Anomaly detection device, anomaly detection method, and network anomaly detection system

摘要

PROBLEM TO BE SOLVED: To provide an abnormality detection device capable of detecting abnormality of the whole object of abnormality detection and abnormality of a component thereof using the same evaluation scale even if the components of the object of abnormality detection increase or decrease in number.SOLUTION: A data output part 200 generates a partial feature matrix representing a state of a component of an object 900 of abnormality detection from an observation value of the object 900 of abnormality detection, and generates a whole feature matrix as matrix data representing the whole of the object 900 of abnormality detection such that the partial feature matrix is a partial column. An abnormality calculation part 300 calculates an inner product value for a time series of the whole feature matrix using a kernel function enabling calculation of the inner product of two arbitrary matrixes. Then abnormality of the whole object 900 of abnormality detection and abnormality of each component are calculated with the same scale using a kerneled probability model structured using the calculated inner product value, for example, a kerneled vector autoregression model.SELECTED DRAWING: Figure 1