JP2019101712A - Abnormality estimation device, abnormality estimation method and program - Google Patents

Abstract

To shorten time required for estimating a position and a factor of irregular type abnormality.SOLUTION: An abnormality estimation device for estimating a position of abnormality in a communication network comprises: first estimation means for calculating a maximum posterior probability using a causal model which indicates a causal relation between an apparatus constituting the communication network and observation information of the apparatus and thereby estimating the position of abnormality in the case where abnormality having occurred in the communication network is a regular type abnormality; abnormality class determination means for determining whether or not the abnormality is an irregular type abnormality on the basis of the maximum posterior probability calculated by the estimation means; and second estimation means for, if the abnormality is determined as the irregular type abnormality by the abnormality class determination means, estimating the position of abnormality in the case where the abnormality is the irregular abnormality, using a correction model obtained by correcting the causal model by difference between distribution of regular abnormalities and distribution of irregular abnormalities.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an abnormality estimation apparatus, an abnormality estimation method, and a program.

  The correspondence of the abnormality which generate | occur | produced in the communication network is performed in order of abnormality detection, identification of an abnormal place and a factor, and restoration. In the identification of the abnormal part / factor, for example, a method of estimating the abnormal part / factor by a causal model is performed (see Non-Patent Documents 1 to 3). The method of estimating an abnormal place and factor by a causal model is composed of two phases of a learning phase and an inference phase.

  In the learning phase, the causal relationship between abnormalities in routers and servers that are components of the communication network system and the values of various observation information representing error logs and alerts obtained from the components of the communication network system, etc. Construct a causal model to represent.

  In the causal model, for example, each component of the communication network system is a node of the device / factor state layer, and weighted toward the nodes of the observation state layer that affects when an abnormality occurs in each node. It is built by putting an edge. This weight is defined by the conditional probability. By applying weighted edges to all nodes based on the knowledge of an expert of the communication network system and the case information of an abnormality that has occurred in the past, etc., a causal model describing the causality of the entire communication network system is obtained. Be

  In the inference phase, the edge is traced backward so that the prior probability and the conditional probability become maximum from the value of observation information obtained when an abnormality occurs in the communication network system and the causal model created in the learning phase To estimate the location of the anomaly The posterior probability when the a priori probability and the conditional probability become maximum is called the maximum posterior probability, and the value of the device / factor state layer at this time is the estimation result.

  Here, although the causal model is constructed based on the configuration information of the communication network, the case information of the abnormality that has occurred in the past, etc., the constructed causal model may not necessarily be accurate. For example, the causal model does not describe the causal relationship when an abnormality that has never occurred in the past has occurred. In addition, when the devices constituting the communication network system are renewed, the causal relationship between the node indicating the device and the nodes in the observation state layer may change, and the cause and effect of the entire communication network system only in the learning phase. It is difficult to construct a causal model that accurately describes the relationship.

  In addition, even if an abnormality occurs, the device may not output an alert, or a node in the observation state layer may be estimated as an abnormal state due to an analysis error of observation information or the like. Thus, there are cases where it is not always easy to determine the state of the original observation information (in other words, the true observation state). Such abnormalities are called atypical abnormalities. On the other hand, an abnormality that can be estimated by a causal model that is constructed based on configuration information of a communication network, case information of an abnormality that has occurred in the past, or the like is called a fixed abnormality.

  On the other hand, by introducing a function corresponding to the imprecision of observation information and correcting the causal model at the time of estimation, the abnormal place / factor of the atypical abnormality can be estimated by the causal model which can also be estimated. An estimation method has been proposed (see Non-Patent Document 4).

Shrink: A tool for failure diagnosis in IP networks. Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data, pages 173-178, 2005. IP Fault Localization via Risk Modeling. IEEE Transactions on Dependable and Secure Computing, 7 (4): 1-14, 2010. R. R. Kompella, J. Yates, A. Greenberg, and A. C. Snoeren. G-RCA: A Generic Root Cause Analysis Platform for Service Quality Management in Large IP Networks. IEEE / ACM Transactions on Networking, 20 (6): 1734-1747, 2012. Youichi Matsuo, Yusuke Nakano, Watanabe, Keishiro Watanabe, Keisuke Ishibashi, Keiichi Kawahara, "Study on technique for estimating the cause of atypical failure," Proceedings of the IEICE General Conference, B-7-35, 2017.

By the way, when the abnormality which generate | occur | produced in the communication network is atypical abnormality, for example, the causal relationship between an apparatus and observation information may differ from the causal model built beforehand. Therefore, in Non-Patent Document 4, all candidate patterns for correcting the causal model are trialed while comparing the maximum a posteriori probability p and the degree of conversion by the function that changes the edge and the function that adds noise to the observation state. By correcting the causal model (that is, performing a full search of correction candidates), it is possible to estimate an abnormal part / factor when an atypical abnormality occurs. However, in the estimation method disclosed in Non-Patent Document 4, as the number of devices and the number of observations increase, correction candidates for the causal model increase in combination. For example, when the number of devices and factors is N and the number of observations is M, the number of combinations is 2 ^N × 2 ^M.

  For this reason, in the estimation method disclosed in Non-Patent Document 4, it takes an enormous amount of time to estimate an abnormal part / factor.

  The present invention has been made in view of the above-described points, and an object thereof is to shorten the time required to estimate an abnormal part / factor of an atypical abnormality.

  So, in the embodiment of the present invention, it is an abnormality estimating device which estimates an abnormal part of a communication network, and uses a causal model representing a causal relationship between a device forming the communication network and observation information of the device. Calculating a maximum a posteriori probability, based on a first estimation means for estimating the abnormal point in the case where the abnormality occurring in the communication network is a fixed abnormality, and the maximum posterior probability calculated by the estimation means; Distribution of fixed type abnormality and distribution of fixed type abnormality when the type is determined as abnormal by the abnormality type determination unit that determines whether the abnormality is the atypical abnormality, and the abnormality type determination unit determines by the abnormality type determination unit Second estimation means for estimating the abnormal portion in the case where the abnormality is an atypical abnormality using a correction model obtained by correcting the causal model by a difference between Characterized in that it.

  It is possible to shorten the time required to estimate the abnormal part / factor of the atypical abnormality.

It is a figure which shows an example of a function structure of the abnormality estimation apparatus in embodiment of this invention. It is a flowchart which shows an example of the construction | assembly process of the causal model in embodiment of this invention. It is a flowchart which shows an example of the abnormality estimation process in embodiment of this invention. It is a figure which shows an example of the hardware constitutions of the abnormality estimation apparatus in embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the following, an abnormality estimation apparatus 10 will be described which estimates an abnormal part / factor of an abnormality generated in a communication network by a method of estimating an abnormal part / factor using a causal model.

  In the method of estimating an abnormal place or factor using a causal model, the device / factor state is calculated by calculating the posterior probability (maximum a posteriori probability) in which the a priori probability and the conditional probability become maximum with respect to the current observation information value. Estimate the layer.

Therefore, in the embodiment of the present invention, the device / factor state layer X = (x ₁ ,..., X _N ) and the observation information state layer Y = (y ₁ ,..., Y _M ) In the directed Markov model connecting を, a prior probability and a conditional probability are defined, and a posteriori probability is newly defined by the prior probability and the conditional probability. In the learning phase, a model (causal model) represented by this a posteriori probability is constructed based on the configuration information of the communication network, the case information of the abnormality that has occurred in the past, and the like. Then, in the inference phase, the abnormal point / factor is estimated by estimating the state of the device / factor which maximizes this a posteriori probability with respect to the value of the current observation information.

  As described above, the observation information is, for example, information representing an error log or an alert obtained from a component of the communication network system, a traffic amount, and the like. The value of the observation information (observation value) is, for example, “1” in the case of an error log or an alert, and “0” otherwise. Similarly, the value of the observation information (observation value) is, for example, “1” when the traffic volume of the device exceeds a certain threshold, and “0” otherwise.

<Prior probability>
First, define the prior probability. Let x _{i be} the state of device factor i, and x _{i be} a random variable taking 0 or 1. Here, 0 represents a normal state, and 1 represents an abnormal state. Also, for the state of N devices / factor i, let X = (x ₁ ,..., X _N ) be the state layer X of the device / factor,

とする。ここで、αは機器・要因の異常度合を表す事前確率のパラメータである。

I assume. Here, α is a parameter of the prior probability representing the degree of abnormality of the device / factor.

  At this time, the prior probability P (X | α) is defined by the following equation 2 for N devices and factor groups.

<Conditional probability>
Next we define the conditional probability. the y _j to the observed value of the observation information _j, y j is a random variable that takes 0 or 1. Here, 0 represents that a normal state was observed, and 1 represents that an abnormal state was observed. Further, for the observed values of M pieces of observation information j, the state layer Y of the observation information is Y = (y ₁ ,..., Y _M ).

  Furthermore, let z be a random variable representing the type of abnormality. z takes 1 or 2, z = 1 represents a typical abnormality, and z = 2 represents an atypical abnormality,

とする。ここで、γは定型異常又は非定型異常の出現のし易さを表すパラメータである。なお、通信ネットワークで異常が発生した場合、ｚの値が１であるか又は２であるかは決定されている（言い換えれば、通信ネットワークで発生した異常が定型異常又は非定型異常のいずれであるかは決定されている）が、本実施形態ではｚを確率変数として扱う。

I assume. Here, γ is a parameter representing the ease of appearance of a typical abnormality or an atypical abnormality. When an abnormality occurs in the communication network, it is determined whether the value of z is 1 or 2 (in other words, the abnormality generated in the communication network is either a fixed abnormality or an unfixed abnormality) However, in the present embodiment, z is treated as a random variable.

Also, let φ z be a distribution that represents the presence or absence of a causal relationship between the device / factor state layer X and the observation information state layer Y. A state x i of the device-factor i, with respect to the observed value y j observation information j, phi 1 i, j is a distribution representing the presence or absence of a causal relationship when the standard error occurs, for example, non-patent literature It is determined using the method disclosed in 1-3. Note that φ 1 i, j is a distribution that is determined decisively, but is treated as a probability distribution in this embodiment.

On the other hand, the state x i of the device-factor i, with respect to the observed value y j observation information j, phi 2 i, j is a distribution representing the causal relationship when the atypical abnormality occurs,

とする。ここで、θはパラメータである。

I assume. Here, θ is a parameter.

At this time, the conditional probability P (Y | X, z, φ ¹ , φ ² ,) is given by the following equation 5 with δ as a delta function, and 1 if true, and 0 otherwise. Define.

ここで、βは、機器・要因群の異常と、異常状態を示す観測値との因果関係の影響度合いを表す条件付き確率のパラメータである。また、ｃは規格化定数である。

Here, β is a parameter of conditional probability that represents the degree of influence of a causal relationship between an abnormality of the device / factor group and an observed value indicating an abnormal state. Also, c is a normalization constant.

<Post-Probability>
Next, we define the posterior probability. The posterior probability P (X, Y, z, φ ¹ , φ ² , θ, α, β, γ) using the prior probability defined by the above equation ² and the conditional probability defined by the above equation ⁵ Is defined by the following equation 6.

この事後確率が学習フェーズで構築される因果モデルである。

This posterior probability is a causal model constructed in the learning phase.

<Estimation of abnormal place / factor>
Next, the case where an abnormal part and factor are estimated using the posterior probability P (X, Y, z, φ ¹ , φ ² , θ, α, β, γ) defined by the above equation ⁶ will be described. If the type of the abnormality generated in the communication network is a fixed abnormality, with the current observation information, assuming z = 1, the maximum posterior probability p ^ by the following equation 7 and the device / factor state X by the following equation 8 Calculate ^.

この機器・要因状態Ｘ＾が定型異常である場合の推定結果（例えば、異常箇所・要因の推定結果）である。なお、上記の数７及び数８は、例えば、確率伝搬法等を用いて計算することができる。確率伝搬法については、例えば、参考文献「Bishop, Christopher M. (2006), Pattern Recognition and Machine Learning, Springer, ISBN 0-387-31073-8」を参照されたい。

This is an estimation result (for example, an estimation result of an abnormal part or factor) when the device / factor state X ^ is a fixed abnormality. The above equations (7) and (8) can be calculated using, for example, a probability propagation method or the like. For the probability propagation method, see, for example, bibliography Bishop, Christopher M. (2006), Pattern Recognition and Machine Learning, Springer, ISBN 0-387-31073-8.

  On the other hand, when the type of abnormality occurring in the communication network is an atypical abnormality, the device / factor state X ^ is calculated by the following equation 9 with z = 2 for the current observation information.

ここで、ｃ´は規格化定数である。

Here, c 'is a normalization constant.

  It is an estimation result when this equipment / factorial state X ^ is an atypical abnormality. The above equation (9) can be calculated using, for example, Gibbs sampling or the like. See the above references for Gibbs sampling.

The above numbers 9, phi ² by representing the causal relationship between atypical abnormal, while changing the θ and phi ^2, phi ¹ and phi ² and the penalty term to avoid excessively deviate τ (| φ ¹ - By introducing φ ² | ₂ ), it is a problem to estimate the causal relationship at the time of atypical abnormality. In other words, Equation 9 introduces as a penalty term a value obtained by multiplying the degree of deviation (difference in distribution) between φ ¹ and φ ² by an arbitrary constant τ that adjusts weighting, and X, θ that maximizes the posterior probability , Φ ² is a problem. Note that | · | ₂ is the L2 norm. Penalty term may be a value based on the deviation degree between the phi ¹ and phi ^2, for example, L1 norm or the like may be used.

  Thus, by formulating with a probability model, methods such as Gibbs sampling can be used, and since it is not necessary to search all, calculation time can be shortened.

<Functional configuration>
Next, the functional configuration of the abnormality estimation device 10 according to the embodiment of the present invention will be described with reference to FIG. FIG. 1 is a diagram showing an example of a functional configuration of the abnormality estimation device 10 according to the embodiment of the present invention.

  As shown in FIG. 1, the abnormality estimation apparatus 10 according to the embodiment of the present invention includes a model construction unit 101, an abnormality estimation processing unit 102, an abnormality type determination unit 103, and a UI unit 104. Further, the abnormality estimation apparatus 10 according to the embodiment of the present invention stores the model construction information storage unit 105 and the causal model storage unit 106.

The model construction information storage unit 105 stores information for constructing a causal model (for example, configuration information of a communication network, case information of an abnormality that has occurred in the past, and the like). The causal model storage unit 106 is information indicating the causal model constructed by the model construction unit 101 (for example, the posterior probability P (X, Y, z, φ ¹ , φ ² , θ, α, β shown in the above equation 6) , Γ) are stored.

In the learning phase, the model construction unit 101 uses the above number 6 based on the information stored in the model construction information storage unit 105 (for example, configuration information of a communication network, case information of an abnormality that has occurred in the past, etc.). A causal model represented by the a posteriori probability P (X, Y, z, φ ¹ , φ ² , θ, α, β, γ) shown in FIG. For example, each parameter (for example, the posterior probability P (X, Y, z, φ ¹ , φ ² , θ, α, β, γ)) (for example, based on the configuration information of the communication network or the case information of the abnormality occurred in the past). , Θ, α, β, γ, etc. are determined to construct a causal model.

  The anomaly estimation processing unit 102 uses the observation information and the causal model constructed by the model construction unit 101 every time observation information is acquired in the inference phase, and the maximum a posteriori probability p ^ shown in Expression 7; The device / factor state X ^ shown in equation 8 is calculated. In addition, when the abnormality type determination unit 103 determines that the type of abnormality is an atypical abnormality, the abnormality estimation processing unit 102 calculates the device / factor state X ^ shown in the above-described equation (9).

  That is, when the type of abnormality generated in the communication network is a fixed abnormality, the abnormality estimation processing unit 102 estimates an abnormal part / factor according to the device / factor state X ^ shown in Expression 8. On the other hand, when the type of the abnormality occurring in the communication network is an atypical abnormality, the abnormality estimation processing unit 102 determines that the causal model constructed by the model construction unit 101 has the distribution of the atypical abnormality and the atypical abnormality. A model expressed as a difference is corrected, and the device / factor state X ^ shown in Equation 9 is calculated using this model (hereinafter also referred to as “corrected model”) to estimate an abnormal part / factor.

  The abnormality estimation device 10 may acquire observation information from a collection device that collects, for example, error logs and alerts of each device, traffic volume, etc. The error estimation device 10 may acquire error logs and alerts from each device, The observation information may be acquired by collecting traffic information and the like.

  The abnormality type determination unit 103 determines the type of abnormality occurring in the communication network based on the maximum a posteriori probability p ^ calculated by the abnormality estimation processing unit 102. The abnormality type determination unit 103 compares, for example, the maximum posterior probability p ^ with a preset threshold, and if the maximum posterior probability p ^ is equal to or greater than the threshold, the fixed abnormality, the maximum posterior probability p ^ is less than the threshold If there is a certain condition, it may be determined as an atypical error. The method of determining the type of abnormality is not limited to this. However, it is preferable that the determination accuracy be as high as possible.

  The UI unit 104 displays the estimation result by the abnormality estimation processing unit 102 (that is, the abnormal place / factor generated in the communication network). By displaying the abnormal part / factor generated in the communication network, the operator or the like can perform the recovery operation according to the abnormal part / factor.

  In addition, the abnormality estimation apparatus 10 in embodiment of this invention may be comprised with one computer, and may be comprised with two or more computers. When the abnormality estimation device 10 is configured by a plurality of computers, each functional unit (the model construction unit 101, the abnormality estimation processing unit 102, the abnormality type determination unit 103, and the UI unit 104) of the abnormality estimation device 10 , May be distributed to a plurality of computers.

  When the abnormality estimation device 10 is configured of a plurality of computers, each storage unit (model construction information storage unit 105 and causal model storage unit 106) of the abnormality estimation device 10 includes a plurality of computers. It may be distributed.

<Causal model construction processing>
Next, a process of constructing a causal model in the embodiment of the present invention will be described with reference to FIG. FIG. 2 is a flowchart showing an example of a process of constructing a causal model in the embodiment of the present invention. The process of constructing a causal model is a process in the learning phase.

  Step S101: The model construction unit 101 acquires, for example, configuration information of a communication network, case information of an abnormality that has occurred in the past, and the like from the model construction information storage unit 105.

Step S102: Next, based on the information acquired from the model construction information storage unit 105, the model construction unit 101 obtains the posterior probability P (X, Y, z, φ ¹ , φ ² , θ , Α, β, γ) construct a causal model. The model construction unit 101 uses, for example, the posterior probability P (X, Y, z, φ ¹ , φ ² , θ, α, β, γ) based on the configuration information of the communication network, the case information of an abnormality that has occurred in the past, and the like. A causal model is constructed by determining each parameter (for example, θ, α, β, γ, etc.) of

Then, the model construction unit 101 causes the information indicating the constructed causal model (for example, each parameter of the posterior probability P (X, Y, z, φ ¹ , φ ² , θ, α, β, γ), etc.) to be a causal model It is stored in the storage unit 106.

As described above, in the abnormality estimation device 10 according to the embodiment of the present invention, in the learning phase, the posterior probability P (X, Y, z, φ ¹ , φ ² , θ, α, β, γ) shown in the equation 6 is displayed. The causal model to be

<Abnormality estimation processing>
Next, abnormality estimation processing according to the embodiment of the present invention will be described with reference to FIG. FIG. 3 is a flowchart showing an example of the abnormality estimation process in the embodiment of the present invention. The abnormality estimation process is a process in the inference phase. Also, the abnormality estimation process is performed each time observation information is acquired.

  Step S201: First, using the acquired observation information and the causal model stored in the causal model storage unit 106, the abnormality estimation processing unit 102 shows the maximum a posteriori probability p ^ shown in the equation 7 and the equation 8 Calculate device / factor state X ^. As a result, an abnormal part or factor is estimated when the abnormality occurring in the communication network is a fixed abnormality.

  Step S202: Based on the maximum a posteriori probability p ^ calculated by the abnormality estimation processing unit 102, the abnormality type determination unit 103 determines whether the type of the abnormality generated in the communication network is either a fixed abnormality or an unfixed abnormality. Do.

  If it is determined that the type of abnormality occurring in the communication network is an unfixed form abnormality, the process proceeds to step S203, and if it is determined that the type of abnormality occurring in the communication network is a fixed form abnormality, the process proceeds to step S204.

  Step S203: If the abnormality type determination unit 103 determines that the type of abnormality is an atypical abnormality, the abnormality estimation processing unit 102 uses the observation information and the correction model to determine the device / factorial state shown in Equation 9. Calculate X ^. As a result, an abnormal part or factor is estimated when the abnormality occurring in the communication network is an atypical abnormality. As described above, the device factor state X ^ shown in equation 9 can be calculated using, for example, Gibbs sampling. Therefore, it is not necessary to perform a full search as in the estimation method disclosed in Non-Patent Document 4, and the calculation time can be shortened.

  Step S204: The UI unit 104 displays the device / factor state X ^ (that is, an abnormal place / factor generated in the communication network) calculated in step S201 or step S203. That is, when the abnormality generated in the communication network is a fixed abnormality, the device / factor state X ^ calculated in step S201 is displayed. On the other hand, when the abnormality generated in the communication network is an unfixed form abnormality, the device / factor state X ^ calculated in step S203 is displayed.

  As described above, in the inference phase, the abnormality estimation device 10 according to the embodiment of the present invention can estimate the abnormal part / factor using the causal model constructed in the learning phase. Moreover, in the abnormality estimation apparatus 10 according to the embodiment of the present invention, when the type of the abnormality generated in the communication network is an atypical abnormality, the abnormality location / factor is estimated using a model obtained by correcting the causal model. Do. For this reason, even if the abnormality generated in the communication network is an atypical abnormality, it is possible to estimate the abnormal part / factor in a short time.

  In the example shown in FIG. 3, the device / factor state X ^ shown in equation 8 is calculated in step S201, and the abnormal part / factor in the case of the fixed abnormality is estimated. This estimation is abnormal in step S202. It may be performed only when it is determined that the type of is a fixed abnormality.

<Hardware configuration>
Finally, the hardware configuration of the abnormality estimation apparatus 10 according to the embodiment of the present invention will be described with reference to FIG. FIG. 4 is a diagram showing an example of a hardware configuration of the abnormality estimation device 10 according to the embodiment of the present invention.

  As shown in FIG. 4, the abnormality estimation device 10 according to the embodiment of the present invention includes an input device 11, a display device 12, an external I / F 13, a random access memory (RAM) 14, and a read only memory (ROM). ), A CPU (Central Processing Unit) 16, a communication I / F 17, and an auxiliary storage device 18. Each of these pieces of hardware is communicably connected via a bus 19.

  The input device 11 is, for example, a keyboard, a mouse, a touch panel, etc., and is used by the user to input various operations. The display device 12 is, for example, a display or the like, and displays the processing result of the abnormality estimation device 10. The abnormality estimation device 10 may not have at least one of the input device 11 and the display device 12.

  The external I / F 13 is an interface with an external device. The external device is, for example, a recording medium 13a. The abnormality estimation apparatus 10 can read and write the recording medium 13 a and the like via the external I / F 13. The recording medium 13a may store, for example, a program for realizing each functional unit of the abnormality estimation apparatus 10 according to the embodiment of the present invention.

  Examples of the recording medium 13a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

  The RAM 14 is a volatile semiconductor memory that temporarily holds programs and data. The ROM 15 is a non-volatile semiconductor memory that can hold programs and data even after the power is turned off. The ROM 15 stores, for example, OS (Operating System) settings, network settings, and the like. The CPU 16 is an arithmetic device that reads a program or data from the ROM 15, the auxiliary storage device 18 or the like onto the RAM 14 and executes processing.

  The communication I / F 17 is an interface for connecting the abnormality estimation device 10 to a communication network. A program for realizing each functional unit of the abnormality estimation apparatus 10 according to the embodiment of the present invention may be acquired (downloaded) from, for example, a predetermined server via the communication I / F 17.

  The auxiliary storage device 18 is, for example, a hard disk drive (HDD) or a solid state drive (SSD), and is a non-volatile storage device storing programs and data. For the programs and data stored in the auxiliary storage device 18, for example, an OS, an application program for realizing various functions on the OS, and each functional unit included in the abnormality estimation apparatus 10 according to the embodiment of the present invention There is a program for

  The functional units (the model construction unit 101, the abnormality estimation processing unit 102, the abnormality type determination unit 103, and the UI unit 104) included in the abnormality estimation device 10 according to the embodiment of the present invention are installed in the abnormality estimation device 10. One or more programs are realized by processing that the CPU 16 executes.

  Further, each storage unit (model construction information storage unit 105 and causal model storage unit 106) included in the abnormality estimation apparatus 10 according to the embodiment of the present invention is realized using, for example, the auxiliary storage device 18. The storage unit of at least one of the model construction information storage unit 105 and the causal model storage unit 106 may be realized using, for example, a storage device connected to the abnormality estimation apparatus 10 via a communication network.

  The present invention is not limited to the above specifically disclosed embodiments, and various modifications and changes are possible without departing from the scope of the claims.

DESCRIPTION OF SYMBOLS 10 abnormality estimation apparatus 101 model construction part 102 abnormality estimation processing part 103 abnormality type determination part 104 UI part 105 information storage part for model construction 106 causal model storage part

Claims (6)

An anomaly estimation apparatus for estimating an anomaly of a communication network, comprising:
The abnormality in the case where the abnormality occurring in the communication network is a fixed abnormality by calculating a maximum a posteriori probability using a causal model representing a causal relationship between a device forming the communication network and the observation information of the device First estimation means for estimating a location;
An abnormality type determination unit that determines whether the abnormality is an atypical abnormality based on the maximum a posteriori probability calculated by the first estimation unit;
If it is determined by the abnormality type determination unit that the abnormality is an atypical abnormality, the abnormality is not determined using a correction model in which the causal model is corrected by the difference between the distribution of the fixed abnormality and the distribution of the atypical abnormality. A second estimation unit configured to estimate the abnormal portion in the case of the fixed abnormality;
An anomaly estimation apparatus characterized by having:   According to whether the abnormality is a fixed form abnormality or a non-fixed form abnormality, it has an output means for outputting the abnormal point estimated by either the first estimation means or the second estimation means. The abnormality estimation apparatus according to claim 1, characterized in that An apparatus state layer X representing the state of an apparatus constituting the communication network, an observation state layer Y representing the state of observation information of the apparatus, a random variable z representing either a fixed form abnormality or an unfixed form abnormality, an apparatus state The anomaly estimating apparatus according to claim 1, further comprising a model constructing unit configured to construct the causal model on the basis of a distribution φ ^z representing a causal relationship from the layer X to the observation state layer Y. The second estimation means is
The said abnormal part is estimated by calculating the maximum value of the formula showing the said correction model by Gibbs sampling by making said difference into a penalty term, The said abnormal location is estimated as described in any one of the Claims 1 thru | or 3 characterized by the above-mentioned. Anomaly estimation device. An anomaly estimation apparatus that estimates an anomaly point of the communication network
The abnormality in the case where the abnormality occurring in the communication network is a fixed abnormality by calculating a maximum a posteriori probability using a causal model representing a causal relationship between a device forming the communication network and the observation information of the device A first estimation procedure for estimating the location;
An abnormality type determination procedure of determining whether the abnormality is an atypical abnormality based on the maximum a posteriori probability calculated by the first estimation procedure;
If it is determined by the abnormality type determination procedure that the abnormality is an atypical abnormality, the abnormality is not determined using a corrected model in which the causal model is corrected by the difference between the distribution of the fixed abnormality and the distribution of the atypical abnormality. A second estimation procedure for estimating the abnormal part in the case of a fixed abnormality;
An anomaly estimation method characterized in that:   The program for functioning a computer as each means in the abnormality estimation apparatus as described in any one of Claims 1-4.

Images