JP7011696B1 - Electronics, control methods, and trained models - Google Patents

Abstract

PROBLEM TO BE SOLVED: To accurately detect an abnormality in a process being executed. An electronic device is based on a processor that executes processing based on a program, an acquisition unit that acquires information indicating the usage rate of the processor for each thread that uses the processor, and information acquired by the acquisition unit. The processor is based on the information acquired by the calculation unit and the acquisition unit, which calculates the first information indicating the ratio of the number of threads whose usage rate of the processor is within the predetermined range to the total number of threads using the processor. The extraction unit that extracts the second information indicating the usage rate of the first thread, which is the most used thread among the threads that are using, and the processing abnormality is detected based on the first information and the second information. It is equipped with an abnormality detection unit. [Selection diagram] Fig. 1

Description

The present invention relates to electronic devices, control methods, and trained models.

In an electronic device equipped with a processor such as a CPU (Central Processing Unit) to execute processing, problems such as performance deterioration may occur due to the processing being executed (see, for example, Patent Document 1). ..

JP-A-2015-184909

However, even if you try to detect whether or not the processing being executed is in an abnormal state from the operating state of the hardware, for example, even if the CPU usage rate is high, it will operate normally just by a large amount of processing. It was difficult to detect it accurately because it may be present.

The present invention has been made in view of the above circumstances, and one of the objects of the present invention is to provide an electronic device, a control method, and a trained model capable of accurately detecting an abnormality in a process being executed.

The present invention has been made to solve the above problems, and the electronic device according to the first aspect of the present invention is a processor that executes processing based on a program and a thread that uses the processor. An acquisition unit that acquires information indicating the usage rate of the processor, and a thread whose usage rate of the processor is within a predetermined range with respect to the total number of threads using the processor based on the information acquired by the acquisition unit. Based on the information acquired by the calculation unit that calculates the first information indicating the ratio of the number and the information acquired by the acquisition unit, the usage rate of the first thread, which is the most used thread among the threads using the processor, is calculated. It includes an extraction unit that extracts the second information shown, and an abnormality detection unit that detects an abnormality in the process based on the first information and the second information.

In the electronic device, the abnormality detection unit uses a trained model machine-learned based on the first information, the second information, and information regarding the presence or absence of an abnormality previously acquired, and the abnormality in the processing. May be detected.

In the electronic device, the acquisition unit further acquires information indicating an application including a thread using the processor, and the extraction unit uses the processor based on the information acquired by the acquisition unit. Information indicating the usage rate of a plurality of threads including the first thread is extracted as the second information from the threads, and an application including each of the plurality of threads extracted as the second information is shown. The third information may be extracted and the abnormality detection unit may detect an abnormality in the process based on the first information, the second information, and the third information.

In the electronic device, the usage rates of the plurality of threads including the first thread are the usage rate of the first thread, the usage rate of the second thread most used after the first thread, and the second thread. It may include the usage rate of the third most used thread after the thread.

In the electronic device, the calculation unit calculates a difference in usage rate between a plurality of threads included in the second information, and the abnormality detection unit calculates the second information when detecting an abnormality in the processing. The information based on the difference based on the above may be further used for detection.

The electronic device further includes a first evaluation unit that determines a first evaluation value based on whether or not each of the applications included in the third information is the same application, and the abnormality detection unit is the processing. When detecting the abnormality of, the first evaluation value based on the third information may be further used for detection.

The electronic device further includes a second evaluation unit that determines a second evaluation value based on each type of application included in the third information, and the abnormality detection unit detects an abnormality in the process. , The second evaluation value based on the third information may be further used for detection.

In the electronic device, the abnormality detection unit is machine-learned based on previously acquired information based on the first information, the second information, and the third information, and information on the presence or absence of an abnormality. An abnormality in the above processing may be detected by using the completed model.

Further, in the control method in an electronic device including a processor that executes processing based on a program according to the second aspect of the present invention, the acquisition unit indicates the usage rate of the processor for each thread using the processor. Based on the step of acquiring information and the information acquired by the acquisition unit, the calculation unit determines the ratio of the number of threads whose processor usage rate is within a predetermined range to the total number of threads using the processor. Based on the step of calculating the first information to be shown and the information acquired by the acquisition unit, the extraction unit indicates the usage rate of the first thread, which is the most used thread among the threads using the processor. The abnormality detection unit has a step of extracting the second information and a step of detecting an abnormality in the process based on the first information and the second information.

Further, the trained model for detecting an abnormality in the processing in the electronic device including the processor that executes the processing based on the program according to the third aspect of the present invention is the total number of threads using the processor. The first information indicating the ratio of the number of threads whose usage rate of the processor is within a predetermined range to the second information, and the second information indicating the usage rate of the first thread, which is the most used thread among the threads using the processor. Machine learning is performed based on the information, and the computer is made to function to detect the abnormality of the processing.

According to the above aspect of the present invention, it is possible to accurately detect an abnormality in the processing during execution.

The system diagram explaining the outline of the abnormality detection system which concerns on 1st Embodiment. The figure which shows an example of the acquisition timing of the state information of the system which concerns on 1st Embodiment. The figure which shows an example of the experimental result which investigated the relationship between the CPU usage rate for each thread which concerns on 1st Embodiment, and the presence or absence of an abnormality. The figure which shows an example of the thread utilization ratio which concerns on 1st Embodiment. The explanatory view of the abnormality detection method which concerns on 1st Embodiment. The block diagram which shows the configuration example of the hardware of the electronic device which concerns on 1st Embodiment. The block diagram which shows an example of the functional structure of the electronic device which concerns on 1st Embodiment. The figure which shows the calculation example of the thread usage rate ratio used for abnormality detection which concerns on 1st Embodiment. The flowchart which shows an example of the abnormality detection processing which concerns on 1st Embodiment. The figure which shows an example of the detection result for demonstrating the abnormality detection method which concerns on 2nd Embodiment. The figure which shows an example of the information about the thread usage rate which concerns on 2nd Embodiment. The figure which shows an example of the application information which concerns on 2nd Embodiment. The block diagram which shows an example of the functional structure of the electronic device which concerns on 2nd Embodiment. The figure which compared the correct answer rate of the abnormality detection result using various machine learning which concerns on 2nd Embodiment. The flowchart which shows an example of the abnormality detection processing which concerns on 2nd Embodiment. The block diagram which shows an example of the structure of the machine learning apparatus which concerns on 3rd Embodiment. An explanatory diagram illustrating an execution procedure in machine learning according to a third embodiment. An explanatory diagram illustrating a learning procedure in machine learning according to a third embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[System overview]
First, an outline of the abnormality detection system according to the present embodiment will be described.
FIG. 1 is a system diagram illustrating an outline of the abnormality detection system 1 according to the present embodiment. The illustrated abnormality detection system 1 includes an electronic device 10 and a machine learning device 30 (server device) capable of communicating with the electronic device 10 via a communication network NW. The machine learning device 30 is a server device that includes a database in which training data is stored, performs machine learning based on the learning data, and provides a machine-learned trained model. The electronic device 10 is, for example, a laptop-type (notebook-type) personal computer, but may be a desktop-type or tablet-type personal computer. The electronic device 10 detects an abnormality (problem) such as a decrease in its own performance.

The electronic device 10 collects state information (Raw data) related to the state of the system, and detects its own abnormality based on the collected state information of the system. In the following, unless otherwise specified, the system refers to a system using hardware, system firmware, and the like included in the electronic device 10, and has a different concept from the abnormality detection system 1. The system status information includes information such as a CPU (Central Processing Unit) usage rate. For example, the electronic device 10 acquires information about the CPU usage rate for each thread of the program (process) being executed. Further, the abnormality detection unit 115 of the electronic device 10 detects an abnormality such as a deterioration in performance (system slowdown) based on the acquired information on the CPU usage rate and the like.

Here, the abnormality detection unit 115 includes an AI (Artificial Integrity) engine. The anomaly detection unit 115 functions as a local AI that detects anomalies using a trained model (hereinafter referred to as “abnormality detection model”) that has been machine-learned using a data set based on information on CPU usage.

The system status information acquired by the electronic device 10 includes, for example, information on the CPU temperature, GPU (Graphic Processing Unit) (GPU usage rate, etc.), and information based on the operating status of the system (BSOD: Blue Screen of Death). , Hang up, etc.), information about the battery (discharge curve, full charge, low charge, charge start time, discharge start time, etc.), information on the rotation speed of the fan, and the like. Based on any of these acquired information, the abnormality detection unit 115 of the electronic device 10 has "short battery life", "degraded performance (slow processing)", "frequent system hangs", and the like. An abnormality (problem) or a failure may be detected.

[First Embodiment]
In the first embodiment, an embodiment in which the electronic device 10 detects an abnormality such as a decrease in performance based on the CPU usage rate for each thread will be described. First, the timing at which the electronic device 10 acquires the state information of the system will be described.

FIG. 2 is a diagram showing an example of acquisition timing of system state information according to the present embodiment. In the illustrated example, the acquisition timing of the system state information is shown, the vertical axis is the CPU usage rate, and the horizontal axis is the time. When the electronic device 10 detects a trigger event at time t1 (1), it acquires system state information (System State) according to the detection timing (2).

The trigger event is, for example, when an operation button instructing the start of abnormality detection is operated on the screen of the application for abnormality detection (the screen that accepts various operations related to abnormality detection), or the CPU usage rate is predetermined. Is generated when the threshold value (for example, "100% / number of cores" in 10 seconds) is exceeded. The trigger event may be generated at predetermined time intervals (for example, 30 minutes).

The electronic device 10 measures the CPU usage rate from the time t1 to a predetermined period th (for example, 30 seconds) (3). Further, at the time t2 when a predetermined period th (for example, 30 seconds) has elapsed from the time t1, the electronic device 10 again acquires the system state information (System State) (4). Further, at time t2, the electronic device 10 acquires process and thread information (5), system information (6), and the like. For example, the electronic device 10 collects data such as the CPU usage rate for each thread of each process from the difference between the information acquired from the time t1 to the time t2. Then, the electronic device 10 stores the collected information as a file (for example, a csv file) (7).

The electronic device 10 detects an abnormality (deterioration of performance) based on the CPU usage rate for each collected thread. For example, even if the CPU usage rate is high, the processing of a high-load application may be executed normally. The actual tendency of the CPU usage rate for each thread in each of the normal processing and the abnormal processing will be described with reference to FIG.

FIG. 3 is a diagram showing an example of experimental results for investigating the relationship between the CPU usage rate for each thread and the presence or absence of an abnormality. In the experiment, as a normal process, the CPU usage rate for each thread during normal work was measured. Further, as an abnormal process, the CPU usage rate for each thread was measured for each of the execution of the application having the CPU high load problem and the execution of the application having the bug of the infinite loop. In this figure, the horizontal axis represents the CPU usage rate and the vertical axis represents the number of threads, indicating how many threads have a CPU usage rate for each of normal processing and no abnormality processing. As a result, in reality, when the number of threads having a CPU usage rate of 1 to 5% is large, the processing is normal, and in the abnormal processing, the CPU usage rate is 10 as compared with the normal processing. The number of threads of about 30% or 90 to 100% tends to be relatively large. As described above, there is a difference in the CPU usage rate for each thread between normal processing and abnormal processing.

Therefore, in the electronic device 10, the ratio of the number of threads whose CPU usage rate is within a predetermined range to the total number of threads that used the CPU during the measurement of the CPU usage rate (hereinafter referred to as "thread usage rate ratio"). Is used to detect anomalies.

FIG. 4 is a diagram showing an example of the thread usage rate. This figure shows an example in which the thread usage rate ratio is calculated in 5% increments such as CPU usage rate of 1 to 5%, 6 to 10%, ..., 96 to 99%, 100%, and so on. There is. "ThreCU0105R" indicates the ratio of the number of threads having a CPU usage rate of 1 to 5% to the total number of threads using the CPU during the measurement of the CPU usage rate. "ThreCU0610R" indicates the ratio of the number of threads having a CPU usage rate of 6 to 10% to the total number of threads using the CPU during the measurement of the CPU usage rate. "ThreCU9699R" indicates the ratio of the number of threads having a CPU usage rate of 96 to 99% to the total number of threads using the CPU during the measurement of the CPU usage rate. "ThreCU100R" indicates the ratio of the number of threads having a CPU usage rate of 100% to the total number of threads using the CPU during the measurement of the CPU usage rate.

Further, the electronic device 10 further extracts the usage rate of the most used thread during the measurement based on the CPU usage rate for each thread collected. The thread most used during the measurement corresponds to the thread having the largest integrated value of the CPU usage rate and the usage time in the measurement period. Hereinafter, the thread most used during the measurement is referred to as a “first thread”. Further, the usage rate of the most used thread during the measurement is referred to as "first thread usage rate".

The electronic device 10 detects an abnormality using AI based on the calculated thread usage rate ratio and the extracted first thread usage rate. Although it is possible for the electronic device 10 to detect an abnormality by using the thread usage rate ratio, it is possible to detect an abnormality by using the first thread usage rate in addition to the thread usage rate ratio, as compared with the case where only the thread usage rate ratio is used. Also accurately detects abnormalities.

With reference to FIG. 5, the difference between the abnormality detection result of only the thread usage rate ratio and the abnormality detection result using the first thread usage rate in addition to the thread usage rate ratio will be described.
FIG. 5 is an explanatory diagram of an abnormality detection method according to the present embodiment. FIG. 5A shows an example of anomaly detection results using an anomaly detection model in which machine learning is performed based only on the thread usage rate ratio. OCSVM (One Class Support Vector Machine) is used for machine learning. Regarding the results of multiple verifications using OCSVM with the thread usage ratio as a parameter, those judged to be normal are shown by ◯, and those judged to be abnormal are shown by ●.

FIG. 5B shows three types of results determined to be abnormal with IDs 1 to 3, the first thread usage rate (1st Thread usage), the determination result by OCSVM (Prediction By OCSVM), and a person. Shows the final judgment result (Last Thread) confirmed by. ID1 had a first thread usage rate of 47% and was determined to be abnormal by OCSVM, but was normal in the final determination result confirmed by humans. ID2 had a first thread usage rate of 59%, was determined to be abnormal by OCSVM, and was also abnormal in the final determination result confirmed by a person. ID3 had a first thread usage rate of 60%, was determined to be abnormal by OCSVM, and was also abnormal in the final determination result confirmed by a person.

From this result, it can be seen that the detection accuracy is improved by adding the threshold value determination based on the first thread usage rate as a parameter at the time of abnormality detection. For example, when an abnormality is detected by OCSVM, the detection accuracy is improved by determining that it is abnormal when the first thread usage rate is 50% or more and normal when the first thread usage rate is less than 50%. Can be made to. FIG. 5C shows a comparison result between the correct answer rate of abnormality detection only by OCSVM and the correct answer rate of abnormality detection when the threshold value determination by the first thread usage rate is added to the abnormality detection by OCSVM. The correct answer rate for abnormality detection by OCSVM alone is 59.86%, whereas the correct answer rate for abnormality detection when the threshold value (50%) judgment based on the first thread usage rate is added to the abnormality detection by OCSVM is The detection accuracy is improved to 89.02%. The threshold value is not limited to 50%, and any threshold value can be set.

For example, the electronic device 10 detects an abnormality using an abnormality detection model in which machine learning is performed based only on the thread usage rate ratio, and then performs a threshold value determination based on the first thread usage rate to determine the final presence or absence of the abnormality. Is detected. The electronic device 10 may detect an abnormality using an abnormality detection model in which machine learning is performed based on both the thread usage rate ratio and the first thread usage rate.

Next, the configuration of the electronic device 10 will be described in detail.
(Hardware configuration of electronic devices)
FIG. 6 is a schematic block diagram showing a configuration example of the hardware of the electronic device 10 according to the present embodiment. The electronic device 10 includes a communication unit 11, a display unit 12, a speaker 13, an input unit 14, a power supply unit 15, a temperature sensor 17, a fan 16, an EC (Embedded Controller) 18, a storage unit 19, and a system processing unit 100. It is composed. The system processing unit 100 is configured to include a CPU 101, a GPU 102, a memory controller 103, an I / O (Input-Output) controller 104, and a system memory 105, and is on the OS by system processing by an operating system (OS: Operating System). It is possible to execute the processing of the programs of various applications with. The CPU 101 and GPU 102 may be collectively referred to as a processor.

The communication unit 11 connects to other devices in a communicable manner via a wireless or wired communication network, and transmits and receives various data. For example, the communication unit 11 includes a wired LAN interface such as Ethernet (registered trademark) and a wireless LAN interface such as Wi-Fi (registered trademark). The communication unit 11 may be configured to include a USB (Universal Serial Bus) interface and a Bluetooth (registered trademark) interface.

The display unit 12 is a display for displaying images, images, texts, and the like, and includes, for example, a liquid crystal display panel, an organic EL display panel, and the like. The speaker 13 outputs electronic sounds, voices, and the like.

The input unit 14 is an input unit that accepts user input, and is configured to include an input device such as a keyboard or a touch pad. The input unit 14 outputs an operation signal indicating the operation content to the EC 18 in response to receiving an operation on the keyboard, touch pad, or the like. The input unit 14 may include a touch panel that accepts operations on the display screen of the display unit 12.

The power supply unit 15 supplies electric power to each unit via the power supply system according to the operating state of each unit of the electronic device 10. The power supply unit 15 includes a DC (Direct Current) / DC converter. The DC / DC converter converts the voltage of the direct current power supplied from the AC (Alternate Current) / DC adapter or the battery 151 into the voltage required by each part. The electric power whose voltage is converted by the DC / DC converter is supplied to each part via each power supply system. For example, the power supply unit 15 supplies electric power to each unit via each power supply system based on a control signal according to the operating state of each unit input from the EC 18.

One or a plurality of temperature sensors 17 are provided inside the housing of the electronic device 10 to detect the environmental temperature. For example, the temperature sensor 17 is provided in a place where the temperature tends to rise, such as in the vicinity of the CPU 101 or in the vicinity of the battery 151.
The fan 16 is provided for cooling to lower the elevated temperature inside the electronic device 10.

The EC18 is an embedded controller incorporating a microcomputer that monitors and controls various devices (peripheral devices, sensors, etc.) regardless of the processing of the CPU 101, and has functions such as battery management, power supply management, and keyboard controller. .. For example, the EC 18 is connected to an input unit 14, a power supply unit 15, a fan 16, and a temperature sensor 17. The EC 18 acquires an operation signal from the input unit 14. Further, the EC 18 generates an activation signal in response to an operation on a power button (not shown). Further, the EC 18 instructs the power supply unit 15 to turn on / off the power supply to each unit, and also supplies information about the battery (discharge curve, full charge, low remaining amount, charge start time, discharge start time, etc.). Obtained from part 15. Further, the EC 18 acquires the detection result of the temperature sensor 17 and controls the ON / OFF of the fan 16 and the rotation speed at the time of ON according to the detection result (temperature). By communicating with the EC18 and the CPU101, various information and each operating state are shared.

The storage unit 19 includes a storage medium such as an SSD (Solid State Drive), an HDD (Hard Disk Drive), a ROM (Read Only Memory), and a RAM (Random access memory). The storage unit 19 stores various programs such as BIOS, OS, device driver, and application, other data necessary for program processing, and various data acquired by program processing.

The CPU 101 controls the operating state by system processing by the BIOS or the OS. It is possible to transition between at least a normal operating state (power-on state) and a standby state (idle state) as the operating state of the system. The standby state includes a standby state, a sleep state, a hibernation state, and a power-off state.

In the standby state, the processing power of the processor is lower than that in the normal operating state, and the power consumption of peripheral devices such as the communication unit 11, the display unit 12, the speaker 13, and the storage unit 19 is maintained while retaining the contents of the operating system memory 105. Is an operating state in which is less than the normal operating state.
The sleep state is an operation mode in which power supply to devices other than the system memory 105 and EC18 and the devices under the system memory 105 is stopped, and the processor does not execute a program.
The hibernation state is a mode in which all the information stored in the system memory 105 is saved in the auxiliary storage device that can be immediately accessed from the processor in the sleep state, and then the power supply to the system memory 105 is further stopped. Therefore, when starting the startup process from the hibernation state, the CPU 101 stores the information saved in the auxiliary storage device in the system memory 105.
The power-off state is a state in which power supply to devices other than EC18 and devices under it is stopped.

For example, when the operating state is the standby state and the start signal is input from the EC 18, the CPU 101 transitions from the standby state to the normal operating state. For example, when the operating state is a sleep state, a hibernation state, or a power-off state, when power is supplied from the power supply unit 15 and a start signal is input from the EC 18, the CPU 101 starts the start process. The CPU 101 detects and initializes a minimum number of devices such as the system memory 105 and the storage unit 19 in the startup process (preboot). The CPU 101 loads the BIOS from the storage unit 19 into the system memory 105, and detects and initializes other devices such as the communication unit 11 and the display unit 12 (post processing). Initialization includes processing such as setting initial parameters. In the transition (resume) from the sleep state to the normal operation state, a part of the post processing may be omitted. After the startup process is completed, the CPU 101 starts executing the system process by the OS (startup).

Further, the CPU 101 realizes the function of the installed application by executing the program of the installed application after the OS is started. For example, the above-mentioned abnormality detection process is provided as an abnormality detection application for performing the abnormality detection, and its function is realized by executing a program of the abnormality detection application.

The GPU 102 executes image processing based on the control of the CPU 101 to generate display data. The GPU 102 outputs the generated display data to the display unit 12. The CPU 101 and the GPU 102 may be integrated and formed as one core, or the load may be shared between the CPU 101 and the GPU 102 formed as individual cores. The number of processors is not limited to one, and may be a plurality.

The memory controller 103 controls reading and writing of data from the system memory 105, the storage unit 19, and the like by the CPU 101 and the GPU 102.
The I / O controller 104 controls the input or output of data with the communication unit 11, the display unit 12, the speaker 13, and the EC 18.
The system memory 105 is used as a read area for a program executed by the CPU 101 and a work area for writing processing data.

[Functional configuration of electronic devices]
Next, the functional configuration related to the abnormality detection process in the electronic device 10 will be described.
FIG. 7 is a block diagram showing an example of the functional configuration of the electronic device 10 according to the present embodiment. The control unit 110 shows the functional configuration of the abnormality detection process realized by the CPU 101 executing the program of the abnormality detection application. The control unit 110 includes an acquisition unit 111, a calculation unit 112, an extraction unit 113, and an abnormality detection unit 115. Further, as a configuration for storing data used for abnormality detection processing, the storage unit 19 includes a system information storage unit 191, a calculation information storage unit 192, an extraction information storage unit 193, an abnormality information storage unit 195, and an abnormality detection model. It is equipped with a storage unit 196.

The acquisition unit 111 acquires state information regarding the state of the system of the electronic device 10. For example, as described with reference to FIG. 2, the acquisition unit 111 has information on programs (processes) and threads being executed, system information (for example, information on the type and version of the OS) at preset timings. And so on. Then, the acquisition unit 111 stores the acquired information in the system information storage unit 191 in association with the information indicating the acquisition timing.

For example, the information acquired by the acquisition unit 111 includes data such as CPU usage rate, GPU usage rate, memory usage rate, and communication network connection status. Specifically, the information acquired by the acquisition unit 111 includes the total number of processes (NumOfProcesss) and the total number of threads (NumOfThread) in the measurement period shown in FIG. 2, the CPU usage rate for each thread, and the CPU usage rate for each thread. Contains data such as the number of processes and the number of threads per CPU usage. For example, the acquisition unit 111 has a CPU usage rate of 0%, 1 to 5%, 6 to 10%, ..., 96 to 99, for example, in increments of 5%, based on the measured CPU usage rate for each thread. The number of threads that is% or 100% is acquired as the number of threads for each CPU usage rate.

Here, the number of threads for each CPU usage rate is acquired in 5% increments and used for abnormality detection, but the present invention is not limited to this, and for example, threads for each CPU usage rate in 10% increments. You may acquire the number of threads and use them for abnormality detection.

The calculation unit 112 calculates the thread usage rate ratio based on the information acquired by the acquisition unit 111. As described above, since the number of threads having a CPU usage rate of 1 to 5% is large in normal processing, for example, the calculation unit 112 has a CPU usage rate within a predetermined range (for example,) with respect to the total number of threads using the CPU 101. The ratio of the number of threads, which is 1 to 5%), is calculated as the thread usage rate ratio. Then, the calculation unit 112 stores the calculated thread usage rate ratio in the calculation information storage unit 192 as a parameter used for abnormality detection.

FIG. 8 is a diagram showing a calculation example of the thread usage rate ratio used for abnormality detection. Assuming that the ratio of the number of threads having a CPU usage rate of 1 to 5% to the total number of threads using the CPU 101 during the measurement of the CPU usage rate is the thread usage rate ratio "ThreCU0105R".
ThreeCU0105R
= ThreeCU0105 × 100 / (NumOfThread-ThreCU00)
Can be represented by.
"ThreCU00" is the number of threads having a CPU usage rate of 0% during the measurement of the CPU usage rate. "ThreCU0105" is the number of threads having a CPU usage rate of 1 to 5% during the measurement of the CPU usage rate. "NumOfThread" is the total number of threads executed during the measurement of CPU usage.

Returning to FIG. 6, the extraction unit 113 extracts information indicating the first thread usage rate among the plurality of threads using the CPU 101 during the measurement period shown in FIG. 2 based on the information acquired by the acquisition unit 111. .. Then, the extraction unit 113 stores the extracted information indicating the first thread usage rate in the extraction information storage unit 193 as a parameter used for abnormality detection.

The abnormality detection unit 115 refers to the calculated information storage unit 192 and the extraction information storage unit 193, and detects an abnormality in processing (deterioration of performance, etc.) based on the thread usage rate ratio and the first thread usage rate. For example, the abnormality detection unit 115 detects a processing abnormality based on the thread usage rate ratio and the first thread usage rate by using the abnormality detection model which is a learned model for detecting the abnormality.

This abnormality detection model is a trained model machine-learned by the machine learning device 30 based on the thread usage ratio previously acquired by the electronic device 10 or another electronic device and the information regarding the presence or absence of the abnormality. For example, OCSVM is used as an algorithm for machine learning, and the discriminant boundary from an abnormal value is determined by machine learning the thread usage rate ratio at the time of normal as learning data, and the abnormality is detected based on the discriminant boundary. .. The electronic device 10 acquires this abnormality detection model from the machine learning device 30 in advance via the communication network NW or a storage medium, and stores it in the abnormality detection model storage unit 196.

Specifically, the abnormality detection unit 115 refers to the calculation information storage unit 192, and is an output result output by inputting the thread usage rate ratio calculated by the calculation unit 112 into the abnormality detection model (OCSVM). Normal / abnormal determination is performed (see FIGS. 5A and 5B). Further, when the abnormality detection unit 115 determines that the abnormality is determined by the OCSVM, the abnormality detection unit 115 determines the threshold value based on the first thread usage rate. For example, when the abnormality detection unit 115 is determined to be abnormal by OCSVM, it is determined to be abnormal when the first thread usage rate is 50% or more, and normal when the first thread usage rate is less than 50%. do. The machine learning method is not limited to OCSVM, and any method such as supervised learning, unsupervised learning, or reinforcement learning may be applied.

Further, the electronic device 10 may detect an abnormality using an abnormality detection model in which machine learning is performed based on both the thread usage rate ratio and the first thread usage rate. In this case, the abnormality detection model is machine-learned by the machine learning device 30 based on the thread usage rate ratio previously acquired by the electronic device 10 or another electronic device, the first thread usage rate, and the information regarding the presence or absence of an abnormality. It is a trained model. As the method of machine learning, any method such as supervised learning, unsupervised learning, or reinforcement learning may be applied. The abnormality detection unit 115 refers to the calculated information storage unit 192 and the extraction information storage unit 193, and inputs the thread usage rate ratio and the first thread usage rate to the abnormality detection model, and the output result is normal / normal. Determine the abnormality.

Further, when the abnormality is detected, the abnormality detection unit 115 generates abnormality information indicating the abnormality and stores it in the abnormality information storage unit 195. For example, the anomaly detection unit 115 generates anomaly information including information indicating the content of the detected anomaly (for example, deterioration of performance), anomalous process, anomalous thread, and the like.

(Operation of abnormality detection processing)
Next, the operation of the abnormality detection process executed by the control unit 110 in the electronic device 10 will be described. FIG. 9 is a flowchart showing an example of the abnormality detection process according to the present embodiment.
(Step S101) The control unit 110 acquires the state information of the system of the electronic device 10 at a preset timing. For example, the control unit 110 acquires information such as the CPU usage rate for each thread. Then, the control unit 110 stores the acquired information in the system information storage unit 191 in association with the information indicating the acquisition timing. Then, the process proceeds to step S103.

(Step S103) The control unit 110 calculates the thread usage rate ratio based on the information acquired in step S101. For example, the control unit 110 calculates the ratio of the number of threads whose CPU usage rate is 1 to 5% to the total number of threads using the CPU 101 during the measurement period as the thread usage rate ratio. Then, the control unit 110 stores the calculated thread usage rate ratio in the calculated information storage unit 192 as a parameter used for abnormality detection. Then, the process proceeds to step S105.

(Step S105) The control unit 110 extracts information indicating the usage rate of the first thread among the plurality of threads using the CPU 101 during the measurement period. Then, the control unit 110 stores the extracted information indicating the first thread usage rate in the extraction information storage unit 193 as a parameter used for abnormality detection. Then, the process proceeds to step S107.

(Step S107) The control unit 110 detects a processing abnormality (deterioration of performance, etc.) based on the thread usage rate ratio calculated in step S103 and the first thread usage rate extracted in step S105. For example, the control unit 110 determines normality / abnormality based on the output result output by inputting the calculated thread usage rate ratio to the abnormality detection model (OCSVM). This abnormality detection model is a trained model machine-learned by the machine learning device 30 based on the thread usage ratio previously acquired by the electronic device 10 or another electronic device and the information regarding the presence or absence of the abnormality. Further, when the control unit 110 determines that the abnormality is determined by the OCSVM, the control unit 110 determines the threshold value based on the first thread usage rate. For example, when the OCSVM determines that the control unit 110 is abnormal, the control unit 110 determines that it is abnormal when the first thread usage rate is 50% or more, and that it is normal when the first thread usage rate is less than 50%.

The control unit 110 was machine-learned by the machine learning device 30 based on the thread usage rate ratio previously acquired by the electronic device 10 or another electronic device, the first thread usage rate, and information regarding the presence or absence of an abnormality. An abnormality detection model may be used to detect processing abnormalities. For example, the control unit 110 may determine normality / abnormality based on the output result output by inputting the calculated thread usage rate ratio and the extracted first thread usage rate to the abnormality detection model. Then, when the control unit 110 determines normality / abnormality, the process proceeds to step S109.

(Step S109) The control unit 110 determines whether or not an abnormality has been detected. When the control unit 110 determines that an abnormality has been detected (YES), the control unit 110 proceeds to the process of step S111. On the other hand, when the control unit 110 determines that no abnormality is detected (NO), the control unit 110 ends the abnormality detection process.

(Step S111) When the control unit 110 detects an abnormality, it generates abnormality information indicating the abnormality and stores it in the abnormality information storage unit 195. For example, the abnormality information includes information indicating the content of the abnormality (degraded performance), an abnormal process, an abnormal thread, and the like. When the control unit 110 detects an abnormality, the control unit 110 displays display information based on the abnormality information. It is displayed on the display unit 12 to notify the user that an abnormality has been detected.

As described above, the electronic device 10 according to the present embodiment includes a CPU 101 (an example of a processor) that executes processing based on a program. For example, the electronic device 10 acquires information indicating the CPU usage rate for each thread using the CPU 101. Further, the electronic device 10 uses threads indicating the ratio of the number of threads whose CPU usage rate is within a predetermined range (for example, 1 to 5%) to the total number of threads using the CPU 101 based on the acquired information. Calculate the rate ratio (an example of the first information). Further, the electronic device 10 has a first thread usage rate (an example of the second information) indicating the usage rate of the first thread, which is the most used thread among the threads using the CPU 101, based on the acquired information. To extract. Then, the electronic device 10 detects a processing abnormality based on the thread usage rate ratio and the first thread usage rate.

As a result, the electronic device 10 can accurately detect an abnormality in the process being executed by using not only the thread usage rate ratio in the process being executed but also the first thread usage rate.

For example, the electronic device 10 uses an anomaly detection model (an example of a trained model) machine-learned based on previously acquired thread utilization ratios, first thread utilization, and information about the presence or absence of anomalies. Detects processing abnormalities. As a result, the electronic device 10 can accurately detect an abnormality using AI from the thread usage rate ratio and the first thread usage rate in the processing being executed.

Further, the abnormality detection model is an example of a trained model for detecting an abnormality in processing in an electronic device 10 including a CPU 101 that executes processing based on a program. The abnormality detection model uses a thread usage rate ratio (an example of the first information) showing the ratio of the number of threads whose usage rate of the CPU 101 is within a predetermined range to the total number of threads using the CPU 101, and the CPU 101. Machine learning is performed based on the usage rate of the first thread (an example of the second information), which indicates the usage rate of the first thread, which is the most used thread among the threads, and the computer functions to detect the abnormality in the above processing. Let me.

As a result, the electronic device 10 uses AI to accurately detect an abnormality in the processing being executed by using a machine-learned abnormality detection model using not only the thread usage rate ratio but also the first thread usage rate. be able to.

In this embodiment, the ratio of the number of threads having a CPU usage rate of 1 to 5% to the total number of threads using the CPU 101 is defined as the thread usage rate ratio, but the CPU usage rate is limited to 1 to 5%. It is not something that is done. For example, the ratio of the number of threads, which is an arbitrary specific CPU usage rate, to the total number of threads using the CPU 101 may be used as the thread usage rate ratio.

[Second Embodiment]
Next, a second embodiment of the present invention will be described.
In the first embodiment, the abnormality is detected by adding the threshold value determination based on the first thread usage rate in addition to the thread usage rate ratio, so that the detection accuracy is improved as compared with detecting the abnormality only by the thread usage rate ratio. I explained an example. However, as shown in FIG. 5C, the correct answer rate for anomaly detection is less than 90%, and false positives still occur at a constant rate. In this embodiment, an embodiment capable of detecting an abnormality more accurately will be described. Since the hardware configuration of the electronic device 10 according to the present embodiment is the same as the configuration shown in FIG. 6, the description thereof will be omitted, and the functional configuration and the abnormality detection process different from those of the first embodiment will be described.

With reference to FIG. 10, an example of erroneous detection in the first embodiment and parameters used for detection in the present embodiment will be described. FIG. 10 is a diagram showing an example of a detection result for explaining the abnormality detection method according to the present embodiment. Here, in the first embodiment, the most used thread in the measurement shown in FIG. 2 is referred to as "first thread", and the usage rate of this first thread is referred to as "first thread usage rate". I explained. Similarly, in the present embodiment, the description will be made using the “first thread” and the “first thread usage rate”, but similarly, the second most used thread is referred to as the “second thread”, which is the second thread. The thread usage rate is referred to as "second thread usage rate". Similarly, the third most used thread is referred to as a "third thread", and the usage rate of the third thread is referred to as a "third thread usage rate". The second most used thread is the most used thread after the first thread (that is, the thread with the next highest thread usage rate after the first thread usage rate). The third most used thread is the most used thread after the second thread (that is, the thread with the next highest thread usage rate after the second thread usage rate).

In this figure, IDs 1 to 3 are attached to the three types of abnormality detection results, and the information of the application including the first thread (Most Used app), the usage rate of the first thread (1st Thread usage), and the second thread are shown. Information on the included application (2nd Most Used app) and second thread utilization (2nd Thread usage), and information on the application containing the third thread (3rd Most Used application) and third thread utilization (3rd Thread usage). The measurement result, the abnormality detection result (Application By OCSVM + 50% thread) according to the first embodiment, and the actual presence / absence of abnormality (Real status) are shown in a table.

In the abnormality detection result using the OCSVM based on the thread usage rate ratio and the threshold value (50%) determination based on the first thread usage rate according to the first embodiment, ID1 is determined to be abnormal, and ID2 and ID3 are determined to be normal. To. However, in this example, ID1 was actually normal, and ID2 and ID3 were abnormal. Here, when not only the 1st thread usage rate but also the 2nd thread usage rate and the 3rd thread usage rate are confirmed, the difference between the 1st thread usage rate and the 2nd thread usage rate is only 2% in the abnormal ID1. It turns out that it is small. On the other hand, in normal ID2 and ID3, the difference between the first thread usage rate and the second thread usage rate is 30% and 56%, respectively, which are large. Further, the difference between the first thread usage rate and the third thread usage rate has the same tendency, and is smaller when it is abnormal.

Further, in the abnormal ID 1, the application (App-m1) including each of the first thread, the second thread, and the third thread is the same. That is, when the same application occupies a plurality of threads with a high usage rate (the CPU usage rate is high and the usage time is long), it can be said that the processing of the CPU 101 is an abnormal processing.

The application (App-dr5) including each thread of ID2 is an example of an application executed in the background by the OS. Since such an application cannot be forcibly terminated, it may be excluded from the target of anomaly detection. For example, even if the CPU usage rate is high due to the execution of the game application, it does not mean that the CPU usage rate is abnormally high, but it is a normal process. Therefore, the type of application also affects the abnormality detection.

In the present embodiment, the electronic device 10 improves the accuracy of the abnormality detection model by adding information on the second thread usage rate as well as the second thread usage rate) and the third thread usage rate as new parameters. .. Further, the electronic device 10 improves the accuracy of the abnormality detection model by adding the information of the application including each of the first thread, the second thread, and the third thread as a new parameter.

That is, the electronic device 10 processes based on the thread usage rate ratio, the information regarding the first thread usage rate, the second thread usage rate, and the third thread usage rate, and the information of the application including each thread. Detect anomalies. Since the thread usage rate ratio is the same as that described in the first embodiment, here, information on the thread usage rate and information on the application including each thread will be described in detail.

FIG. 11 is a diagram showing an example of information regarding the thread usage rate. As described above, the difference between the first thread usage rate and the second thread usage rate and the difference between the first thread usage rate and the third thread usage rate are related to the presence or absence of an abnormality. Therefore, as information on the thread usage rate, the first thread usage rate (ProcCpuUsage1), the difference between the first thread usage rate and the second thread usage rate (ProcCpuUsage2diff), the first thread usage rate, and the third thread usage rate. Difference (ProcCpuUsage3diff) is used as a parameter for abnormality detection.

FIG. 12 is a diagram showing an example of application information. As mentioned above, the fact that the same application has multiple threads is also related to the presence or absence of anomalies. Therefore, as application information, whether or not the first thread, the second thread, and the third thread are included in the same application is expressed as an evaluation value (Same App), and this evaluation value is used as a parameter for abnormality detection. do. For example, when the first thread and the third thread are included in the same application, the evaluation value (Same App) is set to "1". When the first thread and the second thread are included in the same application, the evaluation value (Same App) is set to "2". When the first thread, the second thread, and the third thread are all included in the same application, the evaluation value (Same App) is set to "3". Hereinafter, the evaluation value determined by whether or not the application is included in the same application is also referred to as a first evaluation value.

In addition, as application information, the type of application is also expressed as an evaluation value, and this evaluation value is used as a parameter for detecting an abnormality. For example, when the type of the application including the first thread is a browser, the evaluation value (browser) is set to "1". Further, when the type of the application including the first thread is a game application, the evaluation value (GameApp) is set to "1". Further, when the type of the application including the first thread is an application executed in the background by the OS, the evaluation value (OSApp) is set to "1". Hereinafter, the evaluation value determined based on the type of this application is also referred to as a second evaluation value.

It should be noted that each of the above-mentioned first evaluation value and second evaluation value is an example, and is not limited to the above-mentioned value.

(Functional configuration of electronic devices)
Next, the functional configuration of the electronic device 10 according to the present embodiment will be described.
FIG. 13 is a block diagram showing an example of the functional configuration of the electronic device 10 according to the present embodiment. The control unit 110A shows a functional configuration of an abnormality detection process realized by the CPU 101 executing the program of the abnormality detection application according to the present embodiment. The control unit 110A includes an acquisition unit 111, a calculation unit 112, an extraction unit 113, an evaluation unit 114, and an abnormality detection unit 115. Further, as a configuration for storing data used for abnormality detection processing, the storage unit 19 includes a system information storage unit 191, a calculation information storage unit 192, an extraction information storage unit 193, an evaluation information storage unit 194, and an abnormality information storage unit 194. It includes 195 and an abnormality detection model storage unit 196.

The acquisition unit 111 acquires state information regarding the state of the system of the electronic device 10. For example, as described with reference to FIG. 2, the acquisition unit 111 has information on programs (processes) and threads being executed, system information (for example, information on the type and version of the OS) at preset timings. And so on.

For example, as described in the first embodiment, the information acquired by the acquisition unit 111 includes the total number of processes (NumOfProcesss) and the total number of threads (NumOfThread) in the measurement period shown in FIG. 2, and each thread. Data such as the CPU usage rate, the number of processes per CPU usage rate, and the number of threads per CPU usage rate are included. In addition, the information acquired by the acquisition unit 111 further acquires application information indicating which application the process including the thread is. The application information is information that can identify the application, and may be, for example, the executable file name of the program of the application or the name of the application. Then, the acquisition unit 111 stores the acquired information in the system information storage unit 191 in association with the information indicating the acquisition timing.

The calculation unit 112 calculates the thread usage rate ratio based on the information acquired by the acquisition unit 111. The calculation method is the same as that of the first embodiment. For example, the calculation unit 112 calculates the ratio of the number of threads whose CPU usage rate is within a predetermined range (for example, 1 to 5%) to the total number of threads using the CPU 101 as the thread usage rate ratio. Then, the calculation unit 112 stores the calculated thread usage rate ratio in the calculation information storage unit 192 as a parameter used for abnormality detection.

Based on the information acquired by the acquisition unit 111, the extraction unit 113 obtains information indicating the usage rate of a plurality of threads including the first thread among the plurality of threads using the CPU 101 during the measurement period shown in FIG. 2). Extract the information shown. For example, the extraction unit 113 extracts information indicating the first thread usage rate, the second thread usage rate, and the third thread usage rate. Then, the extraction unit 113 stores the extracted information in the extraction information storage unit 193.

Further, the calculation unit 112 calculates the difference in the usage rate between the plurality of threads based on the information indicating the first thread usage rate, the second thread usage rate, and the third thread usage rate extracted by the extraction unit 113. do. For example, the calculation unit 112 calculates the difference between the first thread usage rate and the second thread usage rate (ProcCpuUsage2diff) and the difference between the first thread usage rate and the third thread usage rate (ProcCpuUsage3diff). Then, the calculation unit 112 determines the difference between the first thread usage rate (ProcCpuUsage1), the difference between the first thread usage rate and the second thread usage rate (ProcCpuUsage2diff), and the difference between the first thread usage rate and the third thread usage rate. (ProcCpuUsage3diff) is stored in the calculated information storage unit 192 as a parameter for detecting an abnormality.

The evaluation unit 114 first evaluates based on whether or not the applications including the first thread, the second thread, and the third thread are the same application based on the application information acquired by the acquisition unit 111. Determine the value. For example, the evaluation unit 114 determines the first evaluation value (Same App) to be "1" when the first thread and the third thread are included in the same application. Further, the evaluation unit 114 determines the first evaluation value (Same App) to be "2" when the first thread and the second thread are included in the same application. Further, the evaluation unit 114 determines the first evaluation value (Same App) to be "3" when all of the first thread, the second thread, and the third thread are included in the same application. Then, the evaluation unit 114 uses the first evaluation value determined based on the type of the application including each of the first thread, the second thread, and the third thread as a parameter for detecting an abnormality in the evaluation information storage unit 194. To memorize.

Further, the evaluation unit 114 determines the second evaluation value based on the type of the application including each of the first thread, the second thread, and the third thread, based on the application information acquired by the acquisition unit 111.
For example, when the type of the application including the first thread is a browser, the evaluation unit 114 determines the evaluation value (browser) to be "1" as the second evaluation value. Further, when the type of application including the first thread is a game application, the evaluation unit 114 determines the evaluation value (GameApp) to be "1" as the second evaluation value. Further, when the type of the application including the first thread is an application executed in the background by the OS, the evaluation unit 114 determines the evaluation value (OSApp) as "1" as the second evaluation value. Then, the evaluation unit 114 uses the second evaluation value determined based on the type of the application including each of the first thread, the second thread, and the third thread as a parameter for detecting an abnormality in the evaluation information storage unit 194. To memorize.

The anomaly detection unit 115 performs processing anomalies (performance) based on the thread usage rate ratio, the first thread usage rate, the second thread usage rate, the third thread usage rate, and the information of the application including each thread. Etc.) is detected. For example, the abnormality detection unit 115 has, in addition to the thread usage rate ratio, the difference between the first thread usage rate (ProcCpuUsage1), the first thread usage rate and the second thread usage rate (ProcCpuUsage2diff), and the first thread usage rate. Using the difference between the third thread usage rate and the third thread usage rate (ProcCpuUsage3diff) (see FIG. 11), processing abnormalities are detected based on the first evaluation value and the second evaluation value based on the type of application.

In the following, the difference between the 1st thread usage rate (ProcCpuUsage1), the 1st thread usage rate and the 2nd thread usage rate (ProcCpuUsage2diff), and the difference between the 1st thread usage rate and the 3rd thread usage rate (ProcCpuUsage3diff). Are collectively referred to as "thread usage difference information". Further, the first evaluation value and the second evaluation value based on the type of application are collectively referred to as "application evaluation information".

For example, the abnormality detection unit 115 detects an abnormality in processing by using an abnormality detection model which is a learned model for detecting an abnormality. This abnormality detection model is based on the thread usage rate ratio, thread usage rate difference information, and application evaluation information previously acquired by the electronic device 10 or other electronic devices, and the machine learning device 30 based on the information regarding the presence or absence of an abnormality. It is a trained model machine-learned in. As the method of machine learning, any method such as supervised learning, unsupervised learning, or reinforcement learning may be applied. The electronic device 10 acquires this abnormality detection model from the machine learning device 30 in advance via the communication network NW or a storage medium, and stores it in the abnormality detection model storage unit 196.

Specifically, the abnormality detection unit 115 refers to the calculation information storage unit 192, the extraction information storage unit 193, and the evaluation information storage unit 194, and obtains the thread usage rate ratio, the thread usage rate difference information, and the application evaluation information. Normal / abnormal judgment is made based on the output result output by inputting to the abnormality detection model (see FIG. 14).

FIG. 14 is a diagram comparing the accuracy rates of abnormality detection results using various machine learning. In the illustrated example, the Liner SVM, Bernoulli Naive Bayes, Random Forest, Random Tree, SGD, LightGBM, XG Boost Classifier, and Neural Network are shown by machine learning (De) There is. Among them, Neural Network (Deep Learning) has a correct answer rate of 99.81% and has the best detection accuracy.

Below, in order of increasing detection accuracy, XG Boost Classifier (correct answer rate: 99.51%), Light GBM (correct answer rate: 98.94%), SGD (correct answer rate: 98.86%), Random Tree (correct answer rate: 93). .71%), Random Forest (correct answer rate: 90.11%), Bernoulli Naive Bayes (correct answer rate: 87.16%), Linear SVM (correct answer rate: 85.04%).

From the above results, it is preferable to use a Neural Network (Deep Learning) having the best detection accuracy, but other machine learning methods may also be used. For example, other machine learning methods may be used in consideration of conditions other than detection accuracy such as the magnitude of the processing load.

(Operation of abnormality detection processing)
Next, the operation of the abnormality detection process executed by the control unit 110A in the electronic device 10 will be described. FIG. 15 is a flowchart showing an example of the abnormality detection process according to the present embodiment.
(Step S201) The control unit 110A acquires the state information of the system of the electronic device 10 at a preset timing. For example, the control unit 110A acquires information indicating the CPU usage rate for each thread, application information for each thread, and the like. Then, the control unit 110A stores the acquired information in the system information storage unit 191 in association with the information indicating the acquisition timing. Then, the process proceeds to step S203.

(Step S203) The control unit 110A calculates the thread usage rate ratio based on the information acquired in step S201. For example, the control unit 110A calculates the ratio of the number of threads whose CPU usage rate is 1 to 5% to the total number of threads using the CPU 101 during the measurement period as the thread usage rate ratio. Then, the control unit 110A stores the calculated thread usage rate ratio in the calculated information storage unit 192 as a parameter used for abnormality detection. Then, the process proceeds to step S205.

(Step S205) The control unit 110A extracts information indicating the first thread usage rate, the second thread usage rate, and the third thread usage rate based on the information acquired in step S201. Then, the control unit 110A stores the extracted information in the extraction information storage unit 193, and proceeds to the process of step S207.

(Step S207) The control unit 110A calculates the difference between the first thread usage rate and the second thread usage rate, and the difference between the first thread usage rate and the third thread usage rate. Then, the control unit 110A includes a thread usage including a difference between the first thread usage rate, the first thread usage rate and the second thread usage rate, and a difference between the first thread usage rate and the third thread usage rate. The rate difference information is stored in the calculated information storage unit 192 as a parameter for detecting an abnormality. Then, the process proceeds to step S209.

(Step S209) The control unit 110A is based on the information acquired in step S201.
The evaluation value is determined based on the type of application including each of the first thread, the second thread, and the third thread. For example, the control unit 110A determines the first evaluation value based on whether or not the applications including the first thread, the second thread, and the third thread are the same application (see FIG. 11). Further, the control unit 110A determines the second evaluation value based on the type of the application including each of the first thread, the second thread, and the third thread. Then, the control unit 110A abnormally displays the application evaluation information including the first evaluation value and the second evaluation value determined based on the type of the application including each of the first thread, the second thread, and the third thread. It is stored in the evaluation information storage unit 194 as a parameter for detection. Then, the process proceeds to step S211.

(Step S211) The control unit 110A detects a processing abnormality (deterioration of performance, etc.) based on the thread usage rate ratio, the thread usage rate difference information, and the application evaluation information. For example, the control unit 110A determines normality / abnormality based on the output result output by inputting the thread usage rate ratio, the thread usage rate difference information, and the application evaluation information into the abnormality detection model. Then, the process proceeds to step S213.

(Step S213) The control unit 110A determines whether or not an abnormality has been detected. When the control unit 110A determines that an abnormality has been detected (YES), the control unit 110A proceeds to the process of step S215. On the other hand, when the control unit 110 determines that no abnormality is detected (NO), the control unit 110 ends the abnormality detection process.

(Step S215) When the control unit 110A detects an abnormality, the control unit 110A generates abnormality information indicating the abnormality and stores it in the abnormality information storage unit 195. For example, the abnormality information includes information indicating the content of the abnormality (degraded performance), an abnormal process, an abnormal thread, and the like. When the control unit 110A detects an abnormality, the control unit 110A displays display information based on the abnormality information. It is displayed on the display unit 12 to notify the user that an abnormality has been detected.

As described above, the electronic device 10 according to the present embodiment acquires information indicating the CPU usage rate for each thread using the CPU 101 (an example of a processor) and information indicating an application including the thread. .. Further, the electronic device 10 calculates the thread usage rate ratio (an example of the first information) based on the acquired information. Further, the electronic device 10 extracts information (an example of the second information) indicating the usage rate of a plurality of threads including the first thread from the threads using the CPU 101 based on the acquired information. Information (an example of the third information) indicating an application including each of the extracted plurality of threads is extracted. Then, the electronic device 10 detects a processing abnormality based on the thread usage rate ratio, the information indicating the usage rate of the plurality of threads including the first thread, and the information indicating the application including the thread.

As a result, the electronic device 10 is executing by using not only the thread usage rate ratio in the processing being executed but also the usage rates of a plurality of threads including the first thread and the application information including each of the threads. It is possible to accurately detect abnormalities in the processing of. For example, when the same application occupies a plurality of threads at a high usage rate, there is a high possibility that the processing of the CPU 101 is an abnormal processing. Therefore, the electronic device 10 is described as a parameter including the characteristics. By using the first information, the second information, and the third information of the above, the abnormality can be detected with high accuracy.

For example, the usage rates of the plurality of threads including the first thread are the usage rate of the first thread (first thread usage rate) and the usage rate of the second thread most used after the first thread (second thread usage rate). The thread usage rate) and the usage rate of the third thread most used after the second thread (third thread usage rate) are included.

As a result, the electronic device 10 can improve the detection accuracy by detecting an abnormality using the usage rate of the thread having the higher thread usage rate in the processing being executed.

Specifically, the electronic device 10 calculates the difference in the usage rate between the plurality of threads included in the information indicating the usage rate of the plurality of threads including the first thread (an example of the second information). For example, the electronic device 10 calculates the difference between the first thread usage rate and the second thread usage rate, and the difference between the first thread usage rate and the third thread usage rate. Then, when detecting an abnormality in processing, the electronic device 10 further uses information based on the difference in usage rate between the plurality of threads in addition to the thread usage rate ratio and the first thread usage rate.

As a result, the electronic device 10 can improve the detection accuracy by detecting the abnormality by further using the difference in the thread usage rate between the plurality of threads. For example, the electronic device 10 can improve the detection accuracy by detecting an abnormality by further using the difference in the thread usage rate between a plurality of threads having a higher thread usage rate.

Further, the electronic device 10 is based on whether or not each of the applications including each of the plurality of threads including the first thread (for example, the first thread, the second thread, and the third thread) is the same application. The first evaluation value is determined. Then, when the electronic device 10 detects an abnormality in the process, the first evaluation value is further used for detection.

As a result, the electronic device 10 can improve the detection accuracy by detecting the abnormality based on whether or not the threads having the higher thread usage rate are the same application.

Further, the electronic device 10 determines the second evaluation value based on each type of the application including each of the plurality of threads including the first thread (for example, the first thread, the second thread, and the third thread). do. Then, when the electronic device 10 detects an abnormality in the process, the second evaluation value is further used for detection.

As a result, the electronic device 10 can improve the detection accuracy by detecting the abnormality based on the type of the application including the thread having the higher thread usage rate.

That is, the electronic device 10 has a thread usage rate ratio (an example of information based on the first information), a thread usage rate difference information (an example of information based on the second information), and application evaluation information (an example of information based on the third information). An abnormality in processing is detected based on one example).

As a result, since the electronic device 10 uses not only the thread usage rate ratio in the processing being executed but also the thread usage rate difference information and the application evaluation information, it is possible to accurately detect an abnormality in the processing being executed. For example, when the same application occupies a plurality of threads at a high usage rate, there is a high possibility that the processing of the CPU 101 is an abnormal processing. Therefore, the electronic device 10 is described as a parameter including the characteristics. By using the thread usage rate ratio, the thread usage rate difference information, and the application evaluation information, it is possible to detect an abnormality with high accuracy.

For example, the electronic device 10 has previously acquired thread usage ratio (an example of information based on the first information), thread usage difference information (an example of information based on the second information), and application evaluation information (third). An abnormality in processing is detected using a trained model that has been machine-learned based on information based on information) and information on the presence or absence of anomalies.

As a result, the electronic device 10 can accurately detect an abnormality using AI from the thread usage rate ratio, the thread usage rate difference information, and the application evaluation information in the processing being executed.

Further, the abnormality detection model is an example of a trained model for detecting an abnormality in processing in an electronic device 10 including a CPU 101 that executes processing based on a program. The anomaly detection model includes a thread usage rate ratio (an example of information based on the first information), a thread usage rate difference information (an example of information based on the second information), and application evaluation information (an example of information based on the third information). It is machine-learned based on the above, and the computer is made to function to detect the abnormality of the above processing.

As a result, the electronic device 10 can accurately detect an abnormality using AI from the thread usage rate ratio, the thread usage rate difference information, and the application evaluation information in the processing being executed.

The thread usage difference information includes the difference between the first thread usage rate, the first thread usage rate and the second thread usage rate, and the difference between the first thread usage rate and the third thread usage rate. An example involving two parameters has been described, but is not limited to this. For example, the thread usage difference information may include only two parameters, the first thread usage rate and the difference between the first thread usage rate and the second thread usage rate, or the first thread usage rate. And only two parameters, the difference between the first thread usage rate and the third thread usage rate, may be included. Further, instead of the thread usage rate difference information, thread usage rate information including the first thread usage rate, the second thread usage rate, and the third thread usage rate may be used for abnormality detection.

Further, the top three thread usage rates of the first thread usage rate, the second thread usage rate, and the third thread usage rate are used, but the present invention is not limited to this. For example, the top two thread usage rates of the first thread usage rate and the second thread usage rate may be used, or any two of the top three threads may be used. Further, the difference in the thread usage rate between the threads to be written may be calculated by using four or more thread usage rates such as the first to fourth thread usage rates and included in the thread usage rate difference information. ..

Further, an example in which the application evaluation information includes the first evaluation value based on whether or not the application is the same and the second evaluation value based on the type of application has been described, but the first evaluation value and the second evaluation value have been described. One of the following may be included.

Further, an example in which the first evaluation value is determined based on whether or not the three threads of the first thread, the second thread, and the third thread are the same has been described. And the first evaluation value may be determined based on whether or not it is the same for any two threads of the third thread. Further, the first evaluation value may be determined based on whether or not the four or more reds are the same.

Further, as an example of the second evaluation value, a case where the application type is a browser, a game application, or an application executed in the background by the OS has been described, but other types of applications have been described. The second evaluation value may also be applied.

[Third Embodiment]
In this embodiment, the configuration of the machine learning device 30 that generates the trained model (abnormality detection model) used for the abnormality detection process in the abnormality detection system 1 will be described.
FIG. 16 is a block diagram showing an example of the configuration of the machine learning device 30 according to the present embodiment. The machine learning device 30 includes a communication unit 310, a learning data setting unit 320, a learning data storage unit 330, a learning unit 340, and an output unit 350.

The communication unit 310 includes, for example, a plurality of Ethernet (registered trademark) ports, a plurality of digital input / output ports such as USB, and a wireless communication port such as WiFi (registered trademark) and a mobile phone line, and is configured as a communication network NW. Communicate with other devices, terminals, etc. via (see FIG. 1).

The training data setting unit 320 acquires the information necessary for generating the trained model. For example, the learning data setting unit 320 may use the information based on the system state information previously acquired by the electronic device 10 or another electronic device as the information necessary for generating the trained model, such as the communication unit 310 or the optical disk. Acquired via a storage medium such as a memory card. The information based on the system state information is, for example, information indicating the thread usage rate ratio and the first thread usage rate in the abnormality detection process according to the first embodiment. Further, for example, in the abnormality detection process according to the second embodiment, the thread usage rate ratio, the thread usage rate difference information, and the application evaluation information are provided.

Further, the learning data setting unit 320 acquires information regarding the presence or absence of an abnormality corresponding to the information based on the acquired system state information. The presence / absence of an abnormality is a result of an operator, an engineer, or the like determining whether or not the processing status at the time when the system status information is measured is abnormal (normal / abnormal). That is, the information regarding the presence or absence of this abnormality is information indicating whether or not the abnormality was actually present.

The learning data setting unit 320 acquires the system state information previously acquired by the electronic device 10 or another electronic device via the communication unit 310 or a storage medium, and based on the acquired system state information. , Thread usage ratio, first thread usage rate, thread usage rate difference information, application evaluation information, etc. can be generated and acquired as information based on the system state information required to generate the trained model. good. In that case, the learning data setting unit 320 may include a part or all of the configurations corresponding to the calculation unit 112, the extraction unit 113, and the evaluation unit 114 shown in FIG. 7 or 13.

Further, the learning data setting unit 320 stores the association information in which the information based on the acquired system state information and the information regarding the presence / absence of an abnormality are associated with each other as a learning data set in the learning data storage unit 330. As a result, the learning data storage unit 330 stores a plurality of learning data sets in which information based on the state information of the system previously acquired by the electronic device 10 or another electronic device and information regarding the presence or absence of an abnormality are associated with each other. To. The learning data setting unit 320 may acquire information based on the system status information and information regarding the presence or absence of an abnormality at any time each time the system status information is measured by the electronic device 10 or another electronic device. , May be acquired in a batch at a predetermined timing.

The learning unit 340 performs the next machine learning using the learning data set in which the information based on the state information of the system and the information regarding the presence / absence of an abnormality are associated with each other. Specifically, the learning unit 340 reads the learning data set from the learning data storage unit 330. The learning unit 340 performs machine learning using the read learning data set, and generates a trained model. The output unit 350 transmits the trained model to the abnormality detection system 1 via the communication unit 310. As a result, the learned model is stored in the learning model storage unit 234 of the abnormality detection system 1 and can be used. The trained model may be stored in the learning model storage unit 234 of the abnormality detection system 1 via a storage medium such as an optical disk or a memory card instead of the communication unit 310. Further, the trained model may be updated as the machine learning progresses in the machine learning device 30.

<Learning stage>
Next, a specific example of machine learning will be described. The learning unit 340 sets the information based on the state information of the system as an input variable for inputting to the input layer for the neural network for learning, and sets the information regarding the presence or absence of an abnormality as an output variable output from the output layer.

(About neural network)
FIG. 17 is a schematic diagram for explaining an example of the neural network according to the present embodiment. The neural network in this figure is composed of L layers l. The layer with l = 1 is also called an input layer, the layer with l = 2 to L-1 is also called an intermediate layer or a hidden layer, and the layer with l = L is also called an output layer.
The N nodes in the input layer are x _n (n = 1, 2, 3, ... N). That is, in the neural network, a vector x (= (x ₁ , x ₂ , x ₃ , ... X _N )) having x _n as an element is input to the input layer. The output of the output layer is M ( _m = 1, 2, 3, ... M). That is, the neural network outputs a vector y (= (y ₁ , y ₂ , y ₃ , ... y _M )) having ym as an element from the output layer.

From the node of the first layer, the vector z ^{(l + 1)} is output as the value in which the vector u ^{(l + 1)} is input to the function f (u ^{(l + 1)} ). The vector u ^{(l + 1)} is a vector obtained by multiplying the vector z ^(l) output from the node of the first layer by the weight matrix w ^{(l + 1)} from the left and adding the vector b ^{(l + 1)} . The function f (u ^(l) ) is an activation function, and the vector b ^(l) is a bias. The vector z ⁽¹⁾ output from the input layer is a vector x.

(About learning process)
FIG. 18 is a schematic diagram for explaining an example of the learning process according to the present embodiment.
FIG. 18 shows a learning process using the neural network of FIG.
In the learning stage, the pair of the vector X _i and the vector Y _i as teacher data is regarded as a learning data set. The vector X _i is a vector in which a value is set in the vector x, and the vector Y _i is a vector in which a value is set in the vector y. In the neural network, the weight matrix w ^(l) is updated based on I training data sets (X _i , Y _i ) (i = 1 to I).

Specifically, an initial value is set in the weight matrix w ^(l) . When data X _i is input to the input layer, the neural network whose value is set in the weight matrix w ^(l) outputs a vector y (expressed as y (X _i )) corresponding to the data X from the output layer. do. The error E between the vector y (X _i ) and the data Y _i is calculated using the loss function. The gradient ΔE _{l + 1} of the first layer is calculated using the output z _{l + 1} from each layer and the error signal δ _{l + 1} . The error signal δ _{l + 1} is calculated using the error signal δ _l . In addition, transmitting the error signal from the output layer side to the input layer side in this way is also called back propagation.
The weight matrix w ^(l) is updated based on the gradient ΔE _{l + 1} . The update of the weight matrix w ^(l) is sequentially performed for I training data sets (X _i , Y _i ) (i = 1 to I). The trained model is a neural network in which the weight matrix w ^(l) is updated by I training data sets (X _i , Y _i ).

(Example of neural network setting)
The learning unit 340 performs learning processing with each of the information based on the state information of the system as the vector X _i and the information regarding the presence or absence of the abnormality as the vector Y _i . The learning unit 340 performs learning processing by updating the weight matrix w ^(l) by back propagation based on I learning data sets (X _i , Y _i ) (i = 1 to I). As a result of the learning process, the learning unit 340 acquires the neural network in which the weight matrix w ^(l) is updated as a trained model. That is, the learning unit 340 generates a trained model based on the information based on the state information of the system and the information regarding the presence / absence of an abnormality. For example, the learning unit 340 generates a trained model for detecting an abnormality in processing by the CPU 101 based on information indicating a thread usage rate ratio and a first thread usage rate and information regarding the presence or absence of an abnormality. Further, the learning unit 340 generates a trained model for detecting an abnormality in processing by the CPU 101 based on the thread usage rate ratio, the thread usage rate difference information, and the application evaluation information and the information regarding the presence or absence of an abnormality.

Here, the learning unit 340 can set an arbitrary number of layers as the number of layers (L) of the neural network.
The learning unit 340 uses N as the number of nodes in the input layer (l = 1 layer) and the number of nodes in the intermediate layer (l = 2 layer) as the number of nodes in each layer (also referred to as “the number of nodes”). M + N) ÷ 2 and the number of nodes in the output layer (l = 3 layer) is set to M. However, the present invention is not limited to this, and the number of nodes in the intermediate layer may be N or M, or may be N or less and M or more. Further, the number of nodes in the intermediate layer may be N or more, or M or more.

The learning unit 340 sets a full connection as a connection of each layer of the neural network. However, the present invention is not limited to this, and the bonds of some or all layers may be set to non-total bonds.
The learning unit 340 sets a sigmoid function in the activation function of all layers as the activation function. However, the present invention is not limited to this, and the activation function of each layer is a step function, a linear connection, a soft sign, a soft plus, a ramp function, a truncated power function, a polymorphic value, an absolute value, a radial basis function, a wavelet, a maxout, etc. , May be another activation function. Also, the activation function of one layer may be of a different type from that of other layers.

The learning unit 340 sets a squared loss (mean squared error) as an error function. However, the present invention is not limited to this, and the error function may be cross entropy, τ-division loss, Huber loss, and ε sensitivity loss (ε tolerance function). Further, the learning unit 340 sets SGD (stochastic gradient descent) as an algorithm for calculating the gradient (gradient descent algorithm). However, the present invention is not limited to this, and Momentum (inertia term) SDG, AdaGrad, RMSprop, AdaDelta, Adam (Adaptive momentation) and the like may be used for the gradient descent algorithm.
The learning unit 340 is not limited to the perceptron neural network, and may set other neural networks such as a convolutional neural network (CNN), a recurrent neural network (RNN), and a residual network (ResNet).

<Execution stage>
The abnormality detection unit 115 of the electronic device 10 inputs information based on the state information of the current system to the trained model generated by the learning unit 340, and thus whether or not there is an abnormality in the processing by the CPU 101 (normal / abnormal). Is output. Specifically, the abnormality detection unit 115 inputs the information based on the system state information acquired in the execution stage as the vector x, and outputs the vector y as the information regarding the presence or absence of the abnormality.
In this way, the abnormality detection unit 115 outputs information regarding the presence or absence of an abnormality based on the information based on the state information of the system and the learning result of the learning unit 340. As a result, the abnormality detection unit 115 can detect an abnormality in the processing by the CPU 101.

<Example of learning variant>
In the above embodiment, the learning process may be unsupervised learning, supervised learning other than a neural network, or learning process using reinforcement learning.

(Unsupervised learning)
The learning unit 340 may perform unsupervised learning learning processing by performing regression or classification on I learning data sets (X _i , Y _i ) (i = 1 to I).
The learning unit 340 determines the variables for the model of one or more functions so that the error with the I training data sets (X _i , Y _i ) is small. The learning unit 340 may generate a model in which variables are determined as a trained model by regression.
The learning unit 340 classifies I learning data sets (X _i , Y _i ) into subsets by clustering. The learning unit 340 may use information indicating the boundaries of each subset (cluster) as a trained model by classification. The clustering may be a hierarchical algorithm such as a single link method, a complete link method, a group average method, a centroid method, a weighted average method, or a median method. Further, the clustering may be non-hierarchical such as the K-means method. In the case of the K-means method, the number of clusters may be predetermined, or may be manually or automatically set by the computer.

(Supervised learning)
The learning unit 340 is not limited to neural networks, but can perform supervised learning learning processing using decision trees, regression trees, random forests, gradient boosting trees, linear regression, logistic regression, SVM (support vector machine), etc. good.
When performing the learning process using the decision tree, the learning unit 340 sets the vector X _i as the independent variable and the vector Y _i as the dependent variable for the I learning data sets (X _i , Y _i ).

(Reinforcement learning)
The learning unit 340 may perform the learning process of reinforcement learning using the learning data set (X _i , Y _i ). For example, the learning unit 340 performs reinforcement learning (Q learning) using the Q value as reinforcement learning. The learning unit 340 calculates Q (s, a) based on the vector Y _i . Here, s represents a state, a represents an action, and the learning unit 340 may use the state s or the action a as a value based on the vector X _i . The present invention is not limited to Q-learning, and Sarsa or the Monte Carlo method may be used for reinforcement learning.

<Variable transformation example>
In the above embodiment, as the learning data set (X _i , Y _i ), a part of the information based on the state information of the system and the information regarding the presence or absence of an abnormality may be used. That is, the learning unit 340 selects learning data of a set of information based on the state information of the system and information regarding the presence or absence of an abnormality, in which a part of this information or a combination thereof satisfies a predetermined condition. It may be a set (X _i , Y _i ). Further, the learning unit 340 uses a value converted according to a predetermined rule for a part or all of the information based on the system state information and the information regarding the presence or absence of an abnormality in the learning data set (X _i , Y _i ). You may. For example, the learning unit 340 sets a learning data set for a part or all of the information based on the state information of the system and the information regarding the presence or absence of an abnormality, and the difference between the time change, the change in space, or different measurement opportunities. It may be used as (X _i , Y _i ).

Although the embodiments of the present invention have been described in detail with reference to the drawings, the specific configuration is not limited to the above, and various design changes and the like can be made without departing from the gist of the present invention. It is possible to do. For example, the configurations described in each embodiment may be combined arbitrarily.

Further, in the above embodiment, an example of detecting an abnormality using a trained model has been described, but the present invention is not limited to this. For example, in the first embodiment, a data table in which the thread usage ratio and a part or all of the first thread usage rate are associated with the presence or absence of an abnormality (normal or abnormal) without using the trained model is used. It may be configured to be used to detect anomalies. Further, instead of using the trained model, it may be configured to detect anomalies by using a program that embodies an algorithm for detecting anomalies based on a thread utilization ratio and a first thread utilization rate. Similarly, in the second embodiment, the presence / absence of abnormality (normal or abnormal) with a part or all of the thread usage ratio, the thread usage difference information, and the application evaluation information without using the trained model. It may be configured to detect anomalies using a data table associated with. In addition, it is configured to detect anomalies using a program that embodies an algorithm that detects anomalies based on thread utilization ratio, thread utilization difference information, and application evaluation information, without using a trained model. May be done.

Further, in the above embodiment, the EC18 that operates independently of the system processing unit 100 may be any processing unit such as a sensor hub or a chipset, and a processing unit other than the EC18 performs the above processing instead of the EC18. You may do it. Further, the system processing unit 100 and the EC 18 may be configured by an integrated circuit.

The above-mentioned electronic device 10 has a computer system inside. Then, a program for realizing the functions of each configuration included in the above-mentioned electronic device 10 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed. The processing in each configuration provided in the above-mentioned electronic device 10 may be performed. Here, "loading and executing a program recorded on a recording medium into a computer system" includes installing the program in the computer system. The term "computer system" as used herein includes hardware such as an OS and peripheral devices. Further, the "computer system" may include a plurality of computer devices connected via a network including a communication line such as the Internet, WAN, LAN, and a dedicated line. Further, the "computer-readable recording medium" refers to a portable medium such as a flexible disk, a magneto-optical disk, a ROM, or a CD-ROM, and a storage device such as a hard disk built in a computer system. As described above, the recording medium in which the program is stored may be a non-transient recording medium such as a CD-ROM.

The recording medium also includes an internal or external recording medium accessible from the distribution server for distributing the program. It should be noted that the program may be divided into a plurality of parts, downloaded at different timings, and then combined with each configuration included in the electronic device 10, or the distribution server for distributing each of the divided programs may be different. Furthermore, a "computer-readable recording medium" is a volatile memory (RAM) inside a computer system that serves as a server or client when a program is transmitted via a network, and holds the program for a certain period of time. It shall include things. Further, the above program may be for realizing a part of the above-mentioned functions. Further, a so-called difference file (difference program) may be used, which can realize the above-mentioned function in combination with a program already recorded in the computer system.

Further, a part or all of each function of the electronic device 10 in the above-described embodiment may be realized as an integrated circuit such as an LSI (Large Scale Integration). Each function may be made into a processor individually, or a part or all of them may be integrated into a processor. Further, the method of making an integrated circuit is not limited to the LSI, and may be realized by a dedicated circuit or a general-purpose processor. Further, when an integrated circuit technology that replaces an LSI appears due to advances in semiconductor technology, an integrated circuit based on this technology may be used.

Further, the electronic device 10 of the above embodiment is not limited to a personal computer, but may be a portable terminal device such as a smartphone, and various types such as a game device, a household electric product, and a commercial electric product. Applicable to electronic devices.

1 Anomaly detection system, 10 Electronic devices, 11 Communication section, 12 Display section, 13 Speaker, 14 Input section, 15 Power supply section, 16 Fan, 17 Temperature sensor, 18 EC, 19 Storage section, 20 Database, 30 Machine learning device, 100 System processing unit, 101 CPU, 102 GPU, 103 memory controller, 104 I / O controller, 105 system memory, 110, 110A control unit, 111 acquisition unit, 112 calculation unit, 113 extraction unit, 114 evaluation unit, 115 abnormality detection Unit, 191 system information storage unit, 192 calculation information storage unit, 193 extraction information storage unit, 194 evaluation information storage unit, 195 abnormality information storage unit, 196 abnormality detection model storage unit.

Claims (10)

A processor that executes processing based on a program, and
An acquisition unit that acquires information indicating the usage rate of the processor for each thread using the processor, and an acquisition unit.
Based on the information acquired by the acquisition unit, a calculation unit that calculates first information indicating the ratio of the number of threads whose usage rate of the processor is within a predetermined range to the total number of threads using the processor, and a calculation unit.
Based on the information acquired by the acquisition unit, an extraction unit that extracts second information indicating the usage rate of the first thread, which is the most used thread among the threads using the processor, and an extraction unit.
An abnormality detection unit that detects an abnormality in the process based on the first information and the second information.
Electronic equipment equipped with. The abnormality detection unit is
Using a trained model machine-learned based on previously acquired first information, second information, and information regarding the presence or absence of anomalies, anomalies in the processing are detected.
The electronic device according to claim 1. The acquisition unit
Further acquisition of information indicating the application containing the thread using the processor,
The extraction unit
Based on the information acquired by the acquisition unit, information indicating the usage rate of a plurality of threads including the first thread is extracted as the second information from the threads using the processor, and the second information is extracted. The third information indicating the application including each of the plurality of threads extracted as information is extracted, and the abnormality detection unit is
The electronic device according to claim 1, wherein an abnormality in the processing is detected based on the first information, the second information, and the third information. The usage rates of the plurality of threads including the first thread are the usage rate of the first thread, the usage rate of the second thread most used after the first thread, and the usage rate next to the second thread. Including the usage rate of the third thread used,
The electronic device according to claim 3. The calculation unit
The difference in the usage rate between the plurality of threads included in the second information is calculated, and the difference is calculated.
The abnormality detection unit is
When detecting the abnormality of the processing, the information based on the difference based on the second information is further used for detection.
The electronic device according to claim 4. Further, a first evaluation unit for determining a first evaluation value based on whether or not each of the applications included in the third information is the same application is provided.
The abnormality detection unit is
When detecting the abnormality of the processing, the first evaluation value based on the third information is further used for detection.
The electronic device according to any one of claims 3 to 5. Further provided with a second evaluation unit that determines a second evaluation value based on each type of application included in the third information.
The abnormality detection unit is
When detecting the abnormality of the processing, the second evaluation value based on the third information is further used for detection.
The electronic device according to any one of claims 3 to 6. The abnormality detection unit is
Using the trained model machine-learned based on the previously acquired information based on the first information, the second information, and the third information, and the information regarding the presence or absence of the abnormality, the abnormality of the processing is detected. To detect,
The electronic device according to any one of claims 3 to 7. A control method in an electronic device equipped with a processor that executes processing based on a program.
A step in which the acquisition unit acquires information indicating the usage rate of the processor for each thread using the processor, and
Based on the information acquired by the acquisition unit, the calculation unit calculates first information indicating the ratio of the number of threads whose usage rate of the processor is within a predetermined range to the total number of threads using the processor. Steps and
A step in which the extraction unit extracts second information indicating the usage rate of the first thread, which is the most used thread among the threads using the processor, based on the information acquired by the acquisition unit.
A step in which the abnormality detection unit detects an abnormality in the process based on the first information and the second information.
Control method having. A trained model for detecting abnormalities in the processing in an electronic device having a processor that executes processing based on a program.
The first information indicating the ratio of the number of threads whose usage rate of the processor is within a predetermined range to the total number of threads using the processor, and the most used thread among the threads using the processor. Machine learning is performed based on the second information indicating the usage rate of a certain first thread, and the abnormality of the processing is detected.
A trained model for making your computer work.

Images