Abstract: An abnormality detection apparatus includes an acquisition unit that acquires time-series data of a detection target whose abnormality is detected at a predetermined point in time, a first extraction unit that extracts a feature in a feature quantity direction in a time section before the predetermined point in time from the time-series data, a second extraction unit that extracts a feature in a time direction in the time section from the feature in the feature quantity direction, and a calculation unit that calculates an abnormality score at a predetermined point in time on the basis of the feature in the feature quantity direction and the feature in the time direction, and calculates the degree of contribution in the feature quantity direction and the degree of contribution in the time direction before the predetermined point in time with respect to the abnormality score.

Abstract: An anomaly detection apparatus (10) includes a storage unit (14) that stores dictionary information (14b) in which a partial character string of a message representing a type of a message included in a text log output from a system and an ID set for the type of the message are associated with each other. The anomaly detection apparatus (10), when the message included in the text log output from the system is acquired, refers to the dictionary information (14b) stored in the storage unit (14), classifies the message included in the text log by the type, and assigns the ID to the message that has been classified; and detects an anomaly based on the ID assigned to the message.

Abstract: A classification unit classifies messages included in a text log depending on types, and gives an ID set for each type to each of the classified messages. A creation unit creates, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID. A pattern extraction unit extracts a plurality of patterns, which are combinations of the IDs, from the matrix created by the creation unit. A removal unit removes a part or whole of the patterns from the matrix. A determination unit calculates a degree of importance for each element included in each of the patterns, and determines whether the degree of importance is equal to or higher than a predetermined threshold. A sequence extraction unit extracts a sequence.

Abstract: A classification unit classifies messages included in a text log depending on types, and gives an ID set for each type to each of the classified messages. A creation unit creates, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID. A pattern extraction unit extracts a plurality of patterns, which are combinations of the IDs, from the matrix created by the creation unit. A removal unit removes a part or whole of the patterns from the matrix. A determination unit calculates a degree of importance for each element included in each of the patterns, and determines whether the degree of importance is equal to or higher than a predetermined threshold. A sequence extraction unit extracts a sequence.

Abstract: An anomaly detection apparatus (10) includes a storage unit (14) that stores dictionary information (14b) in which a partial character string of a message representing a type of a message included in a text log output from a system and an ID set for the type of the message are associated with each other. The anomaly detection apparatus (10), when the message included in the text log output from the system is acquired, refers to the dictionary information (14b) stored in the storage unit (14), classifies the message included in the text log by the type, and assigns the ID to the message that has been classified; and detects an anomaly based on the ID assigned to the message.

Abstract: A preprocessing unit (131) processes data for training and detection object data. Also, a generation unit (132) generates a model in a normal state by deep learning, on the basis of the data for training that is processed by the preprocessing unit (131) . Also, a detection unit (133) calculates a degree of anomaly on the basis of output data obtained by inputting the detection object data and that is processed by the preprocessing unit (131) into the model, and detecting an anomaly in the detection object data on the basis of the degree of anomaly.

Abstract: A text log feature vector generator generates a text log feature vector on the basis of a text log. A numerical log feature vector generator generates a numerical log feature vector on the basis of a numerical log. A system feature vector generator generates a system feature vector on the basis of the text log feature vector and the numerical log feature vector. A learning unit learns a plurality of appearance values of the system feature vector to generate a system state model as a model indicating a state of the system. A determination unit determines the state of the system at determination target time on the basis of the system feature vector at the determination target time and the system state model.

Abstract: A classification unit classifies messages included in a text log depending on types, and gives an ID set for each type to each of the classified messages. A creation unit creates, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID. A pattern extraction unit extracts a plurality of patterns, which are combinations of the IDs, from the matrix created by the creation unit. A removal unit removes a part or whole of the patterns from the matrix. A determination unit calculates a degree of importance for each element included in each of the patterns, and determines whether the degree of importance is equal to or higher than a predetermined threshold. A sequence extraction unit extracts a sequence.

Abstract: A text log feature vector generator generates a text log feature vector on the basis of a text log. A numerical log feature vector generator generates a numerical log feature vector on the basis of a numerical log. A system feature vector generator generates a system feature vector on the basis of the text log feature vector and the numerical log feature vector. A learning unit learns a plurality of appearance values of the system feature vector to generate a system state model as a model indicating a state of the system. A determination unit determines the state of the system at determination target time on the basis of the system feature vector at the determination target time and the system state model.