Detection of abnormal behavior using probabilistic distribution estimation

A probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model having a continuous time distribution and hidden variables, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising:

• a parameter storage unit for storing all of parameters for the time series model having the continuous time distribution and the hidden variables;
• certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit;
• parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said time series model from said parameter storage unit, and
• outputting means for outputting several parameters of said time series model stored in said parameter storage unit.

A probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Macrov models each having a continuous time distribution, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising:

• a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having the continuous distribution;
• certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Macrov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and
• outputting means for outputting several parameters of the finite mixed distribution of said hidden Marcov models stored in said parameter storage unit.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model having the respective hidden variables from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of said vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model having the respective hidden variables from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection apparatus comprising:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said stochastic models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

An abnormal behavior detection apparatus comprising:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said stochastic models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• and
• state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said time series model.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection apparatus comprising:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said time series models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

An abnormal behavior detection apparatus comprising:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said time series models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of the hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of a hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• abnormality detection means for calculating information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection apparatus comprising:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection apparatus comprising:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for the finite mixed distributions of said hidden Marcov models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

An abnormal behavior detection apparatus comprising:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for the finite mixed distributions of said hidden Marcov models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

A method of estimating a probabilistic distribution, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;
• renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten;
• and
• outputting several values of the calculated parameters.

A method of estimating a probabilistic distribution, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for value of the input data in which said input data occurs on the basis of parameters of said time series model;
• renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten;
• and
• outputting several values of the calculated parameters.

A method of estimating a probabilistic distribution, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a finite mixed distribution of hidden Marcov models having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;
• renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten;
• and
• outputting several values of the calculated parameters.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;
• renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten;
• and
• outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable.

A method of detecting abnormal behavior, comprising the steps of:

• inputting input data;
• carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;
• calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;
• renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten;
• and
• outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;
• renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten;
• and
• calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

A method of detecting abnormal behavior, comprising the steps of:

• inputting input data;
• carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;
• calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;
• renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten;
• and
• calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;
• renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten;
• calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;
• calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data;
• and
• calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

A method of detecting abnormal behavior, comprising the steps of:

• inputting input data;
• carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;
• calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;
• renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten;
• calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;
• calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data;
• and
• calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• estimating, in parallel, parameters for stochastic models having hidden variables of different number of states by using a plurality of probabilistic distribution estimation apparatuses;
• and
• calculating, by using the parameters and the input data, standard values of information amounts for the respective stochastic models to produce, as an optimum value, the number of the states where the hidden variables can take when the standard value of the information amount is the least.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;
• renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten;
• and
• outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable of said time series model.

A method of detecting abnormal behavior, comprising the steps of:

• inputting input data;
• carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;
• calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;
• renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten;
• and
• outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable of said time series model.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;
• renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten;
• and
• calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

A method of detecting abnormal behavior, comprising the steps of:

• inputting input data;
• carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;
• calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;
• renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten;
• and
• calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;
• renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten;
• calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;
• calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data;
• and
• calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

A method of detecting abnormal behavior, comprising the steps of:

• inputting input data;
• carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;
• calculating, using a time series model having a continuos time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;
• renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten;
• calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;
• calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data;
• and
• calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• estimating, in parallel, parameters for time series models having continues time distributions and hidden variables of different number of states by using a plurality of probabilistic distribution estimation apparatuses;
• and
• calculating, by using the parameters and the input data, standard values of information amounts for the respective stochastic models to produce, as an optimum value, the number of the states where the hidden variables can take when the standard value of the information amount is the least.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a finite mixed distribution of hidden Marcov models each having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;
• renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten;
• and
• outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

A method of detecting abnormal behavior, comprising the steps of:

• inputting input data;
• carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;
• calculating, using a finite mixed distribution of hidden Marcov models each having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;
• renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten;
• and
• outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a finite mixed distribution of hidden Marcov models each having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;
• renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten;
• and
• calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

A method of detecting abnormal behavior, comprising the steps of:

• inputting input data;
• carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;
• calculating, using a finite mixed distribution of hidden Marcov models each having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;
• renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten;
• and
• calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• calculating, using a finite mixed distribution of hidden Marcov models each having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;
• renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten;
• calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;
• calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data;
• and
• calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

A method of detecting abnormal behavior, comprising the steps of:

• inputting input data;
• carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;
• calculating, using a finite mixed distribution of hidden Marcov models each having a continues time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;
• renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten;
• calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;
• calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data;
• and
• calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

A method of detecting abnormal behavior, comprising the steps of:

• inputting a string of vector data as input data;
• estimating, in parallel, parameters for finite mixed distributions of hidden Marcov models each having a continues time distribution of different number of states by using a plurality of probabilistic distribution estimation apparatuses;
• and
• calculating, by using the parameters and the input data, standard values of information amount for the respective stochastic models to produce, as an optimum value, the number of the states where the hidden variables can take when the standard value of the information amount is the least.

A probabilistic distribution estimation program for making a computer respond to, as input data, a string of vector data to estimate, using a stochastic model having hidden variables, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation program making said computer operate as:

• a parameter storage unit for storing all of parameters for the stochastic model having the hidden variables;
• certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit;
• parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit;
• and
• outputting means for outputting several parameters of said stochastic model stored in said parameter storage unit.

A probabilistic distribution estimation program for making a computer respond to, as input data, a string of vector data to estimate, using a time series model having a continuous time distribution and hidden variables, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation program making said computer operate as:

• a parameter storage unit for storing all of parameters for the time series model having the continuous time distribution and the hidden variables;
• certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit;
• parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said time series model from said parameter storage unit;
• and
• outputting means for outputting several parameters of said time series model stored in said parameter storage unit.

A probabilistic distribution estimation program for making a computer respond to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Macrov models each having a continuous time distribution, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation program making said computer operate as:

• a parameter storage unit for storing all of parameters for the finite mixed distribution of the hidden Marcov models each having the continuous distribution;
• certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Macrov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and
• outputting means for outputting several parameters of the finite mixed distribution of said hidden Marcov models stored in said parameter storage unit.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model having the respective hidden variables from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection apparatus for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model having the respective hidden variables from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection program for making a computer operate as:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said stochastic models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

An abnormal behavior detection program for making a computer operate as:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said stochastic models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• and
• state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said time series model.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• and
• abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection program for making a computer operate as:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said time series models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

An abnormal behavior detection program for making a computer operate as:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said time series models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of the hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection program for making a computer operate as:

• a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;
• a reference data input unit for inputting data different from said input data;
• and
• posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

An abnormal behavior detection program for making a computer operate as:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for the finite mixed distributions of said hidden Marcov models having different number of the states where the hidden variables can take, standard values of information amount from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

An abnormal behavior detection program for making a computer operate as:

• a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;
• and
• information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for the finite mixed distributions of said hidden Marcov models having different number of the states where the hidden variables can take, standard values of information amount from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.