JP6563357B2 - Model judgment apparatus, model judgment method, and program - Google Patents

Description

  The present invention relates to a technique for determining a time series model suitable for input time series data.

  Methods for calculating the characteristics of time-series data and time-series models for reproducing time-series data have been studied for a long time, and various techniques have been devised. An application that provides a function for analyzing time series data is widely used for data analysis.

  By using such an application, it is possible to calculate the characteristics of time-series data relatively easily. In addition, when time series data and an arbitrary order are input to the function of the time series model, the degree of fit with the time series data can be calculated.

Japanese Unexamined Patent Publication No. 07-114531

  Conventionally, determination of a time-series model suitable for time-series data has been performed by judgment of a person (analyst) as described below.

  Specifically, the time series model that can be applied is determined by the characteristics of the time series data (presence / absence of periodicity (seasonality), presence / absence of trend, stationarity, form of autocorrelation function, form of partial autocorrelation function, etc.) The analyst calculates the characteristics of the time series data, visually determines the presence / absence of periodicity (seasonality), the shape of the graph of the autocorrelation function, and the like, and selects an appropriate time series model.

  In addition, when the time series data is increasing exponentially, for example, there may be no applicable time series model unless pre-processing for logarithmically converting the time series data to create a logarithmic series is performed. In addition, when the time series data shows periodic fluctuations, it may be possible to determine a time series model with a better degree of matching by making a difference series by converting the time series data. Thus, it is often the case that the time series data needs to be converted to determine the shape of the graph of the time series data with the eyes of the analyst.

  Time-series data may contain a lot of noise or there may be variations in sampling intervals, and it is necessary to round the data in a certain time unit to create input data. When the rounding unit is lengthened, the influence of noise is reduced, and a time series model with high fitness is obtained. On the other hand, when the length is too long, the characteristics of the time series data to be obtained by time series modeling disappear and the prediction granularity is rough. There is also a problem of becoming. Therefore, in order to obtain a time series model having a high degree of fitness that is not affected by noise, it is important to determine an optimal rounding unit that is neither long nor short. In addition, the characteristics of the time series data change depending on the rounding unit of the data, so that the time series model to be applied changes. Therefore, in order to create a time-series model that best fits the time-series data at present, it is necessary for the analyst to calculate the time-series model that adapts to the rounding unit of the data by trial and error, which is very time-consuming. .

  As described above, the modeling work for determining the time series model suitable for the time series data is a difficult task and takes time.

  The present invention has been made in view of the above points, and provides a technique that makes it possible to easily determine a time-series model suitable for time-series data in a plurality of rounding units and compare them according to fitness. For the purpose.

According to an embodiment of the present invention, a model determination device that determines a time-series model that matches input time-series data,
Based on the sampling interval and the data period of the time series data, a plurality of rounding units to be applied to the time series data are determined, and for each rounding unit, rounding processing in the rounding unit is performed on the time series data. A rounding means for executing and obtaining time series data after rounding;
For each rounding unit , calculate the characteristic value of the time-series data after the rounding process, and compare the characteristic value with a predetermined threshold value to estimate the time-series model suitable for the time-series data after the rounding process. A time series model estimating means for performing,
Applying the time series model estimated by the time series model estimation means to the rounded time series data for each rounding unit, thereby matching the time series model with the rounded time series data And a time series model applying means for determining a parameter that optimizes
A model determination device is provided that outputs a list of information including rounding units and time series models arranged in order of goodness of fit .

Further, according to the embodiment of the present invention, a model determination method executed by a model determination apparatus that determines a time-series model that matches input time-series data,
Based on the sampling interval and the data period of the time series data, a plurality of rounding units to be applied to the time series data are determined, and for each rounding unit, rounding processing in the rounding unit is performed on the time series data. A rounding step to execute and obtain the time series data after rounding,
For each rounding unit , calculate the characteristic value of the time-series data after the rounding process, and compare the characteristic value with a predetermined threshold value to estimate the time-series model suitable for the time-series data after the rounding process. A time series model estimation step,
By applying the time series model estimated by the time series model estimation step to the time series data after the rounding process for each rounding unit , the goodness of fit between the time series model and the time series data after the rounding process Applying a time series model to determine the parameter that best represents
And a step of outputting a list of information including rounding units and time series models arranged in order of goodness of fit .

  According to the embodiment of the present invention, there is provided a technique that makes it possible to easily determine a time series model suitable for time series data by a plurality of rounding units and compare them with the degree of fitness.

It is a functional lineblock diagram of model judging device 100 in an embodiment of the invention. 3 is a flowchart illustrating an overall processing procedure of the model determination apparatus 100. It is a figure for demonstrating a data period analysis and rounding process. It is a figure for demonstrating a data period analysis and rounding process. It is a figure for demonstrating a data period analysis and rounding process. It is a flowchart which shows the procedure of a data period analysis and rounding process. It is a flowchart which shows the procedure of a time series model estimation process. It is a flowchart which shows the procedure of a time series model estimation process. It is a figure which shows the example of the graph of an autocorrelation. It is a flowchart which shows the procedure of a time series conversion process. It is a flowchart which shows the procedure of a time series model application process. It is a flowchart which shows the procedure of a time series model application process. It is a flowchart which shows the procedure of a time series model comparison process. It is a figure which shows the example of the graph of an evaluation parameter | index. It is a figure which shows the other example of the model determination apparatus.

  Hereinafter, an embodiment (this embodiment) of the present invention will be described with reference to the drawings. The embodiment described below is only an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

(Device configuration)
FIG. 1 shows a configuration example of a model determination apparatus 100 in the present embodiment. As shown in FIG. 1, the model determination apparatus 100 includes an input unit 101, a data storage unit 102, a data period analysis / rounding processing unit 103, a time series model estimation unit 104, a time series conversion unit 105, and a time series model application unit 106. The time series model comparison unit 107 and the output unit 108 are provided. The outline of each part is as follows.

  The input unit 101 inputs time series data to be subjected to time series modeling. The data storage unit 102 stores input time-series data, results obtained by the respective function units, and the like. The data period analysis / rounding processing unit 103 determines a plurality of types of rounding units suitable for the input time-series data, and performs rounding processing on the time-series data for each determined rounding unit.

  The time series model estimation unit 104 estimates (determines) a time series model suitable for time series data that has undergone rounding processing for each rounding unit. The time series conversion unit 105 executes the time series conversion process when the time series model estimation unit 104 determines that the time series conversion process is necessary.

  The time-series model application unit 106 relates to the time-series data obtained for each rounding unit / time-series conversion, with respect to the time-series model determined by the time-series model estimation unit 104 while changing parameters (coefficients and orders). The degree of fitness with the series data is calculated, and the parameter with the best fitness is determined as the optimum parameter.

  The time-series model comparison unit 107 arranges the time-series models calculated by the time-series model application unit 106 using the optimum parameters determined for each rounding unit and each time-series conversion in the order of the obtained goodness of fit. At the same time, an evaluation index for determining the validity of each time series model and time series data is calculated and graphed. Further, the time series model comparison unit 107 performs prediction based on each time series model. The output unit 108 outputs the processing result (information of arranged time series models, graphs, etc.) in the time series model comparison unit 107.

  The model determination apparatus 100 (FIGS. 1 and 15) according to the present embodiment can be realized, for example, by causing a computer to execute a program describing the processing contents described in the present embodiment. That is, the function of the model determination apparatus 100 is realized by executing a program corresponding to the process executed by the model determination apparatus 100 using hardware resources such as a CPU, a memory, and a hard disk built in the computer. Is possible. The above-mentioned program can be recorded on a computer-readable recording medium (portable memory or the like), stored, or distributed. It is also possible to provide the program through a network such as the Internet or electronic mail.

  The program includes, for example, a set of functions (modules) that perform various statistical processes. In this embodiment, “R”, which is statistical analysis software, is used as an application that provides a set of functions (modules). However, this is an example, and for example, existing statistical analysis software can be used. Instead, a program for each function may be constructed and used.

  Hereinafter, an operation example of the model determination apparatus 100 will be described with reference to a sequence diagram and the like.

(Overall procedure)
FIG. 2 is a flowchart showing the overall flow of processing executed by the model determination apparatus 100. As shown in FIG. 2, first, time series data to be subjected to time series modeling is input from the input unit 101 (step S100).

  Next, the data period analysis / rounding processing unit 103 determines a plurality of types of rounding units suitable for the input time-series data, and performs rounding processing on the time-series data for each determined rounding unit (step S200). Then, the time series model estimation unit 104 estimates a time series model suitable for the time series data that has undergone rounding processing for each rounding unit (step S300). Further, the time series conversion unit 105 executes time series conversion processing as necessary (step S400).

  Subsequently, the time series model application unit 106 changes the parameters (coefficients and orders) of the time series model determined by the time series model estimation unit 104 for each rounding unit and each time series conversion while changing parameters (coefficients and orders). The fitness is calculated, and the parameter with the best fitness is determined as the optimal parameter (step S500).

  Then, the time series model comparison unit 107 arranges the information of the time series model in the order of fitness obtained for each rounding unit / time series conversion, and determines the validity of each time series model and time series data. The evaluation index is calculated, graphed, and further predicted by each time series model, and the result is output via the output unit 108 (step S600).

  Hereinafter, the processing of steps S200 to S600 will be described in more detail. In the following, various threshold values are used, but the threshold values are examples and are not limited thereto.

(S200: Data period analysis / rounding process)
In the present embodiment, the data period analysis / rounding processing unit 103 automatically calculates a maximum of four and at least one recommended rounding unit from the input sampling interval of the time series data and the data acquisition period, The time series data is rounded in the recommended rounding unit, and time series data for each rounding unit is output.

  A rounding method performed by the data period analysis / rounding processing unit 103 will be described with reference to FIGS.

  The graph in FIG. 3 shows an image of input time series data. As shown in FIG. 3, I indicates a data sampling interval. L is a data period, which indicates the period of the entire input data. For example, if the data is for one year, L is one year. R represents a rounding unit. The data period analysis / rounding processing unit 103 may automatically calculate I by obtaining an average of the sampling intervals I of the time series data, or may have the user input I. Also, the data period L may be calculated from the start and end of the time series data, or L may be input from the user.

  As shown in FIGS. 3A and 3C, in this embodiment, each of I and L is divided into predetermined intervals. For example, in the example of FIG. 3A, I in section 3 indicates that I is 1 minute or more and 1 hour or less. As shown in FIG. 3B, the rounding unit to be selected is also divided into sections.

  Further, from the relationship of I ≦ R <L and empirical rules, combinations indicated by ◯ in FIG. 4A are determined in advance as possible combinations of I and R, and possible combinations of R and L are illustrated in FIG. Combinations indicated by ◯ in (b) are determined in advance, and data indicating these combinations is stored in the data storage unit 102.

  The combination shown in FIG. 4A is inevitably obtained from the relationship I ≦ R. For example, in the case of I category 3 (1 min <I ≦ 1 hour), the rounding unit is one hour or more. In the combination shown in FIG. 4B, there are a point that is inevitably determined from the relationship of R <L and a point determined by an empirical rule. The point that is inevitably determined from the relationship of R <L is, for example, that R is set to one week or less in the division 6 of L. Also, in L category 6, R category 1 (1 second) and category 2 (1 minute) are not included in the combination, but this is based on empirical rules for L category 6 in 1 second. This is because it is known that even if rounding processing or rounding processing in one minute is performed, there is not much effect.

  The data period analysis / rounding processing unit 103 sets the R set corresponding to I of the time-series data among the combinations shown in FIG. 4A and the L of the time-series data among the combinations shown in FIG. The logical product with the R set corresponding to is determined as the R set to be used for the time-series data. FIG. 5 is a diagram illustrating the R division for each combination of the I division and the L division.

  For example, when the I division of the time-series data is 3 (1 min <I ≦ 1 hour) and the L division is 5 (1 week <L ≦ 1 month), a set of R from the combination shown in FIG. As a result, 3 to 8 are obtained. Moreover, 2-5 are obtained as a set of R from the combination shown in FIG.4 (b). Therefore, as the rounding unit R used for the time series data, 3, 4, and 5 are obtained by taking the logical product of 3-8 and 2-5. In this case, rounding processing of time series data is performed using R = 1 hour, 6 hours, and 1 day. That is, in this case, time-series data after three rounding processes is generated. As a rounding method, there are a method of adding data for each rounding section, a method of taking an average, and the like. This method may be selected and input by the user, or rounding may be performed by each method. When rounding is performed by each method, time series data after rounding is generated accordingly. For example, when there are three types of R and two types of rounding processing methods, six types of time-series data after rounding processing are generated.

  FIG. 6 is a flowchart illustrating a procedure of processing executed by the data period analysis / rounding processing unit 103. As shown in FIG. 6, first, a rounding method is selected and input (step S201). The data period analysis / rounding processing unit 103 determines the data period (L division) and the sampling interval (I division) of the time series data, for example, by analyzing the time series data (steps S202 and S203). .

  Then, the data period analysis / rounding processing unit 103 determines one or a plurality of rounding units for the time series data by the method described above, and executes rounding processing for the time series data using each rounding unit. Each time-series data subjected to the rounding process is stored in the data storage unit 102 and read out in the next process.

(S300: time series model estimation process, S400: time series conversion process)
Next, time series model estimation processing and time series conversion processing will be described in detail with reference to FIGS. Below, the process regarding one time series data obtained by the rounding process of a certain rounding unit is demonstrated. The process described below is performed on the time series data of each rounding unit (and after each time series change if necessary). Hereinafter, a function implemented in an application “R” that provides a function for time series data analysis will be described as an example.

  In step S301 in FIG. 7, first, the time series model estimation unit 104 calculates periodicity by applying a frequency function to time series data (data in the figure). The calculation result is put in freq.data. When freq.data is other than 1, it is determined that there is periodicity. Next, the time series model estimation unit 104 determines whether there is a trend in the time series data by applying an aggregate function to the time series data (steps S302 and S303). In this example, when the absolute value of the slope of the graph is 0.1 or more, it is determined that there is a trend, and 1 is set in trend.data.

  Subsequently, the time series model estimation unit 104 determines continuity by applying the CADFtest function (step S305). Here, the periodicity value obtained in step S301 is used as one of the parameters. As a result of the calculation in step S305, if the obtained p-value (probability that the null hypothesis is established) is smaller than 0.05, it is determined that it is stationary (steps S306 and S307). It determines with it being steady (step S306, S308).

  If it is determined to be steady, the process proceeds to step S309, and it is determined whether time series conversion has been performed (step S309). The time series conversion process will be described later. If time-series conversion has been performed, the process proceeds to step S310, and the process is divided depending on whether or not there is a trend. If there is a trend (No in step S310), the model is determined to be SARIMA (seasonal autoregressive integrated moving average) (step S311). If there is no trend (Yes in step S310), the model is determined to be ARIMA (autoregressive integrated moving average) (step S312).

  If No in step S309, the process proceeds to step S313, and an autocorrelation test is performed by applying the acf function. The autocorrelation is an index indicating whether or not data at a certain time point has a correlation with data at a different time point, and a difference between the time points is called a lag. If there is an autocorrelation, data at a certain time can be explained using data at a different time, which is very important information for estimating a time series model.

  As a result of the calculation in step S313, if the obtained p value is not smaller than 0.05, it is determined that there is no autocorrelation (No in step S314, S315), and if it is smaller than the threshold value 0.05, it is determined that there is autocorrelation (step). Yes in S314, S322).

  When there is no autocorrelation, the expected value and the autocovariance are calculated (step S316), and it is determined whether or not “expected value = 0 and autocovariance = 0 (in a lag other than 0)” (step S317).

  If the determination result in step S317 is No, the process is terminated because the model cannot be estimated (step S318). If the determination result in step S317 is Yes, the presence / absence of time series conversion is determined (step S319), and if Yes, the model is determined as a random walk (step S320). If No, the model is determined as white noise (step S321).

  On the other hand, when there is autocorrelation (step S322), the autocorrelation strength is determined by applying the acf function (step S323).

  In step S324 in FIG. 8, it is determined whether or not the value of acf in each lag other than 0 is 0.2 or more. FIG. 9 is a diagram illustrating an example of a graph when the value of acf is 0.2 or more. If the determination result in step S324 of FIG. 8 is Yes, it is determined that there is a strong autocorrelation (step S325), and it is determined whether acf.weak is 1 (step S326). acf.weak is a variable that has an initial value of 0 and becomes 1 when there is weak autocorrelation. Here, it is determined whether there is originally a strong autocorrelation or whether a weak autocorrelation is once determined to have a strong autocorrelation by the square transformation. If the determination result in step S326 is Yes, the model is determined as GARCH (generalized ARCH ((autoregressive conditional heteroskedasticity)) (step S327).

  If the determination result in step S326 is No, the process proceeds to step S328 to perform autocorrelation disconnection determination. Here, when 10 or more lags having a value of acf of 0.05 or less continue between lag 2 and lag 30, autocorrelation is cut. If autocorrelation is cut (Yes in step S329), partial autocorrelation cut is determined by applying the pacf function (step S330). Also here, when there are 10 or more consecutive lags having a pacf value of 0.05 or less between the lag 2 and the lag 30, it is determined that partial autocorrelation is cut. If there is no partial autocorrelation cutting (No in step S331), the model is determined to be MA (moving average) (step S332). When there is partial autocorrelation cutting (Yes in step S331), estimation is impossible, but an ARMA (autoregressive moving average) model may be applicable, so the model is determined to be ARMA (step S334).

  When the determination result of step S329 is No, the process proceeds to step S335, and partial autocorrelation disconnection determination is performed (step S335). Also here, when there are 10 or more consecutive lags having a pacf value of 0.05 or less between the lag 2 and the lag 30, it is determined that partial autocorrelation is cut. If there is partial autocorrelation cutting (Yes in step S336), the model is determined to be ARMA (step S334). If No, the model is determined to be AR (Autoregressive) (step S337).

  On the other hand, if the determination result in step S324 is No, it is determined that the autocorrelation is weak (step S338). If it is determined, the process proceeds to step S328 to execute the processing already described. When acf.weak is 0, acf.weak is set to 1 (step S340), time-series data is square-transformed (steps S341 and S342), and the process returns to step S323.

  As a result of the determination of continuity in FIG. 7 (step S306), when it is determined that it is unsteady (step S308), the time series conversion unit 105 executes the time series conversion process shown in FIG. In FIG. 10, each of log, difflog, diff, and ndiff has an initial value of 0, and is a variable that becomes 1 when logarithmic conversion, logarithmic difference conversion, first-order difference conversion, and n-th order difference conversion are performed.

  In step S401, when it is determined that any of the above is performed (in the case of No), in order to avoid repeating the conversion infinitely, the process is terminated as estimation impossible.

  If the determination in step S401 is Yes, for example, first, logarithmic conversion (S403 to S405) is performed, and the processing from S301 is performed on the time-series data after conversion, and if it is steady (Yes in step S306). The model is determined by the processing described so far. Next, logarithmic difference conversion (S403 to S405) is performed again on time-series data that has not been subjected to time-series conversion (the same data as before the logarithmic conversion is performed), and steady (Yes in step S306). ), The model is determined by the processing described so far. Next, again for time-series data that has not been subjected to time-series conversion (the same data as the data before the logarithmic conversion described above), first-order difference conversion or n-th order difference conversion (depending on the case of S412, S409). -S411, S413-S415), and if it is steady (Yes in step S306), the model is determined by the processing described so far. With such a process, if three conversions are performed, three converted time-series data are obtained. In place of such processing, the logarithmic conversion, logarithmic difference conversion, first-order difference conversion, and n-th order difference conversion of FIG. 10 are sequentially performed in this order, and at the stage determined to be steady by time-series conversion, Other time series conversion may not be performed.

(S500: time series model application process)
Next, the time series model application processing executed by the time series model application unit 106 will be described with reference to FIGS. 11 and 12.

  In the time series model application process, the degree of fitness (Akaike information amount) with time series data is changed for each time series data while changing the parameters (coefficients and order) of the applied time series model determined in the previous process. Criteria: AIC) is calculated. The time series data for which the fitness is calculated is data that has been subjected to the corresponding rounding process. In addition, when time series conversion is performed, the data is further subjected to the time series conversion. In the present embodiment, the fitness is calculated using the Akaike Information Criterion (AIC), but may be calculated using other criteria.

  The specific processing contents are as shown in FIGS. That is, if the estimation result obtained by the time series model estimation process is estimation impossible, white noise, or random walk, all modeling is impossible and AIC is set to 9999 (steps S501 to S506). In other cases, the corresponding time series model is applied to the time series data while changing the parameters, and the parameter (coefficient and order) that minimizes the AIC is determined as the optimum parameter (steps S507 to S518).

  For example, four types of rounding processing (A, B, C, D) are performed on the first input time series data, and two types of time series conversion (H1, H2) are performed for B. If this is done, the following five types of data will be obtained at this point.

  (Data 1) Time series data with rounding units A and A, applied time series model, parameter for minimizing AIC, AIC.

  (Data 2) Rounding unit B, time series conversion H1, time series data subjected to B and H1, applied time series model, parameter for minimizing AIC, AIC.

  (Data 3) Rounding unit B, time series conversion H2, time series data subjected to B and H2, applied time series model, parameter for minimizing AIC, AIC.

  (Data 4) Time series data subjected to rounding units C and C, applied time series model, parameter for minimizing AIC, AIC.

  (Data 5) Time series data subjected to rounding units D and D, applied time series model, parameter for minimizing AIC, AIC.

(S600: time series model comparison process)
Next, time series model comparison processing executed by the time series model comparison unit 107 will be described with reference to the flowchart of FIG.

  The time series model comparison processing unit 107 creates a list in which the data obtained in step S500 is arranged in ascending order of AIC (the smallest one is first), and outputs the list from the output unit 108 (step S601). For example, in the above example, when the size of the AIC is “data 2 <data 3 <data 1 <data 5 <data 4”, the data arranged in this order is output. Each output data is displayed on a display, for example. Here, only the one with the smallest AIC may be output.

  Further, the time series model comparison processing unit 107 calculates and graphs each model and an evaluation index for determining the validity of each data for each data obtained in step S500, and outputs the graph from the output unit 108 (step S602). Although the evaluation index is not limited to a specific one, for example, the following evaluation indexes (1) to (3) can be used.

(1) Residual difference between time series data and time series model (model prediction value-actual measurement value)
(2) Autocorrelation between residuals of time series data and time series model (3) Test whether residual of time series data and time series model can be regarded as white noise FIG. 14 (a) shows time series data and time series An example of a model residual is shown. FIG. 14B shows an example of the autocorrelation of the residual between the time series data and the time series model. FIG. 14C shows a test plot of whether the residual is white noise. If it is not below the dotted line, it can be regarded as white noise. Although it is not essential to perform such output / display, by performing such output / display, the user can easily grasp how much the model is adapted to the actual measurement value.

  In addition, the time-series model comparison processing unit 107 creates and outputs an application model prediction (eg, up to 100 terms) graph for each data obtained in step S500 (step S603).

(Application examples)
The model determination apparatus 100 in the present embodiment can be applied to various fields. For example, in the communication service field such as service provision via a network by a server, the time series model determination technology described so far is applied to the log (learning data) of the number of accesses from the user terminal to the server, and the time series A model can be determined, and the number of future accesses can be predicted using the time series model. Also, when the predicted value of the time series model is compared with the actual measurement value, if the actual measurement value greatly exceeds or falls below the predicted value, an abnormality (attack, failure, concentration of access, etc.) has occurred. It can also be determined.

  FIG. 15 is a functional configuration diagram of the model determination device 100 corresponding to the application example described above. The model determination apparatus 100 illustrated in FIG. 15 includes a model determination unit 151, a prediction unit 152, and an abnormality determination unit 153.

  The model determination unit 151 has the configuration of the model determination apparatus 100 illustrated in FIG. 1 and performs the time-series model determination process described so far. For example, the model determination unit 151 receives the access log data as input data, and determines an optimal time series model suitable for the access log data. More specifically, for example, a time series model and parameters that minimize AIC are determined and output.

  The prediction unit 152 calculates a future predicted value from the time series model determined by the model determination unit 151. The abnormality determination unit 153 receives the current log (number of accesses) and the prediction unit 152 receives the predicted value (predicted number of accesses) corresponding to the current time. For example, the abnormality determination unit 153 outputs a result indicating “abnormal” when the absolute value of the difference between the predicted access number and the access number is larger than a predetermined threshold value.

  In addition to the above example, the unauthorized access is identified from the past access log, the access log is used as learning data, and the time series model determination technology described so far is applied, and the unauthorized access pattern is time-series. It is also possible to determine a model and determine that the user has accessed with an access pattern close to the time series model using the time series model as unauthorized access. When it is determined that the access is unauthorized, it is possible to take measures such as blocking the user or disabling the service.

  Such a process can also be executed by the model determination apparatus 100 shown in FIG. In this case, the model determination unit 151 determines a time series model of an unauthorized access access pattern, the prediction unit 152 predicts a future access pattern of unauthorized access using the time series model, and the abnormality determination unit 153 Then, the predicted value and the actually measured value (current access pattern of each user) are compared, and the user having the actually measured value close to the predicted value is specified. For example, the abnormality determination unit 153 executes an instruction to the access device so as to block access from the user, for example.

(Effect of embodiment)
In the prior art, when deciding on a time-series model that matches time-series data, rounding, time-series conversion, and narrowing down of the time-series model were performed through repeated trial and error based on human judgment. In the embodiment, a rounding process and time series conversion suitable for time series data are automatically performed, and an optimum time series model and fitness are calculated for each processed input data, and a list of time series models is obtained. Can be presented. As a result, even a person who has no academic knowledge about the analysis of time series data can easily perform modeling.

(Summary of embodiment)
As described above, according to the present embodiment, a model determination device that determines a time-series model that matches input time-series data, based on the sampling interval and the data period of the time-series data, A rounding unit that determines a rounding unit to be applied to the time series data, performs rounding processing in the rounding unit on the time series data, and obtains time series data after rounding; and after the rounding process Calculating a characteristic value of the time-series data, and comparing the characteristic value with a predetermined threshold value to estimate a time-series model suitable for the time-series data after the rounding process; and By applying the time series model estimated by the time series model estimation means to the time series data after the rounding process, the goodness of fit between the time series model and the time series data after the rounding process Model determining device is provided, characterized in that it comprises a time-series model application means for determining the parameters of the best. The above characteristic values include, for example, the presence / absence of periodicity (seasonality), presence / absence of trend, continuity, autocorrelation function, partial autocorrelation function, etc., but are not limited thereto. .

  The rounding processing unit determines a plurality of rounding units, executes rounding processing for each rounding unit to obtain time series data after rounding processing, and the time series model estimation unit rounds for each rounding unit. A time series model suitable for the time series data after processing is estimated, the time series model application means determines a parameter that optimizes the fitness for each rounding unit, and the model determination device A list of information including rounding units and time series models arranged in a good order may be output. The information list may further include a parameter.

  In the time series model estimation means, when it is determined that the time series data after rounding is non-stationary, time series conversion means for performing time series transformation on the time series data after rounding When the time series conversion is executed, the time series model estimation means uses the time series data after the time series conversion is executed as time series data after the rounding process as time series data. A model estimation process is executed, and the time series model application means executes a time series model application process using the time series data after the time series conversion is executed as the time series data after the rounding process.

  The rounding processing unit may extract a rounding unit to be applied to the time series data from a rounding unit candidate set predetermined for the data period. Further, the rounding processing unit may calculate a rounding unit obtained by a logical product of a rounding unit candidate set predetermined for the data period and a rounding unit candidate set predetermined for the sampling interval. It is good also as extracting as a rounding unit applied to time series data.

  Further, the model determination device includes a prediction unit that performs a future prediction using a time series model having parameters determined by the time series model application unit, a predicted value obtained by the prediction unit, and an actual measurement value It is good also as providing the abnormality determination means which performs abnormality detection by comparing.

(Section 1)
A model determination device that determines a time-series model that matches input time-series data,
Based on the sampling interval and the data period of the time series data, determine a rounding unit to be applied to the time series data, execute a rounding process in the rounding unit on the time series data, Rounding means for obtaining time series data;
Time series model estimation that calculates a characteristic value of the time series data after rounding and compares the characteristic value with a predetermined threshold to estimate a time series model suitable for the time series data after rounding Means,
A parameter that makes the best fit between the time series model and the time series data after rounding by applying the time series model estimated by the time series model estimation means to the time series data after rounding. Time series model application means to determine
A model determination apparatus comprising:
(Section 2)
The rounding means determines a plurality of rounding units, performs rounding processing for each rounding unit, and acquires time series data after rounding processing,
The time series model estimation means estimates a time series model suitable for time series data after rounding for each rounding unit,
The time series model applying means determines a parameter that optimizes the goodness of fit for each rounding unit,
The model determination device outputs a list of information including rounding units and time series models arranged in order of goodness of fit.
The model determining apparatus according to item 1, characterized in that:
(Section 3)
In the time series model estimation means, when it is determined that the time series data after rounding is non-stationary, time series conversion means for performing time series transformation on the time series data after rounding With
When the time series conversion is executed, the time series model estimation means executes time series model estimation processing using the time series data after the time series conversion is executed as the time series data after the rounding processing. The time-series model application means executes time-series model application processing using the time-series data after the time-series conversion is performed as the time-series data after the rounding process.
The model determination apparatus according to claim 1 or 2, wherein the model determination apparatus is characterized.
(Section 4)
The rounding processing unit extracts a rounding unit to be applied to the time series data from a rounding unit candidate set predetermined for the data period.
The model determination apparatus according to any one of Items 1 to 3, wherein the model determination device is characterized in that
(Section 5)
The rounding processing unit calculates a rounding unit obtained by a logical product of a rounding unit candidate set predetermined for the data period and a rounding unit candidate set predetermined for the sampling interval as the time series. Extract as rounding unit to apply to data
The model determining apparatus according to item 4, wherein
(Section 6)
Prediction means for performing future prediction using a time series model having parameters determined by the time series model application means;
An abnormality determination unit that performs abnormality detection by comparing the predicted value obtained by the prediction unit with an actual measurement value;
The model determination apparatus according to any one of Items 1 to 5, wherein the model determination device includes:
(Section 7)
A model determination method executed by a model determination device that determines a time-series model that matches input time-series data,
Based on the sampling interval and the data period of the time series data, determine a rounding unit to be applied to the time series data, execute a rounding process in the rounding unit on the time series data, A rounding step to obtain time series data;
Time series model estimation that calculates a characteristic value of the time series data after rounding and compares the characteristic value with a predetermined threshold to estimate a time series model suitable for the time series data after rounding Steps,
A parameter that optimizes the degree of matching between the time series model and the time series data after rounding by applying the time series model estimated by the time series model estimation step to the time series data after rounding. Time series model application step to determine
A model determination method comprising:
(Section 8)
The program for functioning a computer as each means in the model determination apparatus of any one of Claims 1 thru | or 6.
Although the present embodiment has been described in detail above, the present invention is not limited to the specific embodiment, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims. Is possible.

100 Model Determination Device 101 Input Unit 102 Data Storage Unit 103 Data Period Analysis / Rounding Processing Unit 104 Time Series Model Estimation Unit 105 Time Series Conversion Unit 106 Time Series Model Application Unit 107 Time Series Model Comparison Unit 108 Output Unit 151 Model Determination Unit 152 Prediction unit 153 Abnormality determination unit

Claims (7)

A model determination device that determines a time-series model that matches input time-series data,
Based on the sampling interval and the data period of the time series data, a plurality of rounding units to be applied to the time series data are determined, and for each rounding unit, rounding processing in the rounding unit is performed on the time series data. A rounding means for executing and obtaining time series data after rounding;
For each rounding unit , calculate the characteristic value of the time-series data after the rounding process, and compare the characteristic value with a predetermined threshold value to estimate the time-series model suitable for the time-series data after the rounding process. A time series model estimating means for performing,
Applying the time series model estimated by the time series model estimation means to the rounded time series data for each rounding unit, thereby matching the time series model with the rounded time series data And a time series model applying means for determining a parameter that optimizes
A model determination apparatus that outputs a list of information including rounding units and time series models arranged in order of goodness of fit . In the time series model estimation means, when it is determined that the time series data after rounding is non-stationary, time series conversion means for performing time series transformation on the time series data after rounding With
When the time series conversion is executed, the time series model estimation means executes time series model estimation processing using the time series data after the time series conversion is executed as the time series data after the rounding processing. The time-series model application unit executes time-series model application processing using the time-series data after the time-series conversion is performed as the time-series data after the rounding process. Model judgment device. Said rounding processing means, wherein among the units candidate set rounded predetermined for the data period, according to claim 1 or 2, wherein the extracting unit rounding applied to the time series data model Judgment device. The rounding processing unit calculates a rounding unit obtained by a logical product of a rounding unit candidate set predetermined for the data period and a rounding unit candidate set predetermined for the sampling interval as the time series. The model determination device according to claim 3 , wherein the model determination device is extracted as a rounding unit to be applied to data. Prediction means for performing future prediction using a time series model having parameters determined by the time series model application means;
Wherein the prediction value obtained by the prediction means, by comparing the measured values, according to claim 1 to model according to any one of the 4, characterized in that it comprises an abnormality determination means for performing abnormality detection Judgment device. A model determination method executed by a model determination device that determines a time-series model that matches input time-series data,
Based on the sampling interval and the data period of the time series data, a plurality of rounding units to be applied to the time series data are determined, and for each rounding unit, rounding processing in the rounding unit is performed on the time series data. A rounding step to execute and obtain the time series data after rounding,
For each rounding unit , calculate the characteristic value of the time-series data after the rounding process, and compare the characteristic value with a predetermined threshold value to estimate the time-series model suitable for the time-series data after the rounding process. A time series model estimation step,
By applying the time series model estimated by the time series model estimation step to the time series data after the rounding process for each rounding unit , the goodness of fit between the time series model and the time series data after the rounding process Applying a time series model to determine the parameter that best represents
And a step of outputting a list of information including rounding units and time series models arranged in order of goodness of fit . The program for functioning a computer as each means in the model determination apparatus of any one of Claims 1 thru | or 5 .

Images