JP7794772B2 - Anomaly detection system, anomaly detection method, and anomaly detection program - Google Patents

Description

The present invention relates to an anomaly detection system, an anomaly detection method, and an anomaly detection program.

For example, in industries that use project-based management, such as construction and systems development, where progress is accumulated over a period of time, there is a demand to "determine whether the accumulation method is appropriate."

In the past, if the construction period and actual results of a past project differed from the construction period and budget of the project for which anomalies were to be determined, it was not possible to compare how the data accumulated. Furthermore, when determining anomalies based on past projects whose construction periods and actual results match, the number of samples was small, resulting in judgment results with low validity. For example, Patent Document 1 discloses a conventional system for managing budgets and actual results.

JP 2015-95122 A

However, Patent Document 1 does not disclose anything about using an approximation curve to accurately detect abnormalities in the progress of a target project based on performance data from past projects.

The present invention has been made in consideration of the above, and aims to provide an anomaly detection system, anomaly detection method, and anomaly detection program that can accurately detect abnormalities in the way a target project's progress accumulates using an approximation curve based on performance data from past projects.

In order to solve the above-mentioned problems and achieve the objectives, the present invention provides an anomaly detection system that includes a control unit and detects anomalies in business data. The control unit is configured to be able to access an anomaly detection definition master in which, for each anomaly detection definition, an X-axis item, a Y-axis item, an X-axis scale uniform item, and a Y-axis scale uniform item are set as parameters; monthly performance data for past cases including case identification information, X-axis item, and Y-axis item; schedule and performance data for past cases including case identification information, X-axis scale uniform item, and Y-axis scale uniform item; monthly performance data for cases subject to anomaly detection including case identification information, X-axis item, and Y-axis item; and schedule and performance data for cases subject to anomaly detection including case identification information, planned period or target completion period, budget, or goal. For the monthly performance data for past cases, the control unit calculates, for each case identification information, a progress rate obtained by dividing the X-axis item by the X-axis scale uniform item of the schedule and performance data for the past cases, and a progress rate obtained by dividing the Y-axis item by the previous The system is characterized by comprising: a data processing means that calculates and processes the progress rate by dividing the planned and actual data of the past cases by a Y-axis scale unified item; and for the monthly actual data of the cases to be determined for each case identification information, calculates and processes the progress rate by dividing the X-axis item by the planned period or target end period of the planned and actual data of the cases to be determined for each case; an approximation curve calculation means that calculates a performance center approximation curve for all of the processed monthly actual data of the past cases; a threshold calculation means that calculates the dispersion of all of the data from the calculated performance center approximation curve, calculates a standard deviation curve that represents the tendency of the calculated dispersion, and calculates a threshold based on the performance center approximation curve and the standard deviation curve; and an abnormality determination means that compares the processed monthly actual data of the cases to be determined for abnormality with the calculated threshold to determine an abnormality.

Furthermore, according to one aspect of the present invention, the X-axis item may include the number of elapsed months, the Y-axis item may include the cumulative actual amount, the X-axis scale unified item may include the planned construction period or implementation period, and the Y-axis scale unified item may include the budget or actual amount.

Furthermore, according to one aspect of the present invention, the anomaly determination definition master further includes one or more approximate function candidates set as parameters for each anomaly determination definition, and the approximate curve calculation means passes the elapsed time and progress rate of the monthly performance data for past cases after processing and information on one or more approximate function candidates set in the anomaly determination definition master to an approximation component to find optimal coefficients, calculates the AIC based on the coefficients returned from the approximation component, and determines the approximate function candidate with the smallest AIC as the performance-centered approximate function.

Furthermore, according to one aspect of the present invention, the one or more candidate approximation functions may include at least one of a polynomial function, an exponential function, a logarithmic function, a logistic function, and a Bass model function.

In another aspect of the present invention, the threshold calculation means may substitute each progress rate of the processed monthly performance data of past cases into the performance center approximation function to calculate a predicted value of the progress rate, calculate a residual, which is the difference between the predicted value and the actual progress rate data, calculate the square of the residual, draw an approximation curve of the residual square approximation function for the square of the residual, and take the square root of the residual square approximation function to obtain a standard deviation function. The threshold calculation means may substitute each progress rate of the processed monthly performance data of the case to be determined as abnormal into the performance center approximation function to calculate a predicted value of the progress rate, and substitute into the standard deviation function to calculate the standard deviation, and calculate upper and lower thresholds with a range above and below the predicted value equal to the standard deviation multiplied by a constant value calculated based on the significance level.

Furthermore, according to one aspect of the present invention, the abnormality determination means may output an abnormality detection message and a graph thereof to the display unit when an abnormality is determined.

Furthermore, according to one aspect of the present invention, a master maintenance means may be provided that sets the abnormality determination definition master data in response to an operator's operation.

Furthermore, in order to solve the above-mentioned problems and achieve the object, the present invention provides an anomaly detection method executed by an information processing device having a control unit, wherein the control unit is configured to be able to access an anomaly detection definition master in which, for each anomaly detection definition, an X-axis item, a Y-axis item, an X-axis scale uniform item, and a Y-axis scale uniform item are set as parameters; monthly performance data of past cases including case identification information, X-axis item, and Y-axis item; schedule and performance data of past cases including case identification information, X-axis scale uniform item, and Y-axis scale uniform item; monthly performance data of cases subject to anomaly detection including case identification information, X-axis item, and Y-axis item; and schedule and performance data of cases subject to anomaly detection including case identification information, a planned period or target completion period, and a budget or target; and the control unit executes an anomaly detection method to calculate, for each case identification information, a process time for the monthly performance data of past cases by dividing the X-axis item by the X-axis scale uniform item of the schedule and performance data of the past cases. a data processing step for calculating and processing the progress rate by dividing the X-axis item by the planned period or target end period of the planned/actual data of the past project by the unified Y-axis scale item of the planned/actual data of the past project, and for calculating and processing the monthly actual data of the project to be determined for each project identification information, the progress rate by dividing the X-axis item by the planned period or target end period of the planned/actual data of the project to be determined for each project identification information, and the progress rate by dividing the Y-axis item by the budget or target of the planned/actual data of the project to be determined for each project identification information; an approximation curve calculation step for calculating a performance center approximation curve for all of the processed monthly actual data of the past project; a threshold calculation step for calculating the dispersion of all of the data from the calculated approximation curve, calculating a standard deviation curve that represents the trend of the calculated dispersion, and calculating a threshold based on the performance center approximation curve and the standard deviation curve; and an abnormality determination step for comparing the processed monthly actual data of the project to be determined for anomaly with the calculated threshold to determine an abnormality.

Also, an anomaly detection program to be executed by an information processing device having a control unit is configured such that the control unit can access, for each anomaly detection definition, an anomaly detection definition master in which an X-axis item, a Y-axis item, an X-axis scale uniform item, and a Y-axis scale uniform item are set as parameters; monthly performance data of past cases including case identification information, X-axis item, and Y-axis item; schedule and performance data of past cases including case identification information, X-axis scale uniform item, and Y-axis scale uniform item; monthly performance data of cases subject to anomaly detection including case identification information, X-axis item, and Y-axis item; and schedule and performance data of cases subject to anomaly detection including case identification information, planned period or target completion period, and budget or goal; and the control unit, for each case identification information, calculates a progress rate obtained by dividing the X-axis item by the X-axis scale uniform item of the schedule and performance data of the past cases, and calculates the Y-axis item as the schedule and performance data of the past cases. a data processing step of calculating and processing the progress rate by dividing the X-axis item by the planned period or target end period of the planned/actual data of the case to be detected for each case identification information, and the progress rate by dividing the Y-axis item by the budget or target of the planned/actual data of the case to be detected for each case identification information; an approximation curve calculation step of calculating a performance center approximation curve for all of the processed monthly performance data of past cases; a threshold calculation step of calculating the dispersion of all of the data from the calculated performance center approximation curve, calculating a standard deviation curve that represents the trend of the calculated dispersion, and calculating a threshold based on the performance center approximation curve and the standard deviation curve; and an anomaly detection step of comparing the processed monthly performance data of the case to be detected for anomaly detection with the calculated threshold to determine an anomaly.

The present invention has the advantage of enabling, with high accuracy, the use of an approximation curve to detect abnormalities in the progress of a target project based on performance data from past projects.

FIG. 1 is a diagram for explaining the problem to be solved by the present invention. FIG. 2 is a diagram for explaining the problem to be solved by the present invention. FIG. 3 is a block diagram showing an example of the configuration of the anomaly detection system according to this embodiment. FIG. 4 is a diagram showing a processing flow illustrating an example of the overall processing of the control unit of the anomaly detection system according to this embodiment. FIG. 5 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 6 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 7 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 8 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 9 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 10 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 11 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 12 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 13A is a diagram for explaining a specific example of processing by the control unit of the anomaly detection system according to this embodiment. FIG. 13B is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 14 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 15 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 16 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 17 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 18A is a diagram for explaining a specific example of processing by the control unit of the anomaly detection system according to this embodiment. FIG. 18B is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 19 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 20 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 21 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 22 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 23 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 24 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 25 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 26 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 27 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 28 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 29 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 30 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 31 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 32 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 33 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 34 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 35 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 36 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 37 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 38 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 39 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 40 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 41 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 42 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 43 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 44 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 45 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. FIG. 46 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment.

An embodiment of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to this embodiment.

[1. Overview]
The present invention will be outlined in the following order: background, problems, solution examples, and features of the present invention.

(1-1. Background)
The background of the present invention will be explained. In industries such as the construction industry and the system development industry, which use project-based management that accumulates progress over a period of time, there is a demand to "determine whether the accumulation method is appropriate by comparing with past projects."

The anomaly detection system of the present invention processes data while taking into account exceeding the planned construction period and budget, and by drawing an approximation curve of progress trends, it is possible to evaluate how progress accumulates and detect anomalies with high accuracy. In addition, it is possible to set the master to perform judgment processing according to the characteristics of each task.

The anomaly detection system of the present invention (1) can flexibly identify anomalies in progress delays and revise plans even when the planned construction period or budget has been exceeded. It also (2) can detect fraudulent recording of progress rates and more accurately prevent fraudulent recording of actual results that do not correspond to reality than conventional anomaly detection systems.

In this specification, "number of months elapsed" refers to the number of months elapsed since the start of a project. "Cumulative actual amount" refers to the actual costs incurred from the start of a project to the number of months elapsed. "Planned construction period" refers to the number of months expected to be required to complete a project, which is set before the project begins. "Implementation period" refers to the number of months expected to be required to complete a project, which is determined after the project begins. "Budget" refers to the planned costs expected to be required to complete a project, which is set before the project begins. "Actual amount" refers to the total amount spent on a project, which is determined after the project is completed. "Percentage of planned construction period elapsed" refers to the number of months elapsed divided by the planned construction period. "Percentage of implementation period elapsed" refers to the number of months elapsed divided by the implementation period. "Percentage of budget elapsed" refers to the cumulative actual amount divided by the budget. "Actual progress rate" refers to the cumulative actual amount divided by the actual amount. "Projects subject to abnormality detection" refer to ongoing projects for which abnormalities in the accumulation of progress are to be detected. "Approximate curve" refers to a curved line when viewed on a graph. An "approximation function" is an equation that represents an approximate curve using letters such as x and y. An "approximation function name" is a name used to distinguish an approximate function using terminology rather than an equation.

(1-2. Issues)
The problems to be solved by the present invention will be described with reference to Figures 1 and 2. Conventionally, there are the following problems.

1. If comparisons are made only with past projects where the construction period and actual results match, the number of samples to compare is small, resulting in anomaly detection results that are of low validity.

2. If the construction periods and actual results of past projects differ, there is the issue of not being able to compare data.

More specifically, it is as follows:

(1) When comparing only past projects whose construction periods and actual results match, the number of samples to compare is small, resulting in anomaly detection results with low validity. Specifically, when collecting data on past projects, if only those whose construction periods and budgets match the project being detected as anomalies are extracted, the number of samples from past projects will be small. In this way, a small number of samples will result in low validity of anomaly detection results.

(2) The issue of not being able to compare data when the construction period and actual results of past projects differ will be explained in detail with reference to Figures 1 and 2. We will explain the case where we want to determine whether project A0001 is abnormal based on how the actual results of project B0001, which has already been completed in the past, have accumulated. As a premise, we will assume that the actual data and budget data of the project to be determined to be abnormal, as well as the actual data of past projects to be compared, are stored as follows:

Figure 1(A) shows an example of performance data for a project subject to abnormality detection, including the project code, number of months elapsed, and performance data. Figure 1(B) shows an example of budget data for a project subject to abnormality detection, including the project code, construction period, and budget data. Figure 1(C) shows an example of performance data for a past project, including the project code, number of months elapsed, and performance data.

Figure 2 shows an image of a graph comparing the accumulation of the case being judged as abnormal with the accumulation of past comparable cases. Figure 2 shows the number of months elapsed and actual results for the past similar case (B0001) and the case being judged as abnormal (A0001) in Figure 1, with the X axis showing the number of months elapsed and the Y axis showing actual results (10,000 yen). Because the construction period and budget for the case being judged as abnormal differ from the construction period and actual results for the past comparable cases, it is impossible to determine whether the accumulation of actual results for the case being judged as abnormal is abnormal or not.

(1-3. Solution)
Therefore, as a solution, the present invention processes data to unify the scale so that, for example, the scale of the construction period and actual results of past projects matches the scale of the construction period and budget of the project being judged for anomalies.

1. When comparing only past projects with matching construction periods and actual results, the number of samples to compare is small, resulting in anomaly detection results with low validity. However, by comparing with the project being detected as anomaly regardless of the construction periods and actual results of past projects, data can be collected regardless of construction periods and actual results.

2. To address the issue of being unable to compare data when the construction periods and actual results of past projects differ, by matching the construction periods and actual results of past projects to the construction period and budget of the project being identified as abnormal, it becomes possible to compare past projects with the project being identified as abnormal.

(1-4. Features of the present invention)
The anomaly detection system of the present invention draws an approximation curve for processed monthly data of past cases, calculates a threshold value, and determines an anomaly based on the threshold value, and has the following features 1 to 3.

(1) Feature 1 of the present invention
It is possible to select what to prioritize when determining anomalies, such as delays in construction schedules or budget overruns. The anomaly detection system of the present invention can accommodate the differences in policies regarding how much importance is placed on deviations from the planned construction schedule and budget at the time of project completion for each company (details are explained in "3-4. Options for processing monthly performance data for past projects").

(2) Feature 2 of the present invention
When predicting the progress of a project, multiple approximation functions can be selected. When predicting the progress of a project, polynomial functions, exponential functions, logarithmic functions, logistic functions, and Bass model functions can be specified as approximation function candidates in the anomaly detection definition master. An approximation function can be selected according to the progress of a project that the user of the anomaly detection system knows from experience.

(3) Feature 3 of the present invention
The progress of a project can be predicted with high accuracy. The approximation curve algorithm of the anomaly detection system of the present invention calculates the reference value and threshold value using actual data, so the accuracy is higher than that of conventional methods.

The anomaly detection system of the present invention can be applied to all business types and industries, and is ideally suited to projects that involve project-based management, such as in the construction industry and IT media industry.

2. Configuration
An example of the configuration of the anomaly detection system 100 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a block diagram showing an example of the configuration of the anomaly detection system 100.

The anomaly detection system 100 is a commercially available desktop personal computer. Note that the anomaly detection system 100 is not limited to stationary information processing devices such as desktop personal computers, but may also be portable information processing devices such as commercially available notebook personal computers, PDAs (Personal Digital Assistants), smartphones, and tablet personal computers.

The anomaly detection system 100 includes a control unit 102, a communication interface unit 104, a memory unit 106, and an input/output interface unit 108. Each unit included in the anomaly detection system 100 is connected to each other so that they can communicate with each other via any communication path.

The communication interface unit 104 communicatively connects the anomaly detection system 100 to the network 300 via a communication device such as a router and a wired or wireless communication line such as a dedicated line. The communication interface unit 104 has the function of communicating data with other devices via the communication line. Here, the network 300 has the function of communicatively connecting the anomaly detection system 100 with the server 200 and the business system 400, and is, for example, the Internet or a LAN (Local Area Network). The business system 400 creates and updates various business data.

An input device 112 and an output device 114 are connected to the input/output interface unit 108. The output device 114 may be a monitor (including a home television), a speaker, or a printer. The input device 112 may be a keyboard, a mouse, a microphone, or a monitor that functions as a pointing device in conjunction with a mouse. Note that, below, the output device 114 may be referred to as the monitor 114, and the input device 112 may be referred to as the keyboard 112 or the mouse 112. Displaying information on the monitor 114 and the user operating the input device 112 may be referred to as "user operation via a UI."

The memory unit 106 stores various databases, tables, files, and the like. The memory unit 106 stores computer programs that work in conjunction with the OS (Operating System) to issue commands to the CPU (Central Processing Unit) to perform various processes. The memory unit 106 can be, for example, a memory device such as RAM (Random Access Memory) or ROM (Read Only Memory), a fixed disk device such as a hard disk, a flexible disk, or an optical disk. The memory unit 106 includes an abnormality determination definition master 106a, a determination result table 106b, an approximate curve result attached information table 106c, monthly actual data and planned/actual data for past cases, monthly actual data and planned/actual data for cases subject to abnormality determination, and the like.

The anomaly determination definition master 106a can be configured as a table that associates and registers anomaly determination definition identification information (anomaly determination definition ID, anomaly determination definition name), acquisition definition, algorithm used (e.g., approximate curve), and parameter settings (X-axis item (e.g., number of months elapsed), Y-axis item (e.g., cumulative actual amount), X-axis scale unified item (e.g., planned construction period), Y-axis scale unified item (e.g., actual amount), approximate function candidate name (e.g., polynomial function, logistic function, Bass model function), smoothness, significance level)). The operator can set the data in the anomaly determination definition master 106a.

The judgment result table 106b is a table for storing judgment result data, which is the result of an abnormality judgment. The judgment result data may include the project code, fiscal year and month, planned completion period progress rate, actual progress rate, forecast value, standard deviation, upper threshold, lower threshold, and judgment result (FALSE or TRUE). For data judged to be abnormal, the judgment result is set to "TRUE", and for other data, it is set to "FALSE".

The approximate curve result attached information table 106c is a table for storing approximate curve result attached information for displaying an abnormality determination graph. The approximate curve result attached information may include an execution history ID, row number, X, Y, upper threshold, and lower threshold. The "execution history ID" is an ID automatically assigned for each execution of abnormality determination, the "row number" is a consecutive number assigned to each row of display data starting from 0, "X" corresponds to the X-axis value of the display data, "Y" corresponds to the Y-axis value of the display data, the "upper threshold" is the upper threshold of the display data, and the "lower threshold" is the lower threshold of the display data.

Monthly performance data for past projects may include the project code (project identification information), accounting year and month, X-axis item (e.g., number of months elapsed), and Y-axis item (e.g., cumulative actual amount).

Planned and actual data for past projects may include project code (project identification information), X-axis scale unified item (e.g., planned construction period), budget, implementation period, and Y-axis scale unified item (e.g., actual amount).

Monthly performance data for cases subject to abnormality detection may include the case code (case identification information), fiscal year, X-axis item (e.g., number of months elapsed), and Y-axis item (e.g., cumulative actual amount).

The planned and actual data for a project subject to abnormality detection may include the project code (project identification information), planned period or target completion period, budget or target, implementation period, and actual amount. The target may include the estimated amount, target retention rate, etc.

The control unit 102 is a CPU or the like that provides overall control of the anomaly detection system 100. The control unit 102 has internal memory for storing control programs such as an OS, programs that define various processing procedures, and required data, and performs various information processing operations based on these stored programs.

The control unit 102 is configured to be able to access the abnormality determination definition master 106a, the determination result table 106b, the approximate curve result attached information table 106c, the monthly actual data and schedule/actual data of past cases, the monthly actual data and schedule/actual data of cases that are subject to abnormality determination, and the like, which are stored in the storage unit 106. Note that the abnormality determination definition master 106a, the determination result table 106b, the approximate curve result attached information table 106c, the monthly actual data and schedule/actual data of past cases, and the monthly actual data and schedule/actual data of cases that are subject to abnormality determination may be provided in another location (for example, the server 200) as long as the control unit 102 is able to access them.

The control unit 102 conceptually includes a data acquisition unit 102a, a data processing unit 102b, an approximate curve calculation unit 102c, a threshold calculation unit 102d, an abnormality determination unit 102e, a screen display control unit 102f, and a master maintenance unit 102g.

The data acquisition unit 102a acquires monthly actual data and planned/actual data for past projects and monthly actual data and planned/actual data for projects subject to abnormality detection from the business system 300, and stores them in the memory unit 106. For example, the data acquisition unit 102a may acquire monthly actual data for past projects and projects subject to abnormality detection, including parameter-set X-axis items (e.g., number of months elapsed) and Y-axis items (e.g., cumulative actual amount), and planned/actual data for past projects and projects subject to abnormality detection, including X-axis scale unified items (e.g., planned construction period) and Y-axis scale unified items (e.g., actual amount), from the business system 300 in accordance with the acquisition definition of the abnormality detection definition master 106a.

The data processing unit 102b processes data to unify the scale of monthly performance data for past projects and projects subject to abnormality detection. The data processing unit 102b may process the monthly performance data for past projects by calculating, for each project identification information, a progress rate by dividing the X-axis item by the X-axis scale unified item of the planned/actual data of the past projects, and a progress rate by dividing the Y-axis item by the Y-axis scale unified item of the data of the past projects. Furthermore, the data processing unit 102b may process the monthly performance data for projects subject to abnormality detection by calculating, for each project identification information, a progress rate by dividing the X-axis item by the planned construction period of the planned/actual data of the project subject to abnormality detection, and a progress rate by dividing the Y-axis item by the budget of the planned/actual data of the project subject to abnormality detection. The X-axis item may include the number of months elapsed, the Y-axis item may include the cumulative actual amount, the X-axis scale unified item may include the planned construction period or implementation period, and the Y-axis scale unified item may include the budget or actual amount.

The approximate curve calculation unit 102c calculates an actual performance approximate curve for all data of the processed monthly performance data of past cases. The approximate curve calculation unit 102c passes the elapsed time rate and progress rate of the processed monthly performance data of past cases and information on one or more approximate function candidates set in the anomaly determination definition master 106a to the approximate component to find optimal coefficients, calculates the AIC based on the coefficients returned from the approximate component, and determines the approximate function with the smallest AIC as the actual performance center approximate function. The one or more approximate function candidates may include at least one of a polynomial function, an exponential function, a logarithmic function, a logistic function, and a Bass model function.

The threshold calculation unit 102d calculates the dispersion of all data of the processed monthly actual data of past cases from the calculated approximation curve, calculates a standard deviation curve that represents the trend of the calculated dispersion, and calculates a threshold based on the actual data center approximation curve and the standard deviation curve. In this case, the threshold calculation unit 102d may substitute each progress rate of the processed monthly actual data of past cases into the actual data center approximation function to calculate a predicted value of the progress rate, calculate the residual, which is the difference between the predicted value and the actual progress rate data, calculate the square of the residual, draw an approximation curve of the residual square approximation function for the square of the residual, and take the square root of the residual square approximation function to obtain the standard deviation function. Substitute each progress rate of the processed monthly actual data of the case to be detected as an anomaly into the actual data center approximation function to calculate a predicted value of the progress rate, and then substitute it into the standard deviation function to calculate the standard deviation. Then, calculate upper and lower thresholds by multiplying the standard deviation by a constant value calculated based on the significance level.

The abnormality determination unit 102e compares the progress rate and progress rate of each case identification information in the processed monthly performance data for the case to be determined as an abnormality with the calculated threshold value to determine an abnormality. If the abnormality determination unit 102e determines that an abnormality has occurred, it may display an abnormality detection message and an abnormality determination graph on the abnormality determination output screen.

The screen display control unit 102f controls the display and input of various screens (e.g., abnormality determination output screen, master maintenance screen, etc.) displayed on the monitor 114.

The master maintenance unit 102g performs settings such as inputting, adding, deleting, and editing data in the abnormality determination definition master 106a, for example, in response to operator operations on the master maintenance screen displayed on the monitor 114.

The screen display control unit 102f controls the display and input of various screens (e.g., store supply alert screen, master maintenance screen, etc.) displayed on the monitor 114.

3. Specific Examples
Specific examples of processing by the control unit 102 of the anomaly detection system 100 according to this embodiment will be described with reference to Fig. 4 to Fig. 46. Fig. 4 is a diagram showing a processing flow for outlining the overall processing by the control unit 102 of the anomaly detection system 100 according to this embodiment. Figs. 5 to 46 are diagrams for explaining specific examples of processing by the control unit 102 of the anomaly detection system 100 according to this embodiment.

[3-1. Processing flow overview]
An overview of the processing flow will be described with reference to Fig. 4. In Fig. 4, the data processing unit 102b executes processing of monthly performance data of past projects (step S1), and processes the monthly performance data of past projects by calculating, for each project identification information, a progress rate obtained by dividing the X-axis item by the X-axis scale uniform item of the plan/performance data of the past project, and a progress rate obtained by dividing the Y-axis item by the Y-axis scale uniform item of the past project data. The X-axis item may include the number of elapsed months, the Y-axis item may include the accumulated performance amount, the X-axis scale uniform item may include the planned construction period or implementation period, and the Y-axis scale uniform item may include the budget or performance amount.

The data processing unit 102b processes the monthly performance data of the anomaly detection target project (step S2), and processes the monthly performance data of the anomaly detection target project by calculating, for each project identification information, the progress rate obtained by dividing the X-axis item by the planned construction period of the planned/actual data of the anomaly detection target project, and the progress rate obtained by dividing the Y-axis item by the budget of the planned/actual data of the anomaly detection target project.

The approximation curve calculation unit 102c executes a performance center approximation curve calculation process (step S3) to calculate a performance center approximation curve for all data of the processed monthly performance data of past cases. In this case, the approximation curve calculation unit 102c passes the elapsed time rate and progress rate of the processed monthly performance data of past cases and information on one or more approximation function candidates set in the anomaly determination definition master 106a to the approximation component to find optimal coefficients, calculates the AIC based on the coefficients returned from the approximation component, and determines the approximation function candidate with the smallest AIC as the performance center approximation function. The one or more approximation function candidates may include at least one of a polynomial function, an exponential function, a logarithmic function, a logistic function, and a Bass model function.

The threshold calculation unit 102d executes a process to calculate the dispersion of data from the performance center approximation curve (step S4), and calculates the dispersion of all data of the processed monthly performance data of past cases from the calculated performance center approximation curve. In this case, the threshold calculation unit 102d substitutes each progress rate of the processed monthly performance data of past cases into the performance center approximation function to calculate a predicted value of the progress rate, calculates the residual, which is the difference between the predicted value and the actual progress rate data, and may further calculate the square of the residual.

The threshold calculation unit 102d executes a process to calculate the tendency of data dispersion (step S5), and calculates a standard deviation curve that represents the calculated tendency of dispersion. In this case, the threshold calculation unit 102d may draw an approximation curve of the residual square approximation function for the square of the residual, and calculate the standard deviation function by taking the square root of the residual square approximation function.

The threshold calculation unit 102d executes a process to calculate the predicted value and threshold for the case to be determined as an anomaly (step S6), and calculates the threshold based on the performance center approximation curve and the standard deviation curve. In this case, the threshold calculation unit 102d may substitute each progress rate of the processed monthly performance data for the case to be determined as an anomaly into a performance center approximation function to calculate the predicted value of the progress rate, and may also substitute it into a standard deviation function to calculate the standard deviation, and calculate upper and lower thresholds with a range above and below the predicted value equal to the value obtained by multiplying the standard deviation by a constant value calculated based on the significance level.

The abnormality determination unit 102e executes the abnormality determination process (step S7) and compares the processed monthly performance data for the case to be determined to be abnormal with the calculated threshold value to determine whether the case is abnormal. In this case, the abnormality determination unit 102e may output an abnormality detection message on the abnormality determination output screen if it determines that an abnormality has occurred.

The abnormality determination unit 102e performs calculation processing of the display data (step S8), creates approximate curve result ancillary information for displaying a graph of the abnormality determination results, stores this information in the approximate curve result ancillary information table 106c, and displays a graph of the abnormality determination results on the abnormality determination output screen based on the approximate curve result ancillary information.

[3-2. Processing flow details]
The above processing flow will be described in detail with reference to FIGS.

(Premise 1)
The abnormality determination definition master 106a is assumed to be registered in advance in the storage unit 106. The abnormality determination definition master 106a is a master for managing definitions for performing abnormality determination on business data.

Figure 5 shows an example of the configuration of the abnormality determination definition master 106a. The abnormality determination definition master 106a associates and registers the abnormality determination definition ID, abnormality determination definition name, data acquisition definition, algorithm used, and parameter settings.

In the example shown in the figure, the anomaly determination definition ID is "JD001", the anomaly determination definition name is "Project progress alert", the algorithm used is "Approximation curve", and the parameter settings are {X-axis item: number of months elapsed, Y-axis item: cumulative actual amount, X-axis scale unified item: planned construction period, Y-axis scale unified item: actual amount, approximate function candidate name: [polynomial function, logistic function, Bass model function], smoothness: 12, significance level: 0.1}.

(Premise 2)
It is assumed that monthly performance data and schedule/performance data of past similar cases are stored in the storage unit 106. The data acquisition unit 102a acquires performance data and schedule/performance data of past cases from the business system 400 and stores them in the storage unit 106.

Figure 6 (A) shows an example of monthly performance data for past cases. Monthly performance data for past cases includes the following data fields: case code, accounting year and month, number of months elapsed (months), and cumulative performance amount (yen). The "accounting year and month" column is not used in the processing flow calculations. In this example, the case codes for past cases are "A001," "A002," and "A003." For simplicity's sake, this explanation uses three cases as an example, but in reality, it is assumed that there will be many past cases to ensure the validity of the anomaly detection results.

Figure 6 (B) is a graph of the monthly performance data for the past projects in Figure 6 (A), with the horizontal axis representing the number of months elapsed (months) and the vertical axis representing the cumulative performance amount (yen).

Figure 6 (C) shows an example of planned and actual data for a past project. Planned and actual data for a past project includes the following fields: project code, planned construction period (months), budget (yen), implementation period (months), and actual amount (yen).

(Premise 3)
The monthly performance data of the case that is the target of abnormality determination and the schedule and performance data before the start of the case are stored in the storage unit 106. The data acquisition unit 102a acquires the monthly performance data of the case that is the target of abnormality determination and the schedule and performance data before the start of the case from the business system 400 and stores them in the storage unit 106.

Figure 7 (A) shows an example of monthly performance data for cases subject to abnormality detection. Monthly performance data for cases subject to abnormality detection includes the following data fields: case code, accounting year and month, number of months elapsed [months], and cumulative performance amount [yen]. The "accounting year and month" column is not used in processing flow calculations, but is used when displaying messages about abnormality detection results. In this example, the case codes for the cases subject to abnormality detection are "B001" and "B002." For simplicity's sake, this explanation uses two cases as an example, but it is assumed that in reality there will be many cases subject to abnormality detection.

Figure 7(B) is a graph of the monthly performance data for the cases in Figure 7(A) that were subject to abnormality detection. The horizontal axis shows the number of months elapsed (months), and the vertical axis shows the cumulative performance amount (yen).

Figure 7 (C) shows an example of planned and actual data for a project that is subject to abnormality detection. The planned and actual data for a project that is subject to abnormality detection includes the following fields: project code, planned construction period [months], budget [yen], implementation period [months], and actual amount [yen]. Because the project that is subject to abnormality detection is an ongoing project, there is no data in the implementation period and actual amount columns.

(Premise 4)
The control unit 102 is equipped with a calculation component (hereinafter referred to as an "approximation component") that determines the optimal coefficients of a function. The approximation component returns the optimal coefficients by passing the following information to it. The approximation component will be described below with reference to FIG. 8.

Figure 8 (A) shows an example of information (1) passed to the approximating part, which passes the data for which you want to draw an approximate curve. The data for which you want to draw an approximate curve is a pair of data such as (X, Y), which corresponds to the values on the horizontal axis X and vertical axis Y when viewed on a graph.

8B shows an example of information (2) to be passed to the approximating part, which passes the function to be approximated. In this example, y = ^ax² + bx + c. The characters other than x and y in the function to be approximated are coefficients.

In the processing within the approximating component, for example, if the function to be approximated is y = ax ² + bx + c, in the above example, the approximating component calculates optimal coefficients of a = 0.5, b = -3.5, c = 7.6. The function to be approximated is not limited to this example, and may be y = a, y = ax + b, etc.

Figure 8 (C) shows an example of information returned by the approximating component, which returns the optimal coefficients for the function to be approximated, obtained through processing within the approximating component. In this example, the information returned by the approximating component is the coefficients a = 0.5, b = -3.5, and c = 7.6.

(S1: Processing of monthly performance data of past cases)
9 and 10, the processing of monthly performance data for past cases will be described. In the processing of monthly performance data for past cases, the number of elapsed months and the cumulative performance amount of the monthly performance data for past cases are converted into values in which the X-axis scale unified item and the Y-axis scale unified item are set to 100%. Specifically, the following calculation process is performed based on the data registered in the parameter setting column of the abnormality determination definition master 106a.

(1) Divide the value of the X-axis item column of the monthly performance data by the value of the X-axis scale unification item.
(2) Divide the value of the Y-axis item column of the monthly performance data by the value of the Y-axis scale unification item.

The following explanation uses case code "A003" for the monthly performance data of past cases as an example. The values by which to divide the X-axis and Y-axis items of the monthly performance data of past cases can be set in the X-axis scale unification item and Y-axis scale unification item of the anomaly judgment definition master 106a. Differences in the processed data due to differences in the setting of the scale unification item will be explained later in [3-3. Options for processing monthly performance data of past cases].

Figure 9 (A) is a diagram showing an example of the settings for the anomaly determination definition master 106a. Figure 9 (B) is a diagram showing an example of monthly performance data for A003. Figure 9 (C) is a diagram showing an example of planned and performance data for A003.

Figure 9 (D) shows an example of the processed monthly actual data for A003. According to the setting example of the anomaly determination definition master 106a, the planned construction period elapsed rate [%] is calculated by dividing the X-axis item "Number of months elapsed" by the X-axis scale unified item "Planned construction period", and the actual progress rate [%] is calculated by dividing the Y-axis item "Cumulative actual amount" by the Y-axis scale unified item "Actual amount".

This data processing falls under "Pattern B: Flexible scheduled construction period, strict budget" in [3-3. Options for processing monthly performance data for past projects].

The characteristics of the processed data are as follows. The planned completion rate is calculated by dividing the number of months elapsed by the construction period before the project began, so if the project 1. finishes earlier than planned, the planned completion rate in the final elapsed month will be less than 100%, and 2. if it takes longer than planned, the planned completion rate in the final elapsed month may exceed 100%. Additionally, since the actual progress rate is calculated by dividing the cumulative actual amount by the actual amount, the actual progress rate in the final elapsed month will always be 100%.

After processing the data for all past cases "A001" to "A003" as described above for "A003," the data will look like the one shown in Figure 10. Figure 10(A) shows an example of the processed monthly performance data for A001 to A003. Figure 10(B) shows an example of the data in Figure 10(A) graphed (Feature 1 of the present invention, above).

(S2: Processing of monthly performance data for cases subject to abnormality determination)
11 and 12, the details of the processing of monthly performance data for cases subject to abnormality detection will be described. In the processing of monthly performance data for cases subject to abnormality detection, the number of elapsed months and the cumulative performance amount of the monthly performance data for the cases subject to abnormality detection are divided by the planned construction period and budget, respectively. Specifically, the following processing is performed.

(1) Divide the number of months elapsed by the planned construction period.
(2) Divide the cumulative actual amount by the budget.

We will use case code "B001" for the monthly performance data of a case subject to abnormality detection as an example. Figure 11(A) shows an example of monthly performance data for B001. Figure 11(B) shows an example of planned and performance data for B001.

Figure 11 (C) shows an example of the monthly actual data for B001 after processing. According to the setting example of the anomaly determination definition master 106a, the planned construction period elapsed rate [%] is calculated by dividing the X-axis item "Number of months elapsed" by the X-axis scale unified item "Planned construction period", and the budget progress rate [%] is calculated by dividing the Y-axis item "Cumulative actual amount" by "Budget" (in past cases, division was done by "Actual amount", but here it is divided by "Budget").

After processing the data for all cases "B001" to "B002" that are subject to abnormality detection, as described above for "B001," the data will look like that shown in Figure 12. Figure 12(A) shows an example of the monthly performance data for B001 to B002 after processing. Figure 12(B) shows an example of the data in Figure 12(A) graphed.

(S3: Performance center approximation curve calculation process)
The details of the performance centered approximation curve calculation process will be explained with reference to Figures 13A to 15. In the performance centered approximation curve calculation process, the data is not distinguished by project code, but an approximation curve is calculated using approximation components based on all data for past project monthly performance data. This process has the following features:

(1) The options for approximation functions include polynomial functions, exponential functions, logarithmic functions, logistic functions, and Bass model functions, and multiple options can be selected.
(2) Among the selected functions, the one with the best AIC (Akaike Information Criterion), an index for measuring the accuracy of approximation, will be the approximation curve used in the subsequent processing flow.

Hereafter, the approximation function deemed to have the best approximation accuracy will be referred to as "Y = F(X)", the name of this approximation function will be called the "performance-centered approximation function", and the curve that results when this approximation function is plotted on a graph will be called the "performance-centered approximation curve". X represents the planned completion rate, Y represents the actual progress rate, and F represents the performance-centered approximation function. By passing X (the planned completion rate) to F, the predicted value of Y (the actual progress rate) can be calculated.

The above "bus model function" is used by the Ministry of Land, Infrastructure, Transport and Tourism to estimate the progress rate of construction work. In addition, polynomial functions and logistic functions are also used for comparison with the bus model function (https://www.mlit.go.jp/sogoseisaku/jouhouka/content/001348995.pdf).

Specifically, the following processing is performed:

(1) Among the parameter settings registered in the abnormality determination definition master 106a, information on the X-axis item, Y-axis item, and function for each approximate function candidate name is passed to the approximation component to find the optimal coefficient.
(2) Calculate the AIC based on the coefficients returned from the approximate parts.
(3) The approximate function with the smallest AIC is set as the performance center approximate function.

Each process will be described in detail below.
(1) Among the parameter settings registered in the abnormality determination definition master 106a, information on the X-axis item, Y-axis item, and function for each approximate function candidate name is passed to the approximation component to find the optimal coefficient.

In Figures 13A and 13B, (A) shows example data from the anomaly determination definition master 106a. In this example, the anomaly determination definition ID is "JD001," the anomaly determination definition name is "Project Progress Alert," the algorithm used is "Approximation Curve," and the parameter settings are {X-axis item: Number of months elapsed, Y-axis item: Cumulative actual amount, Approximation function candidate names: [Polynomial function, Logistic function, Bass model function], ...}. The options for the approximation function correspond to the approximation function candidates in the parameter settings for the data registered in the anomaly determination definition master 106a, and the X and Y values of the data for which an approximation curve is to be drawn correspond to the processed values in the X value item and the Y value item in the parameter settings for the data registered in the anomaly determination definition master 106a.

(B) shows an example of monthly performance data for a past project after processing. (C) shows the approximate function candidates, including polynomial functions, logistic functions, and bus model functions. If a polynomial function is selected, polynomial function expressions of degrees 0 to 6 will be passed. In this example, polynomial functions, logistic functions, and bus model functions have been selected as approximate function candidates, so the nine functions to be approximated that will be passed to the approximation component are the ones shown above. Exponential functions and logarithmic functions may also be selected as approximate function candidates.

The following process is performed for each candidate approximation function. As an example, we will explain the case where the function to be approximated is y = a/(1 + ebx + c) (logistic function). (D) shows an example of information (1) (data to be passed as an approximate curve) passed to the approximation component. (E) shows an example of information (2) (function to be approximated) passed to the approximation component. (F) shows an example of the information (coefficients) returned from the approximation component, where a = 100.85, b = -0.069, and c = 3.68.

(2) Calculate the AIC based on the coefficients returned from the approximate parts. For information on calculating the AIC, see http://www.radio3.ee.uec.ac.jp/ronbun/TR_YK_048_AIC.pdf.

In Figure 14, (A) shows the formula for calculating AIC, which is AIC = (data size) x log (sum of squares of differences from predicted value) / (data size) + 2 x (number of coefficients). Here, the predicted value of Y is calculated by substituting X, the data for which you want to draw an approximate curve, into the approximation function. The square of the difference from the predicted value of Y is calculated as the square of (Y value - predicted value of Y) of the data for which you want to draw an approximate curve. The data size is the number of data (X, Y) pairs.

A characteristic of AIC is that the smaller the sum of squares of the difference from the predicted value, the smaller the AIC; and the larger the number of coefficients, the larger the AIC. The AIC value itself has no meaning; comparing AIC values is an indicator used to determine the superiority of an approximation function. The AIC formula is explained below. The first term in the AIC formula, "(data size) x log (sum of squares of the difference from the predicted value) / (data size)," represents the accuracy of the data for which the approximate curve is to be drawn, while the second term, "2 x (number of coefficients)," represents the penalty for having a large number of coefficients. By determining the superiority of an approximation function based on AIC, a well-balanced approximation function that is robust to data changes and does not overly fit the data for which the approximate curve is to be drawn is selected. The benefits of determining the superiority of an approximation function based on AIC are explained below. Even if the amount of actual data from past projects increases over time, an approximation function that overly fits past data is not selected. This provides the following two benefits: (1) It prevents the type and order of the approximation function from frequently changing each time an anomaly is detected. (2) Even if the number of projects that deviate significantly from the planned progress is dramatically reduced due to thorough project progress management, the approximation curve will shift gradually before and after thorough management.

(B) shows the data (X, Y) for which you want to draw an approximate curve. (C) shows the predicted value of Y and the sum of squares of the difference between the predicted value of Y and the data.

When the data size, the sum of squares of the difference between the predicted value of Y, the coefficient, and the number of coefficients (3) are substituted into the AIC calculation formula, the AIC becomes 94.18, as shown in (D).

When the above process is completed for all approximate function candidates, data such as that shown in Figure 15(A) can be obtained, and the AICs for all approximate function candidates can be obtained. In the figure, the "..." is replaced with actual numerical values.

(3) The approximate function with the smallest AIC is set as the performance center approximate function.
The processing flow will be explained under the assumption that, after calculating the AIC for all candidate approximation functions, the AIC for the logistic function is the smallest. If the performance-centered approximation function is Y = F(X), then in this explanation, the performance-centered approximation function will be y = 100.85/(1 + e ^{- 0.069X + 3.68} ), as shown in Figure 15(B). This is the function with the smallest AIC, and the coefficients are set to the function to be approximated. Hereafter, this function will be referred to as F(X) (Features 2 and 3 of the present invention).

(S4: Processing to calculate data dispersion from the performance center approximation curve)
The process of calculating the dispersion of data from the performance center approximation curve will be described in detail with reference to Figures 16 and 17. The process of calculating the dispersion of data from the performance center approximation curve involves the following steps.

(1) Calculate the predicted value of the actual progress rate for each scheduled progress rate of the monthly performance data of past projects.
(2) Calculate the difference (residual) between the predicted value and the actual data of the performance progress rate.
(3) Calculate the square of the residual (square of the residual).

A specific calculation will be described with reference to FIG.
(1) The predicted value of the actual progress rate is calculated as follows: predicted value = F (progress rate of construction period).
(2) The residual, which is the difference between the actual progress rate and the predicted value, is calculated as follows: Residual = Actual progress rate - Predicted value.
(3) Calculate the square of the residual: residual squared = (residual) ² .

FIG. 16(A) shows the planned completion time lapse rate [%] and actual progress rate [%] of actual data for past projects. FIG. 16(B) shows the newly added columns: forecast value [%], residual [%], and squared residual [% ² ]. The forecast value [%] is calculated by passing the planned completion time lapse rate to the actual performance center approximation function F(X). Because the residual is squared, all residual squares are greater than or equal to 0. By squaring the residual, the magnitude of the squared residual can be expressed as the degree to which the past performance data deviates from the approximation curve.

Figure 17 (A) is a graph showing predicted values and approximate curves for past project data. The horizontal axis shows the planned progress rate [%], and the vertical axis shows the actual progress rate [%]. Past actual data is plotted, and predicted values are plotted on the approximate curve. The actual progress rate minus the predicted value shows the residual.

Figure 17(B) is a graph showing the residuals, with the horizontal axis representing the progress rate [%] and the vertical axis representing the residuals [%].

FIG. 17C is a graph showing the square of the residual, with the horizontal axis representing the progress rate [%] and the vertical axis representing the square of the residual [% ² ].

(S5: Processing to calculate the data dispersion tendency)
The process of calculating the tendency of data dispersion will be described in detail with reference to Figures 18A to 20. The process of calculating the tendency of data dispersion involves the following steps.

(1) Draw an approximation curve for the square of the residual, name this approximation function the residual square approximation function, and let this residual square approximation function be σ ² = V(X). The residual square approximation function is in the form of (polynomial function) ^2. By passing X (the planned completion time progress rate) to the residual square approximation function, the predicted value of the residual square at that planned completion time progress rate will be returned.
(2) Take the square root of the residual square approximation function, name this function the standard deviation function, and let this standard deviation function be σ = S(X). By passing X: the planned completion period progress rate to the standard deviation function, the standard deviation (the degree of dispersion of the actual progress rate) for that planned completion period progress rate is returned.

By taking the square root of the residual square approximation function, we can create a function that returns the standard deviation, as explained in [3-4. Why we calculate the tendency of data dispersion]. The specific process is explained below.

(1) Draw an approximate curve using approximate parts for the square of the residual (this curve is called the residual square approximate curve).
18A and 18B, (A) shows the planned completion period elapsed rate [%], actual progress rate [%], forecast value [%], residual [%], and square of residual [% ² ] of the actual data of past projects. (B) shows candidates for the residual square approximation function.

(Polynomial Function) The reason why function ² is specified as the function to be approximated is as follows.
1. Because we are not approximating the progress rate of the project, there is no need to specify special functions such as bus model functions that are said to represent the progress of the project, so we specify as simple a function as possible.
2. When approximating the actual progress rate, the actual progress rate increases as the progress rate of the scheduled completion period progresses, but the squared residual may increase or decrease as the progress rate of the scheduled completion period progresses. Therefore, (polynomial function) ² is used to capture the increase or decrease in the squared residual.
3. (Polynomial function) By setting it to ² , the square root of the residual square approximation function (polynomial function) can be used later as the standard deviation function.

The following process is performed for each candidate residual squared approximation function. As an example, we will explain the case where the function to be approximated is y = ( ^ax² + bx + c) ^² . In Figures 18A and 18B, (C) shows information (1) (data for which an approximate curve is to be drawn) passed to the approximating part, and (D) shows information (2) (function to be approximated) passed to the approximating part. (E) shows the information returned from the approximating part, with coefficients a = -0.0028, b = 0.3209, and c = 2.1336.

Next, the AIC is calculated. This is the same process as (S3: Performance Center Approximation Curve Calculation Process) in the processing flow, so a detailed explanation will be omitted.

When the above process has been completed for all candidate functions that approximate the square of the residual, the data shown in Figure 19 (A) will be obtained.

In this example, the function with the smallest AIC, with coefficients set to the function to be approximated, is the residual square approximation function y = (-0.0028x ² + 0.3209x + 2.1336) ² , as shown in Figure 19 (B). Hereafter, the following explanation of the processing flow will proceed under the assumption that the AIC of this (quadratic function) ² function was the smallest. The residual square approximation function is assumed to be σ ² = V(X). In this example, V(X) = (-0.0028X ² + 0.3209X + 2.1336) ² .

19(C) shows a graph in which the residual square approximation curve V(X) is plotted against the square of the residual, with the horizontal axis representing the planned completion period elapsed rate [%] and the vertical axis representing the residual square [% ² ]. By drawing an approximation curve in this way, it is possible to take into account the variation in data depending on the completion period elapsed rate, such as the deviation from the approximation curve being small from the start of the project to the early and late stages, and the deviation being large in the middle stages.

(2) Calculate the standard deviation function.
When the planned completion progress rate is passed to X of the residual square approximation function calculated in (1), the output value is in units of [% ² ], so it is converted to a standard deviation function in units of [%] by taking the square root. The standard deviation function S(X) is calculated as S(X) = √V(X). In this processing flow example, V(X) = (-0.0028X ² + 0.3209X + 2.1336) ² , so S(X) = -0.0028X ² + 0.3209X + 2.1336.

Figure 20(A) shows the progress rate, progress rate, forecast value, residual, and the square of the residual plus the absolute value of the residual for the performance data of past projects. Figure 20(B) shows a graph displaying the standard deviation function V(X) as a standard deviation curve, with the horizontal axis representing the progress rate [%] and the vertical axis representing the absolute value of the residual [% ² ]. The absolute value of the residual represents the distance of deviation between the performance data of past projects and the performance center approximation curve. Note that in actual calculation processing, the absolute value of the residual is not calculated from the residual between the performance data of past projects and the forecast value using the performance center approximation function, but is provided as a reference when displaying the standard deviation curve on a graph.

The meaning of drawing an approximate curve to the squared residuals and taking the square root of that approximate function will be explained in detail in [3-4. Why calculate the tendency of data dispersion].

(S6: Calculation process of predicted value and threshold value for abnormality determination target case)
21 to 24, the details of the calculation process of the predicted value and threshold value for an abnormality detection target case will be explained. The actual result center approximation function F(X) and standard deviation function S(X) for finding the predicted value of the actual progress rate have been prepared through the processing up to this point. In the calculation process of the predicted value and threshold value for an abnormality detection target case, past case data is not used, and the actual data of the abnormality detection target case is used for the calculation. In the calculation process of the predicted value and threshold value for an abnormality detection target case, the following processing is performed on the processed actual data of the abnormality detection target case.

(1) A predicted value is calculated using the planned completion period progress rate/actual result center approximation function F(X).
(2) Calculate the standard deviation (the predicted value of the distance of deviation from the approximate curve) using the scheduled construction period progress rate/standard deviation function S(X).
(3) The upper and lower thresholds are set by providing a range above and below the predicted value equal to the standard deviation multiplied by a constant value calculated based on the significance level.

(1) Calculate the predicted value. Calculate the predicted value of the actual progress rate for the project to be determined as abnormal based on the planned progress rate.

Figure 21 (A) shows the processed actual data for a project subject to anomaly detection, with columns for predicted values added to the project code, fiscal year and month, progress rate, and actual progress rate. The predicted values are calculated using the performance center approximation function F(X), where x = progress rate.

Figure 21 (B) is a graph of the predicted values in Figure 21 (A), with the horizontal axis representing the planned progress rate [%] and the vertical axis representing the actual progress rate [%].

(2) Calculate the standard deviation. Calculate the standard deviation of the planned completion period progress rate for projects subject to abnormality detection after processing.

Figure 22 (A) shows the processed performance data for a project subject to anomaly detection, with the standard deviation column added to the project code, fiscal year and month, planned completion period elapsed rate, actual progress rate, and forecast value. The standard deviation is calculated using the standard deviation function S(X), where x = planned completion period elapsed rate. The calculated standard deviation means that there is a 68% chance that the performance data will fall within a range that is the standard deviation away from the performance center approximation curve.

FIG. 22(B) is a graph of the standard deviation of FIG. 22(A), where the horizontal axis represents the progress rate [%] and the vertical axis represents the standard deviation [% ² ].

(3) Determine the threshold value.
Figure 23 (A) shows the processed monthly performance data for a project to be judged as abnormal, with columns for upper threshold [%] and lower threshold [%] added to the project code, fiscal year and month, planned completion period progress rate, actual progress rate, forecast value, and standard deviation.

23(B), the thresholds are calculated as follows: upper threshold = predicted value + Z _α/2 × (standard deviation), lower threshold = predicted value - Z _α/2 × (standard deviation). Z _α/2 means the value of the upper α/2 percentile of the standard normal distribution. For this α, the value of the parameter setting (significance level) registered in the anomaly determination definition master 106a in premise (1) is used.

Figure 24 (A) shows an example of data in the abnormality determination definition master 106a, in which the parameter {significance level: 0.1} is set for the abnormality determination definition ID "JD001."

For example, if the significance level α is 0.1, then α/2 = 0.05 (5%), and Z _α/2 = 1.645. In this case, in Figure 24 (B), for the record of the abnormality judgment target project B001 where the planned completion period elapsed rate is 40%, the upper threshold = 28.678 + 1.645 x 10.415, and the lower threshold = 28.678 - 1.645 x 10.415. This can be interpreted as meaning that there is about a 90% probability that the actual performance progress rate will be above the lower threshold and below the upper threshold. Conversely, if this range is exceeded, it is judged to be abnormal.

Figure 24 (C) is a graph of the predicted values, upper threshold, and lower threshold of Figure 23 (B), with the horizontal axis representing the planned completion period elapsed rate [%] and the vertical axis representing the actual progress rate [%]. Note that while graphs of the actual performance center approximation curve and the upper and lower thresholds are shown, they are for reference purposes only.

Figure 24(D) is a diagram explaining the significance level and percentile (https://ai-trend.jp/basic-study/normal-distribution/normal-distribution/).

(S7: Abnormality determination process)
The abnormality determination process will be described in detail with reference to Figures 25 to 27. The abnormality determination process includes the following steps.

(1) Anomaly detection is performed based on the monthly performance data of the case to be detected and the threshold value obtained in the previous process.
(2) The data of the determination result is stored in a table (not shown) in the storage unit 206 .

The abnormality determination process will be specifically described below.
(1) For a case to be judged as an anomaly, an anomaly is judged by comparing the actual progress rate of the case to be judged as an anomaly with the threshold value obtained in the previous process.

Figure 25 (A) shows the project code, fiscal year and month, progress rate, forecast value, standard deviation, upper threshold, and lower threshold for the actual data of the project subject to abnormality detection.

Figure 25(B) shows a graph of the anomaly determination in Figure 25(A), with the horizontal axis representing the planned completion period elapsed rate [%] and the vertical axis representing the actual progress rate [%], and plotting the actual performance center approximation curve, upper threshold, lower threshold, B001, and B002. In the figure, B001's planned completion period elapsed rate of "40" and actual progress rate of "60" exceed the upper threshold and are therefore determined to be abnormal. B002's planned completion period elapsed rate of "57.143" and actual progress rate of "20" are also determined to be abnormal because they fall below the lower-upper threshold. For example, if the upper threshold is exceeded, the possibility of fraudulent overstating of actual performance is detected. If the lower threshold is below the lower threshold, the possibility of a delay in progress is detected.

(2) The judgment result data is stored in the judgment result table 106b.
26 is a diagram showing an example of judgment result data. The judgment result data may include the case code, accounting year and month, progress rate for the planned completion period, actual progress rate, forecast value, standard deviation, upper threshold, lower threshold, and judgment result (FALSE or TRUE). For data judged to be abnormal, the judgment result is set to "TRUE", and for other data, it is set to "FALSE".

If an anomaly is detected, a message indicating this is displayed. Figure 27 shows an example of an anomaly detection message. The anomaly detection message displays the anomaly detection definition name, the case code in which the anomaly was detected, the calculation method, the fiscal year, the actual progress rate, and the deviation from the threshold. In the example shown in the figure, the following is displayed: {Anomaly detection definition: JD001 Case progress alert, Case: B001, Fiscal year/month: 202203, Calculation method: Approximate curve (significance level: 0.1), Actual progress rate: 60%, Automatically detected because the actual progress rate for fiscal year/month 202203 exceeded the upper limit (45.81%). It exceeds the reference value by 14.19.}.

(S8: Calculation process of display data)
The display data calculation process will be described in detail with reference to Figures 28 to 30. Through the process up to this point, the performance center approximation function F(X) and standard deviation function S(X) based on past cases have been determined. In the display data calculation process, data for display (for displaying the approximation curve on the screen) is created and the results are stored in a table for ancillary information.

The calculation process for display data involves the following steps.
(1) The progress rate of the construction period is calculated to display the data for display.
(2) The values on the approximation curve of the data to be displayed, and the values of the upper and lower thresholds are calculated.
(3) The results of the approximate curve algorithm are stored in the attached information table.

The specific processing contents will be explained below.
(1) The progress rate of the construction period to be displayed as data for display is calculated.
The progress rate of the construction period of the displayed data is obtained by dividing the minimum and maximum values of the progress rate of the construction period of the past project data by the value of a parameter called "smoothness." Figure 28 shows a graph of the actual data of past projects, with the horizontal axis representing the planned progress rate [%] and the vertical axis representing the actual progress rate [%], and A001, A002, and A003 are plotted.

This range of 0-120% of the planned progress rate is divided into 12 equal parts with a smoothness of 12 to prepare the progress rate of the progress rate for display data. For the smoothness, the parameter setting (smoothness) value registered in the anomaly judgment definition master 106a in premise (1) is used.

Figure 28 (B) shows an example of data settings in the abnormality determination definition master 106a. In the example shown in the figure, the parameter "Smoothness: 12" is set for the abnormality determination definition ID "JD001."

As shown in Figure 31, when the display data is displayed on the screen, the predicted value, upper threshold, and lower threshold may be displayed as a line graph, so the larger the "smoothness" value, the smoother the line graph will be, closer to a curve.

By dividing 0-120% into 12 equal parts, the construction progress rate for display data as shown in Figure 28 (C) is prepared. In this example, the interval between each construction progress rate is 10%, which is 12 equal parts of 0-120%, and the number of points for display data is 13.

(2) The values on the approximation curve of the data to be displayed, and the values of the upper and lower thresholds are calculated.
Using F(X) and S(X) obtained when processing the actual data of past cases, the values on the approximation curve for the progress rate of the construction period of the data to be displayed and the values of the upper and lower thresholds are calculated. Since this is exactly the same processing as that used to calculate the predicted values and thresholds for cases subject to abnormality detection, a detailed explanation of the calculation process will be omitted.

After the calculation process, the display data will be as shown in Figure 29(A), with columns for predicted value, upper threshold, and lower threshold added to the planned completion period elapsed rate. Figure 29(B) is a graph (line graph) of the display data in Figure 29(A), with the horizontal axis representing the planned completion period elapsed rate [%] and the vertical axis representing the actual progress rate [%], with the predicted value, upper threshold, and lower threshold plotted. The values of the white dots on the graph are calculated.

As can be seen from the graph, the width between the upper and lower thresholds and the performance center approximation curve is calculated using the standard deviation function, resulting in thresholds that reflect the following two characteristics:

1. In the early and later stages of a project, there is little chance of deviation from the approximate curve. Therefore, even a slight deviation from the approximate curve is highly abnormal, so the threshold range is narrow.
2. There is a high possibility of deviation from the approximate curve in the middle stage of a project. As a result, even if something is normal, there is a possibility of deviation from the approximate curve to some extent, and even if there is a slight deviation, it is not considered abnormal, so the range of the threshold is wide.

(3) The approximate curve result is stored in the attached information table 106c.
The following display data is stored in an approximate curve algorithm result attached information table (hereinafter referred to as the "approximate curve result attached information table"). The approximate curve result attached information table 106c stores data to be displayed as supplementary information when the anomaly determination result is displayed as a graph on the screen. Unlike the data of the case to be determined to be anomaly, data to be compared with the data of the case to be determined to be anomaly is stored. The stored data is calculated based only on data of past cases.

Figure 30 (A) shows an example of display data, and Figure 30 (B) shows an example of approximate curve result ancillary information stored in the approximate curve result ancillary information table 106c based on the display data. The approximate curve result ancillary information includes the following fields: execution history ID, line number, X, Y, upper threshold, and lower threshold.

Here, the execution history ID is an ID automatically assigned for each execution of an abnormality determination, the row number is a consecutive number assigned to each row of display data starting from 0, X corresponds to the X-axis value of the display data, Y corresponds to the Y-axis value of the display data, the upper threshold is the upper threshold of the display data, and the lower threshold is the lower threshold of the display data.

As described above, if an abnormality is detected using the judgment result data (see Figure 26) and the information attached to the approximate curve result (see Figure 30(B)), a message indicating the abnormality is detected and a graph of the abnormality judgment result (e.g., a line graph) is displayed. Figure 31 shows an example of an abnormality detection message (same as Figure 27) and an example of a graph of the abnormality judgment result. In the example graph of the abnormality judgment result, the horizontal axis is the planned completion period elapsed rate [%] and the vertical axis is the actual progress rate [%], and the predicted value, threshold value (upper and lower), and B001 are plotted. B001 is displayed based on the judgment result data. The predicted value and threshold value (upper and lower) are displayed based on the information attached to the approximate curve result.

[3-3. Options for processing monthly performance data for past projects]
32 to 41, options for processing monthly performance data of past cases will be described (Feature 1 of the present invention). As described above, scale unification items can be set in the abnormality determination definition master 106a.

Figure 32 is a diagram showing an example of the settings for the abnormality determination definition master 106a. The assumed item set for the X-axis scale unified item is the planned construction period or implementation period, and the assumed item set for the Y-axis scale unified item is the budget or actual amount. The example of the settings for the abnormality determination definition master 106a shown in Figure 32 is an example for the construction industry, but since it is also expected to be used in other industries, Figure 33 shows an example of settings for other industries.

Figure 33 (A) shows an example for the systems development industry, with the X-axis item being "Elapsed man-hours," the Y-axis item being "Cumulative sales amount," the X-axis unified scale item being "Planned man-hours OR Actual man-hours," and the Y-axis unified scale item being "Estimated amount OR Sales amount."

Here, [Elapsed man-hours [man-days]] is the man-hours required since system development began. [Cumulative sales amount [yen]] is the amount recorded as sales after the elapsed man-hours have elapsed. [Planned man-hours [man-days]] is the planned man-hours required until development is complete, determined before system development begins. [Actual man-hours [man-days]] is the man-hours required until development is complete, determined after system development is complete. [Estimated amount [yen]] is the amount determined before system development begins and planned to be recorded as sales upon development completion. [Sales amount [yen]] is the sales amount recorded upon development completion, determined after system development is complete.

Figure 33 (B) shows an example from the corporate training industry, with the X-axis item being "number of days elapsed in training," the Y-axis item being "learning retention rate," the X-axis scale unified item being "planned completion date OR actual required number of days," and the Y-axis scale unified item being "target retention rate OR actual retention rate."

Here, [Number of days elapsed since training began [days]] is the number of days that have passed since training began. [Learning retention rate [%]] is the retention rate determined by check tests, etc., at the point in time when training has begun. [Planned completion date [days]] is the number of days planned until the end of training, determined before the start of training. [Actual number of days required [days]] is the number of days required for training, determined after training has ended. [Target retention rate [%]] is the retention rate of the target that participants are expected to achieve, determined before training begins. [Actual retention rate [%]] is the actual retention rate of participants, determined after training has ended.

In addition, the X-axis item, Y-axis item, X-axis scale unification item, and Y-axis scale unification item can be freely set according to the industry of the user of this anomaly detection system.

Figure 34 (A) shows an example of monthly performance data for past projects. Figure 34 (B) shows an example of planned and performance data for past projects.

Referring to Figure 35, four methods for processing data from past cases are explained. Data is classified into four patterns, A, B, C, and D, based on the parameter settings of the anomaly determination definition master 106a.

A. When the X-axis scale is unified: implementation period, and the Y-axis scale is unified: actual amount B. When the X-axis scale is unified: planned construction period, and the Y-axis scale is unified: actual amount C. When the X-axis scale is unified: implementation period, and the Y-axis scale is unified: budget D. When the X-axis scale is unified: planned construction period, and the Y-axis scale is unified: budget

Pattern names for patterns A, B, C, and D will be as follows: Pattern A will be "strict scheduled construction period and budget type", Pattern B will be "flexible scheduled construction period and strict budget type", Pattern C will be "strict scheduled construction period and flexible budget type", and Pattern D will be "flexible scheduled construction period and budget type".

"Strict" and "Flexible" mean checking, respectively, rigorously and flexibly at the time of project completion to ensure that the project was completed within the planned timeframe and budget. Below are examples of each pattern A to D.

(Pattern A. Strict scheduled construction period and budget type (X-axis scale unified item: implementation period, Y-axis scale unified item: actual amount))
Pattern A, the strict scheduled construction period/budget type, will be explained with reference to Figures 36 and 37. An example of processing A003 will be explained below. Figure 36(A) shows an example of monthly actual data for A003, and Figure 36(B) shows an example of scheduled/actual data for A003. When the monthly actual data for A003 is processed and the implementation period elapsed rate is calculated by dividing the number of months elapsed by the implementation period, and the actual progress rate is calculated by dividing the cumulative actual amount by the actual amount, the result is as shown in Figure 36(C).

When the monthly performance data for all past cases is processed, it will look like Figure 37(A). Figure 37(B) is a graph of the monthly performance data for past cases in Figure 37(A), and Figure 38(C) shows a graph after calculation processing of the display data.

Since the maximum X-axis value for past projects is all 100%, the threshold calculated in subsequent processing will converge with an X value close to 100%. This makes it possible to strictly check that projects subject to abnormality detection are completed on schedule before they start. Also, since the maximum Y-axis value for past projects is all 100%, the threshold calculated in subsequent processing will converge with a Y value close to 100%. This makes it possible to strictly check that projects subject to abnormality detection are completed on budget before they start.

(Pattern B. Flexible construction schedule and strict budget (X-axis scale unified item: planned construction schedule, Y-axis scale unified item: actual amount))
Pattern B, flexible scheduled construction period/strict budget type, will be explained with reference to Figures 38 and 39. An example of processing A003 will be explained below. Figure 38(A) shows an example of monthly actual data for A003, and Figure 38(B) shows an example of planned and actual data for A003. When the monthly actual data for A003 is processed and the planned construction period elapsed rate is calculated by dividing the number of elapsed months by the scheduled construction period, and the actual progress rate is calculated by dividing the cumulative actual amount by the actual amount, the result is as shown in Figure 38(C).

When the monthly performance data for all past cases is processed, it will look like Figure 39(A). Figure 39(B) is a graph of the monthly performance data for past cases in Figure 39(A), and Figure 39(C) shows the graph after calculation processing of the display data.

Since the maximum X-axis value for past projects is 120%, the threshold calculated in subsequent processing will converge to an X value of around 120%. This means that even if a project to be judged as abnormal is completed with a slight delay, it can be determined to be within the normal range. Furthermore, since the maximum Y-axis value for past projects is all 100%, the threshold calculated in subsequent processing will converge to a Y value of around 100%. This makes it possible to strictly check that projects to be judged as abnormal are completed according to the budget before they began.

(Pattern C: Strict scheduled construction period, flexible budget (X-axis scale unified item: implementation period, Y-axis scale unified item: budget))
Pattern C, a strict scheduled construction period with a flexible budget, will be described with reference to Figures 40 and 41. An example of processing A003 will be described below. Figure 40(A) shows an example of monthly actual data for A003, and Figure 40(B) shows an example of the scheduled and actual data for A003. When the monthly actual data for A003 is processed and the implementation period progress rate is calculated by dividing the number of months elapsed by the implementation period and the budget progress rate by dividing the cumulative actual amount by the budget, the result is as shown in Figure 40(C).

When the monthly performance data for all past cases is processed, it will look like Figure 41(A). Figure 41(B) is a graph of the monthly performance data for past cases in Figure 41(A), and Figure 41(C) shows a graph after calculation processing of the display data.

Since the maximum value of the X-axis for past projects is always 100%, it is possible to strictly check that projects subject to abnormality detection are completed on the scheduled time before they start. Also, since the budget progress rate at the time of completion of past projects varies depending on the project, an abnormality will not be detected even if the budget progress rate at the time of project completion is slightly different from 100%.

(Pattern D. Flexible scheduled construction period and budget (X-axis scale unified item: scheduled construction period, Y-axis scale unified item: budget)
Pattern D, flexible scheduled construction period and budget, will be explained with reference to Figures 42 and 43. An example of processing A003 will be explained below. Figure 42(A) shows an example of monthly actual data for A003, and Figure 42(B) shows an example of planned and actual data for A003. When the monthly actual data for A003 is processed and the planned construction period progress rate is calculated using the number of elapsed months divided by the scheduled construction period, and the budget progress rate is calculated using the cumulative actual amount divided by the budget, the result is as shown in Figure 42(C).

When the monthly performance data for all past cases is processed, it will look like Figure 43(A). Figure 43(B) is a graph of the monthly performance data for past cases in Figure 43(A), and Figure 43(C) shows a graph after calculation processing of the display data.

Since the progress rate and budget progress rate at the time of completion of past projects vary depending on the project, the threshold is also calculated with a range of thresholds in the later stages of the progress rate.

[3-4. The meaning of drawing an approximation curve to the square of the residual and taking the square root of that approximation function]
The meaning of drawing an approximation curve to the square of the residual and taking the square root of the approximation function will be explained with reference to FIGS.

Figure 44 is a diagram for explaining a general method for estimating data dispersion. In Figure 43, the residuals are assumed to follow a standard normal distribution with a mean of 0, and the variance of the residuals is estimated as σ ² = (sum of squared residuals) / (number of data). The standard deviation is the square root of the variance, and is calculated as σ = √(sum of squared residuals) / (number of data). As shown in (A), in this case, it can be interpreted that the probability that the residuals are in the range of -σ to +σ is 68%.

Figure 45 shows a graph of the residuals, with the horizontal axis representing the progress rate [%] and the vertical axis representing the predicted value difference [%]. This can be interpreted as meaning that there is a 68% probability that the dispersion falls within this range, so by using +σ and -σ, a threshold range can be constructed.

In Figure 46 (A), the following formula, ^σ2 = (sum of squared residuals)/(number of data), which appears when estimating variance, is a formula for finding the average of squared residuals, and when viewed on a graph plotting squared residuals, it corresponds to the coefficient a when approximating with a straight line graph of the form y = a.

Since σ, which is used to calculate the range of residuals, is the square root of a, the square root of the approximate function of the square of the residual can be used as the standard deviation function. However, the above calculation does not express the variation in residuals according to the progress rate of the planned completion period (it does not express the characteristic that residuals are small in the early and later stages of project progress and large in the middle stages).

So, by replacing the part that is approximated by a straight line graph in the form of y = a with a function like the one shown in (B), we were able to express the variation in residuals according to the progress rate of the planned construction period. In this way, we introduced a unique calculation method to the part that was approximated by a straight line graph.

As explained above, according to this embodiment, for the monthly performance data of past cases, for each case identification information, a progress rate is calculated by dividing the X-axis item by the X-axis scale uniform item of the schedule/performance data of the past case, and a progress rate is calculated by dividing the Y-axis item by the Y-axis scale uniform item of the schedule/performance data of the past case, and the data processing unit 102b also calculates and processes for each case identification information the monthly performance data of cases subject to abnormality detection a progress rate by dividing the X-axis item by the planned period or target end period of the schedule/performance data of the case subject to abnormality detection, and a progress rate by dividing the Y-axis item by the budget or target of the schedule/performance data of the case subject to abnormality detection; The system is equipped with an approximate curve calculation unit 102c that calculates a performance center approximate curve for all data on monthly performance data for a project, a threshold calculation unit 102d that calculates the dispersion of all data on monthly performance data for past projects after processing from the calculated performance center approximate curve, calculates a standard deviation curve that expresses the calculated dispersion trend, and calculates a threshold based on the performance center approximate curve and the standard deviation curve, and an abnormality determination unit 102e that compares the processed monthly performance data of the project to be subjected to abnormality determination with the calculated threshold, making an abnormality determination. This makes it possible to use the approximate curve to accurately detect abnormalities in the accumulation of progress for the target project based on the performance data of past projects.

[4. Contribution to the United Nations-led Sustainable Development Goals (SDGs)]
This embodiment can contribute to improving business efficiency and promoting appropriate management decisions by companies, thereby contributing to the achievement of SDGs Goals 8 and 9.

Furthermore, this embodiment can contribute to reducing waste and promoting paperless and electronic systems, thereby contributing to SDGs goals 12, 13, and 15.

Furthermore, this embodiment can contribute to strengthening control and governance, thereby contributing to Goal 16 of the SDGs.

5. Other Embodiments
The present invention may be implemented in various different embodiments other than those described above within the scope of the technical concept set forth in the claims.

For example, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods.

In addition, the processing procedures, control procedures, specific names, registered data for each process, information including parameters such as search conditions, screen examples, and database configurations shown in this specification and drawings may be changed as desired unless otherwise specified.

Furthermore, with regard to the anomaly detection system 100, the components shown in the figure are functional concepts and do not necessarily have to be physically configured as shown.

For example, all or any part of the processing functions of the anomaly detection system 100, particularly the processing functions performed by the control unit, may be implemented by a CPU and a program interpreted and executed by the CPU, or may be implemented as hardware using wired logic. The program is recorded on a non-transitory, computer-readable recording medium containing programmed instructions for causing the information processing device to execute the processing described in this embodiment, and is mechanically read by the anomaly detection system 100 as needed. That is, a computer program that works in conjunction with the OS to issue commands to the CPU and perform various processes is recorded in a storage unit such as a ROM or HDD (Hard Disk Drive). This computer program is executed by being loaded into RAM, and works in conjunction with the CPU to form the control unit.

In addition, this computer program may be stored on an application program server connected to the anomaly detection system 100 via any network, and all or part of it may be downloaded as needed.

In addition, the program for executing the processing described in this embodiment may be stored on a non-temporary computer-readable recording medium, or may be configured as a program product. Here, this "recording medium" includes memory cards, USB (Universal Serial Bus) memories, SD (Secure Digital) cards, flexible disks, magneto-optical disks, ROMs, EPROMs (Erasable Programmable Read Only Memory), EEPROMs (registered trademark) (Electrically Erasable and Programmable Read Only Memory), CD-ROMs (Compact Disk Read Only Memory), MOs (Magneto-Optical disks), DVDs (Digital Versatile Disks), and more. This includes any "portable physical media" such as a Blu-ray Disc (registered trademark) and a Blu-ray (registered trademark) Disc.

A "program" is a data processing method written in any language or description method, and may be in any format, such as source code or binary code. It should be noted that a "program" is not necessarily limited to a single structure, but also includes a distributed structure consisting of multiple modules or libraries, or a structure that achieves its function by working in conjunction with a separate program, such as an OS. The specific structure and reading procedure for reading a recording medium in each device shown in the embodiments, as well as the installation procedure after reading, can use well-known structures and procedures.

The various databases stored in the memory unit are storage devices such as memory devices such as RAM and ROM, fixed disk devices such as hard disks, flexible disks, and optical disks, and store various programs, tables, databases, and web page files used for various processes and website provision.

The anomaly detection system 100 may be configured as an information processing device such as a known personal computer or workstation, or as an information processing device connected to any peripheral device. The anomaly detection system 100 may also be implemented by installing software (including programs, data, etc.) that causes the device to perform the processing described in this embodiment.

Furthermore, the specific form of distribution and integration of the devices is not limited to that shown in the figures, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various additions or functional loads. In other words, the above-mentioned embodiments may be implemented in any combination, or embodiments may be implemented selectively.

100 Anomaly detection system 102 Control unit 102a Data acquisition unit 102b Data processing unit 102c Approximate curve calculation unit 102d Threshold calculation unit 102e Anomaly determination unit 102f Screen display control unit 102g Master maintenance unit 104 Communication interface unit 106 Storage unit 106a Anomaly determination definition master 106b Determination result table 106c Approximate curve result attached information table 108 Input/output interface unit 112 Input device 114 Output device 200 Server 300 Network 400 Business system

Claims (9)

An anomaly detection system that includes a control unit and detects anomalies in business data,
The control unit
An abnormality determination definition master in which X-axis item, Y-axis item, X-axis scale unification item, and Y-axis scale unification item are set as parameters for each abnormality determination definition;
Monthly performance data of past projects, including project identification information, X-axis items, and Y-axis items;
Past project schedule and performance data including project identification information, X-axis scale standard items, and Y-axis scale standard items;
Monthly performance data of cases subject to abnormality determination, including case identification information, X-axis items, and Y-axis items;
Planned and actual data of the case to be determined as abnormal, including case identification information, planned period or target completion period, budget or target;
It is configured to be accessible to
data processing means for calculating and processing the monthly performance data of the past cases, for each case identification information, a progress rate obtained by dividing the X-axis item by the X-axis scale uniform item of the schedule/performance data of the past cases, and a progress rate obtained by dividing the Y-axis item by the Y-axis scale uniform item of the schedule/performance data of the past cases; and for calculating and processing the monthly performance data of the abnormality determination case, for each case identification information, a progress rate obtained by dividing the X-axis item by the schedule period or target completion period of the schedule/performance data of the abnormality determination case, and a progress rate obtained by dividing the Y-axis item by the budget or target of the schedule/performance data of the abnormality determination case;
an approximation curve calculation means for calculating a performance center approximation curve for all data of the processed monthly performance data of past cases;
a threshold calculation means for calculating the dispersion of all data from the calculated performance center approximation curve, calculating a standard deviation curve that expresses the tendency of the calculated dispersion, and calculating a threshold based on the performance center approximation curve and the standard deviation curve;
an abnormality determination means for comparing the processed monthly performance data of the case to be determined as an abnormality with the calculated threshold value to determine an abnormality;
An anomaly detection system comprising: The anomaly detection system of claim 1, wherein the X-axis item includes the number of elapsed months, the Y-axis item includes the cumulative actual amount, the X-axis scale unified item includes the planned construction period or implementation period, and the Y-axis scale unified item includes the budget or actual amount. The abnormality determination definition master further includes one or more approximate function candidates set as parameters for each of the abnormality determination definitions,
2. The anomaly detection system according to claim 1, wherein the approximate curve calculation means obtains optimal coefficients by passing the elapsed time rate and progress rate of the processed past monthly actual data and information on one or more approximate function candidates set in the anomaly judgment definition master to an approximating component, calculates AIC based on the coefficients returned from the approximating component, and determines the approximate function candidate with the smallest AIC as the actual performance center approximate function. The anomaly detection system of claim 3, wherein the one or more candidate approximation functions include at least one of a polynomial function, an exponential function, a logarithmic function, a logistic function, and a Bass model function. The threshold calculation means
Substituting each progress rate of the processed monthly performance data of the past projects into the performance center approximation function of the performance center approximation curve to calculate a predicted value of the progress rate, calculating the residual which is the difference between the predicted value and the actual data of the progress rate, and further calculating the square of the residual,
Draw an approximate curve of the residual square approximation function for the square of the residual, and take the square root of the residual square approximation function to obtain the standard deviation function.
The anomaly detection system according to claim 1, characterized in that each progress rate of the processed monthly actual data of the case to be judged as an anomaly is substituted into the actual result center approximation function to calculate a predicted value of the progress rate, and also substituted into the standard deviation function to calculate a standard deviation, and an upper threshold and a lower threshold are calculated by multiplying the standard deviation by a constant value calculated based on the significance level, with a range above and below the predicted value. The anomaly detection system described in claim 1, characterized in that the anomaly determination means outputs an anomaly detection message and a graph of the anomaly determination to a display unit when an anomaly is determined. The anomaly detection system described in any one of claims 1 to 6 further comprises a master maintenance means for setting the anomaly determination definition master data in response to an operator's operation. An anomaly detection method executed by an information processing device including a control unit,
The control unit
An abnormality determination definition master in which X-axis item, Y-axis item, X-axis scale unification item, and Y-axis scale unification item are set as parameters for each abnormality determination definition;
Monthly performance data of past projects, including project identification information, X-axis items, and Y-axis items;
Past project schedule and performance data including project identification information, X-axis scale standard items, and Y-axis scale standard items;
Monthly performance data of cases subject to abnormality determination, including case identification information, X-axis items, and Y-axis items;
Planned and actual data of the case to be determined as abnormal, including case identification information, planned period or target completion period, budget or target;
It is configured to be accessible to
Executed in the control unit:
a data processing step of calculating and processing the monthly performance data of the past projects for each project identification information by calculating a progress rate by dividing the X-axis item by the X-axis scale uniform item of the schedule/performance data of the past projects and a progress rate by dividing the Y-axis item by the Y-axis scale uniform item of the schedule/performance data of the past projects, and also calculating and processing the monthly performance data of the abnormality determination target projects for each project identification information by calculating a progress rate by dividing the X-axis item by the schedule period or target completion period of the schedule/performance data of the abnormality determination target projects and a progress rate by dividing the Y-axis item by the budget or target of the schedule/performance data of the abnormality determination target projects;
an approximation curve calculation step of calculating a performance center approximation curve for all data of the processed monthly performance data of past projects;
a threshold calculation step of calculating the dispersion of all the data from the calculated approximation curve, calculating a standard deviation curve that represents the tendency of the calculated dispersion, and calculating a threshold based on the performance center approximation curve and the standard deviation curve;
an abnormality determination step of comparing the processed monthly performance data of the case to be determined to be abnormal with the calculated threshold value to determine an abnormality;
An anomaly detection method comprising: An abnormality detection program to be executed by an information processing device having a control unit,
The control unit
An abnormality determination definition master in which X-axis item, Y-axis item, X-axis scale unification item, and Y-axis scale unification item are set as parameters for each abnormality determination definition;
Monthly performance data of past projects, including project identification information, X-axis items, and Y-axis items;
Past project schedule and performance data including project identification information, X-axis scale standard items, and Y-axis scale standard items;
Monthly performance data of cases subject to abnormality determination, including case identification information, X-axis items, and Y-axis items;
Planned and actual data of the case to be determined as abnormal, including case identification information, planned period or target completion period, budget or target;
It is configured to be accessible to
In the control unit,
a data processing step of calculating and processing the past monthly actual performance data for each case identification information by calculating a progress rate by dividing an X-axis item by an X-axis scale uniform item of the schedule/performance data of the past case and a progress rate by dividing a Y-axis item by a Y-axis scale uniform item of the schedule/performance data of the past case, and also calculating and processing the monthly actual performance data of the abnormality determination target for each case identification information by calculating a progress rate by dividing an X-axis item by a scheduled period or a target completion period of the schedule/performance data of the abnormality determination target and a progress rate by dividing a Y-axis item by a budget or target of the schedule/performance data of the abnormality determination target;
an approximation curve calculation step of calculating a performance center approximation curve for all data of the processed monthly performance data of past projects;
a threshold calculation step of calculating the dispersion of all the data from the calculated performance center approximation curve, calculating a standard deviation curve that represents the tendency of the calculated dispersion, and calculating a threshold based on the performance center approximation curve and the standard deviation curve;
an abnormality determination step of comparing the processed monthly performance data of the case to be determined to be abnormal with the calculated threshold value to determine an abnormality;
An anomaly detection program to execute the above.