APPARATUS, METHOD, AND NON-TRANSITORY COMPUTER-READABLE MEDIUM FOR ANOMALY DETECTION
An anomaly detection apparatus executes prediction processing to predict fluctuations of a normal range for a value of a parameter in a specified period, correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted normal range, correct the upper limit values of the normal range, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected normal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified, and anomaly detection processing to acquire a value of the parameter in the specified period, determine whether the value of the parameter acquired falls within the corrected normal range, and output predetermined information when determining that the value of the parameter acquired does not fall within the corrected normal range.
1 . An anomaly detection apparatus comprising a processing device configured to execute
prediction processing to predict fluctuations of a normal range for a value of a parameter in a specified period,
correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted noimal range, correct the upper limit values of the normal range based on the upper limit value at the local maximum point identified, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected noimal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified, and
anomaly detection processing to acquire a value of the parameter in the specified period, determine whether the value of the parameter acquired falls within the corrected normal range, and output predetermined information when determining that the value of the parameter acquired does not fall within the corrected noimal range.
2 . The anomaly detection apparatus according to claim 1 , comprising a storage device configured to store a prediction model that takes a period for the parameter as an input value and gives a normal range for a value of the parameter in the period as an output value, wherein
the processing device predicts the fluctuations of the normal range for a value of the parameter in the period by inputting information on the specified period into the prediction model.
3 . The anomaly detection apparatus according to claim 2 , wherein
the processing device updates the prediction model based on the acquired value of the parameter in the specified period.
4 . The anomaly detection apparatus according to claim 1 , wherein
the processing device determines whether there was an anomaly in a value of the parameter before the specified period, and executes the correction processing only when determining that there was an anomaly in the value of the parameter.
5 . The anomaly detection apparatus according to claim 4 , wherein
the processing device determines whether there was an anomaly in the value of the parameter before the specified period by determining whether a value of the parameter at a time before the specified period exceeds a threshold, whether the value of the parameter stays above a threshold continuously for a predetermined period or longer, or whether a difference between the value of the parameter and a threshold exceeds a predetermined value at the time.
6 . The anomaly detection apparatus according to claim 1 , wherein
in the correction processing, the processing device executes first correction processing to identify upper limit values at two local maximum points adjacent to each other in a predetermined time period from the fluctuating upper limit values of the predicted normal range, calculate values in between the identified two local maximum points by performing linear interpolation between the two local maximum points, and correct the upper limit values of the normal range in between the two local maximum points based on the calculated values.
7 . The anomaly detection apparatus according to claim 6 , wherein
after the first correction processing, the processing device executes second correction processing to identify upper limit values at two local minimum points adjacent to each other in a predetermined time period from the fluctuating upper limit values of the normal range identified based on the calculated values and the upper limit values at the identified local maximum points in the normal range, calculate values in between the identified two local minimum points by performing linear interpolation between the two local minimum points, and correct the upper limit values of the normal range in between the two local minimum points based on the calculated values.
8 . The anomaly detection apparatus according to claim 7 , wherein
in the correction processing, the processing device determines whether fluctuation of the upper limit values of the calculated noimal range was reduced, and executes the second correction processing only when deteimining that the fluctuation of the upper limit values was reduced.
9 . An anomaly detection method implemented by an information processing apparatus, comprising executing
prediction processing to predict fluctuations of a noimal range for a value of a parameter in a specified period,
correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted noimal range, correct the upper limit values of the noimal range based on the upper limit value at the local maximum point identified, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected noimal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified, and
anomaly detection processing to acquire a value of the parameter in the specified period, determine whether the value of the parameter acquired falls within the corrected noimal range, and output predetermined information when deteimining that the value of the parameter acquired does not fall within the corrected noimal range.
10 . A non-transitory computer-readable medium recording an anomaly detection program that causes an information processing apparatus to execute
prediction processing to predict fluctuations of a normal range for a value of a parameter in a specified period,
correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted normal range, correct the upper limit values of the normal range based on the upper limit value at the local maximum point identified, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected normal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified, and
anomaly detection processing to acquire a value of the parameter in the specified period, determine whether the value of the parameter acquired falls within the corrected normal range, and output predetermined information when determining that the value of the parameter acquired does not fall within the corrected normal range.