JP7268228B1 - Information processing device, information processing method and information processing program - Google Patents

Abstract

An object of the present invention is to reduce the burden on an administrator involved in monitoring a monitoring target. Kind Code: A1 An information processing apparatus according to the present application includes a reception unit that receives an abnormality detection notification indicating that the state of a monitoring target is abnormal, and a start time that is a first time that a first abnormality detection notification is received. When a recovery detection notification indicating that the state of the monitoring target has recovered from the abnormality is received within the first suppression time, a second abnormality detection notification different from the first abnormality detection notification is generated after the recovery detection notification is received. and an output control unit that outputs a recovery detection notification after the first suppression time has elapsed on condition that the recovery detection notification is not accepted. [Selection drawing] Fig. 4

Description

The present invention relates to an information processing device, an information processing method, and an information processing program.

Conventionally, a technology is known in which an information processing apparatus detects an abnormality in a monitoring target and notifies an administrator of the monitoring target. For example, based on the monitoring result value of the monitoring target until the abnormality of the monitoring target is detected, it is determined whether or not the abnormality of the monitoring target is an instantaneous abnormality. Also, there is known a technique of notifying a failure message when the failure to be monitored is not a momentary failure.

JP 2009-258955 A Japanese Patent No. 3634544 JP 2005-132021 A

There is a demand for a technology that can reduce the burden on administrators involved in monitoring monitored objects.

An object of the present application is to provide an information processing apparatus, an information processing method, and an information processing program that can reduce the burden on an administrator involved in monitoring a monitoring target.

An information processing apparatus according to the present application includes a receiving unit that receives an abnormality detection notification indicating that the state of a monitored object is abnormal, and a first suppression that starts at a first time when the first abnormality detection notification is received. When a recovery detection notification indicating that the state of the monitoring target has recovered from the abnormality is received within the time, a second abnormality detection notification different from the first abnormality detection notification is generated after receiving the recovery detection notification. and an output control unit that outputs the recovery detection notification after the first suppression time has elapsed on condition that the recovery detection notification is not accepted. The output control unit suppresses output of the second abnormality detection notification when the second abnormality detection notification is received within the first suppression time period starting from the first time.

The output control unit outputs a third abnormality detection notification different from the second abnormality detection notification within the first suppression time period starting at a second time when the second abnormality detection notification is received. If the recovery detection notification is received, outputting the third abnormality detection notification is suppressed, and if the recovery detection notification is received within the first suppression time whose start time is the second time, the recovery detection notification on the condition that the third abnormality detection notification is not received after receiving the recovery detection notification after the first restraint time having the second time as the start time elapses.

When receiving a fourth abnormality detection notification after continuing the process of suppressing the abnormality detection notification during the first suppression time for a predetermined time, the output control unit receives a second output control that is longer than the first suppression time. After suppressing the output of the fourth abnormality detection notification for the suppression time of and suppressing the abnormality detection notification during the first suppression time, the recovery detection notification is received after continuing the process for the predetermined time , on condition that the fourth abnormality detection notification is not accepted, the recovery detection notification is output after the second suppression time elapses.

The output control unit controls the end time of the first suppression period having the second time as the start time to exceed the predetermined time, and the first suppression period having the second time as the start time. When the fourth abnormality detection notification is received after the end of, the output of the fourth abnormality detection notification is suppressed for the second suppression time starting at the time when the fourth abnormality detection notification is received. and the end time of the first suppression period starting at the second time exceeds the predetermined period of time, and after the first suppression period starting at the second time ends, When the fourth abnormality detection notification is received and the recovery detection notification is received, the recovery detection notification is received after the second suppression time has elapsed, starting at the time when the fourth abnormality detection notification is received. to output

The output control unit controls the end time of the first suppression period having the second time as the start time to exceed the predetermined time, and the first suppression period having the second time as the start time. In the case where the third abnormality detection notification is received and the recovery detection notification is further received, the recovery detection is performed after the second suppression time has elapsed, the start time being the time when the third abnormality detection notification was received. Output a notification.

The information processing apparatus according to the present application includes a reception unit that receives an abnormality detection notification indicating that the state of a monitoring target is abnormal, and an N-th abnormality detection notification that is an abnormality detection notification received for the Nth time (N is a natural number). If another anomaly detection notification different from the Nth anomaly detection notification is received within a first suppression time starting at the Nth time that is the reception time, the other anomaly detection notification is output. is suppressed, and if a new abnormality detection notification is not received after the process of suppressing the abnormality detection notification during the first suppression time is continued for a predetermined time, a second suppression that is longer than the first suppression time Output for outputting a recovery detection notification indicating that the state of the monitoring target has recovered from the abnormality after a lapse of time or after the process of suppressing the abnormality detection notification during the first suppression time is continued for the predetermined time. and a control unit.

The output control unit uses a machine learning model learned to estimate the first suppression time, the predetermined time, or the second suppression time from the state information indicating the state of the monitoring target, One suppression time, the predetermined time or the second suppression time is estimated.

The output control unit accepts the anomaly detection notification using a statistical method based on the history of the anomaly detection notifications received within a certain period of time from the time when the anomaly detection notification was accepted by the reception unit. , the period until the anomaly detection notification is no longer accepted is estimated, and the first suppression period, the predetermined period, or the second suppression period is determined based on the estimated period.

An information processing apparatus according to the present application includes a reception unit that receives an abnormality detection notification indicating that the state of a monitoring target is abnormal, suppresses output of an abnormality detection notification received within a first suppression time , an output control unit that outputs a first abnormality detection notification after the first suppression time has elapsed on condition that the total notification time of the normal detection notification is equal to or greater than the cumulative threshold time. The output control unit suppresses output of the plurality of abnormality detection notifications when receiving a plurality of abnormality detection notifications within the first suppression time.

The output control unit suppresses the output of the recovery detection notification when the recovery detection notification indicating that the state of the monitoring target has recovered from the abnormality is received within the first suppression time.

The output control unit is a second suppression time starting at a first time when the first abnormality detection notification is output, and is shorter than the first suppression time. When a second anomaly detection notification different from the first anomaly detection notification is received at this time, the output of the second anomaly detection notification is suppressed, and the second anomaly detection notification having the first time as the start time If a recovery detection notification indicating that the state of the monitoring target has recovered from an abnormality is received within the suppression time, the second abnormality detection notification is not received after the recovery detection notification is received. The recovery detection notification is output after the second suppression time, starting from the second time at which the recovery detection notification is received, has elapsed.

The output control unit transmits a third abnormality detection notification different from the second abnormality detection notification within the second suppression time period starting at a third time when the second abnormality detection notification is received. If received, output of the third abnormality detection notification is suppressed, and if the recovery detection notification is received within the second suppression time whose start time is the third time, the recovery detection notification on the condition that the third anomaly detection notification is not received after receiving the recovery detection notification after the second suppression time having the second time as the start time elapses.

The output control unit uses a machine learning model learned to estimate the first suppression time, the cumulative threshold time, or the second suppression time from the state information indicating the state of the monitoring target, A first suppression time, the cumulative threshold time or the second suppression time is estimated.

An information processing method according to the present application is an information processing method implemented by a program executed by an information processing apparatus, comprising: If a second anomaly detection notification different from the first anomaly detection notification is received within a first suppression time starting at the first time when the detection notification is received, the second anomaly detection notification is suppressed, and when a recovery detection notification indicating that the state of the monitored object has recovered from the abnormality is received within the first suppression time, the second abnormality detection is performed after receiving the recovery detection notification and an output control step of outputting the recovery detection notification after the first suppression time has elapsed on condition that the notification is not accepted.

An information processing method according to the present application is an information processing method implemented by a program executed by an information processing apparatus, comprising: a receiving step of receiving an abnormality detection notification indicating that the state of a monitoring target is abnormal; When a plurality of anomaly detection notifications are received within the time, suppressing the output of the plurality of anomaly detection notifications, and on the condition that the total notification time of each of the plurality of anomaly detection notifications is equal to or greater than the cumulative threshold time, and an output control step of outputting a first abnormality detection notification after the first suppression time has elapsed.

An information processing method according to the present application is an information processing method realized by a program executed by an information processing apparatus, comprising: a receiving step of receiving an abnormality detection notification indicating that the state of a monitoring target is abnormal; (natural number) different from the N-th anomaly detection notification within a first suppression time starting at the N-th time, which is the time when the N-th anomaly detection notification, which is an anomaly detection notification received for the first time, is received. is received, the output of the other anomaly detection notification is suppressed, and after continuing the process of suppressing the anomaly detection notification during the first suppression time for a predetermined time, a new anomaly detection notification is accepted. If not, after a second suppression time longer than the first suppression time elapses, or after the process of suppressing the abnormality detection notification during the first suppression time continues for the predetermined time, the monitoring and an output control step of outputting a recovery detection notification indicating that the target state has recovered from the abnormality.

An information processing program according to the present application includes a reception procedure for receiving an abnormality detection notification indicating that the state of a monitoring target is abnormal; When a second abnormality detection notification different from the first abnormality detection notification is received within the time, suppressing the output of the second abnormality detection notification, and suppressing the monitoring target within the first suppression time. When a recovery detection notification indicating that the state has recovered from an abnormality is received, on the condition that the second abnormality detection notification is not received after the recovery detection notification is received, after the first suppression time has elapsed and an output control procedure for outputting the recovery detection notification.

An information processing program according to the present application includes a reception procedure for receiving an abnormality detection notification indicating that the state of a monitoring target is abnormal; Suppressing the output of the detection notification, and outputting the first abnormality detection notification after the first suppression time has elapsed on condition that the total notification time of each of the plurality of abnormality detection notifications is equal to or greater than the cumulative threshold time. and causing a computer to execute an output control procedure.

An information processing program according to the present application includes receiving means for receiving an anomaly detection notification indicating that the state of a monitoring target is anomalous, and an Nth anomaly detection notification which is an anomaly detection notification received for the Nth time (N is a natural number). If another anomaly detection notification different from the Nth anomaly detection notification is received within a first suppression time starting at the Nth time that is the reception time, the other anomaly detection notification is output. is suppressed, and if a new abnormality detection notification is not received after the process of suppressing the abnormality detection notification during the first suppression time is continued for a predetermined time, a second suppression that is longer than the first suppression time Output for outputting a recovery detection notification indicating that the state of the monitoring target has recovered from the abnormality after a lapse of time or after the process of suppressing the abnormality detection notification during the first suppression time is continued for the predetermined time. causing a computer to execute a control means;

According to one aspect of the embodiment, it is possible to reduce the load related to monitoring of the monitoring target.

FIG. 1 is a diagram illustrating a configuration example of an information processing system according to an embodiment. FIG. 2 is a diagram illustrating a configuration example of the filter device according to the embodiment; FIG. 3 is a diagram for explaining notification suppression processing according to the embodiment. FIG. 4 is a diagram for explaining notification suppression processing according to the embodiment. FIG. 5 is a diagram for explaining notification suppression processing according to the embodiment. FIG. 6 is a diagram for explaining notification suppression processing according to the embodiment. FIG. 7 is a diagram for explaining notification suppression processing according to the modification. FIG. 8 is a diagram for explaining notification suppression processing according to the modification. FIG. 9 is a diagram for explaining notification suppression processing according to the modification. FIG. 10 is a diagram for explaining notification suppression processing according to the modification. FIG. 11 is a diagram for explaining notification suppression processing according to the modification. FIG. 12 is a diagram for explaining notification suppression processing according to the modification. FIG. 13 is a hardware configuration diagram showing an example of a computer that implements the functions of the information processing apparatus.

Embodiments for implementing an information processing apparatus, an information processing method, and an information processing program according to the present application (hereinafter referred to as "embodiments") will be described in detail below with reference to the drawings. The information processing apparatus, information processing method, and information processing program according to the present application are not limited to this embodiment. Also, in each of the following embodiments, the same parts are denoted by the same reference numerals, and overlapping descriptions are omitted.

(Embodiment) [1. Flutter suppression mode]
2. Description of the Related Art Conventionally, there is known a detection device that detects the state of an object to be monitored. The detection device indicates the status of the monitoring target, such as the amount of packets sent and received, the usage of hardware resources such as a CPU (Central Processing Unit) or memory, or the status of hardware such as an interface or a power supply unit. Based on the state information, it is detected whether or not the state of the monitored object is abnormal. Whether or not the state of the monitoring target is abnormal is detected, for example, based on a predetermined threshold value, or using a machine learning model that has been learned to detect whether or not the state of the monitoring target is abnormal. , detection of the state of the monitored object, or the like. When detecting that the state of the monitoring target is abnormal, the detecting device notifies the administrator who manages the monitoring target of the abnormality detection that the state of the monitoring target is abnormal.

Also, the abnormalities detected by the detection device include those that do not need to be notified to the administrator. For example, when detecting that the status of the monitoring target is abnormal, the detection device may continue to detect the abnormality until the status of the monitoring target recovers from the abnormality, and may continuously issue an abnormality detection notification. be. In such a case, although the administrator can recognize the occurrence of anomaly from the first anomaly detection notification, the same anomaly detection notification is repeatedly received from the detection device. For each anomaly detection notification that is repeatedly notified, the administrator needs to confirm the status of the monitored object or check whether the content is the same as the first anomaly detection. In parallel with such confirmation work, administrators usually need to perform recovery work for anomalies recognized in the first anomaly detection notification, which imposes an excessive burden on administrators. .

Therefore, before sending an anomaly detection notification from the detection device to the administrator, an anomaly detection notification is received from the detection device, and out of the anomaly detection notifications received, an anomaly detection notification that does not need to be sent to the administrator There is known a filter device that suppresses the For example, when the filter device continuously receives anomaly detection notifications from the detection device, after the first anomaly detection notification is sent, the filter device receives a recovery detection notification indicating that the state of the monitoring target has recovered from the anomaly. Suppress not to perform anomaly detection notification after the next time.

However, the filter device described above, for example, repeats abnormality detection notification and recovery detection notification within a short period of time, and does not perform abnormality detection notification that does not require repeated notification to the administrator. could not be restrained. Therefore, it is sometimes difficult for the filter device described above to reduce the burden on the administrator involved in monitoring the monitored object.

On the other hand, the information processing apparatus according to the present application receives an abnormality detection notification indicating that the state of the monitored object is abnormal, If a second anomaly detection notification different from the first anomaly detection notification is received immediately, the output of the second anomaly detection notification may be suppressed. In addition, if a recovery detection notification indicating that the state of the monitoring target has recovered from an abnormality is received within the suppression time period, the suppression time period is subject to the condition that the second anomaly detection notification is not accepted after the recovery detection notification is accepted. After the elapse of, the recovery detection notification may be output.

As a result, the information processing apparatus can, for example, issue an anomaly detection notification that occurs sporadically for a certain period of time after sending an anomaly detection notification to the administrator for the first time. It is possible to suppress unnecessary anomaly detection notification not to be performed. Therefore, the information processing device can reduce the burden on the administrator involved in monitoring the monitoring target.

Further, the information processing apparatus according to the present application receives anomaly detection notifications indicating that the state of the monitored object is abnormal, and outputs a plurality of anomaly detection notifications when a plurality of anomaly detection notifications are received within the cumulative measurement time. may be suppressed, and the first abnormality detection notification may be output after the cumulative measurement time has elapsed on condition that the total notification time of each of the plurality of abnormality detection notifications is equal to or greater than the cumulative threshold time.

As a result, the information processing apparatus can, for example, send an anomaly detection notification to an administrator in a case where an anomaly detection notification and a recovery detection notification are repeated for a certain period of time, and do not need to notify the administrator. Abnormality detection notification can be suppressed. Therefore, the information processing device can reduce the burden on the administrator involved in monitoring the monitoring target.

[2. Configuration of information processing system]
A case where the information processing device according to the embodiment is the filter device 100 will be described below. Also, a case where the monitoring target according to the embodiment is the target device 10 will be described below.

FIG. 1 is a diagram showing a configuration example of an information processing system 1 according to an embodiment. As shown in FIG. 1 , the information processing system 1 includes a target device 10 , a detection device 20 , a filter device 100 and a monitoring device 200 . The target device 10, the detection device 20, the filter device 100, and the monitoring device 200 are connected via a predetermined network N so as to be communicable by wire or wirelessly. The information processing system 1 shown in FIG. 1 may include a plurality of target devices 10, a plurality of detection devices 20, a plurality of filter devices 100, and a plurality of monitoring devices 200. .

The target device 10 is a device or equipment that constitutes a network to be monitored. The target device 10, for example, the amount of packets sent and received, the usage of hardware resources such as a CPU (Central Processing Unit) or memory, or the state of the target device 10 such as the state of hardware such as an interface or a power supply unit. is transmitted to the detection device 20 .

The detection device 20 is an information processing device that detects the state of the target device 10 . The detection device 20 acquires state information from the target device 10 . Further, the detection device 20 detects whether or not the state of the target device 10 is abnormal based on the state information of the target device 10 . Whether or not the state of the monitoring target is abnormal is detected, for example, based on a predetermined threshold value, or using a machine learning model that has been learned to detect whether or not the state of the monitoring target is abnormal. , detecting the state of the target device 10, or the like may be used. When detecting that the target device 10 is in an abnormal state, the detection device 20 transmits an abnormality detection notification indicating that the target device 10 is in an abnormal state to the filter device 100 . Further, when detecting that the state of the target device 10 has recovered from the abnormality, the detection device 20 transmits a recovery detection notification indicating that the state of the target device 10 has recovered from the abnormality to the filter device 100 . Note that each function of the detection device 20 may be provided separately in two or more devices.

The filter device 100 is an information processing device that suppresses the output of notifications (abnormality detection notifications or recovery detection notifications) that do not need to be notified to the administrator. Notifications that do not need to be notified to the administrator may be, for example, repeated notifications of the same abnormality as the abnormality already recognized by the administrator. The filter device 100 receives an abnormality detection notification from the detection device 20 . When the filter device 100 receives a second abnormality detection notification different from the first abnormality detection notification within the suppression time starting from the first time when the first abnormality detection notification is received, the filter device 100 receives the second abnormality detection notification. Suppresses the output of anomaly detection notifications for Also, the filter device 100 receives a recovery detection notification from the detection device 20 . Further, when the filter device 100 receives the recovery detection notification within the suppression time period starting from the first time when the first abnormality detection notification is received, the filter device 100 performs the second abnormality detection after receiving the recovery detection notification. On the condition that the notification is not accepted, the recovery detection notification is output after the suppression time has elapsed.

The monitoring device 200 is an information processing device used by the administrator of the target device 10 . The monitoring device 200 receives an abnormality detection notification or recovery detection notification output from the filter device 100 . The monitoring device 200 outputs the abnormality detection notification or the recovery detection notification when receiving the abnormality detection notification or the recovery detection notification.

[3. Configuration of filter device]
FIG. 2 is a diagram showing a configuration example of the filter device 100 according to the embodiment. Filter device 100 has communication unit 110 , storage unit 120 , and control unit 130 .

(Communication unit 110)
The communication unit 110 is realized by, for example, a NIC (Network Interface Card) or the like. The communication unit 110 is connected to a network by wire or wirelessly, and transmits and receives information to and from the target device 10, the detection device 20, and the monitoring device 200, for example.

(storage unit 120)
The storage unit 120 is realized by, for example, a semiconductor memory device such as a RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or an optical disk. Specifically, the storage unit 120 stores various programs (an example of an information processing program).

(control unit 130)
The control unit 130 is a controller, and for example, various programs (an example of an information processing program) stored in a storage device inside the filter device 100 by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like. ) is executed using the RAM as a work area. Also, the control unit 130 is a controller, and is implemented by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

The control unit 130 has a reception unit 131 and an output control unit 132 as functional units, and may implement or execute the information processing operation described below. Note that the internal configuration of the control unit 130 is not limited to the configuration shown in FIG. 2, and may be another configuration as long as it performs the information processing described later. Moreover, each functional unit indicates the function of the control unit 130 and may not necessarily be physically distinguished.

The receiving unit 131 receives an abnormality detection notification indicating that the state of the monitored object is abnormal. Further, the receiving unit 131 may cause the storage unit 120 to store a history in which the received anomaly detection notification is associated with the time when the anomaly detection notification was received.

The output control unit 132 suppresses the output of notifications (abnormality detection notifications or recovery detection notifications) that do not need to be notified to the administrator. Specifically, the output control unit 132 suppresses the output of the abnormality detection notification or recovery detection notification received by the reception unit 131 . Here, the notification that does not need to be notified to the administrator may be, for example, a notification that repeatedly notifies the same abnormality as the abnormality already recognized by the administrator.

More specifically, when the receiving unit 131 continuously receives a plurality of anomaly detection notifications, the output control unit 132 outputs the first received anomaly detection notification, and then sets the short-term suppression time (for example, 60 minutes). ), the output of the anomaly detection notification received from the second time onwards is suppressed. Hereinafter, an abnormality detection notification received for the Nth time (N is a natural number) will be referred to as an Nth abnormality detection notification. In addition, when the output control unit 132 receives the second abnormality detection notification within the short-term suppression time period starting from the first time when the first abnormality detection notification is received, the output control unit 132 receives the second abnormality detection notification. Suppress output. In addition, when the output control unit 132 receives the third abnormality detection notification within the short-term suppression time starting at the second time when the second abnormality detection notification is received, the output control unit 132 receives the third abnormality detection notification. Suppress output. In this way, when the output control unit 132 receives the (N+1)-th abnormality detection notification within the short-term suppression period starting from the N-th time when the N-th abnormality detection notification is received, the (N+1)-th ) to suppress the output of anomaly detection notifications. Henceforth, the short-term restraint time which makes the Nth time the start time may be described as the Nth short-term restraint time.

Further, when the recovery detection notification is received during the short-term suppression time, the output control unit 132 receives the recovery detection notification after the short-term suppression time elapses under the condition that no new abnormality detection notification is accepted after the recovery detection notification is received. to output

Here, depending on the application of the target device 10 or the type of failure to be detected, it may not be possible to appropriately suppress notification by the method of suppressing abnormality detection within the short-term suppression time. Specifically, for example, this is a case where the amount of data transmitted and received is monitored, and an abnormality is detected when the amount of data is less than a predetermined amount of data (hereinafter sometimes referred to as a threshold value). In such a case, the amount of data transmitted/received by the target device 10 shows a similar tendency in a certain cycle (for example, one day). Therefore, when the threshold value is exceeded, it is necessary to notify the administrator that an abnormality has occurred. On the other hand, the target device 10 itself, or another target device 10 that is mutually connected to the target device 10 and functions cooperatively, temporarily stopped transmitting and receiving data due to a failure or work, and then resumed transmitting and receiving data. In such a case, it may take a longer period of time than the above-described constant period until the amount of data transmission/reception during normal operation is restored. In such a case, the anomaly detection notification may be repeated until the amount of data sent and received during normal operation is restored. Therefore, in conventional monitoring devices, it is necessary to temporarily change the threshold. , was a burden on the administrator.

On the other hand, when the process of suppressing the abnormality detection notification is repeated within the short-term suppression time, the output control unit 132 determines that the elapsed time from the start time of the first short-term suppression time is the long-term suppression transition time (for example, 100 minutes), the output of the abnormality detection notification is suppressed for a long-term suppression time (for example, 300 minutes) longer than the short-term suppression time. More specifically, the output control unit 132 repeats the process of suppressing the abnormality detection notification within the short-term suppression time, and the end time of the N-th short-term suppression time is set to the long-term suppression transition with the first time as the start time. When the time is exceeded, the output of a new abnormality detection notification is suppressed for a long-term suppression time longer than the short-term suppression time. Here, the start time of the long-term suppression period may be, for example, the time when the (N+1)th abnormality detection notification is received. Also, the start time of the long-term suppression period may be the same time as the end time or start time of the Nth short-term suppression period. Also, the start time of the long-term suppression period may be the same time as the end time of the long-term suppression transition period that starts at the first time. Hereinafter, the long-term suppression transition time with the N-th time as the start time may be referred to as the N-th long-term suppression transition time, and the long-term suppression time with the N-th time as the start time may be referred to as the N-th long-term suppression time. .

Further, when the output control unit 132 receives a recovery detection notification after continuing the process of suppressing the abnormality detection notification during the short-term suppression time over the first long-term suppression transition time, the output control unit 132 does not receive a new abnormality detection notification. condition, a recovery detection notification is output after the long-term suppression time elapses.

FIG. 3 is a diagram for explaining notification suppression processing according to the embodiment. In FIG. 3, the receiving unit 131 continuously receives the first to eleventh abnormality detection notifications E1-1 to E1-11 every 15 minutes at each time from t1 to t11. Further, the receiving unit 131 receives the recovery detection notification R1-12 at time t12.

In FIG. 3, the output control unit 132 outputs the first abnormality detection notification E1-1 received at time t1. Further, the output control unit 132 suppresses the output of the second to fifth abnormality detection notifications E1-2 to E1-5 received during the short-term suppression time #11 starting at time t1. Further, since the output control unit 132 receives the second abnormality detection notification E1-2 within the short-term suppression time #11, the output control unit 132 accepts the third to third abnormal detection notifications E1-2 during the short-term suppression time (not shown) starting at the time t2. 6 anomaly detection notifications E1-3 to E1-6 are suppressed. Similarly, the output control unit 132 receives the k-th to (k+3)-th abnormality detection notifications E1-k to E1 during the short-term suppression time (not shown) starting at time tk (k=3 to 6). Suppress the output of -(k+3). That is, when the output control unit 132 receives the (N+1)th abnormality detection notification within the Nth short-term suppression time, the output control unit 132 suppresses the abnormality detection notification within the short-term suppression time starting at the (N+1)th time. do.

Further, the output control unit 132 determines that the end time of the short-term suppression time #12 starting at time t6 exceeds the long-term suppression transition time (also referred to as the long-term suppression transition trigger time), and the reception unit 131 starts time t6. Since the eleventh abnormality detection notification E1-11 was received after the end of the short-term suppression time #12 set at time t11, the output of the eleventh abnormality detection notification E1-11 is continued over the long-term suppression time #13 starting at time t11. Suppress. In addition, the output control unit 132 determines that the end time of the short-term suppression time #12 starting at the time t6 exceeds the long-term suppression transition time, and the receiving unit 131 determines whether the short-term suppression time #12 starting at the time t6 Since the eleventh abnormality detection notification E1-11 is received after the termination and the recovery detection notification R1-12 is also received, the recovery detection notification R1-12 is output after the long-term suppression time #13 elapses.

FIG. 4 is a diagram for explaining notification suppression processing according to the embodiment. In FIG. 4, the reception unit 131 receives the first abnormality detection notification E2-1, the recovery detection notification R2-2, the second to fourth abnormality detection notifications E2 every 15 minutes from time t1 to time t8. -3 to E2-5, recovery detection notification R2-6, fifth abnormality detection notification E2-7, and recovery detection notification R2-8.

In FIG. 4, similarly to FIG. 3, the output control unit 132 outputs the first abnormality detection notification E2-1 received at time t1. Further, the output control unit 132 suppresses the output of the second to fourth abnormality detection notifications E2-3 to E2-5 received within the short-term suppression time #21 starting at time t1. Also, since the output control unit 132 receives the second abnormality detection notification E2-3 after the recovery detection notification R2-2 received within the short-term suppression time #21, it suppresses the output of the recovery detection notification R2-2. . Further, since the output control unit 132 has received the second abnormality detection notification E2-3 within the short-term suppression time #21, the third to the third to The output of the fourth anomaly detection notifications E2-4 to E2-5 and the fifth anomaly detection notification E2-7 is suppressed. Further, since the output control unit 132 receives the fifth abnormality detection notification E2-7 after the recovery detection notification R2-6 received within the short-term suppression time (not shown) starting at the time t3, the recovery detection Suppress the output of notification R2-6. In addition, the output control unit 132 outputs the fourth abnormality detection notification E2-5 and the fifth abnormality detection notification E2-7 received within the short-term suppression time (not shown) starting at time t4. Suppress. Further, since the output control unit 132 receives the fifth abnormality detection notification E2-7 after the recovery detection notification R2-6 received within the short-term suppression time (not shown) starting at the time t4, the recovery detection Suppress the output of notification R2-6. Further, the output control unit 132 suppresses the output of the fifth abnormality detection notification E2-7 received within the short-term suppression time (not shown) starting at time t5. Further, since the output control unit 132 receives the fifth abnormality detection notification E2-7 after the recovery detection notification R2-6 received within the short-term suppression time (not shown) starting at time t5, the recovery detection Suppress the output of notification R2-6. That is, when the output control unit 132 receives the (N+1)-th abnormality detection notification within the N-th short-term suppression time, the output control unit 132 sets the (N+1)-th time as the start time to the abnormality detection notification and the recovery within the short-term suppression time. Suppress detection notifications.

In addition, since the end time of short-term suppression time #22 starting at time t7 has exceeded the long-term suppression transition time, output control unit 132 detects recovery after long-term suppression time #23 starting at time t7 has passed. Output notification R2-8.

FIG. 5 is a diagram for explaining notification suppression processing according to the embodiment. FIG. 5 shows a pattern in which a shift to long-term suppression is not performed because a single anomaly detection notification and stabilization are repeated. In FIG. 5, the reception unit 131 receives the recovery detection notification R3-2 15 minutes after receiving the first abnormality detection notification E3-1. The output control unit 132 outputs the first abnormality detection notification E3-1. Further, the output control unit 132 receives the recovery detection notification R3-2 within the short-term suppression time (60 minutes in FIG. 5) whose start time is the time when the first abnormality detection notification E3-1 is received. Since no abnormal abnormality detection notification was received, a recovery detection notification R3-2 is output after the short-term suppression time has elapsed. After the output control unit 132 outputs the recovery detection notification R3-2, the reception unit 131 receives the recovery detection notification R3-4 15 minutes after receiving the new abnormality detection notification E3-3. The output control unit 132 outputs a new abnormality detection notification E3-3. Further, the output control unit 132 accepts the recovery detection notification R3-4 within the short-term suppression time (60 minutes in FIG. 5) whose start time is the time when the new abnormality detection notification E3-3 is accepted. Since no new abnormality detection notification has been received, a recovery detection notification R3-4 is output after the short-term suppression time has elapsed.

FIG. 6 is a diagram for explaining notification suppression processing according to the embodiment. FIG. 6 shows a pattern in which the short-term suppression time, which starts at the time when the last abnormality detection notification is received, does not reach the long-term suppression transition time, and thus the long-term suppression is not performed. In FIG. 6, the reception unit 131 receives the recovery detection notification R4-2 15 minutes after receiving the first abnormality detection notification E4-1. In addition, the receiving unit 131 receives the recovery detection notification R4-2 and then sends the second abnormality detection notification E4-3, the third abnormality detection notification E4-4, and the recovery detection notification R4-5 every 15 minutes. accept. The output control unit 132 outputs the first abnormality detection notification E4-1. In addition, the output control unit 132 receives the second to third abnormality detection notifications within the short-term suppression time (60 minutes in FIG. 6) starting at the time when the first abnormality detection notification E4-1 is received. The outputs of E4-3 to E4-4 are suppressed. Further, the output control unit 132 transmits the second abnormality detection notification E4-3 after the recovery detection notification R4-2 received during the short-term suppression period starting at the time when the first abnormality detection notification E4-1 is received. Since it has been accepted, the output of recovery detection notification R4-2 is suppressed. In addition, the output control unit 132 did not receive a new abnormality detection notification after receiving the recovery detection notification R4-5 within the short-term suppression time starting at the time when the third abnormality detection notification E4-4 was received. Therefore, the recovery detection notification R4-5 is output after the short-term suppression time elapses.

Here, depending on the target device 10 or the details of the failure to be monitored, there are cases where only the notification of abnormality detection is sent and the notification of recovery detection is not sent. Specifically, for example, when detecting and notifying that a login failure to a server device has failed, an error occurs when a user fails to log in to the server device due to a password input mistake or an erroneous operation. Output detection notification. Since such anomaly does not involve any state change like hardware failure, it is necessary to restore the state before the anomaly (that is, to eliminate the fact that the login to the server device failed). does not happen. Therefore, in such an anomaly, recovery detection notification may not be performed. Such an anomaly is hereinafter also referred to as an anomalous event.

Depending on the type of abnormal event that has occurred, it may be necessary to notify the administrator only when the detection frequency changes. Specifically, for example, for an anomaly detection notification of an anomaly event that failed to log in to the server device, for example, once every 2 to 3 days, it is caused by a password input error or an erroneous operation by an authorized user. It occurs constantly with a low frequency like Therefore, if it occurs infrequently, it is regarded as a mistake by the user and does not need to be notified to the administrator. On the other hand, if it occurs frequently, for example, 60 times per minute, there is a high possibility that unauthorized access is being performed by a method such as brute force attack, and it is necessary to notify the administrator. There is

In the filter device described above, after receiving the recovery detection notification, the recovery detection notification is output under the condition that the abnormality detection notification is not received again within the suppression time. However, the abnormality detection notification is related to an abnormality event. In this case, the recovery detection notification could not be output, and the administrator could not grasp whether the occurrence of the abnormal event continued or subsided.

On the other hand, after receiving the N-th abnormality detection notification, the output control unit 132, within the short-term suppression time starting at the N-th time, or within the long-term suppression time starting at the N-th time , when the (N+1)th anomaly detection notification is not received, the anomaly event may be deemed to have subsided and the recovery detection notification may be output. In this way, if the output control unit 132 does not receive a new abnormality detection notification after continuing the process of suppressing the abnormality detection notification during the short-term suppression time for a predetermined period of time, the output control unit 132 waits until the long-term suppression time elapses or after the short-term suppression time. The recovery detection notification may be output after continuing the process of suppressing the abnormality detection notification during the suppression time for a predetermined period of time. That is, the output control unit 132 receives the N-th (N is a natural number) abnormality detection notification within the short-term suppression time starting at the N-th time, which is the time at which the N-th abnormality detection notification is received. When another anomaly detection notification different from the N anomaly detection notification is received, the output of the other anomaly detection notification is suppressed, and after continuing the process of suppressing the anomaly detection notification during the short-term suppression time for a predetermined period of time, a new If the abnormality detection notification is not received, the recovery detection notification may be output after the long-term suppression time has elapsed or after the process of suppressing the abnormality detection notification during the short-term suppression time has continued for a predetermined period of time.

Note that the output control unit 132 uses a machine learning model that is trained to estimate the short-term suppression time, the long-term suppression transition time, or the long-term suppression time from the state information indicating the state of the monitored object. Transition times or long-term inhibition times may be estimated. Specifically, for example, the output control unit 132 stores the content of the abnormality detection notification and the history of the abnormality detection notification and the recovery detection notification received within a certain period of time from the time when the reception unit 131 received the abnormality detection notification. Based on learning data, short-term suppression time, long-term suppression transition, based on learning model learned to estimate short-term suppression time, long-term suppression transition time, or long-term suppression time based on abnormality detection notification received by reception unit 131 Time or long-term suppression time may be estimated.

The output control unit 132 according to one embodiment may use a statistical method to determine the short-term suppression time, the long-term suppression transition time, or the long-term suppression time from the state information indicating the state of the monitored object. Specifically, for example, the output control unit 132 statistically determines the period from when the anomaly detection notification is accepted until when the anomaly detection notification is no longer accepted, based on the anomaly detection notification history stored in the storage unit 120. It may be estimated using a method. Also, the output control unit 132 may determine the short-term suppression time, the long-term suppression transition time, or the long-term suppression time based on the period estimated using a statistical method.

(Modification)
[4. Cumulative detection mode]
The processes according to the above-described embodiments may be implemented in various different forms other than the above-described embodiments.

In the above-described embodiment, when the filter device 100 receives a plurality of anomaly detection notifications consecutively, it stabilizes within the short-term suppression time (for example, 60 minutes) after outputting the first received anomaly detection notification. Up to this point, the case of suppressing the output of the second and subsequent anomaly detection notifications has been described. In a modification, when the filter device 100 receives an abnormality detection notification for a cumulative threshold time (eg, 20 minutes) or longer within the cumulative measurement time (eg, 60 minutes), the first A case of outputting an anomaly detection notification will be described. In addition, in the modified example, a case will be described where the filter device 100 outputs the recovery detection notification when it stabilizes within the notification suppression time (for example, 30 minutes) after outputting the first abnormality detection notification.

In the above-described embodiment, in order to notify the administrator of the occurrence of an anomaly as early as possible, the anomaly detection notification that is detected for the first time (hereinafter sometimes referred to as the initial detection) is immediately output, and the second and subsequent anomaly detection notifications are output. take a method of suppressing anomaly detection notifications. However, depending on the purpose of the target device 10 or the content of the failure to be detected, it may not be appropriate to notify the occurrence of an abnormality early. Specifically, for example, there is a case where it is desired to suppress the notification of an abnormality that occurs constantly and is considered to be no problem as long as the frequency of occurrence does not change. In such a case, if a method is adopted in which only the first detection is notified and the second and subsequent detections are suppressed, the administrator cannot recognize whether or not the occurrence frequency of the abnormality has changed.

On the other hand, when a plurality of anomaly detection notifications are received during the cumulative measurement time, the output control unit 132 suppresses the output of the plurality of anomaly detection notifications. It is determined whether or not it is equal to or longer than the time. When the output control unit 132 determines that the total notification time of each of the plurality of abnormality detection notifications is equal to or longer than the cumulative threshold time, the output control unit 132 may output the first abnormality detection notification after the cumulative measurement time has elapsed. Further, the output control unit 132 may suppress the output of the recovery detection notification when the recovery detection notification is received during the cumulative measurement time. Even in the case of a system designed to check the status of the equipment at predetermined time intervals (for example, 15 minutes) and issue an anomaly detection notification when an anomaly is detected, only one anomaly detection notification will be sent. Therefore, the abnormality may be treated as continuing for a predetermined period of time (for example, 15 minutes).

In addition, the output control unit 132 outputs the first abnormality detection notification within the notification suppression time shorter than the cumulative measurement time, which is a notification suppression time starting at the first time when the first abnormality detection notification is output. When a second abnormality detection notification different from is received, the output of the second abnormality detection notification is suppressed. Further, when the recovery detection notification is received within the first notification suppression time, the output control unit 132 outputs the recovery detection notification on the condition that the second abnormality detection notification is not received after the recovery detection notification is received. A recovery detection notification is output after the second notification suppression time that has been accepted has passed. Further, the output control unit 132 outputs the recovery detection notification after the first notification suppression time has passed on condition that the abnormality detection notification is not received within the first notification suppression time.

Further, when the output control unit 132 receives a third abnormality detection notification different from the second abnormality detection notification within the notification suppression time starting at the third time when the second abnormality detection notification is received. suppresses the output of the third anomaly detection notification. Further, when the recovery detection notification is received within the third notification suppression time, the output control unit 132 does not accept the third abnormality detection notification after the recovery detection notification is accepted, and the second notification suppression is performed. Output a recovery detection notification after the elapse of time.

FIG. 7 is a diagram for explaining notification suppression processing according to the modification. In FIG. 7, the notification time of each abnormality detection notification is 5 minutes. The reception unit 131 receives five abnormality detection notifications E5-1 to E5-4 and E5-6 during the cumulative measurement time. Further, the reception unit 131 receives the recovery detection notification R5-5 and the recovery detection notification R5-7 during the cumulative measurement time. The output control unit 132 suppresses the output of the five abnormality detection notifications E5-1 to E5-4 and E5-6 received during the cumulative measurement time. Further, the output control unit 132 suppresses the output of the recovery detection notification R5-5 and the recovery detection notification R5-7 received during the cumulative measurement time. In addition, the output control unit 132 determines that the total notification time of the five abnormality detection notifications E5-1 to E5-4 and E5-6 received during the cumulative measurement time is 25 minutes, and the cumulative threshold time (in FIG. , 20 minutes), the first abnormality detection notification E5-8 is output after the cumulative measurement time has elapsed. In addition, since the output control unit 132 did not receive the abnormality detection notification during the notification suppression time (30 minutes in FIG. 7) whose start time is the first time when the first abnormality detection notification E5-8 was output, A recovery detection notification R5-9 is output after the notification suppression time with the first time as the start time elapses.

FIG. 8 is a diagram for explaining notification suppression processing according to the modification. In FIG. 8, as in FIG. 7, the reception unit 131 receives five abnormality detection notifications E6-1 to E6-4 and E6-6 during the cumulative measurement time. Further, the reception unit 131 receives the recovery detection notification R6-5 and the recovery detection notification R6-7 during the cumulative measurement time. Also, as in FIG. 7, the output control unit 132 suppresses the output of the five abnormality detection notifications E6-1 to E6-4 and E6-6 received during the cumulative measurement time. Further, the output control unit 132 suppresses the output of the recovery detection notification R6-5 and the recovery detection notification R6-7 received during the cumulative measurement time. Further, as in FIG. 7, the output control unit 132 determines that the total notification time of the five abnormality detection notifications E6-1 to E6-4 and E6-6 received during the cumulative measurement time is 25 minutes, and the cumulative measurement time is 25 minutes. Since it is determined that the time is longer than the threshold time (20 minutes in FIG. 8), the first abnormality detection notification E6-8 is output after the cumulative measurement time has elapsed.

Further, in FIG. 8, the output control unit 132 outputs the second to third abnormality detection notifications E6-9 to E6-9 during the notification suppression period starting at the first time when the first abnormality detection notification E6-8 is output. Since E6-10 has been received, the output of the second and third abnormality detection notifications E6-9 to E6-10 is suppressed. In addition, since the output control unit 132 receives the recovery detection notification R6-11 during the notification suppression period starting at the first time when the first abnormality detection notification E6-8 is output, the recovery detection notification R6-11 to suppress the output of Further, the output control unit 132 accepts a new abnormality detection notification after receiving the recovery detection notification R6-11 during the notification suppression time starting at the first time when the first abnormality detection notification E6-8 is output. Therefore, the recovery detection notification R6-12 is output after the notification suppression time (30 minutes in FIG. 8) having started at the second time when the recovery detection notification R6-11 is received.

FIG. 9 is a diagram for explaining notification suppression processing according to the modification. In FIG. 9, the reception unit 131 receives ten abnormality detection notifications E7-1 to E7-10 during the cumulative measurement time. The output control unit 132 suppresses the output of the ten abnormality detection notifications E7-1 to E7-10 received during the cumulative measurement time. In addition, the output control unit 132 determines that the total notification time of the 10 abnormality detection notifications E7-1 to E7-10 received in the cumulative measurement time is 60 minutes, and the cumulative threshold time (60 minutes in FIG. 9) or more. Therefore, the first abnormality detection notification E7-10 is output after the cumulative measurement time has elapsed.

Further, in FIG. 9, the receiving unit 131 outputs the second to third abnormality detection notifications E7-11 to E7 during the notification suppression period starting from the first time when the first abnormality detection notification E7-10 is output. -12 is accepted. The output control unit 132 suppresses the output of the second to third abnormality detection notifications E7-11 to E7-12 received during the notification suppression time. Further, the receiving unit 131 receives the recovery detection notification R7-13 during the notification suppression time starting from the first time when the first abnormality detection notification E7-10 is output. The output control unit 132 suppresses the output of the recovery detection notification R7-13 received during the notification suppression time. In addition, since the output control unit 132 has not received a new abnormality detection notification after receiving the recovery detection notification R7-13, the notification suppression time starts from the second time when the recovery detection notification R7-13 is received. After the elapse of, a recovery detection notification R7-13 is output.

Depending on the type of abnormality to be detected or the cause of occurrence of the abnormality, the frequency or tendency of occurrence may change depending on the time zone. Specifically, for example, when detecting an anomaly in the amount of packets sent and received by a network device, the frequency of detected anomalies differs between late night hours and daytime hours. there was a case.

FIG. 10 is a diagram for explaining notification suppression processing according to the modification. In FIG. 10, the cumulative threshold time, the cumulative measurement time, and the notification Vary the suppression time. In FIG. 10, it is assumed that the cumulative threshold time, cumulative measurement time, and notification suppression time during the daytime are 20 minutes, 60 minutes, and 30 minutes, respectively. On the other hand, it is assumed that the cumulative threshold time, cumulative measurement time, and notification suppression time in the night time zone are 60 minutes, 100 minutes, and 50 minutes, respectively.

Depending on the type of abnormality to be detected, the cause of occurrence of the abnormality, the configuration of the equipment to be monitored, etc., abnormalities in multiple devices may occur in conjunction. Specifically, for example, when detecting an abnormality in the amount of packets sent and received by two network devices that have the same function and perform processing in parallel, one of the devices malfunctions and an abnormality occurs in the amount of packets sent and received. However, if the other device can perform processing for two devices, the network as a whole is normal.

FIG. 11 is a diagram for explaining notification suppression processing according to the modification. In FIG. 11, the filter device 100 sums the amount of input traffic input to each of the input ports of the four target devices #1 to #4 constituting the distributed network, and the four target devices #1 to #4. #4 Calculate the total amount of output traffic output from each output port. Then, the filter device 100 suppresses the output of the anomaly detection notification for the entire bundle group based on the periodic tendency of the sum of the input traffic volume and the sum of the output traffic volume.

Depending on the type of abnormality to be detected, the cause of occurrence of the abnormality, the configuration of the equipment to be monitored, etc., abnormalities in multiple devices may occur in conjunction. Specifically, for example, when detecting an abnormality in the amount of packets sent and received by two network devices that have the same function and perform processing in parallel, if the input port of one of the devices fails, the sent and received packets If an abnormality occurs in the amount of , packets may be concentrated in the other device and the abnormality may be detected, and there are cases where it is desired to notify only one abnormality and suppress the other abnormality.

FIG. 12 is a diagram for explaining notification suppression processing according to the modification. In FIG. 12, the output control unit 132 suppresses the output of the anomaly detection notification based on the traffic volume of each of the plurality of target devices forming the distributed network. A group of a plurality of target devices forming a distributed network is also called a bundle group. For example, when the traffic volume of all target devices in the bundle group is below the lower limit threshold, the output control unit 132 determines that maintenance work is being performed, and suppresses the output of the abnormality detection notification.

Note that the output control unit 132 uses a machine learning model trained to estimate the cumulative measurement time, the cumulative threshold time, or the notification suppression time from the state information indicating the state of the monitoring target, and calculates the cumulative measurement time, the cumulative threshold time, and the Alternatively, the notification suppression time may be estimated.

[5. effect〕
(Flutter suppression mode)
As described above, the information processing apparatus (the filter device 100 in the embodiment) according to the embodiment includes the reception section (the reception section 131 in the embodiment) and the output control section (the output control section 132 in the embodiment). The reception unit receives an abnormality detection notification indicating that the state of the monitored object is abnormal. When the output control unit receives a recovery detection notification indicating that the state of the monitoring target has recovered from an abnormality within a first suppression time period starting from the first time at which the first abnormality detection notification is received outputs the recovery detection notification after the first suppression time has passed on condition that the second abnormality detection notification different from the first abnormality detection notification is not received after the recovery detection notification is received. Further, the output control unit suppresses the output of the second abnormality detection notification when the second abnormality detection notification is received within the first suppression time starting at the first time.

As a result, the information processing apparatus can, for example, issue an anomaly detection notification that occurs sporadically for a certain period of time after sending an anomaly detection notification to the administrator for the first time. It is possible to suppress unnecessary anomaly detection notification not to be performed. Therefore, the information processing device can reduce the burden on the administrator involved in monitoring the monitoring target. In addition, the information processing device can reduce the burden on administrators involved in monitoring objects to be monitored. can contribute to the achievement of

Further, the output control unit receives a third abnormality detection notification different from the second abnormality detection notification within a first suppression time period starting at a second time when the second abnormality detection notification is received. , the output of the third abnormality detection notification is suppressed, and if the recovery detection notification is received within the first suppression time starting at the second time, after the recovery detection notification is received, the third On the condition that the abnormality detection notification is not accepted, the recovery detection notification is output after the first suppression time with the second time as the start time elapses.

As a result, the information processing apparatus does not issue an anomaly detection notification that does not need to be notified to the administrator for a certain period of time each time it receives an anomaly detection notification that does not need to be notified to the administrator. Can be repeatedly suppressed.

Further, when the output control unit receives the fourth abnormality detection notification after continuing the process of suppressing the abnormality detection notification during the first suppression time for a predetermined time, the output control unit performs the second suppression time longer than the first suppression time. If the recovery detection notification is received after the process of suppressing the output of the fourth anomaly detection notification for the suppression time and suppressing the anomaly detection notification during the first suppression time is continued for a predetermined time, the fourth anomaly detection is performed. On condition that the notification is not accepted, the recovery detection notification is output after the second suppression time elapses.

As a result, for example, if it takes a long time to stop accepting anomaly detection notifications that do not need to be notified to the administrator, the information processing device can take a long time to receive anomaly detection notifications that do not need to be notified to the administrator. It can be restrained from doing over time.

In addition, the output control unit controls that the end time of the first suppression time starting at the second time exceeds the predetermined time, and after the first suppression time starting at the second time ends, When the fourth abnormality detection notification is received, the output of the fourth abnormality detection notification is suppressed for a second suppression time starting at the time when the fourth abnormality detection notification is received, and the second time is started. After the end time of the first suppression time set as the time exceeds the predetermined time and the end of the first suppression time set as the start time of the second time, the fourth abnormality detection notification is received, and the recovery detection notification is received. is received, the recovery detection notification is output after the second suppression time, which starts at the time when the fourth abnormality detection notification is received, elapses.

As a result, for example, when the information processing device receives a new anomaly detection notification that does not need to be notified to the administrator after continuously suppressing the anomaly detection notification for a predetermined period of time so that it is not issued for a short time, It is possible to suppress the newly received anomaly detection notification from being sent for a long period of time.

Further, the output control unit determines that the end time of the first suppression period starting at the second time exceeds the predetermined time, and the third suppression period is set to the first suppression period starting at the second time. When an abnormality detection notification is received and then a recovery detection notification is received, the recovery detection notification is output after a second suppression period starting at the time when the third abnormality detection notification is received.

As a result, even if the information processing device receives, for example, an anomaly detection notification that does not need to be notified to the administrator immediately before shifting from short-term restraint to long-term restraint, the information processing apparatus can switch from short-term restraint to long-term restraint. It is possible to suppress for a long time the anomaly detection notification received immediately before the transition.

The receiving unit also receives an abnormality detection notification indicating that the state of the monitored object is abnormal. The output control unit receives the N-th (N is a natural number) abnormality detection notification, which is the N-th abnormality detection notification, within the first suppression time starting at the N-th time, which is the time when the N-th abnormality detection notification is received. When another abnormality detection notification different from the abnormality detection notification is received, the output of the other abnormality detection notification is suppressed, and after continuing the process of suppressing the abnormality detection notification during the first suppression time for a predetermined time, a new If the abnormal detection notification is not received, after the second suppression time longer than the first suppression time has elapsed, or after the process of suppressing the abnormality detection notification during the first suppression time has continued for a predetermined period of time, Output a recovery detection notification indicating that the status of the monitoring target has recovered from an anomaly.

Thereby, the information processing apparatus can output the recovery detection notification even when the abnormality detection notification is related to an abnormal event, for example.

Further, the output control unit uses a machine learning model trained to estimate the first suppression time, the predetermined time, or the second suppression time from the state information indicating the state of the monitored object, and calculates the first suppression time. , a predetermined time or a second suppression time.

Thereby, the information processing device can automatically set the parameter for controlling the suppression time.

Further, the output control unit uses a statistical method based on the history of the anomaly detection notifications received within a certain period of time from the time when the anomaly detection notification was received by the reception unit. A period until the detection notification is no longer accepted is estimated, and the first suppression period, the predetermined period of time, or the second suppression period is determined based on the estimated period.

Thereby, the information processing device can determine a parameter for controlling the suppression time by a statistical method.

(cumulative detection mode)
The receiving unit also receives an abnormality detection notification indicating that the state of the monitored object is abnormal. The output control unit suppresses the output of the abnormality detection notification received within the first suppression time , and the first After the suppression time has elapsed, the first abnormality detection notification is output. Further, the output control unit suppresses the output of the plurality of abnormality detection notifications when receiving the plurality of abnormality detection notifications within the first suppression time.

As a result, the information processing apparatus can, for example, send an anomaly detection notification to an administrator in a case where an anomaly detection notification and a recovery detection notification are repeated for a certain period of time, and do not need to notify the administrator. Abnormality detection notification can be suppressed. Therefore, the information processing device can reduce the burden on the administrator involved in monitoring the monitoring target. In addition, the information processing device can reduce the burden on administrators involved in monitoring objects to be monitored. can contribute to the achievement of

Further, the output control unit suppresses the output of the recovery detection notification when the recovery detection notification indicating that the state of the monitored object has recovered from the abnormality is received within the first suppression time.

As a result, the information processing apparatus can, for example, provide the administrator with a recovery detection notification in the case where the abnormality detection notification and the recovery detection notification are repeated for a certain period of time, and there is no need to notify the administrator. It is possible to suppress not to perform recovery detection notification.

Further, the output control unit sets the second suppression time within a second suppression time starting from the first time at which the first abnormality detection notification is output and which is shorter than the first suppression time. When a second anomaly detection notification different from the first anomaly detection notification is received, the output of the second anomaly detection notification is suppressed, and the monitoring target is suppressed within the second suppression time starting at the first time. When a recovery detection notification indicating that the state of has recovered from an abnormality is received, the second time when the recovery detection notification is received on the condition that the second abnormality detection notification is not received after the recovery detection notification is received. after the lapse of the second suppression time starting time, the recovery detection notification is output.

As a result, when the information processing apparatus receives a new abnormality detection notification that does not need to be notified to the administrator after repeating the abnormality detection notification and the recovery detection notification for a certain period of time, the information processing apparatus Abnormality detection notification can be suppressed.

Further, the output control unit receives a third abnormality detection notification different from the second abnormality detection notification within a second suppression time period starting at a third time at which the second abnormality detection notification is received. , the output of the third abnormality detection notification is suppressed, and if the recovery detection notification is received within the second suppression time starting at the third time, after the recovery detection notification is received, the third On the condition that the abnormality detection notification is not accepted, the recovery detection notification is output after the second suppression time with the second time as the start time elapses.

As a result, the information processing apparatus repeats the anomaly detection notification and the recovery detection notification for a certain period of time, and thereafter, every time an anomaly detection notification that does not need to be notified to the administrator is received, the information processing apparatus It is possible to repeatedly suppress an abnormality detection notification that does not need to be notified to the person.

Further, the output control unit performs the first suppression using a machine learning model learned to estimate the first suppression time, the cumulative threshold time, or the second suppression time from the state information indicating the state of the monitored object. Estimate time, cumulative threshold time or second suppression time.

Thereby, the information processing device can automatically set the parameter for controlling the suppression time.

[6. Hardware configuration]
Further, the information processing device such as the filter device 100 according to the above-described embodiments is implemented by a computer 1000 configured as shown in FIG. 13, for example. FIG. 13 is a hardware configuration diagram showing an example of a computer that implements the functions of the information processing device such as the filter device 100 according to the embodiment. Hereinafter, the filter device 100 according to the embodiment will be described as an example. Computer 1000 includes CPU 1100 , RAM 1200 , ROM 1300 , HDD 1400 , communication interface (I/F) 1500 , input/output interface (I/F) 1600 and media interface (I/F) 1700 .

The CPU 1100 operates based on programs stored in the ROM 1300 or HDD 1400 and controls each section. The ROM 1300 stores a boot program executed by the CPU 1100 when the computer 1000 is started up, a program depending on the hardware of the computer 1000, and the like.

The HDD 1400 stores programs executed by the CPU 1100, data used by the programs, and the like. Communication interface 1500 receives data from another device via a predetermined communication network, sends the data to CPU 1100, and transmits data generated by CPU 1100 to another device via a predetermined communication network.

The CPU 1100 controls output devices such as displays and printers, and input devices such as keyboards and mice, through an input/output interface 1600 . CPU 1100 acquires data from an input device via input/output interface 1600 . CPU 1100 also outputs the generated data to an output device via input/output interface 1600 .

Media interface 1700 reads programs or data stored in recording medium 1800 and provides them to CPU 1100 via RAM 1200 . CPU 1100 loads such a program from recording medium 1800 onto RAM 1200 via media interface 1700, and executes the loaded program. The recording medium 1800 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase change rewritable disc), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory. etc.

For example, when the computer 1000 functions as the filter device 100 according to the embodiment, the CPU 1100 of the computer 1000 implements the functions of the control unit 130 by executing programs loaded on the RAM 1200 . CPU 1100 of computer 1000 reads these programs from recording medium 1800 and executes them, but as another example, these programs may be obtained from another device via a predetermined communication network.

As described above, some of the embodiments of the present application have been described in detail based on the drawings. It is possible to carry out the invention in other forms with modifications.

[7. others〕
Further, among the processes described in the above embodiments and modifications, all or part of the processes described as being performed automatically can be performed manually, or described as being performed manually. All or part of the processing can also be performed automatically by known methods. In addition, information including processing procedures, specific names, various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified. For example, the various information shown in each drawing is not limited to the illustrated information.

Also, each component of each device illustrated is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution and integration of each device is not limited to the one shown in the figure, and all or part of them can be functionally or physically distributed and integrated in arbitrary units according to various loads and usage conditions. Can be integrated and configured.

Also, the above-described embodiments and modifications can be appropriately combined within a range that does not contradict the processing content.

Reference Signs List 1 information processing system 10 target device 20 detection device 100 filter device 110 communication unit 120 storage unit 130 control unit 131 reception unit 132 output control unit 200 monitoring device

Claims (23)

a receiving unit that receives an anomaly detection notification indicating that the state of the monitored object is abnormal;
When a recovery detection notification indicating that the state of the monitoring target has recovered from an abnormality is received within a first suppression time period starting from a first time at which the first abnormality detection notification is received, the recovery detection is performed. an output control unit that outputs the recovery detection notification after the first suppression time has elapsed on the condition that a second abnormality detection notification different from the first abnormality detection notification is not accepted after the notification is received;
Information processing device. The output control unit is
suppressing output of the second abnormality detection notification when the second abnormality detection notification is received within the first suppression time with the first time as the start time;
The information processing device according to claim 1 . The output control unit is
If a third anomaly detection notification different from the second anomaly detection notification is received within the first suppression time starting at the second time when the second anomaly detection notification is received, the Suppressing the output of the third anomaly detection notification,
On the condition that when the recovery detection notification is received within the first suppression time period starting at the second time, the third abnormality detection notification is not received after the recovery detection notification is received. , outputting the recovery detection notification after the first suppression time having the second time as the start time elapses;
The information processing apparatus according to claim 2. The output control unit is
If a fourth abnormality detection notification is received after the process of suppressing the abnormality detection notification is continued for a predetermined time during the first suppression time, the second suppression time longer than the first suppression time Suppressing the output of the fourth anomaly detection notification,
If the recovery detection notification is accepted after the process of suppressing the abnormality detection notification during the first suppression time is continued for the predetermined time, the fourth abnormality detection notification is not accepted. outputting the recovery detection notification after the suppression time of 2 has elapsed;
The information processing apparatus according to claim 3. The output control unit is
The end time of the first suppression period starting at the second time exceeds the predetermined time, and after the first suppression period starting at the second time ends, the fourth When the abnormality detection notification is received, suppressing the output of the fourth abnormality detection notification for the second suppression time starting at the time when the fourth abnormality detection notification is received,
After the end time of the first suppression time period starting at the second time exceeds the predetermined time period and after the first suppression time period starting at the second time ends, the first 4. When the abnormality detection notification of 4 is received and further the recovery detection notification is received, the recovery detection notification is output after the second suppression time, which starts at the time when the fourth abnormality detection notification is received, has elapsed. do,
The information processing apparatus according to claim 4. The output control unit is
The end time of the first suppression period starting at the second time exceeds the predetermined period of time, and the third abnormality occurs during the first suppression period starting at the second time. When the detection notification is received and the recovery detection notification is received, the recovery detection notification is output after the second suppression time has elapsed with the start time being the time when the third abnormality detection notification is received.
The information processing apparatus according to claim 4. a receiving unit that receives an anomaly detection notification indicating that the state of the monitored object is abnormal;
The N-th anomaly detection notification, which is an anomaly detection notification received for the Nth time (N is a natural number), is received within a first suppression time starting at the N-th time, which is the time when the N-th anomaly detection notification is received. When another abnormality detection notification different from the above is received, the output of the other abnormality detection notification is suppressed, and after continuing the process of suppressing the abnormality detection notification during the first suppression time for a predetermined time, a new abnormality If the detection notification is not received, the process of suppressing the abnormality detection notification is continued for the predetermined time after a second suppression time longer than the first suppression time elapses, or during the first suppression time. an output control unit that later outputs a recovery detection notification indicating that the state of the monitoring target has recovered from the abnormality;
Information processing device. The output control unit is
Using a machine learning model learned to estimate the first suppression time, the predetermined time, or the second suppression time from the state information indicating the state of the monitoring target, the first suppression time, the estimating a predetermined time or the second suppression time;
The information processing apparatus according to claim 4 or 7. The output control unit is
After receiving the anomaly detection notification using a statistical method based on the history of the anomaly detection notifications received within a certain period of time from the time when the reception unit received the anomaly detection notification, the anomaly detection notification Estimate the period until it stops accepting, and determine the first suppression time, the predetermined time or the second suppression time based on the estimated period,
The information processing apparatus according to claim 4 or 7. a receiving unit that receives an anomaly detection notification indicating that the state of the monitored object is abnormal;
Suppressing the output of a plurality of anomaly detection notifications received within a first suppression time, and suppressing the first suppression time on the condition that the total notification time of each of the plurality of anomaly detection notifications is equal to or greater than a cumulative threshold time an output control unit that outputs a first abnormality detection notification after the elapse of;
Information processing device. a reception unit that receives, at predetermined time intervals, an abnormality detection notification indicating that the state of the monitored object is abnormal;
Suppressing the output of the anomaly detection notification received within the first suppression time, and suppressing the first suppression on the condition that the total notification time of the anomaly detection notification that is the predetermined time interval is equal to or greater than the cumulative threshold time an output control unit that outputs a first abnormality detection notification after a lapse of time;
Information processing device. The output control unit is
suppressing output of the recovery detection notification when a recovery detection notification indicating that the state of the monitoring target has recovered from an abnormality is received within the first suppression time period;
The information processing apparatus according to claim 10 or 11 . The output control unit is
A second suppression time starting at a first time when the first failure detection notification is output, wherein the first failure occurs within the second suppression time shorter than the first suppression time. When a second abnormality detection notification different from the detection notification is received, suppressing output of the second abnormality detection notification,
When the recovery detection notification indicating that the state of the monitoring target has recovered from the abnormality is received within the second suppression time period starting from the first time, the recovery detection notification is received and then the recovery detection notification is received. 2, on the condition that the abnormality detection notification is not accepted, the recovery detection notification is output after the second suppression time has elapsed with the second time at which the recovery detection notification is accepted as the start time;
The information processing apparatus according to claim 10 or 11 . The output control unit is
If a third anomaly detection notification different from the second anomaly detection notification is received within the second suppression time starting at a third time at which the second anomaly detection notification is received, the Suppressing the output of the third anomaly detection notification,
On the condition that when the recovery detection notification is received within the second suppression time period starting from the third time, the third abnormality detection notification is not received after the recovery detection notification is received. , outputting the recovery detection notification after the second suppression time with the second time as the start time elapses;
The information processing apparatus according to claim 13. The output control unit is
Using a machine learning model trained to estimate the first suppression time, the cumulative threshold time, or the second suppression time from state information indicating the state of the monitoring target, the first suppression time, estimating the cumulative threshold time or the second suppression time;
The information processing apparatus according to claim 13. An information processing method realized by a program executed by an information processing device,
a receiving step of receiving an anomaly detection notification indicating that the state of the monitored object is anomalous;
When a recovery detection notification indicating that the state of the monitoring target has recovered from an abnormality is received within a first suppression time period starting from a first time at which the first abnormality detection notification is received, the recovery detection is performed. an output control step of outputting the recovery detection notification after the first suppression time has elapsed on condition that a second abnormality detection notification different from the first abnormality detection notification is not accepted after the notification is received;
Information processing method including. An information processing method realized by a program executed by an information processing device,
a receiving step of receiving an anomaly detection notification indicating that the state of the monitored object is anomalous;
Suppressing the output of a plurality of anomaly detection notifications received within a first suppression time, and suppressing the first suppression time on the condition that the total notification time of each of the plurality of anomaly detection notifications is equal to or greater than a cumulative threshold time an output control step of outputting a first abnormality detection notification after the elapse of;
Information processing method including. An information processing method realized by a program executed by an information processing device,
a receiving step of receiving, at predetermined time intervals, an abnormality detection notification indicating that the state of the monitored object is abnormal;
Suppressing the output of the anomaly detection notification received within the first suppression time, and suppressing the first suppression on the condition that the total notification time of the anomaly detection notification that is the predetermined time interval is equal to or greater than the cumulative threshold time an output control step of outputting a first abnormality detection notification after a lapse of time;
Information processing method including. An information processing method realized by a program executed by an information processing device,
a receiving step of receiving an anomaly detection notification indicating that the state of the monitored object is anomalous;
The N-th anomaly detection notification, which is an anomaly detection notification received for the Nth time (N is a natural number), is received within a first suppression time starting at the N-th time, which is the time when the N-th anomaly detection notification is received. When another abnormality detection notification different from the above is received, the output of the other abnormality detection notification is suppressed, and after continuing the process of suppressing the abnormality detection notification during the first suppression time for a predetermined time, a new abnormality If the detection notification is not received, the process of suppressing the abnormality detection notification is continued for the predetermined time after a second suppression time longer than the first suppression time elapses, or during the first suppression time. an output control step of outputting a recovery detection notification indicating that the state of the monitoring target has recovered from the abnormality;
Information processing method including. a reception procedure for receiving an anomaly detection notification indicating that the state of a monitoring target is abnormal;
When a recovery detection notification indicating that the state of the monitoring target has recovered from an abnormality is received within a first suppression time period starting from a first time at which the first abnormality detection notification is received, the recovery detection is performed. an output control procedure for outputting the recovery detection notification after the first suppression time elapses on condition that a second abnormality detection notification different from the first abnormality detection notification is not accepted after the notification is received;
An information processing program that causes a computer to execute a reception procedure for receiving an anomaly detection notification indicating that the state of a monitoring target is abnormal;
Suppressing the output of a plurality of anomaly detection notifications received within a first suppression time, and suppressing the first suppression time on the condition that the total notification time of each of the plurality of anomaly detection notifications is equal to or greater than a cumulative threshold time an output control procedure for outputting a first abnormality detection notification after the elapse of;
An information processing program that causes a computer to execute a reception procedure for receiving, at predetermined time intervals, an abnormality detection notification indicating that the state of the monitored object is abnormal;
Suppressing the output of the anomaly detection notification received within the first suppression time, and suppressing the first suppression on the condition that the total notification time of the anomaly detection notification that is the predetermined time interval is equal to or greater than the cumulative threshold time an output control procedure for outputting a first abnormality detection notification after a lapse of time;
An information processing program that causes a computer to execute receiving means for receiving an anomaly detection notification indicating that the state of the monitored object is anomalous;
The N-th anomaly detection notification, which is an anomaly detection notification received for the Nth time (N is a natural number), is received within a first suppression time starting at the N-th time, which is the time when the N-th anomaly detection notification is received. When another abnormality detection notification different from the above is received, the output of the other abnormality detection notification is suppressed, and after continuing the process of suppressing the abnormality detection notification during the first suppression time for a predetermined time, a new abnormality If the detection notification is not received, the process of suppressing the abnormality detection notification is continued for the predetermined time after a second suppression time longer than the first suppression time elapses, or during the first suppression time. output control means for outputting a recovery detection notification indicating that the state of the monitored object has recovered from the abnormality;
An information processing program that causes a computer to execute

Images