Apparatus and method of detecting abnormal behavior

• US 20070255540A1
• Filed: 07/06/2007
• Published: 11/01/2007
• Est. Priority Date: 02/18/2003
• Status: Abandoned Application

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Yamanishi, Kenji, Matsunaga, Yuko
• Application Number:
  US11/822,456
• Publication Number:
  US 20070255540A1
• Time in Patent Office: Days
• US Class Current: 703/2
• CPC Class Codes: G06F 17/18 for evaluating statistical data , e.g. average values, frequency distributions, probability functions, regression analysis forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04
• CPC Class Codes: G06F 18/295 Markov models or related models, e.g. semi-Markov models; Markov random fields; Networks embedding Markov models

Abstract

Supplied with a string of vector data as input data, a probabilistic distribution estimation apparatus estimates, by using a stochastic model having hidden variables, a probabilistic distribution in which each data occurs by successively reading the train of vector data. Specifically, the probabilistic distribution estimation apparatus reads values of parameters of the stochastic model having the hidden variables for a value of the input data, calculates, by using the stochastic model, a certainty in which the input data occurs, renews the parameters in response to new read data with past data forgotten, and produce several parameter'"'"'s values. By using the parameter'"'"'s values received from the probabilistic distribution estimation apparatus, an abnormality detection unit calculates an information amount of data as an abnormal behavior degree to produce the abnormal behavior degree.

Claims

1. An abnormal behavior detection apparatus comprising:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said stochastic model.

2. An abnormal behavior detection apparatus according to claim 1, further comprising:

session means for processing the input data into the string of vector data.

3. An abnormal behavior detection apparatus according to claim 1, wherein the time series model has a continuous time distribution and hidden variables.

4. A method of detecting abnormal behavior, comprising the steps of:

inputting a string of vector data as input data;

calculating, using a time series model having a continuous time distribution and hidden variables as a probabilistic distribution in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said time series model;

renewing, by using said certainty and the parameters of said time series model, the parameters in response to new read data with past data forgotten; and

outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable of said time series model.

5. A method of detecting abnormal behavior according to claim 4, further comprising the step of:

carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data.

6. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a stochastic model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the stochastic model having hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said stochastic model.

7. An abnormal behavior detection program according to claim 6, wherein said probabilistic distribution estimation apparatus further comprises session means for processing the input data into the string of vector data.

8. An abnormal behavior detection program for making a computer operate as:

a probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate, using a time series model, a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising a parameter storage unit for storing all of parameters for the time series model having a continuous time distribution and hidden variables, certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said time series model by reading the parameters of said time series model from said parameter storage unit, and parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading the parameters of said time series model from said parameter storage unit; and

state estimation means for using the parameters of the probabilistic distribution estimated by said probabilistic distribution estimation apparatus to produce, as a score, the certainty where the new read data has a state corresponding to each hidden variable of said time series model.

9. An abnormal behavior detection program according to claim 8, wherein said probabilistic distribution estimation apparatus comprises session means for processing the input data into the string of vector data.