An anomalous sequential data identification method of identifying anomalous sequential data entered into a computer system using a data examination method of determining whether or not sequential data including a plurality of types of events are anomalous, wherein the data examination method comprises the steps of:
- a window data decomposition step of decomposing a plurality of learning sequential data to be learned into a plurality of window data having a predetermined data length,
- a scope data extraction step of sequentially extracting, with a time lag, from the window data a plurality of scope data having a data length shorter than the predetermined data length,
- a co-occurrence matrix conversion step of converting, based on the plurality of scope data, the plurality of window data into a plurality of co-occurrence matrices each indicating a strength of a time series correlation between the plurality of types of events included in the window data,
- an Eigen co-occurrence matrix set determination step of determining one or more Eigen co-occurrence matrix sets, which are a basis for obtaining feature vectors by a statistical feature extraction method using the plurality of co-occurrence matrices as input,
- a profiling co-occurrence matrix conversion step of converting one or more profile-learning sequential data belonging to the one or more categories into one or more profiling co-occurrence matrices by performing steps equivalent to the window data decomposition step, the scope data extraction step and the co-occurrence matrix conversion step upon the one or more profile-learning sequential data,
- a reference feature vector extraction step of extracting one or more reference feature vectors in respect of the one or more profile-learning sequential data, based on the one or more profiling co-occurrence matrices and the one or more Eigen co-occurrence matrix sets,
- a testing co-occurrence matrix conversion step of converting testing sequential data to be tested into a testing co-occurrence matrix by performing steps equivalent to the window data decomposition step, the scope data extraction step and the co-occurrence matrix conversion step upon the testing sequential data to be tested,
- a testing feature vector extraction step of extracting a testing feature vector in respect of the testing sequential data to be tested, based on the testing co-occurrence matrix and the one or more Eigen co-occurrence matrix sets,
- a reference approximate co-occurrence matrix acquisition step of acquiring a plurality of reference approximate co-occurrence matrices having a dimensionality reduced from that of the plurality of Eigen co-occurrence matrices, based on multiplication of the one or more reference feature vectors and the plurality of Eigen co-occurrence matrices forming the one or more Eigen co-occurrence matrix sets,
- a reference layered network model construction step of constructing a reference layered network model by extracting one or more events from the plurality of reference approximate co-occurrence matrices,
- a testing approximate co-occurrence matrix acquisition step of acquiring a plurality of testing approximate co-occurrence matrices having a dimensionality reduced from that of the plurality of Eigen co-occurrence matrices, based on multiplication of the testing feature vector and the plurality of Eigen co-occurrence matrices forming the one or more Eigen co-occurrence matrix sets,
- a testing layered network model construction step of constructing a testing layered network model by extracting one or more events from the plurality of testing approximate co-occurrence matrices, and
- a determination step of determining whether or not the testing sequential data to be tested belong to the one or more categories, based on the reference layered network model and the testing layered network model.