Detection of abnormal behavior using probabilistic distribution estimation

• US 20040167893A1
• Filed: 02/17/2004
• Published: 08/26/2004
• Est. Priority Date: 02/18/2003
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Yamanishi, Kenji, Matsunaga, Yuko
• Granted Patent: US 7,561,991 B2
• Time in Patent Office: Days
• US Class Current: 707/6
• CPC Class Codes: G06F 17/18 for evaluating statistical data , e.g. average values, frequency distributions, probability functions, regression analysis forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04
• CPC Class Codes: G06F 18/295 Markov models or related models, e.g. semi-Markov models; Markov random fields; Networks embedding Markov models

Abstract

Supplied with a string of vector data as input data, a probabilistic distribution estimation apparatus estimates, by using a stochastic model having hidden variables, a probabilistic distribution in which each data occurs by successively reading the train of vector data. Specifically, the probabilistic distribution estimation apparatus reads values of parameters of the stochastic model having the hidden variables for a value of the input data, calculates, by using the stochastic model, a certainty in which the input data occurs, renews the parameters in response to new read data with past data forgotten, and produce several parameter'"'"'s values. By using the parameter'"'"'s values received from the probabilistic distribution estimation apparatus, an abnormality detection unit calculates an information amount of data as an abnormal behavior degree to produce the abnormal behavior degree.

Claims

1. A probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model having hidden variables, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising:

a parameter storage unit for storing all of parameters for the stochastic model having the hidden variables;

certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit;

parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

outputting means for outputting several parameters of said stochastic model stored in said parameter storage unit.

2. A probabilistic distribution estimation apparatus as claimed in claim 1, wherein further comprises session means for processing the input data into the string of vector data.

3. A probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model having a continuous time distribution and hidden variables, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising:

a parameter storage unit for storing all of parameters for the time series model having the continuous time distribution and the hidden variables;

certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit;

parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said time series model from said parameter storage unit, and

outputting means for outputting several parameters of said time series model stored in said parameter storage unit.

4. A probabilistic distribution estimation apparatus as claimed in claim 3, wherein further comprises session means for processing the input data into the string of vector data.

5. A probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Macrov models each having a continuous time distribution, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising:

a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having the continuous distribution;

certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Macrov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;

parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and

outputting means for outputting several parameters of the finite mixed distribution of said hidden Marcov models stored in said parameter storage unit.

6. A probabilistic distribution estimation apparatus as claimed in claim 5, wherein further comprises session means for processing the input data into the string of vector data.

7. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said stochastic model.

8. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said stochastic model.

9. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

10. An abnormal behavior detection apparatus as claimed in claim 9, wherein further comprises a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

11. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

12. An abnormal behavior detection apparatus as claimed in claim 11, wherein further comprises a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

13. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model having the respective hidden variables from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

14. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of said vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model having the respective hidden variables from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

15. An abnormal behavior detection apparatus comprising:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said stochastic models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

16. An abnormal behavior detection apparatus comprising:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said stochastic models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

17. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said time series model.

18. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said time series model.

19. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

20. An abnormal behavior detection apparatus as claimed in claim 19, wherein further comprises a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

21. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

22. An abnormal behavior detection apparatus as claimed in claim 21, wherein further comprises a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

23. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

24. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

25. An abnormal behavior detection apparatus comprising:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said time series models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

26. An abnormal behavior detection apparatus comprising:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said time series models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

27. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of the hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

28. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of a hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

29. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

30. An abnormal behavior detection apparatus as claimed in claim 29, wherein further comprises a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

31. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

abnormality detection means for calculating information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

32. An abnormal behavior detection apparatus as claimed in claim 31, wherein further comprises a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

33. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

34. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

35. An abnormal behavior detection apparatus comprising:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for the finite mixed distributions of said hidden Marcov models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

36. An abnormal behavior detection apparatus comprising:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for the finite mixed distributions of said hidden Marcov models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

37. A method of estimating a probabilistic distribution, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten; and

outputting several values of the calculated parameters.

38. A method as claimed in claim 37, wherein further comprising the step of carrying out session for converting said input data into the vector data when said input data has no structure of vector data.

39. A method of estimating a probabilistic distribution, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for value of the input data in which said input data occurs on the basis of parameters of said time series model;

renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten; and

outputting several values of the calculated parameters.

40. A method as claimed in claim 39, wherein further comprising the step of carrying out session for converting said input data into the vector data when said input data has no structure of vector data.

41. A method of estimating a probabilistic distribution, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a finite mixed distribution of hidden Marcov models having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;

renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten; and

outputting several values of the calculated parameters.

42. A method as claimed in claim 41, wherein further comprising the step of carrying out session for converting said input data into the vector data when said input data has no structure of vector data.

43. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten; and

outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable.

44. A method of detecting abnormal behavior, comprising the steps of:

inputting input data;

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;

calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten; and

outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable.

45. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten; and

calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

46. A method as claimed in claim 45, wherein further comprises the step of calculating, by using the parameters of said estimated probabilistic distribution, a variation degree of a behavior model as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of data.

47. A method of detecting abnormal behavior, comprising the steps of:

inputting input data;

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;

calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten; and

calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

48. A method as claimed in claim 47, wherein further comprises the step of calculating, by using the parameters of said estimated probabilistic distribution, a variation degree of a behavior model as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of data.

49. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten;

calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;

calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data; and

calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

50. A method of detecting abnormal behavior, comprising the steps of:

inputting input data;

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;

calculating, using a stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten;

calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;

calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data; and

calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

51. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

estimating, in parallel, parameters for stochastic models having hidden variables of different number of states by using a plurality of probabilistic distribution estimation apparatuses; and

calculating, by using the parameters and the input data, standard values of information amounts for the respective stochastic models to produce, as an optimum value, the number of the states where the hidden variables can take when the standard value of the information amount is the least.

52. A method as claimed in claim 51, wherein said estimating step in each probabilistic distribution estimation apparatus comprises the steps of:

calculating, using the stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten; and

outputting several values of the calculated parameters.

53. A method as claimed in claim 51, wherein said estimating step in each probabilistic distribution estimation apparatus comprises the steps of:

carrying out session for converting the input data into the string of vector data when said input data have no structure of vector data;

calculating, using the stochastic model having hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten; and

outputting several values of the calculated parameters.

54. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;

renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten; and

outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable of said time series model.

55. A method of detecting abnormal behavior, comprising the steps of:

inputting input data;

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;

calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;

renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten; and

outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable of said time series model.

56. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;

renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten; and

calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

57. A method as claimed in claim 56, wherein further comprises the step of calculating, by using the parameters of said estimated probabilistic distribution, a variation degree of a behavior model as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of data.

58. A method of detecting abnormal behavior, comprising the steps of:

inputting input data;

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;

calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;

renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten; and

calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

59. A method as claimed in claim 58, wherein further comprises the step of calculating, by using the parameters of said estimated probabilistic distribution, a variation degree of a behavior model as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of data.

60. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;

renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten;

calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;

calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data; and

calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

61. A method of detecting abnormal behavior, comprising the steps of:

inputting input data;

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;

calculating, using a time series model having a continuos time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;

renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten;

calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;

calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data; and

calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

62. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

estimating, in parallel, parameters for time series models having continues time distributions and hidden variables of different number of states by using a plurality of probabilistic distribution estimation apparatuses; and

calculating, by using the parameters and the input data, standard values of information amounts for the respective stochastic models to produce, as an optimum value, the number of the states where the hidden variables can take when the standard value of the information amount is the least.

63. A method as claimed in claim 62, wherein said estimating step in each probabilistic distribution estimation apparatus comprises the steps of:

calculating, using the time series model having the continuous time distribution and the hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten; and

outputting several values of the calculated parameters.

64. A method as claimed in claim 62, wherein said estimating step in each probabilistic distribution estimation apparatus comprises the steps of:

carrying out session for converting the input data into the string of vector data when said input data have no structure of vector data;

calculating, using the time series model having the continuous time distribution and the hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;

renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten; and

outputting several values of the calculated parameters.

65. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a finite mixed distribution of hidden Marcov models each having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;

renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten; and

outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

66. A method of detecting abnormal behavior, comprising the steps of:

inputting input data;

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;

calculating, using a finite mixed distribution of hidden Marcov models each having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;

renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten; and

outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

67. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a finite mixed distribution of hidden Marcov models each having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;

renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten; and

calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

68. A method as claimed in claim 67, wherein further comprises the step of calculating, by using the parameters of said estimated probabilistic distribution, a variation degree of a behavior model as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of data.

69. A method of detecting abnormal behavior, comprising the steps of:

inputting input data;

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;

calculating, using a finite mixed distribution of hidden Marcov models each having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;

renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten; and

calculating, by using parameters of an estimated probabilistic distribution, an abnormal behavior degree of new read data using information amount of the new read data to produce the abnormal behavior degree.

70. A method as claimed in claim 69, wherein further comprises the step of calculating, by using the parameters of said estimated probabilistic distribution, a variation degree of a behavior model as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of data.

71. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a finite mixed distribution of hidden Marcov models each having a continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;

renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten;

calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;

calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data; and

calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

72. A method of detecting abnormal behavior, comprising the steps of:

inputting input data;

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;

calculating, using a finite mixed distribution of hidden Marcov models each having a continues time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;

renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten;

calculating, by using parameters of an estimated probabilistic distribution, a first posteriori probability of a state corresponding to the hidden variables by reading reference data different from the input data;

calculating, by using the parameters of the estimated probabilistic distribution, a second posteriori probability of a state corresponding to the hidden variables by reading new read data as the input data; and

calculating, as a variation of a posteriori probability, a difference between the first and the second posteriori probabilities to produce the variation of the posteriori probability.

73. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

estimating, in parallel, parameters for finite mixed distributions of hidden Marcov models each having a continues time distribution of different number of states by using a plurality of probabilistic distribution estimation apparatuses; and

calculating, by using the parameters and the input data, standard values of information amount for the respective stochastic models to produce, as an optimum value, the number of the states where the hidden variables can take when the standard value of the information amount is the least.

74. A method as claimed in claim 73, wherein said estimating step in each probabilistic distribution estimation apparatus comprises the steps of:

calculating, using the finite mixed distribution of said hidden Marcov models each having the continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;

renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten; and

outputting several values of said calculated parameters.

75. A method as claimed in claim 73, wherein said estimating step in each probabilistic distribution estimation apparatus comprises the steps of:

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data;

calculating, using the finite mixed distribution of said hidden Marcov models each having the continuous time distribution as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of the finite mixed distribution of said hidden Marcov models;

renewing, by using said certainty and the parameters of the finite mixed distribution of said hidden Marcov models, the parameters in response to new read data with past data forgotten; and

outputting several values of said calculated parameters.

76. A probabilistic distribution estimation program for making a computer respond to, as input data, a string of vector data to estimate, using a stochastic model having hidden variables, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation program making said computer operate as:

a parameter storage unit for storing all of parameters for the stochastic model having the hidden variables;

certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit;

parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

outputting means for outputting several parameters of said stochastic model stored in said parameter storage unit.

77. A probabilistic distribution estimation program as claimed in claim 76, wherein said probabilistic distribution estimation program further makes said program operate as session means for processing the input data into the string of vector data.

78. A probabilistic distribution estimation program for making a computer respond to, as input data, a string of vector data to estimate, using a time series model having a continuous time distribution and hidden variables, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation program making said computer operate as:

a parameter storage unit for storing all of parameters for the time series model having the continuous time distribution and the hidden variables;

certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit;

parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said time series model from said parameter storage unit; and

outputting means for outputting several parameters of said time series model stored in said parameter storage unit.

79. A probabilistic distribution estimation program as claimed in claim 78, wherein said probabilistic distribution estimation program further makes said program operate as session means for processing the input data into the string of vector data.

80. A probabilistic distribution estimation program for making a computer respond to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Macrov models each having a continuous time distribution, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation program making said computer operate as:

a parameter storage unit for storing all of parameters for the finite mixed distribution of the hidden Marcov models each having the continuous distribution;

certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Macrov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;

parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and

outputting means for outputting several parameters of the finite mixed distribution of said hidden Marcov models stored in said parameter storage unit.

81. A probabilistic distribution estimation program as claimed in claim 80, wherein said probabilistic distribution estimation program further makes said program operate as session means for processing the input data into the string of vector data.

82. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said stochastic model.

83. An abnormal behavior detection program for making a computer as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said stochastic model.

84. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

85. An abnormal behavior detection program as claimed in claim 84, wherein said abnormal behavior detection program further makes said computer as operate as a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

86. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

87. An abnormal behavior detection program as claimed in claim 86, wherein said abnormal behavior detection program further makes said computer as operate as a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

88. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model having the respective hidden variables from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

89. An abnormal behavior detection apparatus for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model having the respective hidden variables from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

90. An abnormal behavior detection program for making a computer operate as:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said stochastic models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

91. An abnormal behavior detection program for making a computer operate as:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said stochastic models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

92. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said time series model.

93. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said time series model.

94. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

95. An abnormal behavior detection program as claimed in claim 94, wherein said abnormal behavior detection program further makes said computer as operate as a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

96. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

97. An abnormal behavior detection program as claimed in claim 96, wherein said abnormal behavior detection program further makes said computer as operate as a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

98. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

99. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

100. An abnormal behavior detection program for making a computer operate as:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said time series models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

101. An abnormal behavior detection program for making a computer operate as:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for said time series models having different number of the states where the hidden variables can take, standard values of information amounts from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

102. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of the hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

103. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of the finite mixed distribution of said hidden Marcov models.

104. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

105. An abnormal behavior detection program as claimed in claim 104, wherein said abnormal behavior detection program further makes said computer as operate as a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

106. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

abnormality detection means for calculating an information amount of the new read data by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce an abnormal behavior degree of said new read data.

107. An abnormal behavior detection program as claimed in claim 106, wherein said abnormal behavior detection program further makes said computer as operate as a behavior model variation degree calculation unit for calculating, by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus, a variation degree of a behavior mode as a time-average of said abnormal behavior degrees for a predetermined width by reading a plurality of new data.

108. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

109. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit;

posteriori probability calculation means for calculating a posteriori probability of the state corresponding to the hidden variables by using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus;

a reference data input unit for inputting data different from said input data; and

posteriori probability variation degree calculation means for calculating a variation of the posteriori distribution and outputting it by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation means on the basis of the data read out of said reference data input unit and by using the posteriori distribution of the state corresponding to the hidden variables calculated by said posteriori distribution calculation mean on the basis of the new read data.

110. An abnormal behavior detection program for making a computer operate as:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for the finite mixed distributions of said hidden Marcov models having different number of the states where the hidden variables can take, standard values of information amount from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.

111. An abnormal behavior detection program for making a computer operate as:

a plurality of probabilistic distribution estimation apparatuses each of which responds to, as input data, a string of vector data to estimate, using a finite mixed distribution of hidden Marcov models, a probabilistic distribution occurred in each data by successively reading said string of vector data, each of said probabilistic distribution estimation apparatuses comprising session means for processing the input data into the string of vector data, a parameter storage unit for storing all of parameters for the finite mixed distribution of said hidden Marcov models each having a continuous time distribution, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using the finite mixed distribution of said hidden Marcov models by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of the finite mixed distribution of said hidden Marcov models from said parameter storage unit; and

information amount standard calculation means for calculating, by using, in parallel, said plurality of probabilistic distribution estimation apparatuses for the finite mixed distributions of said hidden Marcov models having different number of the states where the hidden variables can take, standard values of information amount from the parameters of the probabilistic distributions estimated by the respective probabilistic distribution estimation apparatuses and the input data to produce, as an optimum value, the number of states where the hidden variables can take when the standard value of the information amount is the least.