Storage medium storing anomaly detection program, anomaly detection method, and anomaly detection apparatus

An anomaly detection method performed by a computer, the method comprising steps of:

• generating, based on first log data having values of a first item and values of a second item regarding a movement of a moving object, a regression function according to k-nearest-neighbor crossover kernel regression, the regression function being configured to derive an estimation value for a value of the second item from a value of the first item;
• determining a standard to calculate a specified threshold regarding the estimation value from the value of the first item, based on a confidence-interval width of the estimation value and the regression function for each value of the first item;
• and
• judging whether the moving object has an anomaly, based on whether a difference between an estimation value of the second item and an actually measured value of the second item is smaller than or equal to a threshold calculated from the value of the first item based on the standard, the estimation value of the second item having been derived by the regression function from a value of the first item in second log data having values of the first item and values of the second item, the actually measured value of the second item being included in the second log data.

An anomaly detection apparatus comprising:

• a memory, and
• a processor coupled to the memory and configured to:
• generate, based on first log data having values of a first item and values of a second item regarding a movement of a moving object, a regression function according to k-nearest-neighbor crossover kernel regression, the regression function being configured to derive an estimation value for a value of the second item from a value of the first item;
• determine a standard to calculate a specified threshold regarding the estimation value from the value of the first item, based on a confidence-interval width of the estimation value and the regression function for each value of the first item;
• and
• judge whether the moving object has an anomaly, based on whether a difference between an estimation value of the second item and an actually measured value of the second item is smaller than or equal to a threshold calculated from the value of the first item based on the standard, the estimation value of the second item having been derived by the regression function from a value of the first item in second log data having values of the first item and values of the second item, the actually measured value of the second item being included in the second log data.