JP7291100B2 - Anomaly/change estimation method, program and device using multiple posted time-series data - Google Patents

Description

The present invention relates to a technique for estimating an abnormality or change in a given event from time-series data relating to the event.

In recent years, a great deal of attention has been focused on techniques for detecting the occurrence of various phenomena from information posted on networking services such as SNSs (Social Networking Services) and mini-blogs.

For example, Non-Patent Document 1 discloses a technique of detecting an event using Twitter (registered trademark) stream data. Specifically, this technology uses the trending function of Twitter (registered trademark) to extract hashtags that are currently hot topics, acquire tweets related to them, and create a vector according to the number of times they appear. , and a clustering process is performed. Next, ranking is performed according to the size of the cluster obtained here, and the event and its tweet that are currently being talked about are determined.

Further, Patent Literature 1 discloses an information presentation device that presents both a congested area on an electronic map and information related to the congestion in that area. Specifically, in this device, (a) a score calculated from the standard deviation of the difference between the current demographics and the normal demographics, and (b) the magnification of the current demographics and the normal demographics is used as a congestion degree index, and when the congestion degree index is equal to or greater than a threshold value, it is assumed that a demographic abnormality has occurred.

In addition, in this information presentation device, tweets containing the names of POIs (Points of Interest) existing around the mesh where the demographic anomaly is detected are collected for each POI, and the number of posts is higher than usual. Filtering processing is performed on tweets containing rising POIs. Next, it extracts substrings that match specific patterns such as "(event name) is held" and "(event name) participates", and displays the name of the event that caused the demographic anomaly. -ing

JP 2015-225128 A

Mateusz Fedoryszak, Brent Frederick, Vijay Rajaram and Changtao Zhong, "Real-time Event Detection on Social Data Streams", KDD 2019: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp.2774-2782, <URL : https://doi.org/10.1145/3292500.3330689>, 2019

However, the conventional technology as described above still poses a problem that there are still many cases in which an erroneous judgment is made regarding the occurrence of a phenomenon such as an event or an abnormality.

For example, in the technology described in Non-Patent Document 1, the occurrence of an event is estimated by relying only on data related to Twitter (registered trademark). It may be detected. One easy-to-understand example is the situation where a large number of tweets related to the live performance of a popular artist were posted in advance after receiving an advance notice of the live performance, and when the live event was actually held and the event venue was crowded. It is possible that you may judge that you are in a situation where

In this regard, the technology described in Patent Document 1 takes into consideration the actual demographics and assigns meaning to the mesh that is actually congested by posting. It is possible to avoid associating events with demographic anomalies to situations.

However, in the technique described in this patent document 1, the method used for the above meaning is limited to simple pattern matching. As a result, the results tend to be influenced by topics with a large number of tweets, and the accuracy in estimating the cause of anomalies inevitably deteriorates. For example, in a situation where demographic abnormalities are occurring due to watching a baseball game, if a popular artist announces that a live performance will be held on the same day, the demographic abnormalities may be erroneously assumed to be due to the live performance. There is a possibility that it will be lost. Furthermore, since a uniform threshold value is set in the process of judging the occurrence of abnormalities in demographics, there is the problem of erroneous detection or omission of detection due to, for example, differences in the scale of events.

SUMMARY OF THE INVENTION Accordingly, it is an object of the present invention to provide an abnormality or change estimation method, a program, and an apparatus capable of more accurately estimating information related to an abnormality or change in a given event.

According to the present invention, from event time-series data relating to a predetermined event and a plurality of post time-series data for each of a plurality of posting groups relating to a plurality of topic information that may be related to an abnormality or change in the event, a step of generating a feature amount related to synthesizing or concatenating the event time-series data and the posted time-series data;
and inputting the feature amount into a built abnormality or change estimation model, and determining information related to the abnormality or change of the event based on the output from the abnormality or change estimation model. , an anomaly or change estimation method in a computer is provided.

As an embodiment of the abnormality or change estimation method according to the present invention, it is also preferable to generate the feature amount using an auto-encoder from the event time-series data and the posted time-series data.

It is also preferred that the autoencoder is a fully connected autoencoder, a recurrent neural network (RNN) autoencoder, or a long-short term memory (LSTM) autoencoder.

Furthermore, in the above-described embodiment using an autoencoder, it is also preferable to use the autoencoder to generate the feature amount from the event time-series data and the plurality of posted time-series data as a whole. Alternatively, from each of a plurality of sets of each of the plurality of posted time-series data and the event time-series data, using the autoencoder to generate a plurality of feature amount portions, and from these plurality of feature amount portions It is also preferable to generate the feature amount.

Further, in the embodiment using the above autoencoder, the event is an event related to a predetermined area, and there is a point that can be related to the abnormality or change of the event within a predetermined range including the area,
The feature amount is generated using the autoencoder from the event time-series data and the posted time-series data, information on the degree of separation between the area and the point, and/or type information on the point. is also preferred.

Further, in the above autoencoder embodiments,
(a) the event time-series data and the posted time-series data;
(b) from the degree of divergence from the statistical value of the number of posts in the number of posts in a predetermined period, the attribute information of the poster of the post, and/or information related to the attached data attached to the post; , it is also preferable to generate the feature using the autoencoder.

Also, the plurality of topic information in the anomaly or change estimation method according to the present invention preferably include a set of one range and one topic type related to the attribute information of the contributor of the post.

Furthermore, the information related to the abnormality or change of the event in the abnormality or change estimation method according to the present invention is
(a) information as to whether an anomaly or change occurred in the event; and/or
(b) It is also preferable to include the topic information presumed to be related to the anomaly or change that occurred in the event.

According to the present invention, also
From event time-series data related to a predetermined event and multiple posting time-series data for each of multiple posting groups related to multiple topic information that may be related to the abnormality or change of the event, the event time-series data and the relevant a feature quantity generating means for generating a feature quantity relating to synthesizing or concatenating posted time-series data;
A computer is used as an anomaly or change information determination means for inputting the feature quantity into a built anomaly or change estimation model and determining information related to the anomaly or change of the event based on the output from the anomaly or change estimation model. A functioning anomaly or change estimation program is provided.

According to the present invention, furthermore,
From event time-series data related to a predetermined event and multiple posting time-series data for each of multiple posting groups related to multiple topic information that may be related to the abnormality or change of the event, the event time-series data and the relevant a feature quantity generating means for generating a feature quantity relating to synthesizing or concatenating posted time-series data;
an abnormality or change information determining means for inputting the feature quantity into a constructed abnormality or change estimation model and determining information related to the abnormality or change of the event based on the output from the abnormality or change estimation model; An anomaly or change estimator is provided.

According to the abnormality or change estimation method, program, and device of the present invention, it is possible to more accurately estimate information related to an abnormality or change in a predetermined event.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic diagram showing an embodiment of an abnormality/change estimating device that performs an abnormality/change estimating process using an abnormality/change estimating model according to the present invention; FIG. 10 is a schematic diagram including a table for explaining post-topic linking processing; FIG. 4 is a schematic diagram for explaining another embodiment of an autoencoder according to the present invention; FIG. 10 is a schematic diagram for explaining another embodiment of the synthetic feature amount generation processing according to the present invention;

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[Abnormality/change estimation method and device]
FIG. 1 is a schematic diagram showing an embodiment of an abnormality/change estimation device that performs abnormality/change estimation processing using an abnormality/change estimation model according to the present invention.

The abnormality/change estimation device 2 of this embodiment shown in FIG.
(A) a fully coupled auto-encoder 11F;
(B) An anomaly/change estimation model 12, which estimates the occurrence of an anomaly or change (hereinafter also referred to as "abnormality/change") in the event based on event time-series data related to a predetermined event that has been captured. It is a possible device.

Of these, the above (A) fully coupled autoencoder 11F is
(a1) Event time-series data related to the event, for example, demographic time-series data (related to the event with the discrete set of people),
(a2) The event time-series data and the posted time-series data from the multiple post time-series data for each of the multiple "post" groups related to the multiple "topic information" that may be related to the abnormality/change of the event A "combined feature amount" is generated which is a feature amount related to the synthesis of .

Here, the demographic time-series data of (a1) above can be, for example, data of the number of (users of) mobile terminals per unit time for a predetermined period in a preset regional mesh (predetermined area). In this case, the number of mobile terminals may be acquired from a communication management server capable of collecting information on mobile terminals connected for communication with the base station associated with the regional mesh. Alternatively, after obtaining permission to do so, obtain location information of the mobile terminal from an application installed in the user's mobile terminal that performs positioning using the GPS (Global Positioning System), and based on the location information It is also possible to derive the number of terminals.

In addition, the plurality of "posts" groups related to the plurality of "topic information" in (a2) above is, for example, among the posts in networking services such as SNS (Social Networking Service) and mini-blogs, the event concerned It can be a set of linked "posts" such as "watching sports", "live", "train delay", etc., that can be related to anomalies/changes (for example, demographics).

Incidentally, the group of “posts” can be collected from, for example, a post management server managed by an operator using a public search API (Application Programming Interface). Also, the process of associating a post with a topic will be described later in detail with reference to FIG.

The above (A) fully-connected autoencoder 11F performs feature amount synthesis processing on such event time-series data and a plurality of posted time-series data for each "topic information", and from the intermediate layer, "synthesized feature amount ” can be output.

On the other hand, the anomaly/change estimating model 12 of (B) receives the generated "combined feature quantity" as an input, and determines and outputs "information related to anomaly/change" in the event. Here, this "information related to anomaly/change" is, for example,
(b1) Information regarding whether or not an abnormality or change has occurred in the event (e.g. demographics), for example, the population (the number of mobile terminal users) in the area mesh in a certain time period on a certain day has increased by a predetermined amount or more or information to the effect that it showed a decrease, and (b2) presumed to be related to an abnormality or change that occurred in the event (e.g. demographics) (e.g., an increase or decrease above a predetermined level in a certain time period of a certain day) It can be information that includes either or both of "topic information", for example, information that a "live" was held.

In this way, according to the abnormality/change estimation device 2, not only event time-series data related to a predetermined event, but also post time-series data related to a single topic, cause/factor candidate of the abnormality/change Since the post time-series data related to multiple "topic information" is also captured to generate the feature amount, it is possible to more accurately estimate the "information related to anomalies and changes" of the event based on the feature amount. becomes possible.

In particular, since it uses feature amounts that take into consideration the posted time-series data related to multiple "topic information" that are candidates for the cause or factor of the abnormality or change, one aspect of "information related to the abnormality or change" is used. However, it is possible to more accurately estimate information related to the causes and factors of the abnormalities and changes in the event, such as information that the population has increased more than a predetermined amount due to the holding of the "live". is also possible. In other words, by taking into consideration the transition of multiple candidate topics, it is also possible to identify the cause/factor of the anomaly/change of the phenomenon.

For example, in the area mesh around the "multi-purpose stadium" as a POI that can handle a wide variety of events, in a situation where demographic anomalies occurred due to "watching baseball", advance announcements of live performances by popular artists were made at the same time. Consider the case. Even in such a case, according to the abnormality/change estimation device 2, both the correlation between the demographic transition and the "watching baseball" transition and the correlation between the demographic transition and the "live" transition have already been learned. Since the model is used, it is possible to accurately estimate that the cause/factor of demographic anomalies is "watching baseball games" with higher accuracy.

Furthermore, in the abnormality/change estimating device 2, the abnormality/change in the event can be detected without relying on setting a uniform threshold value for the data values of the event time-series data as in the prior art. It is possible. Therefore, depending on the attributes of the contributor who posts related to "topic information", there may be cases where the absolute number of posts is small in the first place. It is possible to perform more suitable estimation in consideration of the relevance/similarity of transition patterns of series data.

Incidentally, the generation of the feature amount in the abnormality/change estimation device 2 is not limited to the form of generating the "synthetic feature amount" using the autoencoder as described above. For example, the event time-series data of (a1) above and the plurality of posted time-series data of (a2) are connected to form a feature amount, and the abnormality/change estimation model 12 uses this feature amount as an input to determine the event. It may be constructed as a model that outputs "information related to abnormality/change".

However, as the feature amount to be input to the abnormality/change estimation model 12, the "composite feature amount" in which the features of each time-series data as described above are interacted and fused (thus, the dimension is compressed as a result) is used. By adopting it, it becomes possible to estimate "information related to abnormalities and changes" in the event with higher accuracy under a smaller computational load. Furthermore, by generating a "synthetic feature amount" that reflects the correlation between the feature of the event time-series data and the feature of each posted time-series data, "topic information" that has a high correlation with the event can also be specified.

Note that the autoencoder that generates such a "synthetic feature amount" is not limited to the fully coupled autoencoder shown in FIG. For example, a recurrent neural network (RNN, Recurrent Neural Networks) autoencoder or a long-short term memory (LSTM) autoencoder, which will be described in detail later with reference to FIG. It may be used to generate "amount".

Of course, the applicable case of the abnormality/change estimation device 2 (the abnormality/change estimation method in it) is not limited to the demographic movement as an event as described above. In fact, the anomaly/change estimating device 2 can handle a wide variety of events as long as they are events for which time-series data can be acquired and which can fluctuate due to some cause or factor.

For example, the following (a) to (e) can be given as applicable cases of (an abnormality/change estimation method in) the abnormality/change estimation device 2 .
(a) Estimate the cause of an abnormality (rapid increase or sudden decrease) in electricity usage in a certain household or region using posted time-series data relating to a plurality of "topic information", that is, by a plurality of topic transitions.
(b) Estimate the cause of an abnormality (rapid increase or sudden decrease) in the amount of network traffic at a certain base station using posted time-series data relating to a plurality of "topic information", that is, by a plurality of topic transitions.

(c) Estimate the cause of a predetermined change (rising or falling) in a company's stock price using posted time-series data relating to a plurality of "topic information", that is, based on a plurality of topic transitions.
(d) Estimate the cause of the change (increase or decrease) in the approval rating or the number of seats won (in elections) for a certain political party using the time-series data posted on multiple "topic information", that is, by the transition of multiple topics. do.
(e) The cause of change (improvement or decline) in the index indicating the satisfaction level of administrative services by a certain local government is determined using the posting time-series data related to posts by the relevant residents on multiple "topic information", i.e. It is estimated by multiple topic transitions in the corresponding residents.

By the way, as an indicator of (e) above, for example, "Citizen satisfaction with administrative services" <URL: https://s-kantan.jp/city-ushiku-ibaraki-u/offer/userLoginDispNon.action?tempSeq=11892&accessFrom => and “city version SDGs index” <URL: https://prtimes.jp/main/html/rd/p/000000011.000000266.html>.

<Associating topics with posts>
Here, the process of linking the "topic information" to the "post" described above will be described with reference to FIG. FIG. 2 is a schematic diagram including a table for explaining the linking process.

According to the example shown in Figure 2, around noon on December 1, 2019, a demographic anomaly (for example, an increase in the number of mobile terminals) occurred in the regional grid around xxx station, and are obtained from the post management server 3 of the business operator.

Next, each post included in these post groups or the post group is subjected to post-topic linking processing, and a topic (topic information) that is inferred to be related to the post (group) is assigned. There is. In the example of FIG. 2, the topic "train delay" is assigned to the acquired post.

The following (a) to (f) are examples of post-topic linking processing that enables such topic information to be added.
(a) Preparing a word dictionary in which words are associated with each topic in advance, extracting words appearing at a frequency equal to or higher than a predetermined frequency in the obtained post group, and extracting the topic associated with the word Topic to be assigned.
(b) Preparing a hash tag dictionary in which hashtags are associated with each topic in advance, extracting hashtags attached with a frequency equal to or higher than a predetermined frequency in the acquired post group, The topic is the topic to be assigned.
(c) Using a large-scale corpus, build a topic model such as LDA (Latent Dirichlet Allocation) or DTM (Dynamic Topic Model) that infers topics from posts, and input the acquired posts into the topic model. to output the topic to be assigned.
(d) Different from (c) above, all posts posted in a certain time slot (for example, a predetermined hour) are created by building a topic model in advance that estimates the topic composition ratio from the combined system of multiple posts. are combined and input to the topic model, and based on the output topic composition ratio, a topic having a composition ratio equal to or greater than a predetermined composition ratio or the maximum composition ratio is set as a topic to be assigned.

(e) Using a large-scale corpus, build and acquire a neural network (NN) topic model that estimates topics from posts vectorized by word vectorization means such as word2vec, doc2vec, and fastText. The posted post is input to the NN topic model, and the topic to be assigned is output. Here, it is also preferable that the correct topic in the learning data is the label assigned to the post, and the output layer of the NN topic model is set to a layer having the same number of neurons as all the labels used for the correct answer.
(f) When estimating a topic without prior learning (when setting a model by unsupervised learning), build a topic model with a group of posts actually posted, for example, the word "train" and the word "delay" Topic related to posts that include both is set to "train delay"", identify the topic of each post, and assign a topic with a predetermined composition ratio or more or the maximum. It can be a topic.

[Autoencoder configuration, model configuration]
The configuration of the autoencoder and the abnormality/change estimation model according to the present invention will be described in detail below.

Also according to FIG. 1, the fully coupled autoencoder 11F includes:
It consists of a fully-connected neural network algorithm consisting of three layers: (a) an input layer, (b) an intermediate layer, and (c) an output layer. The encoder is capable of extracting the feature quantity of the data from the obtained intermediate layer (b). Incidentally, in FIG. 1, the intermediate layer (b) is composed of one layer as an easy-to-understand aspect, but it is, of course, not limited to this. This intermediate layer may be composed of a plurality of layers, one of which may be set as a layer for extracting the "combined feature amount".

Specifically, in this embodiment, the fully-connected autoencoder 11F, for each of the above (a) input layer and above (c) output layer,
(a) “Event time-series data”, which in Figure 1 is demographic time-series data,
(b) The same "consolidated data" that connects multiple "posted time-series data", such as "watching sports" time-series data, "live" time-series data, "train delay" time-series data in Fig. 1, ... Supervised learning is performed using the "group", and feature quantity extraction processing is performed to extract the "composite feature quantity" as the quantity that characterizes the "connected data group" from the intermediate layer of (b) above.

Here, "event time-series data" is, for example, multi-dimensional data of "quantity related to events" for each unit time (for example, every 15 minutes) during a predetermined data collection period (for example, one day) in the target regional mesh ( For example, it can be 96 (=24×60/15) dimensional data). Here, the "quantity related to the event" may be, for example, the number of (users of) mobile terminals in the case of demographic time-series data.

On the other hand, "post time-series data" is, for example, multi-dimensional data (e.g., 24 (=24 × 60/60) dimensional data). Here, the "quantity of posts" may be the number of posts (for each linked topic), or it may be a post appearance probability value. can be adopted as the “quantity related to posting”. Also, the “amount related to posting” of each “posted time-series data” can be standardized (for example, to a value between 0 and 1). Of course, it is also possible to leave the scale information of the collected post-related data as it is without standardization.

Furthermore, it is more preferable that the data collection period for "event time-series data" and the multiple data collection periods for "post time-series data" for each of multiple topics are all the same period, and at least most of them are It is preferable to set it as the period which overlaps. For example, it is preferable to set the data collection period for both "event time-series data" and multiple "posted time-series data" to be the same day (for example, one day on December 1, 2019). As a result, both time-series data can be synchronized, and it is also possible to reflect a realistic correlation in the temporal change of both time-series data in the generated "synthetic feature amount".

Also, the unit time (divided time slot) may be different between the "event time-series data" and the "posted time-series data". For example, there are cases where it is preferable to set the unit time related to "posted time-series data" to a longer time than the unit time related to "event time-series data" due to circumstances such as restrictions on API requests. On the other hand, it is preferable to align the same unit time (for example, one hour) among the "post time-series data" for each of a plurality of topics.

In this way, by aligning the data collection period and unit time, for example, changes in demographics time-series data in a single day when an event of "watching sports" occurred, and the excitement of posts related to the topic "watching sports" It is possible to learn the correlation with the transition of the condition on the same day by including it in the synthetic feature value. It is expected that it will be possible to estimate demographic anomalies due to "watching".

Furthermore, the above-mentioned "connected data group" used for each of the above (a) input layer and the above (c) output layer is, for example, the "event time series data" is 96-dimensional data, and the topic If the number is 5 and each piece of "posted time-series data" is 24-dimensional data, it becomes 216 (=96+5*24)-dimensional data. In this case, the number of neurons in each of the input layer (a) and the output layer (c) can also be 216, the same number. Of course, the number of neurons in the intermediate layer (b) above (the number of dimensions as a synthetic feature amount) is set to a number less than 216, for example, 54.

Here, as a modification mode, the target event is an event related to a predetermined regional mesh, and the POI (for example, event venue) as a point that can be related to the abnormality or change of the event within a predetermined range including the regional mesh When there are one or more of In addition to series data,
(C) Information (e.g., distance) regarding the degree of separation between (e.g., the center of) the relevant regional mesh and (each) POI, and (D) (Each) POI type information (e.g., previously classified and set Categories of (each) POI such as "event venue" or "multipurpose ground" etc.)
It is also preferable to use data in which either one or both of the above are linked.

As a result, information related to POIs related to abnormalities and changes in the event can be included in the "combined feature amount", and it is possible to carry out more accurate estimation processing after taking into account the existence of POIs. Become. For example, the distance degree information (c) above can be considered as an index indicating the degree of influence of the POI on the estimation result, and the type information (d) above is the type of event that causes demographic anomaly, for example. is likely to be limited by the POI category, it is also preferable to reflect both of them in the "synthetic feature".

As a further modification, the above-mentioned "connected data group" is, in addition to the above (a) the "event time series data" and the above (b) a plurality of "posted time series data", or in addition to the above (C) and / or for those with the above (D) added,
(e) The degree of divergence (e.g., difference, deviation, etc.) from the statistical value of the number of posts in a predetermined period (e.g., one day) (e.g., the average number of posts per day for one year);
(f) attribute information of the poster of the acquired post (e.g., gender, age group, etc.); )
It is also preferable to use concatenated data of at least one of.

Here, the degree of divergence in (e) above is considered to be larger than usual when an abnormality occurs in the event, and incorporating it into the feature value is effective in improving the accuracy of abnormality estimation. can be.

In addition, the attribute information in (f) above is based on the fact that, for example, young people tend to participate in certain live performances, and men tend to participate more easily in spectating sports. On the other hand, it is fully conceivable that the attribute will have an effect depending on the cause or factor, and incorporating it into the feature amount can also contribute to the improvement of the estimation accuracy. It should be noted that the attribute information of the poster can be estimated from the posted text, for example, by analyzing the posted text using a known analysis method such as machine learning.

In addition, the attached data information in (g) above can be related to the content of the post and the linked topic, for example, the attached information such as an image, and can be incorporated into the feature amount. , can be effective in improving the accuracy of anomaly estimation. Note that the image feature amount as information related to the attached data can be calculated using a known object detection algorithm such as YOLO (You Look Only Once) using CNN (Convolutional Neural Networks).

Similarly, according to FIG. 1, the abnormality/change estimation model 12 is composed of a multi-layer DNN (Deep Neural Networks) algorithm consisting of an input layer, a hidden layer, and an output layer, and is generated by a fully connected autoencoder 11F. It is an estimator that uses the obtained "combined feature amount" in the input layer and outputs "information related to abnormality/change" in the event as each neuron value in the output layer.

Of course, the abnormality/change estimation model 12 can be constructed by various other machine learning algorithms as long as the "synthetic feature value" can be input. In order to carry out cause/factor estimation all at once, a suitable DNN is adopted. Specifically, as one preferred mode, a DNN algorithm is used in which the output of the output layer is a One-Hot vector.

That is, the output of the output layer in this embodiment is as shown in FIG.
"No problem""Watchingsports""Live""Traindelay" ・・・
(0, 1, 0, 0, ...)
becomes. In this case, the number of dimensions (the number of neurons in the output layer) of this output (one-hot vector) is (the number of topics of cause/factor candidates)+1.

Here, in constructing the abnormality/change estimation model 12, it is possible to use learning data created by, for example, manually assigning a label indicating the cause/factor of an abnormality/change to the generated synthetic feature quantity. good. Here, for example, the topic determined during the post-topic linking process described above can be adopted as the label to be assigned. Moreover, it is also preferable to employ the above-described "no abnormality" label in order to detect an abnormality/change and estimate the cause/factor of the abnormality at once.

As a matter of course, the abnormality/change estimation model 12 may be a model that outputs other "information related to abnormality/change". For example, the likelihood for each item (for example, the topic described above) set in advance as the cause/factor of anomaly/change may be output, or one cause/factor with the highest likelihood (for example, one topic).

In addition, as a mode of changing the topic setting, multiple topics (topic information) related to each posted time-series data (further as a label for building the anomaly/change estimation model 12) are changed to one related to attribute information of the poster. It may also contain a set of scopes and one topic type. For example, as multiple topics ・"(More than 50% of the contributors are women) Live A",
・ “(More than 50% of contributors are men) Live B”,
・ "(Posters are over 50% young (for example, under the age of 34) watching sports A",
・"Sports Watching B",
·"train delay",···
may be set. As a result, it is possible to obtain more detailed information related to the attributes of the presumed cause/factor.

FIG. 3 is a schematic diagram for explaining another embodiment of the autoencoder according to the present invention.

So far, the fully-connected autoencoder 11F (FIG. 1) has been described as a means for generating the "synthetic feature". It is also possible to adopt

According to FIG. 3, in the RNN autoencoder 11R (and the LSTM autoencoder 11L), similarly to the fully coupled autoencoder 11F, a "concatenated data group" in which event time-series data and a plurality of posted time-series data are connected is input. As a layer, learning is performed so that the output layer at that time is the same as the "connected data group", and a process of extracting a synthetic feature amount from the resulting "intermediate layer" is performed.

However, in the RNN autoencoder 11R (and the LSTM autoencoder 11L), unlike the fully coupled autoencoder 11F, every unit time (for example, every 15 minutes) in a predetermined period (for example, one day), the "connected An "intermediate layer" consisting of a plurality of neurons that determine their own neuron values by taking in neuron values from a plurality of neurons corresponding to the unit time in the "data group" is sequentially generated.

More specifically, if the unit time set in the "consolidated data group" (event time-series data and multiple post time-series data) is Ti ( _i = 1, 2, ..., n), Each neuron in the hidden layer generated for unit time T _j+1 (j=1, 2, . . . , n-1) is
(a) neuron values from a plurality of neurons corresponding to unit time T _j+1 in the "connected data group" as the input layer;
(b) Determining its own neuron value based on the weighted linear sum of the neuron values of the corresponding neurons in the intermediate layer of the previous unit time T _j .

That is, in the RNN autoencoder 11R (and the LSTM autoencoder 11L), the "intermediate layer" of a certain unit time is recursively generated considering the output of the previous (past) "intermediate layer" of. Here, the finally generated "intermediate layer"("intermediatelayer" of unit time _Tn ) is extracted and output as a composite feature amount.

Note that the LSTM autoencoder 11L, in the RNN autoencoder 11R,
(a) Forget gates to control retention/forget aging in each element stored in memory cells located in the "middle tier" and (b) input and output gates to avoid conflicting weight updates. is further provided, and it is an encoder that can realize long-term dependencies, such as generating a new "intermediate layer" by reflecting the information of the "intermediate layer" in the distant past. .

Using such RNN autoencoder 11R and LSTM autoencoder 11L, continuous time change information (in relation to past data) in feature extraction target data (event time series data and multiple posted time series data) Such information) is also reflected in the synthetic feature quantity, basically, it becomes possible to more accurately estimate abnormalities and changes that occur over time.

By the way, the RNN autoencoder 11R and the LSTM autoencoder 11L input "concatenated data group", in addition to the event time series data and multiple post time series data, as described above (c) to (g). It may also be set to handle a concatenated piece of information, and output the combined feature amount.

4A and 4B are schematic diagrams for explaining another embodiment of the process of generating a combined feature amount according to the present invention.

So far, as the data to be input to the autoencoder (11F, 11R or 11L) when generating the "synthetic feature amount", the "connected data group" consisting of the entire event time-series data and multiple posted time-series data is used. form has been described.

On the other hand, as shown in FIG. 4, in this embodiment,
(a) generating a plurality of sets (“event/post concatenated pairs”) that are concatenated sets of event time-series data and each of a plurality of post time-series data;
(b) Each of the generated "event/post linked pairs" is subjected to feature synthesis processing by an individually prepared autoencoder (11F, 11R or 11L) to generate a plurality of "synthetic feature amount portions". ,
(c) A "composite feature amount" is generated by connecting a plurality of generated "feature amount portions".

In this way, by first generating a plurality of "synthetic feature amount portions" from a plurality of "event/post linked pairs", each "synthetic feature amount portion" can store changes in event time-series data and one post It is possible to directly reflect the correlation with the temporal change of the time-series data. As a result, by using the "synthetic feature value" generated later, it is possible to more accurately estimate anomalies and changes that have a strong influence on the degree of correlation, as well as their causes and factors. It becomes possible.

Incidentally, also in this embodiment, at least one or all of the plurality of "event/post linked pairs" are, in addition to the event time-series data and the plurality of post time-series data, the above (c) to ( It is also possible to concatenate information such as g).

For example, depending on the topic or contributor of the time-series data that constitutes the "event/post linked pair", the circumstances of whether or not the above information (c) to (g) can be collected may differ. exist. Therefore, it is also possible to incorporate information such as the above (c) to (g) only for "event/post linked pairs" related to post time-series data that can be collected in this way.

[Abnormality/change estimation device, abnormality/change estimation program]
Hereinafter, returning to FIG. 1, the autoencoder (11F, 11R or 11L) as described above and the abnormality/change estimation model 12 are installed, and the presence or absence of abnormality/change occurrence in a predetermined event and An abnormality/change estimating device 2 capable of outputting information on the cause/factor of an abnormality/change that has occurred as an estimation result will be described.

As shown in FIG. 1 , the abnormality/change estimation device 2 includes an input unit 21 , a feature amount/model generation unit 22 , an abnormality/change determination unit 23 , and an output unit 24 . Of these, the feature quantity/model generation unit 22 and the abnormality/change determination unit 23 are main parts for implementing an embodiment of the abnormality/change estimation method according to the present invention. can also be viewed as a function of a processor memory that stores an embodiment of .

For this reason, the abnormality/change estimating device 2 may be a dedicated device for estimating anomalies/changes.・It can be a computer (PC), a notebook or tablet computer, or a smart phone.

Similarly, in FIG. 1, the input unit 21 of the abnormality/change estimation device 2 has a communication function, and for example, a server installed outside (for example, a communication management server of a telecommunications carrier and a post management server of a networking service provider). receives information (e.g. number of mobile terminals) and information related to posts (e.g. post data) from a given event, event time-series data (e.g. demographic time-series data) and multiple posts Time-series data (for example, time-series data of the number of posts for each topic) is generated and stored in the feature quantity/model generation unit 22 .

The feature quantity/model generation unit 22
(a) Using an autoencoder (11F, 11R or 11), generate a synthetic feature value of event time-series data and a plurality of post time-series data, and use learning data with a correct label attached to the generated synthetic feature value building the change estimation model 12, providing the abnormality/change estimation model 12 to the abnormality/change determination unit 23;
(b) Similarly, using an autoencoder (11F, 11R or 11), a synthetic feature amount is generated from a concatenated data group (or an event/post concatenated pair) including the event time-series data to be estimated, and the generated synthetic feature amount is output to the abnormality/change determination unit 23 .

The anomaly/change determination unit 23 uses the received anomaly/change estimation model 12 to determine "information on the presence or absence of an anomaly/change occurrence and its cause/factor" in the event from the synthetic feature quantity also received. and output to the output unit 24 .

The output unit 24 displays the received "whether or not an abnormality or change has occurred, and information about its cause or factor" on a display, or transmits it to an external information processing device (if it has a communication function). or Here, the information to be displayed/transmitted is, for example, "On December 1, 2019, around xx:xx minutes, there was a sudden increase in the population (80% increase compared to normal) around xxx station due to train delays. It becomes information such as "occurrence".

As described in detail above, according to the present invention, not only event time-series data related to a predetermined event, but also posting time-series data related to a single topic, causes and Since the post time-series data related to multiple topic information as factor candidates is also taken in to generate the feature amount, it is possible to more accurately estimate the information related to the abnormality or change of the event based on the feature amount. It becomes possible.

In addition, the present invention can be applied to various events as long as they are events for which time-series data can be acquired and events that can fluctuate due to some cause or factor.

For example, in the case of applying demographics (discrete set of people) as the event, according to the present invention, by utilizing multiple posted time-series data, the presence or absence of abnormal demographics, ( Depending on the embodiment, it is also possible to estimate the causes/factors of the demographic anomalies that have occurred. In addition, it is believed that the present invention will greatly contribute to the accurate grasping of urban fluctuation characteristics, for example, when an event occurs, when a disaster occurs, or when an emergency is announced, and for the appropriate implementation of people flow control there. Furthermore, it is considered that the invention can contribute to the appropriate management of smart cities, which are expected to spread in various places in the future, in the event of such a situation.

For the various embodiments of the present invention described above, various changes, modifications and omissions within the spirit and scope of the present invention can be easily made by those skilled in the art. The foregoing description is exemplary only and is not intended to be limiting. The invention is to be limited only as limited by the claims and the equivalents thereof.

11F fully coupled autoencoder 11R RNN autoencoder 11L LSTM autoencoder 12 abnormality/change estimation model 2 abnormality/change estimation device 21 input unit 22 feature amount/model generation unit 23 abnormality/change determination unit 24 output unit

Claims (11)

From event time-series data related to a predetermined event and multiple posting time-series data for each of multiple posting groups related to multiple topic information that may be related to the abnormality or change of the event, the event time-series data and the relevant a step of generating a feature amount related to synthesizing or concatenating posted time-series data;
and inputting the feature amount into a built abnormality or change estimation model, and determining information related to the abnormality or change of the event based on the output from the abnormality or change estimation model. , anomaly or change estimation methods in computers. 2. The abnormality or change estimation method according to claim 1, wherein the feature amount is generated from the event time-series data and the posted time-series data using an auto-encoder. A claim characterized in that the autoencoder is a fully connected autoencoder, a recurrent neural network (RNN, Recurrent Neural Networks) autoencoder, or a long-short term memory (LSTM) autoencoder. Item 3. The abnormality or change estimation method according to Item 2. 4. The anomaly or change estimation method according to claim 2, wherein the feature amount is generated using the autoencoder from the event time-series data and the plurality of posted time-series data as a whole. generating a plurality of feature quantity portions using the autoencoder from each of a plurality of sets of each of the plurality of posted time-series data and the event time-series data; 4. The abnormality or change estimation method according to claim 2 or 3, wherein a feature amount is generated. The event is an event related to a predetermined area, and there is a point that can be related to the abnormality or change of the event within a predetermined range including the area,
The feature amount is generated using the autoencoder from the event time-series data and the posted time-series data, information on the degree of separation between the area and the point, and/or type information on the point. The abnormality or change estimation method according to any one of claims 2 to 5, characterized in that: the event time-series data and the posted time-series data;
Based on the degree of divergence from the statistical value of the number of posts in the number of posts in a predetermined period, the attribute information of the poster of the post, and/or information related to the attached data attached to the post, the auto 7. The abnormality or change estimation method according to any one of claims 2 to 6, wherein the feature amount is generated using an encoder. 8. The abnormality or according to any one of claims 1 to 7, wherein the plurality of topic information includes a set of one range and one topic type related to the attribute information of the person who posted the post. Change estimation method. Information relating to anomalies or changes in the event includes information relating to whether anomalies or changes have occurred in the event, and/or topic information presumed to be related to the anomaly or changes that occurred in the event. The abnormality or change estimation method according to any one of claims 1 to 8, characterized in that: From event time-series data related to a predetermined event and multiple posting time-series data for each of multiple posting groups related to multiple topic information that may be related to the abnormality or change of the event, the event time-series data and the relevant a feature quantity generating means for generating a feature quantity relating to synthesizing or concatenating posted time-series data;
A computer is used as an anomaly or change information determination means for inputting the feature quantity into a built anomaly or change estimation model and determining information related to the anomaly or change of the event based on the output from the anomaly or change estimation model. Abnormality or change estimation program characterized by functioning. From event time-series data related to a predetermined event and multiple posting time-series data for each of multiple posting groups related to multiple topic information that may be related to the abnormality or change of the event, the event time-series data and the relevant a feature quantity generating means for generating a feature quantity relating to synthesizing or concatenating posted time-series data;
an abnormality or change information determining means for inputting the feature quantity into a constructed abnormality or change estimation model and determining information related to the abnormality or change of the event based on the output from the abnormality or change estimation model; Abnormality or change estimating device characterized by:

Images