CPC H04L 63/1425 (2013.01) | 9 Claims |
1. A model generation apparatus comprising:
processing circuitry
to extract as a plurality of model-generation attribute values, a plurality of attribute values belonging to an attribute associated with a monitoring subject for anomaly detection;
to extract for each model-generation attribute value, a normal event associated with the model-generation attribute value from normal data indicating a plurality of normal events each of which is found out to be normal, each of which is associated with one attribute value of the plurality of attribute values, and each of which includes a plurality of characteristics, and generate for each model-generation attribute value, division data indicating the extracted normal event;
to select a combination of characteristics to be used for generation of a normal model to be used for anomaly detection, from a plurality of characteristics included in a plurality of normal events indicated in a plurality of pieces of division data generated for the plurality of model-generation attribute values; and
to generate the normal model for each model-generation attribute value, using the combination of characteristics selected.
|