JP2005182647A - Abnormality detector for apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an abnormality detector for an apparatus which learns even abnormality patterns which are not preliminarily registered as abnormality detection conditions in real time and utilizes a data mining method to detect the abnormalities of the apparatus. <P>SOLUTION: In a learning part 21, new learning results are generated from apparatus operation information 11 received from an electronic apparatus 1 and past learning results 31, which are stored in a storage part 3. During operation, operation information 11 of the electronic apparatus 1 being an abnormality detection object and the learning results 31 are compared in an analysis section 22 to represent the degree of difference as a numerical value, and the numerical value is stored as analysis results 32 in the storage part 3. A detecting/informing part 23 refers to the analysis results 32 to perform comparison with a threshold. When data showing an abnormality of the electronic apparatus 1 are found as comparison results, an output part 4 is informed that the abnormality occurs in the electronic apparatus 1. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a device abnormality detection apparatus that learns in real time even an abnormality pattern that is not registered as a condition for detecting an abnormality in advance and detects a device abnormality using a data mining technique.

In recent years, various electronic devices and the internal configuration of a system that combines these have become complicated in order to perform advanced processing, but due to its complexity, troubles often occur due to unexpected troubles such as power outages, Failure may occur. Alternatively, the system may fail because the type of data to be processed is not compatible with the program, for example, it becomes impossible to process due to a mixture of character strings for numerical processing.
In addition, a small number of failures may cause fatal failures to the entire electronic device or system.
Therefore, faults must be detected as soon as possible. And an apparatus for detecting such an abnormality is indispensable in current electronic devices and systems.

  As a conventional technique for taking measures against various abnormalities, for example, it reduces the time required for log information analysis work, integrates log information having various data formats and file system uneven distribution, Log information analysis that can extract log information indicating a new abnormality that is not abnormal, and allows the system administrator to quickly grasp the log information to be noticed from a huge amount of log information in characters There are inventions related to devices and the like. Thereby, the administrator can perform a quick log analysis when analyzing log information for a device in which an abnormality has occurred (see Patent Document 1).

  Further, for example, there is an invention related to an abnormal input detection device that detects abnormal raw data from data input by a consumer. Thereby, it is possible to exclude abnormal data accurately (see Patent Document 2).

Moreover, as a technique for detecting outliers / abnormal values from a large number of statistical data, rule learning or learning with a label using a neural network has been the mainstream, but if labeled data is not available, Although rule learning and labeled learning using a neuron cannot be applied, recently, a technique for detecting an outlier / abnormal value even with unlabeled data has been introduced (see Non-Patent Document 1).
JP 2001-356939 A JP 2003-132075 A Kenji Yamanishi, Junichi Takeuchi, Discovery of outlier filtering rules from unsupervised data, 2001 Information theory learning theory workshop (2001)

Conventional devices for detecting device abnormalities register conditions for detection for each device with respect to information obtained from devices such as logs, and the information that is obtained from devices matches the conditions for abnormalities. By doing so, the occurrence of abnormality was judged.
However, in the conventional technique, it is necessary to create a pattern to be abnormal in advance and register it in the device. For that purpose, it is necessary to assume a state in which an abnormality occurs. The operation of creating an abnormal pattern requires a high level of skill of the operator, but it is practically difficult to cover all patterns. Therefore, what deviated from the assumption could not be detected even if an abnormality occurred.

In order to avoid such a problem, it is necessary to cover all cases when designing an abnormal pattern, but this is a very heavy work for the designer.
In addition, when the usage environment of the device changes and the information obtained from the device is affected, it is necessary to create a new pattern.
Therefore, it has been desired that an apparatus for detecting a device abnormality has a function of learning a log generated by the device without registering conditions for detecting the abnormality in advance.

Further, as in the prior art, the system administrator uses a data mining method or the like to acquire characteristic information from the output log file, for example, information indicating a device failure. Log analysis was conducted to understand device abnormalities.
However, the information recorded in the log file is mostly information indicating the state of normal operation (normal operation history), and it is difficult to efficiently acquire the target information (information indicating a failure or the like). there were.
Therefore, not all log information is provided to the system administrator, but only characteristic information (information indicating device malfunction, etc.) is extracted and provided to the administrator by using a data mining technique. A function to (notify) was desired.

  The present invention has been made in view of the above circumstances, and learns in real time even an abnormal pattern that is not registered in advance as a condition for detecting an abnormality, and further uses a data mining technique to provide a device. An object of the present invention is to provide an apparatus for detecting an abnormality of an apparatus for detecting an abnormality of the apparatus.

  In order to solve the above-mentioned problem, the invention described in claim 1 includes a monitoring device that monitors an operation state of a device and detects an abnormality, and a device monitored by the monitoring device. An apparatus for detecting an abnormality of a device, wherein the monitoring device receives device operation information indicating an operation state generated by operation of the device, learns the device operation information, and stores the contents as a learning result A learning means; an analysis means for comparing and analyzing the device operation information and the learning result; storing the contents as an analysis result; an abnormality detecting means for detecting an abnormality of the device from the analysis result; Output means for outputting the fact that the abnormality is detected.

  The invention described in claim 2 is characterized in that the device has information collection and transmission means for collecting device operation information indicating an operation state generated by its own operation and transmitting the device operation information to the monitoring device.

  The invention described in claim 3 is characterized in that the information collection / transmission means includes information collection means for collecting only the information specified in the information collection setting file from the device operation information.

  The invention described in claim 4 is characterized in that the monitoring device has a first content changing means for changing the content of the information collection setting file.

  The invention described in claim 5 is characterized in that the first content changing means has first instruction means for instructing from the outside.

  The invention according to claim 6 is characterized in that the learning means has second learning means for learning about an item specified in the setting file and storing it as a learning result.

  The invention described in claim 7 is characterized in that the analysis means has second analysis means for analyzing items specified in the setting file and storing them as analysis results.

  The invention according to claim 8 is characterized in that the abnormality detection means has a determination means for determining whether or not there is an abnormality by comparing the value of the analysis result with a threshold value specified in a setting file. Features.

  The invention according to claim 9 is characterized in that the monitoring device has a second content changing means for changing the content of the setting file.

  A tenth aspect of the invention is characterized in that the second content changing means includes second instruction means for instructing from the outside.

  According to the present invention, there is provided a device abnormality detection device characterized by including a monitoring device for monitoring an operation state of the device and detecting an abnormality, and a device monitored by the monitoring device, The monitoring device receives device operation information indicating an operation state generated by the operation of the device, learns the device operation information, and stores the contents as a learning result; the device operation information; An analysis unit that compares and analyzes the learning result and stores the content as an analysis result, an abnormality detection unit that detects an abnormality of the device from the analysis result, and an output that indicates that the abnormality of the device is detected By using the data mining technique, it is possible to detect an abnormality of the device without registering a condition for detecting the abnormality in advance.

  In recent years, various electronic devices and the internal configuration of a system combining these have become complicated in order to perform advanced processing. In addition, since there are a wide variety of devices used in the system, as shown in the following embodiments, a general-purpose information processing device such as a server computer is used as a monitoring device, and the system administrator accesses the server. It is the most preferred embodiment to monitor an electronic device using an information processing apparatus such as a personal computer.

Next, embodiments of the present invention will be described with reference to the accompanying drawings.
FIG. 1 is a diagram showing an outline of the abnormality detection device.
The abnormality detection device includes an electronic device 1 that is an abnormality detection target, a detection unit 2 that detects an abnormality of the electronic device 1, a storage unit 3 that stores information, and an output such as a display for displaying a detection result. The unit 4 is configured.
The electronic device 1 that is the target of abnormality detection has device operation information 11 such as a log of its operation results in the form of a file or the like.
The storage unit 3 has a learning result 31 in which the operation information 11 of the electronic device 1 so far is accumulated and an analysis result 32 in which the operation information 11 of the electronic device 1 at the present time is analyzed.

The learning unit 21 of the detection unit 2 reads and processes the device operation information 11 and the learning result 31 in order to reflect the device operation information 11 in the learning result 31, and returns the result to the learning result 31 of the storage unit 3.
In the analysis unit 22, the device operation information 11 and the learning result 31 are compared and analyzed, and the result is stored in the analysis result 32 of the storage device 3.
The detection / notification unit 23 searches the analysis result 32 and, when an abnormality is detected, notifies the administrator by outputting the fact to the output unit 4.

FIG. 2 is a flowchart illustrating the operation flow of the abnormality detection device.
The electronic device 1 to be monitored for abnormality detection outputs device operation information 11 such as an operation log and a security log during operation. Furthermore, the learning unit 21 and the analysis unit 22 operate at a preset time (step S1).
Based on the existing statistical model A1 obtained from the learning result 31, the learning unit 21 performs a new probability distribution calculation process to which the content of the analysis target data A2 obtained from the device operation information 11 is added. The new statistical model A3, which is the calculated result, replaces the learning result 31 as a new learning result (step S2).

Next, the analysis unit 22 calculates a score for each element constituting the analysis target data A2 obtained from the information 11, based on the new statistical model A3 obtained from the learning result 31.
Here, the score is a numerical value representing the statistical distance between the statistical model that is the basis and the statistical model that is obtained by adding the elements to be evaluated in the data to be analyzed. (See Patent Document 1).
Therefore, the larger the numerical value of the score, the greater the degree of statistical deviation (fluctuation) of the content from the statistical model A3. The score A4 for each element constituting the analysis target data A2 obtained in step S4 is output as the analysis result 32 (step S4).

The detection / notification unit searches the score stored in the analysis result 32 for a value greater than or equal to a preset threshold value (step S5).
If there is a score equal to or higher than a preset threshold value (step S5 / Yes), it is determined that an abnormality has occurred in the device, and the administrator is notified in accordance with a predetermined procedure such as e-mail (step). S6).

FIG. 3 is a diagram showing a more detailed configuration of the abnormality detection device.
As shown in the figure, the abnormality detection device includes an electronic device 1 to be monitored, a monitoring device 200, and an administrator terminal 300.
In the monitoring target device 1, the information collection processing unit 110 collects various logs such as an access log, SYSLOG, and event log generated by the device, converts them into CSV data, and connects the network to the monitoring device 200. And is added to the extracted information file on the monitoring apparatus 200.
The information collection setting file 120 describes parameters and the like necessary for the operation of the information collection processing unit 110.
For example, which log information is collected from various types of log information such as information on a transmission destination monitoring device, access log, SYSLOG, and event log, or log information about which internal unit constituting the electronic device 1 Various parameters necessary for the operation of the information collection processing unit, such as whether to collect data, are described.

In the monitoring device 200, the information processing unit 210 is designated at the digit position in the setting file 280 from the CSV data of the extracted information file received from the information collection processing unit 210 on the electronic device 1 to be monitored. The time attribute item is converted into seconds for easy learning analysis, digitized, newly created CSV data, and added to the processed information file.
Here, “converting to a numerical value in terms of seconds” means indicating how much time has elapsed from a certain reference time in seconds. For example, if the reference time is 00:00:00 on December 1, 2003, the time of 0:10:10 on December 1, 2003 is quantified as 610.
However, the method is not limited to “second conversion”, and there is a method of quantifying in a shorter time unit, for example, 1/10 second unit, 1/100 second unit, millisecond (1/1000 second) unit, or the like.

The learning processing unit 220 refers to update the statistical file, and further, information on the items specified in the setting file 280 from all items of the CSV data of the processed information file is stored in the statistical file so far. And output as a new statistics file.
The analysis processing unit 230 calculates the statistical distance between the learning result and the items in the analysis target CSV data specified in the setting file 280 from the statistical file, quantifies the degree of abnormality, and generates the analysis result file. Output.

Here, “items specified in the setting file 280” mean items related to various operations of the electronic device 1. For example, if the electronic device 1 is a data communication device that realizes high-speed data communication, it is preferable to acquire information relating to data traffic from a large amount of log information. You only have to set it.
More specifically, if the data is acquired for multiple information such as the line speed and the buffer area status where data that is waiting for data communication is temporarily stored as factors that influence data traffic, By using a mining technique, analysis and abnormality detection can be performed.

Alternatively, when monitoring the CPU that controls the entire electronic device, it is preferable to acquire temperature information such as processing capacity (processing speed per second) and temperature rise due to heat generation and temperature drop due to cooling. It is only necessary to make a setting of “processing for processing capacity” or “processing for temperature information”.
Alternatively, a setting such as “process all log information” can be performed to comprehensively analyze and detect an abnormality.

The detection processing unit 240 reads a threshold value from the setting file 280, searches the analysis result file for a numerical value representing the degree of abnormality being equal to or greater than the threshold value, and outputs the search result as a detection result file.
The notification processing unit 250 notifies the administrator terminal 300 of data in the detection result file using e-Mail or SNMP (Simple Network Management Protocol).

In addition, in order to automatically execute the information processing processing unit 210, the learning processing unit 220, the analysis processing unit 230, the detection processing unit 240, and the notification processing unit 250 in a series of flows, the execution control unit 260 to manage.
The management function 270 also provides a function for editing the setting file 280 as a function that operates on the Web server. Therefore, the monitoring device 200 generally uses a highly versatile information processing device such as a server computer.

The administrator terminal 300 can connect to the management function from the Web browser 310 and edit the setting file 280 on the monitoring device 200 and the information collection setting file 120 on the electronic device 1 to be monitored. .
The mailer 320 receives the notification mail from the notification processing unit 250 of the monitoring device 200.
As the administrator terminal 300, a highly versatile information processing apparatus such as a personal computer is generally used.

  The means for notifying the abnormality detection from the monitoring apparatus or the means for outputting the notified contents is not limited to e-Mail or SNMP, and is managed from the monitoring apparatus every time an abnormality is detected using a dedicated program. It is also conceivable to notify the user terminal by giving a pop-up notification on the screen or by issuing a sound such as a warning sound.

Moreover, embodiment shown above is an example of suitable implementation of this invention. However, the embodiments of the present invention are not limited to these, and various modifications can be made without departing from the scope of the present invention.
For example, in this embodiment, there is provided means for collecting device operation information 11 on the electronic device 1 to be monitored and transmitting it to the monitoring device 200. However, the device operation information 11 on the electronic device 1 from the monitoring device 200 is provided. It is possible to refer to and acquire (download).

(effect)
As is apparent from the above description, an apparatus abnormality detection apparatus comprising: a monitoring apparatus that monitors an operation state of an apparatus and detects an abnormality; and an apparatus monitored by the monitoring apparatus. The monitoring device receives device operation information indicating an operation state generated by the operation of the device, learns the device operation information, and stores the contents as a learning result, and the device operation Information and the learning result are compared and analyzed, an analysis means for storing the contents as an analysis result, an abnormality detection means for detecting an abnormality of the device from the analysis result, and the fact that the abnormality of the device is detected By having an output means for outputting, without registering conditions for detecting an abnormality in advance, an apparatus abnormality is detected using a data mining technique. It is possible to grasp an abnormality of the device through the power unit.

  In addition, when collecting and transmitting device operation information, only necessary information is collected from the device operation information by having means for collecting only the information specified in the information collection setting file, It is possible to analyze efficiently and detect anomalies.

  In addition, when changing the contents of the information collection setting file, the system administrator can change the settings as necessary by giving an external instruction.

  Further, since the items specified in the setting file are learned and stored as learning results, efficient learning is possible, and more efficient analysis processing and abnormality detection processing can be performed.

  Further, since the items specified in the setting file are analyzed and stored as analysis results, efficient analysis can be performed, and furthermore, efficient abnormality detection can be performed.

In addition, when changing the contents of the setting file, the system administrator can change the settings as necessary by giving an external instruction.
For example, it is possible to increase the sensitivity of abnormality detection by increasing the threshold value. Conversely, if the threshold value is decreased, the sensitivity of abnormality detection can be decreased.
In this way, the system administrator can change the operation setting of the abnormality detection device according to the situation.

  In the conventional technique, the manufacturer of the electronic device assumes an abnormal state (error design). However, according to the present invention, an operation that assumes an abnormal state (error design work) becomes unnecessary.

It is a figure which shows the outline | summary of an abnormality detection apparatus. It is the flowchart explaining the flow of operation | movement of the abnormality detection apparatus. FIG. 3 is a diagram showing a detailed configuration of the abnormality detection device.

Explanation of symbols

1 Anomaly detection target equipment (electronic equipment)
2 Detection Unit 3 Storage Unit 4 Output Unit 11 Device Operation Information 21 Learning Unit 22 Analysis Unit 23 Detection / Notification Unit 31 Learning Result 32 Analysis Result 110 Information Collection Processing Unit 120 Information Collection Setting File 200 Monitoring Device 210 Information Processing Processing Unit 220 Learning processing unit 230 Analysis processing unit 240 Detection processing unit 250 Notification processing unit 260 Execution control unit 270 Management function 280 Setting file 300 Administrator terminal 310 Web browser 320 Mailer A1 Existing statistical model A2 Analysis target data A3 New statistical model A4 Score data

Claims (10)

A monitoring device that monitors the operational status of the device and detects anomalies;
An apparatus for detecting an abnormality of an apparatus, comprising an apparatus monitored by the monitoring apparatus,
The monitoring device receives device operation information indicating an operation state generated by the operation of the device, learns the device operation information, and stores the contents as a learning result;
Analyzing and analyzing the device operation information and the learning result, and storing the contents as an analysis result;
An abnormality detection means for detecting an abnormality of the device from the analysis result;
An apparatus abnormality detection apparatus comprising: output means for outputting a notification that an abnormality of the apparatus has been detected.   2. The apparatus abnormality detection device according to claim 1, further comprising information collection and transmission means for collecting device operation information indicating an operation state generated by its own operation and transmitting the device operation information to the monitoring device.   3. The apparatus abnormality detection device according to claim 2, wherein the information collection and transmission unit includes an information collection unit that collects only the information specified in the information collection setting file from the device operation information.   4. The apparatus abnormality detection device according to claim 3, wherein the monitoring device includes first content changing means for changing the content of the information collection setting file.   The apparatus according to claim 4, further comprising a first instruction unit that instructs the first content changing unit from outside.   6. The device abnormality detection according to claim 1, wherein the learning unit includes a second learning unit that learns about an item specified in a setting file and stores the learning result as a learning result. apparatus.   The apparatus according to claim 1, wherein the analysis unit includes a second analysis unit that analyzes an item specified in a setting file and stores the result as an analysis result. apparatus.   The abnormality detection unit includes a determination unit that determines whether or not there is an abnormality by comparing the value of the analysis result with a threshold value specified in a setting file. The apparatus abnormality detection device according to any one of the above.   9. The apparatus abnormality detection device according to claim 6, wherein the monitoring device includes a second content changing unit that changes the content of the setting file.   10. The apparatus abnormality detection device according to claim 9, further comprising second instruction means for instructing the second content changing means from outside.

Images