ANOMALY DETECTION APPARATUS, ANOMALY DETECTION METHOD AND PROGRAM
An anomaly detection apparatus includes an approximation unit configured to generate, based on observed data, an approximation of a Perron-Frobenius operator on an RKHS that represents a mathematical model to generate the observed data; and a detection unit configured to use the approximation of the Perron-Frobenius operator and an observed data item at time t, to predict a data item at time t+1, and based on a discrepancy between the predicted data item and an observed data item at time t+1, to determine whether the observed data item at time t+1 is anomalous.
1 . An anomaly detection apparatus comprising:
a memory; and
a processor configured to execute
generating, based on observed data, an approximation of a Perron-Frobenius operator on a reproducing kernel Hilbert space (RKHS) that represents a mathematical model to generate the observed data; and
using the approximation of the Perron-Frobenius operator and an observed data item at time t, to predict a data item at time t+1, and based on a discrepancy between the predicted data item and an observed data item at time t+1, to determine whether the observed data item at time t+1 is anomalous.
2 . The anomaly detection apparatus as claimed in claim 1 , wherein the generating uses the approximation of the Perron-Frobenius operator to calculate an index of a dispersion level of predictions with respect observed data items, and
wherein the using uses a threshold value according to the index of the dispersion level, to determine whether the observed data item is anomalous.
3 . The anomaly detection apparatus as claimed in claim 2 , wherein the index of the dispersion level is a magnitude of the predictions in the RKHS obtained by using the approximation of the Perron-Frobenius operator.
4 . The anomaly detection apparatus as claimed in claim 1 , wherein the generating partitions the observed data into S sets of data sets, to generate the approximation of the Perron-Frobenius operator restricted to an S-dimensional space by an orthogonalization operation from the S sets of the data sets.
5 . The anomaly detection apparatus as claimed in claim 4 , wherein the generating generates the approximation of the Perron-Frobenius operator by a Shift-invert Arnoldi method.
6 . An anomaly detection method executed by an anomaly detection apparatus including a memory and a processor, the method comprising:
generating, based on observed data, an approximation of a Perron-Frobenius operator on a reproducing kernel Hilbert space (RKHS) that represents a mathematical model to generate the observed data; and
using the approximation of the Perron-Frobenius operator and an observed data item at time t, to predict a data item at time t+1, and based on a discrepancy between the predicted data item and an observed data item at time t+1, to determine whether the observed data item at time t+1 is anomalous.
7 . A non-transitory computer-readable recording medium having computer-readable instructions stored thereon, which when executed, cause a computer including a memory and a processor to execute respective operations of the anomaly detection apparatus as claimed in claim 1 .