Apparatus, method and program for detecting abnormal behavior

Abstract

Supplied with a string of vector data as input data, a probabilistic distribution estimation apparatus estimates, by using a stochastic model having hidden variables, a probabilistic distribution in which each data occurs by successively reading the train of vector data. Specifically, the probabilistic distribution estimation apparatus reads values of parameters of the stochastic model having the hidden variables for a value of the input data, calculates, by using the stochastic model, a certainty in which the input data occurs, renews the parameters in response to new read data with past data forgotten, and produce several parameter's values. By using the parameter's values received from the probabilistic distribution estimation apparatus, an abnormality detection unit calculates an information amount of data as an abnormal behavior degree to produce the abnormal behavior degree.

1 . A probabilistic distribution estimation apparatus for responding to, as input data, a string of vector data to estimate a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation apparatus comprising: 
 a parameter storage unit for storing all of parameters for the stochastic model having the hidden variables;    certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit;    parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and    outputting means for outputting several parameters of said stochastic model stored in said parameter storage unit.    
   
   
       2 . A probabilistic distribution estimation apparatus as claimed in  claim 1 , wherein further comprises session means for processing the input data into the string of vector data, and wherein a stochastic model having hidden variables is used to estimate the probabilistic distribution occurred in each data.  
   
   
       3 . A probabilistic distribution estimation apparatus according to  claim 1 , wherein a time series model having a continuous time distribution and hidden variables is used to estimate the probabilistic distribution occurred in each data.  
   
   
       4 . A probabilistic distribution estimation apparatus according to  claim 1 , wherein a finite mixed distribution of hidden Markov models each having a continuous time distribution is used to estimate the probabilistic distribution occurred in each data.  
   
   
       5 . An abnormal behavior detection apparatus according to  claim 1 , wherein a finite mixed distribution of hidden Markov models is used to estimate the probabilistic distribution occurred in each data.  
   
   
       6 . An abnormal behavior detection apparatus according to  claim 5 , further comprising: 
 session means for processing the input data into the string of vector data.    
   
   
       7 . A method of estimating a probabilistic distribution, comprising the steps of: 
 inputting a string of vector data as input data;    calculating, using a model in which each data occurs by successively reading the string of vector data, a certainty for a value of the input data in which said input data occurs on the basis of parameters of said stochastic model;    renewing, by using said certainty and the parameters of said stochastic model, the parameters in response to new read data with past data forgotten; and    outputting several values of the calculated parameters.    
   
   
       8 . A method as claimed in  claim 7 , wherein further comprising the step of carrying out session for converting said input data into the vector data when said input data has no structure of vector data, and wherein the model is a stochastic model having hidden variables as a probabilistic distribution.  
   
   
       9 . A method of estimating a probabilistic distribution according to  claim 7 , wherein the model used in the calculating step is a time series model having a continuous time distribution and hidden variables as a probabilistic distribution.  
   
   
       10 . A method as claimed in  claim 9 , wherein further comprising the step of carrying out session for converting said input data into the vector data when said input data has no structure of vector data.  
   
   
       11 . A method of estimating a probabilistic distribution according to  claim 7 , wherein the model used in the calculating step is a finite mixed distribution of hidden Markov models having a continuous time distribution as a probabilistic distribution.  
   
   
       12 . A method as claimed in  claim 11 , wherein further comprising the step of carrying out session for converting said input data into the vector data when said input data has no structure of vector data.  
   
   
       13 . A method of detecting abnormal behavior according to  claim 7 , wherein the outputting step comprises the step of: 
 outputting, by using parameters of an estimated probabilistic distribution, as a score, the certainty where new read data has a state corresponding to each hidden variable.    
   
   
       14 . A method of detecting abnormal behavior according to  claim 7 , further comprises the step of: 
 carrying out session for converting the input data into a string of vector data when said input data have no structure of vector data.    
   
   
       15 . A probabilistic distribution estimation program for making a computer respond to, as input data, a string of vector data to estimate a probabilistic distribution occurred in each data by successively reading said string of vector data, said probabilistic distribution estimation program making said computer operate as: 
 a parameter storage unit for storing all of parameters for the stochastic model having the hidden variables;    certainty calculation means for calculating, in response to said input data, a certainty where said input data occurs using said stochastic model by reading the parameters of said stochastic model from said parameter storage unit;    parameter renewal means for renewing contents of said parameter storage unit in accordance with new read data with past data forgotten by reading the certainty from said certainty calculation means and by reading each parameter of said stochastic model from said parameter storage unit; and    outputting means for outputting several parameters of said stochastic model stored in said parameter storage unit.    
   
   
       16 . A probabilistic distribution estimation program as claimed in  claim 15 , wherein said probabilistic distribution estimation program further makes said program operate as session means for processing the input data into the string of vector data, and wherein a stochastic model having hidden variables is used to estimate the probabilistic distribution occurred in each data.  
   
   
       17 . A probabilistic distribution estimation program according to  claim 15 , wherein a time series model having a continuous time distribution and hidden variables is used to estimate the probabilistic distribution occurred in each data.  
   
   
       18 . A probabilistic distribution estimation program as claimed in  claim 17 , wherein said probabilistic distribution estimation program further makes said program operate as session means for processing the input data into the string of vector data.  
   
   
       19 . A probabilistic distribution estimation program according to  claim 15 , wherein a finite mixed distribution of hidden Markov models each having a continuous time distribution is used to estimate the probabilistic distribution occurred in each data.  
   
   
       20 . A probabilistic distribution estimation program as claimed in  claim 19 , wherein said probabilistic distribution estimation program further makes said program operate as session means for processing the input data into the string of vector data.