Anomaly detection method, system, and program
The present invention provides an anomaly detection method, an anomaly detection system, and an anomaly detection program that can detect an anomaly at high accuracy by using log output quantity distributions generated for to different aggregate units and different devices. An anomaly detection system according to one example embodiment of the present invention has: a reference distribution, which is a time-series distribution of a log output quantity acquisition unit that acquires a plurality of distributions generated for each device that outputs logs and for each unit of a time range in which logs are aggregated; and an anomaly detection unit that detects an anomaly by using the plurality of distributions.
1. An anomaly detection method comprising:
acquiring a plurality of reference data including a number of log outputs of different devices with respect to different aggregate units;
acquiring target data including a number of log outputs of a target device with respect to a first aggregate unit included in the different aggregate units;
determining a first reference data, among the plurality of reference data, based on similarity between the target data and each of the plurality of reference data; and
detecting that the target device has an anomaly based on the first reference data and the target data.
2. The anomaly detection method according to claim 1 , wherein
the plurality of reference data is in various time ranges.
3. The anomaly detection method according to claim 1 , wherein
an anomaly degree is calculated based on the first reference data and the target data, and
the target device is detected as having the anomaly when the anomaly degree is higher than a predetermined threshold.
4. The anomaly detection method according to claim 1 , wherein
the target data include time-series distribution of number of log outputs.
5. The anomaly detection method according to claim 1 , wherein
the similarity is related to a correlation coefficient.
6. The anomaly detection method according to claim 1 , wherein
the deciding is performed based on a correlation coefficient.
7. The anomaly detection method according to claim 1 , wherein
each of the plurality of reference data is a time-series distribution of an output quantity generated based on a rule of aggregating previously output logs according to a predetermined time range.
8. The anomaly detection method according to claim 1 further comprising
displaying a notification indicating that the anomaly is detected.
9. An anomaly detection system comprising:
a memory storing one or more instructions; and
one or more processors configured to execute the one or more instructions to:
acquire a plurality of reference data including a number of log outputs of different devices with respect to different aggregate units;
acquire target data including a number of log outputs of a target device with respect to a first aggregate unit included in the different aggregate units;
determine a first reference data, among the plurality of reference data, based on similarity between the target data and each of the plurality of reference data; and
detect that the target device has an anomaly based on the first reference data and the target data.
10. The anomaly detection system according to claim 9 , wherein
the plurality of reference data is in various time ranges.
11. The anomaly detection system according to claim 9 , wherein
an anomaly degree is calculated based on the first reference data and the target data, and
the one or more processors detect that the target device has the anomaly when the anomaly degree is higher than a predetermined threshold.
12. The anomaly detection system according to claim 9 , wherein
the target data include time-series distribution of number of log outputs.
13. The anomaly detection system according to claim 9 , wherein
the similarity is related to a correlation coefficient.
14. The anomaly detection system according to claim 9 , wherein
the detection is performed based on a correlation coefficient.
15. The anomaly detection system according to claim 9 , wherein
each of the plurality of reference data is a time-series distribution of an output quantity generated based on a rule of aggregating previously output logs according to a predetermined time range.
16. The anomaly detection system according to claim 9 , wherein the one or more processors is further configured to execute the one or more instructions to:
display a notification indicating that the anomaly is detected.
17. A non-transitory computer-readable storage medium in which an anomaly detection program is stored, the anomaly detection program causing a computer to:
acquire a plurality of reference data including a number of log outputs of different devices with respect to different aggregate units;
acquire target data including a number of log outputs of a target device with respect to a first aggregate unit included in the different aggregate units;
determine a first reference data, among the plurality of reference data, based on similarity between the target data and each of the plurality of reference data; and
detect that the target device has an anomaly based on the first reference data and the target data.
18. The non-transitory computer-readable storage medium according to claim 17 , wherein
each of the plurality of reference data is a time-series distribution of an output quantity generated based on a rule of aggregating previously output logs according to a predetermined time range.
19. The non-transitory computer-readable storage medium according to claim 17 , wherein the anomaly detection program further causes a computer to:
display a notification indicating that the anomaly is detected.