Upgrade to Pro — share decks privately, control downloads, hide ads and more …

SDARアルゴリズムと統計的手法による時系列からの外れ値と変化点の検出

 SDARアルゴリズムと統計的手法による時系列からの外れ値と変化点の検出

SDARアルゴリズムと統計的手法による時系列からの外れ値と変化点の検出。大学時代の研究で調査していた内容。

MATSUMOTO Ryosuke

July 13, 2013
Tweet

More Decks by MATSUMOTO Ryosuke

Other Decks in Technology

Transcript

  1. 2/24
    [4]


    [4] J. Takeuchi and K. Yamanishi, “A Unifying Framework for
    Detecting Outliers and Change Points from Time Series,” IEEE
    transactions on Knowledge and Data Engineering, pp.482-492,
    2006.

    View full-size slide

  2. 3/24






    View full-size slide

  3. 4/24




    View full-size slide

  4. 5/24
    ChangeFinder
    2

    View full-size slide

  5. 6/24
    ChangeFinder
    ChangeFinder
    2

    View full-size slide

  6. 7/24
    ChangeFinder

    2
    ⇒ DoS

    View full-size slide

  7. 8/24
    ChangeFinder
    2

    View full-size slide

  8. 9/24
    2
    SDAR
    SDAR
    t
    x
    SDAR
    1
    2

    View full-size slide

  9. 10/24
    ⇒ AR

    AR ⇒

    ⇒ SDAR

    View full-size slide

  10. 11/24
    SDAR
    L
    +
    +
    =



    − 2
    2
    1
    1 t
    t
    t
    t
    t
    x
    A
    x
    A
    x
    AR
    AR
    ⇒ Σ
    Σ
    Σ
    Σ ⇒
    SDAR


    View full-size slide

  11. 12/24
    AR
    ( )
    Σ


    ,
    ,
    ,
    ,
    ,
    |
    1
    1 µ
    k
    t
    k
    t
    t
    A
    A
    x
    x
    P L
    ( )( )T
    1
    1
    1
    1


    +
    =

    +
    =



    =

    =
    t
    k
    i
    j
    i
    i
    j
    t
    k
    i
    i
    x
    x
    k
    t
    C
    x
    k
    t
    µ
    µ
    µ

    ⇒ ⇒



    =

    =
    =
    Σ
    +
    =
    k
    i
    i
    j
    i
    j
    k
    i
    i
    i
    C
    A
    C
    C
    A
    C
    1
    1
    0
    k
    ( )
    k
    j
    j ,
    ,
    1
    : L
    =
    AR




    View full-size slide

  12. 13/24
    SDAR
    ( ) ( )
    Σ

    = −
    =

    ∑ ,
    ,
    ,
    ,
    ,
    |
    log
    1
    1
    1
    1
    µ
    k
    i
    i
    t
    i
    i
    t A
    A
    x
    x
    P
    r
    I L
    ■ I







    ⇒ t

    ( )
    1
    0 <
    < r
    r



    View full-size slide

  13. 14/24
    SDAR


    ( )
    ( ) ( )( )T
    1
    :
    1
    :
    µ
    µ
    µ
    µ


    +

    =
    +

    =
    − j
    t
    t
    j
    j
    t
    x
    x
    r
    C
    r
    C
    rx
    r
    ( )
    ( ) ( )( )T
    1
    ˆ
    ˆ
    1
    :
    :
    ˆ
    t
    t
    t
    t
    k
    i
    k
    t
    i
    t
    x
    x
    x
    x
    r
    r
    x
    A
    x


    +
    Σ

    =
    Σ
    +

    = ∑
    =

    µ
    µ




    j
    A
    r

    =

    =
    k
    i
    i
    j
    i
    j
    C
    A
    C
    1
    ( ) ( )
    Σ

    = −
    =

    ∑ ,
    ,
    ,
    ,
    ,
    |
    log
    1
    1
    1
    1
    µ
    k
    i
    i
    t
    i
    i
    t A
    A
    x
    x
    P
    r
    I L

    View full-size slide

  14. 15/24
    t
    x
    t
    P
    SDAR


    ( )
    1
    1
    |
    log
    )
    (
    Score −


    = t
    t
    t
    t
    x
    x
    P
    x








    View full-size slide

  15. 16/24
    T
    ⇒ SDAR
    ⇒ ⇒
    T
    ⇒ T
    t
    x
    t
    x
    t
    x

    View full-size slide

  16. 17/24
    2


    View full-size slide

  17. 18/24
    ChangeFinder
    2

    View full-size slide

  18. 19/24
    02
    .
    0
    =
    r
    ■ ChageFinder
    Port135
    2003 7 31 3 8 26 2
    ⇒ MS.Blast
    5
    =
    T
    [2]

    Trend Micro ※

    View full-size slide

  19. 20/24
    3
    Trend Micro
    ■ MS.Blast
    ⇒ 2003 8 17 5 31
    Trend Micro
    ■ MS.Blast
    ⇒ 2003 8 11 9 44

    ⇒ 2003 8 23 10

    ⇒ 2003 8 11 9

    ⇒ 2003 8 13 10

    View full-size slide

  20. 21/24
    ChangeFinder
    2

    View full-size slide

  21. 22/24
    2




    View full-size slide

  22. 23/24



    ■ ARMA
    ⇒ AR






    View full-size slide

  23. 26/24
    t
    t
    t
    t
    z
    z
    z ε
    +

    =

    − 2
    1
    5
    .
    0
    6
    .
    0
    t
    t
    t
    z
    x µ
    +
    =
    0 1000 10 1000 1
    10
    1000
    =
    µ
    9
    2000
    =
    µ
    8
    3000
    =
    µ
    1000

    View full-size slide

  24. 28/24
    t
    t
    t
    t
    z
    z
    z ε
    +

    =

    − 2
    1
    5
    .
    0
    6
    .
    0
    t
    t
    t
    z
    x µ
    +
    =
    0 1000 1 t
    ×
    1000
    1000

    View full-size slide

  25. 33/24




    View full-size slide

  26. 34/24







    View full-size slide

  27. 35/24

    ChangeFinder

    View full-size slide

  28. 37/24
    ■ SDAR




    ( )
    1
    1
    |
    log
    )
    (
    Score −


    = t
    t
    t
    t
    y
    y
    Q
    y

    View full-size slide