JP6602256B2 - Program, apparatus and method capable of detecting time series change point based on cross-correlation - Google Patents

Description

  The present invention relates to a technique for detecting a trend change or abnormality of data values in time series data.

  In recent years, with the spread of ICT (Information and Communication Technologies) systems, a huge amount of time-series data is generated in various situations. At present, attempts are being made to analyze such time-series data and obtain information useful for business. As an example, time series data of a wireless communication service represented by cellular communication will be described below.

  In the wireless communication service, usually, a plurality of wireless base stations covering an area of several tens of meters to several kilometers are installed, and a wide communication coverage is provided so that a large number of users can communicate anywhere. Further, in an area having a large number of users that cannot be accommodated in one frequency band, for example, a wireless communication service using a plurality of frequency bands is provided. Thereby, the user can use the communication service seamlessly without being aware of the change of the connection destination base station due to movement or the like.

  Under such a communication service, there is a difference in time change information of traffic (for example, traffic) for each base station, that is, time-series traffic data, depending on a user's movement status and a difference in communication-related applications to be used.

A wireless communication service provider can detect such an inflow of traffic exceeding the capacity of the base station or a decrease in the amount of processing traffic due to equipment failure by monitoring such a time change of traffic. Actually, as a factor that the traffic in the base station greatly changes, excluding the periodic traffic change due to the time zone and day of the week,
(A) change in communication traffic by users, (b) change in number of users,
(C) Change of parameters at the base station, (d) New establishment or discontinuation of base stations,
(E) The occurrence of a failure or failure in equipment.

  Here, the communication traffic by the user in (a) fluctuates due to, for example, a change in the frequency of using a large-capacity application, and tends to change gradually. In addition, the change in the number of users in (b) changes the spatial and / or temporal distribution of users when a new densely populated spot appears in the communication service area or due to a flow line change around the spot. Can happen. Furthermore, the above (c) and (d) occur, for example, when the operator adjusts the base station as traffic management. In addition, the equipment in (e) is a network equipment, a base station, a server or the like, and when such equipment fails and a failure occurs, the traffic tends to be different from normal. .

  In order to determine the cause of the traffic change described above, in particular, the occurrence of a failure or failure in the facility (e), a technique for detecting a change point in the time-series traffic data is very important.

  Furthermore, such a change point detection technique can be applied to security means such as attack detection and intrusion detection in a communication network, or can be used for abnormality monitoring, failure detection / failure detection, etc. in a manufacturing system, for example. . Under such circumstances, a change point detection technique in time-series data has attracted attention in various fields.

  For example, in Patent Document 1, a time-series prediction model is constructed using past time-series data, the presence or absence of a structural change is determined by sequentially testing the difference between the predicted value and the actual value, and the change point is detected. Technology is disclosed. Patent Document 2 discloses a technique for detecting a change point using an online forgetting learning algorithm of a two-stage autoregressive model.

  Further, Patent Document 3 updates the time series model while sequentially reading the time series data, sequentially reads the parameters for each of the input data, calculates the loss function, and calculates the value of the loss function. There is disclosed a technique for calculating a sum as a model fitting error (complexity) to input time-series data. In this technique, for all change point candidates, the complexity for the time series data before and after the change point is read, and the sum of these complexities and the complexity for all time series data when no change point is assumed. The change point is detected based on the magnitude of the change point degree calculated based on the difference value.

  Further, in Patent Document 4, for all input time-series data, a vector or space obtained from the latest time-series data and a vector or space of a partial space obtained from time-series data of a past fixed period A technique is disclosed in which a similarity is calculated between and an abnormal point or a change point is detected based on the calculated similarity.

JP 2004-178473 A JP 2004-0543370 A JP 2005-004658 A JP 2006-107179 A

  However, in the prior arts described in Patent Documents 1 to 4, there are problems that the calculation cost is enormous in order to detect the change point without omission and the real-time property of detection is lacking.

  For example, in the techniques described in Patent Documents 1 to 3, change points must be detected for each time series data. As a result, when the number of time-series data increases, the calculation cost increases linearly. In fact, in many sites that handle time-series data, for example, sites that provide a wireless communication service having a large number of radio base stations, it is necessary to detect the change points from the enormous amount of time-series data that is acquired. Therefore, an increase in calculation cost becomes a serious problem.

  Further, in the technique described in Patent Document 4, all time series data is handled at the same time, but since a feature vector or space acquired from a certain period in the past in the time series data is used, a delay occurs and real-time characteristics are obtained. The problem of lacking. In addition, when time-series data having a long periodicity exists, the similarity is low because the characteristics are different in the partial space temporally close to the latest time. In order to deal with this, it becomes necessary to refer to past time-series data for a period, and eventually, a detection delay occurs for the period.

  Furthermore, when the correlation of fluctuations for each time series data is low, the partial space varies depending on the time, the similarity is not stable, and as a result, the change point cannot be stably detected. In addition, there is a possibility that there is a periodicity unique to each data group for a plurality of input time-series data groups. In such a case, a period for calculating the similarity for each data group is appropriately set. It is not easy to determine, and as a result, there may be a case where the change point cannot be detected stably.

  Therefore, an object of the present invention is to provide a program, an apparatus, and a method capable of appropriately detecting a change point from time series data while suppressing an increase in calculation cost.

According to the present invention, there is a change point detection program for causing a computer mounted on an apparatus for detecting a change point indicating a trend change or an abnormality from time series data,
Cross-correlation data determining means for determining one or a plurality of time-series data showing high cross-correlation satisfying a predetermined condition at a certain negative time lag value with reference time-series data;
A correlation matrix relating to one time point is generated from a time-series data group including the time-series data serving as the reference and the determined time-series data, and an eigenvector of the correlation matrix and the time-series data group are included. Generates feature value time-series data including the feature value at each time point using a scalar value corresponding to the difference in direction from a representative vector, which is a vector component of matrix elements related to one time-series data, as a feature value. Feature quantity generating means for
There is provided a change point detection program for causing a computer to function as a change point determination means for determining a change point of the one time series data based on the fluctuation of the feature amount in the feature amount time series data.

As an embodiment of the change point detection program according to the present invention, the change point detection program generates auto-correlation data generating means for generating time-series data indicating high auto-correlation satisfying a predetermined condition for the reference time-series data. As a computer,
The feature quantity generation means preferably includes time-series data indicating high autocorrelation satisfying the predetermined condition in the time-series data group for generating the correlation matrix.

Further, in the change point detection program according to the present invention, the feature quantity generation means is configured to obtain, for each time series data included in the time series data group , a representative vector that is a vector having a matrix element related to the time series data as a vector component. Generating feature amount time-series data including a set of a plurality of feature amounts generated for each time-series data at each time point,
It is also preferable that the change point determination means specifies the time series data in which the change point is generated based on the feature amount variation in the feature amount time series data.

Further, in the change point detection program according to the present invention, the cross-correlation data determination means sets each of a plurality of time series data to be detected as change points as reference time series data, and sets the reference time series data. For each, determine one or more time-series data showing the high cross-correlation,
It is also preferable that the feature quantity generation unit generates the feature quantity time series data for each time series data as the reference.

As another embodiment of the change point detection program according to the present invention, the cross-correlation data determination means shows a high cross-correlation satisfying a predetermined condition at a certain positive time lag value with the reference time-series data. Generating a time series data list including one or more time series data;
The change point detection program performs the positive time lag from the one time point in the time series data included in the time series data list for the time series data for which the change point is determined at one time point by the change point determination unit. It is also preferable to further cause the computer to function as a change point predicting means for predicting that a change point will occur after a lapse of time.

Furthermore, in the change point detection program according to the present invention, the feature value generation means generates a correlation matrix at the Nth time point from the time series data group related to the Nth (N ≧ 1) period, and the correlation matrix And a scalar value corresponding to a difference in direction between the eigenvector and a representative vector that is a vector component of a matrix element related to one time-series data included in the time-series data group, at the Nth time point. From the time series data group related to the (N + 1) th period shifted from the Nth period in the time lapse direction as viewed from the Nth period, to the Nth time point behind the generated correlation matrix at the time of (N + 1), and eigenvectors of the correlation matrix, is the vector of one when the matrix elements according to sequence data and vector components contained in the time-series data group representative Repeating the process of making the scalar value corresponding to the difference in orientation with the Kuttle as the feature value related to the one time-series data at the (N + 1) th time point in the form of sequentially incrementing the N value, the feature value It is also preferable to generate time series data.

Further, as still another embodiment of the change point detection program according to the present invention, the feature value generation means uses the subspace tracking method, based on the data at the new time point related to the time series data group, update the eigenvectors of the correlation matrix, the orientation of the behenate vector generated from the correlation coefficient between the other time series data in one time-series data contained in the time-series data group, and updated the eigenvector It is also preferable that the scalar value corresponding to the difference is a feature value at the new time point.

According to the present invention, there is also a change point detection program for causing a computer mounted on an apparatus for detecting a change point indicating a trend change or abnormality from time series data,
Cross-correlation data determining means for determining one or a plurality of time-series data showing high cross-correlation satisfying a predetermined condition at a certain negative time lag value with reference time-series data;
Using the subspace tracking method, based on the data at a new time point related to the time-series data group including the time-series data serving as the reference and the determined time-series data, a preset initial eigenvector or previous update the eigenvectors updated in time, and behenate vector generated from the correlation coefficient between the other time series data in one time-series data contained in the time-series data group, and updated the eigenvector A feature value generating means for generating a feature value time-series data including the feature value at each time point as a scalar value corresponding to the difference in direction of
There is provided a change point detection program for causing a computer to function as a change point determination means for determining a change point of the one time series data based on the fluctuation of the feature amount in the feature amount time series data.

According to the present invention, the change point detection device further detects a change point indicating a trend change or abnormality from the time series data,
Cross-correlation data determining means for determining one or a plurality of time-series data showing high cross-correlation satisfying a predetermined condition at a certain negative time lag value with reference time-series data;
A correlation matrix relating to one time point is generated from a time-series data group including the time-series data serving as the reference and the determined time-series data, and an eigenvector of the correlation matrix and the time-series data group are included. Generates feature value time-series data including the feature value at each time point using a scalar value corresponding to the difference in direction from a representative vector, which is a vector component of matrix elements related to one time-series data, as a feature value. Feature quantity generating means for
There is provided a change point detection device having change point determination means for determining a change point of the one time series data based on the fluctuation of the feature amount in the feature amount time series data.

As one embodiment of the change point detecting apparatus according to the present invention, the cross correlation data determining means is one which shows a high cross correlation satisfying a predetermined condition at a certain positive time lag value with respect to the reference time series data. Or, generate a time series data list containing multiple time series data,
The change point detection apparatus includes a positive time lag from the one time point in the time series data included in the time series data list for the time series data for which the change point is determined at one time point by the change point determination unit. It is also preferable to further include a change point predicting means for predicting that a change point will occur after the lapse of time.

According to the present invention, there is also a change point detection method in an apparatus for detecting a change point indicating a trend change or abnormality from time series data,
Determining one or a plurality of time-series data exhibiting a high cross-correlation satisfying a predetermined condition at a certain negative time lag value with reference time-series data;
A correlation matrix relating to one time point is generated from a time-series data group including the time-series data serving as the reference and the determined time-series data, and an eigenvector of the correlation matrix and the time-series data group are included. Generates feature value time-series data including the feature value at each time point using a scalar value corresponding to the difference in direction from a representative vector, which is a vector component of matrix elements related to one time-series data, as a feature value. And steps to
There is provided a change point detection method including a step of determining a change point of the one time series data based on a variation of the feature quantity in the feature quantity time series data.

As one embodiment of the change point detection method according to the present invention, the change point detection method includes:
Generating a time series data list including one or a plurality of time series data indicating a high cross-correlation satisfying a predetermined condition at a certain positive time lag value with respect to the reference time series data;
In the time-series data included in the time-series data list for the time-series data in which the change point is determined at one time point in the step of determining the change point, the time related to the positive time lag from the one time point It is also preferable to further include a step of predicting that a change point will occur after the elapse of time.

  According to the change point detection program, apparatus, and method of the present invention, it is possible to appropriately detect a change point from time series data while suppressing an increase in calculation cost.

It is a functional block diagram which shows the function structure in one Embodiment of the change point detection apparatus by this invention. It is a graph which shows one Example of the process in an autocorrelation data generation part and a cross correlation data determination part. It is a table which shows one Example of the produced | generated correlation matrix and time series data list. It is a mimetic diagram for explaining one embodiment of processing which generates feature amount time series data in a feature amount generation part. It is a schematic diagram for demonstrating one Embodiment of the change point test process in a change point determination part. It is a schematic diagram for demonstrating other embodiment of the feature-value production | generation process in a feature-value production | generation part. 3 is a flowchart illustrating an embodiment of a change point detection method according to the present invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[Change point detector]
FIG. 1 is a functional block diagram showing a functional configuration in an embodiment of a change point detection apparatus according to the present invention.

  The change point detection apparatus 1 of the present embodiment shown in FIG. 1 is an apparatus that receives a plurality of time series data via the communication interface 101 and detects change points indicating trend changes and abnormalities in these time series data. is there. The change point detection apparatus 1 can be, for example, a server on which a change point detection program according to the present invention is installed, or a personal computer (PC).

  Here, the plurality of time-series data are time-series data having different sources or different data types. For example, in a wireless communication service, traffic (communication amount) data at a predetermined time (or every elapse of a predetermined unit time) in one installed base station can be adopted as time series data. For example, the traffic data at one time may be a communication amount from a time point before this time by a predetermined time unit to this time. Here, since a plurality of base stations are usually installed in the communication area, a plurality of pieces of time-series data corresponding to the number of base stations (or base station antennas) are acquired.

  Further, the number of call connections, the number of connection trials, etc. can be adopted as traffic data instead of the traffic. Furthermore, as a plurality of time-series data to be handled, it is possible to adopt a mixture of traffic data adopting traffic and traffic call count (or connection trial count). In this case, for example, it is possible to detect an unusual situation such as a decrease in traffic even if the number of calls increases, as a change point.

  Here, the change point in the time series data detected by the change point detection device 1 is a place where the trend of the transition of the data value in the time series data changes (time point) and a place where the data value is far from the normal tendency ( Time).

  By detecting a change point in time-series data using the change point detection device 1, for example, in a wireless communication service represented by cellular communication, a failure or failure of a network facility, a base station, a server or the like is generated. I can find out. That is, when a failure occurs in such equipment, etc., the traffic shows a tendency different from normal or moves away from the normal trend, so by detecting the change point of time series traffic data,・ It becomes possible to detect a failure.

  Of course, the change point detection by the change point detection device 1 is not used only for detecting a failure or failure of a network facility or the like. For example, it may be used as security means such as attack detection or intrusion detection in a communication network, and may be applied to abnormality monitoring, failure detection / failure detection, etc. in a manufacturing system. In fact, if the environment can acquire a plurality of time-series data whose data values may fluctuate due to various factors, the change point detector 1 can be used to detect the occurrence of the factors. .

The change point detection apparatus 1 according to the present invention has the following features:
(A) One or a plurality of time-series data indicating a high cross-correlation satisfying a predetermined condition at a certain negative time lag value with reference time-series data (hereinafter abbreviated as “reference time-series data”) (Hereinafter referred to as “high cross-correlation data”)
(B) generating a correlation matrix relating to one point in time from a time-series data group including “reference time-series data” and the determined “high cross-correlation data”, the “eigenvector” of the correlation matrix, The scalar value corresponding to the difference in direction from the “representative vector” generated from the matrix elements related to one time-series data included in the time-series data group is defined as the “scalar feature value”. ”Including feature amount time series data,
(C) Based on the variation of the “scalar feature value” in the feature value time-series data, a change point of the one time-series data is determined.

  Since the change point detection apparatus 1 uses a “scalar feature value” that has a relatively small calculation processing load because it is a scalar value in this way, even if a plurality of time-series data are handled, the change point detection apparatus 1 can detect the change point. The increase in calculation cost can be suppressed. Furthermore, since the change point is determined from the feature amount time-series data including the “scalar feature amount” at each time point, the change point can be appropriately detected in a form close to real time. In addition, since the scalar amount is processed in time series, the amount of calculation for determining the change point is small. In other words, by sequentially calculating the scalar feature amount, the change point can be detected at any time with a small amount of calculation.

  In addition, since the change point detection device 1 calculates a feature amount by processing a plurality of time series data collectively, the change inspection is more reliably and stably performed without being greatly affected by individual fluctuations for each time series data. It is also possible to go out.

  In this regard, the change point detection apparatus 1 particularly groups “high cross-correlation data” indicating high cross-correlation with “reference time-series data” into time-series data groups for generating a correlation matrix. Yes. As one embodiment described later in detail, “high autocorrelation data” indicating high autocorrelation with “reference time series data” may be included in this time series data group.

  By such grouping, “eigenvectors” are calculated from a plurality of time-series data having a high correlation of a predetermined level or more, so that change point detection can be performed more reliably and stably. That is, it is possible to avoid a situation in which stable change point detection cannot be performed because the correlation of fluctuations between a plurality of time-series data processed together is low.

  Incidentally, it is at a negative time lag value that “high cross-correlation data” shows high cross-correlation with “reference time series data”. Accordingly, the “high cross-correlation data” used to generate the correlation matrix for “reference time series data” is selected as the cause (factor) for the occurrence of “reference time series data”. It will be. In this way, in the correlation matrix for “reference time series data”, it is possible to capture change point detection more reliably by incorporating data related to the situation before the “reference time series data”. Become.

  Further, by grouping the time series data for generating the correlation matrix in consideration of the time lag in this way, it is possible to incorporate the time series data with a causal relationship into the correlation matrix without missing. For example, if an abnormality of a certain device occurs due to an abnormality of another device that occurred one hour ago, considering only the correlation between the time series data of both devices without considering the time lag, both time-series data It is also conceivable not to generate a correlation matrix incorporating the same as the same group. On the other hand, like the change point detection apparatus 1, by considering the causal relationship between the two time series data, a correlation matrix incorporating both the time series data can be generated, and the abnormality of the data can be more reliably detected. It becomes possible.

  Incidentally, as an example, in time-series data related to communication traffic generated at each base station of a wireless communication network, for example, a time shift occurs between each base station due to a difference in the installation position of the base station. There are many cases where causal relationships occur between time-series data. According to the present invention, it is possible to appropriately group traffic time series data having such a causal relationship to generate a correlation matrix.

  Further, as will be described in detail later, the change point detection device 1 specifies which of the grouped time-series data the change point is detected when the change point is detected as one embodiment of the present invention. You can also. Furthermore, it is possible to predict the occurrence of a change point in time series data. Such change point occurrence data identification processing and change point occurrence prediction processing are also possible by considering the causal relationship between time-series data.

[Functional configuration of the device]
Similarly, according to the functional block diagram shown in FIG. 1, the change point detection apparatus 1 includes a communication interface 101, a time series data storage unit 102, a correlation data storage unit 103, a feature amount time series storage unit 104, A change point information storage unit 105, a time-series data list storage unit 106, a display (DP) 107, a keyboard (KB) 108, and a processor memory are included. Here, the processor memory realizes a change point detection function by executing a program that causes the computer of the change point detection apparatus 1 to function.

  Further, the processor memory includes a time series data access unit 111, an autocorrelation data generation unit 112, a cross correlation data determination unit 113, a feature amount generation unit 114, and a change point determination unit 115 as functional components. The change point prediction unit 116 and the input / output control unit 117 are provided. Here, the flow of processing shown by connecting the functional components of the apparatus 1 in FIG. 1 with arrows is understood as an embodiment of the change point detection method according to the present invention.

  Similarly, in FIG. 1, the communication interface 101 transmits a plurality of time-series data such as a plurality of time-series traffic data acquired at each of a plurality of base stations via an access network (carrier communication network) or the Internet. Receive. Here, it is also preferable that each time series data is given an origin for data, that is, an identifier for identifying the series, for example, a base station identifier.

  The time-series data storage unit 102 sequentially stores received (acquired) time-series data by distinguishing each series. Here, it is also preferable to accumulate data for a certain period in each series (for example, for each base station). For example, only data related to a period from a predetermined time before to the present is always stored, and newly received data is stored, while data related to a time point that is past the time point before the predetermined time is discarded. May be. Alternatively, the oldest data may be discarded / maintained so that the data length is within a predetermined threshold while newly received data is accumulated.

  The time-series data access unit 111 appropriately acquires data for a predetermined period in a plurality of accumulated time-series data or each of a plurality of series as appropriate, for example, every time the data time interval of the time-series data elapses. The data is output to the autocorrelation data generation unit 112 and the cross correlation data determination unit 113.

The autocorrelation data generation unit 112 generates high autocorrelation data that is time-series data obtained by time-shifting a reference time-series data (input) as a reference by a period t _p determined from a periodogram. To do. Here, the periodogram is a function corresponding to the Fourier transform of an autocorrelation function (ACF, Auto-Correlation Function), and is a function with respect to frequency (1 / period). The generation of high autocorrelation data using this periodogram will be described later in detail with reference to FIG.

  The cross-correlation data determination unit 113 performs a high cross-correlation satisfying a predetermined condition at a certain negative time lag value with respect to the reference time-series data (which is also input) from the input time-series data. High cross-correlation data, which is time series data to be shown, is determined. Here, the time lag is a shift (time difference) between time parameters of two time-series data in a cross-correlation function (CCF). Next, determination of high cross-correlation data in consideration of this cross-correlation function will be described in detail with reference to FIG.

  FIG. 2 is a graph illustrating an example of processing in the autocorrelation data generation unit 112 and the cross correlation data determination unit 113.

  According to FIG. 2 (A), three time series data A, B and C are acquired (input) as time series data to be detected as change points, and among these, time series data A is used as reference time series data. 2B and 2C show the processing in the case of First, a process for generating the high autocorrelation data A ′ from the reference time series data A will be described.

As shown in FIG. 2B, the autocorrelation data determination unit 112 generates a periodogram from the autocorrelation function (ACF) of the reference time series data A. The autocorrelation function R (τ) of the reference time series data A is expressed by the following equation (1) R (τ) = T ⁻¹ Σt _{= 1} ^T A (t) · A (t + τ)
Is calculated by In the above equation (1), A (t) is a data value at time t of the reference time series data A, and A (t + τ) is a data value at time (t + τ). Σ _{t = 1} ^T is the summation at time t at t = 1, 2,..., T. Here, the time t is a value that is incremented by 1 when an hour unit has elapsed. Therefore, T in the above formula (1) matches the number of data of the reference time series data A.

Next, the periodogram p (f) of the reference time series data A is expressed by the following equation (2) p (f) = Στ _{= −T} ^T exp (−i2πfτ) using R (τ) of the above equation (1). ) ・ R (τ)
Is calculated by Here, f is a frequency (1 / period), and _{Στ = −T} ^T is a summation from −T to T with respect to τ. In the expression (2), i in exp is an imaginary unit.

The periodogram of the time-series data A shown in the graph of FIG. 2B has a peak value (local maximum value) at a frequency f = 0.14, and its period t _p (= 1 / f) is 7. . The autocorrelation data determination unit 112
(A) In the reference time series data A, generate time series data A ′ time-shifted by this period t _p (= 7) obtained from the periodogram,
(B) In the autocorrelation function of the reference time series data A, if the autocorrelation function value ACF ₇ at the period t _p = 7 is equal to or greater than a predetermined threshold, the generated time series data A ′ is converted to the high autocorrelation data A 'Is added to the time series data group for generating the correlation matrix.
Here, if the predetermined threshold is 0.80, for example, ACF ₇ is 0.81, and therefore the time series data A ′ is added to the time series data group as the high autocorrelation data A ′.

Actually, the autocorrelation data generation unit 112 sets each input time-series data as reference time-series data, and generates a periodogram for each reference time-series according to the procedures (a) and (b). Te derives the period t _p, the high autocorrelation data generated using the period t _p, can be a time-series data group elements for generating a correlation matrix. In addition, time-shifting the reference time-series data A and setting the time-series data that has been time-shifted by the time shift that maximizes the autocorrelation function value as the time-series data A ′ can be used without using a periodogram. It is also possible to generate correlation data. Next, processing for determining high cross-correlation data from the reference time series data A will be described.

As shown in FIG. 2C, the cross correlation data determination unit 113 first generates a cross correlation function (CCF) between the time series data A and the time series data B. This cross-correlation function C _AB (t _g ) is expressed by the following equation (3) C _AB (t _g ) = T ⁻¹ Σt _{= 1} ^T A (t) · B (t + t _g )
Is calculated by Here, A (t) is a data value at time t of the reference time series data A, and B (t + t _g ) is a data value at time t + t _g of the time series data B. T _g is the time lag of the time series data B with respect to the reference time series data A. Next, the cross-correlation data determining section 113, the cross-correlation function between the time series data A and the time-series data C C _AC (t _g) also, the following equation _{(4) C AC (t g} ) = T -1 Σ t _{= 1} ^T A (t) ・ C (t + t _g )
Calculated by

In the cross-correlation function C _AB (t _g ) shown in FIG. 2C (calculated by the above equation (3)), the absolute value of the cross-correlation function value CCF becomes 0.8 at the time lag t _g = + 6. Take the maximum value. When in this way the absolute value of the CCF of the time series data A and B is the time lag t _g as a maximum and t _AB, in this example a t _AB = + 6. Here, as in this embodiment, when the time lag at which the absolute value of CCF is maximum takes a positive value (t _AB > 0), the time-series data (A) serving as a reference causes (causes) It is possible to grasp that the time series data (B) of the correlation survey target as a result (fruit) has occurred.

  The cross-correlation data determination unit 113 adds the time-series data B that is “fruit” to the reference time-series data A to a time-series data list used for change point prediction, which will be described in detail later.

On the other hand, in the cross-correlation function C _AC (t _g ) shown in FIG. 2C (calculated by the above equation (4)), the absolute value of the cross-correlation function value CCF is a time lag t _g = −6. The maximum value is 0.8. When in this way the absolute value of the CCF of the time series data A and C is a time lag t _g as a maximum and t _AC, in this example a t _AC = -6. Here, as in this example, when the time lag at which the absolute value of CCF is the maximum takes a negative value (t _AC <0), the time series data (C) subject to correlation investigation causes (cause) Therefore, it can be understood that the reference time series data (A) as a result (result) is generated.

  The cross-correlation data determination unit 113 adds the time-series data C “cause” to the reference time-series data A as high cross-correlation data to the time-series data group for generating the correlation matrix.

Actually, the cross-correlation data generation unit 113
(A) A pairwise cross-correlation function is generated for all input time-series data, that is, a pair of all time-series data selected from the input time-series data (considering the order) Generate a correlation function
(B) In the pair of time series data X and Y, calculate a time lag value t _XY where the absolute value of the cross-correlation function value CCF _XY is maximum, and record this t _XY in association with the pair;
(C) The above process (b) is performed for all pairs,
(D) Using each of the input time series data as reference time series data, for each reference time series data (X), a recorded time lag (t _XY ) for the time series data (Y) that is the counterpart of the pair there a positive, and if the absolute value is equal to or greater than a predetermined threshold value of the cross-correlation function value at the time lag value _{(t XY) (CCF XY)} , the time-series data (Y), the time-series data list In addition,
(E) On the other hand, if the time lag (t _XY ) is a negative value and the absolute value of the cross-correlation function value (CCF _XY ) at the time lag value (t _XY ) is greater than or equal to a predetermined threshold value, the time series data (Y) can be an element of a time-series data group for generating a correlation matrix.

  For a plurality of time-series data input to the autocorrelation data generation unit 112 and the cross-correlation data determination unit 113, a trend component is included in each time-series data as preprocessing immediately before being processed by these functional components. You may extract and prepare the time series data which excluded the said trend component from the said time series data. Here, the extraction of the trend component from the time series data can be performed using a known method such as regression analysis.

  Incidentally, the trend component of time-series data is, for example, in the case of time-series traffic data in a communication service, the number of users performing communication in the target area is increased, or the communication terminal used by the user has a higher communication volume, etc. Occurs when moving to. By removing the trend component that does not cause such a change point in advance, the change point can be detected more reliably.

  Returning to FIG. 1, the correlation data storage unit 103 stores the high autocorrelation data generated by the autocorrelation data generation unit 112 in association with the reference time-series data serving as a correlation partner. Further, the high cross-correlation data determined by the cross-correlation data determination unit 113 is stored in association with the reference time-series data serving as a correlation partner. Further, the correlation data storage unit 103 outputs the stored reference time-series data, high autocorrelation data, and high cross-correlation data to the feature quantity generation unit 114 as required or appropriate.

  The time-series data list accumulating unit 106 accumulates the time-series data list generated by the cross-correlation data determination unit 113 in association with the reference time-series data that is a correlation partner, and the time series added to the list Enter the data information and update the time-series data list. Further, the time-series data list accumulating unit 106 outputs the stored time-series data list to the change point prediction unit 116 in response to a request or as appropriate.

Similarly in FIG. 1, the feature value generation unit 114 includes
(A) In the correlation matrix generation unit 114c, a time-series data group including the reference time-series data input from the correlation data storage unit 103, the associated high autocorrelation data, and the associated highly cross-correlation data To generate a correlation matrix for one point in time,
(B) Principal component analysis PCA (Principle Component Analysis) calculates the (first principal component) eigenvector of the generated correlation matrix,
(C) calculating a scalar value corresponding to an inner product (angle) formed by the calculated eigenvector and a representative vector generated from a matrix element related to one time-series data included in the time-series data group; age,
(D) The correlation matrix of (a) is generated at each time point, and feature amount time-series data including the calculated feature amount is generated.

  Here, the feature quantity generation unit 114 can also generate a correlation matrix in (a) above without using the high autocorrelation data (not included in the time-series data group). For example, the correlation matrix can be generated even when the reference time series data has no periodicity and high autocorrelation data cannot be generated. Naturally, the correlation matrix may be generated without intentionally including the high autocorrelation data. In such a case, when a change point occurs independently in each of the reference time series data and the high cross-correlation data, the change point can be detected.

  On the other hand, as shown in (a) above, by generating a correlation matrix using high autocorrelation data (included in the time-series data group), the trend change of data in the entire time-series data constituting the correlation matrix It is also possible to grasp the abnormalities as abnormal points.

  Here, as a pre-processing of the feature value generation process using the correlation matrix described above, a normalization process for aligning the volume ratio may be performed on the time-series data included in the time-series data group for generating the correlation matrix. preferable. Here, the volume ratio is a ratio between the vertical scales when each time series data is represented in a graph in which the horizontal axis is time.

  For example, if some time series data in the time series data group have a smaller volume ratio than other time series data, even if a change occurs in the data value of this time series data, the feature amount (eigenvector and Corresponding changes are unlikely to occur in the angle formed with the representative vector. That is, data value fluctuations in time-series data with a smaller volume ratio are covered by data with a larger volume ratio and are not easily reflected in the feature amount.

  Therefore, by aligning the vertical scale in the time-series data in the time-series data group (with the volume ratio constant or within a predetermined range), that is, by normalizing the data value, it appears in each time-series data. The change of the data value is surely reflected in the feature value. As a result, it is possible to carry out reliable change point detection with less leakage. In particular, since the feature quantity generation unit 114 performs a feature quantity generation process by collecting a plurality of time-series data, it is very effective to perform a normalization process.

  Note that the correlation matrix generated by the correlation matrix generation unit 114c described above is not limited to a matrix element having a value corresponding to the correlation coefficient, and for example, a variance / covariance corresponding to this correlation coefficient is used. Including those having corresponding values as matrix elements. In other words, a process having a mathematically similar meaning to the correlation matrix generation process of the time series data is included in the process in the correlation matrix generation unit 114c.

  FIG. 3 is a table showing an example of the generated correlation matrix and time-series data list.

  FIG. 3 shows a correlation matrix generated by the feature value generation unit 114 and a time-series data list generated by the cross-correlation data determination unit 113 in the embodiment shown in FIG. Among these, the correlation matrix is composed of a time series data group including the reference time series data A, the high autocorrelation data A ′, and the high cross correlation data C. The time-series data list includes time-series data B that is “fruit” with respect to the reference time-series data A. These correlation matrix and time series data list are preferably recorded as attributes (auxiliary data) of the reference time series data A as shown in FIG.

  FIG. 4 is a schematic diagram for explaining an embodiment of a process for generating feature amount time-series data in the feature amount generation unit 114.

  According to FIG. 4, first, for each time series of a time series data group including one reference time series data, one corresponding high autocorrelation data, and one or more corresponding high cross-correlation data, Time-series data having data from (tM) to time t is acquired. In FIG. 4, three pieces of reference time-series data, high autocorrelation data, and high cross-correlation data are extracted from time (t-M) to t extracted by a window from time (t-M) to time t.

Next, these time series data are set as time series data X _k of series k (= 1, 2,..., N _k ), and the following equation (5) X _k = [x _k1 , x _k2 ,.・, X _{k (M + 1)} ]
Is represented by the transposed matrix X ^T of the matrix X using the time series data in the group as column data.
(6) X ^T = [X ₁ , X ₂ , ..., X _Nk ]
It is expressed in the form of Next, using such a matrix X ^T (X), a correlation matrix (pseudo correlation matrix) C _t at time t is _expressed by the following equation (7) C _t = m ⁻¹ X · X ^T
Generate by. Also, further, it calculates a first principal component eigenvectors w of the generated correlation matrix C _t.

Next, a representative vector for each column (for each row) is generated using each column component (each row component) of the generated correlation matrix C _t as a vector component. The representative vector a _k for each column (row) is one of the time series corresponding to the column (row) among the reference time series data, the high autocorrelation data, and one or more high cross correlation data. It is a representative vector for data.

Then, the eigenvector w calculated, when the angle between the representative vector a _k of the series data X _k F _k a (t), the following equation _{(8) F k (t)} = cos -1 (w T · a k )
Calculated by The angle F _k (t) calculated at the time t is set as the scalar feature amount of the time series data X _k . Further, the following equation (9) F (t) = [F ₁ (t), F ₂ (t) , ..., F _Nk (t)]
A set F (t) of feature quantities at time t expressed by

  Next, the process of calculating the feature value set F (t) at time t described above is repeated at time t + 1 when t is incremented by one unit, and the feature value set F (at time t + 1) t + 1) is calculated. Specifically, a set of feature values is obtained from time series data of times (t-M + 1) to (t + 1) extracted by a window from time (t-M + 1) to time (t + 1). F (t + 1) is calculated. In this way, by calculating and storing the feature value set F (t + p) for each time t + p (p = 1, 2,...) That sequentially elapses, F (t) , F (t + 1), F (t + 2),..., Feature quantity time-series data can be generated. Here, t + p represents the time when a time corresponding to p times the time unit (increment) of the time related to the time series data has elapsed as viewed from time t.

The generation process of the feature amount time series data described above is summarized as follows.
(A) First, a (pseudo) correlation matrix at the Nth time point is generated from a time series data group for generating a correlation matrix related to an Nth (N ≧ 1) period (window),
(B) Angle (direction difference) between the first principal component eigenvector of the generated (pseudo) correlation matrix and a representative vector generated from a matrix element related to one time-series data included in the time-series data group A scalar value corresponding to is a feature amount related to the one time series data at the Nth time point,
(C) Next, from the time-series data group related to the (N + 1) th period (window) shifted in the time lapse direction as viewed from the Nth period, the (N + 1) th time after the Nth time point Generate a (pseudo) correlation matrix at
(D) A scalar corresponding to an angle (direction difference) between the eigenvector of the generated (pseudo) correlation matrix and a representative vector generated from a matrix element related to one time-series data included in the time-series data group The value is a feature amount related to the one time-series data at the (N + 1) th time point,
(E) Such processing is repeated in such a manner that the N value is incremented by 1 in order to generate feature amount time-series data.
In this way, each time a new batch of time series data is acquired by shifting the window with the passage of time, eigenvalue analysis is performed, and batch processing for deriving feature amount time series data is performed.

  Actually, the feature quantity generation unit 114 sets each of the time series data input as change point detection targets as reference time series data, and sets the feature quantity set F (for each reference time series data (X). It is possible to calculate feature amount time series data which is a time series of t). In this case, the correlation matrix and the feature amount time series data are generated by the number of time series data input as the change point detection targets.

  Returning to FIG. 1, the feature quantity generation unit 114 outputs the generated feature quantity time series data to the feature quantity time series storage unit 104 in a form associated with the corresponding reference time series data. The feature amount time series storage unit 104 stores the input feature amount time series data, and outputs the stored feature amount time series data to the change point determination unit 115 in response to a request or as appropriate.

  The change point determination unit 115 determines a change point generated in one time series data based on the fluctuation of the feature quantity in the input feature quantity time series data. Here, when the time series data of the feature quantity set F (t) calculated by the above equation (9) is acquired, based on the fluctuation of the feature quantity in the feature quantity time series data of this F (t), It is also possible to specify the time series data that caused the change point.

  FIG. 5 is a schematic diagram for explaining an embodiment of a change point test process in the change point determination unit 115.

5A to 5D show the correlation matrix at each time T and the feature amount time series data generated by the feature amount generation unit 114 in the embodiment shown in FIG. . Among these, the correlation matrix is generated from a time series data group including the reference time series data A, the high autocorrelation data A ′, and the high cross correlation data C. The feature time series data is
(A) A scalar feature amount F _WA [t] that is an angle formed by the first principal component eigenvector of this correlation matrix and the representative vector of the reference time series data A,
(B) a scalar feature F _{WA ′} [t], which is an angle formed by the first principal component eigenvector of this correlation matrix and the representative vector of the high autocorrelation data A ′, and (c) the first main component of this correlation matrix Scalar feature value F _WC [t], which is the angle between the component eigenvector and the representative vector of high cross-correlation data C
Is composed of a set of scalar features including

When the absolute value of the change from the value at the previous time in the scalar feature value F of the feature value time-series data becomes equal to or greater than the predetermined threshold value F _TH at each time point, the change point determination unit 115 It is determined that a change point has occurred in the time-series data related to the representative vector of the scalar feature F. Specifically, in the embodiment of FIG. 5, if the predetermined threshold value F _TH is 0.1, any time from time T = 1 (FIG. 5A) to time T = t (FIG. 5C) Also, no change in the scalar feature amount F exceeds the predetermined threshold value _FTH .

However, at the time T = t + 1 (FIG. 5D), the scalar feature amount F related to the high cross-correlation data C is
(10) F _WC [t + 1] −F _WC [t] = 0.45−0.24 = 0.21> 0.1 = F _TH
Thus, it is determined that there has been a predetermined change or more. Thereby, the change point determination unit 115 determines that a change point has occurred in the time series data C at time t + 1, and identifies the time series data in which the change point has occurred as the time series data C.

  As described above, the change point determination unit 115 not only detects the occurrence of a change point by generating and using feature amount time-series data composed of a set of feature amounts F, but the change point is not detected. It is also possible to specify which time series data is generated.

  Here, as one example, in order to identify a single base station where a change point occurs in communication traffic in a wireless communication network, conventionally, a huge calculation processing cost has been required. On the other hand, the change point determination unit 115 detects the change point for any time-series data to be specified based on the calculation of the scalar quantity, so that the base station that generated the change point (time series) ) In the specific processing can be suppressed.

As described above, the change point determination unit 115
(A) When the difference between the scalar feature value F at a certain time and the scalar feature value F at the previous time exceeds a predetermined threshold value F _TH , the change point at the certain time is It can be determined that it has occurred.

  In this case, specifically, from the generated feature quantity time-series data, for each time, the difference between the scalar feature quantity F at the time and the scalar feature quantity F at the previous time (feature quantity difference) is calculated. It is also preferable to generate feature amount difference time series data recorded in association with each other and determine a change point using this feature amount difference time series data. Here, using this feature amount difference as a change point detection score, when the change point detection score is equal to or greater than a predetermined score, it may be determined that a change point has occurred at that time.

As another method for determining the change point, the change point determination unit 115
(B) The difference (error) between the scalar feature value F at a certain time in the feature value time-series data and the data value at the time in the preset time-series prediction model is calculated, and this error is preset. When the predetermined threshold value is exceeded, it is possible to determine that a change point has occurred at that time.

  Here, the comparison processing with such a time series prediction model is performed by the model comparison unit 115m of the change point determination unit 115. Further, as a preset time series prediction model, for example, an AR (autoregressive) model generally used for predicting time series data may be adopted. In the linear AR model, the objective variable uses the past value of the objective variable as an explanatory variable, and the coefficient of the polynomial representing the model is usually determined by the maximum likelihood method.

  Returning to FIG. 1, the information on the change point determined by the change point determination unit 115 changes as change point detection information including information indicating at which time the change point occurs in which time-series data. It is recorded in the point information storage unit 105. The change point detection information may be displayed on the display 107 via the input / output control unit 117, or may be transmitted from the communication interface 101 to an external information processing apparatus. The change point detection information may be further output as described above in accordance with a change point detection information request signal input from an input device such as the keyboard 108.

The change point predicting unit 116, when the change point determining unit 115 detects a change point in one time series data at one time point,
(A) obtaining a time-series data list for the one time-series data from the time-series data list storage unit 106;
(B) When the acquired time-series data list includes time-series data (not null), that is, when the one time-series data is “cause” (a positive time lag value is associated) When the series data exists, it is predicted that a change point will occur in the time series data (each) included in the list after the time related to the positive time lag value has elapsed from the one time point.

  For example, in the case of the embodiment shown in FIG. 2 and when the time series data list as shown in FIG. 3 is generated, a change point occurs in the time series data A at time T = t ′. When the determination (specification) is made, the change point prediction unit 116 can predict that a change point will occur in the time-series data B at time T = t ′ + 6.

  As described above, the time series data included in this time series data list is data that is a “result” with respect to the reference time series data, and changes caused by changes in the reference time series data. It is time series data that can occur. According to the change point prediction unit 116, by using such a time series data list, not only the occurrence of a change point is detected, but also a change point occurs in one time series data at one future time point. It is also possible to determine the prediction information.

  Here, as an example, conventionally, in a wireless communication network, it has been difficult to predict the occurrence of a change point in communication traffic. On the other hand, the change point prediction unit 116 predicts the occurrence of a change point based on the autocorrelation time-series data generated by the autocorrelation analysis and the change point detected by the calculation of the scalar quantity. This makes it possible to specify (predict) a base station (time series) that generates a change point in advance.

Incidentally, the change point prediction unit 116 can also predict the occurrence of a change point using the correlation matrix generated by the feature value generation unit 114. For example, in the embodiment shown in FIG. 5, when it is determined that a change point has occurred in the time series data C at time T = t + 1, the change point prediction unit 116 receives this determination result, and receives this determination result. For time series data A that has a relationship of “fruit”, time T is
T = (t + 1) + | t _AC | = t + 1 + 6 = t + 7 (where time lag value t _AC = -6)
It can be predicted that a change point will occur at.

  The change point prediction information determined by the change point prediction unit 116 may be displayed on the display 107 via the input / output control unit 117 or may be transmitted from the communication interface 101 to an external information processing apparatus. . The change point prediction information may be further output as described above according to a request signal for change point prediction information input from an input device such as the keyboard 108. Next, although going back as a function / process, another embodiment using the subspace tracking method in the feature value generation process in the feature value generation unit 114 will be described.

  FIG. 6 is a schematic diagram for explaining another embodiment of the feature quantity generation processing in the feature quantity generation unit 114.

  As another embodiment of the feature quantity generation process, a feature quantity generation process using the subspace tracking method performed by the subspace tracking unit 114p (FIG. 1) of the feature quantity generation unit 114 will be described below.

  First, for comparison, FIG. 6A shows an outline of the feature quantity generation batch processing already described with reference to FIG. In the calculation of the feature amount in the batch processing, every time data at a new time point is added in the time series data, the feature amount is calculated for the batch of the time series data in the window (FIG. 4) for a predetermined period. It is necessary to perform eigenvalue analysis of.

On the other hand, according to FIG. 6B, the subspace tracking unit 114p (FIG. 1) uses the subspace tracking method, and based on data at a new time point related to a plurality of time series data,
(A) Initially, the initial eigenvector set in advance is updated,
(B) If there is an eigenvector updated at the previous time point, further update the eigenvector updated at the previous time point,
Difference in direction (angle) between the updated eigenvector and the representative vector generated from the correlation coefficient (cross-correlation function value) between the other time-series data in one time-series data included in the time-series data group The feature value time-series data including the feature value at each time point is generated using the scalar value corresponding to) as the feature value at the new time point.

Specifically, as the PAST _D algorithm, time series data (at time (tM) to t) acquired at time _t is represented as an observation vector x _t at time t, and an eigenvector w _t at time t is expressed as (11) y _t = w ^T _t-1 · x _t
d _t = β ・ d _t-1 + y _t ²
e _t = x _t −w _t-1・ y _t
w _t = w _t-1 + e _t · y _t / d _t
Calculate using. Here, d _t is the eigenvalue equivalent updated by the observation vector x _{t at} time t, and β is a forgetting factor. The eigenvector w _t at time t calculated by the above equation (11) corresponds to the eigenvector updated by the observation vector x _{t at} time t.

Next, the feature quantity F _t at the time _t between the calculated eigenvector w _t and the representative vector at is _expressed by the following equation (12) F _t = cos ⁻¹ (w _t ^T · a _t )
Calculate using. The processing using the above equations (11) and (12) is performed on the representative vectors of all the time-series data at every elapsed time to calculate a set of feature amounts F, whereby the feature amount F Feature quantity time-series data composed of a set of time series is generated. Incidentally, the initial eigenvector w (0) and the initial eigenvalue d (0) as initial parameters of this algorithm can be any vector other than the zero vector and any scalar value other than zero, respectively.

In this way, each time time t data is added in each time series, the subspace tracking method is applied to the additional data to update various parameters of the subspace tracking method. F _{t is} also updated. Therefore, in this embodiment, there is no need to perform eigenvalue analysis each time data is added, and feature amounts are calculated by relatively simple calculations, so the calculation amount is reduced and the processing burden is further reduced. Is done.

Incidentally, the feature quantity generation unit 114 (subspace tracking unit 114p) has a change mode as follows:
(A) Initially, by batch processing as shown in FIG. 4, a (pseudo) correlation matrix of the time series data group is generated, and the first principal component eigenvector and the corresponding eigenvalue are calculated.
(B) calculating the feature amount F at the time by the eigenvalue analysis of the above (a) only for the first time or from the first time to the time after a predetermined number of time units have elapsed,
(C) At the time immediately thereafter, the eigenvector calculated in the above (b) is set as the initial eigenvector, and this initial eigenvector is determined based on the data at the time related to a plurality of time series data using the subspace tracking method. A representative vector generated from a correlation coefficient (cross-correlation function value) between other time-series data in one time-series data included in the time-series data group, and the updated initial eigenvector The scalar value corresponding to the difference in direction (angle) is defined as the feature value F at the new time point.
(D) After that, at each time, it is also preferable to generate a feature amount time-series data by calculating a set of feature amounts F by processing using a subspace tracking method as shown in FIG. 6B.

As a further modification, following the process in (d) above,
(E) Generate a (pseudo) correlation matrix of time-series data relating to the time again at a time after a predetermined period from the beginning, calculate a first principal component eigenvector (and corresponding eigenvalue), and calculate a feature amount It is also preferable to calculate the set of F. After this, at each new time, the eigenvalue analysis may be continued to calculate the set of feature amounts F, or these eigenvectors and eigenvalues may be sequentially updated as parameters of the subspace tracking method, A set of feature values F at time may be calculated.

[Change point detection method]

  FIG. 7 is a flowchart showing an embodiment of a change point detection method according to the present invention. Hereinafter, an outline of a flow in the change point detection method of the present embodiment will be described with reference to FIGS. 7A and 7B.

First, FIG. 7A shows a processing flow in the time-series data access unit 111.
(S11) The latest time series data of each series is acquired.
(S12) The time series data is stored in the time series data storage unit 102 for each series.

(S13) In each time-series data, it is determined whether or not the data length exceeds a predetermined threshold value. Here, if a false determination is made, the determined time-series data is used as the next change point detection target as it is.
(S14) On the other hand, when a true determination is made in step S13, the data is deleted in order from the oldest data in the determined time series data until the data length falls within a predetermined threshold, and then the time series data Is the next change point detection target.

Next, FIG. 7B shows a change point detection data specifying / change point prediction process flow.
(S21) Read all time-series data subject to change point detection with adjusted data length.
(S22) For each reference time series data, high autocorrelation data is generated and added to the time series data group for generating a correlation matrix.
(S23) For each reference time series data, data indicating a high cross-correlation greater than or equal to a predetermined value with a positive time lag value is generated and added to the time series data list used for predicting the occurrence of a change point.
(S24) High cross-correlation data is determined for each reference time series data and added to the time series data group for generating a correlation matrix.

(S25) For each reference time series data, a correlation matrix is generated using a time series data group including high autocorrelation data and high cross correlation data, and an eigenvector of the correlation matrix is calculated.
(S26) For each reference time-series data, a scalar value corresponding to the angle formed between the calculated eigenvector and representative vector is used as a feature quantity, and feature quantity time-series data is generated / updated from a set of feature quantities at each time. .
(S27) A change point is detected based on the variation of the generated / updated feature amount time-series data, and the time-series data causing the change point is specified.
(S28) Using the generated / updated time-series data list, the time-series data for generating the change point is predicted together with the estimated occurrence time.
As described above, by executing the processing from step S11 to step S28 at each time, the execution of the change point detection method is completed.

  As described above in detail, according to the present invention, since a scalar feature amount having a relatively small calculation processing load is used because of a scalar value, change point detection uses a plurality of time-series data. In addition, it is possible to suppress an increase in calculation cost for detecting the change point. Furthermore, since the change point is determined from the feature amount time-series data including the scalar feature amount at each time point, it is possible to appropriately detect the change point in a form close to real time.

  In addition, since feature values are calculated by processing multiple time series data together, it is possible to detect change points more reliably and stably without being greatly affected by individual fluctuations for each time series data. Become.

  In particular, high cross-correlation data showing a high cross-correlation with reference time-series data is grouped into a time-series data group for generating a correlation matrix. Further, as one embodiment, high autocorrelation data showing high autocorrelation with reference time series data can be included in the time series data group. Since such grouping is performed and eigenvectors are calculated from a plurality of time-series data having a high correlation of a predetermined level or higher, change point detection can be performed more reliably and stably.

  Furthermore, as one embodiment of the present invention, when a change point is detected, it is also possible to specify which of the grouped time-series data the change point is detected. It is also possible to predict the occurrence of change points in time series data. Such identification processing and prediction processing are also possible by considering the causal relationship between the time series data. Thereby, for example, in a wireless communication network, a base station (time series) that generates a change point in communication traffic is specified, or a base station (time series) that generates a change point is specified (predicted) in advance. This is possible while reducing the calculation cost.

  Incidentally, the source of time-series data is naturally not limited to a communication relay device such as a base station. For example, various terminals and servers that make up a communication network, manufacturing devices that make up a manufacturing system, transportation devices, management devices, etc., and further, terminals that make up a market / financial system, authentication servers, customer management servers, etc. Equipment / equipment becomes the source of time-series data. The present invention is naturally applicable to a system including such a source. Furthermore, detection of change points in time-series data from these sources is not limited to those for fault detection and fault detection, for example, monitoring of abnormalities, detection of sudden changes in access, attack / intrusion detection, etc. This is useful for various purposes and purposes.

  In addition, according to the present invention, even in the field of IoT (Internet of Things), which is expected to make great progress in the future, by detecting change points in time series data output from a large number of sensors and devices / devices. Therefore, it is possible to reliably detect an abnormality in the monitoring / management target and appropriately grasp a change in the system environment.

  Various changes, modifications, and omissions of the various embodiments of the present invention described above within the scope of the technical idea and viewpoint of the present invention can be easily made by those skilled in the art. The above description is merely an example, and is not intended to be restrictive. The present invention is limited only by the claims and the equivalents thereof.

DESCRIPTION OF SYMBOLS 1 Change point detection apparatus 101 Communication interface 102 Time series data storage part 103 Correlation data storage part 104 Feature-value time series storage part 105 Change point information storage part 106 Time series data list storage part 107 Display 108 Keyboard 111 Time series data access part 112 Autocorrelation data generation unit 113 Cross correlation data determination unit 114 Feature quantity generation unit 114c Correlation matrix generation unit 114p Subspace tracking unit 115 Change point determination unit 115m Model comparison unit 116 Change point prediction unit 117 Input / output control unit

Claims (12)

A change point detection program for functioning a computer mounted on a device that detects a change point indicating a trend change or abnormality from time series data,
Cross-correlation data determining means for determining one or a plurality of time-series data showing high cross-correlation satisfying a predetermined condition at a certain negative time lag value with reference time-series data;
A correlation matrix relating to one time point is generated from a time-series data group including the time-series data serving as the reference and the determined time-series data, and an eigenvector of the correlation matrix and the time-series data group are included. Generates feature value time-series data including the feature value at each time point using a scalar value corresponding to the difference in direction from a representative vector, which is a vector component of matrix elements related to one time-series data, as a feature value. Feature quantity generating means for
A change point detection program that causes a computer to function as a change point determination unit that determines a change point of one time series data based on a change in feature amount in the feature amount time series data. The change point detection program further causes the computer to function as autocorrelation data generating means for generating time series data indicating high autocorrelation satisfying a predetermined condition for the reference time series data,
The change point detection according to claim 1, wherein the feature amount generation unit includes time-series data indicating high autocorrelation satisfying the predetermined condition in a time-series data group for generating the correlation matrix. program. The feature amount generation means generates a feature amount for a representative vector that is a vector component of a matrix element related to the time series data for each time series data included in the time series data group, and at each time point Generate feature amount time series data including a plurality of feature amount sets generated for each time series data,
The change inspection according to claim 1 or 2, wherein the change point determination means identifies time-series data in which a change point is generated based on a variation in the feature amount in the feature amount time-series data. Out program. The cross-correlation data determination means sets each of a plurality of time-series data to be detected as a change point as reference time-series data, and indicates the high cross-correlation for each reference time-series data. Determine one or more time series data,
The change point detection program according to any one of claims 1 to 3, wherein the feature amount generation unit generates the feature amount time-series data for each time-series data serving as the reference. The cross-correlation data determination means includes a time-series data list including one or a plurality of time-series data indicating high cross-correlation satisfying a predetermined condition at a certain positive time lag value with the reference time-series data. Generate and
In the time-series data included in the time-series data list for the time-series data for which the change point is determined at one time point by the change point determination unit, the change point detection program performs the positive change from the one time point. 5. The change point detection program according to claim 1, further causing the computer to function as a change point prediction unit that predicts that a change point will occur after the lapse of time related to the time lag. The feature value generation means generates a correlation matrix at the Nth time point from the time series data group related to the Nth (N ≧ 1) period, and generates an eigenvector of the correlation matrix and the time series data group. A scalar value corresponding to a difference in direction from a representative vector that is a vector having a matrix element related to one included time series data as a vector component is defined as a feature amount related to the one time series data at the Nth time point. Next, the correlation at the (N + 1) -th time point after the N-th time point from the time-series data group related to the (N + 1) -th time period shifted by the time unit as viewed from the N-th time period. A matrix is generated, and a scalar value corresponding to a difference in direction between the eigenvector of the correlation matrix and a representative vector that is a vector component of a matrix element related to one time-series data included in the time-series data group is obtained. , Number ( The feature amount time-series data is generated by repeating the process of making the feature amount related to the one time-series data at the time of +1) in such a manner that N values are sequentially incremented. 6. The change point detection program according to any one of 5 above. The feature quantity generation means updates the eigenvector of the correlation matrix based on data at a new time point related to the time series data group using the subspace tracking method, and is included in the time series data group. feature quantity of the behenate vector generated from the correlation coefficient, a scalar value corresponding to the difference between the orientation of the updated the eigenvectors in the new time between other time series data at One of the time-series data The change point detection program according to any one of claims 1 to 6, wherein: A change point detection program for functioning a computer mounted on a device that detects a change point indicating a trend change or abnormality from time series data,
Cross-correlation data determining means for determining one or a plurality of time-series data showing high cross-correlation satisfying a predetermined condition at a certain negative time lag value with reference time-series data;
Using the subspace tracking method, based on the data at a new time point related to the time-series data group including the time-series data serving as the reference and the determined time-series data, a preset initial eigenvector or previous update the eigenvectors updated in time, and behenate vector generated from the correlation coefficient between the other time series data in one time-series data contained in the time-series data group, and updated the eigenvector A feature value generating means for generating a feature value time-series data including the feature value at each time point as a scalar value corresponding to the difference in direction of
A change point detection program that causes a computer to function as a change point determination unit that determines a change point of one time series data based on a change in feature amount in the feature amount time series data. A change point detection device that detects a change point indicating a trend change or abnormality from time series data,
Cross-correlation data determining means for determining one or a plurality of time-series data showing high cross-correlation satisfying a predetermined condition at a certain negative time lag value with reference time-series data;
A correlation matrix relating to one time point is generated from a time-series data group including the time-series data serving as the reference and the determined time-series data, and an eigenvector of the correlation matrix and the time-series data group are included. Generates feature value time-series data including the feature value at each time point using a scalar value corresponding to the difference in direction from a representative vector, which is a vector component of matrix elements related to one time-series data, as a feature value. Feature quantity generating means for
A change point detection apparatus comprising: a change point determination unit that determines a change point of the one time series data based on a variation of the feature quantity in the feature quantity time series data. The cross-correlation data determination means includes a time-series data list including one or a plurality of time-series data indicating high cross-correlation satisfying a predetermined condition at a certain positive time lag value with the reference time-series data. Generate and
In the time series data included in the time series data list of the time series data for which the change point is determined at one time point by the change point determination unit, the change point detection device is configured to perform the positive operation from the one time point. The change point detection apparatus according to claim 9, further comprising a change point prediction unit that predicts that a change point is generated after the time related to the time lag. A change point detection method in a device for detecting a change point indicating a trend change or abnormality from time series data,
Determining one or a plurality of time-series data exhibiting a high cross-correlation satisfying a predetermined condition at a certain negative time lag value with reference time-series data;
A correlation matrix relating to one time point is generated from a time-series data group including the time-series data serving as the reference and the determined time-series data, and an eigenvector of the correlation matrix and the time-series data group are included. Generates feature value time-series data including the feature value at each time point using a scalar value corresponding to the difference in direction from a representative vector, which is a vector component of matrix elements related to one time-series data, as a feature value. And steps to
A change point detection method comprising: determining a change point of the one time series data based on a variation of the feature quantity in the feature time series data. Generating a time series data list including one or a plurality of time series data indicating a high cross-correlation satisfying a predetermined condition at a certain positive time lag value with respect to the reference time series data;
In the time-series data included in the time-series data list for the time-series data in which the change point is determined at one time point in the step of determining the change point, the time corresponding to the positive time lag from the one time point The change point detection method according to claim 11, further comprising a step of predicting that a change point will occur after the elapse of time.

Images