JP7726841B2 - Anomaly detection system, anomaly detection method, and anomaly detection program - Google Patents

Description

The present invention relates to an anomaly detection system, an anomaly detection method, and an anomaly detection program.

For example, in industries that use project-based management, such as construction and systems development, where progress is accumulated over a period of time, there is a demand to "compare progress with similar projects from the past to determine whether the accumulation is appropriate."

In the past, if the construction period and actual results of a past project differed from the construction period and budget of the project for which anomalies were to be determined, it was not possible to compare how the data accumulated. Furthermore, when determining anomalies based on past projects whose construction periods and actual results match, the number of samples was small, resulting in judgment results with low validity. For example, Patent Document 1 discloses a conventional system for managing budgets and actual results.

JP 2015-95122 A

However, Patent Document 1 does not mention anything about detecting anomalies in a project by comparing the accumulation of performance data for the project with a threshold based on a large number of past projects.

The present invention was made in consideration of the above, and aims to provide an anomaly detection system, anomaly detection method, and anomaly detection program that can detect anomalies in a case by comparing a threshold based on a large number of past cases with the way the actual performance of the case in question has accumulated.

To solve the above-mentioned problems and achieve the objectives, the present invention provides an anomaly detection system equipped with a control unit, which is configured to be able to access budget data for a project to be detected for anomalies, including project identification information, construction period, and budget; performance data for the project to be detected for anomalies, including project identification information, number of months elapsed, and performance data; and performance data for multiple similar past projects that are similar to the project to be detected for anomalies, including project identification information, number of months elapsed, and performance data; the control unit scales the number of months elapsed and performance data for the multiple similar past projects to the budget data for the project to be detected for anomalies, calculates a threshold based on the number of months elapsed and performance data for the scaled performance data for the multiple similar past projects, and compares the performance data for the project to be detected for anomalies with the calculated threshold to determine an anomaly.

According to one aspect of the present invention, the control unit includes a scale unification means for performing a scale unification process to unify the scales by calculating, for each piece of performance data for the plurality of similar past projects, an elapsed time rate by dividing the number of elapsed months by the maximum number of elapsed months and an actual performance rate by dividing the actual performance by the maximum value of the actual performance; an equidistant point acquisition means for performing an equidistant point acquisition process to calculate, for each piece of performance data for the plurality of similar past projects after the scale unification process, a hypothetical elapsed time rate by dividing the progress rate axis by the construction period of the anomaly detection target project data, and to calculate a hypothetical performance rate corresponding to the hypothetical elapsed time rate for the actual performance; and a scale unification means for performing an equidistant point acquisition process to unify the scales for each piece of performance data for the plurality of similar past projects after the equidistant point acquisition process. The system is characterized by comprising: a scaling expansion means that performs a scaling expansion process to calculate a virtual number of elapsed months by multiplying a virtual elapsed rate by the construction period of the budget data for the case to be determined as an anomaly, and to calculate a virtual actual result by multiplying the virtual number of elapsed months by the budget data for the case to be determined as an anomaly; a threshold calculation means that performs a threshold calculation process to calculate a threshold from the average value and standard deviation of the virtual actual results for each virtual number of elapsed months based on the actual data for multiple similar past cases after the scaling expansion process; and an abnormality determination means that performs an abnormality determination process to compare the actual data for the case to be determined as an anomaly with the calculated threshold value and determine whether there is an abnormality.

Furthermore, according to one aspect of the present invention, the performance data of the plurality of similar past projects may have a relative error in construction period and/or budget of a predetermined percentage or less relative to the budget data of the project to be determined as abnormal.

Furthermore, according to one aspect of the present invention, the equally-spaced point acquisition means may, for each of the performance data of multiple similar past projects after scale unification processing, use the construction period of the budget data of the project to be determined as the number of divisions, use the range of 1/the number of divisions as the range of the progress rates of the equally-spaced points, and use the equally-spaced points as virtual progress rates, and calculate a virtual performance rate corresponding to each virtual progress rate from the relational expression between the progress rate and the performance rate.

Furthermore, according to one aspect of the present invention, the threshold calculation means may separate the performance data of multiple similar past cases after the scale expansion process into groups of data with matching hypothetical elapsed months, calculate the average value and standard deviation of the hypothetical performance for each group of data, calculate threshold data using the formula: upper threshold = hypothetical performance average value + threshold rate × standard deviation, and lower threshold = hypothetical performance average value - threshold rate × standard deviation, and select a threshold to be used for abnormality determination from the calculated threshold data.

Furthermore, according to one aspect of the present invention, the threshold value used for the abnormality determination may be selected by using the calculated threshold data as is for the abnormality determination, by providing an allowable range (= threshold rate x standard deviation) for the threshold value for the final month, by using only the upper threshold value, or by using only the lower threshold value.

Furthermore, according to one aspect of the present invention, the abnormality determination means may output an abnormality detection message to a display unit when an abnormality is determined.

Furthermore, according to one aspect of the present invention, the cases may include cases that are subject to project-based management.

In order to solve the above-mentioned problems and achieve the object, the present invention provides an anomaly detection method executed by an information processing device having a control unit, wherein the control unit is configured to be able to access budget data of a case that is a target of anomaly detection, including case identification information, a construction period, and a budget, performance data of the case that is a target of anomaly detection, including case identification information, the number of months that have passed, and performance data, and performance data of a plurality of similar past cases that are similar to the case that is a target of anomaly detection, including case identification information, the number of months that have passed, and performance data,
The method is characterized in that it includes a process executed by the control unit to adjust the number of elapsed months and actual results of the performance data of the plurality of similar past cases to the scale of the budget data of the case to be determined for an abnormality, calculate a threshold value based on the number of elapsed months and actual results of the scaled performance data of the plurality of similar past cases, and compare the performance data of the case to be determined for an abnormality with the calculated threshold value to determine an abnormality.

Furthermore, to solve the above-mentioned problems and achieve the objective, the present invention provides an anomaly detection program to be executed by an information processing device having a control unit, wherein the control unit is configured to be able to access budget data of a project to be detected for anomaly detection, including project identification information, construction period, and budget; performance data of the project to be detected for anomaly detection, including project identification information, number of months elapsed, and performance data; and performance data of a plurality of similar past projects that are similar to the project to be detected for anomaly detection, including project identification information, number of months elapsed, and performance data; the anomaly detection program causes the control unit to execute the steps of: adjusting the number of months elapsed and performance data of the performance data of the plurality of similar past projects to the scale of the budget data of the project to be detected for anomaly detection; calculating a threshold based on the number of months elapsed and performance data of the scaled performance data of the plurality of similar past projects; and comparing the performance data of the project to be detected for anomaly detection with the calculated threshold to determine an anomaly.

This invention has the advantage of making it possible to detect abnormalities in a case by comparing the accumulation of performance data for that case with a threshold based on a large number of past cases.

FIG. 1 is a diagram for explaining the background of the present invention. FIG. 2 is a diagram for explaining the problem to be solved by the present invention. FIG. 3 is a diagram for explaining the problem to be solved by the present invention. FIG. 4 is a block diagram showing an example of the configuration of the anomaly detection system according to this embodiment. FIG. 5 is a diagram showing a processing flow illustrating an example of the overall processing of the control unit of the anomaly detection system according to this embodiment. FIG. 6 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 7 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 8 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 9 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 10 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 11 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 12 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 13 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 14 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 15 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 16 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 17 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 18 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 19 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 20 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 21 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 22 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 23 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 24 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 25 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 26 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 27 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 28 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 29 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment.

An embodiment of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to this embodiment.

[1. Overview]
The present invention will be outlined in the order of background, problems, and solutions.

(1-1. Background)
The background of the present invention will be explained with reference to Fig. 1. In industries such as the construction industry and the system development industry, which use project-based management in which progress is accumulated over a period of time, there is a demand to "determine whether the accumulation method is appropriate by comparing it with similar past projects."

The anomaly detection system of the present invention can obtain a graph like the one shown in Figure 1. In Figure 1, the X axis represents the number of months elapsed (months) and the Y axis represents actual results (in 10,000 yen), showing the reference value calculated from similar past cases and the actual results of the case being judged for an anomaly. Values that allow a range for the reference value calculated from similar past cases are set as the upper and lower thresholds, and an anomaly is detected when the actual results of the case being judged for an anomaly deviate from the upper or lower threshold.

In this specification, "construction period" refers to the number of months planned until the completion of a project. "Budget" refers to the amount planned to be incurred until the completion of a project. "Number of months elapsed" refers to the number of months elapsed since the start of a project. "Actual results" refers to the amount incurred from the start of a project to the elapsed months.

(1-2. Issues)
The problems to be solved by the present invention will be described with reference to Figures 2 and 3. Conventionally, there are the following problems.

1. If comparisons are made only with past projects where the construction period and actual results match, the number of samples to compare is small, resulting in anomaly detection results that are of low validity.

2. If the construction periods and actual results of past projects differ, there is the issue of not being able to compare data.

More specifically, it is as follows:

1. When comparing only past projects with matching construction periods and actual results, the number of samples to compare is small, resulting in low validity of abnormality detection results. Specifically, when collecting data on past projects, if only those projects that match the construction period and budget of the project being detected as abnormal are extracted, the number of samples from past projects will be small. In this way, a small number of samples will result in low validity of abnormality detection results.

2. The issue of not being able to compare data when the construction period and actual results of past projects differ will be explained in detail with reference to Figures 2 and 3. This explains the case where you want to determine whether project A0001 is abnormal based on how the actual results of project B0001, which has already been completed in the past, have accumulated. As a premise, it is assumed that the actual data and budget data of the project to be determined to be abnormal, as well as the actual data of past projects to be compared, are stored as follows:

Figure 2 (A) shows an example of performance data for a project subject to abnormality detection, including the project code, number of months elapsed, and performance data. Figure 2 (B) shows an example of budget data for a project subject to abnormality detection, including the project code, construction period, and budget data. Figure 2 (C) shows performance data for past projects, including the project code, number of months elapsed, and performance data.

Figure 3 shows an image of a graph comparing the accumulation of the case being judged as abnormal with the accumulation of past comparable cases. Figure 3 shows the number of months elapsed and actual results for the past similar case (B0001) and the case being judged as abnormal (A0001) in Figure 2, with the X axis showing the number of months elapsed and the Y axis showing actual results (10,000 yen). Because the construction period and budget for the case being judged as abnormal differ from the construction period and actual results for the past comparable cases, it is impossible to determine whether the accumulation of actual results for the case being judged as abnormal is abnormal or not.

(1-3. Solution)
Therefore, as a solution to this problem, the present invention processes data so that the scale of the construction period and actual results of past projects matches the construction period and budget of the project being judged for anomalies. Specifically, the values of the number of months elapsed and actual results of past projects are compressed, and then the number of months elapsed and actual results are expanded to the construction period and budget of the project being judged for anomalies. This solution solves the following problems.

1. When comparing only past projects with matching construction periods and actual results, the number of samples to compare is small, resulting in anomaly detection results with low validity. However, by comparing with the project being detected as anomaly regardless of the construction periods and actual results of past projects, data can be collected regardless of construction periods and actual results.

2. To address the issue of being unable to compare data when the construction periods and actual results of past projects differ, by matching the construction periods and actual results of past projects to the construction period and budget of the project being identified as abnormal, it becomes possible to compare past projects with the project being identified as abnormal.

Specifically, (1) it can detect delays in project progress and revise plans. Furthermore, (2) it can detect overstated or fraudulent reporting of progress rates in an attempt to achieve targets, preventing fraudulent reporting of actual results that do not reflect reality.

The anomaly detection system of the present invention can be applied to all business types and industries, and is ideally suited to projects that involve project-based management, such as in the construction industry and IT media industry.

2. Configuration
An example of the configuration of the anomaly detection system 100 according to this embodiment will be described with reference to Fig. 4. Fig. 4 is a block diagram showing an example of the configuration of the anomaly detection system 100.

The anomaly detection system 100 is a commercially available desktop personal computer. Note that the anomaly detection system 100 is not limited to stationary information processing devices such as desktop personal computers, but may also be portable information processing devices such as commercially available notebook personal computers, PDAs (Personal Digital Assistants), smartphones, and tablet personal computers.

The anomaly detection system 100 includes a control unit 102, a communication interface unit 104, a memory unit 106, and an input/output interface unit 108. Each unit included in the anomaly detection system 100 is connected to each other so that they can communicate with each other via any communication path.

The communication interface unit 104 communicatively connects the anomaly detection system 100 to the network 300 via a communication device such as a router and a wired or wireless communication line such as a dedicated line. The communication interface unit 104 has the function of communicating data with other devices via the communication line. Here, the network 300 has the function of connecting the anomaly detection system 100 and the server 200 so that they can communicate with each other, and is, for example, the Internet or a LAN (Local Area Network).

An input device 112 and an output device 114 are connected to the input/output interface unit 108. The output device 114 may be a monitor (including a home television), a speaker, or a printer. The input device 112 may be a keyboard, a mouse, a microphone, or a monitor that functions as a pointing device in conjunction with a mouse. Note that, below, the output device 114 may be referred to as the monitor 114, and the input device 112 may be referred to as the keyboard 112 or the mouse 112. Displaying information on the monitor 114 and the user operating the input device 112 may be referred to as "user operation via a UI."

The storage unit 106 stores various databases, tables, files, and the like. The storage unit 106 stores computer programs that work in conjunction with the OS (Operating System) to issue commands to the CPU (Central Processing Unit) to perform various processes. The storage unit 106 can be, for example, a memory device such as RAM (Random Access Memory) or ROM (Read Only Memory), a fixed disk device such as a hard disk, a flexible disk, or an optical disk. The storage unit 106 includes a data table 106a, etc.

Data table 106a is a table for storing various data such as budget data and performance data for the case subject to abnormality detection, and performance data for multiple similar past cases.

Budget data for projects subject to abnormality detection may include the project code (project identification information), construction period, and budget. Actual performance data for projects subject to abnormality detection may include the project code (project identification information), number of months elapsed, and actual performance.

The performance data for multiple similar past cases is performance data for multiple past cases that are similar to the case being determined to be abnormal, and may include the case code (case identification information), number of months elapsed, and performance data.

The control unit 102 is a CPU or the like that provides overall control of the anomaly detection system 100. The control unit 102 has internal memory for storing control programs such as an OS, programs that define various processing procedures, and required data, and performs various information processing operations based on these stored programs.

The control unit 102 is configured to be able to access data tables 106a and the like stored in the memory unit 106. Note that the data table 106a may be stored elsewhere (e.g., on the server 200), as long as it is accessible by the control unit 102.

The control unit 102 conceptually includes a data acquisition unit 102a, a scale unification unit 102b, an equally spaced point acquisition unit 102c, a scale expansion unit 102d, a threshold calculation unit 102e, and an abnormality determination unit 102f.

The control unit 102 uses the performance data of multiple similar past cases stored in data table 106a to determine whether the performance data of the case to be determined as an anomaly, which is stored in data table 106a, is abnormal. Specifically, the control unit 102 adjusts the number of months elapsed and the results of the performance data of multiple similar past cases to the scale of the budget data of the case to be determined as an anomaly, calculates a threshold based on the number of months elapsed and the results of the scaled performance data of the multiple similar past cases, and automatically executes a series of processes to compare the performance data of the case to be determined as an anomaly with the calculated threshold and determine whether it is abnormal.

The data acquisition unit 102a acquires the budget data and performance data of the project to be detected as an anomaly, as well as performance data of multiple similar projects from the past, and stores them in the data table 106a. The performance data of multiple similar projects from the past may have a relative error in construction period and/or budget of less than a predetermined percentage compared to the budget data of the project to be detected as an anomaly.

The scale unification unit 102b calculates the elapsed rate by dividing the number of elapsed months by the maximum number of elapsed months, and the performance rate by dividing the performance by the maximum performance value, for each piece of performance data for multiple past similar cases, and performs scale unification processing to unify the scales.

The equally-spaced point acquisition unit 102c calculates a hypothetical progress rate for each of the performance data for multiple similar past projects after the scale unification process, dividing the progress rate axis by the construction period of the project data subject to abnormality judgment, and performs an equally-spaced point acquisition process to calculate a hypothetical performance rate corresponding to the hypothetical progress rate for the actual performance.

In this case, the equally-spaced point acquisition unit 102c may use the construction period of the budget data for the project to be determined as the number of divisions, the range of 1/the number of divisions as the range of the progress rates of the equally-spaced points, and the equally-spaced points as the hypothetical progress rates, and calculate (acquire) the hypothetical progress rate corresponding to each hypothetical progress rate from the relational expression between the progress rate and the achievement rate, for each of the performance data for multiple past similar projects after the scale unification process.

The scale expansion unit 102d executes a scale expansion process to calculate a hypothetical number of elapsed months by multiplying the hypothetical elapsed rate by the construction period of the budget data for the project to be determined as abnormal, for each of the performance data for multiple similar past projects after the equally spaced point acquisition process, and calculates a hypothetical performance by multiplying the hypothetical performance rate by the budget of the budget data for the project to be determined as abnormal.

The threshold calculation unit 102e executes a threshold calculation process to calculate a threshold from the average value and standard deviation of the hypothetical results for each hypothetical number of elapsed months, based on the performance data of multiple past similar cases after the scale expansion process.

In this case, the threshold calculation unit 102e may separate the performance data of multiple similar past cases after the scale expansion process into groups of data with matching hypothetical elapsed months, calculate the average value and standard deviation of the hypothetical performance for each group of data, calculate threshold data using the upper threshold = hypothetical performance average value + threshold rate × standard deviation and the lower threshold = hypothetical performance average value - threshold rate × standard deviation, and select the threshold value to be used for abnormality determination from the calculated threshold data.

The threshold used for abnormality determination can be selected by using the calculated threshold data as is, by giving the threshold for the final month a tolerance range (= threshold rate x standard deviation), by using only the upper threshold, or by using only the lower threshold.

The abnormality determination unit 102f executes an abnormality determination process by comparing the performance data of the case to be determined to be abnormal with the calculated threshold value to determine whether an abnormality has occurred. In this case, the abnormality determination unit 102f may output an abnormality detection message to the monitor 114 when it determines that an abnormality has occurred.

3. Specific Examples
Specific examples of processing by the control unit 102 of the anomaly detection system 100 according to this embodiment will be described with reference to Figures 4 to 29. Figure 5 is a diagram showing a processing flow for outlining the overall processing by the control unit 102 of the anomaly detection system 100 according to this embodiment. Figures 6 to 29 are diagrams for explaining specific examples of processing by the control unit 102 of the anomaly detection system 100 according to this embodiment.

(3-1. Overview of processing flow)
An overview of the processing flow will be described with reference to Figure 5. The scale unification unit 102b executes scale unification processing (step S1). In the scale unification processing, performance data of multiple similar past cases is normalized along two axes: the number of months elapsed (X axis) and the actual results (Y axis). Specifically, for each piece of performance data of multiple similar past cases, the number of months elapsed is divided by the maximum number of months elapsed for each case, and for each similar past case, the actual results are divided by the maximum value of the actual results for each case.

The equally-spaced point acquisition unit 102c executes the equally-spaced point acquisition process (step S2). In the equally-spaced point acquisition process, virtual actual results corresponding to the construction period of the budget data for the project to be diagnosed are obtained. Specifically, a relational expression is found between the number of months elapsed and the actual results, and the actual results corresponding to each number of months elapsed when the number of months elapsed is divided by the construction period of the project to be diagnosed are calculated.

The scale expansion unit 102d executes scale expansion processing (step S3). In the scale expansion processing, inverse normalization is performed on each of the two axes, the virtual elapsed time rate (X-axis) and the virtual actual volume rate (Y-axis), to align the scale with that of the project to be judged for anomalies. Specifically, the virtual elapsed time rate obtained by obtaining equally spaced points is multiplied by the construction period of the project to be judged for anomalies. In addition, the virtual actual volume rate obtained by obtaining equally spaced points is multiplied by the budget of the project to be judged for anomalies.

The threshold calculation unit 102e executes a threshold calculation process (step S4). In the threshold calculation process, the threshold is calculated from the average value and standard deviation of the hypothetical actual results for each number of elapsed months. Specifically, the average value and standard deviation are calculated for each data set with the same number of elapsed months, and the threshold is calculated.

The abnormality determination unit 102f executes the abnormality determination process (step S5). In the abnormality determination process, the performance data of the case to be determined to be abnormal is compared with a threshold calculated from performance data of multiple similar past cases to determine whether an abnormality has occurred. Specifically, the abnormality determination is performed based on whether the performance data of the case to be determined to be abnormal exceeds the threshold for each number of elapsed months.

(3-2. Processing flow details)
The details of the processing flow will be described with reference to FIGS.

(Actual data and budget data for the case subject to abnormality detection, as well as actual data for similar cases in the past)
The performance data and budget data of the case to be determined as an abnormality, as well as performance data of similar cases in the past, will be described with reference to FIGS. 6 and 7. FIG.

It is assumed that the data acquisition unit 102a has registered performance data and budget data for cases subject to abnormality detection in the data table 106a. In the following example, the case code for the case subject to abnormality detection is "A0001."

Figure 6 (A) shows an example of actual data for a project subject to abnormality detection, with fields for project code, number of months elapsed, and actual data. Figure 6 (B) shows budget data for a project subject to abnormality detection, with fields for project code, construction period, and budget. In Figure 6, the number of months elapsed for which actual results exist in the actual data (3 months) is less than the construction period in the budget data (6 months) because project "A0001" is currently in progress.

Data table 106a stores performance data for similar past cases. The data acquisition unit 102a extracts similar case data from the performance data for past cases using specified conditions, acquires the data, and stores it in data table 106a.

Examples of criteria for extracting similar projects include: (1) a relative error of 10% or less between the "construction period of the project to be judged as abnormal" and the "construction period of past projects," and (2) a relative error of 10% or less between the "budget of the project to be judged as abnormal" and the "final results of past projects."

When extracting projects with a relative error of 10% or less for the budget of "10 million yen" for project "A0001," past projects with final results between "9 million yen and 11 million yen" will be extracted.

In this example, the case codes for the past similar case data are "B0001" and "B0002." For simplicity, this explanation will use two cases as an example, but in reality, it is assumed that there will be many past similar cases to ensure the validity of the anomaly detection results.

Figure 7(A) shows an example of performance data for a similar past project. Figure 7(B) shows a graph of the performance data for a similar past project, with the horizontal axis representing the number of months elapsed and the vertical axis representing the actual results. Figure 7(B) also plots an example of the budget and construction period for a project subject to anomaly detection.

In this invention, the scale unification process, equally spaced point acquisition process, and scale enlargement process are performed together, making it possible to compare data with different scales.

(Scale unification processing)
The scale unification process will be described with reference to Fig. 8. In the scale unification process, the following process is performed for each piece of past similar case data to normalize it.

(1) For each case code of the performance data of similar past cases, divide the number of months elapsed by the maximum number of months elapsed for each case.
(2) For each case code in the performance data of similar past cases, divide the performance by the maximum performance value of each case.

The elapsed period is calculated by dividing the number of months elapsed by the maximum number of months elapsed for each project, and the actual period is calculated by dividing the actual period by the maximum actual period for each project.

After the scale unification process, columns for progress rate and actual achievement rate are added to the performance data of past similar cases. Figure 8 (A) shows the performance data of past similar cases after scale unification. As shown in Figure 8 (A), progress rate and actual achievement rate have been added.

Figure 8 (B) shows a graph of the progress rate and actual achievement rate of the performance data of similar past projects after the scale unification process in Figure 8 (A). Because the number of elapsed months and performance have been normalized, the actual achievement rate becomes "1" at the final number of elapsed months (progression rate of "1").

(Equally spaced point acquisition process)
The equally spaced point acquisition process will be described with reference to Fig. 9. In the equally spaced point acquisition process, the following process is performed for each piece of past similar project data after the scale unification process. In the equally spaced point acquisition process, the key point is to divide the data by the construction period of the project to be detected as an anomaly.

(1) Divide the budget data of the project to be judged as abnormal by the construction period against the axis of the progress rate of the data of similar past projects.
(2) Using the relationship between the progress rate and the actual rate, calculate the actual rate for each divided progress rate.
(3) The calculated values are named hypothetical elapsed rate and hypothetical actual accumulation rate because they are not actual elapsed rate and actual accumulation rate.

Figure 9 (A) shows an example of budget data for a project subject to abnormality detection. The construction period is "6 months," so the progress rate is divided into 6 parts.

Figure 9 (B) shows the performance data (job code, hypothetical progress rate, hypothetical actual volume rate) of past similar jobs after the equidistant point acquisition process. Figure 9 (C) shows the graph calculated when the equidistant point acquisition process is performed. By performing the equidistant point acquisition process, the progress rate and actual volume rate at the square points on the graph are calculated. Since the intermediate points on the broken line are not performance data, the progress rate and actual volume rate are changed to hypothetical progress rate and hypothetical actual volume rate.

(Scale enlargement processing)
The scale expansion process will be described with reference to Figures 10 and 11. In the scale expansion process, the following process is performed for each piece of performance data of similar past cases after the equally spaced point acquisition process. The key point in the scale expansion process is to expand the scale based on the budget data of the case that is the target of abnormality detection.

(1) The hypothetical elapsed number of months is calculated by multiplying the hypothetical elapsed rate obtained in the equally spaced point acquisition process by the construction period of the budget data of the project to be judged as abnormal.
(2) The virtual performance rate obtained in the equally spaced point acquisition process is multiplied by the budget of the budget data of the case to be judged as abnormal to calculate the virtual performance.

Figure 10 (A) shows an example of budget data for a project subject to abnormality detection. The construction period is "6 months" and the budget is "10 million yen."

Figure 10 (B) shows the actual data (project code, hypothetical elapsed rate, hypothetical actual volume rate, hypothetical elapsed months, hypothetical actual results) of similar past projects after scale expansion processing. The hypothetical elapsed months are calculated by multiplying the hypothetical elapsed rate by the construction period of the project to be determined as abnormal, and the hypothetical actual volume is calculated by multiplying the hypothetical actual volume rate by the budget of the project to be determined as abnormal. Columns for hypothetical elapsed months and hypothetical actual results are added to the data after scale expansion processing.

Figure 10(C) shows a graph of the hypothetical number of months elapsed and hypothetical actual results for the data on similar past projects after the scale expansion process in Figure 10(B). Because the data has been inverse normalized to match the construction period and budget of the anomaly target project, the hypothetical actual results at the final number of months elapsed, "6 months," are 10 million yen.

In this example, for ease of understanding, two similar past cases (B0001, B0002) are used as examples, but in reality, data processing is performed on many similar past cases to ensure the validity of the final anomaly determination results. When data processing is performed on many cases up to an expanded scale, the graph will look like the one shown in Figure 11, for example.

The following threshold calculation process and anomaly detection process allow for anomaly detection using a threshold that takes into account the degree of dispersion of actual results for each number of months that have passed.

(Threshold calculation process)
The threshold calculation process will be described with reference to Fig. 12. In the threshold calculation process, the average value and standard deviation are calculated for each hypothetical result for which the hypothetical number of elapsed months matches, for the performance data of past similar cases after the scale expansion process, to calculate a threshold.

When determining an abnormality, the upper tolerance value of the actual results is set as the upper threshold, and the lower tolerance value is set as the lower threshold. As an example, data such as that shown in Figure 12(A) is calculated. Figure 12(A) shows the data after the threshold calculation process. For each hypothetical number of months elapsed, a hypothetical actual results average (10,000 yen), upper threshold (10,000 yen), and lower threshold (10,000 yen) are calculated. Figure 12(B) is a graph of the hypothetical actual results average (10,000 yen), upper threshold (10,000 yen), and lower threshold (10,000 yen) from Figure 12(A).

(Abnormality determination process)
The abnormality determination process will be described with reference to Figures 13 to 15. In the abnormality determination process, the following process is performed for each piece of data in which the hypothetical number of elapsed months of a similar past case is equal to the number of elapsed months of the case to be determined as abnormal.

The hypothetical number of months elapsed in the threshold data calculated from similar past cases is compared with the actual number of months elapsed in the actual data of the case being judged as abnormal for each piece of data, and if the actual number of months elapsed is greater than the upper threshold or less than the lower threshold, it is judged to be abnormal. Data for which no actual data yet exists is not judged to be abnormal.

Figure 13 (A) shows an example of threshold data calculated from similar past cases, Figure 13 (B) shows actual data for a case subject to abnormality determination, and Figure 13 (C) shows the abnormality determination result (abnormal: "TRUE", normal: "FALSE"). In the example shown in the figure, for data where the hypothetical number of elapsed months and the number of elapsed months are "3 months", the actual result of "2.5 million yen" falls below the lower threshold of "3.0858 million yen", so it is determined to be abnormal "TRUE".

Figure 14 shows an example of an anomaly detection graph. A hypothetical performance average calculated based on similar past cases, threshold data (upper threshold, lower threshold), and performance data for cases subject to anomaly detection are displayed on a single graph. In this case, an anomaly is detected when the performance data for a case subject to anomaly detection falls outside the threshold range (the range formed by the upper and lower thresholds) on the graph. As the focus is on how the performance data for cases subject to anomaly detection accumulates, the axes are "months elapsed" and "performance" to match the performance data for cases subject to anomaly detection.

When an abnormality is detected, a message indicating this is displayed. Figure 15 shows an example of an abnormality detection message. The abnormality detection message displays the calculation method, the case code in which the abnormality was detected, the number of months elapsed, actual results, and the deviation amount from the reference value. In the example shown in the figure, the message displayed is, "Calculation method: Similar comparison method (threshold rate 1.0), Case A0001, number of months elapsed: 3 months, actual results: 2.5 million yen, 580,000 yen below the reference value."

(3-3. Details of the equally spaced points acquisition process)
The equally spaced point acquisition process will be described in detail with reference to FIGS.

Figure 16(A) shows the performance data (B0001, B0002) of similar past cases after the scale unification process. Figure 16(B) shows a graph of the progress rate and actual rate of the performance data of similar past cases after the scale unification process of Figure 16(A).

In the process of obtaining equally spaced points, (1) the construction period from the budget data for the project to be judged as abnormal is obtained and used as the division number. (2) The value of 1/(division number) is used as the range of the progress rate of equally spaced points. (3) A hypothetical actual rate is calculated.

The case where the equally spaced point acquisition process is performed for project B0001 will be explained with reference to Figure 17. (1) The construction period of the project data that is the target of abnormality detection is acquired and used as the division number. Figure 17 (A) shows the budget data for the project data that is the target of abnormality detection. In this case, the division number is set to "6 months", the construction period of project "A0001" that is the target of abnormality detection.

(2) Set the value of 1/(number of divisions) as the width of the progress rate of equally spaced points, and calculate the virtual progress rate of the equally spaced points you want to calculate. Figure 17(B) is a diagram for explaining the calculation of the virtual progress rate for "B0001" in the similar case data. "B0002" is not shown in the figure, but can be calculated in the same way. In Figure 17(B), the number of divisions = 6, the width of the progress rate of equally spaced points = 1/6, and the virtual progress rates of equally spaced points = 0, 1/6, 2/6, 3/6, 4/6, 5/6, 1.

(3) Calculate the virtual performance rate for each equally spaced progress rate. It is necessary to find the relationship between the progress rate and performance rate between each point of the performance data on the graph.

Methods for calculating a hypothetical performance rate from the equation relating the progress rate and performance rate include, for example: (a) approximating the equation relating the progress rate and performance rate with a straight line: connect two adjacent points on the graph with a straight line, and calculate the hypothetical performance rate corresponding to the hypothetical progress rate on that line. (b) approximating the equation relating the progress rate and performance rate with a quadratic function curve: draw a quadratic function that passes through three adjacent points on the graph, and calculate the hypothetical performance rate corresponding to the hypothetical progress rate on that curve. (c) Other approximations may also be made with non-linear functions.

In this example, to simplify the calculations, we will explain the case where the relationship between the progress rate and the actual rate is determined using method (a). Below, as a specific example, we will show the calculation process for the hypothetical actual rate at the point where the hypothetical progress rate is 3/6 = 0.5. Figures 18 to 20 are diagrams used to explain the calculation process for the hypothetical actual rate.

(3)-1. Obtain continuous data such that the hypothetical progress rate falls between progress rates. In Figure 18 (A), the hypothetical progress rate of 0.5 falls between the progress rates of 0.4 and 0.6 for case B0001. Therefore, to calculate the hypothetical actual progress rate, the rows with elapsed months of "2," actual results of "3.5 million yen," progress rate of "0.4," and actual rate of "0.43" and those with elapsed months of "3," actual results of "5.5 million yen," progress rate of "0.6," and actual rate of "0.68" are used, as shown in Figure 18 (B). Figure 18 (C) shows an image of the graph used to obtain data for calculating the hypothetical progress rate.

(3)-2. Find the relationship between the progress rate and the actual rate. Find the equation for the line that passes through the two points in Figure 18(D). Figure 18(E) shows the equation for the solid line on the graph, and the actual rate is as shown in Figure 18(E), where Actual rate = {(0.68 - 0.43) / (0.6 - 0.4)} x (progress rate - 0.4) + 0.43.

(3)-3. Calculate the hypothetical actual volume rate. Calculate the hypothetical actual volume rate that results in a hypothetical elapsed volume rate of "0.5". Figure 19 (B) shows an image of the graph when calculating the hypothetical actual volume rate. Calculate the hypothetical actual volume rate based on the elapsed volume rate and actual volume rate at both ends of the broken line.

In this case, the hypothetical performance rate is 0.55. As shown in Figure 19 (A), the columns for elapsed months, performance, elapsed rate, and actual performance rate disappear from the data table, and columns for hypothetical performance rate and hypothetical actual performance rate are added.

Figure 20 (A) shows an example of data after the equally spaced points acquisition process. Figure 20 (B) shows a graph of the data obtained after the equally spaced points acquisition process. By performing process (3) on all of the hypothetical elapsed rates calculated in (2) = 0, 1/6, 2/6, 3/6, 4/6, 5/6, 1, it is possible to obtain data for equally spaced points B0001 and B0002, as shown in Figures 20 (A) and (B).

(3-4. Details of threshold calculation process)
The threshold calculation process will be described in detail with reference to FIGS.

Figure 21(A) shows the performance data (B0001, B0002) of past similar projects after the scale expansion process. Figure 21(B) shows a graph of the hypothetical number of months elapsed and the hypothetical performance of the performance data of past similar projects after the scale expansion process of Figure 21(A).

In the threshold calculation process, the following process is executed.
(1) Divide the data into groups according to the number of virtual months that have passed.
(2) Calculate the average value and standard deviation of the virtual results for each divided data.
(3) Calculate the threshold.
(4) Select the threshold data to be used for abnormality determination.

(1) Separating data by the number of virtual months that match. Fig. 22(A) shows the data in Fig. 21(A) sorted in ascending order of the number of virtual months that have passed. Fig. 22(B) shows an image of the data in Fig. 22(A) in a graph.

(2) Calculate the average value and standard deviation of the hypothetical results for each divided data. Figure 23 is a diagram for explaining the calculation of the average value and standard deviation of the hypothetical results for each divided data. As shown in Figure 23, by calculating the average value and standard deviation of the hypothetical results for each hypothetical number of months elapsed, it is possible to take into account the differences in the degree of dispersion of the hypothetical results for the early, middle, and late stages of multiple similar past cases (B0001, B0002).

Figure 24 shows an image of a graph in which the average value and standard deviation of the hypothetical results are calculated for each divided data. A single average value and standard deviation representing the dispersion of the hypothetical results can be obtained from a group of data with the same hypothetical number of elapsed months. The figure shows the hypothetical results for B0001, B0002, and the average and standard deviation of the hypothetical results.

(3) Calculate the threshold value. This process allows you to set the tolerance for abnormality determination and a parameter called the threshold rate. The threshold rate is a parameter that determines how far the actual results of the object being determined to be abnormal must deviate from the virtual actual result average before it is determined to be abnormal. Figure 25 is a diagram explaining how the threshold value is calculated.

Figure 25 (A) is a diagram explaining the calculation formulas for the upper and lower thresholds. The upper and lower thresholds are calculated based on the threshold rate as follows: The upper threshold is calculated as follows: Upper threshold = hypothetical performance average + threshold rate x standard deviation. The lower threshold is calculated as follows: Lower threshold = hypothetical performance average - threshold rate x standard deviation.

Figure 25(B) shows the relationship between the threshold rate and tolerance in a normal distribution. σ represents the standard deviation. When the σ coefficient is "1", this indicates that there is a 68% probability that the deviation from the mean will be between (mean) -1σ and (mean) +1σ.

The threshold rate is the standard deviation coefficient used when calculating the upper and lower thresholds. The relationship between the threshold rate, tolerance, and "interpretation of events when the threshold defined by the threshold rate is exceeded" is shown in Figure 25 (C). When the threshold rate is "1", the tolerance is "68%", and it is an abnormal event that can occur with a probability of 32% or less. When the threshold rate is "2", the tolerance is "95%", and it is an abnormal event that can occur with a probability of 5% or less. When the threshold rate is "3", the tolerance is "99.7%", and it is an abnormal event that can occur with a probability of 0.3% or less.

"Tolerance" refers to the tolerance for the degree of deviation of the actual results of a case subject to abnormality detection from the hypothetical average actual results. The value of the threshold rate x standard deviation is called the tolerance range. The tolerance range is calculated as tolerance range = threshold rate x standard deviation, as shown in Figure 25 (D).

Figure 26 (A) shows the data after the threshold calculation process, where the threshold rate is set to "1.0." The figure also shows the calculation results for the hypothetical actual average, tolerance range, upper threshold, and lower threshold for each hypothetical number of months elapsed.

Figure 26 (B) shows a graph of the data after the threshold calculation process. The figure shows the average of the hypothetical actual results, the upper threshold, the lower threshold, and the tolerance range. As shown in the figure, the tolerance range is wide in the mid-stage because there is a large difference in the progress of each project. In contrast, the tolerance range is narrow in the early and late stages. In this way, it is possible to determine the tolerance range that captures the tendency of the dispersion of statistical distribution in the early, mid, and late stages of multiple similar past projects (B0001, B0002).

(4) Select the threshold data to be used for abnormality detection. Methods for selecting data to be used for abnormality detection include, for example, methods A to D below.

A. The data after threshold calculation is used directly to determine anomalies. This can be used to strictly check that the project data for which anomalies are to be detected is completed according to the original budget and schedule.

B. Allow for a tolerance range for the threshold for the final month. This can be used to consider a certain deviation from the original budget and construction period of the project for which anomaly detection is being performed, and to consider a deviation within the same range as the previous month's tolerance range as normal.

C. Use only the upper threshold. This can be used when you want to detect anomalies specifically by viewing anything outside the upper threshold as a tendency for actual results to exceed the budget.

D. Use only the lower threshold. This can be used when you want to detect anomalies specifically by viewing anything outside the lower threshold as an abnormal trend of project stagnation based on the number of months that have passed.

We will explain the case of A, where "data after threshold calculation processing is used directly for anomaly detection." In this case, it is possible to strictly check that the data for projects subject to anomaly detection is completed according to the original budget and schedule. Figure 27 (A) shows the threshold data used for anomaly detection, and Figure 27 (B) shows a graph of the threshold data used for anomaly detection.

We will now explain the case of B, "giving the final month threshold a tolerance range." In method A, even the slightest deviation from the original budget or construction period of the project being judged to be abnormal will result in it being judged to be abnormal, so a tolerance range is set for the final month. The tolerance range for the final month is set to the tolerance range for the month before the final month. Figure 28 (A) shows the threshold data used for abnormality judgment, and Figure 28 (B) shows a graph of the threshold data used for abnormality judgment. As shown in Figure 28 (A), the tolerance range of "282,800 yen" for the hypothetical number of elapsed months of "6 months" is set to the same as the tolerance range of "282,800 yen" for the hypothetical number of elapsed months of "5 months."

We will explain the cases C, "Using only the upper threshold," and D, "Using only the lower threshold." You can choose to use only the upper or lower threshold. Below, we will explain the case where only the lower threshold is used. Figure 29 (A) shows the threshold data used for abnormality determination. Figure 29 (B) shows a graph of the threshold data used for abnormality determination. Since only the lower threshold is used for abnormality determination, the upper threshold data is not used.

As explained above, according to this embodiment, the control unit 102 adjusts the number of months elapsed and actual results of the performance data of multiple similar past cases to the scale of the budget data of the case being determined to be abnormal, calculates a threshold based on the number of months elapsed and actual results of the performance data of the multiple similar past cases that have been adjusted to the same scale, and compares the performance data of the case being determined to be abnormal with the calculated threshold to determine whether there is an abnormality.Therefore, by comparing the threshold based on multiple past cases with the way the performance of the target case has accumulated, it is possible to detect an abnormality in the case.

[4. Contribution to the United Nations-led Sustainable Development Goals (SDGs)]
This embodiment can contribute to improving business efficiency and promoting appropriate management decisions by companies, thereby contributing to the achievement of SDGs Goals 8 and 9.

Furthermore, this embodiment can contribute to reducing waste and promoting paperless and electronic systems, thereby contributing to SDGs goals 12, 13, and 15.

Furthermore, this embodiment can contribute to strengthening control and governance, thereby contributing to Goal 16 of the SDGs.

5. Other Embodiments
The present invention may be implemented in various different embodiments other than those described above within the scope of the technical concept set forth in the claims.

For example, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods.

In addition, the processing procedures, control procedures, specific names, registered data for each process, information including parameters such as search conditions, screen examples, and database configurations shown in this specification and drawings may be changed as desired unless otherwise specified.

Furthermore, with regard to the anomaly detection system 100, the components shown in the figure are functional concepts and do not necessarily have to be physically configured as shown.

For example, all or any part of the processing functions of the anomaly detection system 100, particularly the processing functions performed by the control unit, may be implemented by a CPU and a program interpreted and executed by the CPU, or may be implemented as hardware using wired logic. The program is recorded on a non-transitory, computer-readable recording medium containing programmed instructions for causing the information processing device to execute the processing described in this embodiment, and is mechanically read by the anomaly detection system 100 as needed. That is, a computer program that works in conjunction with the OS to issue commands to the CPU and perform various processes is recorded in a storage unit such as a ROM or HDD (Hard Disk Drive). This computer program is executed by being loaded into RAM, and works in conjunction with the CPU to form the control unit.

In addition, this computer program may be stored on an application program server connected to the anomaly detection system 100 via any network, and all or part of it may be downloaded as needed.

In addition, the program for executing the processing described in this embodiment may be stored on a non-temporary computer-readable recording medium, or may be configured as a program product. Here, this "recording medium" includes memory cards, USB (Universal Serial Bus) memories, SD (Secure Digital) cards, flexible disks, magneto-optical disks, ROMs, EPROMs (Erasable Programmable Read Only Memory), EEPROMs (registered trademark) (Electrically Erasable and Programmable Read Only Memory), CD-ROMs (Compact Disk Read Only Memory), MOs (Magneto-Optical disks), DVDs (Digital Versatile Disks), and more. This includes any "portable physical media" such as a Blu-ray Disc (registered trademark) and a Blu-ray (registered trademark) Disc.

A "program" is a data processing method written in any language or description method, and may be in any format, such as source code or binary code. It should be noted that a "program" is not necessarily limited to a single structure, but also includes a distributed structure consisting of multiple modules or libraries, or a structure that achieves its function by working in conjunction with a separate program, such as an OS. The specific structure and reading procedure for reading a recording medium in each device shown in the embodiments, as well as the installation procedure after reading, can use well-known structures and procedures.

The various databases stored in the memory unit are storage devices such as memory devices such as RAM and ROM, fixed disk devices such as hard disks, flexible disks, and optical disks, and store various programs, tables, databases, and web page files used for various processes and website provision.

The anomaly detection system 100 may be configured as an information processing device such as a known personal computer or workstation, or as an information processing device connected to any peripheral device. The anomaly detection system 100 may also be implemented by installing software (including programs, data, etc.) that causes the device to perform the processing described in this embodiment.

Furthermore, the specific form of distribution and integration of the devices is not limited to that shown in the figures, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various additions or functional loads. In other words, the above-mentioned embodiments may be implemented in any combination, or embodiments may be implemented selectively.

100 Anomaly detection system 102 Control unit 102a Data acquisition unit 102b Scale unification unit 102c Equally spaced point acquisition unit 102d Scale enlargement unit 102e Threshold calculation unit 102f Anomaly determination unit 104 Communication interface unit 106 Storage unit 106a Data table 108 Input/output interface unit 112 Input device 114 Output device 200 Server 300 Network

Claims (9)

An anomaly detection system including a control unit,
The control unit
Budget data for the project to be judged as abnormal, including project identification information, construction period, and budget;
Actual data of the cases subject to abnormality judgment, including case identification information, number of months elapsed, and results;
performance data of a plurality of similar past cases similar to the case to be determined as abnormal, including case identification information, number of months elapsed, and performance data;
It is configured to be accessible to
a scale unification means for calculating an elapsed time rate by dividing the number of elapsed months by the maximum value of the number of elapsed months and an actual time rate by dividing the actual time by the maximum value of the actual time, for each of the performance data of the plurality of past similar cases, and executing a scale unification process to unify the scales;
an equally spaced point acquisition means for calculating a hypothetical progress rate by dividing the progress rate axis by the construction period of the budget data of the case to be determined as an anomaly for each of the actual results data of a plurality of similar past cases after the scale unification process, and for the actual results, executing an equally spaced point acquisition process for calculating a hypothetical achievement rate corresponding to the hypothetical progress rate;
a scale expansion means for executing a scale expansion process for calculating a virtual number of elapsed months by multiplying a virtual elapsed rate by the construction period of the budget data of the case to be determined to be abnormal, for each of the performance data of a plurality of similar past cases after the equally-spaced point acquisition process, and calculating a virtual performance by multiplying the virtual performance rate by the budget of the budget data of the case to be determined to be abnormal;
a threshold calculation means for executing a threshold calculation process for calculating a threshold from an average value and a standard deviation of the hypothetical results for each hypothetical number of elapsed months based on the performance data of a plurality of similar past cases after the scale expansion process;
an abnormality determination means for executing an abnormality determination process that compares the performance data of the case to be determined to be abnormal with the calculated threshold value and determines whether an abnormality has occurred;
An anomaly detection system comprising : The anomaly detection system according to claim 1 , characterized in that the performance data of the plurality of similar past projects has a relative error in construction period and/or budget of a predetermined percentage or less compared to the budget data of the project to be judged as an anomaly. 2. The anomaly detection system according to claim 1, wherein the equally-spaced point acquisition means calculates, for each of the actual data of a plurality of similar past projects after scale unification processing, a virtual performance rate corresponding to each virtual performance rate from a relational expression between the performance rate and the performance rate, with the construction period of the budget data of the project to be determined as the number of divisions, and a range of 1/ the number of divisions as the range of the progress rates of the equally-spaced points. The anomaly detection system according to claim 1, wherein the threshold calculation means separates performance data of a plurality of similar past cases after scale expansion processing into data sets that match in virtual elapsed months, calculates an average value and standard deviation of the virtual performance for each separated data set, calculates threshold data using the formula: upper threshold = virtual performance average value + threshold rate × standard deviation, and lower threshold = virtual performance average value - threshold rate × standard deviation, and selects a threshold to be used for anomaly detection from the calculated threshold data . The anomaly detection system according to claim 4, characterized in that the selection of the threshold value to be used for the abnormality determination is made by using the calculated threshold value data as is for the abnormality determination, by giving the threshold value for the final month an allowable range (= threshold rate × standard deviation ) , by using only the upper threshold value, or by using only the lower threshold value. The anomaly detection system described in claim 1, characterized in that the anomaly determination means outputs an anomaly detection message to a display unit when an anomaly is determined. 7. The anomaly detection system according to claim 1 , wherein the anomaly detection target case and the similar cases include cases that are subject to project-based management. An anomaly detection method executed by an information processing device including a control unit,
The control unit
Budget data for the project to be judged as abnormal, including project identification information, construction period, and budget;
Actual data of the cases subject to abnormality judgment, including case identification information, number of months elapsed, and results;
performance data of a plurality of similar past cases similar to the case to be determined as abnormal, including case identification information, number of months elapsed, and performance data;
It is configured to be accessible to
The control unit executes
a scale unification step of calculating an elapsed time rate by dividing the number of elapsed months by the maximum value of the number of elapsed months and an actual time rate by dividing the actual time by the maximum value of the actual time for each of the plurality of past similar cases, and executing a scale unification process to unify the scales;
an equally-spaced point acquisition process for calculating a hypothetical progress rate by dividing the progress rate axis by the construction period of the budget data of the project to be determined as an anomaly for each of the performance data of the multiple similar past projects after the scale unification process, and for the performance data, performing an equally-spaced point acquisition process for calculating a hypothetical performance rate corresponding to the hypothetical progress rate;
a scale expansion process for executing a scale expansion process to calculate a virtual number of elapsed months by multiplying a virtual elapsed rate by the construction period of the budget data of the project to be determined for an abnormality, for each of the performance data of a plurality of similar past projects after the equally-spaced point acquisition process, and to calculate a virtual performance by multiplying the virtual performance rate by the budget of the budget data of the project to be determined for an abnormality;
a threshold calculation step of executing a threshold calculation process to calculate a threshold from an average value and a standard deviation of the hypothetical actual results for each hypothetical number of elapsed months based on the actual results data of a plurality of similar past cases after the scale expansion process;
an abnormality determination step of executing an abnormality determination process by comparing the performance data of the case to be determined to be abnormal with the calculated threshold value and determining whether an abnormality has occurred;
An anomaly detection method comprising: An abnormality detection program to be executed by an information processing device having a control unit,
The control unit
Budget data for the project to be judged as abnormal, including project identification information, construction period, and budget;
Actual data of the cases subject to abnormality judgment, including case identification information, number of months elapsed, and results;
performance data of a plurality of similar past cases similar to the case to be determined as abnormal, including case identification information, number of months elapsed, and performance data;
It is configured to be accessible to
The control unit
a scale unification step of calculating an elapsed time rate by dividing the number of elapsed months by the maximum value of the number of elapsed months and an actual time rate by dividing the actual time by the maximum value of the actual time, for each of the performance data of the plurality of past similar cases, and executing a scale unification process to unify the scales;
an equally-spaced point acquisition process for calculating a hypothetical progress rate by dividing the budget data of the project to be determined as an anomaly by the construction period on the progress rate axis for each of the actual data of the multiple similar projects after the scale unification process, and for the actual results, performing an equally-spaced point acquisition process for calculating a hypothetical achievement rate corresponding to the hypothetical progress rate;
a scale expansion process for executing a scale expansion process to calculate a virtual number of elapsed months by multiplying a virtual elapsed rate by the construction period of the budget data of the project to be determined for an abnormality, for each of the performance data of a plurality of similar past projects after the equally-spaced point acquisition process, and to calculate a virtual performance by multiplying the virtual performance rate by the budget of the budget data of the project to be determined for an abnormality;
a threshold calculation step of executing a threshold calculation process to calculate a threshold from an average value and a standard deviation of the hypothetical actual results for each hypothetical number of elapsed months based on the actual results data of a plurality of similar past cases after the scale expansion process;
an abnormality determination step of executing an abnormality determination process by comparing the performance data of the case to be determined to be abnormal with the calculated threshold value and determining whether an abnormality has occurred;
An anomaly detection program to execute the above.