Nippon Telegraph and Telephone Corporation

Ryoichi Kawahara

Keisuke Ishibashi

Yasuhiro Ikeda

Keishiro Watanabe

Yusuke Nakano

Shigeaki Harada

Masahiro Kobayashi

Yoichi Matsuo

Yuka Komai

Akito Suzuki

A feature value generation device includes a generator configured to generate vectors whose elements are feature values of data items collected at a plurality of timings from a target of anomaly detection, so as to normalize or standardize the vectors based on a set of predetermined vectors; a learning unit configured to learn the predetermined vectors so as to output a learning result; and a detector configured to detect, for each of the vectors normalized or standardized by the generator, an anomaly based on said each of the vectors and the learning result. The set of predetermined vectors is a set of vectors with which no anomaly is detected by the detector, and the set of vectors is updated in accordance with no anomaly being detected by the detector.

Anomaly detection method using an autoencoder learning from data items collected by measuring devices

A feature value generation device includes a generator configured to digitize non-numerical text data items collected at a plurality of timings from a target of anomaly detection, to generate vectors whose elements are feature values corresponding to the digitized data items; a learning unit configured to learn the vectors during a learning period so as to output a learning result; and a detector configured to detect, during a test period, for each of the vectors generated by the generator, an anomaly based on said each of the vectors and the learning result.

Feature value generation device, feature value generation method, and program

A control device includes a first calculation unit configured to calculate for each control target a control solution for controlling said each control target; a second calculation unit configured to calculate an evaluation of the control solution for said each control target; a solution change unit configured to change the control solution based on the evaluation calculated by the second calculation unit; and a control unit configured to control said each control target based on the control solution changed by the solution change unit.

Control device, control method, and program

An anomaly detection apparatus having a function of an autoencoder that includes an input layer, hidden layers, and an output layer, and that learns parameters such that data of the input layer is reproduced in the output layer, the anomaly detection apparatus including: input means that input normal data of a plurality of types; learning means that learn parameters such that normal data of the input layer is reproduced in the output layer by learning a feature across data types using data of a dimension which is smaller than a dimension of the normal data; and anomaly degree calculation means that input test data to the autoencoder using the parameters learned by the learning means, and calculate anomaly degree of the test data based on output data of the autoencoder and the test data.

Anomaly detection apparatus, anomaly detection method, and program

A device for estimating a cause of an anomaly comprises: a detection unit to detect an anomaly in a detection target based on a learner trained on first numerical vectors obtained from a detection target when the detection target is under a normal condition and second numerical vectors to be obtained from the detection target at multiple time; and a first computing unit to compute, for each metric of a second numerical vector from which an anomaly has been detected, as information for estimating a metric of cause of the anomaly, a value obtained by subtracting, from a value of the metric, an average of the metric in the first numerical vectors, and dividing a result of the subtracting by standard deviation of the metric in the first numerical vectors. This device supports estimation of the cause of an anomaly detected in a target object for detecting an anomaly.

Anomaly factor estimation device, anomaly factor estimation method, and storage medium

An anomaly location identification device includes a determination unit configured to determine presence or absence of an anomaly by inputting part or all of information items output from a plurality of devices into an anomaly detection algorithm; a calculation unit configured to calculate, in response to a determination made by the determination unit that an anomaly is present, with respect to one of the information items, an index indicating a degree of contribution to the anomaly; and an identification unit configured to perform calculation by an analysis algorithm using a causal model receiving the index as input, to identify an anomalous device, to improve the precision and calculation speed related to identification of an anomaly location.

Anomaly location identification device, anomaly location identification method, and program

An apparatus for estimating anomaly information includes an input unit configured to input anomaly data detected as anomaly by an anomaly detecting algorithm that outputs an anomaly degree of input data for vectors, using learning of the vectors in a normal state, and an estimate unit configured to search for one or more vectors that decrease the degree of anomaly when added to the anomaly data, taking into account a likelihood, for each dimension, of a given dimension being a cause of the anomaly, and estimate the cause of the anomaly based on the searched vectors whereby it is possible to estimate detailed information on a detected anomaly.

Apparatus and method for estimating anomaly information, and program

An access source classification apparatus has: a first calculation unit that calculates a statistic related to access to each service by each access source based on a set of access logs indicating access to any service of a plurality of services by any access source of a plurality of access sources; an extraction unit that, for each of the services, calculates an index value indicating distribution of access status to the service for each of the access sources based on the access logs related to the service, and extracts some services based on the index value; a second calculation unit that calculates relevance between each access source and each service extracted by the extraction unit by applying a clustering approach to the statistic; and a classification unit that classifies an access source to any service extracted by the extraction unit into any of groups each including one or more access sources based on the relevance, thereby assisting improvement of efficiency in identifying the terminal type of an access source to a service.

Access origin classification apparatus, access origin classification method and program

A first time series of traffic volume and a first time series of communication quality that are observed in a first communication line in which traffic demand is equal to or greater than a line bandwidth and a second time series of traffic volume and a second time series of communication quality that are observed in a second communication line in which traffic demand is less than a line bandwidth are input to a state space model to estimate values of a parameter group of the state space model, the traffic demand is calculated based on the values of the parameter group, and the state space model is a state space model in which the first time series of traffic volume and the second time series of traffic volume are generated from a third time series indicating cyclicity of traffic common to the first communication line and the second communication line under influence of the first time series of communication quality and the second time series of communication quality on the traffic demand, thereby supporting appropriate band design of an overload line in which traffic demand is equal to or greater than a line bandwidth.

Growing community of inventors

Musashino, Japan

Ryoichi Kawahara