JP2012186667A - Network fault detection apparatus, network fault detection method of network fault detection apparatus, and network fault detection program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect a fault that is caused by a network based on communication information and terminal operation information under such condition as routing information is not known.SOLUTION: A response time fluctuation quantitative evaluation part 110 generates a quantitative evaluation value data 193 of PING response time. An operation load weight function calculation part 120 generates a weighting evaluation value data 195 of the PING response time based on a terminal operation value data 192 of each terminal device. A weight consideration fluctuation characteristic classification part 130 generates a terminal device classification data 196 by classifying terminal devices for each group based on the weighting evaluation value data 195 of the respective terminal devices. A network fluctuation extraction part 140 calculates a network fluctuation evaluation value data 197n based on the terminal device classification data 196 and the weighting evaluation value data 195. A network fault evaluation part 150 generates a network fault evaluation result data 181 based on the network fluctuation evaluation value data 197n and past fault content data 199. A fault notification part 160 outputs the network fault evaluation result data 181.

Description

  The present invention relates to, for example, a network failure detection device that detects a network failure, a network failure detection method of the network failure detection device, and a network failure detection program.

In order to maintain the quality of service provided in a business operator who manages a network including various business forms and various communication infrastructure forms, it is necessary to take prompt measures by proactive detection of abnormalities.
After detection, the initial action depends on whether the source of the abnormality is in the network or the terminal.
In particular, in the case of a failure caused by the inside of the network, there is a waste of being dispatched to the site where the failure has occurred and making an inquiry to the network side when there is no problem on the site. For this reason, the loss of time delay until failure recovery and extra field dispatch occurs.

  In some companies that know the contents of the network configuration, quality degradation location estimation technology that identifies the location of the cause of quality degradation based on traffic route information in the network is being researched.

Japanese Patent Application Laid-Open No. 2004-133867 discloses a method of determining only from whether or not each terminal can be accessed and detecting only an abnormality in a down state among network failures.
Patent Document 2 discloses a method for evaluating communication quality from response times to individual terminals.
Patent Document 3 discloses a method of obtaining a correlation coefficient between individual terminals from operation information of individual terminals and evaluating a deterioration tendency from past observation values.

JP 2009-171009 A JP 2007-310762 A JP 2006-146668 A

In order to estimate the quality degradation location by the conventional method, network routing information is required. However, the telecommunications carrier contracting and using the communication infrastructure does not know the routing information and configuration of the sub-network managed by the carrier, and detailed routing information cannot be obtained.
Therefore, the state of the entire network, including unknown sub-networks, is estimated from communication information and terminal operation information that can be observed by the telecommunications carrier. Need to detect failure.

  An object of the present invention is to make it possible to detect a failure caused in a network from communication information and terminal operation information in a state where routing information is unknown, for example.

The network failure detection apparatus of the present invention
A plurality of responses measured at different measurement times as a time from when the response request data is transmitted to the plurality of terminal devices connected to the network and the response request data is transmitted until the response data is received. A response time storage unit that stores time and a plurality of measurement times obtained by measuring the plurality of response times in association with each terminal device;
A resource usage storage unit that stores a plurality of resource usages measured at different measurement times in each terminal device and a plurality of measurement times for measuring the plurality of resource usages in association with each terminal device;
A plurality of response times are acquired for each terminal device from the response time storage unit, and a value corresponding to the length of the response time is measured for each response time based on the acquired response times. A response time evaluation value calculation unit for calculating as a time evaluation value;
A response time evaluation value storage unit that stores, for each terminal device, a response time evaluation value at each measurement time calculated by the response time evaluation value calculation unit;
The response time evaluation value at each measurement time is acquired for each terminal device from the response time evaluation value storage unit, and the resource usage at each measurement time is acquired for each terminal device from the resource usage storage unit, and each measurement acquired Based on the response time evaluation value of the time and the resource usage at each measurement time, the larger the response time evaluation value for each measurement time, the larger the smaller the value of the measurement time. A weighted evaluation value calculating unit that calculates the weighted evaluation value;
A weighted evaluation value storage unit that stores a weighted evaluation value of each measurement time calculated by the weighted evaluation value calculation unit for each terminal device;
A terminal device classifying unit that classifies the plurality of terminal devices into a plurality of terminal device groups composed of one or more terminal devices based on the weighted evaluation value of each terminal device stored in the weighted evaluation value storage unit;
Based on the classification result by the terminal device classification unit, the weighted evaluation value of each terminal device belonging to the terminal device group is obtained for each terminal device group from the weighted evaluation value storage unit, and based on the obtained weighted evaluation value of each terminal device Calculating a distribution of weighted evaluation values of the terminal device group at each measurement time, and selecting a weighted evaluation value in the distribution as a network evaluation value of the terminal device group at each measurement time based on the calculated distribution of weighted evaluation values An evaluation value selection unit;
A network evaluation value storage unit that stores a plurality of past times indicating past measurement times and network evaluation values of each past time in association with each terminal device group;
A network failure data storage unit that stores network failure data in which a failure content indicating a failure that has occurred in the network is associated with a failure time that indicates a time at which the failure has occurred;
Based on the network evaluation value at each measurement time selected for each terminal device group by the network evaluation value selection unit and the network evaluation value at each past time stored for each terminal device group in the network evaluation value storage unit. A correlation time zone determination unit that determines, for each terminal device group, a past time zone in which the correlation between the network evaluation value of the measurement time and the network evaluation value is high, as a correlation time zone;
Based on the network failure data stored in the network failure data storage unit and the correlation time zone determined for each terminal device group by the correlation time zone determination unit, the failure time corresponding to the correlation time zone is determined for each terminal device group. A detection result output unit that searches from the network failure data, acquires failure content corresponding to the failure time from the network failure data, and outputs the acquired failure content in association with group information representing the terminal device group; Is provided.

  According to the present invention, for example, a failure caused in the network can be detected from communication information (response time) and terminal operation information (resource usage amount) in a state where routing information is unknown.

1 is a diagram illustrating a configuration example of a network system 200 according to Embodiment 1. FIG. FIG. 3 is a functional configuration diagram of the in-network fault extraction apparatus 100 according to the first embodiment. 3 is a flowchart showing a network fault extraction method of the network fault extraction apparatus 100 according to the first embodiment. 4 is a table showing an example of PING response time data 191 in the first embodiment. 6 is a graph showing an example of PING response time data 191 in the first embodiment. FIG. 3 is a schematic diagram illustrating principal component analysis of a response time variation quantitative evaluation unit 110 according to the first embodiment. The figure showing the quantitative evaluation value (Mahalanobis distance) of the PING response time in Embodiment 1. FIG. A table showing an example of quantitative evaluation value data 193 in the first embodiment. 6 is a graph showing an example of quantitative evaluation value data 193 in the first embodiment. 4 is a table showing an example of terminal operating value data 192 in the first embodiment. 3 is a graph showing an example of terminal operating value data 192 in the first embodiment. 5 is a graph showing working load weight function value data 194 in the first embodiment. 6 is a graph showing weighted evaluation value data 195 in the first embodiment. The figure which showed the terminal device group in the graph of the weighting evaluation value data 195 in Embodiment 1. FIG. 4 is a table showing terminal device classification data 196 in the first embodiment. FIG. 3 is a schematic diagram showing a method for generating network fluctuation evaluation value data 197n in the first embodiment. A table showing an example of network fluctuation evaluation value data 197n in the first embodiment. 6 is a graph showing an example of network fluctuation evaluation value data 197n in the first embodiment. FIG. 6 is a relationship diagram between past network fluctuation evaluation value data 197o and new network fluctuation evaluation value data 197n in the first embodiment. A table showing an example of failure content data 199 in the first embodiment. FIG. 3 is a diagram illustrating an example of hardware resources of the in-network failure extraction apparatus 100 according to the first embodiment.

Embodiment 1 FIG.
A mode for detecting a network failure occurring in the network system will be described.

FIG. 1 is a diagram illustrating a configuration example of a network system 200 according to the first embodiment.
A configuration example of the network system 200 in the first embodiment will be described with reference to FIG.

In the network system 200, the network 210 includes a plurality of sub-networks 211A-D, and a plurality of terminal devices 220A-I are connected to each sub-network 211A-C.
Further, the terminal information collection device 230 and the in-network failure extraction device 100 are connected to the sub-network 211D.

A response time measurement unit (not shown) of the terminal information collection device 230 executes a PING command every predetermined measurement time, and transmits an ICMP (Internet Control Message Protocol) response request packet to each terminal device 220.
The terminal information collecting device 230 receives the ICMP response packet transmitted from each terminal device 220, measures the time from when the response request packet is transmitted until the response packet is received, and the measured time is the terminal device. Store every 220.
Hereinafter, the time measured by the terminal information collection device 230 is referred to as “PING response time (or response time)”.

In addition, each terminal device 220 measures the usage of resources such as a CPU (Central Processing Unit) and a memory (hereinafter referred to as resource usage) for each predetermined measurement time, and stores the measured resource usage.
Then, a resource usage collection unit (not shown) of the terminal information collection device 230 collects the resource usage from each terminal device 220 and stores the collected resource usage for each terminal device 220.

  The network fault extraction apparatus 100 includes the PING response time (PING response time data 191 described later) of each terminal apparatus 220 measured by the terminal information collection apparatus 230, and the terminal apparatus 220 collected by the terminal information collection apparatus 230. Based on the resource usage (terminal operation value data 192 described later), the sub-network 211 in which a network failure has occurred is detected.

However, the configuration of the network system 200, such as the configuration of the network 210, the configuration of the subnetwork 211, the connection form of the subnetwork 211, and the connection form of the terminal device 220, is not limited to the configuration shown in FIG.
Further, the in-network fault extraction apparatus 100 may have the function of the terminal information collection apparatus 230.

FIG. 2 is a functional configuration diagram of the in-network fault extraction apparatus 100 according to the first embodiment.
A functional configuration of the in-network fault extraction apparatus 100 according to the first embodiment will be described with reference to FIG.

The network failure extraction device 100 (an example of a network failure detection device) includes a response time variation quantitative evaluation unit 110, an operational load weight function calculation unit 120, a weight-considered variation characteristic classification unit 130, a network variation extraction unit 140, A network failure evaluation unit 150 and a failure notification unit 160 are provided.
Further, the network fault extraction apparatus 100 includes a device storage unit 190 (response time storage unit, resource usage storage unit, response time evaluation value storage unit, weighted evaluation value storage unit, network evaluation value storage unit, network fault data storage unit). Example).

The device storage unit 190 stores data used by the network fault extraction device 100 using a storage medium.
For example, the device storage unit 190 stores in advance PING response time data 191 and terminal operating value data 192 generated by the terminal information collection device 230 (see FIG. 1).
In addition, the device storage unit 190 stores various data (reference numerals 193 to 199 and 181) generated by the in-network failure extraction device 100.

  PING response time data 191 (an example of response time data) is a terminal device in which a plurality of response times (PING response times) measured at different measurement times are associated with a plurality of measurement times at which a plurality of response times are measured. It is the data shown for every. The response time is a time measured as a time from when response request data for requesting response data is transmitted to a plurality of terminal devices connected to the network and the response request data is transmitted until the response data is received.

  The terminal operating value data 192 (an example of resource usage data) is obtained by associating a plurality of resource usages measured at different measurement times with a plurality of measurement times at which a plurality of resource usages are measured for each terminal device. It is the data shown.

The response time fluctuation quantitative evaluation unit 110 (an example of a response time evaluation value calculation unit) calculates a response time evaluation value (a quantitative evaluation value described later) as follows (response time evaluation value calculation processing).
The response time variation quantitative evaluation unit 110 acquires a plurality of response times from the PING response time data 191 for each terminal device.
The response time variation quantitative evaluation unit 110 calculates a value corresponding to the length of the response time as a response time evaluation value of the measurement time for each measurement time of the response time based on the acquired plurality of response times.

For example, the response time variation quantitative evaluation unit 110 calculates a response time evaluation value as follows.
The response time variation quantitative evaluation unit 110 performs principal component analysis on the acquired plurality of response times, and calculates a value obtained for each measurement time of each response time by the principal component analysis as a response time evaluation value of the measurement time.

For example, the response time variation quantitative evaluation unit 110 performs principal component analysis as follows.
The response time variation quantitative evaluation unit 110 extracts one or more response times corresponding to a predetermined measurement period including the measurement time as a response time series for each response time measurement time.
The response time variation quantitative evaluation unit 110 generates a matrix in which response time series at each measurement time are arranged as a time series waveform matrix, and performs principal component analysis using the generated time series waveform matrix.

The response time variation quantitative evaluation unit 110 generates quantitative evaluation value data 193.
The quantitative evaluation value data 193 (an example of response time evaluation value data) is data indicating the response time evaluation value at each measurement time for each terminal device.

The operating load weight function calculation unit 120 (an example of a weighted evaluation value calculation unit) calculates a weighted evaluation value as follows (weighted evaluation value calculation process).
The operational load weight function calculation unit 120 acquires a response time evaluation value at each measurement time from the quantitative evaluation value data 193 for each terminal device.
The operating load weight function calculation unit 120 acquires the resource usage at each measurement time from the terminal operating value data 192 for each terminal device.
Based on the acquired response time evaluation value at each measurement time and the resource usage at each measurement time, the working load weight function calculation unit 120 performs measurement corresponding to the measurement time as the response time evaluation value increases for each measurement time. A smaller value is calculated as the weighted evaluation value of the measurement time as the amount of resource usage at the time increases.

For example, the working load weight function calculation unit 120 calculates a weighted evaluation value as follows.
Based on the resource usage at each measurement time, the operating load weight function calculation unit 120 calculates a value corresponding to the size of the resource usage for each measurement time of each resource usage as a weighting value for the measurement time (weighting value). Calculation process).
The working load weight function calculation unit 120 uses the resource of the measurement time corresponding to the measurement time as the response time evaluation value increases for each measurement time based on the response time evaluation value at each measurement time and the weighted value of each measurement time. A smaller value is calculated as a weighted evaluation value of the measurement time as the amount increases.

The operating load weight function calculation unit 120 generates weighted evaluation value data 195.
The weighted evaluation value data 195 is data indicating the weighted evaluation value at each measurement time for each terminal device.

The weight-considering variation characteristic classification unit 130 (an example of a terminal device classification unit) classifies a plurality of terminal devices into a plurality of terminal device groups as follows (terminal device classification processing).
Based on the weighted evaluation value of each terminal device indicated in the weighted evaluation value data 195, the weight-considering variation characteristic classifying unit 130 classifies the plurality of terminal devices into a plurality of terminal device groups composed of one or more terminal devices.

For example, the weight-considering variation characteristic classification unit 130 classifies a plurality of terminal devices into a plurality of terminal device groups as follows.
The weight-considering variation characteristic classification unit 130 generates a plurality of combinations of terminal devices.
The weight-considering variation characteristic classification unit 130 calculates an evaluation value correlation value that represents the degree of correlation of the weighted evaluation values for each generated combination.
The weight-considering variation characteristic classifying unit 130 classifies the plurality of terminal devices into a plurality of terminal device groups based on the calculated evaluation value correlation values.

The weight-considering variation characteristic classification unit 130 generates terminal device classification data 196.
The terminal device classification data 196 is data indicating terminal devices belonging to the terminal device group for each terminal device group.

The network fluctuation extraction unit 140 (an example of a network evaluation value selection unit) selects a network evaluation value (a network fluctuation evaluation value described later) as follows (network evaluation value selection process).
The network fluctuation extraction unit 140 acquires the weighted evaluation value of each terminal device belonging to the terminal device group from the weighted evaluation value data 195 for each terminal device group based on the classification result by the weight-considered variation characteristic classification unit 130.
The network fluctuation extraction unit 140 calculates the distribution of the weighted evaluation values of the terminal device groups for each measurement time based on the obtained weighted evaluation values of the terminal devices.
The network fluctuation extraction unit 140 selects a weighted evaluation value in the distribution as a network evaluation value of the terminal device group for each measurement time based on the calculated distribution of weighted evaluation values.

For example, the network fluctuation extraction unit 140 selects a network evaluation value as follows.
The network fluctuation extraction unit 140 acquires a weighted evaluation value at each measurement time from the weighted evaluation value data 195 for each terminal device.
The network fluctuation extracting unit 140 extracts, as an evaluation value series, one or more weighted evaluation values corresponding to a target period of a predetermined length including the measurement time for each measurement time, based on the acquired weighted evaluation value of each measurement time. To do.
The network fluctuation extraction unit 140 calculates a function representing the distribution of weighted evaluation values as a probability density function at the measurement time based on the extracted evaluation value series (probability density function calculation processing).
The network fluctuation extraction unit 140 calculates a probability density function (superposition function described later) of the terminal device group based on the probability density function of each terminal device.
The network fluctuation extraction unit 140 selects a weighted evaluation value in the distribution represented by the calculated probability density function of the terminal device group as a network evaluation value.
For example, the network fluctuation extraction unit 140 selects the weighted evaluation value with the largest distribution amount as the network evaluation value.

The device storage unit 190 stores network fluctuation evaluation value data 197o and failure content data 199.
The network fluctuation evaluation value data 197o (an example of network evaluation value data) is data that indicates a plurality of past times indicating past measurement times and network evaluation values at each past time in association with each terminal device group. For example, the network fluctuation evaluation value data 197o is data generated in the past by the network fluctuation extracting unit 140.
The failure content data 199 (an example of network failure data) is data in which a failure content indicating a failure occurring in the network is associated with a failure time indicating a time when the failure occurred.

The network failure evaluation unit 150 (an example of a correlation time zone determination unit and a detection result output unit) determines a correlation time zone (a past correlation period to be described later) as follows (correlation time zone determination processing).
The network failure evaluation unit 150 selects the network evaluation value at each measurement time selected for each terminal device group by the network fluctuation extraction unit 140 and the network evaluation value at each past time indicated for each terminal device group in the network fluctuation evaluation value data 197o. Based on the above, a past time zone in which the degree of correlation between the network evaluation value at each measurement time and the network evaluation value is high is determined for each terminal device group as a correlation time zone.

The network failure evaluation unit 150 generates network failure evaluation result data 181 (an example of network failure detection data) as follows (network failure detection data generation processing).
The network failure evaluation unit 150 searches the failure content data 199 for a failure time corresponding to the correlation time zone for each terminal device group based on the correlation time zone determined for each terminal device group.
The network failure evaluation unit 150 acquires the failure content corresponding to the failure time from the failure content data 199.
The network failure evaluation unit 150 generates network failure evaluation result data 181 by associating the acquired failure content with group information (for example, a group number described later) representing the terminal device group.

  The failure notification unit 160 (an example of the detection result output unit) outputs the network failure evaluation result data 181 generated by the network failure evaluation unit 150 (network failure detection data output process).

FIG. 3 is a flowchart showing an in-network fault extracting method of the in-network fault extracting apparatus 100 according to the first embodiment.
The network fault extraction method of the network fault extraction apparatus 100 according to the first embodiment will be described with reference to FIG.

  First, an outline of the network fault extraction method will be described.

The response time variation quantitative evaluation unit 110 generates PING response time quantitative evaluation value data 193 based on the PING response time data 191 of each terminal device (S110).
The operating load weight function calculation unit 120 generates weighting evaluation value data 195 of the PING response time based on the terminal operating value data 192 and the quantitative evaluation value data 193 of each terminal device (S120).
The weight-considering variation characteristic classifying unit 130 classifies each terminal device for each group based on the weighted evaluation value data 195 of each terminal device, and generates terminal device classification data 196 (S130).
Based on the terminal device classification data 196 and the weighted evaluation value data 195, the network variation extraction unit 140 calculates new network variation evaluation value data 197n related to the network failure for each terminal device group (S140).
The network failure evaluation unit 150 generates network failure evaluation result data 181 based on the new network variation evaluation value data 197n, the past network variation evaluation value data 197o, and the past failure content data 199 (S150).
The failure notification unit 160 outputs network failure evaluation result data 181 (S160).

  Next, details of the network fault extraction method will be described.

  In S <b> 110, the response time variation quantitative evaluation unit 110 acquires the PING response time data 191 from the device storage unit 190.

FIG. 4 is a table showing an example of the PING response time data 191 in the first embodiment.
FIG. 5 is a graph showing an example of the PING response time data 191 in the first embodiment.
PING response time data 191 in the first embodiment will be described with reference to FIG. 4 and FIG.

As illustrated in FIG. 4, the PING response time data 191 is data in which “date and time”, “terminal name”, and “PING response time” are associated with each other, for example.
“Date and time” indicates the time (measurement time) at which the PING response time was measured.
“Terminal name” indicates a name (an example of a terminal device identifier) for identifying a terminal device.
“PING response time” indicates the PING response time.

  FIG. 5 shows a graph in which “date and time” of the PING response time data 191 is expressed as a value on the horizontal axis and “PING response time” is expressed as a value on the vertical axis.

  Returning to FIG. 3, the description of S110 will be continued.

  The response time variation quantitative evaluation unit 110 generates a time series waveform matrix for each terminal device based on the PING response time data 191, performs principal component analysis on the generated time series waveform matrix, and Mahalanobis distance corresponding to each PING response time Is calculated as a quantitative evaluation value of the PING response time.

The response time variation quantitative evaluation unit 110 generates a time-series waveform matrix for each terminal device based on the PING response time data 191 as follows.
The response time fluctuation quantitative evaluation unit 110 responds to one or more PING response times corresponding to a predetermined measurement period including the measurement time for each measurement time (date and time) of each PING response time from the PING response time data 191. Extract as a time series.
The response time variation quantitative evaluation unit 110 generates a time series waveform matrix by arranging the extracted response time series at each measurement time as a matrix row.

For example, based on the PING response time data 191 shown in FIG. 4, the response time variation quantitative evaluation unit 110 performs the PING response time “124, 130, 115, 127 for one week from 0:00 on January 1, 2010. ,... Are extracted from the PING response time data 191 as a response time sequence of 0:00 on January 1, 2010.
Then, the response time variation quantitative evaluation unit 110 sets the extracted response time series “124, 130, 115, 127,...” In the first row of the time series waveform matrix.
Further, the response time fluctuation quantitative evaluation unit 110 sets the PING response time “130, 115, 127,...” For one week from 1:30 on January 1, 2010 to 0:00 on January 1, 2010. Are extracted from the PING response time data 191 and the extracted response time sequence “130, 115, 127,...” Is set in the second row of the time series waveform matrix.
Similarly, the response time variation quantitative evaluation unit 110 extracts the response time series of the remaining measurement times from the PING response time data 191 and sets the extracted response time series of each measurement time in each row of the time series waveform matrix.

However, the response time variation quantitative evaluation unit 110 may thin out the response time series without extracting the response time series at every measurement time. For example, after setting a response time series on January 1, 2010 at 0:00 on the first row of the time series waveform matrix, the response time series on January 2, 2010 at 0:00 is converted into the time series waveform matrix. It may be set in the second row.
In addition, the measurement period corresponding to the response time series may be a period longer than one week (or a shorter period). For example, the PING response time for two days may be a response time series, and the PING response time for one month may be a response time series.

  Principal component analysis is statistical processing for obtaining an index value representing the characteristics of a plurality of data (in the embodiment, PING response time).

FIG. 6 is a schematic diagram illustrating principal component analysis of the response time variation quantitative evaluation unit 110 in the first embodiment.
An outline of principal component analysis performed by the response time variation quantitative evaluation unit 110 will be described with reference to FIG.

The “data space” is a space (graph) in which the distribution of data (PING response time) is expressed using a specific data axis. For example, when the time series waveform matrix is a matrix of X rows and Y columns, the time series waveform matrix is handled as Y points projected (plotted) in the X-dimensional data space.
When principal component analysis is performed on this data space (time series waveform matrix), the same number of principal component axes that strongly reflect the characteristics of the data are calculated as the number of data axes in the data space. The space represented by these principal component axes is called “principal component space”.
Furthermore, a space represented by a higher-order principal component axis (first principal component axis, second principal component axis) selected from the principal component space is referred to as a “feature space (or feature plane)”.

FIG. 7 is a diagram illustrating a quantitative evaluation value (Mahalanobis distance) of the PING response time in the first embodiment.
As shown in FIG. 7, the Mahalanobis distance (arrow line in the figure) represents the distance from the center (center of gravity) of the data distribution (triangle mark in the figure) to each point included in the data distribution.
However, the Mahalanobis distance is obtained by projecting each point included in the data distribution onto the feature plane (or feature space), that is, by drawing a perpendicular line from each point to the principal component axis of the feature plane. Calculated using coordinate values.
Further, the Mahalanobis distance is expressed as a distance shorter than the actual distance in the direction where the variance of the data distribution is large, and is expressed as a distance longer than the actual distance in the direction where the variance of the data distribution is small. For example, in the figure, at points A and B having the same distance from the center of the data distribution, the value of the Mahalanobis distance is larger at the point A located in the direction in which the distribution of the data distribution is smaller.
A point having a large Mahalanobis distance (for example, points A and B located outside a predetermined boundary line) is a point deviating from the normal data distribution, that is, a point having different characteristics from other points.

  The response time variation quantitative evaluation unit 110 generates quantitative evaluation value data 193 using the Mahalanobis distance corresponding to each PING response time as a quantitative evaluation value of the PING response time.

FIG. 8 is a table showing an example of the quantitative evaluation value data 193 in the first embodiment.
FIG. 9 is a graph showing an example of the quantitative evaluation value data 193 in the first embodiment.
The quantitative evaluation value data 193 according to the first embodiment will be described with reference to FIGS. 8 and 9.

As illustrated in FIG. 8, the quantitative evaluation value data 193 is, for example, data in which “date and time”, “terminal name”, and “quantitative evaluation value” are associated with each other.
“Date and time” indicates the measurement time of the PING response time.
“Terminal name” indicates a name for identifying a terminal device.
“Quantitative evaluation value” indicates a quantitative evaluation value of the PING response time.

  FIG. 9 shows a graph in which “date and time” of the quantitative evaluation value data 193 is represented as a value on the horizontal axis and “quantitative evaluation value” is represented as a value on the vertical axis.

  Returning to FIG. 3, the description of S110 will be continued.

However, the response time variation quantitative evaluation unit 110 may calculate the quantitative evaluation value of the PING response time by a process other than the principal component analysis.
Further, the response time variation quantitative evaluation unit 110 may calculate a value other than the Mahalanobis distance as a quantitative evaluation value of the PING response time.
For example, the response time variation quantitative evaluation unit 110 may calculate a value representing the PING response time in a predetermined unit time as the quantitative evaluation value of the PING response time.
It progresses to S120 after S110.

  In S <b> 120, the operating load weight function calculation unit 120 acquires the terminal operating value data 192 from the device storage unit 190.

FIG. 10 is a table showing an example of the terminal operating value data 192 in the first embodiment.
FIG. 11 is a graph showing an example of the terminal operating value data 192 in the first embodiment.
The terminal operation value data 192 in the first embodiment will be described based on FIG. 10 and FIG.

As illustrated in FIG. 10, the terminal operating value data 192 is data in which “date and time”, “terminal name”, and “CPU occupancy” are associated with each other, for example.
“Date and time” indicates the time (measurement time) when the CPU occupancy was measured.
“Terminal name” indicates a name for identifying a terminal device.
“CPU occupancy rate” indicates the CPU usage rate used in network-related processing (for example, communication processing) in the CPU usage rate. The CPU usage rate is the percentage of time spent using the CPU.

  FIG. 11 shows a graph in which “date and time” of the terminal operating value data 192 is represented as a value on the horizontal axis and “CPU occupancy” is represented as a value on the vertical axis.

  However, the CPU occupancy rate is an example of the resource usage amount, and the resource usage amount other than the CPU occupancy rate, such as the CPU usage rate of the terminal device, the memory occupancy rate of processing related to the network, and the memory usage rate of the terminal device, is the terminal operating value data. It may be set to 192.

  Returning to FIG. 3, the description of S120 will be continued.

The operating load weight function calculating unit 120 calculates the following operating load weight function based on the terminal operating value data 192 to calculate the operating load weight function value, and sets the calculated operating load weight function value to operate. Load weight function value data 194 is generated.
The operating load weight function value data 194 is data indicating the operating load weight function value at the measurement time of each CPU occupancy for each terminal device. For example, the operating load weight function value data 194 is generated in association with “date and time (measurement time)”, “terminal name”, and “operating load weight function value”.
The working load weighting function value is a weighting value for weighting the quantitative evaluation value of the PING response time, and the smaller the CPU occupancy is, the smaller the CPU occupancy is.
The following operational load weighting functions (weighting functions) are defined in advance.

For example, the operating load weight function outputs “0” as an operating load weight function value in a time zone in which the CPU occupancy is 5% or more, and an operating load weight function value in a time zone in which the CPU occupancy is less than 5%. “1” is output. In addition, the CPU occupancy rate is measured every minute, the operation load weight function value is set to “0” when the CPU occupancy rate is 5% or more continuously for 20 minutes or more, and the operation load weight in other cases. The function value may be “1”.
A function that outputs “0” or “1” in this way is called a “0-1 function”.

FIG. 12 is a graph showing the operational load weight function value data 194 in the first embodiment.
When “0-1 function” is used as the operating load weight function, the graph of the operating load weight function value data 194 is expressed as shown in FIG. The horizontal axis of the graph indicates “date and time (CPU occupancy measurement time)”, and the vertical axis of the graph indicates “work load weight function value”.

Moreover, you may define the working load weight function f (t; x) as shown in the following formula | equation (1).
W (t) used in the equation (1) is “t = 0” and a value is “1”, and a value is changed from “1” to “0” at a specific ratio centering on “t = 0”. It is a “window function” that decreases. However, the value of the section “−0.9Δ ≦ t ≦ 0.9Δ” is “1”. “Δ” is a predetermined consideration time to be considered as a condition of the CPU occupation ratio.
The window function is a function that outputs “0” when a predetermined condition is not satisfied.

  Returning to FIG. 3, the description of S120 will be continued.

For each quantitative evaluation value set in the quantitative evaluation value data 193, the operational load weight function calculation unit 120 obtains an operational load weight function value corresponding to the measurement time (date) of the quantitative evaluation value from the operational load weight function value data 194. get. For example, when the measurement time of the quantitative evaluation value is “January 1, 2010 00:00”, the operating load weight function calculation unit 120 sets “January 1, 2010 00:00” or “2010 1 The operation load weight function value at the measurement time (date and time) closest to “Monday 1:00:00” is acquired.
The working load weight function calculation unit 120 divides the quantitative evaluation value by the working load weight function value. Hereinafter, a value obtained by dividing the quantitative evaluation value by the operating load weight function value is referred to as a “weighted evaluation value”. However, when the working load weight function value is “0”, the weight evaluation value is “no value” or “0”.
Thereby, the quantitative evaluation value of the PING response time in consideration of the CPU occupancy can be calculated as the weighted evaluation value. That is, when the PING response time becomes long because the CPU occupation ratio is high, a value obtained by reducing the quantitative evaluation value of the PING response time is calculated as the weighted evaluation value.
The “weighting evaluation value” is larger as the quantitative evaluation value is larger and is smaller as the working load weight function value is larger.

The operating load weight function calculation unit 120 sets the calculated weighted evaluation value and generates weighted evaluation value data 195.
The weighted evaluation value data 195 is data indicating the weighted evaluation value of the measurement time of each PING response time for each terminal device. For example, the weighted evaluation value data 195 is generated in association with “date and time (measurement time)”, “terminal name”, and “weighted evaluation value”.

FIG. 13 is a graph showing the weighted evaluation value data 195 in the first embodiment.
The horizontal axis of the graph shown in FIG. 13 represents “date and time (measurement time of PING response time)”, and the vertical axis of the graph represents “weighted evaluation value”.
In addition, the weighted evaluation value in the time zone in which the working load weight function value is “0” is represented as “missing value (no value)”.

  Returning to FIG. 3, the description of the fault extraction method in the network will be continued.

  It progresses to S130 after S120.

In S <b> 130, the weight-considering variation characteristic classification unit 130 generates a plurality of combinations of terminal devices including two terminal devices by combining a plurality of terminal devices indicated in the PING response time data 191 and the terminal operating value data 192.
The weight consideration variation characteristic classifying unit 130 calculates an evaluation value correlation function using the weighted evaluation value data 195 for each combination of terminal devices, and calculates an evaluation value correlation value for each combination of terminal devices.

The evaluation value correlation function is a cross-correlation function that outputs an evaluation value correlation value.
The evaluation value correlation value is a value representing the degree of correlation of the weighted evaluation value. The evaluation value correlation value increases as the correlation degree of the weighted evaluation value increases, and decreases as the correlation degree of the weighted evaluation value decreases.

For example, the weight-considering variation characteristic classifying unit 130 calculates the evaluation value correlation function f (x, y; k) shown in the following equation (2), and evaluates the evaluation value correlation between the weighted evaluation values of the terminal device x and the terminal device y The value Cor (x, y; k) is calculated.
The evaluation value correlation value Cor (x, y; k) is a value of “0 or more and 1 or less”. When the correlation degree of the weighted evaluation value is high, the evaluation value correlation value Cor (x, y; k) is a value close to “1”, and when the correlation degree of the weighted evaluation value is low, the evaluation value correlation value Cor (x, y y; k) is a value close to “0”.

The weight-considering variation characteristic classification unit 130 compares the evaluation value correlation value (a value between 0 and 1) for each combination of terminal devices with a predetermined evaluation value correlation threshold (for example, 0.8), and the evaluation value correlation value is A combination of terminal devices larger than the evaluation value correlation threshold is determined.
Hereinafter, a combination of terminal devices whose evaluation value correlation value is larger than the evaluation value correlation threshold is referred to as “correlation combination”.

The weight-considering variation characteristic classification unit 130 generates a terminal device group based on each correlation combination, and generates terminal device classification data 196 representing the generated terminal device group.
The terminal device group is a combination of terminal devices including a plurality of terminal devices (or one terminal device) having a high degree of correlation of weighted evaluation values.

However, you may define and use evaluation value correlation functions other than said Formula (2).
For example, an evaluation value correlation function that outputs an evaluation value correlation value may be defined not for two terminal devices but for three or more terminal devices.

FIG. 14 is a diagram showing terminal device groups in the graph of the weighted evaluation value data 195 in the first embodiment.
FIG. 15 is a table showing terminal device classification data 196 in the first embodiment.

As indicated by a solid circle in FIG. 14, terminal A and terminal C have a high degree of correlation between weighted evaluation values. Terminal C and terminal F have a high degree of correlation between the weighted evaluation values. Furthermore, terminal F and terminal H have a high degree of correlation between weighted evaluation values.
Therefore, the terminal A, the terminal C, the terminal F, and the terminal H constitute one terminal device group (1).
Similarly, the terminal B, the terminal E, and the terminal G constitute a terminal device group (2), and the terminal D and the terminal I constitute a terminal device group (3).

  FIG. 15 shows terminal device classification data 196 representing each terminal device group (1)-(3) shown in FIG.

As illustrated in FIG. 15, the terminal device classification data 196 is data in which “date and time”, “group number”, and “terminal name” are associated with each other.
“Date and time” indicates the date and time when the terminal device group is classified.
“Group number” indicates a number (an example of a group identifier) for identifying a terminal device group. For example, the group number is a value calculated using a predetermined hash function with the terminal name (or other terminal device identifier) of each terminal device constituting the terminal device group as an input.
“Terminal name” indicates the name of the terminal device belonging to the terminal device group.

  Returning to FIG. 3, the description of the fault extraction method in the network will be continued.

  It progresses to S140 after S130.

In S140, the network fluctuation extracting unit 140 acquires the weighted evaluation value at each measurement time from the weighted evaluation value data 195 for each terminal device.
The network fluctuation extracting unit 140 extracts, as an evaluation value series, one or more weighted evaluation values corresponding to a target period of a predetermined length including the measurement time for each measurement time, based on the acquired weighted evaluation value of each measurement time. To do.
The network fluctuation extraction unit 140 calculates a function representing the distribution of weighted evaluation values as a probability density function at the measurement time based on the extracted evaluation value series.
The network fluctuation extraction unit 140 calculates a probability density function of the terminal device group based on the probability density function of each terminal device.
The network fluctuation extraction unit 140 selects, as the network fluctuation evaluation value, a weighted evaluation value having the largest distribution amount based on the calculated probability density function of the terminal device group. However, the network fluctuation extraction unit 140 may select an evaluation value other than the weighted evaluation value having the largest average value of distribution amounts as the network fluctuation evaluation value. For example, the network fluctuation extraction unit 140 may select the average value of the weighted evaluation values in the distribution represented by the probability density function as the network fluctuation evaluation value.

  The network fluctuation extraction unit 140 generates network fluctuation evaluation value data 197n indicating the network fluctuation evaluation value at each measurement time for each terminal device group.

FIG. 16 is a schematic diagram showing a method for generating network fluctuation evaluation value data 197n in the first embodiment.
An outline of a method for generating the network fluctuation evaluation value data 197n will be described with reference to FIG.

For example, the network fluctuation extraction unit 140 calculates the network fluctuation evaluation value of the terminal device group (2) at time “t” as follows.
The network fluctuation extraction unit 140 calculates a target period (a dotted frame shown in the drawing) having a predetermined length with the time “t” as the center time.
The network fluctuation extraction unit 140 obtains a plurality of weighted evaluation values (weighted evaluation values within a dotted frame) corresponding to the target period from the weighted evaluation value data 195 of each terminal device (B, E, G) belonging to the terminal device group (2). ) As an evaluation value series at time “t”.
The network fluctuation extraction unit 140 calculates a probability density function (also referred to as a kernel function) at time “t” by a kernel density estimation method using the evaluation value series at time “t” for each terminal device (B, E, G). To do.

The kernel density estimation method is a statistical process for estimating a probability density function.
The probability density function is a function representing the kernel density of a random variable (in the embodiment, a weighted evaluation value).
The kernel density is a value representing the distribution amount of random variables.
In the figure, the probability density function represents the weighted evaluation value on the horizontal axis and the kernel density on the vertical axis.

The network fluctuation extraction unit 140 calculates a probability density function representing the average of the distribution of weighted evaluation values based on the probability density function of each terminal device (B, E, G). Hereinafter, the probability density function representing the average of the distributions of the respective weighted evaluation values is referred to as “superposition function”.
The network fluctuation extraction unit 140 selects, as the network fluctuation evaluation value, the weighting evaluation value x having the highest kernel density in the distribution of the weighting evaluation values represented by the overlay function. However, the network fluctuation extraction unit 140 may select a weighting evaluation value other than the weighting evaluation value x having the highest kernel density as the network fluctuation evaluation value. For example, the network fluctuation extraction unit 140 may select an average value of kernel densities in the distribution as the network fluctuation evaluation value.
The network fluctuation extraction unit 140 sets the selected network fluctuation evaluation value x in the network fluctuation evaluation value data 197n as the network fluctuation evaluation value of the terminal device group (2) at time “t”.
In the figure, the network fluctuation evaluation value data 197n represents the date and time (measurement time) on the horizontal axis and the network fluctuation evaluation value on the vertical axis.

FIG. 17 is a table showing an example of the network fluctuation evaluation value data 197n in the first embodiment.
FIG. 18 is a graph showing an example of the network fluctuation evaluation value data 197n in the first embodiment.

As shown in FIG. 17, the network fluctuation evaluation value data 197n is data in which “date and time”, “group number”, and “network fluctuation evaluation value” are associated with each other, for example.
“Date and time” indicates the measurement time of the PING response time.
“Group number” indicates a number for identifying a terminal device group.
“Network fluctuation evaluation value” indicates a network fluctuation evaluation value.

  FIG. 18 shows a graph in which “date and time” of the network fluctuation evaluation value data 197n is represented as a value on the horizontal axis and “network fluctuation evaluation value” is represented as a value on the vertical axis.

  The past network fluctuation evaluation value data 197o stored in advance in the device storage unit 190 has the same data structure as the new network fluctuation evaluation value data 197n.

  Returning to FIG. 3, the description of the fault extraction method in the network will be continued.

  After S140, the process proceeds to S150.

In S150, the network failure evaluation unit 150 acquires the network variation evaluation value data 197n generated in S140 and the network variation evaluation value data 197o indicating the past network variation evaluation value from the device storage unit 190.
Hereinafter, the plurality of network fluctuation evaluation values indicated in the new network fluctuation evaluation value data 197n are referred to as “new network fluctuation series”, and the plurality of network fluctuation evaluation values indicated in the past network fluctuation evaluation value data 197o are referred to as “past network fluctuation evaluation values”. The network fluctuation series.

The network failure evaluation unit 150 is a time zone including the past time for each past time (past measurement time) from the past network fluctuation sequence, and a time zone having the same time length as the time zone of the new network fluctuation sequence A plurality of network fluctuation evaluation values corresponding to are extracted.
Hereinafter, the plurality of extracted network fluctuation evaluation values are referred to as “network fluctuation subsequences” of the past time.

  The network failure evaluation unit 150 calculates a network variation correlation function using a new network variation sequence and a network variation subsequence at the past time for each past time, and calculates a network variation correlation value for each past time.

The network fluctuation correlation function is a cross-correlation function that outputs a network fluctuation correlation value.
The network fluctuation correlation value is a value representing the degree of correlation between a new network fluctuation series and a network fluctuation partial series at a past time.

For example, the network failure evaluation unit 150 calculates a network fluctuation correlation function f (j) expressed by the following equation (3), and calculates a network fluctuation correlation value R (j) at the j-th past time.
The network fluctuation correlation value R (j) is a value “0 to 1”. When the degree of correlation with the new network fluctuation sequence is high, the network fluctuation correlation value R (j) is close to “1”, and when the degree of correlation with the new network fluctuation series is low, the network fluctuation correlation value R ( j) is a value close to “0”.

The network failure evaluation unit 150 compares the network fluctuation correlation value (a value between 0 and 1) for each past time with a predetermined network fluctuation threshold (for example, 0.8), and the network fluctuation correlation value is greater than the network fluctuation threshold. The past time is determined.
Hereinafter, the period (time zone) of the network fluctuation subsequence corresponding to the past time when the network fluctuation correlation value is larger than the network fluctuation threshold is referred to as “past correlation period”.

The network failure evaluation unit 150 sets the past correlation period and generates the past correlation period data 198.
The past correlation period data 198 is data indicating a past correlation period for each terminal device group. For example, the past correlation period data 198 is data in which “past correlation period” and “group number” are associated with each other.

FIG. 19 is a relationship diagram between past network fluctuation evaluation value data 197o and new network fluctuation evaluation value data 197n in the first embodiment.
In FIG. 19, the degree of correlation between the new network fluctuation series represented by the new network fluctuation evaluation value data 197n and the network fluctuation sub-series at the 200th (= j) th past time is high.
Here, the network fluctuation correlation value R (j) at the 100 (= j) th past time is “0.07”, and the network fluctuation correlation value R (j) at the 200 (= j) th past time is “ It is assumed that the network fluctuation correlation value R (j) at the 300th (= j) -th past time is “0.06”. The network fluctuation threshold is set to “0.8”.
In this case, since the network fluctuation correlation value “0.86” at the 200 (= j) th past time is greater than the network fluctuation threshold “0.8”, the network failure evaluation unit 150 determines that the 200 (= j) th past The time zone “T” of the network fluctuation subsequence corresponding to the time is selected as the past correlation period.

  Returning to FIG. 3, the description of S150 will be continued.

The network failure evaluation unit 150 acquires failure content data 199 from the device storage unit 190.
The failure content data 199 is data indicating the time when a network failure occurs and the content of the network failure that has occurred.

FIG. 20 is a table showing an example of the failure content data 199 in the first embodiment.
The failure content data 199 in the first embodiment will be described with reference to FIG.

For example, the failure content data 199 is data in which “date and time”, “group number”, and “failure content” are associated with each other.
“Date and time” indicates the time (failure time) when a network failure occurs.
“Group number” is a number for identifying a terminal device group. For example, the group number is a value calculated using a predetermined hash function with the terminal names (or other identifiers) of the terminal devices constituting the terminal device group as inputs.
“Failure content” indicates the content of the network failure that has occurred (failure content).

  Returning to FIG. 3, the description of S150 will be continued.

The network failure evaluation unit 150 searches the failure content data 199 for failure contents corresponding to the past correlation period for each terminal device group based on the past correlation period data 198.
The failure contents corresponding to the past correlation period are the failure time indicating the time included in the past correlation period (or the time included within the predetermined allowable time from the correlation time zone, and the same hereinafter), and the group number of the terminal device group The failure content associated with.
However, the network failure evaluation unit 150 may search the failure content associated with the failure time indicating the time included in the past correlation period as the failure content corresponding to the past correlation period regardless of the group number.

The network failure evaluation unit 150 sets the failure content corresponding to the past correlation period and generates network failure evaluation result data 181.
The network failure evaluation result data 181 is data indicating the failure content and group information representing the terminal device group for each terminal device group having the failure content corresponding to the past correlation period.
For example, the network failure evaluation result data 181 is data in which “measurement period (range of date and time of the PING response time data 191)”, “failure content”, and “group number (an example of group information)” are associated with each other. Further, the network failure evaluation result data 181 may include the terminal names (or other terminal identifiers) of the terminal devices that constitute the terminal device group instead of the group number or together with the group number.
After S150, the process proceeds to S160.

  In S160, the failure notification unit 160 acquires the network failure evaluation result data 181 from the device storage unit 190, and outputs the acquired network failure evaluation result data 181.

For example, the failure notification unit 160 displays the network failure evaluation result data 181 on the display device.
The user can estimate the sub-network in which the network failure has occurred by referring to the network failure evaluation result data 181 displayed on the display device.
As an example, the user specifies a terminal device group corresponding to the group number indicated in the network failure evaluation result data 181 and determines that a network failure has occurred in the subnetwork to which the specified terminal device group belongs.

Further, the failure notification unit 160 may transmit network failure evaluation result data 181 to a preventive maintenance system (not shown).
The preventive maintenance system is a device that suppresses the occurrence of a network failure or reduces the influence of the network failure by executing a predetermined preventive maintenance process.
For example, the preventive maintenance process communicates with a router in the network to update the routing table of the router, or communicates with a terminal device (or a server device such as a gateway server) in the network to Update control information (such as the upper limit of traffic). Thereby, multiplexing of communication paths and traffic control can be realized.
However, the network failure extraction apparatus 100 may be provided with the function of the preventive maintenance system as a preventive maintenance unit.

  By S160, the processing of the network fault extraction method ends.

In S150 of the network fault extraction method (see FIG. 3), the network fault evaluation unit 150 determines whether or not the new network fluctuation evaluation value data 197n indicates the occurrence of a network fault, and the new network fluctuation evaluation value. When the data 197n indicates the occurrence of a network failure, the process of S150 may be executed.
Further, the network failure evaluation unit 150 determines a failure occurrence period in which a network failure has occurred based on the new network change evaluation value data 197n, and extracts a plurality of network change evaluation values corresponding to the determined failure occurrence period. Then, the process of S150 may be executed for the extracted plurality of network fluctuation evaluation values.
For example, the network failure evaluation unit 150 compares the new network fluctuation evaluation value data 197n and the past network fluctuation evaluation value data 197o by statistical processing, and the new network fluctuation evaluation value data 197n indicates the occurrence of a network failure. It is determined whether there is a network failure or a failure occurrence period.
For example, the network failure evaluation unit 150 calculates the “3σ range (or 95% confidence interval)” of the past network fluctuation evaluation value based on the past network fluctuation evaluation value data 197o, and calculates the calculated “3σ range (or 95). If the new network fluctuation evaluation value data 197n includes a network fluctuation evaluation value deviating from “% confidence interval)”, it is determined that the new network fluctuation evaluation value data 197n indicates the occurrence of a network failure. The “3σ range” is a range in which the difference from the average value is not more than three times the standard deviation.
Further, the network failure evaluation unit 150 searches the new network fluctuation evaluation value data 197n for a network fluctuation evaluation value that is out of the “3σ range (or 95% confidence interval)” of the past network fluctuation evaluation value data 197o, and performs a search. The period corresponding to the network fluctuation evaluation value is determined as the failure occurrence period.

FIG. 21 is a diagram illustrating an example of hardware resources of the network fault extraction apparatus 100 according to the first embodiment.
In FIG. 21, the in-network fault extraction apparatus 100 includes a CPU 901 (Central Processing Unit). The CPU 901 is connected to the ROM 903, the RAM 904, the communication board 905, the display device 911, the keyboard 912, the mouse 913, the drive device 914, and the magnetic disk device 920 via the bus 902, and controls these hardware devices. The drive device 914 is a device that reads and writes a storage medium such as an FD (Flexible Disk Drive), a CD (Compact Disc), and a DVD (Digital Versatile Disc).

  The communication board 905 is wired or wirelessly connected to a communication network such as a LAN (Local Area Network), the Internet, or a telephone line.

  The magnetic disk device 920 stores an OS 921 (operating system), a program group 922, and a file group 923.

  The program group 922 includes programs that execute the functions described as “units” in the embodiments. The program is read and executed by the CPU 901. That is, the program causes the computer to function as “to part”, and causes the computer to execute the procedures and methods of “to part”.

  The file group 923 includes various data (input, output, determination result, calculation result, processing result, etc.) used in “˜part” described in the embodiment.

  In the embodiment, arrows included in the configuration diagrams and flowcharts mainly indicate input and output of data and signals.

  In the embodiment, what is described as “to part” may be “to circuit”, “to apparatus”, and “to device”, and “to step”, “to procedure”, and “to processing”. May be. That is, what is described as “to part” may be implemented by any of firmware, software, hardware, or a combination thereof.

Embodiment 2. FIG.
A mode of classifying a plurality of terminal devices by a method different from that in the first embodiment will be described.
Hereinafter, items different from the first embodiment will be mainly described. The matters whose explanation is omitted are the same as those in the first embodiment.

  The configuration of the network system 200 (see FIG. 1) and the functional configuration of the in-network fault extraction apparatus 100 (see FIG. 2) are the same as those in the first embodiment.

The processing flow (see FIG. 3) of the network fault extraction method is the same as that of the first embodiment.
However, the terminal device classification data generation process (S130) is different from the first embodiment.

Hereinafter, the terminal device classification data generation process (S130) will be described.
In S <b> 130, the weight-considering variation characteristic classification unit 130 generates new terminal device classification data 196 by the K-means method using the quantitative evaluation value data 193 generated this time and the terminal device classification data 196 generated last time. .
That is, the weight-considering variation characteristic classification unit 130 updates the current terminal device classification data 196 based on the quantitative evaluation value data 193 by the K-means method.

For example, the weight-considering variation characteristic classification unit 130 generates (updates) the terminal device classification data 196 as follows.
The weight-considering variation characteristic classification unit 130 acquires quantitative evaluation value data 193 and terminal device classification data 196 from the device storage unit 190.
The weight-considering variation characteristic classifying unit 130 extracts, from the quantitative evaluation value data 193, the quantitative evaluation value of each terminal device belonging to the terminal device group for each terminal device group indicated by the terminal device classification data 196.
The weight-considering variation characteristic classification unit 130 calculates an average value of quantitative evaluation values as a group evaluation value for each terminal device group.
The weight-considering variation characteristic classification unit 130 calculates the average value of the quantitative evaluation values as the terminal evaluation value for each terminal device.
The weight-considering variation characteristic classification unit 130 compares the terminal evaluation value with each group evaluation value for each terminal device, selects the group evaluation value closest to the terminal evaluation value, and the terminal device group corresponding to the selected group evaluation value As the appropriate group.
The weight-considering variation characteristic classifying unit 130 determines for each terminal device whether the terminal device group to which the terminal device belongs matches the corresponding group.
When the terminal device group does not match the corresponding group, the weight-considering variation characteristic classifying unit 130 updates the terminal device classification data 196 so that the terminal device belongs to the corresponding group.
The weight-considering variation characteristic classification unit 130 repeats the above process when the terminal device classification data 196 is updated.

  Other processes (see FIG. 3) of the network fault extraction method are the same as those in the first embodiment.

  DESCRIPTION OF SYMBOLS 100 In-network fault extraction apparatus, 110 Response time fluctuation quantitative evaluation part, 120 Working load weight function calculation part, 130 Weight consideration fluctuation characteristic classification part, 140 Network fluctuation extraction part, 150 Network fault evaluation part, 160 Fault notification part, 181 network Failure evaluation result data, 190 device storage unit, 191 PING response time data, 192 terminal operating value data, 193 quantitative evaluation value data, 194 operating load weight function value data, 195 weighted evaluation value data, 196 terminal device classification data, 197 network Fluctuation evaluation value data, 198 past correlation period data, 199 failure content data, 200 network system, 210 network, 211 subnetwork, 220 terminal device, 230 terminal information collection device, 901 CPU, 902 bus, 903 ROM, 904 RAM, 905Shin board, 911 display device, 912 keyboard, 913 mouse, 914 drive, 920 a magnetic disk device, 921 OS, 922 programs, 923 files.

Claims (12)

A plurality of responses measured at different measurement times as a time from when the response request data is transmitted to the plurality of terminal devices connected to the network and the response request data is transmitted until the response data is received. A response time storage unit that stores time and a plurality of measurement times obtained by measuring the plurality of response times in association with each terminal device;
A resource usage storage unit that stores a plurality of resource usages measured at different measurement times in each terminal device and a plurality of measurement times for measuring the plurality of resource usages in association with each terminal device;
A plurality of response times are acquired for each terminal device from the response time storage unit, and a value corresponding to the length of the response time is measured for each response time based on the acquired response times. A response time evaluation value calculation unit for calculating as a time evaluation value;
A response time evaluation value storage unit that stores, for each terminal device, a response time evaluation value at each measurement time calculated by the response time evaluation value calculation unit;
The response time evaluation value at each measurement time is acquired for each terminal device from the response time evaluation value storage unit, and the resource usage at each measurement time is acquired for each terminal device from the resource usage storage unit, and each measurement acquired Based on the response time evaluation value of the time and the resource usage at each measurement time, the larger the response time evaluation value for each measurement time, the larger the smaller the value of the measurement time. A weighted evaluation value calculating unit that calculates the weighted evaluation value;
A weighted evaluation value storage unit that stores a weighted evaluation value of each measurement time calculated by the weighted evaluation value calculation unit for each terminal device;
A terminal device classifying unit that classifies the plurality of terminal devices into a plurality of terminal device groups composed of one or more terminal devices based on the weighted evaluation value of each terminal device stored in the weighted evaluation value storage unit;
Based on the classification result by the terminal device classification unit, the weighted evaluation value of each terminal device belonging to the terminal device group is obtained for each terminal device group from the weighted evaluation value storage unit, and based on the obtained weighted evaluation value of each terminal device Calculating a distribution of weighted evaluation values of the terminal device group at each measurement time, and selecting a weighted evaluation value in the distribution as a network evaluation value of the terminal device group at each measurement time based on the calculated distribution of weighted evaluation values An evaluation value selection unit;
A network evaluation value storage unit that stores a plurality of past times indicating past measurement times and network evaluation values of each past time in association with each terminal device group;
A network failure data storage unit that stores network failure data in which a failure content indicating a failure that has occurred in the network is associated with a failure time that indicates a time at which the failure has occurred;
Based on the network evaluation value at each measurement time selected for each terminal device group by the network evaluation value selection unit and the network evaluation value at each past time stored for each terminal device group in the network evaluation value storage unit. A correlation time zone determination unit that determines, for each terminal device group, a past time zone in which the correlation between the network evaluation value of the measurement time and the network evaluation value is high, as a correlation time zone;
Based on the network failure data stored in the network failure data storage unit and the correlation time zone determined for each terminal device group by the correlation time zone determination unit, the failure time corresponding to the correlation time zone is determined for each terminal device group. A detection result output unit that searches from the network failure data, acquires failure content corresponding to the failure time from the network failure data, and outputs the acquired failure content in association with group information representing the terminal device group; A network failure detection apparatus comprising: The response time evaluation value calculation unit performs a principal component analysis on the obtained plurality of response times, and calculates a value obtained for each measurement time of each response time by the principal component analysis as a response time evaluation value of the measurement time. The network failure detection apparatus according to claim 1. The response time evaluation value calculation unit extracts, as a response time series, one or more response times corresponding to a predetermined measurement period including the measurement time for each measurement time of each response time, and the response time of each measurement time 3. The network failure detection apparatus according to claim 2, wherein a matrix in which series are arranged is generated as a time series waveform matrix, and principal component analysis is performed using the generated time series waveform matrix. The weighted evaluation value calculation unit calculates a value corresponding to the magnitude of the resource usage for each measurement time of each resource usage based on the resource usage at each measurement time as a weighting value of the measurement time, Based on the response time evaluation value of each measurement time and the weighted value of each measurement time, the larger the response time evaluation value for each measurement time, the larger the resource usage of the measurement time corresponding to the measurement time, the smaller the smaller the value. The network failure detection apparatus according to claim 1, wherein the network failure detection apparatus calculates the value as a value. The weighted evaluation value calculation unit calculates and calculates a weighted value of the measurement time for each measurement time of each resource usage using a 0-1 function that outputs 0 or 1 based on the resource usage at each measurement time. 5. The value obtained by subtracting the response time evaluation value of the measurement time corresponding to the measurement time of the weight value by the weight value based on the weighted value of the measured time is calculated as the weighted evaluation value of the measurement time. Network failure detection device. The weighted evaluation value calculation unit calculates a weighting value of the measurement time for each measurement time of each resource usage amount using a window function based on the resource usage amount of each measurement time, and based on the calculated weighting value of the measurement time 5. The network failure detection apparatus according to claim 4, wherein a value obtained by subtracting the response time evaluation value at the measurement time corresponding to the measurement time of the weight value by the weight value is calculated as the weight evaluation value at the measurement time. The terminal device classifying unit generates a plurality of combinations of terminal devices, calculates an evaluation value correlation value representing a degree of correlation of weighted evaluation values for each generated combination, and a plurality of terminals based on the calculated evaluation value correlation values 7. The network failure detection device according to claim 1, wherein the device is classified into a plurality of terminal device groups. The network failure detection device further includes:
A terminal device classification data storage unit for storing terminal device classification data indicating terminal devices belonging to the terminal device group for each terminal device group;
The terminal device classification unit classifies a plurality of terminal devices into a plurality of terminal device groups by updating the terminal device classification data by a K-means method using a weighted evaluation value of each terminal device. The network failure detection device according to any one of claims 1 to 6. The network evaluation value selection unit acquires a weighted evaluation value at each measurement time for each terminal device from the weighted evaluation value storage unit, and includes a measurement time for each measurement time based on the acquired weighted evaluation value at each measurement time. One or more weighted evaluation values corresponding to a target period of a predetermined length are extracted as an evaluation value series, and a function representing a distribution of weighted evaluation values is calculated as a probability density function of measurement time based on the extracted evaluation value series. Calculating a probability density function of the terminal device group based on the probability density function of each terminal device, and selecting a weighted evaluation value in a distribution represented by the calculated probability density function of the terminal device group as the network evaluation value. The network failure detection apparatus according to any one of claims 1 to 8. The network failure detection apparatus according to claim 9, wherein the network evaluation value selection unit selects a weighted evaluation value having the largest distribution amount as the network evaluation value. A plurality of responses measured at different measurement times as a time from when the response request data is transmitted to the plurality of terminal devices connected to the network and the response request data is transmitted until the response data is received. A response time storage unit that associates a time with a plurality of measurement times at which the plurality of response times are measured, and stores the same for each terminal device, a plurality of resource usages measured at different measurement times at each terminal device, and the plurality of times A resource usage storage unit that associates and stores a plurality of measurement times for measuring resource usage for each terminal device, a plurality of past times indicating past measurement times, and a network evaluation value of each past time A network evaluation value storage unit for storing each terminal device group, a failure content indicating a failure that has occurred in the network, and a time at which the failure has occurred In the network failure detection method of network failure detection system and a network fault data storing unit for storing a network failure data that associates harm time,
The response time evaluation value calculation unit acquires a plurality of response times for each terminal device from the response time storage unit, and sets the length of the response time for each measurement time of each response time based on the acquired plurality of response times. The corresponding value is calculated as the response time evaluation value of the measurement time,
The response time evaluation value storage unit stores the response time evaluation value at each measurement time calculated by the response time evaluation value calculation unit for each terminal device,
The weighted evaluation value calculation unit obtains a response time evaluation value at each measurement time for each terminal device from the response time evaluation value storage unit, and obtains a resource usage at each measurement time from the resource usage storage unit for each terminal device. The larger the response time evaluation value for each measurement time based on the obtained response time evaluation value at each measurement time and the resource usage at each measurement time, the larger the resource usage at the measurement time corresponding to the measurement time. Calculate the smaller value as the weighted evaluation value of the measurement time,
The weighted evaluation value storage unit stores the weighted evaluation value at each measurement time calculated by the weighted evaluation value calculation unit for each terminal device,
The terminal device classification unit classifies the plurality of terminal devices into a plurality of terminal device groups including one or more terminal devices based on the weighted evaluation value of each terminal device stored in the weighted evaluation value storage unit,
The network evaluation value selection unit acquires the weighted evaluation value of each terminal device belonging to the terminal device group for each terminal device group from the weighted evaluation value storage unit based on the classification result by the terminal device classification unit, and acquires each terminal Based on the weighted evaluation value of the device, the distribution of the weighted evaluation value of the terminal device group is calculated for each measurement time, and based on the calculated distribution of the weighted evaluation value, the weighted evaluation value in the distribution is used as the network evaluation value of the terminal device group Select every measurement time,
The correlation time zone determination unit includes a network evaluation value at each measurement time selected for each terminal device group by the network evaluation value selection unit, and a network at each past time stored for each terminal device group in the network evaluation value storage unit. Based on the evaluation value, the network evaluation value at each measurement time and the past time zone where the degree of correlation between the network evaluation value is high are determined for each terminal device group as a correlation time zone,
The detection result output unit includes a correlation time zone for each terminal device group based on the network failure data stored in the network failure data storage unit and the correlation time zone determined for each terminal device group by the correlation time zone determination unit. The failure time corresponding to the failure time is searched from the network failure data, the failure content corresponding to the failure time is acquired from the network failure data, and the acquired failure content is associated with the group information representing the terminal device group and output. A network failure detection method for a network failure detection apparatus. A plurality of responses measured at different measurement times as a time from when the response request data is transmitted to the plurality of terminal devices connected to the network and the response request data is transmitted until the response data is received. A response time storage unit that associates a time with a plurality of measurement times at which the plurality of response times are measured, and stores the same for each terminal device, a plurality of resource usages measured at different measurement times at each terminal device, and the plurality of times A resource usage storage unit that associates and stores a plurality of measurement times for measuring resource usage for each terminal device, a plurality of past times indicating past measurement times, and a network evaluation value of each past time A network evaluation value storage unit for storing each terminal device group, a failure content indicating a failure that has occurred in the network, and a time at which the failure has occurred In the network failure detection a program that causes a network failure detection system and a network fault data storing unit for storing a network failure data that associates harm time,
A plurality of response times are acquired for each terminal device from the response time storage unit, and a value corresponding to the length of the response time is measured for each response time based on the acquired response times. A response time evaluation value calculation unit for calculating as a time evaluation value;
A response time evaluation value storage unit that stores, for each terminal device, a response time evaluation value at each measurement time calculated by the response time evaluation value calculation unit;
The response time evaluation value at each measurement time is acquired for each terminal device from the response time evaluation value storage unit, and the resource usage at each measurement time is acquired for each terminal device from the resource usage storage unit, and each measurement acquired Based on the response time evaluation value of the time and the resource usage at each measurement time, the larger the response time evaluation value for each measurement time, the larger the smaller the value of the measurement time. A weighted evaluation value calculating unit that calculates the weighted evaluation value;
A weighted evaluation value storage unit that stores a weighted evaluation value of each measurement time calculated by the weighted evaluation value calculation unit for each terminal device;
A terminal device classifying unit that classifies the plurality of terminal devices into a plurality of terminal device groups composed of one or more terminal devices based on the weighted evaluation value of each terminal device stored in the weighted evaluation value storage unit;
Based on the classification result by the terminal device classification unit, the weighted evaluation value of each terminal device belonging to the terminal device group is obtained for each terminal device group from the weighted evaluation value storage unit, and based on the obtained weighted evaluation value of each terminal device Calculating a distribution of weighted evaluation values of the terminal device group at each measurement time, and selecting a weighted evaluation value in the distribution as a network evaluation value of the terminal device group at each measurement time based on the calculated distribution of weighted evaluation values An evaluation value selection unit;
Based on the network evaluation value at each measurement time selected for each terminal device group by the network evaluation value selection unit and the network evaluation value at each past time stored for each terminal device group in the network evaluation value storage unit. A correlation time zone determination unit that determines, for each terminal device group, a past time zone in which the correlation between the network evaluation value of the measurement time and the network evaluation value is high, as a correlation time zone;
Based on the network failure data stored in the network failure data storage unit and the correlation time zone determined for each terminal device group by the correlation time zone determination unit, the failure time corresponding to the correlation time zone is determined for each terminal device group. As a detection result output unit that searches from the network failure data, acquires the failure content corresponding to the failure time from the network failure data, and outputs the acquired failure content in association with the group information representing the terminal device group A network failure detection program for causing a network failure detection device to function.

Images