JP6085497B2 - Operational risk analysis server device - Google Patents

Description

  The present invention relates to an operational risk analysis server device that extracts event occurrence factors that tend to appear frequently or increase from operational risk events stored in a database.

  In financial institutions, operational risk management is essential to quickly grasp and respond to administrative accidents, which are mistakes in administrative processing, and complaint consultations, which are complaints from customers. For this reason, the contents of office accidents and complaints that have occurred are registered in the database as operational risk events. For example, as an event occurrence factor, an operational risk event table storing the year / month / store where the office accident occurred and the type / process of the office processing is stored in the database. Then, it is desired to grasp the necessary countermeasure points for operational risk by extracting event occurrence factors that tend to increase frequently from operational risk events stored in the database.

  In the technique described in Patent Literature 1, when an event occurrence factor that tends to increase frequently is extracted from the operational risk events stored in the database, it tends to increase more frequently than a combination of event occurrence factors that tend to increase frequently. Deeply extract the causes of event occurrence. For example, we deepen the event occurrence factor “correction rate of remittance operations for exchange operations at GPT terminals” which is more frequent than the combination of event occurrence factors which tend to increase frequently, “correction rate for remittance operations for exchange operations”. Can be extracted.

International Publication No. 2012/039232

  However, in the technique described in Patent Literature 1, when extracting event occurrence factors that tend to increase more frequently than combinations of event occurrence factors that tend to increase frequently, risk events of a pattern with a small number of items are extracted. By comparing with an expected value proportional to the ratio of the number of cases, patterns that tend to increase more frequently than patterns with a small number of items are extracted.

  For this reason, if the ratio of the number of risk events in the pattern with a small number of items is small, the expected value becomes small, so that when the number of items is increased, extraction becomes easy.

  The object of the present invention is to reduce the risk of a pattern with a small number of items when deeply extracting event occurrence factors that tend to increase more frequently than combinations of event occurrence factors that tend to increase frequently in an operational risk analysis system. The objective is to enable appropriate extraction regardless of the proportion of the number of events.

In the first aspect of the operational risk analysis server device of the present invention,
A database for storing an operational risk event table storing an operational risk event composed of a plurality of event occurrence factors;
If the number of items in the combination pattern of event occurrence factors stored in the database is 2, if the ratio of the pattern to the first item of the pattern is significantly greater than the ratio of the second item of the pattern to the total number of data First abnormal frequent pattern extraction means for extracting as an abnormal frequent pattern;
When the number of items in the combination pattern of event occurrence factors stored in the database is 3 and there is an abnormality in the pattern with a small number of items, the ratio of the pattern to the first item and the second item of the pattern is 2 The ratio of the pattern to the first item and the second item of the pattern is significantly larger than the ratio of the second item and the third item of the pattern to the item, and the ratio of the pattern to the first item and the second item of the pattern is the first item and 3 of the pattern. A second abnormal frequent pattern extraction means for extracting as an abnormal frequent pattern if it is significantly greater than the ratio of the item;
If the number of items in the combination pattern of event occurrence factors stored in the database is 3 and there is no abnormality in the pattern with a small number of items, the ratio of the pattern to the first item of the pattern is 2 of the pattern with respect to the total number of data items. Significantly more than the ratio of the item and the third item, and the ratio of the pattern to the first item and the second item of the pattern is higher than the ratio of the first item and the third item of the pattern to the first item of the pattern, And a third abnormal frequency pattern extraction means for extracting as an abnormal frequency pattern if it is significantly higher.

In the second aspect of the operational risk analysis server device of the present invention,
A database for storing an operational risk event table storing an operational risk event composed of a plurality of event occurrence factors;
In the case where the number of event occurrence factor combination patterns stored in the database is 2, if the ratio of the pattern to the second item other than the pattern is significantly greater than the previous period, the abnormal increase pattern First abnormal increase pattern extraction means for extracting as:
If the number of items in the combination pattern of event occurrence factors stored in the database is 3 and the number of minority items is abnormal, the ratio of the pattern to the second and third items other than the pattern is the current period. Is significantly greater than the previous period, and the pattern ratio for the first and second items of the pattern is significantly greater than the previous period, and the pattern for the first and third items of the pattern If the current period is significantly higher in the current period than in the previous period, a second abnormal increase pattern extracting means for extracting as an abnormal increase pattern;
If the number of items in the combination pattern of event occurrence factors stored in the database is 3 and there is no abnormality in the pattern with a small number of items, the ratio of the pattern to the second and third items other than the pattern is the current period. Is significantly higher than the previous period, and the ratio of the pattern to the first item of the pattern is significantly higher than the previous period, and the ratio of the pattern to the first and third items of the pattern is And a third abnormal increase pattern extracting means for extracting an abnormal increase pattern if the current period is significantly greater than the previous period.

  According to the present invention, when extracting event occurrence factors that tend to appear frequently or increase from operational risk events stored in the database, not only the pattern with a small number of items but also the comparison with the whole By making the comparison with the partial pattern separately, it is possible to limit and extract patterns that are even more valuable to be displayed as an abnormal pattern.

FIG. 1 is an example of a configuration of an operational risk analysis system having an operational risk analysis server device of the present invention. FIG. 2 is a diagram illustrating an example of an operational risk event table. FIG. 3 is a diagram showing an example of processing of the operational risk analysis server device of the present invention. FIG. 4 is a diagram illustrating an example of the threshold value input screen. FIG. 5 is a diagram illustrating an example of the calculation of the p value based on the binomial test. FIG. 6 is a diagram illustrating an example of p-value calculation based on Fisher's exact test. FIG. 7 is a diagram illustrating an example of processing performed by the abnormal frequent appearance pattern extraction unit. FIG. 8 is a diagram illustrating an example of processing performed by the abnormal increase pattern extraction unit. FIG. 9 is a diagram illustrating an example of an abnormal frequent appearance pattern list. FIG. 10 is a diagram illustrating an example of the abnormal increase pattern list.

  Hereinafter, an operational risk analysis server apparatus according to an embodiment of the present invention will be described with reference to the drawings showing an example of an operational risk analysis system having the server apparatus.

  FIG. 1 is an example of a configuration of an operational risk analysis system having an operational risk analysis server apparatus (hereinafter, abbreviated as “analysis server apparatus”) of the present invention.

The operational risk analysis system includes an analysis server device 1 and a client terminal 2. The analysis server device 1 and the client terminal 2 are connected via the network 3 and can communicate with each other.
The analysis server device 1 is a computer that includes a central processing unit 11, a main storage device 12, an auxiliary storage device 13, and a network communication device 14.
The central processing unit 11, the main storage device 12, the auxiliary storage device 13, and the network communication device 14 are connected by a data bus.
The main storage device 12 is, for example, a RAM (Random Access Memory).
The auxiliary storage device 13 is, for example, a hard disk, and stores an analysis program 15 and a database 16.
Each function of the abnormal frequent appearance pattern extraction unit 4 and the abnormal increase pattern extraction unit 5 is implemented in the analysis program 15. The abnormal frequent pattern extraction unit 4 has a processing function of extracting an abnormal frequent pattern. The abnormal increase pattern extraction unit 5 has a processing function of extracting an abnormal increase pattern.
The database 16 stores an operational risk event table 6.
When the central processing unit 11 reads the analysis program 15 from the auxiliary storage device 13 into the main storage device 12 and executes it, the functions of the abnormal frequent pattern extraction unit 4 and the abnormal increase pattern extraction unit 5 are realized.
The network communication device 14 transmits / receives data to / from the client terminal 2 via the network 3.

The client terminal 2 is a computer including a central processing unit 21, a main storage device 22, an auxiliary storage device 23, a network communication device 24, a display device 25, and an input device 26.
The central processing unit 21, the main storage device 22, the auxiliary storage device 23, the network communication device 24, the display device 25, and the input device 26 are connected by a data bus.
The network communication device 24 transmits / receives data to / from the analysis server device 1 via the network 3.
The display device 25 is a liquid crystal display, for example.
The input device 26 is a keyboard, for example.

FIG. 2 is an example of the operational risk event table 6 stored in the database 16 of the analysis server device 1.
The operational risk event table 6 stores event occurrence factors such as office accidents and complaint consultations that have occurred in a certain period in the past (previous period) and recently in a certain period (current period).
In the example of the operational risk event table 6 in FIG. 2, “year of occurrence”, “when the office accident occurred” as the item name of the event occurrence factor of the office accident that occurred in 2008 (previous period) and 2009 (current period). “Occurrence month”, “Occurrence store”, “Accident type” of office accident, and “Cause process” of office accident. Specific data stored in each item is a factor name.

Constants related to event occurrence factors used in the abnormal frequent pattern extraction unit 4 and abnormal increase pattern extraction unit 5 executed by the analysis server device 1 are shown below.
N items of event occurrence factors are assumed to be A [i] (1 ≦ i ≦ N). In the example of FIG. 2, N = 4, A [1] = “occurrence month”, A [2] = “occurrence store”, A [3] = “accident type”, A [4] = “cause process” is there.
Let the index set of items be AI = {i | 1 ≦ i ≦ N}. In the example of FIG. 2, AI = {1,2,3,4}.
Let N [i] factors belonging to item A [i] be B [i] [j] (1 ≦ j ≦ N [i]). In the example of FIG. 2, N [1] = 12 factors belonging to item A [1] = “occurrence month” are B [1] [1] = “January”, B [1] [2] = ” February ", ..., B [1] [12] =" December ". In addition, N [2] = 26 factors belonging to item A [2] = “occurrence store” are B [2] [1] = “A store”, B [2] [2] = “B store”, ..., B [2] [26] = "Z store".
Let BI [i] = {j | 1 ≦ j ≦ N [i]} be an index set of factors belonging to the item A [i]. In the example of FIG. 2, the index set of factors belonging to item A [1] = “occurrence month” is BI [1] = {1, 2,..., 12}. Further, the index set of factors belonging to the item A [2] = “occurrence store” is BI [2] = {1, 2,..., 26}.

An operation function for the database 16 used by the abnormal frequent pattern extraction unit 4 and the abnormal increase pattern extraction unit 5 executed by the analysis server device 1 is shown below.
The analysis server device 1 acquires the number of data of operational risk events including the set X of event occurrence factor combinations from the operational risk event table 6 stored in the database 16. However, if X = φ (empty set), the total number of data is acquired.
The number of data in the current period is FCI (X), and the number of data in the previous period is FPI (X). In the example of FIG. 2, FCI (φ) = 8380, FCI (B [1] [1]) = 651, FCI (B [1] [1] ∪B [2] [1]) = 27, FPI (φ ) = 7944, FPI (B [1] [1]) = 705, FPI (B [1] [1] ∪B [2] [1]) = 35.

FIG. 3 is an example of processing of the operational risk analysis system of the present invention.
When the threshold value is input from the input device 26 to the threshold value input screen displayed on the display device 25, the client terminal 2 transmits the input threshold value to the analysis server device 1 (step 101).
The analysis server device 1 receives the threshold value from the client terminal 2 (step 102).
The abnormal frequent pattern extraction unit 4 of the analysis server device 1 generates an abnormal frequent pattern list (FIG. 9 to be described later) by referring to the operational risk event table 6 using the threshold as an input (step 103).
The abnormal increase pattern extraction unit 5 of the analysis server device 1 receives the threshold value and refers to the operational risk event table 6 to generate an abnormal increase pattern list (FIG. 10 described later) (step 104).
The analysis server device 1 transmits an abnormal frequent pattern list and an abnormal increase pattern list to the client terminal 2 (step 105).
The client terminal 2 receives the abnormal frequent pattern list and abnormal increase pattern list from the analysis server device 1, and displays the abnormal frequent pattern list and abnormal increase pattern list on the display device 25 (step 106).

  However, the analysis server device 1 may first perform an abnormal increase pattern extraction process and then perform an abnormal frequent pattern extraction process.

  Further, the analysis server device 1 may perform only the abnormal frequent pattern extraction processing and transmit only the abnormal frequent pattern list to the client terminal 2. When the client terminal 2 receives the abnormal frequent pattern list from the analysis server device 1, the client terminal 2 displays the abnormal frequent pattern list on the display device 25.

  The analysis server apparatus 1 may perform only the abnormal increase pattern extraction process and transmit only the abnormal increase pattern list to the client terminal 2. When the client terminal 2 receives the abnormal increase pattern list from the analysis server device 1, the client terminal 2 displays the abnormal increase pattern list on the display device 25.

FIG. 4 is an example of a threshold value input screen displayed on the display device 25 of the client terminal 2.
On the threshold value input screen, a condition for extracting an abnormal pattern that is a combination pattern of event occurrence factors that tend to appear frequently or increase from the operational risk event is input.

The example of the threshold value input screen of FIG. 4 includes a text box in which a significance level threshold value can be directly input. At the significance level threshold, a numerical value indicating how many p-values of the pattern are to be an abnormal pattern is input. Here, the p value is a value calculated based on a statistical test as to how much the number of data of a predetermined pattern is high.
As the significance level threshold, the significance level threshold PVT1 in the case of one item deep digging and the significance level threshold PVT2 in the case of two items deep digging are input. For example, PVT1 = 0.10 and PVT2 = 0.01.

FIG. 5 is an example of p-value calculation based on the binomial test used by the abnormal frequent pattern extraction unit 4 executed by the analysis server device 1.
The p value is the sum of probabilities when the number of successes is larger in the binomial distribution.
The p-value calculation function is represented by binomial distribution upper cumulative probability density BIN (S, C, P) where S is the number of successes, C is the number of trials, and P is the success rate.

  In the example of p-value calculation based on the binomial test in FIG. 5, p-value = BIN (4,8,0.25) = (probability when S = 4) because the number of successes S = 4 and the number of trials C = 8 + (Probability when S = 5) +... + (Probability when S = 8) = 0.1138

FIG. 6 is an example of p-value calculation based on Fisher's exact test used in the abnormal increase pattern extraction unit 5 executed by the analysis server device 1.
The p value is the sum of the occurrence probabilities of the contingency table in which the value in the first row and the first column is larger in the contingency table of 2 rows and 2 columns.
The p-value calculation function uses M [1] [1] for the first row and first column of the contingency table, M [1] [2] for the first row and second column, and M [2] [1 for the second row and first column. ] The second row and the second column are M [2] [2] and the upper cumulative probability density FIS (M [1] [1], M [1] [2], M [2] [1 ], M [2] [2]).

  In the example of p-value calculation based on Fisher's exact test in FIG. 6, the value M [1] [1] = 13 in the first row and the first column, the total value in the first row (13 + 4 = 17) and the first column P value = FIS (13,4,6,14) = (occurrence probability of contingency table of M [1] [1] = 13) + (M [ 1] [1] = 14 occurrence probability of contingency table) +... + (M [1] [1] = 17 occurrence probability of contingency table) = 0.0058.

FIG. 7 is an example of processing of the abnormal frequent pattern extraction unit 4 executed by the analysis server device 1.
Step 202 and the subsequent steps are executed for each factor (∀j1εBI [i1]) belonging to the item for every item of event occurrence factors (∀i1εAI) (step 201).

The first item of the pattern is PA [1] = A [i1], and the event occurrence factor of the first item of the pattern is PB [1] = B [i1] [j1] (step 202).
Step 204 and subsequent steps are executed for each item (∀j2εBI [i2]) for each item (∀i2εAI \ {i1}) excluding items included in the pattern from all items of event occurrence factors (Step 203).
The second item of the pattern is PA [2] = A [i2], and the event occurrence factor of the second item of the pattern is PB [2] = B [i2] [j2] (step 204).
p value PVF1 = BIN (FCI (PB [1] ∪PB [2]), FCI (PB [1]), FCI (PB [2]) / FCI (φ)) is calculated (step 205).
If PVF1 <PVT1, step 207 to step 213 are executed, and if PVF1 ≧ PVT1, step 214 to step 219 are executed (step 206).
A combination pattern “PA [n] = PB [n]” (1 ≦ n ≦ 2) of event occurrence factors is added to the abnormal frequent pattern list (step 207).

For each item (∀i3εAI \ {i1, i2}) excluding items included in the pattern from all items of event occurrence factors, for each factor (∀j3εBI [i3]) belonging to the item, from step 209 Step 213 is executed (step 208).
The third item of the pattern is PA [3] = A [i3], and the event occurrence factor of the third item of the pattern is PB [3] = B [i3] [j3] (step 209).
p value PVF2 = BIN (FCI (PB [1] ∪PB [2] ∪PB [3]), FCI (PB [1] ∪PB [2]), FCI (PB [2] ∪PB [3]) / FCI (PB [2])) is calculated (step 210).
p value PVF3 = BIN (FCI (PB [1] ∪PB [2] ∪PB [3]), FCI (PB [1] ∪PB [2]), FCI (PB [1] ∪PB [3]) / FCI (PB [1])) is calculated (step 211).
If PVF2 <PVT1 and PVF3 <PVT1, step 213 is executed (step 212).
A combination pattern “PA [n] = PB [n]” (1 ≦ n ≦ 3) of event occurrence factors is added to the abnormal frequent pattern list (step 213).

For each item (∀i3∈AI \ {i1, i2}) excluding items included in the pattern from all items of event occurrence factors, from step 215, for each factor (∀j3∈BI [i3]) belonging to the item Step 219 is executed (step 214).
The third item of the pattern is PA [3] = A [i3], and the event occurrence factor of the third item of the pattern is PB [3] = B [i3] [j3] (step 215).
p value PVF4 = BIN (FCI (PB [1] ∪PB [2] ∪PB [3]), FCI (PB [1]), FCI (PB [2] ∪PB [3]) / FCI (φ)) Is calculated (step 216).
p value PVF5 = BIN (FCI (PB [1] ∪PB [2] ∪PB [3]), FCI (PB [1] ∪PB [2]), FCI (PB [1] ∪PB [3]) / FCI (PB [1])) is calculated (step 217).
If PVF4 <PVT2 and PVF5 <PVT1, step 219 is executed (step 218).
A combination pattern “PA [n] = PB [n]” (1 ≦ n ≦ 3) of event occurrence factors is added to the abnormal frequent pattern list (step 219).

When abnormal frequent patterns are extracted and the number of pattern items is 2, the following one test is performed.
In step 205 and step 206, the ratio of the pattern FCI (PB [1] ∪PB [2]) to the first item FCI (PB [1]) of the pattern is the ratio FCI (2 of the second item of the pattern to the total number of data items). PB [2]) / FCI (φ) is tested to determine whether it is significantly higher.
For example, if PA [1] = "occurrence store", PB [1] = "A store", PA [2] = "accident type", PB [2] = "exchange accident", store A and other stores In comparison, if the rate of exchange accidents among all accidents is significantly high, it is extracted as an abnormal frequency pattern.

When abnormal frequent patterns are extracted and the number of pattern items is 3 and the number of minority items is abnormal, the following two tests are performed.
In step 210 and step 212, the ratio of the pattern FCI (PB [1] ∪PB [2] ∪PB [3]) to the first and second item FCI (PB [1] ∪PB [2]) of the pattern is The ratio of the second item and the third item of the pattern to the second item of the pattern, FCI (PB [2] ∪PB [3]) / FCI (PB [2]), is tested for whether it is significantly higher.
For example, if PA [3] = "cause process" and PB [3] = "window process", if store A has a significantly larger percentage of window processes during exchange accidents than other stores, abnormal frequency will occur. One of the conditions extracted as a pattern is satisfied.

In step 211 and step 212, the ratio of the pattern FCI (PB [1] ∪PB [2] ∪PB [3]) to the first and second item FCI (PB [1] ∪PB [2]) of the pattern is The ratio of the first item and the third item of the pattern with respect to the first item of the pattern, FCI (PB [1] ∪PB [3]) / FCI (PB [1]), is tested to determine whether it is significantly higher.
For example, if the ratio of the counter process in the store A during the exchange accident is significantly higher than the ratio of the counter process in the store A, one of the conditions extracted as an abnormal frequency pattern is satisfied.

When abnormal frequent patterns are extracted, the number of pattern items is three, and there are no abnormalities in the pattern with a small number of items, the following two tests are performed.
In step 216 and step 218, the ratio of the pattern FCI (PB [1] ∪PB [2] ∪PB [3]) to the first item FCI (PB [1]) of the pattern is the two items of the pattern for the total number of data items. It is tested whether it is significantly higher than the ratio FCI (PB [2] ∪PB [3]) / FCI (φ) of the third item.
For example, if store A has a significantly higher rate of exchange accidents and window processes than all other stores, it satisfies one of the conditions extracted as an abnormal frequency pattern.

In step 217 and step 218, the ratio of the pattern FCI (PB [1] ∪PB [2] ∪PB [3]) to the first and second item FCI (PB [1] ∪PB [2]) of the pattern is The ratio of the first item and the third item of the pattern with respect to the first item of the pattern, FCI (PB [1] ∪PB [3]) / FCI (PB [1]), is tested to determine whether it is significantly higher.
For example, if the ratio of the counter process in the store A during the exchange accident is significantly higher than the ratio of the counter process in the store A, one of the conditions extracted as an abnormal frequency pattern is satisfied.

FIG. 8 is an example of the process of the abnormal increase pattern extraction unit 5 executed by the analysis server device 1.
Step 302 and subsequent steps are executed for each factor (∀j1εBI [i1]) belonging to the item for every item of event occurrence factors (∀i1εAI) (step 301).

The first item of the pattern is PA [1] = A [i1], and the event occurrence factor of the first item of the pattern is PB [1] = B [i1] [j1] (step 302).
Step 304 and subsequent steps are executed for each item (2j2εBI [i2]) for each item (∀i2∈AI \ {i1}) excluding the items included in the pattern from all items of event occurrence factors (Step 303).
The second item of the pattern is PA [2] = A [i2], and the event occurrence factor of the second item of the pattern is PB [2] = B [i2] [j2] (step 304).
p value PVI1 = FIS (FCI (PB [1] ∪PB [2]), FCI (PB [2]) − FCI (PB [1] ∪PB [2]), FPI (PB [1] ∪PB [2 ]), FPI (PB [2]) − FPI (PB [1] ∪PB [2])) is calculated (step 305).
If PVI1 <PVT1, step 307 to step 314 are executed, and if PVI1 ≧ PVT1, step 315 to step 321 are executed (step 306).
A combination pattern “PA [n] = PB [n]” (1 ≦ n ≦ 2) of event occurrence factors is added to the abnormal increase pattern list (step 307).

For each item (に つ い て i3εAI \ {i1, i2}) excluding items included in the pattern from all items of event occurrence factors, from step 309 for each factor (に j3εBI [i3]) belonging to the item Step 314 is executed (step 308).
The third item of the pattern is PA [3] = A [i3], and the event occurrence factor of the third item of the pattern is PB [3] = B [i3] [j3] (step 309).
p value PVI2 = FIS (FCI (PB [1] ∪PB [2] ∪PB [3]), FCI (PB [2] ∪PB [3]) − FCI (PB [1] ∪PB [2] ∪PB [3]), FPI (PB [1] ∪PB [2] ∪PB [3]), FPI (PB [2] ∪PB [3]) − FPI (PB [1] ∪PB [2] ∪PB [ 3])) is calculated (step 310).
P value PVI3 = FIS (FCI (PB [1] ∪PB [2] ∪PB [3]), FCI (PB [1] ∪PB [2]), FPI (PB [1] ∪PB [2] ∪PB [3]), FPI (PB [1] ∪PB [2])) is calculated (step 311).
p value PVI4 = FIS (FCI (PB [1] BPB [2] ∪PB [3]), FCI (PB [1] ∪PB [3]), FPI (PB [1] ∪PB [2] ∪PB [3]), FPI (PB [1] ∪PB [3])) is calculated (step 312).
If PVI2 <PVT1, PVI3 <0.5, and PVI4 <0.5, step 314 is executed (step 313).
A combination pattern “PA [n] = PB [n]” (1 ≦ n ≦ 3) of event occurrence factors is added to the abnormal increase pattern list (step 314).

For every item (に つ い て i3εAI \ {i1, i2}) excluding items included in the pattern from all items of event occurrence factors, for each factor (に つ い て j3εBI [i3]) belonging to the item, from step 316 Step 321 is executed (Step 315).
The third item of the pattern is PA [3] = A [i3] and the event occurrence factor of the third item of the pattern is PB [3] = B [i3] [j3] (step 316).
P value PVI5 = FIS (FCI (FCI (PB [1] ∪PB [2] ∪PB [3]), FCI (PB [2] ∪PB [3]) − FCI (PB [1] ∪PB [2] ∪PB [3]), FPI (PB [1] ∪PB [2] ∪PB [3]), FPI (PB [2] ∪PB [3]) − FPI (PB [1] ∪PB [2] ∪PB [ 3])) is calculated (step 317).
p-value PVI6 = FIS (FCI (FCI (PB [1] ∪PB [2] ∪PB [3]), FCI (PB [1]), FPI (PB [1] ∪PB [2] ∪PB [3]), FPI (PB [1])) is calculated (step 318).
p-value PVI7 = FIS (FCI (PB [1] 1PB [2] ∪PB [3]), FCI (PB [1] ∪PB [3]), FPI (PB [1] ∪PB [2] ∪PB [3]), FPI (PB [1] ∪PB [3])) is calculated (step 319).
If PVI5 <PVT2, PVI6 <0.5, and PVI7 <0.5, step 321 is executed (step 320).
A combination pattern “PA [n] = PB [n]” (1 ≦ n ≦ 3) of event occurrence factors is added to the abnormal increase pattern list (step 321).

When the abnormal increase pattern is extracted and the number of pattern items is 2, the following one test is performed.
In step 305 and step 306, the ratio of the pattern FCI (PB [1] ∪PB [2]) to the second item FCI (PB [2]) − FCI (PB [1] ∪PB [2]) other than the pattern is Tests whether the current period is significantly greater than the previous period.
For example, if PA [1] = "occurrence store", PB [1] = "A store", PA [2] = "accident type", PB [2] = "exchange accident", store A and other stores In comparison, if the number of exchange accidents has increased significantly, it is extracted as an abnormal increase pattern.

When the abnormal increase pattern is extracted and the number of pattern items is 3 and the number of minority items is abnormal, the following three tests are performed.
In step 310 and step 313, the pattern FCI for the second and third item FCI (PB [2] ∪PB [3]) − FCI (PB [1] ∪PB [2] ∪PB [3]) other than the pattern is determined. The ratio of (PB [1] ∪PB [2] ∪PB [3]) is tested to see if the current period is significantly higher than the previous period.
For example, if PA [3] = "cause process" and PB [3] = "window process", if store A has a foreign exchange accident and the window process significantly increased compared to other stores, abnormal increase pattern One of the conditions extracted as is satisfied.

In step 311 and step 313, the ratio of the pattern FCI (PB [1] ∪PB [2] ∪PB [3]) to the first and second item FCI (PB [1] ∪PB [2]) of the pattern is Tests whether the current period is significantly greater than the previous period.
For example, if the contact process of the exchange accident at the store A is significantly increased from the exchange accident at the store A, one of the conditions extracted as an abnormal increase pattern is satisfied.

In step 312 and step 313, the ratio of the pattern FCI (PB [1] ∪PB [2] ∪PB [3]) to the first and third item FCI (PB [1] ∪PB [3]) of the pattern is Tests whether the current period is significantly greater than the previous period.
For example, if the counter process of the exchange accident at the store A is significantly increased from the counter process at the store A, one of the conditions extracted as an abnormal increase pattern is satisfied.

When an abnormal increase pattern is extracted, the number of pattern items is three, and there is no abnormality in a pattern with a small number of items, the following three tests are performed.
In step 317 and step 320, the pattern FCI for the second and third item FCI (PB [2] ∪PB [3]) − FCI (PB [1] ∪PB [2] ∪PB [3]) other than the pattern is determined. The ratio of (PB [1] ∪PB [2] ∪PB [3]) is tested to see if the current period is significantly higher than the previous period.
For example, if a store A has a currency exchange accident and a window process significantly increased compared to other stores, one of the conditions extracted as an abnormal increase pattern is satisfied.

In step 318 and step 320, the ratio of pattern FCI (PB [1] ∪PB [2] ∪PB [3]) to the first item FCI (PB [1]) of the pattern is more significant in the current period than in the previous period. It is tested whether there are many.
For example, if the exchange accident counter process at store A is significantly greater than all accidents at store A, one of the conditions extracted as an abnormal increase pattern is satisfied.

In step 319 and step 320, the ratio of the pattern FCI (PB [1] ∪PB [2] ∪PB [3]) to the first and third item FCI (PB [1] ∪PB [3]) of the pattern is Tests whether the current period is significantly greater than the previous period.
For example, if the counter process of the exchange accident at the store A is significantly increased from the counter process at the store A, one of the conditions extracted as an abnormal increase pattern is satisfied.

  FIG. 9 is an example of an abnormal frequent pattern list displayed on the display device 25 of the client terminal 2.

FIG. 10 is an example of an abnormal increase pattern list displayed on the display device 25 of the client terminal 2.
Each row of the abnormal pattern list is each abnormal pattern, and each column of the abnormal pattern list is an event occurrence factor of each item of the abnormal pattern.

  Furthermore, the number of risk events in the current period of the pattern and the increase / decrease in the number of risk events from the previous period to the current period of the pattern may be added as columns of the abnormal pattern list.

DESCRIPTION OF SYMBOLS 1 Analysis server apparatus 11 Central processing unit 12 Main storage apparatus 13 Auxiliary storage apparatus 14 Network communication apparatus 15 Analysis program 16 Database 2 Client terminal 21 Central processing unit 22 Main storage apparatus 23 Auxiliary storage apparatus 24 Network communication apparatus 25 Display apparatus 26 Input device 3 Network 4 Abnormal frequency pattern extraction unit 5 Abnormal increase pattern extraction unit 6 Operational risk event table

Claims (2)

A database for storing an operational risk event table storing an operational risk event composed of a plurality of event occurrence factors;
If the number of items in the combination pattern of event occurrence factors stored in the database is 2, if the ratio of the pattern to the first item of the pattern is significantly greater than the ratio of the second item of the pattern to the total number of data First abnormal frequent pattern extraction means for extracting as an abnormal frequent pattern;
When the number of items in the combination pattern of event occurrence factors stored in the database is 3 and there is an abnormality in the pattern with a small number of items, the ratio of the pattern to the first item and the second item of the pattern is 2 The ratio of the pattern to the first item and the second item of the pattern is significantly larger than the ratio of the second item and the third item of the pattern to the item, and the ratio of the pattern to the first item and the second item of the pattern is the first item and 3 of the pattern. A second abnormal frequent pattern extraction means for extracting as an abnormal frequent pattern if it is significantly greater than the ratio of the item;
If the number of items in the combination pattern of event occurrence factors stored in the database is 3 and there is no abnormality in the pattern with a small number of items, the ratio of the pattern to the first item of the pattern is 2 of the pattern with respect to the total number of data items. Significantly more than the ratio of the item and the third item, and the ratio of the pattern to the first item and the second item of the pattern is higher than the ratio of the first item and the third item of the pattern to the first item of the pattern, An operational risk analysis server device comprising: a third abnormal frequency pattern extraction unit that extracts an abnormal frequency pattern if it is significantly higher. A database for storing an operational risk event table storing an operational risk event composed of a plurality of event occurrence factors;
In the case where the number of event occurrence factor combination patterns stored in the database is 2, if the ratio of the pattern to the second item other than the pattern is significantly greater than the previous period, the abnormal increase pattern First abnormal increase pattern extraction means for extracting as:
If the number of items in the combination pattern of event occurrence factors stored in the database is 3 and the number of minority items is abnormal, the ratio of the pattern to the second and third items other than the pattern is the current period. Is significantly greater than the previous period, and the pattern ratio for the first and second items of the pattern is significantly greater than the previous period, and the pattern for the first and third items of the pattern If the current period is significantly higher in the current period than in the previous period, a second abnormal increase pattern extracting means for extracting as an abnormal increase pattern;
If the number of items in the combination pattern of event occurrence factors stored in the database is 3 and there is no abnormality in the pattern with a small number of items, the ratio of the pattern to the second and third items other than the pattern is the current period. Is significantly higher than the previous period, and the ratio of the pattern to the first item of the pattern is significantly higher than the previous period, and the ratio of the pattern to the first and third items of the pattern is An operational risk analysis server apparatus comprising: a third abnormal increase pattern extraction unit that extracts an abnormal increase pattern if the current period is significantly greater than the previous period.

Images