Anomaly detection method, system, and program
AssigneeNEC Corporation
InventorRyosuke TOGAWA
Life of this patent
Estimating the term…
Abstract
The present invention provides an anomaly detection method, an anomaly detection system, and an anomaly detection program that can detect an anomaly at high accuracy by using log output quantity distributions generated for to different aggregate units and different devices. An anomaly detection system according to one example embodiment of the present invention has: a reference distribution, which is a time-series distribution of a log output quantity acquisition unit that acquires a plurality of distributions generated for each device that outputs logs and for each unit of a time range in which logs are aggregated; and an anomaly detection unit that detects an anomaly by using the plurality of distributions.
Claims19
An anomaly detection method comprising:
- acquiring a plurality of reference data each including a number of log outputs;
- acquiring target data including a number of log outputs of a target device;
- determining a first reference data, among the plurality of reference data, based on similarity between the target data and each of the plurality of reference data;
- and
- detecting that the target device has an anomaly based on the first reference data and the target data.
An anomaly detection system comprising:
- a memory storing one or more instructions;
- and
- one or more processors configured to execute the one or more instructions to:
- acquire a plurality of reference data each including a number of log outputs;
- acquire target data including a number of log outputs of a target device;
- determine a first reference data, among the plurality of reference data, based on similarity between the target data and each of the plurality of reference data;
- and
- detect that the target device has an anomaly based on the first reference data and the target data.
A non-transitory computer-readable storage medium in which an anomaly detection program is stored, the anomaly detection program causing a computer to:
- acquire a plurality of reference data each including a number of log outputs;
- acquire target data including a number of log outputs of a target device;
- determine a first reference data, among the plurality of reference data, based on similarity between the target data and each of the plurality of reference data;
- and
- detect that the target device has an anomaly based on the first reference data and the target data.
Dependencies are inferred from the claim text.