Anomaly detection method and recording medium

A recording medium storing a program that causes a device including a processor to execute a process, the recording medium being nonvolatile and computer-readable, the process comprising:

• (a1) obtaining first data which is normal data, the normal data being data that is determined to be normal by a neural network;
• (a2) generating second data by adding normal noise to the first data by using a method predetermined in accordance with a kind of the first data, the second data being data that is determined to be normal by the neural network;
• (a3) generating third data by adding abnormal noise to the first data by using a method predetermined in accordance with the kind of the first data, the third data being data that is determined to be abnormal by the neural network;
• (a4) inputting the first data, the second data, and the third data to the neural network and calculating a first normal score, a second normal score, and a third normal score, each of the first normal score, the second normal score, and the third normal score being a value indicating how much a corresponding one of the first data, the second data, and the third data input to the neural network is likely to be normal data;
• (a5) calculating a first difference that is based on a difference between the first normal score and the second normal score, calculating a second difference that is based on a difference between the first normal score and the third normal score, and calculating a third difference that is based on a difference between the first difference and the second difference;
• (a6) calculating parameters of the neural network, the parameters making the third difference smallest;
• (a7) changing the neural network by using the parameters that have been calculated;
• and
• (a8) obtaining fourth data from a test database storing data that is unknown in terms of whether the data is normal or abnormal, inputting the fourth data to the neural network that has been changed, calculating a fourth normal score, and determining, based on the fourth normal score, whether the fourth data is normal or abnormal.

An anomaly detection method comprising:

• (a1) obtaining first data, a neural network calculating a score equal to or more than a threshold value using the first data as an input to the neural network and parameters of the neural network;
• (a2) generating second data by adding normal noise to the first data using a method predetermined in accordance with a kind of the first data, the neural network calculating a score equal to or more than the threshold value using the second data as an input to the neural network and the parameters;
• (a3) generating third data by adding abnormal noise to the first data using a method predetermined in accordance with the kind of the first data, the neural network calculating a score less than the threshold value using the third data as an input to the neural network and the parameters;
• (a4) determining i-th parameters of the neural network corresponding to a minimum resulting value from among a first resulting value, . . . , and an n-th resulting value,
• the first resulting value, . . . and the n-th resulting value and first parameters of the neural network, . . . , and n-th parameters of the neural network being in a one-to-one relationship,
• a j-th resulting value being calculated based on a first difference and a second difference,
• the first difference being calculated based on a first score and a second score,
• the second difference being calculated based on the first score and a third score,
• the first score being calculated by the neural network using the first data as an input to the neural network and j-th parameters of the neural network,
• the second score being calculated by the neural network using the second data as an input to the neural network and the j-th parameters,
• the third score being calculated by the neural network using the third data as an input to the neural network and the j-th parameters, n, i, and j being natural numbers, n≥2, i≤n, and j≤n;
• and
• (a5) detecting whether fourth data is normal or abnormal based on a fourth score, the neural network calculating the fourth score using the fourth data as an input to the neural network and the i-th parameters.