In a case where supervised (learning) data is prepared and the case where test data is prepared, the data is recorded with time information attached to the data. The method includes clustering the learning data in a target class and clustering the test data in the target class. Then, the probability density for each of identified subclasses is calculated for each of time intervals having various time points and widths for the learning data, and is calculated for each of time intervals in the latest time period which have various widths, for the test data. Then, a ratio between a probability density obtained when learning is performed and a probability density obtained when testing is performed is obtained as a relative frequency in each of the time intervals for each of the subclasses. Input having a relative frequency that statistically and markedly increases is detected as an anomaly.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A computer implemented information identification method for detecting an attack carried out using irregular data against a classifier that is configured by means of supervised machine learning, the method comprising the steps of: preparing a plurality of pieces of training data each including feature data, a label, and time; configuring the classifier by using the plurality of pieces of training data; configuring a sub-classifier by using the plurality of pieces of training data while classifying data in classes obtained through classification by the classifier, into subclasses; preparing a plurality of pieces of test data each including feature data, a label, and time; classifying the plurality of pieces of test data by using the classifier; classifying the plurality of pieces of test data that have been classified, into subclasses by using the sub-classifier; calculating statistical data representing a relative frequency of the plurality of pieces of test data with respect to the plurality of pieces of training data, the statistical data being calculated for each identical set of the subclasses in a time window having a predetermined width for the time; and warning of a possibility of occurrence of the attack carried out using the irregular data, in response to a value of the statistical data exceeding a predetermined threshold. 2. The information identification method according to claim 1, wherein the feature data is represented by a feature vector obtained by converting an answer to a question item in a financial application document into an electronic form, and the classes include an acceptance class and a rejection class. 3. The information identification method according to claim 1, wherein the classifier is configured with a support vector machine. 4. The information identification method according to claim 1, wherein the sub-classifier uses a K-means algorithm. 5. The information identification method according to claim 2, wherein the irregular data is falsely accepted data. 6. The information identification method according to claim 1, wherein the statistical data is calculated by using a moving average of the frequency and a variance of the moving average. 7. A computer executed information identification program product for detecting an attack carried out using irregular data against a classifier that is configured by means of supervised machine learning, the program product causing a computer to execute the steps of: preparing a plurality of pieces of training data each including feature data, a label, and time; configuring the classifier by using the plurality of pieces of training data; configuring a sub-classifier by using the plurality of pieces of training data while classifying data in classes obtained through classification by the classifier, into subclasses; preparing a plurality of pieces of test data each including feature data, a label, and time; classifying the plurality of pieces of test data by using the classifier; classifying the plurality of pieces of test data that have been classified, into subclasses by using the sub-classifier; calculating statistical data representing a relative frequency of the plurality of pieces of test data with respect to the plurality of pieces of training data, the statistical data being calculated for each identical set of the subclasses in a time window having a predetermined width for the time; and warning of a possibility of occurrence of the attack carried out using the irregular data, in response to a value of the statistical data exceeding a predetermined threshold. 8. The information identification program product according to claim 7, wherein the feature data is represented by a feature vector obtained by converting an answer to a question item in a financial application document into an electronic form, and the classes include an acceptance class and a rejection class. 9. The information identification program product according to claim 7, wherein the classifier is configured with a support vector machine. 10. The information identification program product according to claim 7, wherein the sub-classifier uses a K-means algorithm. 11. The information identification program product according to claim 8, wherein the irregular data is falsely accepted data. 12. The information identification program product according to claim 7, wherein the statistical data is calculated by using a moving average of the frequency and a variance of the moving average. 13. A computer implemented information identification system for detecting an attack carried out using irregular data against a classifier that is configured by means of supervised machine learning, the information identification system comprising: storage means; a plurality of pieces of training data each including feature data, a label, and time, and being stored in the storage means; a classifier configured by using the plurality of pieces of training data; a sub-classifier being configured by using the plurality of pieces of training data and being used for classifying data in classes obtained through classification by the classifier, into subclasses; data in the subclasses of the plurality of pieces of training data, the data being generated by applying the sub-classifier to the plurality of pieces of training data and being stored in the storage means; a plurality of pieces of test data each including feature data, a label, and time, and being stored in the storage means; data in subclasses of the plurality of pieces of test data, the data being generated by applying the sub-classifier to the plurality of pieces of test data and being stored in the storage means; calculation means for calculating statistical data representing a relative frequency of the plurality of pieces of test data with respect to the plurality of pieces of training data, the statistical data being calculated for each identical set of the subclasses in a time window having a predetermined width for the time; and warning means for warning of a possibility of occurrence of the attack carried out using the irregular data, in response to a value of the statistical data exceeding a predetermined threshold. 14. The information identification system according to claim 13, wherein the feature data is represented by a feature vector obtained by converting an answer to a question item in a financial application document into an electronic form, and the classes include an acceptance class and a rejection class. 15. The information identification system according to claim 13, wherein the classifier is configured with a support vector machine. 16. The information identification system according to claim 13, wherein the sub-classifier uses a K-means algorithm. 17. The information identification system according to claim 14, wherein the irregular data is falsely accepted data. 18. The information identification system according to claim 13, wherein the statistical data is calculated by using a moving average of the frequency and a variance of the moving average.