JP2018055294A - Program for detecting abnormal condition from event groups in time series, device and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a program which optimizes a threshold to determine whether it is in an abnormal state on the basis of a change of the state of an event from event groups in various time series, and a device and a method.SOLUTION: The program includes: Markov model learning means for learning a Markov model with a time when calculating a probability of transition from a state i to a state j corresponding to a maintaining time of the state i by using all event groups Ebased on teacher data; evaluation value distribution calculation means for calculating, as an evaluation value, an addition value or a multiplication value of the transition probability in a state transition for each of event groups Punder normal conditions and event groups Punder abnormal conditions in past time series based on the teacher data and calculating an evaluation value distribution R which counts occurrence frequencies for the evaluation values; and evaluation threshold calculation means for calculating an evaluation threshold under prescribed criteria between an evaluation value distribution Rof the normal event groups and an evaluation value distribution Rof the abnormal event groups. It is determined that the state is abnormal when the evaluation value distribution R of an event group E'in operation is concentrated on the evaluation threshold or a value less than the threshold.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a technique for detecting an abnormal state from a time-series event group accompanied by a state change.

  In an ICT (Information and Communication Technologies) network, a large number of various events may occur from one cause. For example, when a failure occurs in one communication device, a large number of unique events are generated from a large number of different communication devices such as servers and routers at the time of abnormality. The network administrator needs to quickly detect the communication device in which the failure has occurred and to shorten the abnormal state period as much as possible. In general, an abnormal state in the network is directly detected by an alert transmitted by the communication device itself.

  On the other hand, an alert is not always transmitted when an abnormal state occurs. The network as a whole tries to operate normally while allowing the behavior of the communication device in which the failure has occurred. Therefore, it is necessary to detect an abnormal state based on information other than the alert.

Conventionally, there is a technique for detecting an abnormal state using a time-series event group transmitted from a communication device.
For example, there are techniques using machine learning algorithms such as naive Bayes, support vector machines, and decision trees (see, for example, Patent Documents 1 to 3). According to this technique, an abnormal state is detected by a combination of events that have occurred.
There is also a technique that uses a time-series event group with a small number of occurrences using a timed Markov model (see, for example, Non-Patent Document 1). According to this technique, an abnormal state is detected by associating the occurrence order and occurrence time interval of events.

JP 2012-128583 A JP2013-191672A JP2013-13075A

Yoshiyoshi Kondo et al., “Proposal of Fault Detection Method Using Timed Markov Model”, IPSJ SIG Technical Report, Vol.2016-IOT-32 No.18, 2016/03, [online], [September 22, 2016 Search], Internet <URL: https: //ipsj.ixsq.nii.ac.jp/ej/index.php? Active_action = repository_view_main_item_detail & page_id = 13 & block_id = 8 & item_id = 157703 & item_no = 1>

According to the techniques described in Patent Literatures 1 to 3, since the order of occurrence of events and the time interval between occurrences are not taken into account, the propagation of an abnormal state to the entire network cannot be detected.
Further, according to the technique described in Non-Patent Document 1, since the determination is based only on the occurrence probability of the time series event, the probability of abnormality determination true / false has been low. In particular, there is a problem that a threshold value for determining whether or not an abnormal state is set is arbitrarily set, and a criterion for determining an abnormal state in a time series event is not optimized.

  In the first place, if a large number of various event groups can be separated in a normal state / abnormal state in real time, it may be easy to estimate a failure location that causes the event group. However, in general, since the relationship between events is extremely complicated and has no regularity, it is difficult to determine whether the normal state / abnormal state is separated.

  On the other hand, the inventors of the present application may detect different behaviors between the normal event group and the abnormal event group if the event represents a state change. I thought. In other words, if the determination threshold value with different behavior can be set optimally, can the probability of abnormality determination true / false be increased? I thought.

  Accordingly, the present invention provides a program, an apparatus, and a method capable of optimally setting a determination threshold value for determining whether or not an abnormal state has occurred based on a change in the state of an event from various time-series event groups. And

According to the present invention, there is provided a program for causing a computer mounted on a device for determining an abnormality to a time-series operational event group E ′ _M to function,
A Markov model learning means for learning a timed Markov model that calculates the transition probability from the state i to the state j according to the stay time of the state i using all the time series of events E _N based on the teacher data;
For each of the normal time event group P ⁰ and the abnormal time event group P ^{1 in the} past time series based on the teacher data, an addition value or a multiplication value of the transition probability in the state transition is calculated as an evaluation value, and the appearance of the evaluation value Evaluation value distribution calculating means for calculating an evaluation value distribution R counting the frequency;
Between the evaluation value distribution R ¹ evaluation value distribution R ⁰ abnormal event group normal event group causes the computer to function as an evaluation threshold calculating means for calculating an evaluation threshold of a predetermined condition,
The evaluation value distribution calculating means further calculates an evaluation value distribution R for the operational event group E ′ _M ,
When the evaluation value distribution of the operating event group E ′ _M is biased to be equal to or less than the evaluation threshold value, the computer is further caused to function as an abnormality determination means for determining an abnormality.

According to another embodiment of the program of the present invention,
The transition probability from state i to state j according to the stay time of state i is
g _ij × F _ij (T)
g _ij : Probability of transition between states from state i to state j F _ij (T _i ): Transition from state i to state j within a stay time T _i = t _j −t _i in state _i It is also preferred to have the computer function as expressed as a probability.

According to another embodiment of the program of the present invention,
Event group _{E N = {e 1, e} 2, ···, e N} each event e _n in the, e _n, including the generation time and generating post-state = (t _n, x _n)
t _n : occurrence time of e _n
x _n : state after occurrence of e _n , x _n ∈ Y
Y: All state sets that can be generated by event group E _N
Y = {y ₁ , y ₂ ,..., Y _s }
It is also preferable to make the computer function.

According to another embodiment of the program of the present invention,
Among the event group E _N , the event group P _{v, K obtained} by cutting out a predetermined number K of continuous time series by the sliding window method,
The past normal time event group P ⁰ is an event group determined to be normal among the event groups P _{v, K.}
The abnormal time event group P ^{1 in the} past time series is an event group determined to be abnormal in each event group P _{v, K.} P _{v, K} = {e _v , e _{v + 1} ,. , e _{v + K-1} }, v = (1,2, ..., N-K + 1)
P = {P1 _{, K} , P2 _{, K} ,..., _{PN-K + 1, K} }
P ⁰ = {P ⁰ | P ⁰ is a normal event group, P ⁰ ∈P}
P ¹ = {P ¹ | P ¹ is an abnormal event group, P ¹ ∈P}
It is also preferable to make the computer function.

According to another embodiment of the program of the present invention,
The evaluation threshold value calculation means includes a transition probability g _xixj between states from the i state to the j state, a minimum evaluation value R ⁰ _min of the normal event group evaluation value distribution R ⁰ , and an abnormal event group evaluation value distribution R the difference between the ^first maximum evaluation value R ¹ _max Te weighting coefficients alpha _XiXj maximize, preferably also causes a computer to function so as to calculate the evaluation threshold.

According to another embodiment of the program of the present invention,
The coefficient α _xixj is calculated by optimizing as a linear programming problem based on the following objective function and constraints: Objective function:
Maximization α _max = R ⁰ _min −R ¹ _max
Restrictions:
R (P ⁰ ) = {R (p ⁰ ) | p ⁰ ∈P ⁰ }: Set of evaluation values based on normal event groups R (P ¹ ) = {R (p ¹ ) | p ¹ ∈P ¹ }: Set of evaluation values based on abnormal event group R ⁰ _min = min (R (P ⁰ )): Minimum evaluation value based on normal event group R ¹ _max = min (R (P ¹ )): Normal event group Maximum evaluation value based on R ⁰ _min > R ¹ _max : Evaluation value based on normal event group is larger α _xixj > 0
It is also preferable to make the computer function.

According to another embodiment of the program of the present invention,
The evaluation threshold value calculation means calculates a median value of the minimum evaluation value R ⁰ _{min of the} evaluation value distribution based on the normal event group and the maximum evaluation value R ¹ _max of the evaluation value distribution based on the abnormal event group as the evaluation threshold value. It is also preferable to make the computer function.

According to another embodiment of the program of the present invention,
An event is a data packet transmitted from a communication device,
It is also preferable to cause the computer to function such that “with link + first speed”, “with link + second speed”, and “without link” at each port of the communication device.

According to the present invention, an apparatus for determining an abnormality with respect to a time-series operational event group E ′ _M ,
A Markov model learning means for learning a timed Markov model that calculates the transition probability from the state i to the state j according to the stay time of the state i using all the time series of events E _N based on the teacher data;
For each of the normal time event group P ⁰ and the abnormal time event group P ^{1 in the} past time series based on the teacher data, an addition value or a multiplication value of the transition probability in the state transition is calculated as an evaluation value, and the appearance of the evaluation value Evaluation value distribution calculating means for calculating an evaluation value distribution R counting the frequency;
Between the evaluation value distribution R ¹ evaluation value distribution R ⁰ abnormal event group normal event group, and having an evaluation threshold calculating means for calculating an evaluation threshold of a predetermined condition,
The evaluation value distribution calculating means further calculates an evaluation value distribution R for the operational event group E ′ _M ,
The system further includes an abnormality determination unit that determines that an abnormality occurs when the evaluation value distribution of the operating event group E ′ _M is biased to be equal to or less than the evaluation threshold value.

According to the present invention, there is provided an abnormality determination method for an apparatus for determining an abnormality with respect to a time-series operational event group E ′ _M ,
The device
As a learning stage,
Using all sets of events E _N time series based on the training data, and the eleventh step of learning Timed Markov model to calculate the probability of transition from state i corresponding to the residence time of the state i to state j,
For each of the normal time event group P ⁰ and the abnormal time event group P ^{1 in the} past time series based on the teacher data, an addition value or a multiplication value of the transition probability in the state transition is calculated as an evaluation value, and the appearance of the evaluation value A twelfth step of calculating an evaluation value distribution R counting the frequency;
Between the evaluation value distribution R ¹ evaluation value distribution R ⁰ abnormal event group normal event group to perform a thirteenth step of calculating an evaluation threshold of a predetermined condition,
As an operational stage,
A twenty-first step of calculating an evaluation value distribution R in which an added value or a multiplied value of transition probabilities in state transitions is calculated as an evaluation value for the operating event group E ′ _{M and the} appearance frequency with respect to the evaluation value is counted; ,
When the evaluation value distribution of the operation event group E ′ _M is biased to be equal to or less than the evaluation threshold value, a twenty-second step for determining an abnormality is further performed.

  According to the program, apparatus, and method of the present invention, a program, apparatus, and method that can optimally set a threshold for determining whether or not there is an abnormal state based on a change in the state of an event from various time-series event groups. The purpose is to provide.

It is a system block diagram which has the abnormality determination apparatus of this invention. It is a functional block diagram of the abnormality determination apparatus in this invention. It is explanatory drawing showing the state transition in Markov model with time. It is explanatory drawing showing the evaluation threshold value of the determination using the evaluation value distribution of a normal state, and the evaluation value distribution of an abnormal state. It is explanatory drawing showing determination of whether it is in an abnormal state from the event group at the time of operation.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a system configuration diagram having an abnormality determination device of the present invention.

According to FIG. 1, the abnormality determination device 1 is arranged in an operator network and detects an abnormal state in a large number of communication devices. Each communication device is not limited to an alarm for notifying an abnormality (for example, a link down or a signal synchronization error), and transmits an “event” indicating its own state. The abnormality determination device 1 detects an abnormal state by collecting these event groups. As a communication device arranged in the carrier network, for example, there is a route control device such as a router or a switch.
The provider network may be an access network such as LTE (Long Term Evolution) or WiMAX (Worldwide Interoperability for Microwave Access), or may be a core network such as IMS.

An “event” is a data packet that includes a state and is transmitted from a communication device.
For example, in the case of a switch, the “status” is “with link + first speed”, “with link + second speed”, “without link” at each port.
Also, each event e _n in an event group _{E N = {e 1, e} 2, ···, e N} includes occurrence time and after occurrence state.
e _n = (t _n , x _n )
e _n : nth event
t _n : occurrence time of e _n
x _n: the generation state after event e _n, information indicating the correlation with other events is not included at all, as compared to only each other event, but can not find its correlation.

  FIG. 2 is a functional configuration diagram of the abnormality determination device according to the present invention.

  According to FIG. 2, the abnormality determination device 1 of the present invention includes a teacher data storage unit 10, an all event group input unit 110, a learning event group input unit 120, and an operation event group input unit 210. The abnormality determination device includes a Markov model learning unit 11, evaluation value distribution calculation units 12 and 21, an evaluation threshold value calculation unit 13, and an abnormality determination unit 22. These functional components are realized by executing a program that causes a computer installed in the apparatus to function. Moreover, the flow of processing of these functional components can be understood as an abnormality determination method using the apparatus.

Further, the abnormality determination device 1 of the present invention is divided into <model learning stage>, <evaluation threshold learning stage>, and <operation stage>.
The abnormality determination device 1 includes an all event group input unit 110 and a Markov model learning unit 11 as a model learning stage.
In addition, the abnormality determination device 1 includes a learning event group input unit 120, an evaluation value distribution calculation unit 12, and an evaluation threshold calculation unit 13 as an evaluation threshold learning stage.
Furthermore, the abnormality determination device 1 includes an operation event group input unit 210, an evaluation value distribution calculation unit 21, and an abnormality determination unit 22 as an operation stage.

[Teacher data storage unit 10]
The teacher data storage unit 10 previously stores “normal event group” and “abnormal event group” collected in the past as teacher data. Here, a time-series event group is stored by distinguishing between normal time and abnormal time.
In the model learning stage, the teacher data storage unit 10 outputs all event groups.
In the evaluation threshold learning stage, the teacher data storage unit 10 outputs the normal event group and the abnormal event group separately.

<Model learning stage>
[All event group input unit 110]
The all event group input unit 110 inputs all event groups from the teacher data storage unit 10 and outputs them to the Markov model learning unit 11.

[Markov model learning unit 11]
Markov model learning unit 11 uses all events group E _N time series based on the teacher data "state i stay time with Markov model to calculate the transition probabilities of the time from the state i corresponding to the state j of" To learn.

The “Markov model” refers to a probabilistic model having the property that the future state is determined only by the current state and is not related to the past behavior.
The “timed Markov model” is a Markov model whose state transition probability depends on time, and the state transition in which the transition probability changes according to the staying time in the transition source state until transition from one state to the next state A model.

  FIG. 3 is an explanatory diagram showing state transitions in timed Markov model learning.

For example the state x _n events e _n occurs after the communication device, the all-state group Y which may be caused by an event group E _N, the following relationship.
x _n ∈ Y = {y ₁ , y ₂ ,..., y _s }
y: State of Markov model with time
x _n : State after occurrence of e _{n From} any two consecutive events e _h , e _{h + 1} (h = 1, 2,..., N−1) in E _N , one state transition x _h → x _{h + 1} is represented. At this time, the time was staying in source state is represented by t _{h + 1} -t h.
All state transitions are extracted from E _N and the following is calculated for y _i → y _j (i, j = 1, 2,..., S).
g _ij : Probability of transition between states y _i to state y _j f _yijj (T _i ): y _i → y _j State transition time T _i = t _j −t _i of state y _i Probability Density Representing Distribution State transitions in FIG. 3 are constructed by learning with all event groups of teacher data.

<Evaluation threshold learning stage>
[Learning event group input unit 120]
The learning event group input unit 120 inputs the normal event group and the abnormal event group separately from the teacher data storage unit 10, and outputs these event groups to the evaluation value distribution calculation unit 12.

[Evaluation Value Distribution Calculation Unit 12]
The evaluation value distribution calculating unit 12 calculates, as an evaluation value, an addition value or a multiplication value of transition probabilities in the state transition for each of the normal time event group and the abnormal time event group in the past time series based on the teacher data, An evaluation value distribution R obtained by counting the appearance frequency with respect to the evaluation value is calculated.

From the normal time / abnormal each respective event group E _N, a predetermined number of K a sliding window of time series continuous cuts out an event group P _{v, K.
Pv, K} = { _ev , _{ev + 1} , ..., _{ev + K-1} }, v = (1,2, ..., N-K + 1)
K: Length continuous from E _N (any integer)
A set of extracted event groups P _{v, K} is expressed as follows.
P = {P1 _{, K} , P2 _{, K} ,..., _{PN-K + 1, K} }

Then, it is divided into two sets of normal time / abnormal time.
The past time series normal event group P ⁰ is an event group determined to be normal among the event groups P _{v, K.}
P ⁰ = {P ⁰ | P ⁰ is a normal event group, P ⁰ ∈P}
The past time series abnormal event group P ¹ is an event group determined to be abnormal in each event group P _{v, K.}
P ¹ = {P ¹ | P ¹ is an abnormal event group, P ¹ ∈P}

An evaluation value is calculated from each element of P ⁰ and P ¹ to create an evaluation value distribution R (P _{v, K} ).
R (P _{v, K} ) = q (x _v ) Σ ^{v + K−2} _{i = v} (g _{xixi + 1} × F _{xixi + 1} (t _{i + 1} −t _i ))
F _yiyj (T _i ) = ∫ ₀ ^Ti f _yiyj (u) du
q (x _n ): probability that x _n is the initial state among all states
F _ij (T _i ): Probability of state transition within the stay time T _i = t _j −t _i at y _i for the transition from y _i to y _j “from state i to state according to stay time of state i The “transition probability to j” is expressed by the following equation.
g _ij × F _ij (T)

Then, the evaluation value distribution calculation unit 12 outputs the normal event group evaluation value distribution R ⁰ and the abnormal event group evaluation value distribution R ¹ to the evaluation threshold value calculation unit 13, respectively.

[Evaluation Threshold Calculation Unit 13]
Evaluation threshold calculating unit 13, with the evaluation value distribution R ¹ evaluation value distribution R ⁰ abnormal event group of normal events group, calculates the evaluation threshold of a predetermined condition.

  FIG. 4 is an explanatory diagram showing evaluation threshold values for determination using the evaluation value distribution in the normal state and the evaluation value distribution in the abnormal state.

According to Fig.4 (a), distribution of the appearance frequency with respect to an evaluation value is represented separately in a normal state and an abnormal state.
The evaluation value calculated from the normal event group is larger than the evaluation value calculated from the abnormal event group. In addition, the boundary between the evaluation value distribution of the normal event group and the evaluation value distribution of the abnormal event group is an index (evaluation threshold) for determining normality / abnormality.

(First Embodiment in Evaluation Threshold Optimization)
According to FIG.4 (b), distribution of the appearance frequency with respect to an evaluation value is represented separately with a normal state and an abnormal state.
Here, simply, the evaluation threshold value calculation unit 13 calculates the median value of the minimum evaluation value R ⁰ _{min of the} evaluation value distribution based on the normal event group and the maximum evaluation value R ¹ _max of the evaluation value distribution based on the abnormal event group, It is calculated as the evaluation threshold value _Rz .
z = (R ⁰ _min + R ¹ _max ) / 2

(Second Embodiment in Optimization of Evaluation Threshold)
According to FIG. _4C , different evaluation value distributions are represented for the normal state and the abnormal state weighted by the coefficient α _xixj .
An evaluation value distribution R ⁰ of the normal time of event groups, as evaluation value of abnormal event group and the distribution R ¹ is away, it is possible to determine exactly normal state / an abnormal state.
Therefore, the evaluation threshold value calculation unit 13 sets the transition probability g _xixj between the states from the i state to the j state, the minimum evaluation value R ⁰ _min of the evaluation value distribution R ⁰ of the normal event group, and the evaluation of the abnormal event group. An evaluation threshold value is calculated by weighting a coefficient α _xixj that maximizes the difference between the value distribution R ^{1 and} the maximum evaluation value R ¹ _max .

The coefficient α _xixj is weighted to the formula of the evaluation value distribution R (P _{v, K} ) described above.
R (P _{v, K} ) = q (x _v ) _{Σv +} ^K−2 _{i = v} (α _{xixi + 1} × g _{xixi + 1} × F _{xixi + 1} (t _{i + 1} −t _i ))
The coefficient α _yiyj is _assumed to be optimized and calculated as a linear programming problem based on the following objective function and constraint conditions.
Objective function:
Maximization α _max = R ⁰ _min −R ¹ _max
Restrictions:
R (P ⁰ ) = {R (p ⁰ ) | p ⁰ ∈P ⁰ }: Set of evaluation values based on normal event groups R (P ¹ ) = {R (p ¹ ) | p ¹ ∈P ¹ }: Set of evaluation values based on abnormal event group R ⁰ _min = min (R (P ⁰ )): Minimum evaluation value based on normal event group R ¹ _max = min (R (P ¹ )): Normal event group Maximum evaluation value based on R ⁰ _min > R ¹ _max : Evaluation value based on normal event group is larger α _xixj > 0

<Operation stage>
[Operation Event Group Input Unit 210]
The operation event group input unit 210 inputs a time-series operation event group E ′ _M and outputs it to the evaluation value distribution calculation unit 21.

[Evaluation Value Distribution Calculation Unit 21]
The evaluation value distribution calculation unit 21 calculates the evaluation value distribution R ′ for the operational event group E ′ _M as described above.
From the time-series operational event group E ′ _M = {e ′ ₁ , e ′ ₂ ,..., E ′ _M }, a predetermined number K of continuous time series are converted into the event group P ′ _v, Cut out _K.
P ′ _{w, K} = {e _w , e _{w + 1} ,..., E _{w + K−1} }, w = (1,2,..., M−K + 1)
A set of extracted event groups P _{v, K} is expressed as follows.
P ′ = {P ′ _{1, K} , P ′ _{2, K} ,..., P ′ _{M−K + 1, K} }
Then, an evaluation value R (P ′ _{w, K} ) is calculated for each element of P ′.

[Abnormality determination unit 22]
The abnormality determination unit 22 determines that there is an abnormality when the evaluation value distribution R ′ of the operational event group E ′ _M is biased below the evaluation threshold R _z .

  FIG. 5 is an explanatory diagram showing determination of whether or not there is an abnormal state from an event group during operation.

According to FIG. 5A, the center of the evaluation value distribution R ′ based on the event group at the time of operation is biased to be equal to or less than the evaluation threshold value R _z . In this case, the event group during operation is determined to be abnormal.
According to FIG. 5B, the center of the evaluation value distribution R ′ based on the event group during operation is biased to be higher than the evaluation threshold value R _z . In this case, the event group during operation is determined to be normal.

  In the embodiment described above, the event has been described as a packet transmitted from a communication device arranged in the operator network, but the present invention is not limited to this. That is, if it is an event group showing a state change, abnormality can be determined in various uses. For example, the present invention can be applied to various large-scale business systems such as power generation / transmission systems, distribution systems such as water supplies, and various production / manufacturing plants.

  As described above in detail, according to the program, apparatus, and method of the present invention, the determination threshold value for determining whether or not there is an abnormal state is optimally set based on a change in the state of an event from various time-series event groups. can do.

  Various changes, modifications, and omissions of the above-described various embodiments of the present invention can be easily made by those skilled in the art. The above description is merely an example, and is not intended to be restrictive. The invention is limited only as defined in the following claims and the equivalents thereto.

DESCRIPTION OF SYMBOLS 1 Abnormality determination apparatus 10 Teacher data storage part 110 All event group input part 11 Markov model learning part 120 Learning event group input part 12, 21 Evaluation value distribution calculation part 13 Evaluation threshold value calculation part 210 Operation event group input part 22 Abnormality determination part

Claims (10)

A program for causing a computer mounted in a device for judging an abnormality to a time series operation event group E ′ _M to function,
A Markov model learning means for learning a timed Markov model that calculates the transition probability from the state i to the state j according to the stay time of the state i using all the time series of events E _N based on the teacher data;
For each of the normal time event group P ⁰ and the abnormal time event group P ^{1 in the} past time series based on the teacher data, an addition value or a multiplication value of the transition probabilities in the state transition is calculated as an evaluation value. Evaluation value distribution calculating means for calculating an evaluation value distribution R counting the appearance frequency;
Between the evaluation value distribution R ¹ evaluation value distribution R ⁰ abnormal event group normal event group causes the computer to function as an evaluation threshold calculating means for calculating an evaluation threshold of a predetermined condition,
The evaluation value distribution calculating means further calculates an evaluation value distribution R for the operational event group E ′ _M ,
A program that further causes a computer to function as an abnormality determination unit that determines an abnormality when an evaluation value distribution of an operation event group E ′ _M is biased to be equal to or less than the evaluation threshold value. The transition probability from state i to state j according to the stay time of state i is
g _ij × F _ij (T)
g _ij : Probability of transition between states from state i to state j F _ij (T _i ): Transition from state i to state j within a stay time T _i = t _j −t _i in state _i The program according to claim 1, wherein the computer is caused to function as a probability. Event group _{E N = {e 1, e} 2, ···, e N} each event e _n in the, e _n, including the generation time and generating post-state = (t _n, x _n)
t _n : occurrence time of e _n
x _n : state after occurrence of e _n , x _n ∈ Y
Y: All state sets that can be generated by event group E _N
Y = {y ₁ , y ₂ ,..., Y _s }
The program according to claim 1 or 2, wherein the computer functions as described above. Among the event group E _N , the event group P _{v, K obtained} by cutting out a predetermined number K of continuous time series by the sliding window method,
The past normal time event group P ⁰ is an event group determined to be normal among the event groups P _{v, K.}
The abnormal time event group P ^{1 in the} past time series is an event group determined to be abnormal in each event group P _{v, K.} P _{v, K} = {e _v , e _{v + 1} ,. , e _{v + K-1} }, v = (1,2, ..., N-K + 1)
P = {P1 _{, K} , P2 _{, K} ,..., _{PN-K + 1, K} }
P ⁰ = {P ⁰ | P ⁰ is a normal event group, P ⁰ ∈P}
P ¹ = {P ¹ | P ¹ is an abnormal event group, P ¹ ∈P}
The program according to any one of claims 1 to 3, wherein the computer functions as described above. The evaluation threshold value calculation means includes a transition probability g _xixj between states from the i state to the j state, a minimum evaluation value R ⁰ _min of the normal event group evaluation value distribution R ⁰ , and an abnormal event group evaluation value distribution. the difference between the maximum evaluation value R ¹ _max of R ¹ Te weighting factor alpha _XiXj to maximize any one of claims 1 to 4, characterized in that causes a computer to function so as to calculate the evaluation threshold The program described in. The coefficient α _xixj is calculated by optimizing as a linear programming problem based on the following objective function and constraints: Objective function:
Maximization α _max = R ⁰ _min −R ¹ _max
Restrictions:
R (P ⁰ ) = {R (p ⁰ ) | p ⁰ ∈P ⁰ }: Set of evaluation values based on normal event groups R (P ¹ ) = {R (p ¹ ) | p ¹ ∈P ¹ }: Set of evaluation values based on abnormal event group R ⁰ _min = min (R (P ⁰ )): Minimum evaluation value based on normal event group R ¹ _max = min (R (P ¹ )): Normal event group Maximum evaluation value based on R ⁰ _min > R ¹ _max : Evaluation value based on normal event group is larger α _xixj > 0
The program according to claim 5, which causes the computer to function as described above. The evaluation threshold value calculation means calculates a median value between the minimum evaluation value R ⁰ _{min of the} evaluation value distribution based on the normal event group and the maximum evaluation value R ¹ _max of the evaluation value distribution based on the abnormal event group as the evaluation threshold value. The program according to any one of claims 1 to 6, wherein the computer is caused to function. The event is a data packet transmitted from a communication device,
2. The computer according to claim 1, wherein the state functions the computer to be “with link + first speed”, “with link + second speed”, and “without link” at each port of the communication device. 8. The program according to any one of items 7. A device for determining an abnormality with respect to a time-series operational event group E ′ _M ,
A Markov model learning means for learning a timed Markov model that calculates the transition probability from the state i to the state j according to the stay time of the state i using all the time series of events E _N based on the teacher data;
For each of the normal time event group P ⁰ and the abnormal time event group P ^{1 in the} past time series based on the teacher data, an addition value or a multiplication value of the transition probabilities in the state transition is calculated as an evaluation value. Evaluation value distribution calculating means for calculating an evaluation value distribution R counting the appearance frequency;
Between the evaluation value distribution R ¹ evaluation value distribution R ⁰ abnormal event group normal event group, and having an evaluation threshold calculating means for calculating an evaluation threshold of a predetermined condition,
The evaluation value distribution calculating means further calculates an evaluation value distribution R for the operational event group E ′ _M ,
The apparatus further comprising: an abnormality determination unit that determines that an abnormality occurs when an evaluation value distribution of the operation event group E ′ _M is biased to be equal to or less than the evaluation threshold value. An apparatus abnormality determination method for determining an abnormality with respect to a time-series operation event group E ′ _M ,
The device is
As a learning stage,
Using all sets of events E _N time series based on the training data, and the eleventh step of learning Timed Markov model to calculate the probability of transition from state i corresponding to the residence time of the state i to state j,
For each of the normal time event group P ⁰ and the abnormal time event group P ^{1 in the} past time series based on the teacher data, an addition value or a multiplication value of the transition probabilities in the state transition is calculated as an evaluation value. A twelfth step of calculating an evaluation value distribution R counting the appearance frequency;
Between the evaluation value distribution R ¹ evaluation value distribution R ⁰ abnormal event group normal event group to perform a thirteenth step of calculating an evaluation threshold of a predetermined condition,
As an operational stage,
A twenty-first step of calculating an evaluation value distribution R in which an added value or a multiplied value of the transition probabilities in the state transition is calculated as an evaluation value for the operating event group E ′ _{M and the} appearance frequency with respect to the evaluation value is counted. When,
An abnormality determination method for an apparatus, further comprising a twenty-second step of determining an abnormality when an evaluation value distribution of an operation event group E ′ _M is biased to be equal to or less than the evaluation threshold value.

Images