtime. The group ID is an ID when data is grouped when calculating a threshold value or a multiplication rate. The upper limit is the mean standard deviation or the upper limit determined by the interquartile range. The lower bound is the lower bound determined by the mean standard deviation or interquartile range. The multiplication factor is the multiplication factor calculated in the outlier range.

(result message table)
FIG. 31 is a diagram showing an example of a result message table in which the result message data described in step S58 of the flowchart of FIG. 14 is stored or updated. Result message data is message data generated for data determined to be abnormal. The result message table stores or updates each item of definition ID, execution Guid, index, layout element CD, and message as shown in FIG. 31 according to the result message data.

The definition ID is an ID that uniquely defines the definition of abnormal value determination. Execution Guid is the Guid value at runtime. The index is the index number of data determined to be abnormal among the determination results. A layout element CD is a layout element CD that indicates a place to display a message. message is the content of the result message.

[Inventory rotation abnormality detection operation]
Next, as a specific example, the operation of the abnormality detection device 9 when detecting an inventory turnover abnormality will be described. Inventory improprieties include, for example, inflating the end-of-term inventory or reducing the cost of sales. Such dishonesty can be determined using the inventory turnover rate calculated by the formula of "cost of sales/monthly average inventory amount".

That is, when the end-of-term inventory is padded, the "monthly average inventory value" increases. Also, if the cost of sales is reduced, the "cost of sales" is reduced. Therefore, if the inventory is fraudulent, the inventory turnover rate calculated by the above formula will be a small value. Therefore, by determining whether or not the inventory turnover rate is a low value, inventory fraud can be detected (abnormality detection). The actual setting table information and the graph displayed as the result of the abnormality detection at the time of inventory fraud (abnormality detection) will be described below.

(table setting)
FIG. 32 is a diagram showing an example of setting values that are set in the abnormal value determination data acquisition definition table when such inventory turnover abnormality detection is performed. In this case, as shown in FIG. 32(a), "ZaikoAlertSelect" is set as the data acquisition definition ID, and "inventory turnover alert data acquisition definition" is set as the data acquisition definition name. The display order is set to "0", the stored name is set to "pr_ZaikoKaitenritu_Select", and the display name is set to "stored procedure for obtaining data for inventory turnover alert".

FIG. 32(b) is an example of a result set of various data acquired by the inventory turnover alert data acquisition stored procedure (stored name: pr_ZaikoKaitenritu_Select) shown in FIG. 32(a). In this example, as shown in FIG. 32(b), the inventory turnover alert data acquisition stored procedure generates "KaikeiYYYYMM (fiscal year and month)," "KaikeiYYYY (fiscal year)," "KaikeiMM (fiscal month)," "ShouhinCD (product code)" and "ShouhinName (product name)" are acquired. In addition, "ZengetumatuZaikoKingaku (inventory amount at the end of the previous month)", "TougetumatuZaikoKingaku (inventory amount at the end of the current month)", "TougetuUriageGenka (cost of sales for the current month)" and "TougetuZaikoKaitenritu (inventory turnover rate for the current month)" are acquired.

FIG. 33 is a diagram showing an example of setting values that are set in the stored parameter definition table when inventory turnover abnormality detection is performed. As shown in FIG. 33, data acquisition definition IDs "ZaikoAlertSelect" are set for serial numbers "0" to "7" in the stored parameter definition table.

Also, the parameter name of serial number "0" is set to "reference point date", the parameter type is set to "current time", and the value is set to "NULL". The parameter name of serial number "1" is set to "fiscal year/month From", the parameter type is set to "table value function", and the value is set to "last year's fiscal year/month acquisition function". The parameter name of the serial number "2" is set to "fiscal year and month To", the parameter type is set to "table value function", and the value is set to "current fiscal year and month acquisition function".

Also, the parameter names of the serial numbers "3" to "7" are set with "department CD", "product type CD", "product type CD", "product number CD", and "product code", respectively. . The parameter types of serial numbers "3" to "7" are all set to "fixed value", and the values are all "NULL".

FIG. 34 is a diagram showing an example of set values set in the abnormal value determination data acquisition mapping definition table when inventory turnover abnormality detection is performed. As shown in FIG. 34, the data acquisition definition ID "ZaikoAlertSelect" is set for each of the item numbers "1" to "9" in the abnormal value determination data acquisition mapping definition table.

The item name "KaikeiYYYYMM (fiscal year and month)" is set for the item number "1", and the item name "KaikeiYYYY (fiscal year)" is set for the item number "2". For number "3", the item name "KaikeiMM (accounting month)" is set. The item name "ShouhinCD (product code)" is set for the item number "4", and the item name "ShouhinName (product name)" is set for the item number "5". . The item name "ZengetumatuZaikoKingaku (inventory amount at the end of the previous month)" is set for the item number "6", and the item name "TougetumatuZaikoKingaku (inventory amount at the end of the current month)" is set for the item number "7". is set. For item number "8", the item name "TougetuUriageGenka (cost of sales for the current month)" is set, and for item number "9", the item name is set for "TougetuZaikoKaitenritu (inventory turnover rate for the current month)". set.

FIG. 35 is a diagram showing an example of set values set in the abnormal value determination definition table when inventory turnover abnormality detection is performed. In this case, as shown in FIG. 35, "ZaikoAlert" is set as the definition ID, and "Inventory rotation alert" is set as the definition name. In addition, "0" is set as the display order, and a comment is set that "the data in which the monthly inventory turnover rate is 1.5 times or more away from the normal range is detected". In addition, the "interquartile range method" is set as the algorithm, and the definition is ""column_name":"TougetuZaikoKaitenritu","side":"Lower","iqr_magnification":1.5, "key": null" is set. Also, "ZaikoAlertSelect" is set as the data acquisition definition ID, and "ZaikoAlertJudgementResult" is set as the update table name.

FIG. 36 is a diagram showing an example of set values set in the message template table when stock turnover abnormality detection is performed. In this case, as shown in FIG. 36, the definition IDs are all "ZaikoAlert" and the message classification is also "2". Also, R2 to R10 are set as the layout elements CD, and the template value of "DefinitionID DefinitionName" is set to the layout element CD of R2 as indicated by being surrounded by curly braces. Also, in the layout element CD of R3, a template value of "KaikeiYYYY, KaikeiMM, Month ShouhinName: Inventory turnover rate, an abnormal decrease was detected" is set as shown in curly brackets.

A template value of "ImgHakoHige" is set for the layout element CD of R4, and "ShouhinName" is enclosed in curly braces and "<strong><span style="color:#ff0000; font-size:25px; ">Product name:ShouhinName</span> detected</strong>" template value is set. In addition, the layout element CD of R6 is set with a template value of "calculation method: Algorithm (range magnification IqrMagnification times, Side test)" using curly braces, and the layout element CD of R7 is set with "<strong> Inventory turnover</strong> was <u><strong>abnormally low</strong></u> compared to the previous month, so it was automatically detected." is set as the template value. A template value of "KaikeiYYYY/KaikeiMM inventory turnover rate" is set to the layout element CD of R8 using curly brackets. In addition, in the layout element CD of R9, "TougetuZaikoKaitenritu" is enclosed in curly braces, and "<span style="color:#ff0000;font-size:25px;"><strong> TougetuZaikoKaitenritu<span class="tani"> </span></strong></span>” is set.

FIG. 37 is a diagram showing a list of determination result table definitions set for the determination result table when inventory turnover abnormality detection is performed. As the determination result table definition in this case, as shown in FIG. 37, there is a determination result table definition of item numbers "0" to "15" to which the definition ID "ZaikoAlert" is attached.

The item number of "0" is the determination result table definition of the definition ID, and the type is a character string type. The item number "1" is the determination result table definition of the execution Guid, and the identifier is used as the type. The item number "2" is the definition of the index determination result table, and the integer type is used for the type. The item number "3" is the determination result table definition of the item name of the determination result, and the logical type is used for the type.

The item number "4" is the definition of the reference point difference determination result table, and the decimal type is used for the type. The item number "5" is the definition of the determination result table of the reference point deviation degree, and the decimal type is used for the type. The item number "6" is the definition of the determination result table of the degree of anomaly rank, and the integer type is used as the type. The item number "7" is the definition of the determination result table for the fiscal year and month, and the integer type is used for the type. The item number "8" is the definition of the determination result table for the fiscal year, and the integer type is used for the type. The item number "9" is the accounting month determination result table definition, and the integer type is used for the type.

The item number "10" is the product code determination result table definition, and the character string type is used as the type. The item number "11" is the product name determination result table definition, and the character string type is used as the type. The item number "12" is the table definition of the inventory value at the end of the previous month, and the decimal type is used for the type. The item number "13" is the determination result table definition of the inventory amount at the end of the current month, and the decimal type is used for the type. Also, the item number "14" is the definition of the determination result table for the current month's cost of sales, and the decimal type is used for the type. The item number "15" is the determination result table definition of the current month's inventory turnover rate, and the decimal type is used for the type.

Note that the definition ID with the item number "0", the execution Guid with the item number "1", the index with the item number "2", and the judgment result with the item number "3" are essential items. A required flag is attached to indicate As the essential flag, "1" is assigned to essential items, and "0" is assigned to non-essential items.

FIG. 38 is a diagram showing an example of a determination result table definition set for the determination result table when inventory turnover abnormality detection is performed. In this case, as shown in FIG. 38, definition ID, execution Guid, index, judgment result, reference point difference, degree of reference point deviation, degree of abnormality rank, fiscal month, fiscal year, fiscal month, product code, product name, previous The determination result table definitions of end-of-month inventory value, current-end inventory value, current-month cost of sales, and current-month inventory turnover rate are set for the determination result table.

[Flow of stock rotation abnormality detection]
Next, the flow of inventory turnover abnormality detection operation will be described using a flowchart. The flowcharts of FIGS. 39, 40, and 42 to 44 are a series of flowcharts showing the flow of inventory turnover abnormality detection operation. The flowchart of FIG. 39 is a flowchart of data acquisition, and the flowchart of FIG. 40 is a flowchart of data preprocessing and change point detection. Further, the flowchart of FIG. 42 is a flowchart of abnormality detection, and the flowcharts of FIGS. 43 and 44 are flowcharts of data update.

First, in the data acquisition flowchart of FIG. 39, in step S61, the acquisition unit 24 shown in FIG. Get the abnormal value determination definition from the definition table.

Next, in step S62, the acquisition unit 24 extracts the abnormal value determination data acquisition definition from the abnormal value determination data acquisition definition table described with reference to FIG. Acquire the stored parameter definition from the stored parameter definition table described using .

Next, in step S63, the acquiring unit 24 acquires the business data shown in FIG. 39, for example, based on the stored data and the stored parameter definition. FIG. 39 shows business data including various data such as fiscal year/month, fiscal year, fiscal month, product code, product name, inventory amount at the end of the previous month, inventory amount at the end of the current month, cost of sales for the current month, and inventory turnover rate for the current month. example.

Next, the process proceeds to step S64 in the flowchart of data preprocessing and conversion point detection in FIG. 40, but in this example, preprocessing definition and aggregation conditions are not set. Therefore, the process proceeds to step S65 without performing data preprocessing. Also, in this example, no change point definition is set. Therefore, the process proceeds to step S66 of the abnormality detection flowchart in FIG. 42 without performing change point detection.

Here, in this example, since the change point definition is not set, the process proceeds to the abnormality detection flowchart in FIG. 42 without performing the change point detection. If change point definitions are set, change point detection is performed as follows.

That is, when the change point definition is set, the abnormal value definition execution unit 22 rearranges the time series for each key item in ascending order as shown in FIG. Rearrange).

Next, as shown in FIG. 41(c), the abnormal value definition execution unit 22 calculates a comparison target based on the comparison target and the number (the previous month's result is used as a comparison target). Next, as shown in FIG. 41(c), the abnormal value definition execution unit 22 assigns the change degree calculation type as shown in FIG. Calculate the degree of change according to (the difference from the comparison target is the degree of change).

Next, the abnormal value definition executing unit 22 calculates change point data according to the change point detection type, as shown in FIG. 41(e), for the calculated degree of change. Specifically, the abnormal value definition execution unit 22 calculates the upper limit value and the lower limit value of the degree of change based on the average standard deviation of the degree of change, and evaluates points below the lower limit as points where the degree of change has decreased. do. The example of FIG. 41(e) is an example in which the upper limit of the degree of change is 0.2 and the lower limit is -0.2. In this case, the change point is "TRUE" and the change point rank is " -1” rating. In addition, the change point is "TRUE" and the change point rank is "1", which indicates that the inventory turnover rate for the current month has increased with respect to the degree of change of "0.252" on the third line of FIG. 41(e). get a rating of

Next, returning to the description of the flowchart, when the process proceeds to step S66 of the abnormality detection flowchart of FIG. The outlier detection process (outlier determination) is performed using the interquartile range method defined in the algorithm of the table. In step S67, the abnormal value definition executing unit 22 calculates a threshold value and performs abnormality detection.

FIG. 45 is a diagram for explaining the threshold value calculation and the abnormality detection operation executed by the abnormal value definition execution unit 22 in step S67. In this case, first, the abnormal value definition executing unit 22 performs the following operations as shown in FIG. to select the plot method. The algorithm method is the lower limit calculation method, which is the first quartile -1.5 x IQR. This is a common interquartile normal range calculation method. As a result, "0.65" is calculated as the lower limit, and the upper limit of "0" is added to the determination result attached information table described with reference to FIG. 30 as the determination result attached information data as shown in FIG. Assume that the value is also stored with a lower limit of "0.65".

Next, the abnormal value definition executing unit 22 adds ""column_name":"TougetuZaikoKaitenritu","side":"Lower","iqr_magnification":1.5,"key": in the abnormal value determination definition table enclosed in curly braces. Based on the definition JSON ""column_name":"TougetuZaikoKaitenritu"" defined as null", the current month inventory turnover rate of the business data shown in Fig. 45(c) is converted to the value Sort from top to bottom (ascending order) and plot in ascending order.

Next, the abnormal value definition execution unit 22 performs the following calculation based on the lower limit value of "0.65" indicated by the determination result attached information data shown in FIG. Calculate the reference point difference and the degree of reference point deviation for each month's inventory turnover rate.

Reference point difference = Current month's inventory turnover - Lower limit Degree of reference deviation = Reference point difference absolute value / Lower limit

When the abnormal value definition execution unit 22 calculates the reference point difference and the reference point deviation degree by performing such calculation, as shown in FIG. Generate anomaly degree data indicating Then, the abnormal value definition execution unit 22 sets the current month inventory turnover rate below the lower limit value (current month inventory turnover rate<lower limit value) as the determination result of "TRUE", and the current month inventory turnover rate above the lower limit value as "FALSE". The judgment result data shown in FIG. 45(g) is generated as the judgment result. In the example of FIGS. 45(e) to 45(g), the reference point difference of "-0.036" is calculated for the current month's inventory turnover rate of "0.614", and the reference point of "0.0554" is calculated. The degree of point deviation is calculated, and "TRUE" determination result data is generated.

After the determination result data and the like are generated in this manner, the process proceeds to step S68 in the flowchart of FIG. In step S68, the acquisition unit 24 acquires the abnormal value rank definition stored in the abnormality degree rank definition database described in step S45 of FIG. In this example, it is assumed that the outlier rank definition is not set. When the abnormal value rank definition is not set, the abnormal value definition execution unit 22 divides the degree of abnormality into a predetermined number such as three and ranks them.

FIG. 46 is a diagram for explaining the ranking process of the degree of abnormality. When the reference point difference and the reference point deviation degree are calculated as shown in FIG. Calculate the average value and standard deviation value of the degree of abnormality of the inventory turnover rate. FIG. 46(b) is an example of the average value and standard deviation of the degree of anomaly calculated at the time of the previous anomaly detection, and FIG. It is an example of a standard deviation value.

Next, as shown in FIG. 46(d), the abnormal value definition execution unit 22, the average value and standard deviation value of the previous abnormality degree shown in FIG. 46(b), and the current Calculate the average value of the degree of anomaly and the average value of the standard deviation values, and use this as the anomaly degree added data.

Next, in the case of this example, no abnormal value rank definition is set in the abnormality degree rank definition database as described above. Therefore, the anomaly rank definition database stores (ranking non-set definition) indicating that the anomaly value rank definition is not set. FIG. 46(e) is a diagram showing an example of this ranking non-setting definition. This ranking non-setting definition is "0 (normal)", "less than 0.185 (less than average)", "0.185 or more 0.308 It shows that the degree of anomaly is ranked according to the rules of less than ((mean + (1 x standard deviation))” and “0.308 or more”.

When the anomaly degree range is "0 (normal)", the anomaly degree is classified into the anomaly degree rank of "0". When the anomaly degree range is "less than 0.185 (below average)", the anomaly degree is classified into an anomaly degree rank of "1". When the degree of anomaly range is "0.185 or more and less than 0.308 (mean + (1 x standard deviation))", the degree of anomaly is classified into an anomaly degree rank of "2". When the degree of anomaly range is "0.308 or more", the degree of anomaly is classified into an anomaly degree rank of "3".

In the case of this example, as shown in FIG. "1".

Next, when the degree of abnormality is ranked as described above, the process proceeds to step S69 in the flowchart of FIG. In step S69, based on the extraction condition registered in the business database 7 as described in step S47 of the flowchart in FIG. Extract degrees only.

However, in this example, it is assumed that the extraction condition is not set. If the extraction condition is not set, the process proceeds to step S70 of the flowchart of the data update process in FIG. 43 without extracting the degree of abnormality corresponding to the extraction condition.

In step S70, the storage control unit 23 stores business data, judgment result data, The anomaly degree data and the anomaly degree rank data are stored or updated.

47 to 51 are diagrams for explaining the operation of creating the determination result table. When creating the determination result table, the display control unit 26 lists the abnormal value determination result column names on the determination result table definition setting screen shown in FIG. 48 based on the settable column names shown in FIG. indicate. Further, the display control unit 26 displays a list of obtained data column names on the determination result table definition setting screen shown in FIG. 48 based on the master-managed business data item dictionary shown in FIG. 47(b).

As described with reference to FIG. 6, the business operator operates the ">>" button, the "<<" button, the ">" button, or the "<" button to list the abnormal value determination result column names. and the data to be stored in the determination result table from the list of acquired data column names. Also, the business operator inputs a desired update table name such as "ZaikoAlertJudgementResult" to the setting screen for the determination result table definition.

When a desired update table name is input, the storage control unit 23 updates the update table name of the abnormal value definition determination table to the input update table name such as "ZaikoAlertJudgementResult", as shown in FIG. do.

The storage control unit 23 also stores data selected from the list of abnormal value determination result column names and the list of obtained data column names in the determination result table definition database as shown in FIG. 51 based on the update table name such as "ZaikoAlertJudgementResult" stored in the abnormal value judgment definition table shown in FIG. 49 and the judgment result table definition shown in FIG. create a determination result table and store it in the business database 7.

Next, FIG. 52 is a schematic diagram for explaining update processing of various data for such a determination result table. FIGS. 52(e) and 52(f) show a series of determination result tables. Business data such as fiscal year, fiscal year, fiscal month, product code, product name, inventory amount at the end of the previous month, inventory amount at the end of the current month, cost of sales for the current month, and inventory turnover rate for the current month shown in FIG. Then, it is stored or updated in the determination result table as shown in FIG. 52(f).

Further, the judgment result data of "FALSE" or "TRUE" of the judgment result data shown in FIG. The abnormality degree rank data shown in d) is stored or updated in the determination result table as shown in FIG. 52(e).

Next, in step S71 of the flowchart of FIG. 43, the storage control unit 23 stores or updates the attached information data, which is the determination result of the abnormal value, in the abnormality degree determination result attached information database described with reference to FIG. do. The attached information data is the threshold value or multiplication rate internally obtained when determining whether or not there is an abnormality as described above. The items of definition ID, execution Guid, group ID, upper limit, lower limit, and multiplication rate of the abnormality degree determination result attached information table are stored or updated by this attached information data.

Further, in step S72, the storage control unit 23 stores or updates the determination result (abnormality degree rank data) in the abnormality degree rank table. FIG. 53 is a diagram for explaining the update processing of the abnormality degree rank data. As shown in FIG. 53(a), the storage control unit 23 stores the definition ID, the execution Guid, the index, and the abnormality rank of the data for which the judgment result is judged to be abnormal (TRUE) as abnormality degree rank data. ) is stored or updated in the anomaly degree rank table.

When the process of updating the abnormality degree rank data is completed in this way, the process proceeds to step S73 in FIG. In step S73, the storage control unit 23 stores or updates the anomaly degree rank additional data in the anomaly degree rank additional information table described with reference to FIG. The anomaly degree rank addition data is data of the average value of the anomaly degree or the standard deviation of the anomaly degree of the anomaly data used for intermediate calculation when calculating the degree of anomaly.

Next, in step S74, the acquiring unit 24 acquires a message template based on the definition ID of "ZaikoAlert" from the message template table described with reference to FIG. The storage control unit 23 creates a result message based on the acquired message template and the data determined to be abnormal. Then, the storage control unit 23 stores or updates the created result message in the result message table of the business database 7 in step S75.

FIG. 54 is a diagram for explaining the operation of creating and updating such a result message. In FIG. 54, FIG. 54(a) shows determination result data determined to be abnormal, and FIG. 54(b) shows message templates acquired from the message template table. Also, FIG. 54(c) shows a result message table in which result messages are stored or updated.

As shown in FIG. 54(a), the determination result data determined to be abnormal includes, for example, a definition ID such as "ZaikoAlert", an execution Guid such as "a Guid uniquely assigned at the time of execution", an index such as "1", It is created so as to include the judgment result such as "TRUE" and the reference point difference such as "-0.036". In addition, the determination result data is based on the message template, for example, the degree of deviation of the reference point such as "0.0554", the degree of abnormality rank such as "1", the fiscal year and month such as "October 2020", and the year "2020 , a fiscal month such as "October", and a product code such as "S0A". Furthermore, based on the message template, the determination result data includes, for example, the inventory amount at the end of the previous month such as "8200 yen", the inventory amount at the end of the current month such as "8400 yen", the cost of sales for the current month such as "5100 yen", and "0 .614” to include the current month inventory turnover rate.

Based on the message template, the storage control unit 23 extracts the fiscal year, fiscal month, and current month inventory turnover rate from the determination result data thus created, as shown in FIG. 54(b). The storage control unit 23 also extracts the index from the determination result data. Then, the storage control unit 23 stores or updates the index, fiscal year, fiscal month, and current month inventory turnover extracted from the determination result data in the result message table as shown in FIG. 54(c). In the example of FIG. 54(c), the index of "1" is stored or updated in the result message table, and the fiscal year and month of October 2020 and the inventory turnover rate of 0.614 are stored in the result message table. It is an example stored or updated in a table.

[Display operation of abnormality detection result]
Next, the abnormality detection device 9 can display the abnormality detection result of the inventory turnover rate in the form of a graph or the like. For example, as shown in FIG. 55, an inventory turnover rate indicating an abnormal value of 0.614 is detected for product A with a fiscal year of October 2020, and product B with a fiscal year of February 2021 is detected. Assume that an inventory turnover rate indicating an outlier of 0.582 is detected. Note that the example of FIG. 55 is an example in which an inventory turnover rate indicating a value of "0.65" or less is detected as an abnormal value as described with reference to FIG. 45(g).

In this case, when the business operator designates display of the abnormal detection result of the inventory turnover rate, the display control unit 26 displays a result display screen as shown in FIG. The business operator selects one or more of the business name, department name, product classification, product number, and product name for which the inventory turnover abnormality detection result is desired to be displayed on the result display screen. Perform input operations as extraction conditions. The acquisition unit 24 refers to the result message table based on the extraction conditions input by the business operator, and acquires a result message indicating an abnormality in the inventory turnover rate corresponding to the extraction conditions, as shown in FIG. 54(c). do.

Based on the acquired result message, the display control unit 26 displays a definition ID such as "ZaikoAlert", an alert name such as "inventory turnover alert", a fiscal year and month such as "October 2020", "product A", etc. product name, detection data name such as "inventory turnover rate", and an abnormality detection result of the inventory turnover rate including a message such as "an abnormal decrease was detected" are displayed on the result display screen.

Note that the example of FIG. 56 includes, in addition to the result of detection of an abnormality in the inventory turnover rate, a definition ID such as "ZaikoAlert", an alert name such as "Inventory turnover alert", and a fiscal year such as "February 2021". Abnormality detection result of inventory turnover including month, product name such as "Product B", detection data name such as "inventory turnover rate", and message such as "abnormal decrease detected" is also from the result message table. This is an example obtained and displayed on the result display screen.

Also, the acquisition unit acquires the monthly inventory turnover rate of product A, product B, and product C by referring to the determination result table described with reference to FIG. The display control unit 26 controls the display of the obtained monthly inventory turnover rate of each product on the graphed result display screen as shown in FIG. As a result, it is possible for the business operator or the like to recognize the transition of the monthly inventory turnover rate of each of the products A to C. FIG. In addition, since the determination result is stored in the determination result table, it is possible to display and analyze various data associated with business transaction data acquired in real time. When analysis is performed, the data analysis specified by the business operator is performed by the analysis unit 25 shown in FIG.

In addition, when the business operator wants to recognize the details of the detection result of an abnormality in the inventory turnover rate, the inventory Click the display column of the rotation rate abnormality detection result. For example, it is assumed that a click operation is performed on the display column for the abnormal detection result of the inventory turnover rate for product B. FIG. In this case, the display control unit 26, for example, as shown in FIG. 57, displays the detailed message stored in the result message table, the fiscal year and month in which the abnormal value of the inventory turnover was detected, and the value of the inventory turnover in detail. Display on the display screen.

The example in FIG. 57 is
"Product name; Product B was detected Calculation method: Interquartile range (range magnification 1.5 times, lower test)
It was automatically detected because the inventory turnover rate was abnormally low compared to the results up to the previous month.”
This is an example in which a detailed message is displayed.

Also, the example of FIG. 57 is an example in which the fiscal year and month and the value of the inventory turnover rate showing an abnormal value are displayed, such as "February 2021 inventory turnover rate 0.582". As a result, the business operator can recognize detailed information on the inventory turnover rate of the product B. FIG.

In addition to such detailed information on the inventory turnover rate, the display control unit 26 also displays a graph showing the end-of-month inventory amount status of product B, and a graph showing the amount-based occurrence status (cost of sales and average inventory amount) of product B. display. As a result, the business operator can recognize detailed information on the inventory turnover rate of the product B, as well as the end-of-month inventory amount status and amount-based occurrence status related to the product B, and the like.

[Effects of Embodiment]
As is clear from the above description, the mission-critical information system of the embodiment is configured with the anomaly detection device 9 on the mission-critical information system so that it cooperates with business data, sets for each business, and detects anomalies in general. A system that performs detection can be realized with a small-scale configuration. For this reason, it is possible to eliminate the need to set an anomaly detection method and processing according to the characteristics of each piece of business data. In addition, it is possible to eliminate both the setting based on the characteristics of the work and the construction of an anomaly detection system for each work. In addition, it is possible to smoothly perform everything from data preparation to detection result display within one core information system.

In addition, as described with reference to FIG. 3, by dividing the settings for each process, it is possible to execute anomaly detection processing according to various settings.

In addition, as explained using FIGS. 6 and 7, from the acquired items and detection definition items determined according to the work to be anomaly detected, a determination result table of arbitrary items required for analysis is generated and used in work analysis. Available. Therefore, analysis can be performed by combining transaction data acquired in real time and determination results.

More specifically, the backbone information system of the embodiment is intended for the following three generalizations.

1. Generalization of acquired data (Input) Generalization by data acquisition definition (process + parameter) Generalization of data acquisition result (a) → Item dictionary of result data is master-managed.

2. Generalization of the processing method (Process) Operation control according to the selection of arbitrary steps (extraction conditions for data preprocessing/change point detection/abnormality detection/abnormality degree rank definition) Intermediate processing data according to the algorithm of each step Generalization of (b)

3. Generalization of result storage method (Output) ・Updating process of result table specialized for intermediate processing data (b) according to essential/selection steps ・Generalization of message update (update by template replacement)
・Updating the general-purpose result table automatically generated by any combination from the data acquisition result (a) + intermediate processing data (b) according to the selection step (abnormal value + basis information)

By performing such three generalizations 1 to 3, the core information system according to the embodiment can standardize alert detection necessary for solving problems that differ for each task. Arbitrary result data combining ground data and detected business information is created in the same business database 7 as business transaction data. Therefore, it is possible to flexibly perform analysis combining detailed data and alert detection data existing in the business database 7 .

[Contribution to the Sustainable Development Goals (SDGs) led by the United Nations]
Since this embodiment can contribute to improving operational efficiency and promoting appropriate management decisions of companies, it is possible to contribute to Goals 8 and 9 of the SDGs.

In addition, the present embodiment can contribute to the reduction of disposal loss and the promotion of paperless and computerization.

In addition, since this embodiment can contribute to strengthening control and governance, it is possible to contribute to Goal 16 of the SDGs.

[Other embodiments]
The present invention may be implemented in various different embodiments other than the embodiments described above within the scope of the technical idea described in the claims.

For example, among the processes described in the embodiments, all or part of the processes described as being automatically performed can be manually performed, or all of the processes described as being manually performed Or partly can be done automatically by a known method.

In addition, unless otherwise specified, the processing procedures, control procedures, specific names, information including parameters such as registration data of each process or search conditions, screen examples, and database configurations shown in this specification and drawings can be changed arbitrarily.

Also, with regard to the abnormality detection device 9, each component shown in the drawing is functionally conceptual, and does not necessarily need to be physically configured as shown in the drawing.

For example, the processing functions provided in the abnormality detection device 9, particularly the control unit 12 and each processing function performed by the control unit 12, are interpreted in whole or in part by a CPU (Central Processing Unit) and the CPU. It may be implemented by a program to be executed, or may be implemented as hardware by wired logic. The program is recorded on a non-temporary computer-readable recording medium containing programmed instructions for causing the information processing device to execute the processing described in the present embodiment, and the abnormality detection device if necessary. 9 is mechanically read. That is, a storage unit such as a ROM or HDD stores a computer program for giving commands to the CPU in cooperation with the OS to perform various processes. This computer program is executed by being loaded into the RAM, and constitutes the control unit 12 in cooperation with the CPU.

In addition, the anomaly detection program, which is a computer program, may be stored in another server device connected to the anomaly detection device 9 via any network, and all or part of it may be stored as necessary. It is also possible to download.

Further, the anomaly detection program for executing the processing described in this embodiment may be stored in a non-temporary computer-readable recording medium, or may be configured as a program product. Here, this "recording medium" means memory card, USB (Universal Serial Bus) memory, SD (Secure Digital) card, flexible disk, magneto-optical disk, ROM, EPROM (Erasable Programmable Read Only Memory), EEPROM (registered Trademark) (Electrically Erasable and Programmable Read Only Memory), CD-ROM (Compact Disk Read Only Memory), MO (Magneto-Optical Disk), DVD (Digital Versatile Disk), Blu-ray (registered trademark) Disc, etc. shall include any "portable physical medium".

A "program" is a data processing method written in any language or writing method, regardless of the format such as source code or binary code. In addition, the "program" is not necessarily limited to a single configuration, but is distributed as multiple modules or libraries, or cooperates with a separate program represented by the OS to achieve its function. including things. It should be noted that well-known configurations and procedures can be used for the specific configuration and reading procedure for reading the recording medium in each device shown in the embodiment and the installation procedure after reading.

The storage unit 11 is storage means such as memory devices such as RAM and ROM, fixed disk devices such as hard disks, flexible disks, and optical disks, and stores various programs, tables, databases, and , to store files for web pages, etc.

Further, the abnormality detection device 9 may be configured by an information processing device such as a known personal computer device or workstation, or may be configured by an information processing device to which arbitrary peripheral devices are connected. Further, the abnormality detection device 9 may be implemented by installing software (including programs, data, etc.) that implements the processing described in the present embodiment.

Furthermore, the specific form of distribution and integration of the device is not limited to the one shown in the figure, and all or part of it can be functionally or physically implemented in any unit according to various additions or functional additions. It can be distributed and integrated. That is, the embodiments described above may be arbitrarily combined and implemented, or the embodiments may be selectively implemented.

INDUSTRIAL APPLICABILITY The present invention is useful for detecting abnormal data in each task of a core information system.

1 inventory management device 2 sales management device 3 accounting management device 4 production management device 5 payroll management device 6 personnel management device 7 business database 8 electrical connection function 9 abnormality detection device 11 storage unit 12 control unit 13 communication interface unit 14 input/output Interface unit 15 Input device 16 Output device 21 Abnormal value definition setting unit 22 Abnormal value definition execution unit 23 Storage control unit 24 Acquisition unit 25 Analysis unit 26 Display control unit

Claims (9)

An anomaly detection device provided in a core information system in which a plurality of resource element management devices for managing various resource elements are integrated into one system together with each resource element management device,
The anomaly detection device is
an abnormal value definition setting unit for performing settings for performing abnormal value detection processing of abnormal value detection data for each of the resource element management devices;
an acquisition unit configured to acquire, from the corresponding resource element management device, the abnormal value detection data for performing abnormal value detection processing set by the abnormal value definition setting unit;
an abnormal value definition execution unit that performs abnormal value detection processing on the abnormal value detection data acquired from the resource element management device;
a storage control unit that controls storage of abnormal value detection processing results by the abnormal value definition execution unit in a storage unit;
An abnormality detection device characterized by comprising: 2. The anomaly detection device according to claim 1, wherein the storage unit is a storage unit commonly used by each of the resource element management devices and the anomaly detection device. The abnormal value definition setting unit includes at least a data acquisition content definition, which is an acquisition definition of the abnormal value detection data, and a calculation used for abnormal value detection, as settings for performing abnormal value detection processing of the abnormal value detection data. storing and setting an algorithm and an abnormal value determination definition including information indicating a determination result table, which is a storage area on the storage unit for storing abnormal value detection results by the abnormal value detection process, in the storage unit. 3. The abnormality detection device according to claim 1 or 2. The acquisition unit acquires the abnormal value detection data based on the data acquisition content definition stored in the storage unit,
The abnormal value definition execution unit detects an abnormal value of the abnormal value detection data by performing arithmetic processing of the algorithm on the abnormal value detection data acquired by the acquisition unit,
4. The abnormality detection device according to claim 3, wherein the memory control unit stores the abnormal value detection result in the determination result table of the storage unit. The anomaly detection device is
5. The abnormality detection device according to claim 4, further comprising a display control unit that displays the abnormal value detection result stored in the determination result table on a display unit. The abnormal value definition setting unit includes a data preprocessing definition, which is predetermined data processing to be performed on the abnormal value detection data before the abnormal value detection processing, a comparison target, a method for calculating the degree of change, and a change. Any one of the change point definition including the point detection method, the extraction condition for extracting the desired abnormal value from the detected abnormal values, and the abnormality degree rank definition for ranking the abnormal values 6. The anomaly detection device according to any one of claims 1 to 5, wherein one or more can be further set. An anomaly detection method of an anomaly detection device provided in a system together with each resource element management device for a backbone information system in which a plurality of resource element management devices for managing various resource elements are integrated into one system, comprising: ,
In the abnormality detection device,
an abnormal value definition setting step in which the abnormal value definition setting unit performs settings for performing abnormal value detection processing of abnormal value detection data for each of the resource element management devices;
an acquisition step in which an acquisition unit acquires the abnormal value detection data for performing abnormal value detection processing set in the abnormal value definition setting step from the corresponding resource element management device;
an abnormal value definition execution step in which the abnormal value definition executing unit performs abnormal value detection processing on the abnormal value detection data acquired from the resource element management device;
a storage control step in which the storage control unit stores and controls the abnormal value detection processing result by the abnormal value definition execution unit in the storage unit;
An anomaly detection method, comprising: An anomaly detection program for an anomaly detection device provided in the system together with each of the resource element management devices for a backbone information system in which a plurality of resource element management devices for managing various resource elements are integrated into one system. hand,
the computer,
an abnormal value definition setting unit for performing settings for performing abnormal value detection processing of abnormal value detection data for each of the resource element management devices;
an acquisition unit configured to acquire, from the corresponding resource element management device, the abnormal value detection data for performing abnormal value detection processing set by the abnormal value definition setting unit;
an abnormal value definition execution unit that performs abnormal value detection processing on the abnormal value detection data acquired from the resource element management device;
An anomaly detection program characterized by causing the anomaly detection program to function as a storage control unit that controls storage of an anomaly value detection processing result by the anomaly value definition execution unit in a storage unit. A backbone information system in which a plurality of resource element management devices for managing various resource elements are integrated into one system,
An anomaly detection device provided in the system together with each resource element management device,
The anomaly detection device is
an abnormal value definition setting unit for performing settings for performing abnormal value detection processing of abnormal value detection data for each of the resource element management devices;
an acquisition unit configured to acquire, from the corresponding resource element management device, the abnormal value detection data for performing abnormal value detection processing set by the abnormal value definition setting unit;
an abnormal value definition execution unit that performs abnormal value detection processing on the abnormal value detection data acquired from the resource element management device;
a storage control unit that controls storage of abnormal value detection processing results by the abnormal value definition execution unit in a storage unit;
A backbone information system characterized by comprising:

Images