Patent Publication Number: US-2016231738-A1

Title: Information processing apparatus and analysis method

Description:
TECHNICAL FIELD 
     The present invention relates to an information processing apparatus and an analysis method. 
     BACKGROUND ART 
     Analysis apparatuses which compare time series of measurement values (metric values) of sensors or the like in a system to be analyzed (a target system) to analyze the status of the target system are known. 
     As such an analysis apparatus, for example, PTL 1 describes an analysis apparatus (operation management apparatus) which employs a correlation model of a target system. The operation management apparatus described in PTL 1 determines, based on time series of measurement values of a plurality of sensors or the like of a target system, a correlation function representing the correlation between the sensors in a normal state by system identification method to generate a correlation model of the target system. The operation management apparatus then detects destruction (correlation destruction) of the correlation by using the generated correlation model to determine a fault cause of the target system. 
     CITATION LIST 
     Patent Literature 
     [PTL 1] Japanese Patent Publication No. 4872944 
     SUMMARY OF INVENTION 
     Technical Problem 
     When the above-described analysis apparatus is used to analyze states of target systems, a large time lag (time difference) as compared with a measurement interval of measurement value may be generated between measurement values of different sensors in some of the target systems. For example, a case in which the target system is a bridge and the sensor is a vibration sensor that is placed on the bridge is assumed. In this case, between measurement values of different sensors, there is a small time lag generated when a vibration of a vehicle passing through the bridge propagates through steel constituting the bridge and a large time lag generated when a moving vehicle approaches each sensor successively. In a case that the target system is an air-conditioner and the sensors are a current sensor and a temperature sensor for surroundings of the air-conditioner, the temperature changes in delay relative to a change of the state of the air-conditioner. There is thus a large time lag between measurement values of the current sensor and the temperature sensor. Further, in a case that the target system is a vehicle and the sensors are a sensor for a drive system such as an engine of the vehicle and a sensor for an operation system for a driver, there is a delay until a driver can take an action after recognizing a change in the state of the driving system. There are thus also a large time lag between measurement values of the drive system sensor and the operation system sensor. 
     When there is a large time lag between measurement values of sensors as described above, analysis accuracy may decrease. 
     For example, the operation management apparatus of PTL 1 determines a correlation function such as the following equation Math. 1 between sensors when a target system is analyzed. 
         Y ( t )= A   1   Y ( t− 1)+ A   2   Y ( t− 2)+ . . . + A   N   Y ( t−N )+ B   1   X ( t )+ B   2   X ( t− 1)+ . . . + B   M   X ( t −( M− 1))  [Math. 1]
 
     In the equation Math. 1, X(t) and Y(t) are measurement values of the sensors at time t which are an input and an output of the correlation function, respectively. The operation management apparatus determines the coefficients A 1 , A 2 , . . . , A N , B 1 , B 2 , . . . , B M  in the equation Math. 1 for each pair of sensors in a plurality of sensors. Here, values of N and M are input in advance by, for example, a user. The operation management apparatus then detects correlation destruction between the sensors by using the determined correlation function. 
     When a time lag between sensors is larger than the value of M in the equation Math. 1, the correlation cannot be sufficiently approximated by the correlation function of the equation Math. 1, whereby prediction accuracy by the correlation function decreases. In this case, correlation destruction between the sensors cannot be accurately detected, whereby analysis accuracy decreases. 
     An object of the present invention is to resolve the above-described issue and to provide an information processing apparatus and an analysis method that prevent a decrease in analysis accuracy of the target system even when there is a large time lag between metrics of a target system. 
     Solution to Problem 
     An information processing apparatus according to an exemplary aspect of the invention includes: a processing means for performing comparative analysis of values of a first metric and a second metric in a system to be analyzed; and a pre-processing means for identifying, with respect to the comparative analysis of the first metric and the second metric, a temporal correspondence relation between respective pieces of data used as the first metric and the second metric. 
     An analysis method according to an exemplary aspect of the invention includes: identifying, with respect to a comparative analysis of a first metric and a second metric in a system to be analyzed, a temporal correspondence relation between respective pieces of data used as the first metric and the second metric; and performing the comparative analysis of values of the first metric and the second metric. 
     A computer readable storage medium according to an exemplary aspect of the invention records thereon a program, causing a computer to perform a method including: identifying, with respect to a comparative analysis of a first metric and a second metric in a system to be analyzed, a temporal correspondence relation between respective pieces of data used as the first metric and the second metric; and performing the comparative analysis of values of the first metric and the second metric. 
     Advantageous Effects of Invention 
     An advantageous effect of the present invention is that a decrease in analysis accuracy of a target system can be prevented even when there is a large time lag between metrics of the target system. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG. 1  is a block diagram illustrating a characteristic configuration of a first exemplary embodiment of the present invention. 
         FIG. 2  is a block diagram illustrating a configuration of an analysis system in the first exemplary embodiment of the present invention. 
         FIG. 3  is a block diagram illustrating a configuration of an analysis apparatus  100  implemented on a computer in the first exemplary embodiment of the present invention. 
         FIG. 4  is a flow chart illustrating an operation of the analysis apparatus  100  in the first exemplary embodiment of the present invention. 
         FIG. 5  is a diagram illustrating an example of time series data  121  in the first exemplary embodiment of the present invention. 
         FIG. 6  is a diagram illustrating an example of time lag information  122  in the first exemplary embodiment of the present invention. 
         FIG. 7  is a diagram illustrating an example of a correlation model  123  in the first exemplary embodiment of the present invention. 
         FIG. 8  is a diagram illustrating an example of a pattern (change pattern) of a time-series change in the first exemplary embodiment of the present invention. 
         FIG. 9  is a diagram illustrating an example of extracting a time lag in the first exemplary embodiment of the present invention. 
         FIG. 10  is a diagram illustrating an example of a display screen  501  (time lag selection) in the first exemplary embodiment of the present invention. 
         FIG. 11  is a diagram illustrating an example of the display screen  501  (display of correlation destruction) in the first exemplary embodiment of the present invention. 
         FIG. 12  is a diagram illustrating an example of the display screen  501  (comparison of time series) in the first exemplary embodiment of, the present invention. 
         FIG. 13  is a block diagram illustrating a configuration of an analysis system in the second exemplary embodiment of the present invention. 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     First Embodiment 
     A first exemplary embodiment of the present invention will be described. 
     First, a configuration of an analysis system of the first exemplary embodiment of the present invention will be described. 
       FIG. 2  is a block diagram illustrating a configuration of the analysis system in the first exemplary embodiment of the present invention. 
     Referring to  FIG. 2 , the analysis system in the first exemplary embodiment of the present invention includes an analysis apparatus  100  and a target system  200  which is a system to be analyzed. The analysis apparatus  100  and the target system  200  are communicably connected via a network or the like. 
     The analysis apparatus  100  is one exemplary embodiment of an information processing apparatus of the present invention. 
     Here, the target system  200  is one of a variety of systems in which sensors for monitoring the state of systems are arranged. For example, the target system  200  is a structure such as a building or a bridge on which vibration sensors for diagnosing deterioration, temperature sensors, and/or the like are arranged. The target system  200  may be a plant such as a production plant or a power plant in which temperature sensors, flow sensors, and/or the like for monitoring an operation state are arranged. The target system  200  may be a mobile body such as a vehicle, a ship, or an aircraft in which measuring instruments such as a variety of sensors and/or sequencers for monitoring a driving state are incorporated. The target system  200  is not restricted to a system using physical sensors as described above, and may be a computer system which measures performance information for operation management. The target system  200  may be a computer system in which environment sensors for collecting power, temperature, or the like at the same time as the performance information are further arranged. 
     Here, each sensor and each performance item measured in the target system  200  are referred to as a “metric”. The term “metric” herein corresponds to the term “element” which is in PTL 1 referred to as a target for generating a correlation model. 
     The analysis apparatus  100  analyzes the state of the target system  200  based on a time series of measurement values of metrics collected from the target system  200 . 
     The analysis apparatus  100  includes a data collection unit  101 , a data storage unit  111 , a pre-processing unit  130 , a processing unit  140 , a dialogue unit  106 , and a handling execution unit  107 . 
     The data collection unit  101  collects measurement values of each metric such as measurement values detected by each sensor, from the target system  200  at a predetermined collection interval. 
     The data storage unit  111  stores a time series of the measurement values of the metrics collected by the data collection unit  101  as time series data  121 . 
       FIG. 5  is a diagram illustrating an example of the time series data  121  in the first exemplary embodiment of the present invention. In the example of  FIG. 5 , the time series data  121  includes a time series of measurement values collected every 1 msec for each of sensors 1, 2, . . . , n. 
     The pre-processing unit  130  identifies a temporal correspondence relation between metric values. In the first exemplary embodiment of the present invention, the pre-processing unit  130  identifies, as the temporal correspondence relation, a time lag of a time-series change of one metric relative to a time-series change of another metric. 
     The pre-processing unit  130  includes a time lag detection unit  102  and a time lag storage unit  112 . 
     The time lag detection unit  102  generates time lag information  122  based on the time series data  121  stored in the data storage unit  111 . 
     The time lag information  122  represents a time lag for each pair of metrics in a plurality of metrics. In the exemplary embodiment of the present invention, the time lag in a pair of metrics is a time difference between time-series changes of the pair of metrics in a case that similar changes in time-series occur in one of the pair of metrics (preceding metric) and the other of the pair of metrics (succeeding metric). The time lag may be a roughly estimated value of the time difference. In the exemplary embodiment of the present invention, the time lag is detected by comparing a series of a patterns of a time-series change of a metric for every predetermined length of time period (time period consisting of a plurality of monitoring intervals), as described below. For this reason, a value obtained by multiplying the length of time period for extracting a pattern of the time-series change by an integer is used for the value of a time lag. 
       FIG. 6  is a diagram illustrating an example of the time lag information  122  in the first exemplary embodiment of the present invention. In an example of  FIG. 6 , a time lag of a succeeding metric relative to a preceding metric is illustrated for each pair of metrics. 
     The time lag storage unit  112  stores the time lag information  122  generated by the time lag detection unit  102 . 
     The processing unit  140  performs a comparative analysis between metric values in a target system. In the first exemplary embodiment of the present invention, the processing unit  140  performs, as the comparative analysis, an analysis based on a correlation between metrics (generation of a correlation model  123  and detection of correlation destruction). 
     The processing unit  140  includes a correlation model generation unit  103 , a correlation model storage unit  113 , a correlation destruction detection unit  104 , and a data extraction unit  105 . 
     The correlation model generation unit  103  generates the correlation model  123  of the target system  200  based on the time series data  121  stored in the data storage unit  111 . 
     The correlation model  123  includes a correlation function (or a conversion function) representing a correlation of each pair of metrics in a plurality of metrics. For example, the correlation function is represented by the above-described equation Math. 1. In other words, the correlation function is a function that predicts a value of one metric (output metric) of a pair of metrics at time t from a measurement value of the other metric (input metric) at or before time t and a measurement value of the one metric (output metric) before time t. The correlation model generation unit  103  determines coefficients of a correlation function in a similar manner to the operation management apparatus of PTL 1. In other words, the correlation model generation unit  103  determines coefficients A 1 , A 2 , . . . , A N , B 1 , B 2 , . . . , B M  of the correlation function of the equation Math. 1 for each pair of metrics by system identification processing based on the time series data  121  of a predetermined modeling time period. 
     On the other hand, in the exemplary embodiment of the present invention, a shifted (delayed) time series is used. The shifted time series is obtained by shifting (delaying) the above-described time series of a preceding metric by a time lag, with reference to the time lag information  122  stored in the time lag storage unit  112 . The correlation model generation unit  103  determines the correlation function using a time series obtained by shifting (delaying) the above-described time series of a preceding metric by a time lag as a time series of an input metric, and using the above-described time series of a succeeding metric as a time series of an output metric. 
     In a similar manner to the operation management apparatus of PTL 1, the correlation model generation unit  103  may calculate a weight for each pair of metrics based on a conversion error of a correlation function to obtain, as the correlation model  123 , a set of correlation functions (effective correlation functions) in which the weight is equal to or larger than a predetermined value. 
       FIG. 7  is a diagram illustrating an example of the correlation model  123  in the first exemplary embodiment of the present invention. In an example of  FIG. 7 , values of coefficients A 1 , . . . , B 1 , . . . , in the equation Math. 1 for each pair of metrics are illustrated. 
     The correlation model storage unit  113  stores the correlation model  123  generated by the correlation model generation unit  103 . 
     In a similar manner to the operation management apparatus of PTL 1, the correlation destruction detection unit  104  determines whether a correlation included in the correlation model  123  is maintained or destroyed by using newly collected measurement values of the metrics. 
     Here, the correlation destruction detection unit  104  uses newly collected measurement values of the metrics which are extracted by the data extraction unit  105 . The correlation destruction detection unit  104  calculates, for each pair of the metrics, a difference (prediction error) between a measurement value of an output metric at time t and a prediction value of an output metric at time t calculated by using the correlation function. The correlation destruction detection unit  104  determines that the correlation is destroyed when the calculated difference is equal to or more than a predetermined value. 
     The data extraction unit  105  extracts newly collected measurement values of the metrics which are needed for detection of correlation destruction from the time series data  121  stored in the data storage unit  111 , and outputs them to the correlation destruction detection unit  104 . The data extraction unit  105  outputs measurement values of the input metric a time lag earlier with reference to the time lag information  122  stored in the time lag storage unit  112 . 
     The dialogue unit  106  presents a detection result of correlation destruction to a user or the like. 
     The dialogue unit  106  may also instructs the handling execution unit  107  to execute an operation for handling the correlation destruction in accordance with an operation of a user or the like. In this case, the handling execution unit  107  executes an instructed handling operation on the target system  200 . 
     The analysis apparatus  100  may be a computer which includes a CPU (Central Processing Unit) and a storage medium storing a program, and operates by control based on the program. The data storage unit  111 , the correlation model storage unit  113 , and the time lag storage unit  112  may be individual storage media, or may be configured as one storage medium. 
       FIG. 3  is a block diagram illustrating a configuration of the analysis apparatus  100  implemented on a computer in the first exemplary embodiment of the present invention. 
     Referring to  FIG. 3 , the analysis apparatus  100  includes a CPU  161 , a storage medium  162 , a communication unit  163 , an input unit  164 , and an output unit  165 . The CPU  161  executes a computer program for embodying functions of the data collection unit  101 , the time lag detection unit  102 , the correlation model generation unit  103 , the correlation destruction detection unit  104 , the data extraction unit  105 , the dialogue unit  106 , and the handling execution unit  107 . The storage medium  162  stores data of the data storage unit  111 , the time lag storage unit  112 , and the correlation model storage unit  113 . The communication unit  163  receives measurement values for each metric from the target system  200 . The input unit  164  is, for example, an input device such as a keyboard, and receives from a user or the like an input to the dialogue unit  106 . The output unit  165  is, for example, a display device such as a display, and displays an output from the dialogue unit  106  to a user or the like. 
     Next, an operation of the analysis apparatus  100  in the first exemplary embodiment of the present invention will be described. 
       FIG. 4  is a flow chart illustrating the operation of the analysis apparatus  100  in the first exemplary embodiment of the present invention. 
     First, the data collection unit  101  collects measurement values for each metric from the target system  200  at a predetermined collection interval (step S 101 ). The data collection unit  101  stores a time series of the collected measurement values for each metric as the time series data  121  in the data storage unit  111 . 
     For example, the data collection unit  101  stores time series data  121  as illustrated in  FIG. 5 . 
     The time lag detection unit  102  of the pre-processing unit  130  generates the time lag information  122  based on the time series data  121  (step S 102 ). The time lag detection unit  102  stores the generated time lag information  122  in the time lag storage unit  112 . 
     Here, the time lag detection unit  102  detects a time lag by, for example, comparing, for each pair of metrics, series of time-series change patterns of the metrics for each predetermined length of time period. 
       FIG. 8  is a diagram illustrating an example of a time-series change pattern (change pattern) in the first exemplary embodiment of the present invention. The change pattern is a pattern of an increase-decrease trend of measurement values of a metric in a predetermined length of time period. For example, a change pattern of symbol A in  FIG. 8  indicates that the measurement value of metric does not change during a predetermined length of time period. A change pattern of symbol B indicates that measurement values of a metric increase during the predetermined length of time period. 
       FIG. 9  is a diagram illustrating an example of extraction of a time lag in the first exemplary embodiment of the present invention. In the example of  FIG. 9 , as a predetermined length W for detecting a change pattern, 40 msec is employed. 
     The time lag detection unit  102  gives, in accordance with the change patterns as illustrated in  FIG. 8 , a corresponding symbol for a change pattern to a time series of each metric for each predetermined length of time period W. The time lag detection unit  102  then detects a pair of a preceding metric and a succeeding metric and a time lag for the pair by comparing series of symbols given to each metric for each pair of metrics. 
     For example, in  FIG. 9 , series of change pattern symbols “DBDGEEDBDEB”, “DBDGEEDBDEB”, and “CCBDEDBDGEE” are given to time series of a sensor  1 , a sensor  2 , and a sensor  3 , respectively. By comparing these series with one another, a time lag W×0=0 msec is detected for a pair of the sensor  1  which is taken as the preceding metric and the sensor  2  which is taken as the succeeding metric. Similarly, a time lag W×5=200 msec is detected for a pair of the sensor  1  which is taken as the preceding metric and the sensor  3  which is taken as the succeeding metric. 
     The time lag detection unit  102  then stores the time lag information  122  as illustrated in  FIG. 6  in the time lag storage unit  112 . 
     When a plurality of candidates for a time lag for a pair of metrics are detected in the step S 102 , the dialogue unit  106  may present the candidates for a time lag to a user or the like and receive an input for selection of a time lag from a user. 
       FIG. 10  is a diagram illustrating an example of a display screen  501  (time lag selection) in the first exemplary embodiment of the present invention. The display screen  501  of  FIG. 10  displays time series graphs, and indicates that 200 msec and 400 msec are detected as candidates for a time lag for a pair of the sensor  1  which is taken as the preceding metric and the sensor  3  which is taken as the succeeding metric. 
     In this case, the dialogue unit  106  displays, for example, the display screen  501  of  FIG. 10  to a user or the like. The dialogue unit  106  receives the input for selection of a time lag used for analysis from candidates for a time lag, from a user or the like via a time lag selection button in the display screen  501 . 
     The correlation model generation unit  103  of the processing unit  140  generates the correlation model  123  for each pair of metrics contained in the time lag information  122  (step S 103 ). Here, the correlation model generation unit  103  uses a time series obtained by shifting (delaying) a time series of the preceding metric by the time lag as the time series of the input metric, and uses a time series of the succeeding metric as the time series of the output metric. The correlation model generation unit  103  stores the generated correlation model  123  in the correlation model storage unit  113 . 
     For example, it is assumed that measurement values of the sensor  1  and the sensor  3  are S1(t) and S3(t), respectively. In this case, the correlation model generation unit  103  determines, with respect to a pair of the sensor  1  and the sensor  3  in the time lag information  122  of  FIG. 6 , a correlation function by setting X(t)=S1(t−200) and Y(t)=S3(t) for the input and the output of the equation Math. 1, respectively. 
     As a result, the correlation model generation unit  103  determines a correlation function, for example, as illustrated in  FIG. 7 . The correlation model generation unit  103  then stores the correlation model  123  of  FIG. 7  in the correlation model storage unit  113 . 
     The data collection unit  101  collects a new measurement value of each metric from the target system  200  (step S 104 ). The data collection unit  101  stores time series of the collected new measurement values of the metrics as the time series data  121  in the data storage unit  111 . 
     The data extraction unit  105  extracts, with respect to each correlation function included in the correlation model  123 , measurement values needed for detection of correlation destruction from the new measurement values of the metrics, and outputs them to the correlation destruction detection unit  104  (step S 105 ). Here, the data extraction unit  105  extracts a measurement value of the input metric at or before time t and a measurement value of the output metric before time t needed for calculation of a prediction value of the output metric of the correlation function at time t. It is noted that the data extraction unit  105  extracts a measurement value of the input metric that goes back by the length of the time, lag. 
     For example, the data extraction unit  105  outputs, with respect to a pair of the sensor  1  and the sensor  3  in the correlation model  123  of  FIG. 7 , S1(t−200) as a measurement value of the input X(t) and S3(t−1) as a measurement value of the output Y(t−1) in the equation Math. 1. 
     The correlation destruction detection unit  104  detects correlation destruction with respect to each correlation function included in the correlation model  123  by using the new measurement value of each metric extracted by the data extraction unit  105  (step S 106 ). Here, the correlation destruction detection unit  104  applies the measurement value of the input metric at or before time t and the measurement value of the output metric before time t extracted by the data extraction unit  105  to the correlation function and calculates a prediction value of the output metric at time t. The correlation destruction detection unit  104  then detects correlation destruction based on the difference between the measurement value and the prediction value of the output metric at time t. 
     For example, with respect to the pair of the sensor  1  and the sensor  3  in the correlation model  123  of  FIG. 7 , the correlation destruction detection unit  104  calculates a prediction value of the sensor  3  at time t in the following manner. The correlation destruction detection unit  104  calculates a prediction value of a value (Y(t)) of the sensor  3  at time t by using a value obtained by multiplying (S3(t−1)) which is a measurement value of Y(t−1) by 0.96 and a value obtained by multiplying (S1(t−200)) which is a measurement, value of X(t) by 70. 
     The dialogue unit  106  presents a detection result of correlation destruction to a user or the like (step S 107 ). 
       FIG. 11  is a diagram illustrating an example of the display screen  501  (a display of correlation destruction) in the first exemplary embodiment of the present invention. The display screen  501  of  FIG. 11  displays that the correlation between the sensor  1  and the sensor  3  is destroyed, in an abnormality degree ranking. The display screen also displays, by time series graphs, that measurement values of the sensor  1  and the sensor  3  change while being shifted from each other by a time lag, and that a current measurement value of the sensor  3  is deviated from a prediction value. 
     The dialogue unit  106  displays, for example, the display screen  501  of  FIG. 11  to a user or the like. The dialogue unit  106  may receive an instruction as to the handling of correlation destruction from a user or the like via a handling selection button in the display screen  501 . 
     The dialogue unit  106  may further display a time series graph corrected for the length of the time lag so that time-series changes between metrics are easily compared with each other. 
       FIG. 12  is a diagram illustrating an example of the display screen  501  (time series comparison) in the first exemplary embodiment of the present invention. Time series graphs of the display screen  501  of  FIG. 12  display a time-series change of measurement values of the sensor  1  and a time-series change of measurement values of the sensor  3  that is shifted forward in time by the length of the time lag. 
     The dialogue unit  106  displays, for example, the display screen  501  of  FIG. 12  to a user or the like. 
     Thereafter, the dialogue unit  106  instructs the handling execution unit  107  to handle the correlation destruction in accordance with an operation from a user or the like. The handling execution unit  107  executes instructed handling on the target system  200 . 
     This completes the operation of the first exemplary embodiment of the present invention. 
     In the first exemplary embodiment of the present invention, an analysis based on correlation is performed as a comparative analysis between metric values in a target system. The analysis, however, is not limited thereto, and analyses other than the analysis based on correlation may be performed as long as the analysis is a comparative analysis affected by a time lag between metrics. 
     In the first exemplary embodiment of the present invention, the equation Math. 1 is used for the correlation function. The equation is, however, not limited thereto, and other correlation functions may be used as long as the correlation function represents a correlation between a pair of metrics. 
     In the first exemplary embodiment of the present invention, the time lag of each pair of metrics is detected by comparing series of time-series change patterns with one another. The detection method is, however, not limited thereto, and the time lag may be detected by other methods such as a method using a time difference between times at which metric values are maximum or minimum or a method using a phase difference between time series of metrics, as long as the time lag can be detected based on change in the metric value. 
     In the first exemplary embodiment of the present invention, a change pattern as illustrated in  FIG. 8  is used for a time-series change pattern (change pattern). The change pattern is, however, not limited thereto, and other change patterns may be used as long as the time lag between time series can be extracted. 
     In the first exemplary embodiment of the present invention, a time difference is used as the time lag, in a case that a change pattern series of a succeeding metric which is similar (same in the increase-decrease trend) to a change pattern series of a preceding metric occurs. The time difference is, however, not limited thereto, and a time difference may also be used as the time lag, even in a case that the change pattern series of the succeeding metric is opposite to the change pattern series of the preceding metric in the increase-decrease trend. 
     Next, a characteristic configuration of the first exemplary embodiment of the present invention will be described.  FIG. 1  is a block diagram illustrating a characteristic configuration of the first exemplary embodiment of the present invention. 
     The analysis apparatus (information processing apparatus)  100  includes the processing unit  140  and the pre-processing unit  130 . The processing unit  140  performs comparative analysis of values of a first metric and a second metric in a system to be analyzed. The pre-processing unit  130  identifies, with respect to the comparative analysis of the first metric and the second metric, a temporal correspondence relation between respective pieces of data used as the first metric and the second metric. 
     Next, an advantageous effect of the first exemplary embodiment of the present invention will be described. 
     According to the first exemplary embodiment of the present invention, a decrease in analysis accuracy of a target system can be prevented even when there is a large time lag between metrics of the target system. This is because the pre-processing unit  130  identifies, with respect to the comparative analysis of the first metric and the second metric, a temporal correspondence relation between respective pieces of data used as the first metric and the second metric. 
     It has been difficult to set the size of a time lag for a correlation as knowledge in advance since the size varies depending on a target system to which sensors are arranged or operating conditions of the target system. 
     According to the first exemplary embodiment of the present invention, a time lag between metrics depending on a target system can be easily identified. This is because the time lag detection unit  102  detects a time lag by comparing a series of time-series change patterns of a preceding metric, each time-series change pattern being obtained for a predetermined length of time period, with a series of time-series change patterns of a succeeding metric, each time-series change pattern being obtained for the predetermined length of time period. 
     For the correlation destruction detection unit  104 , for example, an analysis engine that uses a dedicated hardware or program may have been used since correlation destruction needs to be detected in real time for newly collected large number of measurement values. 
     According to the first exemplary embodiment of the present invention, the correlation destruction detection unit  104  (analysis engine) that cannot handle a large time lag can be utilized as it is even when there is a large time lag between metrics of a target system. This is because the data extraction unit  105  extracts a measurement value of the input metric a time lag earlier, and the correlation destruction detection unit  104  detects correlation destruction by using the measurement value extracted by the data extraction unit  105 . 
     Second Embodiment 
     Next, a second exemplary embodiment of the present invention will be described. 
     The second exemplary embodiment of the present invention is different from the first exemplary embodiment of the present invention in that generation of the time lag information  122  and generation of the correlation model  123  are performed in an apparatus which is different from the analysis apparatus  100 . In the second exemplary embodiment of the present invention, a component to which the same reference sign is assigned is the same as the component in the first exemplary embodiment of the present invention unless otherwise specified. 
       FIG. 13  is a block diagram illustrating a configuration of an analysis system in the second exemplary embodiment of the present invention. 
     Referring to  FIG. 13 , the analysis system in the second exemplary embodiment of the present invention includes the analysis apparatus  100 , a monitoring apparatus  150 , and the target system  200 . The analysis apparatus  100  and the target system  200  are communicably connected. The analysis apparatus  100  and the monitoring apparatus  150  are also communicably connected by a network or the like. 
     The analysis apparatus  100  includes the data collection unit  101 , the data storage unit  111 , the time lag storage unit  112 , the correlation model storage unit  113 , the correlation destruction detection unit  104 , the data extraction unit  105 , and the handling execution unit  107 , similarly to the analysis apparatus  100  ( FIG. 2 ) of the first exemplary embodiment of the present invention. In addition thereto, the analysis apparatus  100  further includes a handling determination unit  108 . 
     The monitoring apparatus  150  includes the time lag detection unit  102 , the correlation model generation unit  103 , and the dialogue unit  106 , similarly to the analysis apparatus  100  ( FIG. 2 ) of the first exemplary embodiment of the present invention. 
     The time lag detection unit  102  of the monitoring apparatus  150  generates the time lag information  122  based on time series data  121  stored in the data storage unit  111  of the analysis apparatus  100 . 
     The correlation model generation unit  103  of the monitoring apparatus  150  generates the correlation model  123  based on the time series data  121  stored in the data storage unit  111  and the time lag information  122  stored in the time lag storage unit  112  of the analysis apparatus  100 . 
     The handling determination unit  108  of the analysis apparatus  100  determines a handling process to be executed in a predetermined condition depending on a detection result of correlation destruction obtained by the correlation destruction detection unit  104 , and instructs the execution of handling to the handling execution unit  107 . The handling determination unit  108  then presents the execution result of handling to a user or the like through the dialogue unit  106  of the monitoring apparatus  150 . The handling determination unit  108  may instructs the handling execution unit  107  to execute an operation for handling in accordance with an operation of a user or the like which is input via the dialogue unit  106 , similarly to the first exemplary embodiment of the present invention. 
     The time lag detection unit  102  and the correlation model generation unit  103  may be included in a still another apparatus which is different from the monitoring apparatus  150 . 
     Next, an advantageous effect of the second exemplary embodiment of the present invention will be described. 
     According to the second exemplary embodiment of the present invention, a real time abnormality analysis of the target system  200  by detection of correlation destruction can be performed more rapidly compared with the first exemplary embodiment of the present invention. This is because generation of the time lag information  122  by the time lag detection unit  102  and generation of the correlation model  123  by the correlation model generation unit  103  which become a relatively high processing load are executed by an apparatus which is different from the analysis apparatus  100  which performs the abnormality analysis. 
     While the invention has been particularly shown and described with reference to exemplary embodiments thereof, the invention is not limited to these embodiments. It will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the claims. 
     This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2013-199943, filed on Sep. 26, 2013, the disclosure of which is incorporated herein in its entirety by reference. 
     REFERENCE SIGNS LIST 
     
         
         
           
               100  ANALYSIS APPARATUS 
               101  DATA COLLECTION UNIT 
               102  TIME LAG DETECTION UNIT 
               103  CORRELATION MODEL GENERATION UNIT 
               104  CORRELATION DESTRUCTION DETECTION UNIT 
               105  DATA EXTRACTION UNIT 
               106  DIALOGUE UNIT 
               107  HANDLING EXECUTION UNIT 
               108  HANDLING DETERMINATION UNIT 
               111  DATA STORAGE UNIT 
               112  TIME LAG STORAGE UNIT 
               113  CORRELATION MODEL STORAGE UNIT 
               121  TIME SERIES DATA 
               122  TIME LAG INFORMATION 
               123  CORRELATION MODEL 
               130  PRE-PROCESSING UNIT 
               140  PROCESSING UNIT 
               150  MONITORING APPARATUS 
               161  CPU 
               162  STORAGE MEDIUM 
               163  COMMUNICATION UNIT 
               164  INPUT UNIT 
               165  OUTPUT UNIT 
               200  TARGET SYSTEM