Anomaly detection method, system, and program
AssigneeNEC Corporation
InventorRyosuke TOGAWA
Life of this patent
Estimating the term…
Abstract
The present invention provides an anomaly detection method, an anomaly detection system, and an anomaly detection program that can detect an anomaly at high accuracy by using log output quantity distributions generated for to different aggregate units and different devices. An anomaly detection system according to one example embodiment of the present invention has: a reference distribution, which is a time-series distribution of a log output quantity acquisition unit that acquires a plurality of distributions generated for each device that outputs logs and for each unit of a time range in which logs are aggregated; and an anomaly detection unit that detects an anomaly by using the plurality of distributions.
Claims10
An anomaly detection method comprising steps of:
- acquiring a plurality of distributions generated for each device that outputs logs and for each unit of a time range in which logs are aggregated;
- and
- detecting an anomaly by using the plurality of distributions,
- wherein each of the plurality of distributions is a time-series distribution of an output quantity of the logs in the unit.
A non-transitory storage medium in which an anomaly detection program is stored, the anomaly detection program causing a computer to perform steps of:
- acquiring a plurality of distributions generated for each device that outputs logs and for each unit of a time range in which logs are aggregated;
- and
- detecting an anomaly by using the plurality of distributions,
- wherein each of the plurality of distributions is a time-series distribution of an output quantity of the logs in the unit.
An anomaly detection system comprising:
- a distribution acquisition unit that acquires a plurality of distributions generated for each device that outputs logs and for each unit of a time range in which logs are aggregated;
- and
- an anomaly detection unit that detects an anomaly by using the plurality of distributions,
- wherein each of the plurality of distributions is a time-series distribution of an output quantity of the logs in the unit.
Dependencies are inferred from the claim text.