JP6586067B2 - Fault location device, fault location method, and fault location program - Google Patents

Description

  The present invention relates to a failure location specifying device, a failure location specifying method, and a failure location specifying program.

  Memory (SRAM (Static Random Access Memory)) is prone to soft errors due to increased capacity of communication equipment such as optical transmission devices and routers, increased use of general-purpose components, and process miniaturization such as field-programmable gate arrays (FPGAs). ) Etc.) are widely used. As a result, communication technology and network monitoring technology consisting of connection of communication devices tend to diversify the failure factors of communication devices and increase the scale of the impact at the time of failure.

  Due to this tendency, it is expected that cases such as so-called intermittent failures and silent failures will appear in lower layers such as an optical transport layer composed of an optical transmission apparatus. In other words, a failure on the lower layer is not detected as a clear alarm, but is intermittent in the upper layer such as the L3 layer composed of routers accommodated in the optical transport layer and the service layer of each user accommodated in the L3 layer. In particular, it is expected that cases in which communication quality and throughput will decrease will increase.

  For the above case, for example, a measure for enhancing the monitoring function itself by increasing the type of performance information acquired from the communication devices of each layer and the frequency of acquisition and monitoring the state in detail. However, due to the diversification of the failure factors described above, it is difficult to deal with all such cases, and there are still cases in which the upper layer communication quality cannot be detected as a clear alarm. . For this reason, there is an increasing need for a technology that can identify the location of a failure or a failure sign and enable early countermeasures in response to a decrease in communication quality and throughput that appears in the upper layer.

  In addition, as a method for detecting an intermittent failure or a silent failure in a lower layer, for example, a method for setting a threshold value for determining a sudden decrease (or increase) in traffic by monitoring MIB (Management Information Base) traffic for the L3 layer is known. It has been. However, according to Non-Patent Document 1, it is difficult to set a threshold value so as to suppress failure detection failure and false detection as much as possible.

  In general, in a state where the influence of the failure leaks to the communication quality of the upper layer, all communication devices on the communication path in which the upper layer is accommodated are widespread because they become suspected locations of the failure. In addition, a decrease in communication quality and throughput is probabilistic information accompanied by a detection failure or erroneous detection. According to Non-Patent Document 2, it is assumed that detection failure can occur with a high probability of about 30%. From these circumstances, it is difficult to uniquely identify the failure location.

  Therefore, by enabling information distribution and collaborative operation between multiple layers in the accommodation relationship, the status of communication devices within the suspected range of the lower layer is sequentially confirmed from the communication quality degradation information of the upper layer. A method for uniquely identifying the failure location is conceivable. However, such a method requires a great amount of operation and time to identify the fault location because it is necessary to check the performance information of the communication device in the past and confirm it over time.

Keisuke Ishibashi, Takanori Hayashi, Hiroshi Shiomoto, “Advanced Network Design and Operation by Machine Learning and Data Analysis” NTT Technical Journal 2015.12 Yongning Tang, Ehab Al-Shaer, Kaustubh Joshi, "Reasoning under Uncertainty for Overlay Fault Diagnosis," IEEE Trans. On Network and Service Management, Volume 9, Issue 1, March 2012.

  In view of such circumstances, it is an object of the present invention to reduce the operation for specifying the position of a failure that has occurred in a lower layer with respect to abnormality detection in an upper layer.

  In order to solve the above-described problem, the invention according to claim 1 is a failure location identifying device that identifies a location of a failure that has occurred in a lower layer with respect to abnormality detection in an upper layer, wherein the lower layer device is a component A control unit that is classified into units, converts the abnormality detection of the upper layer into one or more types of parameters for each component of the lower layer, and estimates a component in which a failure has occurred using the converted parameters , Comprising.

  The invention according to claim 7 is a failure location specifying method in a failure location specifying device for specifying a location of a failure that has occurred in a lower layer with respect to abnormality detection in an upper layer, wherein the lower layer device is a component unit The failure location device converts the upper layer abnormality detection into one or more types of parameters for each component of the lower layer, and a failure is detected using the converted parameters. Performing the step of estimating the generated component.

  The invention according to claim 8 is a failure location specifying program for causing a computer to function as a failure location specifying device for specifying a location of a failure that has occurred in a lower layer with respect to abnormality detection in an upper layer, Lower layer devices are classified into components, and the computer converts the upper layer abnormality detection into one or more types of parameters for each lower layer component, and uses the converted parameters. It is a fault location specifying program for functioning as a control means for estimating a component in which a fault has occurred.

According to the first, seventh, and eighth aspects of the present invention, it is possible to detect the parameter in the component unit of the lower layer from the abnormality detection of the upper layer that is stochastically expressed and originally makes it difficult to identify the failure position of the lower layer. Distribution can be obtained. A component having an extreme value in the parameter can be found in such a distribution, and the found component can be estimated as a component in which a failure has occurred. Thereby, the suspected range of the failure of the lower layer can be narrowed down. In other words, it is possible to efficiently narrow down the target for performing detailed analysis with a great burden in order to finally specify the position of the failure in the lower layer.
Therefore, it is possible to reduce the operation for specifying the position of the failure that has occurred in the lower layer with respect to the abnormality detection of the upper layer.

  The invention according to claim 2 is the fault location apparatus according to claim 1, wherein the control unit is configured to determine a component of the lower layer according to a value of the parameter regarding the location of the fault. Each is ranked.

  According to the second aspect of the present invention, it is possible to determine a component for which a detailed analysis is preferentially performed for a plurality of components. For this reason, by performing detailed analysis in order from the component with the highest priority, it is possible to further reduce the operation for specifying the position of the failure in the lower layer.

  The invention according to claim 3 is the fault location apparatus according to claim 1 or 2, wherein the parameter is (1) routed through the upper layer device accommodated by each of the components. Among the paths to be detected, the number of detections in component units, which is the number of paths in which the anomaly has been detected, (2) the number of accommodations that is the number of paths that pass through the higher-layer equipment that each of the components accommodates, The detection rate in component units, which is a ratio to the number of detections, (3) the failure rate in component units determined from past failures in the lower layer devices belonging to each of the components, and (4) the failure rate On the basis of the abnormality detection, the failure of the component unit, which is the probability that the lower layer device belonging to each of the components has not failed No rate, (5) said corresponding to each of the upper layer of paths using the reciprocal of the number of components and weight of the detection number, weighting the number of detected per component, is either, characterized in that.

  According to the third aspect of the present invention, the distribution of each type of parameter in the component unit of the lower layer can be quantified. Therefore, it is possible to easily find a component whose parameter shows an extreme value.

  The invention according to claim 4 is the fault location device according to any one of claims 1 to 3, wherein there are a plurality of types of the parameters, and the control unit sets the parameters to a plurality of types. When estimating a component in which a failure has occurred by combining types, a priority is given to each of the plurality of types of combined parameters, and the estimation is executed from the parameters having a high priority.

  According to the invention described in claim 4, it is possible to realize estimation of a component in which a failure has occurred using a plurality of types of parameters.

  The invention according to claim 5 is the fault location apparatus according to any one of claims 1 to 4, wherein the control unit estimates the estimation when there is no fault in the estimated component. It is estimated that a failure has occurred in a component in the vicinity of the selected component.

  According to the fifth aspect of the present invention, detailed analysis can be performed with priority given to components in the vicinity of the component estimated to have a failure in the lower layer.

  The invention according to claim 6 is the fault location apparatus according to any one of claims 1 to 5, wherein the control unit is configured to detect a path of a higher layer where the abnormality is detected. For each, a similarity between the paths is evaluated based on a component corresponding to each of the paths, and abnormality detection in a path with a small similarity is removed as a false detection.

  According to the sixth aspect of the invention, it is possible to obtain the parameter distribution in the component unit of the lower layer after removing the false detection. For this reason, it is possible to improve the accuracy of narrowing down the suspected range of failure in the lower layer.

  ADVANTAGE OF THE INVENTION According to this invention, the operation | movement for pinpointing the position of the failure which generate | occur | produced in the lower layer with respect to the abnormality detection of an upper layer can be reduced.

It is an example of the block diagram of the communication system used as the object of surface analysis. (A) is a simplified configuration diagram of a communication system, and (b) is a table regarding determination of confirmation order for each OMS. It is an example of a functional block diagram of the failure position specific device in this embodiment. It is a figure explaining the case (a) where the number of detection is effective, the case (b) where the detection rate is effective, and the case (c) where the neighborhood information is effective regarding the determination of the confirmation order. (A) is a simplified configuration diagram of a communication system, and (b) is a table relating to determination of confirmation order using a failure rate. (A) is a simplified configuration diagram of a communication system, and (b) is a table relating to determination of a confirmation order using a non-failure rate. (A) is a simplified configuration diagram of a communication system, and (b) is a table relating to determination of confirmation order using weighted detection numbers. (A) is a simplified configuration diagram of a communication system, and (b) is a table relating to determination of confirmation order using a combination of a plurality of types of parameters. (A) is a simplified configuration diagram of the communication system, (b) is a table relating to determination of erroneous detection, and (c) is a confirmation order when reflecting the removal of OMS determined to be erroneous detection. It is a table about a decision.

≪Overview≫
Embodiments of the present invention will be described in detail with reference to the drawings.
In the present embodiment, a plurality of components that collectively handle one or a plurality of devices arranged in a lower layer of a monitoring target network are prepared, and lower layer devices are classified in advance in units of components. In this embodiment, an area analysis that analyzes the distribution of detection in units of components by converting the detection of abnormalities such as communication quality degradation and throughput degradation into detection for each component in the lower layer is adopted. To do. This area analysis narrows down the suspicion range by identifying components with extremely high detection counts or detection rates.

  After that, a detailed analysis is performed on the devices belonging to the identified component, thereby finally identifying the position of the failure that causes the abnormality. The present invention is intended to improve the efficiency of narrowing down the suspected range by area analysis. As the detailed analysis for each device, a well-known analysis can be adopted, and the description thereof is omitted.

  The method of determining the component is arbitrary. For example, the component may be one lower layer device or all of the devices. However, in this embodiment, the component is an OMS (Optical Multiplex Section) and the area analysis is performed in units of OMS. explain. OMS represents a logical communication path (path or connection) of a wavelength-multiplexed optical signal. OMS has the property that wavelength multiplexed signals are multiplexed / demultiplexed and terminated at an OXC (Optical Cross Connect) node or an Add / Drop node.

  The upper layer devices accommodated in one OMS section are the same, and the accommodation relationship does not change. On the other hand, between a plurality of OMSs, upper layer devices accommodated in each OMS section differ, and the accommodation relationship changes. Such an OMS can be handled as the maximum unit in which the accommodation relationship does not change, and can be handled as the minimum unit for which the accommodation relationship should be grasped. Since such a handling is possible, the component is preferably an OMS.

The configuration of the communication system that is the subject of the area analysis of the present embodiment is as shown in FIG. This configuration is an example, and the configuration to which the area analysis is applied is not limited to that shown in FIG.
The communication system shown in FIG. 1 is composed of a group of devices arranged in each of the L0 / L1 network, the L2 / L1.5 network, the L3 network, and the service network. The L0 / L1 network is a lower layer. The L2 / L1.5 network, the L3 network, and the service network are upper layers, and are higher in this order.

  A device arranged in the L0 / L1 network will be described. Reference numerals 11 to 14 are, for example, OXC (OXC node). Reference numerals 51 to 54 are, for example, REP (Repeater). Reference numerals 61 to 64 are, for example, trapons (transponders). Reference numerals 1a to 1d are, for example, MUX (Multiplexer) / DMUX (Demultiplexer), but may be a CDC (Colorless Directionless Contentionless) device. Reference numerals 2a to 2h are, for example, WSS (Wavelength Selective Switch). Reference numerals 3a to 3p are, for example, AMP (Amplifier). MUX (Multiplexer) / DMUX (1a-1d), WSS (2a-2h), and AMP (3a-3p) are connected by an optical fiber.

A device arranged in the L2 / L1.5 network will be described. Reference numerals 21 to 24 are, for example, MPLS-TP (Multi-Protocol Label Switching-Transport Profile) devices.
A device arranged in the L3 network will be described. Reference numerals 31 to 34 are routers, for example. The routers 31 to 34 store a traffic MIB for traffic monitoring.
A device arranged in the service network will be described. Reference numerals 41 to 46 are servers, for example.

  In the configuration of FIG. 1, the device between the OXCs 11 and 12 forms one component and is referred to as OMS A (or simply “A”). The equipment between OXCs 12 and 13 forms one component and will be referred to as OMS B (or simply “B”). The equipment between OXCs 13 and 14 forms one component and will be referred to as OMS C (or simply “C”). The equipment between OXCs 12 and 14 forms one component and will be referred to as OMS D (or simply “D”).

  As shown in FIG. 1, paths [1] to [3] are set on the L3 network. The paths [1] to [3] are appropriately set by the administrator of the communication system, and the setting mode is not limited to this. The path [1] is a logical communication path that passes through the routers 31 to 34. The path [2] is a logical communication path that passes through the routers 32 to 34. The path [3] is a logical communication path that passes through the routers 31 to 33.

  For each of the paths [1] to [3] on the L3 network, a path (lower layer path) that passes through the device on the L0 / L1 network that accommodates the device through which the paths [1] to [3] pass is set. Is done. In FIG. 1, three paths set on the L0 / L1 network are illustrated with the corresponding devices on the L2 / L1.5 network interposed. In FIG. 1, the paths on the L0 / L1 network corresponding to the paths [1] to [3] on the L3 network are line types (thick lines) for drawing the paths [1] to [3] on the L3 network, respectively. It is drawn with the same line type as a solid line, a thick broken line, and a thick dashed line.

  Similarly, for each of the paths [1] to [3] on the L3 network, a path passing through a device on the service network accommodated by a device via which the paths [1] to [3] pass is set. FIG. 1 shows three paths set on the service network. In FIG. 1, the paths on the service network corresponding to the paths [1] to [3] on the L3 network are the line types (thick solid lines and lines) for drawing the paths [1] to [3] on the L3 network, respectively. It is drawn with the same line type as a thick broken line and a thick dashed line).

  According to the configuration of FIG. 1, the components that accommodate the path [1] are OMS A, B, and C. Components that contain the path [2] are OMS B and C. Components that contain the path [3] are OMS A and B. Thus, the OMS (group) that accommodates each path on the L3 network is uniquely determined.

  When a failure such as an intermittent failure or a silent failure occurs on the lower layer, that is, the L0 / L1 network, for example, the MIB threshold is set on the paths [1] to [3] set on the L3 network of the upper layer. Abnormalities such as traffic reduction due to monitoring are detected probabilistically. Further, when a failure occurs, an abnormality is detected by, for example, a user report that suggests a decrease in traffic on a path set on the upper layer service network. The user report is not surely made when there is a decrease in traffic, and may be erroneously reported regardless of whether it is intentional or not. For this reason, it can be said that the abnormality detection by a user report is also probabilistic.

  The anomalies on the upper layer detected in this way can be expressed as a distribution of the number of detected anomalies converted to OMS units, a detection rate, and the like. The fault location apparatus of this embodiment specifies an OMS that shows a high value for the number of detections, detection rate, etc., and performs detailed analysis with priority.

  A method for identifying an OMS that shows a high value such as the number of detections and a detection rate will be described in detail with reference to FIG. As shown in FIG. 2A, it is assumed that a failure has occurred in OMS B (a specific device belonging to OMS B). In this case, the MIB threshold value monitoring detects an abnormality such as a decrease in traffic in the paths [1] to [3] passing through the devices (that is, the routers 32 and 33) on the L3 network accommodated by the OMS B.

  The failure location device of this embodiment converts the abnormality detection in the paths [1] to [3] into each OMS unit. Specifically, the abnormality detection of the path [1] is counted as an abnormality detection caused by a failure suspected to have occurred in each of the OMS A, B, and C that accommodates the device through which the path [1] passes. Similarly, the abnormality detection of the path [2] is counted as an abnormality detection caused by a failure suspected to have occurred in each of the OMS B and C that accommodate the device through which the path [2] passes. The abnormality detection of the path [3] is counted as an abnormality detection caused by a failure suspected to have occurred in each of the OMSs A and B that accommodate the devices through which the path [3] passes.

  From the abnormality detection counted in the paths [1] to [3], the number of detected components is obtained. That is, how many times the abnormality detection is counted in each OMS A to D is totalized. For OMS A, the number of detections of OMS A is 2 because the two abnormal detections of paths [1] and [3] are counted. For OMS B, the number of detections of OMS B is 3 because the three abnormal detections of paths [1] to [3] are counted. For OMS C, the number of detections of OMS B is 2 in order to count the two abnormal detections of paths [1] and [2]. On the L3 network, since no path is originally set for the device accommodated by OMS D, abnormality detection is not counted, and the number of detected OMS D is zero.

  The tabulated results of abnormality detection for each OMS are shown in the table of FIG. 2B (corresponding to confirmation order information 3b (FIG. 3) described later). In the table of FIG. 2B, items such as “component”, “accommodation number”, “detection number”, “detection rate”, “neighboring component”, “failure rate”, and “confirmation order” are provided. .

The “component” is a unit indicating a suspected range of occurrence of a failure, and is prepared for each OMS in the present embodiment.
The “accommodation number” is the number of paths (all or part of the paths) that pass through the devices on the L3 network accommodated by the target component. It can also be said that the number of connections (the number of accommodated L3 connections) set in the devices on the L3 network accommodated by each component. The arrows depicted in FIG. 2A indicate the relationship between the path on the L3 network and the OMS that accommodates the device through which the path passes. The accommodation number of each OMS is equal to the number of arrows that reach its own OMS.

The “number of detections” is the number of paths in which an abnormality is detected among paths (may be all or part) that pass through devices on the L3 network accommodated by the target component.
The “detection rate” is a value (percent display) obtained by dividing the number of detections by the number of accommodations for the target component.

“Neighboring components” refers to components adjacent to the target component. The adjacent components will be described later.
The “failure rate” is a probability that a failure will occur in a device (lower layer) belonging to the target component. It can also be said that the probability is a unit of component obtained from a past failure of a lower layer device belonging to each component. The “failure rate” in component units will be described later, but can be determined as appropriate using a predetermined calculation formula. The failure rate is updated each time a failure occurs in the device. It is assumed that the failure rate increases as the number of failures increases.

The “number of detections”, “detection rate”, “neighboring components”, and “failure rate” are parameters for area analysis.
The “confirmation order” is a priority indicating which component is to be preferentially analyzed in detail based on all or part of the parameters of the area analysis. The higher the accuracy of the suspected place, the higher the priority. For example, an OMS with a high number of detections is given priority, an OMS with the same number of detections is given priority to an OMS with a high detection rate, and an OMS with the same detection rate is given priority to an OMS with a high failure rate. Assume that a decision rule is adopted. In this case, according to FIG. 2B, OMS B has the largest number of detections between the OMSs (the number of detections is 3), and the confirmation order is first. In addition, OMS D has the smallest number of detections between the OMSs (the number of detections is 0), and the confirmation order is fourth.

  Next, for OMS A and C, the number of detections is 2 and there is no superiority, and further, the detection rates are both 100% (2/2) and there is no superiority or inferiority. However, since OMS A has a higher failure rate, OMS A is given priority. As a result, the confirmation order of OMS A is second and the confirmation order of OMS C is third.

  The failure location device of the present embodiment performs detailed analysis in the order of B → A → C → D according to the confirmation order determined in the table of FIG. As described above, the OMS B in which a failure actually occurs can be the most likely suspected place candidate, and not all the devices in the lower layer are considered suspected places. Therefore, it is possible to reduce the operation for specifying the position of the failure that appears in the lower layer.

≪Configuration≫
A functional configuration of the failure location device of this embodiment will be described. As illustrated in FIG. 3, the failure location device 100 includes a network configuration management unit 1-1 to 1-4, a performance information management unit 2-1 to 2-3, a user report management unit 2-4, and a confirmation. The control unit includes functional units such as the order determination unit 3 and the failure position specifying unit 4. The failure location device 100 also stores network configuration information 1a to 1d, performance information 2a to 2c, reporting information 2d, inter-layer accommodation information 3a, and confirmation order information 3b in the storage unit.

  The failure location device 100 is configured as a computer having a CPU (Central Processing Unit), storage means (storage unit), and a network interface. In this computer, the CPU executes a program (including a failure location specifying program) read on the storage unit, thereby operating a control unit (control means) configured by each functional unit.

  The network configuration management unit 1-1 manages the network configuration of the L0 / L1 network. The network configuration of the L0 / L1 network includes, for example, topology information between devices arranged on the L0 / L1 network and path setting information set on devices arranged on the L0 / L1 network. included. The network configuration management unit 1-1 outputs the network configuration management result of the L0 / L1 network as network configuration information 1a.

  The network configuration management unit 1-2 manages the network configuration of the L2 / L1.5 network. In the network configuration of the L2 / L1.5 network, for example, topology information between devices arranged on the L2 / L1.5 network or devices arranged on the L2 / L1.5 network are set. The setting information of the existing path is included. The network configuration management unit 1-2 outputs the network configuration management result of the L2 / L1.5 network as network configuration information 1b.

  The network configuration management unit 1-3 manages the network configuration of the L3 network. The network configuration of the L3 network includes, for example, topology information between devices arranged on the L3 network, and path setting information set for devices arranged on the L3 network. The network configuration management unit 1-3 outputs the network configuration management result of the L3 network as network configuration information 1c.

  The network configuration management unit 1-4 manages the network configuration of the service network. The network configuration of the service network includes, for example, topology information between devices arranged on the service network and path setting information set for the devices arranged on the service network. The network configuration manager 1-4 outputs the network configuration management result of the service network as network configuration information 1d.

  The performance information management unit 2-1 manages the performance of the L0 / L1 network. The performance of the L0 / L1 network includes, for example, a history of performance values (eg, CPU frequency, memory amount, processing traffic amount) of devices arranged in the L0 / L1 network. The performance information management unit 2-1 outputs the performance management result of the L0 / L1 network as performance information 2a. The performance information 2a includes alarm information indicating that a fault that can be clearly confirmed has occurred unlike an intermittent fault or a silent fault.

  The performance information management unit 2-2 manages the performance of the L2 / L1.5 network. The performance of the L2 / L1.5 network includes, for example, a history of performance values (eg, CPU frequency, memory amount, processing traffic amount) of devices arranged in the L2 / L1.5 network. The performance information management unit 2-2 outputs the performance management result of the L2 / L1.5 network as performance information 2b. The performance information 2b includes upper layer alarm information indicating that the current performance value has decreased to a predetermined threshold value or more than the past performance value.

  The performance information management unit 2-3 manages the performance of the L3 network. The performance of the L3 network includes, for example, a history of performance values (eg, CPU frequency, memory amount, processing traffic amount) of devices arranged in the L3 network. The performance information management unit 2-3 outputs the performance management result of the L3 network as performance information 2c. The performance information 2c includes upper layer alarm information indicating that the current performance value has decreased to a predetermined threshold value or more than the past performance value due to the MIB traffic monitoring.

  The user report management unit 2-4 manages user reports generated on the service network. The user report is a report output from a user terminal (not shown) of a user who uses a predetermined service, and includes, for example, a report that suggests a decrease in traffic exceeding a predetermined threshold. The user report management unit 2-4 outputs the management result of the user report as report information 2d. The report information 2d can be, for example, information in which the content of the user report, the timing when the report is made, and the identifier of the user terminal that made the report are associated. The content of the user report includes upper layer alarm information.

  The inter-layer accommodation information 3a indicates the accommodation relationship between devices arranged between different layers with respect to the devices arranged in layers such as the L0 / L1 network, the L2 / L1.5 network, the L3 network, and the service network. Information.

  The confirmation order determining unit 3 determines the lower layer component group based on the network configuration information 1a to 1d, the performance information 2b, 2c, the upper layer warning information included in the declaration information 2d, and the interlayer accommodation information 3a. The order of confirmation of which component is to be subjected to detailed analysis and confirmation is determined (ranking of components). The confirmation order determination unit 3 outputs the processing result related to the determination of the confirmation order as confirmation order information 3b (see FIG. 2B). The confirmation order determination unit 3 follows the confirmation order determination rule using the parameters of the area analysis regarding the determination of the confirmation order. The confirmation order determination rule can be appropriately determined by the administrator of the communication system, for example, and is stored in the storage unit of the failure location device 100.

  The failure location specifying unit 4 performs detailed analysis along the component confirmation order indicated in the confirmation order information 3b. Specifically, the failure location specifying unit 4 acquires the performance information 2a to 2c at different points in time, and analyzes the past performance and the current performance for the devices belonging to the component at the suspected place, thereby finally Identify the fault location. The details of this analysis are well known and will not be described.

≪Details of each parameter≫
Each of the area analysis parameters will be described in detail.

<Number of detections>
As already described, it is possible to adopt a confirmation order in which components with a large number of detected abnormalities are preferentially confirmed. The simplified configuration diagram shown in the upper part of FIG. 4A is the same as that of FIG. The paths [1] to [3] drawn in the upper part of FIG. 4A are the same as the paths [1] to [3] drawn in FIG. Further, it is assumed that a failure (shown by x) occurs in OMS B.

As shown in the upper part of FIG. 4A, when there is no detection omission, the number of detections of OMS B is maximum among OMS A to C, and OMS B is given priority as a suspected place (for OMS D, L3 Ignore it because no path is set on the network).
For example, a detection omission in path [1] may occur. In this case, the number of detections of the OMS A to C that accommodate the devices through which the path [1] passes is reduced by 1 as compared with the case where there is no detection omission (see the lower part of FIG. 4A). In addition, for example, there are cases where a user report is leaked in the service network when an intermittent failure or a silent failure occurs, or a case where the traffic fluctuation threshold for detecting an abnormality is not reached when monitoring a traffic MIB in the L3 network. .

Even when there is a detection failure in the path [1], the number of detections of OMS B is the maximum among OMS A to C, and therefore OMS B can be prioritized as a suspected place. Thus, it is useful to use the number of detections as a parameter for area analysis.
As shown in the lower part of FIG. 4 (a), when there is a detection failure in path [1], OMS B is also the maximum (66%) for the detection rate, and OMS B is suspected using the detection rate. It can be given priority as a location.

<Detection rate>
As already described, it is possible to adopt a confirmation order in which components with a high abnormality detection rate are preferentially confirmed. The simplified configuration diagram shown in the upper part of FIG. 4B has the same paths [1] to [3] as compared to the simplified configuration diagram shown in the upper part of FIG. The difference is that OMS B is changed to OMS C.

  As shown in the upper part of FIG. 4B, in principle, there is no detection in the path [3] for the actual failure of the OMS C. For this reason, when there is no detection omission, the number of detections of OMS B and C among OMS A to C is the same number (2). Therefore, focusing on the detection rate, the detection rate of OMS C is larger than the detection rate of OMS B due to the difference in the number of accommodated OMS B and C (number of arrows). Therefore, OMS C can be prioritized as a suspected place. Thus, it is useful to use the number of detections as a parameter for area analysis.

  As shown in the lower part of FIG. 4B, when there is a detection failure in the path [1], the detection in the path [1] is not counted, but the OMS C is the maximum (50 %), And OMS C can be prioritized as a suspected location using the detection rate.

<Nearby information>
A confirmation order of preferentially confirming (adjacent) components adjacent to the priority component determined by other parameters using the neighborhood information representing the adjacent relationship between the components can be employed. Specifically, the neighborhood information can be expressed as a neighborhood component in FIG. Compared to the simplified configuration diagram shown in the upper part of FIG. 4A, the simplified configuration diagram shown in the upper part of FIG. 4C has a path [4] added in addition to the paths [1] to [3]. Is different. The path [4] is a logical communication path that passes through the routers 31 to 33, but is different from the path [3]. In the simplified configuration diagram shown in the upper part of FIG. 4C, the actual failure occurrence location is OMS B (illustrated by x).

  As shown in the upper part of FIG. 4C, when there is no detection omission, the number of detections of OMS B is the maximum (4) among OMS A to C, and OMS B is given priority as a suspected location.

  When a detection failure occurs in the path [2], the number of detections of the OMS B and C that accommodate the device through which the path [2] passes is reduced by 1 as compared with the case where there is no detection failure (FIG. 4C ) See below). As a result, the number of detections of OMS A is the same as the number of detections of OMS C, and there is no superiority or inferiority between OMS A and C with respect to the number of detections. Therefore, when attention is paid to the detection rate as the second parameter, since OMS A is not affected by detection omission in path [2], the detection rate of OMS A (100%) is higher than the detection rate of OMS B (75%). ) Is larger. Therefore, although OMS A is selected as the highest priority suspected location, such selection is different from the actual failure occurrence location (OMS B).

  As described above, when there is no failure in the component selected by any of the parameters, a confirmation order of preferentially confirming the vicinity of the selected component can be adopted. A component in the vicinity of OMS A, which is a component selected when a detection failure in path [2] occurs (see FIG. 2 (b) and the explanation with reference to FIG. 2 (b)), OMS B, D. OMS D is excluded because no path is set for the device accommodated by the OMS D. As a result, the remaining OMS B (actual failure occurrence location) is selected as the highest priority suspect location in place of OMS A. When there is no failure in the component selected using parameters such as the number of detections and the detection rate (OMS A in FIG. 4C), there is a high possibility that a failure has occurred in the vicinity of the selected component. Therefore, it is useful to use neighborhood information as a parameter for area analysis.

  In general, when the number of detections and the detection rate are used, there is a high possibility that the same accommodation connection as the failed part is erroneously selected as the suspected part. According to the example of FIG. 4C, since OMS A and B have the same accommodation connection in three paths [1], [3], and [4], OMS B (actual failure occurrence location) There is a high possibility that OMS A (the component with the highest detection rate) is selected instead of. Like OMS A and B, components that accommodate many of the same connections have similar topologies, and therefore the neighborhood information is more effective than the number of detections and the detection rate.

<Failure rate>
A confirmation order in which components with a high failure rate are preferentially confirmed can be adopted. The simplified configuration diagram shown in FIG. 5A is the same as that in FIG. The paths [1] to [3] depicted in FIG. 5A are the same as the paths [1] to [3] depicted in FIG. As compared with FIG. 2A, in FIG. 5A, it is assumed that a failure (indicated by x) occurs in OMS A.

  It is assumed that an abnormality is detected in all the paths [1] to [3]. Therefore, the abnormality detection in the path [2] that does not pass through the device that is not accommodated by the OMS A is a false detection. Further, with respect to FIG. 5A, a table relating to determination of the confirmation order for each OMS is as shown in FIG. 5B.

  For example, an OMS with a high number of detections is given priority, an OMS with the same number of detections is given priority to an OMS with a high detection rate, and an OMS with the same detection rate is given priority to an OMS with a high failure rate. Assume that a decision rule is adopted. In this case, as shown in FIG. 5B, the confirmation order of OMS B with the maximum number of detections (3) is first, and the confirmation order of OMS D with the minimum number of detections (0) is fourth. Become.

  OMS A and C have the same detection number and detection rate (detection number: 2, detection rate 100%). Therefore, paying attention to the failure rate, OMS A has a higher failure rate (0.2), so OMS A is given priority over OMS C. As a result, detailed analysis is performed in the order of B → A → C → D.

  It is also possible to adopt a confirmation order decision rule that places importance on the failure rate. For example, an OMS with a high failure rate may be prioritized, and for an OMS with the same failure rate, a confirmation order determination rule that prioritizes an OMS with a larger parameter in the order of the number of detections and the detection rate may be employed. If this rule is followed, it is possible to determine the OMS A with the highest failure rate as the suspected place with the highest priority.

<Rate of no failure>
A confirmation order of preferentially confirming components with a low rate of not failing can be adopted. The “rate of failure of the component of interest” refers to the probability that a component other than the component of interest has failed from the failure rate of each component (obtained in advance). Or, based on the failure rate, it can be said that it is the probability that a lower layer device belonging to each of the components has not failed for abnormality detection. A rate of failure for each component is obtained for all abnormality detections, and a component having a small rate of failure is determined.

The non-failure rate will be described using the simplified configuration diagram shown in FIG. In FIG. 6A, it is assumed that paths [1] and [2] are set on the L3 network.
The path [1] is a logical communication path that passes through the routers 31 to 34. Therefore, OMSs that accommodate devices on the L3 network through which the path [1] passes are OMS A, B, and C.
The path [2] is a logical communication path that passes through the routers 33, 32, and 34 in this order (or the reverse order). Therefore, the OMSs that accommodate the devices on the L3 network through which the path [2] passes are OMS B and D.

  Assume that a failure (indicated by x) occurs in OMS A. Further, it is assumed that an abnormality is detected in all the paths [1] and [2]. Therefore, the abnormality detection in the path [2] that does not pass through the device accommodated by the OMS A is a false detection. Also, with respect to FIG. 6A, a table relating to determination of the confirmation order for each OMS is as shown in FIG. 6B.

The failure rates of OMS A to D are PA, PB, PC, and PD, respectively. The failure location device 100 of the present embodiment can determine the failure rate for each component with respect to the failure rates PA, PB, PC, and PD. For example, when OMS B is described, “a rate at which B does not fail with respect to abnormality detection on path [1]”, “a rate at which B does not fail with respect to abnormality detection on path [2]”, In addition, three types of “rate that B does not fail with respect to anomaly detection on paths [1] and [2]” can be obtained. The calculation formulas for the three types of B non-failure rates are as follows.
The rate at which B does not fail with respect to anomaly detection on path [1] = (1-PB) [1- (1-PA) (1-PC)]
The rate at which B does not fail with respect to anomaly detection on path [2] = (1-PB) [1- (1-PD)] = (1-PB) PD
The rate at which B does not fail with respect to anomaly detection on path [1] [2] = (1-PB) [1- (1-PA) (1-PC)] PD

  For example, the value of the rate at which each OMS does not fail can be registered in the “non-failed rate” in the table of FIG. , OMS A to D non-failed rate is registered. Of the registered non-failure rates, the smallest OMS can be determined as the highest priority suspected place.

<Extended detection number (weighted detection number)>
It is possible to adopt a confirmation order in which the concept of the number of detections already described is expanded and the expanded components with a large number of detections are preferentially confirmed. The smaller the number of components that accommodate the device through which the path where the abnormality is detected is, the higher the importance of the failure when viewed from the component. Therefore, a path with a small number of corresponding components is given a large weight, and the number of detections for each component is calculated. For the weight, the reciprocal of the number of components accommodating the device through which one path passes can be used, but the weight is not limited to this.

The extended number of detections will be described using the simplified configuration diagram shown in FIG. In FIG. 7A, it is assumed that paths [1] to [3] are set on the L3 network.
The path [1] is a logical communication path that passes through the routers 31 to 34. Therefore, OMSs that accommodate devices on the L3 network through which the path [1] passes are OMS A, B, and C.
The path [2] is a logical communication path that passes through the routers 32 to 34. Therefore, the OMSs that accommodate the devices on the L3 network through which the path [2] passes are OMS B and C.
The path [3] is a logical communication path that passes through the routers 35 and 31 to 33. In FIG. 7A, the router 35 is a device on the L3 network. Reference numeral 25 is, for example, an MPLS-TP device on an L2 / L1.5 network. Reference numeral 15 is, for example, OXC. OMS E is formed between OXCs 11 and 15. OMSs that accommodate devices on the L3 network through which the path [3] passes are OMS E, A, and B.

  Assume that a failure (indicated by x) occurs in OMSC. Further, it is assumed that an abnormality is detected in all the paths [1] to [3]. Therefore, the abnormality detection in the path [3] that does not pass through the device accommodated by the OMS C is a false detection. Also, with respect to FIG. 7A, a table relating to determination of the confirmation order for each OMS is as shown in FIG. 7B.

  In FIG. 7A, the number of components corresponding to the path [1] is three. Therefore, the reciprocal 1/3 (= 2/6) of 3 is set as a weight for the path [1]. The number of components corresponding to the path [2] is two. Therefore, the reciprocal 1/2 of 2 (= 3/6) is set as a weight for the path [2]. The number of components corresponding to path [3] is three. Therefore, the reciprocal 1/3 (= 2/6) of 3 is set as a weight for the path [3].

  It is assumed that a confirmation order determination rule is adopted that determines the confirmation order based on the priorities of the expanded number of detections, the detection rate, and the failure rate (neighbor information is not used). Referring to the table of FIG. 7B, the number of detections of OMS A (not expanded) is 2, but the expanded number of detections is the weight (2/6) + OMS for the path [1] accommodated in OMS A The weight (2/6) = 4/6 for the path [3] accommodated in A.

In addition, the number of detections of OMS B (not expanded) is 3, but the expanded number of detections is the weight (2/6) for path [1] accommodated in OMS B + path [2] accommodated in OMS B Weight (3/6) + weight (2/6) = 7/6 for path [3] accommodated in OMS B.
Similarly, the number of detections of OMS C (not expanded) is 2, but the expanded number of detections is the weight (2/6) for the path [1] accommodated in OMS C + the path accommodated in OMS B [ 2] (3/6) = 5/6.
Similarly, the number of detections of OMS E (not expanded) is 1 (false detection), but the expanded number of detections is weight = 2/6 for path [3] accommodated in OMS E.

  According to the table of FIG. 7B, when the number of detections (not expanded) is used, the number of detections (not expanded) and the detection rate are the same for OMS A and C. , OMS A confirmation order (2nd place) exceeds OMS C confirmation order (3rd place). However, when the extended detection number is used, the extended detection number (5/6) of OMS C exceeds the extended detection number (4/6) of OMS A. For this reason, the result that the confirmation order (2nd place) of OMS C is higher than the confirmation order (3rd place) of OMS A is obtained. This means that by using the expanded number of detections, it is possible to improve the accuracy of estimation using an actual failure location (OMSC) as a suspect location.

<Combination of area analysis parameters>
By combining the parameters described above (number of detections, detection rate, proximity information (neighboring components), failure rate (or failure rate)), the component confirmation order can be determined. Note that it is not necessary to use all types of parameters.
The combination of parameters will be described with reference to the simplified configuration diagram shown in FIG. In FIG. 8A, it is assumed that paths [1] to [4] are set on the L3 network.
The path [1] is a logical communication path that passes through the routers 31 to 34. Therefore, OMSs that accommodate devices on the L3 network through which the path [1] passes are OMS A, B, and C.
The path [2] is a logical communication path that passes through the routers 32 to 34 in this order (or the reverse order). Therefore, the OMSs that accommodate the devices on the L3 network through which the path [2] passes are OMS B and C.
The path [3] is a logical communication path that passes through the routers 35 and 31 to 33. Therefore, the OMSs that accommodate the devices on the L3 network through which the path [3] passes are OMS E, A, and B.
The path [4] is a logical communication path that passes through the routers 35 and 31. Therefore, the OMS that accommodates the device on the L3 network through which the path [4] passes is OMS E.

  Assume that a failure (illustrated by x) occurs in OMS B. Further, it is assumed that an abnormality is detected in the paths [1], [2], and [4]. Therefore, the abnormality detection in the path [4] that does not pass through the device accommodated in the OMS B is a false detection. Further, there is no abnormality detection in the path [3] via the device accommodated by the OMS B, and there is a detection failure in the path [3]. A broken-line arrow in FIG. 8A indicates the relationship between the path on the L3 network and the OMS that accommodates the device through which the path passes, and indicates that there was a detection omission in the path. Also, with respect to FIG. 8A, a table relating to determination of the confirmation order for each OMS is as shown in FIG.

(Combination method 1)
When using a combination of parameters, for example, there is a method in which a priority is assigned to each parameter, and a component confirmation order is determined from a parameter having a high priority. In this method, components having the same value in a parameter having a high priority are determined using the parameter having the next highest priority. This method is the same as the confirmation order determination rule described above. The failure location device 100 stores the priority assigned to the parameter as priority information in the storage unit. The priority information can be determined by, for example, an operator of the failure location device 100.

  As shown in FIG. 8B, for example, priority information such as priorities 1, 2, 4, and 3 can be assigned to parameters such as the number of detections, detection rates, neighboring components, and failure rates. The priority is higher in the order of priorities 1, 2, 3 and 4. In this case, the order of confirmation is determined by the priority of the number of detections, detection rate, failure rate, and neighboring components.

Whether or not to use the neighborhood information (neighbor component) can be appropriately determined. When using neighborhood information, the neighborhood of the highest-priority component determined by a parameter that has priority over neighborhood information (a parameter that has a higher priority than that assigned to neighborhood information) and the same parameter that takes precedence over neighborhood information There is a problem of which detailed analysis should be given priority with the runner-up priority component. In this case, for example, a confirmation order may be adopted in which priority is given to the detailed analysis of the vicinity of the highest priority component, and then the detailed analysis of the next priority component is performed.
On the other hand, when the neighborhood information is not used, it means that the neighborhood search is not performed, and can be processed as not giving priority to the neighborhood information.

  According to the table of FIG. 8B, the confirmation order is determined in the order of the number of detections (priority 1) → detection rate (priority 2) → failure rate (priority 3) (rightmost in FIG. 8B). (See the parenthesized numbers in the column). Therefore, the OMS C that maximizes the number of detections (2) and the detection rate (100%) is ranked first. When using the neighborhood information (when priority 4 is given to the neighborhood component), the neighborhood of OMS C is preferentially searched before moving to the next point (that is, OMS B). That is, OMS B and D that are in the vicinity of OMS C are preferentially searched. Since OMS D has a detection number of 0, OMS B has priority over OMS D. As a result, the confirmation order of OMS B is second, and the confirmation order of OMS D is third. As for OMS A and E, OMS A that is next to OMS B and D is given priority over OMS E that is farthest from OMS C over OMS C that has the highest priority. As a result, the confirmation order of OMS A is fourth, and the confirmation order of OMS E is fifth.

  When the neighborhood information is not used (when the priority is not given to the neighborhood component), the neighborhood search is not performed, and therefore, the confirmation order of OMS B which is the next point of OMS C is the second place (the highest in FIG. 8B). (See the value in parentheses on the right column). For the remaining OMS A, D and E, the confirmation order of OMS D where the number of detections is 0 is first. For OMS A and E, the number of detections (1) and the detection rate (50%) are both the same, and in terms of failure rate, OMS E (failure rate 0.3) is better than OMS A (failure rate 0.2). Is also given priority. As a result, the confirmation order of OMS E is third, and the confirmation order of OMS A is fourth.

(Combination method 2)
When using a combination of parameters, for example, there is a method of quantifying and summing up each parameter and determining a component confirmation order so that a component with a large sum is given priority. For example, the parameter can be digitized by multiplying each parameter value by a predetermined coefficient and adding up the values. In the table of FIG. 8B, the total values (a to e) for each OMS are registered.

When using neighborhood information, for example, after calculating a provisional summation value that does not use neighboring components, add a predetermined value to the neighboring component of a component with a high provisional summation value, and obtain a final summation value. It is good to calculate. In the table of FIG. 8B, final combined values (a to e) for each OMS are registered. The order in which the components are confirmed is determined so as to give priority to the component having a large final sum.
By combining the parameters as described above, the specific accuracy of the suspected place can be further improved.

<Removal of false detection>
When it is determined that the detection of an abnormality in the path (group) on the L3 network includes an erroneous detection, the component confirmation order can be determined from the remaining abnormal detections from which the erroneous detection has been removed. For example, it is possible to identify a component corresponding to each abnormality detection, evaluate the similarity between paths in which an abnormality is detected from the identified component, and detect abnormality detection in a path with a small similarity.

The removal of erroneous detection will be described with reference to the simplified configuration diagram shown in FIG. In FIG. 9A, it is assumed that paths [1] to [4] are set on the L3 network.
The path [1] is a logical communication path that passes through the routers 31 to 34. Therefore, OMSs that accommodate devices on the L3 network through which the path [1] passes are OMS A, B, and C.
The path [2] is a logical communication path that passes through the routers 32 to 34 in this order (or the reverse order). Therefore, the OMSs that accommodate the devices on the L3 network through which the path [2] passes are OMS B and C.
The path [3] is a logical communication path that passes through the routers 31 and 32. Therefore, the OMS that accommodates the device on the L3 network through which the path [3] passes is OMS A.
The path [4] is a logical communication path that passes through the routers 33, 32, and 34 in this order (or the reverse order). Accordingly, the OMSs that accommodate the devices on the L3 network through which the path [4] passes are OMS B and D.

  Assume that a failure (indicated by x) occurs in OMSC. Further, it is assumed that an abnormality is detected in the paths [1] to [4]. Therefore, the abnormality detection in the paths [3] and [4] that do not pass through the device accommodated by the OMS C is a false detection.

  FIG. 9B is a table relating to determination of erroneous detection. The failure location device 100 stores information corresponding to the table in FIG. 9B in the storage unit. Also, with respect to FIG. 9 (a), a table relating to determination of the confirmation order for each OMS is as shown in FIG. 9 (c). A confirmation order decision rule that prioritizes the order of detection number, detection rate, and failure rate is adopted.

In the table of FIG. 9B, items such as “abnormality detection path”, “passing component (OMS)”, and “similarity metric” are provided.
The “abnormality detection path” is a path in which an abnormality is detected among the paths set on the L3 network.
The “passing component” indicates a component that accommodates a device on the L3 network in which the target abnormality detection path is set, in OMS units.
The “similarity metric” is an evaluation value for evaluating the similarity between the abnormality detection that has occurred in the target abnormality detection path and the other abnormality detection that has occurred in the corresponding passing component. There are the following examples 1 and 2 in determining the evaluation value.

(Example 1)
As the evaluation value, for each passing component corresponding to the abnormality detection path, the maximum number of other abnormality detection paths corresponding to the passage component is used. In other words, the evaluation value of Example 1 can be said to be the maximum number of abnormality detections shared by the same component.

For example, when attention is paid to the abnormality detection path [1] in the table of FIG. 9B, the corresponding passing components are OMS A, B, and C.
OMS A shares the abnormality detection of the abnormality detection path [3] in addition to the abnormality detection of the abnormality detection path [1] of interest. Therefore, the number of abnormality detections shared by OMS A is 1.
The OMS B shares the abnormality detection of the abnormality detection paths [2] and [4] in addition to the abnormality detection of the abnormality detection path [1] of interest. Therefore, the number of abnormality detections shared by OMS B is two.
Further, the OMS C shares the abnormality detection of the abnormality detection path [2] in addition to the abnormality detection of the abnormality detection path [1] of interest. Therefore, the number of abnormality detections shared by OMS C is 1.
According to the above, since 2 which is the number of abnormality detections shared by OMS B is the maximum number, 2 is registered in the “similarity metric” as the evaluation value.

Evaluation values can be obtained for the other abnormality detection paths [2] to [4] in the table of FIG.
For the abnormality detection path [2], the number (2) of abnormality detections shared by the OMS B is the maximum number, so 2 is registered in the “similarity metric” as the evaluation value.
For the abnormality detection path [3], the number (1) of abnormality detections shared by OMS A is the maximum number, so 1 is registered as the evaluation value in the “similarity metric”.
For the abnormality detection path [4], the number (2) of abnormality detections shared by the OMS B is the maximum number, so 2 is registered as the evaluation value in the “similarity metric”.

  Anomaly detection that does not share anomaly detection with any of the other components, or anomaly detection with a relatively small number of anomaly detections shared with other components, is a false detection (when there is no double failure). It can be considered that there is a high possibility. Therefore, in Example 1, the abnormality detection path [3] having the smallest evaluation value can be a candidate to be removed as an erroneous detection.

(Example 2)
In this method, the evaluation value is the number of other abnormality detection paths corresponding to at least one passing component corresponding to the abnormality detection path. In other words, the evaluation value of Example 2 can be said to be the number of abnormality detections shared by any component.

For example, when attention is paid to the abnormality detection path [1] in the table of FIG. 9B, the corresponding passing components are OMS A, B, and C. At least one of the OMSs A, B, and C shares three abnormality detections of the abnormality detection paths [2] [3] [4]. Therefore, 3 is registered in the “similarity metric” as the evaluation value.
Evaluation values can be obtained for the other abnormality detection paths [2] to [4] in the table of FIG.
For the abnormality detection path [2], at least one of the OMS B and C shares the two abnormality detections of the abnormality detection path [1] [4]. Therefore, 2 is registered in the “similarity metric” as the evaluation value.
For the abnormality detection path [3], OMS A shares one abnormality detection of the abnormality detection path [1]. Therefore, 1 is registered in the “similarity metric” as the evaluation value.
For the abnormality detection path [4], at least one of OMS B and D (only B according to FIG. 9A) shares the two abnormality detections of the abnormality detection path [1] [2]. Therefore, 2 is registered in the “similarity metric” as the evaluation value.

  As in Example 1, an anomaly detection that does not share an anomaly detection with any of the other components, or an anomaly detection that has a relatively small number of anomaly detections shared with other components (no double failure) Case) When the possibility of erroneous detection is considered high, the abnormality detection path [3] having the smallest evaluation value can be a candidate to be removed as erroneous detection.

  In the table of FIG. 9C, when the abnormality detection path [3] is not removed as a false detection, the number of detections is the same between OMS A and OMS C. However, due to the difference in failure rate, the order of confirmation of OMS A (second place) exceeds that of OMS C (third place). Here, when the abnormality detection path [3] is removed as an erroneous detection, the number of detected OMS A is reduced from “2” to “1”. Accordingly, the detection rate of OMS A becomes “50%”. Therefore, OMS C is given priority due to a decrease in the number of detected OMS A, and the confirmation order is second. Accordingly, the rank of OMS D (third place) and the rank of OMS A (fourth place) are determined based on the detection rate. As a result, it is possible to improve the confirmation order (third place → second place) of OMSC which is an actual failure location.

  If it can be determined that there is a false detection as in the example of FIG. 9, by removing it, the order of confirmation of the corresponding components can be lowered, and the estimation accuracy of the suspected place can be further improved.

<Determination between layers>
When estimating the suspicious location of the lower layer on a component basis from the upper layer anomaly detection (eg, user declaration, traffic reduction), it is possible to narrow down the suspicious location of the lower layer using the confirmation result of the upper layer normality confirmation There are cases where it is possible. If this narrowing effect is sufficient to compensate for the time loss associated with the higher layer normality confirmation, it is useful to reinforce the area analysis of the lower layer with the confirmation result of the higher layer normality confirmation.

For example, in the configuration diagram of the communication system of FIG. 1, a specific example for a case where only the paths [2] and [3] are set on the L3 network and the path [1] is not set. explain. It is assumed that two sections of OMS A and B are suspected candidates due to a user declaration made on the service network (path between the servers 41 and 43 (dashed line)). In this case, the following two measures can be considered.
Solution 1: Perform a two-dimensional analysis of the two sections of OMS A and B.
Countermeasure 2: A surface analysis is performed after reinforcing the information by checking the normality of the L3 network.

  In response to the user declaration to the service network, the normality of the two paths [2] and [3] passing through the devices on the L3 network accommodated by the suspected OMS A and B is confirmed. The method for confirming the normality of the path on the L3 network is well known and will not be described. As a result, it is assumed that the suspect candidates can be narrowed down to one section of OMS B by checking the normality of the path on the L3 network. This narrowing down to one section is realized even in the worst case where it is expected that the probability of failure of each of the lower layer devices belonging to the range of the suspected candidate is uniformly distributed. Suppose you can.

  For example, if the time required for checking the normality of the path on the L3 network is in the time order and the time required for the area analysis of the OMS for each section is in the day order, the section can be narrowed down to the OMS1 section even in the worst case. Therefore, it can be said that it is more useful to select the countermeasure 2 because the failure position can be specified in a short time.

  Utilize analysis overhead information, which is the operating time required for one-component area analysis. The failure location device 100 stores analysis overhead information in a storage unit. It is assumed that the content of the analysis overhead information, that is, the operation time of the analysis target is known to the operator.

In general, if the relational expression "the lower layer analysis overhead is reduced by improving the failure location estimation accuracy">"the higher layer analysis overhead for improving the failure location estimation accuracy" is satisfied, the failure location estimation Priority is given to improving accuracy, that is, checking the normality of higher-layer paths.
Here, the estimated accuracy is the number of worst-case procedures, that is, the number of suspected candidate components (the probability that the failure is estimated in each of the lower layer devices belonging to the suspected candidate range is uniformly distributed. The number of analysis procedures when it can be expressed as an expected value.
The “lower layer analysis overhead” refers to the total analysis overhead of each lower layer device corresponding to the suspected candidate for the lower layer.
The “lower layer analysis overhead reduction effect” corresponds to the total analysis overhead of each lower layer device excluded by narrowing down the suspect candidates.
The “upper layer analysis overhead” refers to the total analysis overhead of the upper layer devices accommodated by the lower layer suspect candidates.

Speaking of the above specific example (in the case of the worst case calculation), “the effect of reducing the analysis overhead of the lower layer by improving the estimation accuracy of the fault location” is (the OMS of two sections when the normality of the L3 network is not confirmed) -OMS of one section after normality check of L3 network) × Daily order = 1 × Reduction in daily order.
The “upper layer analysis overhead for improving the estimated accuracy of the fault location” can be expressed as 2 paths set in L3 network × time order = 2 × time order. According to the above relational expression, it can be said that it is useful to perform normality of the L3 network because time reduction of several minutes is expected.

≪Summary≫
According to this embodiment, it is possible to obtain the parameter distribution in the component unit of the lower layer from the abnormality detection of the upper layer that appears stochastically and makes it difficult to identify the failure position of the lower layer. A component having an extreme value in the parameter can be found in such a distribution, and the found component can be estimated as a component in which a failure has occurred. Thereby, the suspected range of the failure of the lower layer can be narrowed down. In other words, it is possible to efficiently narrow down the target for performing detailed analysis with a great burden in order to finally specify the position of the failure in the lower layer.
Therefore, it is possible to reduce the operation for specifying the position of the failure that has occurred in the lower layer with respect to the abnormality detection of the upper layer.

  In addition, by performing ranking according to the parameter values for a plurality of components, it is possible to determine a component for which detailed analysis is preferentially performed. For this reason, by performing detailed analysis in order from the component with the highest priority, it is possible to further reduce the operation for specifying the position of the failure in the lower layer.

  In addition, the parameter is any one of the number of detected components, the detection rate, the failure rate, the non-failure rate, and the number of weighted detections, thereby quantifying the distribution of each type of parameter in the lower layer component units. be able to. Therefore, it is possible to easily find a component whose parameter shows an extreme value.

  Further, when there are a plurality of types of parameters, it is possible to realize the estimation of the component in which the failure has occurred using the plurality of types of parameters.

  Further, the detailed analysis can be performed with priority given to the component in the vicinity of the component that is estimated to have a failure in the lower layer, not the failure estimation according to the parameter value.

  In addition, it is possible to obtain the parameter distribution in the component unit of the lower layer after evaluating the similarity between paths and removing the false detection. For this reason, it is possible to improve the accuracy of narrowing down the suspected range of failure in the lower layer.

  The present invention is not limited to the above embodiment, and can be modified without departing from the spirit of the present invention. For example, although the component unit of the lower layer (L0 / L1 network) is OMS, the component may be OCh (Optical Channel), OTU (Optical Transport Unit), etc., which are larger than OMS, or more than OMS. It may be an OTS (Optical Transmission Section) that is a small unit.

  In this embodiment, the confirmation order determination unit 3 ranks the components that are in the suspicious range. However, only the most suspicious component (the confirmation order is first) may be specified. Such identification can speed up the area analysis process.

In addition, it is possible to realize a technique in which various techniques described in this embodiment are appropriately combined.
Further, the software described in the present embodiment can be realized as hardware, and the hardware can also be realized as software.
In addition, hardware, software, processing procedures, and the like can be changed as appropriate without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 100 Failure location device 1-1 to 1-4 Network configuration management unit 1a to 1d Network configuration information 2-1 to 2-3 Performance information management unit 2-4 User report management unit 2a to 2c Performance information 2d Report information 3 Confirmation Order determination unit (control unit: control means)
3a Inter-layer accommodation information 3b Confirmation order information 4 Fault location specifying part

Claims (8)

A fault location device that identifies the location of a fault that has occurred in a lower layer for anomaly detection in an upper layer,
The lower layer devices are classified into component units,
For each component of the lower layer, the abnormality detection of the upper layer is converted into one or more types of parameters,
A control unit that estimates a component in which a failure has occurred using the converted parameter,
A fault location apparatus characterized by that. The controller is
With respect to locating the fault, each of the lower layer components is ranked according to the value of the parameter;
The fault location device according to claim 1. The parameter is
(1) The number of detections in component units, which is the number of paths in which the abnormality is detected, among paths passing through the upper layer devices accommodated by each of the components,
(2) A detection rate in units of components, which is a ratio between the number of accommodations that is the number of paths that pass through the higher-layer device accommodated by each of the components and the number of detections,
(3) a failure rate in units of components determined from past failures of the lower layer devices belonging to each of the components;
(4) Based on the failure rate, a failure rate of component units, which is a probability that the lower layer device belonging to each of the components does not fail for the abnormality detection,
(5) One of the weighted detection numbers in component units, wherein the number of detections is weighted using the reciprocal of the number of components corresponding to each path of the upper layer.
The fault location apparatus according to claim 1 or 2, characterized by the above. There are multiple types of parameters,
The controller is
When estimating a component in which a failure has occurred by combining a plurality of types of the parameters,
Giving priority to each of the plurality of types of combined parameters, and performing the estimation from the high priority parameters,
The fault location apparatus according to any one of claims 1 to 3, wherein The controller is
When there is no failure in the estimated component, it is estimated that a failure has occurred in a component in the vicinity of the estimated component.
The fault location apparatus according to any one of claims 1 to 4, wherein The controller is
For each path of the upper layer where the abnormality was detected, the similarity between the paths is evaluated based on the component corresponding to each of the paths,
Anomaly detection in a path with a small similarity is removed as a false detection,
The fault location apparatus according to any one of claims 1 to 5, wherein A fault location specifying method in a fault location device for identifying the location of a fault that has occurred in a lower layer with respect to abnormality detection in an upper layer,
The lower layer devices are classified into component units,
The fault location device is
For each lower layer component, converting the upper layer anomaly detection to one or more types of parameters;
Performing a step of estimating a component in which a failure has occurred using the converted parameters;
The fault location method characterized by the above-mentioned. A failure location specifying program for causing a computer to function as a failure location specifying device for specifying a location of a failure that has occurred in a lower layer for abnormality detection of an upper layer,
The lower layer devices are classified into component units,
The computer,
For each component of the lower layer, the abnormality detection of the upper layer is converted into one or more types of parameters,
Control means for estimating a component in which a failure has occurred using the converted parameter;
Fault location program to function as

Images