Apparatus and method for estimating anomaly information, and program

An apparatus for estimating anomaly information comprising:

• processing circuitry configured to
• input anomaly data detected as an anomaly by an anomaly detecting algorithm that outputs an anomaly degree of input data for vectors, using learning of the vectors in a normal state, the anomaly degree indicating an extent to which an anomaly of the input data occurs, and the inputted anomaly data is detected as data observed over a network;
• search for one or more first vectors that decrease the anomaly degree when added to the anomaly data, taking into account a likelihood, for each dimension, of a given dimension being the cause of the anomaly;
• and
• output the cause of the anomaly by using the first vectors and one or more second vectors, the second vectors being of a plurality of vectors of which causes of anomalies are known and being searched in a same manner as the first vectors.

A method for estimating anomaly information comprising:

• inputting anomaly data detected as an anomaly by an anomaly detecting algorithm that outputs an anomaly degree of input data for vectors, using learning of the vectors in a normal state, the anomaly degree indicating an extent to which an anomaly of the input data occurs, and the inputted anomaly data is detected as data observed over a network;
• searching for one or more first vectors that decrease the anomaly degree when added to the anomaly data, taking into account a likelihood, for each dimension, of a given dimension being a cause of the anomaly;
• and
• outputting the cause of the anomaly by using the first vectors and one or more second vectors, the second vectors being of a plurality of vectors of which causes of anomalies are known and being searched in a same manner as the first vectors.