JP6648058B2 - Information processing apparatus, information processing method, and program - Google Patents

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program, and more particularly, to a technique for learning a method of coping with a failure that has occurred in a network.

  2. Description of the Related Art In the event of a failure in a network system, a technique for estimating and narrowing down a suspected failure site is known. Patent Literature 1 discloses a technique for extracting a suspected failure part by sequentially performing polling on each interface included in a path to each node that is a failure, assuming a tree-type network. I have.

JP 2014-53658 A

  The structure of the network is not limited to a tree type, but is various. In a large-scale and complex network, when a failure occurs at one node, the effect spreads to surrounding nodes. Therefore, even if there is a node for which information cannot be obtained by polling, the node is not always the cause of the failure. This is because some nodes have difficulty transmitting and receiving information due to the influence of a node that causes a true failure. For this reason, it is considered that there is room for improvement in the technique for improving the estimation of the cause of a failure in a network, and further improving the accuracy of determining a method of coping with a failure in the network.

  Therefore, the present invention has been made in view of these points, and improves the accuracy of determining a method of coping with a failure in a network.

  A first aspect of the present invention is an information processing device. This device includes: (1) topology information indicating a connection relationship between a plurality of nodes constituting a network; (2) each of one or more faults occurring in the network; An information acquisition unit that acquires failure handling information in which a troubleshooting method including a troubleshooting procedure for the cause and a failure occurrence time are associated with each other, and (3) event information that is time-series data of an event that has occurred in the node. For each of the one or more faults, a related node topology specifying unit for specifying a related node topology configured by using a node that has caused an event due to each fault as an element, and each node configuring the related node topology is generated. Using the time series data of the event and the method of coping with the failure as teacher data, Comprising a learning unit for generating a learning device for outputting a likelihood method by a machine learning, a.

  The related node topology specifying unit includes, for each of the one or more faults, an event extracting unit that extracts a node that has generated an event within a predetermined period including the time of occurrence of each fault, and a node extracted by the event extracting unit. A node extraction unit that extracts, as a connected subgraph-related node topology, a set of nodes in which all nodes existing on a path leading to the cause node generate an event.

  The information processing apparatus may define, as the related fault, a fault in which the cause node is the same, the corresponding action of the cause node is the same, and the node configuring the related node topology is the same among the one or more faults. The learning unit may further include a related fault extracting unit that extracts, as teacher data, time series data of an event generated by each node configuring a related node topology in the related fault and a method of coping with the fault. Is also good.

  The node extraction unit may extract a different related node topology if a manufacturer of a device configuring the node is different.

  The node extraction unit may extract as a different related node topology if the type of the device is different even if the manufacturer of the device configuring the node is the same.

  Even if the manufacturer of the device constituting the node and the type of the device are the same, even if the version of the firmware incorporated in the device is different, the node extraction unit may extract as a different related node topology. Good.

  The information processing apparatus may further include a determination unit that outputs a likelihood of a method of coping with the failure based on an event generated due to the failure of the network and a learning device generated by the learning unit. Good.

  The determination unit outputs the likelihood of a coping method associated with the learning device for each of one or more learning devices generated with respect to a related node topology including a set of nodes that caused the event, and outputs A method for coping with the failure may be determined based on the one or more likelihoods thus obtained.

  A second aspect of the present invention is an information processing method. In this method, a processor acquires topology information indicating a connection relationship between a plurality of nodes constituting a network, each of one or more failures occurring in the network, a method of coping with each failure, and a failure occurrence time. Acquiring fault handling information associated with the event, acquiring event information that is time-series data of an event that has occurred in the node, and generating an event due to each of the one or more faults. Specifying a related node topology configured by using the caused node as an element, and using time series data of an event generated by each node configuring the related node topology and a method of coping with the fault as teacher data, A step of generating a determiner for determining the likelihood of the coping method by machine learning. And, to run.

  A third aspect of the present invention is a program. This program provides a computer with a function of acquiring topology information indicating a connection relationship between a plurality of nodes constituting a network, one or more faults that have occurred in the network, a method of dealing with each fault, and a fault occurrence time. A function of acquiring failure handling information associated with the above, a function of acquiring event information that is time-series data of events occurring in the node, and an event occurring due to each failure for each of the one or more failures A function of specifying a related node topology configured by using the node as an element, a time series data of an event generated by each node configuring the related node topology, and a method of coping with the fault as teacher data; A function to generate a determiner for determining the likelihood of the coping method by machine learning. To.

  According to the present invention, it is possible to improve the accuracy of determining a method of coping with a failure in a network.

FIG. 2 is a diagram schematically illustrating nodes constituting a network and events occurring in the nodes. It is a figure for explaining a hidden Markov model. FIG. 2 is a diagram schematically illustrating a functional configuration of the information processing apparatus according to the embodiment. FIG. 4 is a diagram for explaining topology information according to the embodiment. It is a figure which shows typically the data structure of the troubleshooting information concerning embodiment. FIG. 4 is a diagram schematically illustrating a data structure of event information according to the embodiment. It is a figure which shows typically the data structure of the database which stores the related fault extracted by the related fault extraction part which concerns on embodiment. It is a figure which shows typically the data structure of the learning device database which stores the learning device which the learning part which concerns on embodiment produces. 5 is a flowchart for explaining a flow of information processing executed by the information processing apparatus according to the embodiment.

<Outline of Embodiment>
An outline of the embodiment will be described with reference to FIGS.
FIGS. 1A and 1B are diagrams schematically showing nodes constituting a network and events occurring in the nodes. Specifically, FIG. 1A is a diagram illustrating nodes forming a network, and FIG. 1B is a diagram schematically illustrating time-series data of an event that has occurred in the node. Here, the “event” means that an operation that is not in the normal operation state of the node, such as occurrence of an alarm, occurs.

  In FIG. 1A, white circles with numbers indicated by reference symbols N indicate nodes constituting the network. Although numerals are not given to the parts other than the white circles to which 1 is added in order to prevent complexity, all the white circles to which numbers from 1 to 9 are added in FIG. 1A are nodes constituting the network. . Hereinafter, for convenience of description, a node assigned 1 is referred to as a node N1 in this specification. The same applies to other numbers. For example, a node with 9 is described as a node N9.

  In FIG. 1A, a seven-pointed star indicated by a symbol A indicates that an event has occurred at an adjacent node. To avoid complication, the symbol A is assigned only to the star adjacent to the node N5, but in FIG. 1A, the star A is adjacent to each of the nodes N2, N3, N4, and N8. The star also indicates that an event has occurred at these nodes.

  FIG. 1B shows that an event has occurred at each node in the order of the nodes N2, N4, N3, N2, N5, N8, N5, and N2. In FIG. 1B, a rectangle shown adjacent to the occurrence of an event at the node N8 indicates that a countermeasure for a failure that has occurred at the node 8 has been performed.

  When a failure occurs in a node configuring the network, an event such as an alarm may occur in another node due to the failure. In this case, the event that occurs due to the failure is considered to be temporally closer to the failure occurrence time. On the other hand, events that occur at a time close to the time of occurrence of a certain failure are not always caused by the failure. For this reason, the information processing device 1 according to the embodiment classifies an event that has occurred in each node of the network for each fault that has caused the event.

In the embodiment, a “node caused by a failure” is a node that satisfies the following three conditions.
(Condition 1) A node that has generated an event within a predetermined period D including a time at which a failure has occurred in a node that caused the failure (hereinafter, referred to as a “cause node”).
(Condition 2) All nodes existing on the route up to the cause node must be nodes that are generating events.
(Condition 3) The corresponding actions of the cause nodes are the same.

  In FIG. 1A, a node N8 is a cause node. Also, in FIG. 8B, the arrow indicated by the symbol D is the predetermined period D in the condition 1. As shown in FIG. 1B, the nodes that generate events within the predetermined period D are the nodes N2, N3, N4, N5, N8, and N5. Further, from FIG. 1A, a set of nodes in which all the nodes existing on the route to the node N8 which is the cause node have generated an event are the node N2, the node N5, and the node N8. The node N3 and the node N4 each generate the event within the predetermined period D and thus satisfy the condition 1, but do not satisfy the condition 2 because the node N6 does not generate the event.

  Hereinafter, in this specification, a set of nodes satisfying the above three conditions and their connection relationship will be referred to as “related node topology”. In FIG. 1A, a set of nodes surrounded by a dashed line (a set including nodes N2, N5, and N8 as elements and their connection relations) is a related node topology. The information processing apparatus according to the embodiment uses, as a unit, a related node topology, which is a subset of nodes constituting a network, as machine learning, using event information, which is time-series data of an event, a cause node, and corresponding action as teacher data. To generate a learning device for outputting the likelihood of the coping method of the fault.

  When the information processing apparatus according to the embodiment generates a learning device using the related node topology as a unit instead of the entire network, it is possible to exclude the event information of the node not caused by the failure from the teacher data. As a result, the information processing apparatus according to the embodiment can improve the accuracy of estimating a failure in the network.

  The machine learning method used in the embodiment uses, for example, a known method such as a hidden Markov model (hereinafter, referred to as “HMM”), a neural network, a support vector machine (Support Vector Machine), or the like. Perform machine learning. Hereinafter, an HMM will be described as an example of machine learning.

[HMM model]
FIG. 2 is a diagram for explaining the HMM, and is a diagram schematically illustrating an HMM model of an event generation process in the related node topology illustrated in FIG. In the HMM, each event observed at each node is described by an unobservable “state”. In the HMM illustrated in FIG. 2, each event that occurs in the related node topology including the nodes N2, N3, and N8 as elements is expressed by internal states S1, S2, and an output probability from the state S3.

  In FIG. 2, a1, a2, and a3 (where a1 + a2 + a3 = 1.0) indicate the probabilities that the states S1, S2, and S3 are the initial states of the HMM, respectively. Aij (i, j = 1, 2, 3) indicates a transition probability from the state Si to the state Sj. For example, the transition probability from the state S1 to the state S2 is a12, and the transition probability from the state S3 to the state S2 is S32. In the example of the HMM shown in FIG. 2, each state always transitions to any other state. Since the state S1 transits only to the state S2, the transition probability a12 is 1.0 (100%). Since the state S2 transits to either the state S1 or the state S3, a21 + a23 = 1.0.

  In FIG. 2, bij (i, j = 2, 5, 8) indicates a probability that an event will occur at the node Nj when the HMM is in the state Si. For example, the probability that an event will occur at the node N5 when the HMM is in the state S2 is b25, and the probability that an event will occur at the node N8 when the HMM is the state S3 is b38.

  In the related node topology including the node N2, the node N5, and the node N8 illustrated in FIG. 1A, as illustrated in FIG. 1B, in the order of the node N2, the node N5, the node N8, and the node N5. An event has occurred. According to the HMM shown in FIG. 2, in order for an event to occur in the order of the node N2, the node N5, the node N8, and the node N5, a transition is made in the order of the state S1, the state S2, the state S3, and the state S2. Or state S2, state S3, state S2, and state S1 in this order.

  The former occurrence probability P1 is a1 × b12 × a12 × b25 × a23 × b38 × a32 × b25. The latter occurrence probability P2 is a2 × b22 × a23 × b35 × a32 × b28 × a21 × 15. Therefore, in the HMM shown in FIG. 2, the likelihood that an event will occur in the order of node N2, node N5, node N8, and node N5 is P1 + P2.

  The information processing apparatus according to the embodiment calculates an HMM learner for each of a plurality of different related node topologies by learning based on the following three pieces of information. Specifically, the information processing apparatus according to the embodiment calculates the parameters ai, aij, and bij of the HMM by using, for example, a known Baum-Welch algorithm.

(Information 1) Topology information indicating a connection relationship between a plurality of nodes constituting a network.
(Information 2) Failure handling information that associates each of one or more failures that have occurred in the network, a handling method including a cause node that caused each failure and a corresponding action for the cause, and a failure occurrence time.
(Information 3) Event information that is time-series data of an event that has occurred in a node.

  When an event occurs in a network, the information processing apparatus according to the embodiment selects one or more learning devices that include the node that caused the event in the related node topology, and performs an event processing for each of the selected learning devices. Calculate the probability of occurrence. Each learning device is associated with a coping method of the cause node. The event occurrence probability calculated using each learning device is the likelihood of the cause node causing the event and the coping method thereof. The information processing apparatus according to the embodiment determines a method of coping with a failure based on, for example, the likelihood calculated using each learning device.

  FIG. 2 shows an example of an HMM in which a state transition does not occur between the state S1 and the state S3. However, even when an HMM in which a state transition occurs between the state S1 and the state S3 is employed. Good. Further, an HMM in which a transition to the same state (for example, a transition from the state S2 to the state S2) may be adopted. Further, in the HMM shown in FIG. 2, there are events that do not occur in a certain state, such as no event occurring in the node N8 in the state S1, but all events can occur in all states. An HMM model may be adopted. Which HMM is used may be determined by experiment in consideration of the network structure, calculation cost, and the like.

<Functional configuration of information processing device>
Hereinafter, the information processing apparatus according to the embodiment will be described in more detail with reference to FIG.
FIG. 3 is a diagram schematically illustrating a functional configuration of the information processing apparatus 1 according to the embodiment. The information processing device 1 according to the embodiment includes a storage unit 10 and a control unit 20. The control unit 20 includes an information acquiring unit 21, a related node topology specifying unit 22, a related fault extracting unit 23, a learning unit 24, and a determining unit 25.

  The storage unit 10 includes a ROM that stores a basic input output system (BIOS) of a computer that implements the information processing apparatus 1, a RAM (Random Access Memory) that is a work area of the information processing apparatus 1, an OS (Operating System), and an application. It is a large-capacity storage device such as a hard disk drive (HDD) or a solid state drive (SSD) that stores programs and various information referred to when the application program is executed.

  The control unit 20 is a processor such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit) of the information processing device 1, and executes a program stored in the storage unit 10 to execute the information acquisition unit 21 and the related nodes. It functions as the topology specifying unit 22 (the event extracting unit 221 and the node extracting unit 222), the related fault extracting unit 23, the learning unit 24, and the determining unit 25.

  The information acquisition unit 21 acquires the above-described three pieces of information (topology information, failure handling information, and event information). The topology information, the troubleshooting information, and the event information are stored in the storage unit 10. Hereinafter, the topology information, the failure handling information, and the event information will be described with reference to FIG. 4, FIG. 5, and FIG.

[Topology information]
FIGS. 4A and 4B are diagrams for explaining topology information according to the embodiment. Specifically, FIG. 4A is a diagram schematically illustrating the connection relationship of the network, and FIG. 4B is a schematic diagram illustrating the data structure of the topology information indicating the connection relationship illustrated in FIG. FIG. Note that the network connection shown in FIG. 4A is the same as the network connection shown in FIG.

  As shown in FIG. 4B, the topology information according to the embodiment is managed by assigning a node ID (Identification) for identifying each node constituting the network. FIG. 4B shows an example in which NID0005 is assigned as the node ID of the node N5. Similarly, NID000i is assigned to each of the nodes Ni (i = 1, 2,..., 9).

  As shown in FIG. 4A, the node N5 is connected to the nodes N1, N2, and N8. For this reason, as shown in FIG. 4B, a node whose node ID is NID0005 is associated with NID0001, NID0002, and NID0008 as connection nodes. The topology information also includes node type information including the description type, model, and firmware version of each node, the node installation area ID assigned to each area where the node is installed, and each node ID. Corresponding.

[Troubleshooting information]
FIG. 5 is a diagram schematically illustrating a data structure of the troubleshooting information according to the embodiment. As shown in FIG. 5, the failure handling information according to the embodiment manages information by assigning a failure ID for uniquely identifying a failure to each failure. FIG. 5 illustrates failure handling information regarding a failure in which the node whose node ID is NID0008 (that is, the node N8) is the cause node. As shown in FIG. 5, the node N8 is a switch, which indicates that the device has been replaced as a response to the failure. The failure occurrence time was 11:54:32 am on February 23, 2017, the failure response time was 1:46:57 pm on the same day, and the recovery time was 2:01:23 pm on the same day. It is.

[event information]
FIG. 6 is a diagram schematically illustrating a data structure of event information according to the embodiment. As illustrated in FIG. 5, the event information according to the embodiment manages information by assigning an event ID for uniquely identifying an event that has occurred in each node to each event. FIG. 6 illustrates that an alarm has occurred at the node N5 due to an increase in the temperature of the device. At the node N5, the alarm occurs on February 23, 2017 at 10:11:22 AM, and the recovery is at 2:01:23 PM on the same day.

[Identify related node topology]
Subsequently, a method of specifying the related node topology will be described.
The related node topology identifying unit 22 refers to the topology information, the failure handling information, and the event information, and configures, for each of the one or more failures, a relation that includes a node that has caused an event due to each failure as an element. Identify the node topology. To realize this, the related node topology specifying unit 22 includes an event extracting unit 221 and a node extracting unit 222.

  The event extracting unit 221 extracts, for each of one or more faults, a node that has generated an event within a predetermined period D including the time of occurrence of each fault. Here, the “predetermined period D” indicates a temporal range affected by one failure. The predetermined period D may be determined by experiments in consideration of the scale of the network, the types of components, and the like, and is, for example, 10 hours. The event extracting unit 221 specifies one failure with reference to the failure handling information. Subsequently, the event extraction unit 221 refers to the event information, and specifies a node that has generated the event within a predetermined period D including the specified failure occurrence time.

  The node extraction unit 222 refers to the topology information to associate a set of nodes in which all nodes existing on the path leading to the cause node among the nodes extracted by the event extraction unit 221 generate an event. Extract as node topology. Thereby, the related node topology specifying unit 22 can extract, from the set of nodes configuring the network, the related node topology configured by nodes related to a certain failure. Since the related node topology is a unit of learning for generating a learning device, the determination accuracy of the learning device can be improved by using only the node that has generated an event related to a certain failure as the related node topology.

  Here, if the manufacturers of the devices constituting the nodes are different, the events to be generated at the time of failure may be different. Therefore, the node extracting unit 222 may extract a different related node topology if the manufacturer of the device configuring the node is different. Thereby, the node extracting unit 222 can suppress a variation of an event generated by a node configuring the related node topology. Since this corresponds to narrowing down events targeted by the learning device, the accuracy of the learning device determination can be increased.

  Further, even if the equipment constituting the node is the same, if the equipment type of the equipment is different, the event to be generated at the time of failure may be different. Therefore, the node extracting unit 222 may extract as a different related node topology if the type of the device is different even if the manufacturer of the device configuring the node is the same. Thereby, the node extracting unit 222 can suppress a variation of an event generated by a node configuring the related node topology. Since this corresponds to narrowing down events targeted by the learning device, the accuracy of the learning device determination can be increased.

  Further, even if the manufacturer of the device constituting the node and the equipment type of the device are the same, if the version of the firmware incorporated in the device is different, the event to be generated at the time of failure may be different. Therefore, the node extracting unit 222 may extract a different related node topology as long as the firmware and the version of the firmware incorporated in the device are different even if the manufacturer and the type of the device constituting the node are the same. . Thereby, the node extracting unit 222 can suppress a variation of an event generated by a node configuring the related node topology. Since this corresponds to narrowing down events targeted by the learning device, the accuracy of the learning device determination can be increased.

  Returning to the description of FIG. The related fault extracting unit 23 determines, among one or more faults included in the fault handling information, a fault in which the cause node is the same, the corresponding action of the cause node is the same, and the nodes configuring the related node topology are the same. Is extracted as a related disorder.

  FIG. 7 is a diagram schematically illustrating a data structure of a related fault database storing related faults extracted by the related fault extracting unit 23 according to the embodiment. The related failure database is held by the storage unit 10. As shown in FIG. 7, the related fault database stores a related node topology ID, node information constituting the related node topology, and a plurality of fault IDs in association with each other. The related node topology ID is an identifier assigned to each related node topology in order to uniquely specify the related node topology. The node information includes a node ID of each node constituting the related node topology and a node shape indicating a connection relationship of the related node topology.

  Even if the corresponding action of the cause node is the same and the nodes configuring the related node topology are the same, the event occurrence pattern may be different. FIG. 7 shows an event occurrence pattern when the node N8 is the cause node in the related node topology including the node N2, the node N5, and the node N8, and the method of coping with the failure is replacement of the device. .

  That is, even if the corresponding actions of the cause node are the same and the nodes configuring the related node topology are the same, at some point, an event occurs in the order of, for example, node N2, node N5, node N8, and node N5. Otherwise, the event occurs in the order of node N8, node N2, node N5, and node N8. The related obstacle is used as teacher data of the machine learning executed by the learning unit 24.

  The learning unit 24 generates a learning device by machine learning using time-series data of an event generated by each node configuring the related node topology and a method of coping with a failure as teacher data. More specifically, the learning unit 24 uses the time series data of the event generated by each node constituting the related node topology in the related failure shown in FIG. Generate a container.

  FIG. 8 is a diagram schematically illustrating a data structure of a learning device database storing learning devices generated by the learning unit 24 according to the embodiment. The learning device database is held by the storage unit 10. Since the learning unit 24 generates a learning device individually for each related disorder, a plurality of learning devices are registered in the learning device database even when the same network is targeted. As shown in FIG. 9, the learning device database manages information by assigning a learning device ID for uniquely specifying a learning device to each learning device.

  As shown in FIG. 8, the learning device database includes a learning device ID, a related node topology ID for specifying a related node topology to be determined by the learning device, and a node of each node constituting the related node topology. The information is stored in association with the troubleshooting method.

  For example, the related node topology targeted by the learning device whose learning device ID is LID0003 is specified by TID0008, and its components are a node N2, a node N5, and a node N8. The learning device outputs the likelihood of the target method of the failure by inputting the event information generated in the related node topology including the nodes N2, N5, and N8 or a subset thereof. In other words, the learning device whose learning device ID is LID0003 outputs a probability that a failure has occurred in the node N8 and the corresponding action is replacement of the device.

  The determination unit 25 performs the likelihood output of the target method of the obstacle using the learning device. The determination unit 25 outputs the likelihood of the failure handling method based on the event that has occurred due to the network failure and the learning device generated by the learning unit 24. More specifically, the determination unit 25 acquires one or more learning devices generated with respect to the related node topology including the set of nodes that have caused the event from the learning device database held by the storage unit 10.

  The determination unit 25 outputs the likelihood of the coping method associated with each of the acquired one or more learning devices. The determining unit 25 determines a handling method for the failure based on the output one or more likelihoods. For example, the determination unit 25 outputs a coping method with the highest likelihood among the one or more likelihoods output. Thus, the determination unit 25 can output a statistically most likely coping method based on past event information generated in the network.

<Processing flow of information processing executed by information processing apparatus 1>
FIG. 9 is a flowchart illustrating a flow of information processing executed by information processing apparatus 1 according to the embodiment. The processing in this flowchart is started, for example, when the information processing apparatus 1 is turned on.

  The information acquiring unit 21 refers to the storage unit 10 and acquires topology information indicating a connection relationship between a plurality of nodes configuring the network (S2). The information acquisition unit 21 refers to the storage unit 10, and deals with one or more failures that have occurred in the network, the cause node that caused each failure, and the countermeasure for the cause, and the failure occurrence time. Is also obtained (S4).

  The information acquisition unit 21 also refers to the storage unit 10 to acquire event information that is time-series data of an event that has occurred in the node (S6). The related node topology specifying unit 22 extracts a related node topology for each cause node included in the failure handling information (S8). The related fault extracting unit 23 extracts, as the related fault, a fault in which the cause node is the same, the corresponding action of the cause node is the same, and the nodes configuring the related node topology are the same (S10).

  The learning unit 24 generates a learning device for outputting the likelihood of the method of coping with the failure with each related failure as teacher data for each related failure extracted by the related failure extraction unit 23 (S12). When the learning unit 24 generates the learning devices corresponding to all the related failures, the processing in this flowchart ends.

<Effects of Information Processing Apparatus 1>
As described above, according to the information processing apparatus 1 according to the embodiment, it is possible to improve the accuracy of determining a method of coping with a failure in a network. In particular, the information processing apparatus 1 according to the embodiment generates a learning device using time-series data of an event generated by each node configuring the related node topology and a method of coping with a failure as teacher data. Since information irrelevant to the obstacle can be excluded, the accuracy of the learning device determination can be improved.

  In addition, the information processing apparatus 1 according to the embodiment generates a learning device for each related node topology, which is a subset of the network, even if the structure of the network is complex. Thereby, the information processing apparatus 1 according to the embodiment can learn the order of occurrence of the events that have occurred for the failure types, without depending on the topology shape of the network.

  As described above, the present invention has been described using the embodiment, but the technical scope of the present invention is not limited to the scope described in the above embodiment, and various modifications and changes are possible within the scope of the gist. is there. For example, the specific embodiment of the dispersion / integration of the apparatus is not limited to the above-described embodiment, and all or a part of the apparatus may be functionally or physically dispersed / integrated in an arbitrary unit. Can be. Further, new embodiments that are generated by arbitrary combinations of the plurality of embodiments are also included in the embodiments of the present invention. The effect of the new embodiment caused by the combination has the effect of the original embodiment.

DESCRIPTION OF SYMBOLS 1 ... Information processing apparatus 10 ... Storage part 20 ... Control part 21 ... Information acquisition part 22 ... Related node topology specification part 23 ... Related failure extraction part 24 ... Learning part 25 ... Determining unit 221 ... Event extracting unit 222 ... Node extracting unit

Claims (10)

(1) topology information indicating a connection relationship between a plurality of nodes configuring the network; (2) each of one or more faults that have occurred in the network, a cause node that caused each fault and a corresponding measure for the cause Doo and troubleshooting information that associates the Action and failure time including an information acquiring unit that acquires a time series data of the events that occurred in (3) the node;
Wherein for each of the troubleshooting information to the one or more disorders associated with, an associated node topology configured node that caused the event Te predetermined period in odor including time of occurrence of each failure as an element, the topology information Related node topology identification unit to identify by referring to
The time-series data of the event generated by each node configuring the related node topology in the time-series data, and the cause of the event generated by each node configuring the related node topology in the troubleshooting information. and the Action of the fault as teacher data composed, a learning unit for generating the machine learning learning device for outputting a likelihood of Action of a fault in the network,
An information processing apparatus comprising: The related node topology specifying unit includes:
For each of the one or more faults, an event extraction unit that extracts a node that has generated an event within a predetermined period including the time of occurrence of each fault;
Among the nodes extracted by the event extraction unit, a node extraction unit that extracts, as a connected subgraph-related node topology, a set of nodes in which all nodes existing on the path leading to the cause node are generating an event,
including,
The information processing device according to claim 1. A related fault extracting unit that extracts, as the related fault, a fault in which the cause node is the same, the corresponding action of the cause node is the same, and the nodes configuring the related node topology are the same among the one or more faults. Further comprising
The learning unit sets, as teacher data, time-series data of an event generated by each node configuring the related node topology in the related failure and a method of coping with the failure.
The information processing device according to claim 2. The node extraction unit, if the manufacturer of the device constituting the node is different, to extract as a different related node topology,
The information processing apparatus according to claim 2. The node extraction unit, even if the manufacturer of the device constituting the node is the same, if the type of the device is different, extract as a different related node topology,
The information processing device according to claim 2. The node extraction unit, even if the manufacturer of the device constituting the node and the type of the device are the same, if the version of the firmware incorporated in the device is different, extract as a different related node topology,
The information processing apparatus according to claim 2. An event that has occurred due to the failure of the network, and a determination unit that outputs a likelihood of a method of coping with the failure based on the learning device generated by the learning unit,
The information processing apparatus according to claim 1. The determination unit outputs the likelihood of a coping method associated with the learning device for each of one or more learning devices generated with respect to a related node topology including a set of nodes that caused the event, and outputs Determining a method of coping with the failure based on the one or more likelihoods determined;
The information processing device according to claim 7. The processor
Obtaining topology information indicating a connection relationship between a plurality of nodes constituting the network;
Acquiring failure handling information that associates each of the one or more failures that have occurred in the network with a troubleshooting method and a failure occurrence time of each failure;
Obtaining a time series data of the events that have occurred in the node,
Wherein for each of the troubleshooting information to the one or more disorders associated with, an associated node topology configured node that caused the event Te predetermined period in odor including time of occurrence of each failure as an element, the topology information Referring to and identifying;
The time-series data of the event generated by each node configuring the related node topology in the time-series data, and the cause of the event generated by each node configuring the related node topology in the troubleshooting information. a step of generating by a machine learning and as consisting Action and the teacher data of the fault, the determiner for determining the likelihood of Action of the disorder,
Information processing method for executing. On the computer,
A function of acquiring topology information indicating a connection relationship between a plurality of nodes constituting the network;
A function of acquiring failure handling information associating each of one or more failures that have occurred in the network with a troubleshooting method and a failure occurrence time of each failure;
The function of acquiring the time series data of the events that have occurred in the node,
Wherein for each of the troubleshooting information to the one or more disorders associated with, an associated node topology configured node that caused the event Te predetermined period in odor including time of occurrence of each failure as an element, the topology information With reference to the
The time-series data of the event generated by each node configuring the related node topology in the time-series data, and the cause of the event generated by each node configuring the related node topology in the troubleshooting information. and as becomes teacher data and Action of the disorder, a function of generating a machine learning determiner for determining the likelihood of Action of the disorder,
The program that realizes.

Images