Anomaly identification system, method, and storage medium

An anomaly identification method comprising:

• extracting a plurality of log subsets from target logs in accordance with a predetermined condition, the number of the plurality of log subsets being three or more;
• generating models from the plurality of log subsets;
• acquiring a correspondence between the models and the plurality of log subsets that contribute to generation of the models;
• classifying the plurality of log subsets into two log subset groups in accordance with presence or absence of contribution to generation of the models based on the correspondence and determining, out of the two log subset groups, a minority log subset group that includes the log subsets the number of which is smaller;
• and
• determining one of the plurality of log subsets having the highest specificity related to presence or absence of contribution to generation of the models out of the plurality of log subsets based on the minority log subset group.

A non-transitory storage medium in which a program is stored, the program causing a computer to execute,

• extracting a plurality of log subsets from target logs in accordance with a predetermined condition, the number of the plurality of log subsets being three or more,
• generating models from the plurality of log subsets,
• acquiring a correspondence between the models and the plurality of log subsets that contribute to generation of the models,
• classifying the plurality of log subsets into two log subset groups in accordance with presence or absence of contribution to generation of the models based on the correspondence and determining, out of the two log subset groups, a minority log subset group that includes the log subsets the number of which is smaller, and
• determining one of the plurality of log subsets having the highest specificity related to presence or absence of contribution to generation of the models out of the plurality of log subsets based on the minority log subset group.