JP6649294B2 - State determination device, state determination method, and program - Google Patents

Description

  The present invention relates to a state determination device, a state determination method, and a program.

  When an abnormality occurs in the operation of the computer system, the operator uses the observation value of various observation information obtained from the system equipment, such as the CPU usage rate, error log, and traffic log, based on the knowledge and experience so far. The cause and the cause were identified, and the cause was dealt with. As one of the methods for assisting the operator in making a decision, there is an analysis method using a causal graph.

  An error occurrence cause location and cause estimation method using a causal graph is a method for quickly identifying the cause location and cause using a causal graph that describes the influence relationship that occurs when an error occurs in a part of the system component (For example, Non-Patent Documents 1 to 3). These methods are mainly divided into two parts: pre-construction, learning phase and inference phase.

  In the learning phase, each component of the system (eg, router, server) is used as a node in the device state / factor layer, and when an abnormality occurs in each node, a node in the observation layer (eg, an alert) that affects the node. , Packet errors, CPU utilization, etc.), and a weighted edge is created. By performing this for all nodes based on the knowledge of the system expert and past cases, a causal graph describing the influence relationship of the entire system is completed.

FIG. 1 is a diagram for explaining a causal graph. In Figure _{1, X (x 1, x} 2, ... x n) represents the state of each of the n device as a component of the system, each _{x i} is 0 (normal state) or 1 (abnormal state ). Y (y ₁ , y ₂ ,..., Y _m ) represents the state of m pieces of observation information. For example, if Y is an observation layer indicating whether a packet error has occurred, each y _j is 0 (packet error). None) or 1 (occurrence of packet error). Edge weights are defined by the conditional probability P, for _{example, P (y j = 1 |} x i = 1) represents the probability _{that y j} becomes 1 _{when x i} took one.

  In the inference phase, when an anomaly occurs in the system, the cause of the cause, Identify the factor.

Srikanth Kandula, Dina Katabi, and Jean-philippe Vasseur.Shrink: A tool for failure diagnosis in IP networks.Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data, pages 173-178, 2005. R.R.Kompella, J. Yates, A. Greenberg, and A.C.Snoeren.IP Fault Localization via Risk Modeling.IEEE Transactions on Dependable and Secure Computing, 7 (4): 1-14, 2010. He Yan, Lee Breslau, Zihui Ge, Dan Massey, Dan Pei, and Jennifer Yates.G-RCA: A Generic Root Cause Analysis Platform for Service Quality Management in Large IP Networks.IEEE/ACM Transactions on Networking, 20 (6): 1734-1747, 2012.

  In the prior art, in the learning phase, a method for constructing a causal graph based on correlations from expert knowledge, past failure cases, system observation data, etc. has been proposed, but has not occurred in the past The influence relationship when an error occurs cannot be described.

  In addition, since the influence range of the node may change due to the new machine of the system, it is difficult to construct a graph that accurately describes the causal relationship of the system only in the learning phase.

  Further, even if an abnormality occurs, the device does not issue an alert, or a node in an observation layer is erroneously determined to be in an abnormal state due to an analysis error in an observation value, and thus the original state of observation information cannot always be easily determined.

  As described above, when an accurate causal graph cannot be constructed, or when the state of the observation layer cannot be accurately determined, there is a possibility that the estimation accuracy of the causal point / factor is reduced.

  The present invention has been made in view of the above points, and an object of the present invention is to improve the accuracy of estimating a cause and a cause of a system abnormality.

  Therefore, in order to solve the above problem, the state determination device includes a first layer corresponding to the state of each component of the system and a second layer corresponding to the state of observation information output from each element of the first layer in the system. For the first causal graph showing the relationship with the layer of the first layer, the third layer corresponding to the state of the second observation information obtained by converting the observation information output from each component of the first layer is described above. A second causal graph added between the first layer and the second layer, and a set F of functions f for manipulating the weight of the edge between the first layer and the third layer. A determination unit that determines the state of each component having the maximum likelihood to the state of the observation information collected from the system, based on the set G of the function g that performs the conversion, and the determination unit An output unit that outputs a state of each of the determined components; A.

  It is possible to improve the accuracy of estimating the cause and the cause of the system abnormality.

It is a figure for explaining a causal graph. FIG. 1 is a diagram illustrating a system configuration example according to an embodiment of the present invention. FIG. 2 is a diagram illustrating a hardware configuration example of an estimation device 10 according to the embodiment of the present invention. It is a figure showing an example of functional composition of estimating device 10 in an embodiment of the invention. FIG. 4 is a diagram illustrating a configuration example of a causal graph according to the embodiment of the present invention. 5 is a flowchart for explaining an example of a processing procedure executed by the estimation device 10. FIG. 6 is a diagram illustrating an example of a text file expressing a relationship between nodes and edges. FIG. 9 is a diagram illustrating an output example of an X state sequence. It is a flowchart for demonstrating an example of the processing procedure of the estimation process of the state of the apparatus / factory state layer X.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the present embodiment, in the learning phase, a causal graph extended from the conventional causal graph is constructed. In the inference phase, the state of the edge of the causal graph and the state of the observation information are corrected. By doing so, even when the accuracy of the causal graph or the observation information is low, it is possible to estimate the cause and the cause with high accuracy.

  FIG. 2 is a diagram illustrating a system configuration example according to the embodiment of the present invention. In FIG. 2, the estimation device 10 is connected to a plurality of devices 20 via a network.

  Each device 20 is a component of an operation system that is to be observed by the estimation device 10. The operation system may be various systems such as a network system or a computer system.

  The estimation device 10 is one or more computers that collects observation information from the operation system when an abnormality occurs in the operation system, and estimates a cause and a cause of the abnormality based on the observation information. In the present embodiment, observation information refers to information indicating an observation item or an observation result of an observation target in the operation system. The observation result may be the observation value itself or the presence or absence of a certain phenomenon. The certain phenomenon is, for example, a log output including a specific message (for example, a message indicating a packet error).

  FIG. 3 is a diagram illustrating a hardware configuration example of the estimation device 10 according to the embodiment of the present invention. 3 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, a display device 106, an input device 107, and the like, which are mutually connected by a bus B.

  A program for realizing the processing in the estimation device 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not always be installed from the recording medium 101, and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads out the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 implements functions related to the estimation device 10 according to a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network. The display device 106 displays a GUI (Graphical User Interface) according to a program. The input device 107 includes a keyboard, a mouse, and the like, and is used to input various operation instructions.

  FIG. 4 is a diagram illustrating an example of a functional configuration of the estimation device 10 according to the embodiment of the present invention. 4, the estimation device 10 includes a UI unit 11, a causal graph construction unit 12, a correction candidate construction unit 13, an abnormality degree calculation unit 14, an inference unit 15, and the like. Each of these units is realized by a process of causing the CPU 104 to execute one or more programs installed in the estimation device 10. The estimating apparatus 10 also uses databases such as the causal graph DB 16 and the correction candidate DB 17. Each of these databases can be realized by using, for example, a storage device that can be connected to the auxiliary storage device 102 or the estimation device 10 via a network.

  The UI unit 11 outputs information indicating the state (normal or abnormal) of each device 20 as information that assists in estimating the location and cause of the abnormality in the operation system. When a new device 20 is added to the operation system or the like, the UI unit 11 accepts from the user an instruction to add a node to the causal graph and to change a causal relationship with the node, and corrects the causal graph.

  The causal graph constructing unit 12 extends (generates) a conventional causal graph and constructs (generates) a new layer and a model (causal graph) into which a function can be introduced.

FIG. 5 is a diagram illustrating a configuration example of a causal graph according to the embodiment of the present invention. In this embodiment, the state layer _Y = y j observation information (j = 1, ..., m ) and equipment and cause state layer _{X = x i (i = 1} , ..., n) and the connecting it directed Markov The state layer Y of the observation information in the model (conventional causal graph) is the state layer Y of the observation information including noise (observation information actually observed), and the state layer Z = z _{j of the} true observation information. (J = 1,..., M) are added between Y and X.

  The state layer Z of the true observation information represents the state of the observation information that can be normally observed. That is, the true observation information refers to observation information obtained by performing conversion for removing noise from observation information actually observed. The noise is, for example, an observation mistake. An observation error is that the observation information cannot be captured for some reason, even though the observation information is output, or that the observation information that should be output is not output due to a setting mistake on the device 20 side. And so on. For example, the state layer Z of the true observation information indicates that the failure “A affects the nodes B, C, and D of the observation layer” and the nodes B, C, and D are actually affected. It is.

The causal graph includes a set of functions F = I + U ′, u ′ _ij ∈ [0, ± 1] that change the value of the weight of the edge e _ij from _xi to z _j and the state of the true observation information. A set of functions G = I + U ″, u ″ _ij ∈ [0, ± 1], which adds noise to z _j and outputs to y _j , is scheduled to be introduced. Here, I indicates an identity map such as a unit matrix.

  The causal graph constructed by the causal graph constructing unit 12 is stored in the causal graph DB 16.

The correction candidate construction unit 13 constructs a set of functions F and G. The construction of the set of functions F and G refers to generating an entity (expression) of each function belonging to F or G. Specifically, the correction candidate construction unit 13 can convert f _k into a function acting on the weight of an arbitrary convertible edge in the causal graph for the causal graph stored in the causal graph DB 16 and perform conversion. Let F be a set of functions covering all the patterns. f _k is a function acting on the k-th subgraph of the complete bipartite graph consisting of X and Z. k exists as many as the number of subgraphs of the complete bipartite graph. Note that the conversion refers to an operation of changing the weight of an edge between nodes x _i and z _j of arbitrary X and Z. For example, in the present embodiment, a case where the weight of an edge is set to 0 or 1 will be described. Setting the weight of an edge to 0 is equivalent to deleting the edge, and setting the weight of the edge to 1 is equivalent to adding the edge. However, the weight of the edge may be a multi-value or a continuous value.

The correction candidate construction unit 13 also sets _gs (s = 1,..., M) as a function for converting the state value of an element for each of all subsets of the state layer Z of true observation information, and sets G to It is the set of g _s. Here, m is the number of all subsets of the state layer Z of the true observation information.

  The function sets F and G constructed by the modification candidate construction unit 13 are stored in the modification candidate DB 17.

The abnormality degree calculation unit 14 collects observation information from the device 20 by performing a command operation on the device 20 in the operation system, and calculates an abnormality degree for the observation information. The method of calculating the degree of abnormality may be determined as 0 or 1 based on whether or not a threshold value is exceeded, an outlier calculation method such as a local outlier factor, a general time series analysis such as an autoregressive model, or the like. May be calculated using Abnormality level calculation unit 14 is further based on the degree of abnormality, it determines the state of the node y _j of the observed layer Y of the observation information including the noise. If y _j takes a value of normal (0) or abnormal (1), the abnormality degree calculation unit 14 determines whether y _j corresponds to 0 or 1 based on the calculated abnormality degree. Is determined. If y _j takes the three values of normal (0), abnormal (1), or partially abnormal (0.5), the abnormality degree calculator 14 calculates y _j based on the calculated abnormality degree. Of the three values is determined. For the determination, a comparison with a threshold value, a t-test, or the like may be used. If the state of y _j can take a continuous value from 0 to 1, the calculated abnormal value may be normalized from 0 to 1, and the normalized value may be the value of y _j .

The inference unit 15 includes, for the causal graph stored in the causal graph DB 16 and the set of functions F and G stored in the correction candidate DB 17, the noise calculated by the anomaly degree calculator 14 based on the observation information. we by applying the status of the layer y _j observation information, the status of the layer y _j best represent (likelihood relative state layer y _j state is a maximum) to estimate the state of the x _i.

  Hereinafter, a processing procedure executed by the estimation device 10 will be described. FIG. 6 is a flowchart illustrating an example of a processing procedure executed by the estimation device 10.

In step S101, a causal graph construction unit 12, the existing technology (e.g., Non-Patent Documents 1 to 3) the weight of an edge of a causal graph can be constructed with x _i, be dynamically changed for each side of the y _j Construct (generate) a causal graph as possible. The initial value of the weight of each node and edge of the device / factor state layer X of the causal graph and the state layer Y of the observation information including noise is calculated based on the configuration information of the operation system, past abnormal occurrence cases, and the like. You. In the causal graph, a new state layer Z of true observation information is newly introduced, and a set G of functions that gives noise to the state layer Z of true observation information and maps to Y can be applied. y _j is observation information obtained by adding noise to z _j . In other words, z _j is observation information obtained by removing noise from y _j .

Further, in the causal graph, it is possible to apply a set F of functions acting on edge weights to x _i and z _j . By F, the causal graph is a model that can consider that an influence outside the range assumed in advance occurs. For example, by allowing the weight of an edge to be changed later by the set of functions F, the causal graph can be used even when the configuration information of the operation system is incorrect or a failure that has never occurred in the past. It becomes possible to correspond.

  When the causal graph constructing unit 12 constructs a causal graph capable of expressing various states as described above, the causal graph DB 16 stores a text file in which a relationship between a node and an edge of each layer of the causal graph is described.

  FIG. 7 is a diagram illustrating an example of a text file expressing the relationship between nodes and edges. An example of the causal graph is shown on the left side of FIG. On the right side of FIG. 7, a text file corresponding to the causal graph is shown. In the text file, a relationship between an edge name, a node connected by the edge, and a weight for the edge is described.

  The relationship between an edge name and a node to which the edge connects is described, for example, as eASL1: ASpine1, Link1. This description indicates that the edge having the edge name eASL1 connects the node ASpine1 of X and the node Link1 of Y.

The weight for the edge is described, for example, as eASL1: 1,0. The description, the conditional probability _{P (y j = 1 | x} i = 1) = 1, P | and so _{(y j = 0 x i =} 1) = 0, indicating the value of the conditional probability. In other words,: The first number after the colon in "eASL1 1,0" (:) is, the conditional probability _P (y j = 1 _| shows the _x i = 1), the second number, the conditional probability P shows the _{| (x i = 1 y j} = 0). In FIG. 7, nodes of the state layer Y of observation information including noise are omitted for convenience.

Subsequently, the modification candidate construction unit 13 constructs (generates) the function set F by the following method (S102). First, the modification candidate construction unit 13 acquires the data of the causal graph (the text file of FIG. 7) from the causal graph DB 16. Subsequently, when the weight of the edge is 1 or 0, the correction candidate constructing unit 13 sets f to a transformation that replaces 1 and 0, and sets f _k to a subset of any edge from X to Z in the causal graph. A function that acts on Here, an arbitrary subset of edges also includes an edge having a weight of 0. An edge having a weight of 0 refers to, for example, an edge that is not represented in the example of FIG. 7, and refers to an edge having all conditional probabilities of 0. For example, in FIG. 7, the edge between Aspine1 and Link2 and the edge between BLeaf1 and Link1 correspond to the edge having a weight of 0. Therefore, there are as many arbitrary subsets of edges as the number of subsets of the complete bipartite graph consisting of X and Z, and _fk is also the same. f _k is a function that sets an edge having a weight of 1 to 0 and an edge having a weight of 0 to 1 for the k-th subset. The correction candidate construction unit 13 sets a set _obtained by summing f _k as F. The modification candidate construction unit 13 stores the constructed function set F in the modification candidate DB 17. When the weight is multi-valued or continuous, a function corresponding to each may be defined.

Subsequently, the modification candidate construction unit 13 constructs (generates) a set G of functions (S103). Specifically, correction candidate building unit 13, the state z _j observation information on the state layer Z of the true observation information, 0 is normal, take the binary 1 is such that abnormality {0,1} In this case, g is a function for inverting 0 and 1 and g _s is an inversion of the element state value (0 or 1) for an arbitrary subset of s elements of the state layer Z of the true observation information. (S = 1,..., M). Suggestions construction unit 13, a set summarizing g _s and G. The modification candidate construction unit 13 stores the constructed function set G in the modification candidate DB 17. When the state of the observation information takes multiple values or continuous values, it is only necessary to define a function corresponding to each value.

  Steps S101 to S103 may be executed in advance regardless of the occurrence of an abnormality in the operation system.

  When the UI unit 11 receives an analysis execution instruction from the user when an abnormality occurs in the operation system, the steps after step S104 are executed.

  In step S104, the abnormality degree calculation unit 14 collects observation information from each device 20 by performing a command operation on each device 20 in the system.

Subsequently, the degree-of-abnormality calculation unit 14 calculates the degree of abnormality of each collected observation information, and based on the degree of abnormality, the state y _j of each observation information (that is, the state layer Y of the observation information including noise). ) Is determined (S105).

  Subsequently, the inference unit 15 uses the causal graph information stored in the causal graph DB 16, the sets F and G of functions stored in the correction candidate DB 17, and the observation including the noise by the anomaly degree calculation unit 14. Based on the determination result of the status layer Y of the information, the status of the device / factor status layer X is estimated (S106). That is, the state of the device / factor state layer X having the highest likelihood with respect to the state layer Y of the observation information including noise is estimated.

  Subsequently, the UI unit 11 outputs the state sequence of X estimated by the inference unit 15 as information indicating the location and the cause of the abnormality (S107). For example, a text file as shown in FIG. 8 may be output.

  FIG. 8 is a diagram illustrating an output example of the state sequence of X. FIG. 8 shows the state of each node of the device / factory state layer X shown in FIG. 7 as 0 (normal state) or 1 (abnormal state). In the example of FIG. 8, the node Bspine1 is 1 (abnormal state), and this node is presumed to be the location and the cause of the abnormality.

  Subsequently, the details of step S106 will be described. FIG. 9 is a flowchart illustrating an example of a processing procedure of a process of estimating a state of the device / factor state layer X.

In step S201, the inference unit 15, the F and G in a state where the identity mapping I, maximum a posteriori _{p = max X F (P (} X│G -1 (Y))) was collected Y Calculate based on This calculation is equivalent to calculating the maximum posterior probability p = max XP ( _X | Y) before applying the operation by the existing method, similarly to the existing causal graph. Therefore, for example, the method described in Non-Patent Document 1 may be used as the calculation method.

Subsequently, the inference unit 15 changes the causal graph using F and G, and calculates the maximum posterior probability p ′ = max XF (P ( _X | G ⁻¹ (Y))) (S202). . Specifically, the inference unit 15 calculates the maximum posterior probability p ′ _ks = f _k (P (X│g _s ⁻¹ (Y)) for each combination of f _k ∈F and g _s ∈G. At the same time, the state sequence of X having the highest likelihood for Y is obtained. Therefore, if at least one of the number of elements of F and the number of elements of G is plural, a plurality of p ′ _ks are calculated, and a state sequence of X is obtained for each p ′ _ks .

Subsequently, inference unit 15, from the step S202, p _'ks / p threshold τ (τ> 1) greater than p' _ks (i.e., at least p is greater than p _'ks) were extracted and the extracted The state sequence of X corresponding to _p'ks is output as a solution candidate (S203). That is, a state sequence of X corresponding to p ′ _ks whose magnitude with respect to p exceeds the threshold τ is output as a solution candidate. The output solution candidate is a state sequence of X that satisfies the threshold τ> 1 and has a larger maximum posterior probability than the existing causal graph method. That is, a solution indicating the location and factor of the occurrence of the abnormality is extracted with higher accuracy than the existing method.

Note that when determining whether p ′ _ks / p exceeds the threshold τ (τ> 1), the inference unit 15 determines the degree of change of the causal graph by f _k (for example, the number of edges whose weights have been changed ( The value of the threshold τ is changed according to the number of added edges or the number of deleted edges, etc.) to give a penalty, thereby limiting the degree of freedom of the change by _fk .

Giving a penalty means, for example, changing the threshold value τ in accordance with the degree of change. If the degree of change in the causal graph by f _k is relatively small, the threshold value τ is reduced and f _k Means that the threshold value τ is increased when the degree of change of the causal graph is relatively large. By doing so, when the degree of change is small, even if the increase of the maximum posterior probability p ′ with respect to the maximum posterior probability p is slight, it can be considered as a solution candidate, and when the degree of change is large, the maximum Only when the increase of the maximum posterior probability p ′ with respect to the posterior probability p is large, a solution candidate can be set.

The method of changing the threshold value τ is not limited to a specific method. For example, when the number of elements of a subset on which f _k or g _s acts is s, there is a method of setting τ to the s power.

Note that FIG. 8 corresponds to the case where there is one solution candidate, but there may be a plurality of solution candidates. In this case, for example, the output targets may be narrowed down based on the maximum posterior probability p ′ _ks . For example, a solution candidate having the highest N posterior probabilities p ′ _ks (N ≧ 1) may be output. Further, the solution candidates may be sorted and output based on the maximum posterior probability p ′ _ks . Further, for each solution candidate, the corresponding maximum posterior probability p ′ _ks may be output.

  As described above, according to the present embodiment, the maximum posterior probability is calculated by considering the addition and subtraction of edges by the transformation of F, so that even if the causal graph constructed in advance is inaccurate, it is corrected. The state of the device / factor state layer X can be estimated correctly. Similarly, by calculating the maximum posterior probability while considering the addition of noise by converting G, even if the state determination of the observation information is incorrect, the state of the state layer X can be correctly estimated while correcting it. . As a result, it is possible to improve the accuracy of estimating the location and the cause of the system abnormality. Therefore, the user can use the present embodiment to specify the cause / factor with high accuracy and to take measures.

  In the present embodiment, the estimation device 10 is an example of a state determination device. The causal graph of the existing method is an example of a first causal graph. The causal graph as shown in FIG. 5 is an example of the second causal graph. The inference unit 15 is an example of a determination unit. The UI unit 11 is an example of an output unit. The abnormality degree calculator 14 is an example of a calculator. The device / factor state layer X is an example of a first layer. The state layer Y of the observation information including noise is an example of a second layer. The state layer Z of the true observation information is an example of a third layer. Observation information including noise is an example of first observation information. True observation information is an example of second observation information. The maximum posterior probability p is an example of a first maximum posterior probability. The maximum posterior probability p ′ is an example of a second maximum posterior probability.

  As mentioned above, although the Example of this invention was described in full detail, this invention is not limited to such a specific embodiment, A various deformation | transformation is carried out within the range of the gist of this invention described in the claim.・ Changes are possible.

10 Estimation Device 11 UI Unit 12 Causal Graph Constructing Unit 13 Correction Candidate Constructing Unit 14 Abnormality Calculation Unit 15 Inference Unit 16 Causal Graph DB
17 Correction candidate DB
Reference Signs List 20 device 100 drive device 101 recording medium 102 auxiliary storage device 103 memory device 104 CPU
105 interface device 106 display device 107 input device B bus

Claims (6)

A first causal graph showing a relationship between a first layer corresponding to a state of each component of the system and a second layer corresponding to a state of observation information output from each component of the first layer in the system. On the other hand, a third layer corresponding to the state of the second observation information obtained by converting the observation information output from each component of the first layer is placed between the first layer and the second layer. , A set F of functions f for manipulating the weights of edges between the first layer and the third layer, and a set G of functions g for performing the conversion. A determination unit that determines the state of each of the constituent elements having the maximum likelihood to the state of the observation information collected from the system,
An output unit that outputs a state of each of the components determined by the determination unit,
A state determination device comprising: The determining unit calculates a first maximum posterior probability for a state of observation information collected from the system based on the first causal graph, and for each combination of the function f and the function g, Based on the second causal graph, calculate the second maximum posterior probability in the combination and determine the state of each component in the combination,
The output unit outputs, among the second maximum posterior probabilities, states of the components determined with respect to a second maximum posterior probability larger than the first maximum posterior probability.
The state determination device according to claim 1, wherein: The output unit outputs, among the second maximum posterior probabilities, a state of each of the components determined with respect to a second maximum posterior probability whose magnitude with respect to the first maximum posterior probability exceeds a threshold value. And
The threshold value is increased as the combination of the function f with a greater degree of operation of the weight is increased.
3. The state determination device according to claim 2, wherein: A calculation unit that calculates the degree of abnormality for the observation information collected from the system, and determines the state of the observation information based on the degree of abnormality,
The state determination device according to any one of claims 1 to 3, further comprising: A first causal graph showing a relationship between a first layer corresponding to a state of each component of the system and a second layer corresponding to a state of observation information output from each component of the first layer in the system. On the other hand, a third layer corresponding to the state of the second observation information obtained by converting the observation information output from each component of the first layer is placed between the first layer and the second layer. , A set F of functions f for manipulating the weights of edges between the first layer and the third layer, and a set G of functions g for performing the conversion. A determination procedure for determining the state of each of the constituent elements having the maximum likelihood to the state of the observation information collected from the system,
An output step of outputting a state of each of the components determined in the determination step,
And a computer for executing the state determination method.   A program that causes a computer to function as each unit according to claim 1.

Images