Anomaly determination apparatus, anomaly determination method, and non-transitory computer readable medium storing program

1. An anomaly determination apparatus comprising:

at least one memory storing program instructions; and

at least one processor configured to execute the instructions stored in the memory to train a neural network for detecting an anomaly in a system by:

acquiring a sample of an abnormality level of a signal output from a determination target-apparatus while the determination-target apparatus is performing a predetermined process, the signal being at least one of a sound waveform, an oscillatory waveform, a current waveform, a voltage waveform, communication traffic, or log data,

performing a transformation process using a transform function for transforming the anomaly level of the signal into a probability variable value, the probability variable value being a variable value in accordance with a predetermined probability distribution,

determining presence/absence of an anomaly of the sample of the anomaly level by using a result of the transformation by the transformation process; and

determining whether or not an abnormality has occurred in the predetermined process performed by the determination-target apparatus by using a result of the determination of presence/absence of the anomaly of the sample of the anomaly level, wherein

the transform function is a monotone function, and

the presence/absence of an anomaly is determined by comparing a result of the transformation obtained by applying an inverse function of the transform function to a predetermined threshold with the sample.

2. The anomaly determination apparatus according to claim 1 , wherein

the probability distribution is a uniform distribution, and

the threshold is a probability that the signal contains an anomaly or a probability that the signal does not contain an anomaly.

3. The anomaly determination apparatus according to claim 1 , the processor is further configured to execute the instructions to generate a parameter representing the transform function.

4. The anomaly determination apparatus according to claim 3 , wherein

the processor is further configured to execute the instructions to:

generate, as the parameter, an ordering relation when the plurality of samples of anomaly levels are arranged in a descending order or an ascending order, and

calculate the probability variable value by calculating an order of anomaly levels to be transformed based on the ordering relation.

5. The anomaly determination apparatus according to claim 4 , wherein the processor is further configured to execute the instructions to calculate the probability variable value by correcting a discrete order into a continuous order.

6. The anomaly determination apparatus according to claim 4 , wherein the processor is further configured to execute the instructions to calculate the probability variable value by applying an inverse function of a predetermined cumulative distribution function to the order.

7. The anomaly determination apparatus according to claim 1 , wherein the anomaly level is a likelihood function of the distribution of the signal.

8. The anomaly determination apparatus according to claim 3 , wherein

the anomaly level is a likelihood function of the distribution of the signal, and

the processor is further configured to execute the instructions to generate the transform function by estimating the distribution of the signal and specifying the transform function by using a parameter of the estimated distribution of the signal.

9. The anomaly determination apparatus according to claim 8 , wherein the processor is further configured to execute the instructions to estimate the distribution of the signal by maximum likelihood estimation or an EM algorithm.

10. The anomaly determination apparatus according to claim 8 , wherein the processor is further configured to execute the instructions to:

create a plurality of samples of signals from the estimated distribution of the signal by using a random number,

calculate the anomaly level of each of the plurality of samples of signals,

generate, as the parameter, an ordering relation when the plurality of calculated anomaly levels are arranged in a descending order or an ascending order, and

calculate the probability variable value by calculating an order of anomaly levels to be transformed based on the ordering relation.

11. The anomaly determination apparatus according to claim 8 , wherein

the distribution of the signal is a mixture distribution, and

the processor is further configured to execute the instructions to generate the transform function by specifying the transform function by using a parameter of the estimated distribution of the signal, the transform function being an approximate function.

12. A method comprising:

training a neural network for detecting an anomaly in a system by:

acquiring a sample of an abnormality level of a signal output from a determination-target apparatus while the determination-target apparatus is performing a predetermined process, the signal being at least one of a sound waveform, an oscillatory waveform, a current waveform, a voltage waveform, communication traffic, or log data,

performing a transformation process using a transform function for transforming the anomaly level of the signal into a probability variable value, the probability variable value being a variable value in accordance with a predetermined probability distribution, determining presence/absence of an anomaly of the sample of the anomaly level by using a result of the transformation by the transformation process; and

determining whether or not an abnormality has occurred in the predetermined process performed by the determination-target apparatus by using a result of the

determination of presence/absence of the anomaly of the sample of the anomaly level,

wherein the transform function is a monotone function, and

the presence/absence of an anomaly is determined by comparing a result of the transformation obtained by applying an inverse function of the transform function to a predetermined threshold with the sample.

13. A non-transitory computer readable medium storing a program for causing a computer to perform:

a training operation for training a neural network for detecting an anomaly in a system

of acquiring a sample of an abnormality level of a signal output from a determination-target apparatus while the determination-target apparatus is performing a predetermined process, the signal being at least one of a sound waveform, an oscillatory waveform, a current waveform, a voltage waveform, communication traffic, or log data,

performing a transformation process using a transform function for transforming the anomaly level of the signal into a probability variable value, the probability variable value being a variable value in accordance with a predetermined probability distribution,

determining presence/absence of an anomaly of the sample of the anomaly level by using a result of the transformation by the transformation step; and

determining whether or not an abnormality has occurred in the predetermined process performed by the determination-target apparatus by using a result of the determination of presence/absence of the anomaly of the sample of the anomaly level,

wherein the transform function is a monotone function, and

the presence/absence of an anomaly is determined by comparing a result of the transformation obtained by applying an inverse function of the transform function to a predetermined threshold with the sample.