JP7402932B1 - Fault detection device, fault detection method, and fault detection program - Google Patents

Abstract

The object of the present invention is to provide a failure detection device that quickly detects failures using posted messages from an unspecified number of users. [Solution] A failure detection device sets a contribution index for providing failure information for each user based on the content of posts posted by the user in the past regarding the presence or absence of communication failures of the target Internet service. a setting unit, a posted text acquisition unit that acquires a posted text that includes a predetermined wording for determining whether there is a problem with the Internet service from among a plurality of posted texts, and the posted text acquisition unit acquires the posted text within a predetermined period. Regarding the posted texts, for each user, calculate the effective number of posts by multiplying the number of posts posted by the user by the user's contribution index, and calculate the cumulative value by integrating the effective number of posts by multiple users. A failure determination unit that determines that a failure has occurred in the Internet service when the integrated value satisfies a predetermined condition, and a failure notification unit that notifies an external party that a failure has occurred. [Selection diagram] Figure 1

Description

The present invention relates to a failure detection device, a failure detection method, and a failure detection program.

In recent years, SNS services such as Twitter (registered trademark) and Instagram, in which multiple users provide information, have been widely used. It has been confirmed that among users of SNS, there are multiple users who post about failures when a failure occurs in cloud services such as AWS or Azure, or internet services including communication services such as mobile lines. ing.

Therefore, an anomaly detection device is known that detects a specific anomaly using a large number of posted texts written by a plurality of posters (for example, Patent Document 1). The anomaly detection device described in Patent Document 1 acquires posted texts containing keywords to be detected every unit time, and detects that the number of posts at the current time increases by a predetermined threshold or more than the number of posts at a predetermined time in the past. This is to detect the occurrence of an abnormality.

However, conventional anomaly detection devices do not consider the attributes of SNS users, and treat users who post inaccurate fault information and users who post useful fault information equally. As a result, it is difficult to accurately grasp the occurrence of a failure simply by acquiring posts about the failure, and it takes a long time to detect the failure, making it difficult for server administrators to respond quickly to the failure. The problem was that it was difficult.

Japanese Patent Application Publication No. 2014-10511

The present invention provides a failure detection device that can quickly detect failures in Internet services, including both cloud services and communication services such as mobile lines, using posted messages from an unspecified number of users. With the goal.

A failure detection device according to an embodiment of the present disclosure provides a contribution level, which is an index representing the degree of contribution to the provision of failure information, based on the content of posts posted by users in the past regarding the presence or absence of failures in a target Internet service. A contribution index setting unit that sets an index for each user, and a post text acquisition unit that obtains post texts that include predetermined text for determining whether there is a problem with internet services from among multiple posts on a posting site. For each user, calculate the effective number of posts by multiplying the number of posts posted by the user by the user's contribution index with respect to the posts acquired by the post acquisition unit and the post acquisition unit within a predetermined period, and A calculation unit that calculates an integrated value of the effective number of posts by multiple users; a failure determination unit that determines that a failure has occurred in the Internet service when the accumulated value satisfies a predetermined condition; and a failure notification unit that notifies the outside that a problem has occurred.

In the failure detection device according to an embodiment of the present disclosure, the contribution index setting unit is configured to perform a contribution index setting unit, regarding a failure that occurred in the past, when a user posts a notification of failure occurrence during a period in which the failure occurred. Points may be added to the contribution index of the user.

In the failure detection device according to an embodiment of the present disclosure, the contribution index setting unit sets the number of points to be added to the contribution index with respect to failures that have occurred in the past, the shorter the time from the occurrence of the failure until posting. You can set it to a large value.

In the failure detection device according to an embodiment of the present disclosure, the contribution index setting unit is configured to perform a contribution index setting unit, regarding a failure that occurred in the past, when a user posts a notification of failure occurrence during a period when no failure has occurred. Points may be subtracted from the contribution index of the user.

In the failure detection device according to an embodiment of the present disclosure, the predetermined conditions include a first condition in which the integrated value continuously increases in a predetermined period, and an average integrated value that is an integrated value per unit time in the predetermined period. a second condition in which the average number of posts, which is the number of posts per unit time in a predetermined period, exceeds the second threshold; and a third condition in which the ratio of the cumulative value to the number of posts in the predetermined period exceeds the second threshold; It may be that at least two or more of the fourth conditions exceeding the threshold are satisfied.

In the failure detection device according to an embodiment of the present disclosure, the predetermined condition may be that the cumulative value of the integrated values in a predetermined period exceeds a predetermined reference value.

In the failure detection device according to an embodiment of the present disclosure, the predetermined condition may be that the integrated value continuously increases in a predetermined period.

In the failure detection device according to an embodiment of the present disclosure, the predetermined condition may be that an average integrated value that is an integrated value per unit time in a predetermined period exceeds a first threshold value.

In the failure detection device according to an embodiment of the present disclosure, the predetermined condition may be that the ratio of the integrated value to the number of posts in a predetermined period exceeds a third threshold.

In the failure detection device according to an embodiment of the present disclosure, a posted message including a message related to a failure is acquired as an input parameter from the posted message acquisition unit, and inputted to the learning model, and the posted message is changed to a posted message related to the occurrence of a failure. The learning model further includes a learning unit that outputs the possibility that It may be a learning model generated by machine learning using an input/output data set where is used as a learning input parameter and the result of determining whether the posted text is related to the occurrence of a failure is used as a learning output parameter. .

In the failure detection method according to an embodiment of the present disclosure, the contribution index setting unit contributes to the provision of failure information based on the content of posts posted by users in the past regarding the presence or absence of communication failures in the target Internet service. A contribution index, which is an index representing the degree of failure, is set for each user, and the posted text acquisition unit selects posts that include predetermined text for determining whether or not there is a problem with an Internet service from among the posted texts on the posting site. The calculation unit calculates, for each user, the effective number of posts obtained by multiplying the number of posts posted by the user by the contribution index of the user, regarding the posted texts that the posted text acquisition unit acquired within a predetermined period. and calculates an integrated value by integrating the effective number of posts by multiple users, and the fault determination unit determines that a fault has occurred in the Internet service if the integrated value satisfies a predetermined condition; The failure notification unit is characterized in that it notifies the outside that a failure has occurred in the Internet service.

A failure detection program according to an embodiment of the present disclosure provides an index representing the degree of contribution to the provision of failure information based on the content of posts posted by users in the past regarding the presence or absence of communication failures in a target Internet service. a step of setting a contribution index for each user, a step of obtaining a posted text including a predetermined wording for determining the presence or absence of a failure regarding an Internet service from among posted texts on a posting site; Regarding posts obtained within the period, for each user, calculate the effective number of posts by multiplying the number of posts posted by the user by the user's contribution index, and add up the effective number of posts by multiple users. a step of determining that a failure has occurred in the Internet service if the cumulative value satisfies a predetermined condition; and a step of notifying an external party that a failure has occurred in the Internet service; It is characterized by causing the execution.

According to the failure detection device according to an embodiment of the present disclosure, it is possible to quickly detect a failure in an Internet service using posted messages from an unspecified number of users.

1 is a configuration diagram of a failure detection system including a failure detection device according to an embodiment of the present disclosure. FIG. 1 is a configuration block diagram of a failure detection device according to an embodiment of the present disclosure. 2 is a flowchart for explaining a procedure for updating a contribution index database by a failure detection device according to an embodiment of the present disclosure. FIG. 2 is a diagram for explaining the procedure from the occurrence of a failure by the failure detection device according to an embodiment of the present disclosure to the update of the contribution index database, in which (a) is a procedure for acquiring failure date and time information; FIG. 6C is a diagram for explaining the procedure for acquiring a posted text and the procedure for updating the contribution index database. FIG. 6 is a diagram illustrating an example of adding and subtracting points to a contribution index when a failure occurs and when a failure does not occur, using the failure detection device according to an embodiment of the present disclosure. 2 is an example of a table showing the relationship between the contribution index set by the contribution index setting unit of the failure detection device according to an embodiment of the present disclosure and the elapsed time from the occurrence of a failure. 2 is a flowchart for explaining a procedure for determining whether a failure has occurred using the number of posts and an integrated value using a failure detection device according to an embodiment of the present disclosure. It is a graph showing a temporal change in the integrated value and the number of posts detected using the failure detection device according to an embodiment of the present disclosure. It is a graph showing a temporal change in the integrated value and the cumulative number of failure posts detected using the failure detection device according to an embodiment of the present disclosure. FIG. 3 is a diagram illustrating a procedure for creating a learning model using posted messages posted when a failure occurs and when a failure does not occur, using the failure detection device according to an embodiment of the present disclosure.

Hereinafter, a failure detection device, a failure detection method, and a failure detection program according to the present invention will be described with reference to the drawings. However, it should be noted that the technical scope of the present invention is not limited to these embodiments, but extends to the invention described in the claims and equivalents thereof.

(Overview of failure detection device)
FIG. 1 shows a configuration diagram of a failure detection system including a failure detection device according to an embodiment of the present disclosure. The failure detection system 1000 includes a failure detection device 100, a posting site server 200, a cloud service server 300, and a plurality of terminals 400, which are connected via an Internet service 500. Note that in this embodiment, a cloud service will be described as an example of an Internet service, but the present invention is not limited to such an example, and the Internet service may include a mobile line and the like.

The user uses the terminal 400 to communicate with the cloud service server 300 and utilizes the services provided by the cloud service server 300. As the terminal 400, a computer, a mobile phone, a smartphone, an information terminal such as a tablet terminal, etc. can be used. The cloud service server 300 is a server that provides services such as AWS and Azure. However, cloud services are not limited to these examples.

When a communication failure occurs in a specific cloud service server 300, the user shall post on the posting site operated by the posting site server 200 that a failure has occurred in the cloud service server 300. . Posting sites include, for example, Twitter and Instagram, but are not limited to these examples.

It has been confirmed that some users frequently post about failures when they occur. By counting the number of posts by such users, it is possible to detect the occurrence of a failure. In particular, posts by users who post within a short period of time after the occurrence of a fault are useful for quickly detecting the occurrence of a fault. In other words, a posted text posted within a short time after the occurrence of a failure can be considered to be more important than a posted text posted after a long period of time. Therefore, in the fault detection device according to an embodiment of the present disclosure, a contribution index is set as an index (parameter) representing the degree of contribution to the detection of the occurrence of a fault, and high points are awarded to users who make a high contribution. .

When a communication failure occurs in a specific cloud service server 300, the user posts a message to the posting site that includes the service name of the cloud service server 300 where the failure occurred and a predetermined wording indicating that a failure has occurred. It is thought that it will be posted on. “Predetermined words” (failure words) that indicate the occurrence of a failure include, for example, “failure,” “death,” “fall,” “unusable,” “impact,” “slow,” “stop,” and “severe.” ” etc., but are not limited to these examples.

The content of the message posted by the user is, for example, "Is there a problem with AWS after all?" or "As far as I can see from the timeline, is there a problem with AWS?" If the failure continues, the number of such posted messages is expected to increase as time passes from the occurrence of the failure. Therefore, it is considered possible to detect posted texts that include words expressing a fault, and to detect the presence or absence of a fault based on the increasing trend in the number of posts. For example, it can be determined that a failure has occurred when the number of posts notifying the occurrence of a failure reaches a predetermined threshold.

However, even if a user's posted text includes a fault word, it may not necessarily mean that a fault has occurred. For example, even if the wording ``failed'' is included, such as in ``failed AWS qualification,'' it may not mean a server failure. Therefore, it may be difficult to accurately determine the presence or absence of a disability by simply counting the number of posted texts that include words expressing a disability (disability word).

Furthermore, as the amount of time that has elapsed since the occurrence of a failure is prolonged, the number of affected users is likely to increase, so it is preferable to quickly notify the server administrator of the occurrence of a failure.

Therefore, the failure detection device 100 according to an embodiment of the present disclosure aims to quickly detect the occurrence of a failure by counting the number of posts that include the failure word in consideration of user attributes. . That is, the failure detection device 100 according to an embodiment of the present disclosure analyzes posts posted in response to failures that occurred in the past, and quickly and accurately informs the user of the occurrence of the failure. is a method that quickly detects the occurrence of a failure by determining that the degree of contribution to failure notification is high, giving it a high weight (additional points), and counting the effective number of posts higher than the actual number of posts. It is.

In addition, points will be deducted for users who have posted inaccurate or incorrect failure information, such as posting that a failure occurred when a failure did not occur in the past. By doing this, the influence caused by such a user can be reduced, and the occurrence of a failure may be accurately detected.

(Configuration of failure detection device)
Next, a failure detection device according to an embodiment of the present disclosure will be described. FIG. 2 shows a configuration block diagram of a failure detection device 100 according to an embodiment of the present disclosure. The failure detection device 100 includes a contribution index setting unit 1, a posted text acquisition unit 2, a calculation unit 3, a failure determination unit 4, a failure notification unit 5, a storage unit 6, a learning unit 7, and a communication unit. 8. Contribution index setting unit 1, posted text acquisition unit 2, calculation unit 3, failure determination unit 4, failure notification unit 5, and learning unit 7 are configured such that a processor (not shown) executes a program stored in storage unit 6. This is achieved by

The contribution index setting unit 1 sets a contribution index for each user, which is an index representing the degree of contribution to providing failure information, based on the content of posts posted by users in the past regarding the presence or absence of communication failures in the target cloud service. Set to . The contribution index assumes that users who have accurately posted about problems that have occurred in the past are likely to post accurately about problems that occur now or in the future, and are therefore more likely to contribute to failure notifications. This is a coefficient for determining and weighting the number of posts. For example, if the number of posts by a normal user notifying the occurrence of a failure is counted as one, then the number of posts by a user with high trust notifying the occurrence of a failure is counted as one post. , the effective number of posts may be increased by counting a larger number (for example, 2 posts, etc.). By doing this, it is possible to shorten the time it takes for the number of posts notifying the occurrence of a failure to reach a predetermined threshold value, which is the criterion for detecting the occurrence of a failure, and to quickly detect the occurrence of a failure. can do.

(Overview of how to set the contribution index)
Next, a method of setting the contribution index will be explained. FIG. 3 shows a flowchart for explaining a procedure for updating the contribution index database by the failure detection device according to an embodiment of the present disclosure. FIGS. 4(a) to 4(c) are diagrams for explaining the procedure from the occurrence of a failure to the update of the contribution index database by the failure detection device according to an embodiment of the present disclosure. FIG. 4A is a diagram for explaining the procedure for acquiring failure date and time information. FIG. 4(b) is a diagram for explaining the procedure for acquiring posted text. FIG. 4(c) is a diagram for explaining the procedure for updating the contribution index database.

First, in step S101, accurate information regarding the date and time of the failure is acquired from the failure information database. For example, as shown in Figure 4(a), in one year from April 2021, in a specific cloud service, the first failure, "Failure I", occurred in June 2021, and the first failure occurred in October 2021. It is assumed that the second failure, “Failure II” occurs in the month, and the third failure, “Failure III” occurs in January 2022.

Next, in step S102, a previously posted message containing a message related to the occurrence of a failure is obtained. For example, messages posted regarding failures that occurred in a specific cloud service in one year from April 2021 are acquired. For example, if the posting site is Twitter, the posted text can be obtained by using the Twitter API.

The posted text includes the account that is the identification information of the user who posted, the date and time of posting, and the content of the post. For example, as shown in Figure 4(b), on March 23, 2021, user "A1234" (hereinafter simply referred to as "User A") said, "I thought it was an AWS problem, but it seems normal." It is assumed that it has been posted. Similarly, assume that on June 10, 2021, user “B5678” (hereinafter simply referred to as “User B”) posted “I guess there is a problem with AWS...”. Similarly, assume that on September 20, 2021, user "C9012" (hereinafter simply referred to as "User C") posted, "I wonder if there is a problem with PSN or AWS." At this time, by acquiring the posted texts posted by users A to C, information regarding the accounts, posting dates and times, and posting contents of users A to C can be obtained.

Next, in step S103, it is determined whether the acquired posted text is a posted text that was posted when a failure occurred or a posted text that was posted during a non-failure period when no failure occurred. For example, the posted date and time of user A's post is March 23, 2021, which is before the period in which failure I occurred (June 2021), so the failure has occurred. You can see that it was posted at a time when it was not posted. In addition, the date and time of user B's post is June 10, 2021, which is included in the period in which failure I occurred (June 2021), so when the failure occurred, I can see that it was posted. Furthermore, the posted date and time of User C's post is September 20, 2021, which is after Failure I occurred and before the period in which Failure II occurred (October 2021). , it can be seen that the post was posted when no failure occurred.

Next, in step S104, the contribution index setting unit 1 adds points to the contribution index of the user if the user was posting when the failure occurred, and adds points to the contribution index of the user if the user was posting when the failure occurred. Deduct points from the user's contribution index. That is, regarding a failure that occurred in the past, if a user posts a notification of the occurrence of a failure during the period when the failure occurred, the contribution index setting unit 1 adds points to the contribution index of the user. good. On the other hand, the contribution index setting unit 1 deducts points from the contribution index of the user if the user posts a notification of the occurrence of a failure during a period when no failure has occurred regarding a failure that occurred in the past. good. For example, as mentioned above, the posts by users A and C were posted during a period when no failure occurred (non-failure time), so the messages shown in FIG. 4(c) Thus, "0.1 point" is subtracted from the contribution index of users A and C. On the other hand, since User B's posted text was posted at the time of the failure (at the time of the failure), which is the period during which the failure occurred, for example, the contribution index of User B is ``1.0 points.'' ” will be added. However, the number of points to be added or subtracted is not limited to the above example. A specific example of the contribution index to which points are added or subtracted will be described later.

Next, in step S105, the user contribution index database stored in the storage unit 6 (see FIG. 2) is updated. As described above, a contribution index is set for each user.

(Example of setting contribution index)
Next, a specific example of the procedure for setting the contribution index will be explained. FIG. 5 shows an example of adding and subtracting points to the contribution index for each user using the failure detection device according to an embodiment of the present disclosure, using posts posted when a failure occurs and when a failure does not occur. shows.

As an example, a procedure for setting the contribution index during the period from time t1 to t8 will be described. It is assumed that failures I to III occur in a specific cloud service server at times t2 to t3, t4 to t5, and t6 to t7, respectively.

Here, for example, assume that user A posted a message such as "I thought it was an AWS failure, but it seems normal" at some point during the period from time t1 to time t2. In this case, the period from time t1 to t2 is the period before failure I occurs, and since user A's post was made during the period when no failure occurred (non-failure time), user A points will be deducted from the contribution index. The number of points to be deducted may be, for example, "0.1 point". However, the present invention is not limited to such an example.

In addition, in this embodiment, an example was shown in which user A posted only once during the period from time t1 to time t2, but if user A posted multiple times, the contribution index is determined according to the number of posts. You may deduct points from For example, in the period from time t1 to time t2, if user A posted three times including the problem word when there was no problem, 3 is added to the "0.1 point" that is the deduction for the first post. The multiplied "0.3 points" may be subtracted from the contribution index.

On the other hand, for example, assume that user B posted a message such as "I guess there is a problem with AWS..." at some point during the period from time t2 to time t3. In this case, the period from time t2 to time t3 is the period during which failure I occurs, and since user B's post was made during the period when the failure occurred (at the time of failure), user B Points will be added to the contribution index of The point to be added may be, for example, "1.0 point". However, the present invention is not limited to such an example. In addition, in this example, an example was shown in which user B posted only once during the period from time t2 to t3, but if user B posts multiple times, priority is given to the posted text that was posted first. You may do so. For example, in the period from time t2 to time t3, if user B posted twice including the trouble word at the time of the trouble, the additional point for the first post, ``1.0 point'', is used as the contribution index. You may add points to This means that if the same user's contribution index is added each time in response to multiple posts by the same user, one user will receive a huge amount of money by intentionally posting many times during the failure period. This is because it would give a contribution index that is undesirable.

Here, the number of points added to the contribution index for each user may be changed depending on the contribution to the failure occurrence. Since the failure detection device according to an embodiment of the present disclosure aims to quickly detect the occurrence of a failure in a specific cloud service, a posted message including a failure word that notifies the occurrence of a failure from the time the failure occurs. The shorter the time until posting, the larger the value may be added to the contribution index. FIG. 6 shows the relationship between the contribution index set by the contribution index setting unit of the failure detection device according to an embodiment of the present disclosure and the elapsed time from the occurrence of the failure. Regarding failures that occurred in the past, the contribution index setting unit 1 may set the number of points to be added to the contribution index to a larger value as the time from the occurrence of the failure to posting is shorter. For example, 1.0 points will be added to the contribution index for a user who posts a problem word within 10 minutes after the problem occurs, and For users who have made posts that include troublesome words, 0.9 points may be added to the contribution index. Thereafter, the number of points added to the user's contribution index may be decreased as time passes since the failure occurred.

For example, in the example shown in FIG. 5, if user B posts a post that includes the fault word during a period of 50 to 60 minutes that has elapsed since time t4 when fault II occurred, the contribution level of user B You may add 0.5 points to the index. Similarly, if user C posts a post that includes a faulty word during a period of 90 to 100 minutes that has elapsed since time t4 when fault II occurred, 0.1 point will be added to user C's contribution index. You may add points.

Thereafter, in the same manner, the number of points added to the contribution index may be decreased by 0.1 points every 10 minutes until 110 minutes have passed since the failure occurred. However, the number of points added to the contribution index is not limited to the example in which the number of points added to the contribution index monotonically decreases with the elapsed time from the occurrence of the failure. Further, although the example shown in FIG. 6 shows an example in which the number of points to be added or subtracted from the contribution index is defined by dividing the elapsed time from the occurrence of a failure into every 10 minutes, this is not limited to such an example. The contribution index may be defined by dividing it into arbitrary time periods.

Furthermore, after a certain period of time has passed since the occurrence of a failure, the number of points added to the contribution index for each user may be set constant. This is because, although the degree of contribution in terms of prompt notification of the occurrence of a failure decreases after a predetermined period of time has elapsed since the occurrence of a failure, it still contributes to a certain extent.

As shown in FIG. 6, if user A posts including a problem word three times when there is no problem, 0.3 points may be subtracted from the contribution index. If the initial value of the contribution index of users A to C is 1 point, the contribution index of user A may be set to 0.7 points by subtracting 0.3 points from the initial value of 1 point. Similarly, if user B posts three times including the trouble word at the time of the trouble, and the number of points added to the contribution index for each post is 1.0, 0.5, and 0.2. may have a final contribution index of 2.7 points.

The relationship between the elapsed time since the occurrence of a failure and the size of the contribution index may be determined by performing machine learning to create a learning model.

After setting the user's contribution index using past posted messages as described above, the database stored in the storage unit 6 (see FIG. 2) may be updated. As described later, when a post that includes a troublesome word is made, the occurrence of trouble can be quickly detected by referring to the contribution index stored in the database and counting the number of posts by reliable users with a large contribution index. can be detected.

(Method of detecting failure occurrence)
Next, a method for detecting a failure in a specific cloud service using a failure detection device according to an embodiment of the present disclosure will be described. FIG. 7 shows a flowchart for explaining a procedure for determining whether a failure has occurred using the number of posts and an integrated value using the failure detection device according to an embodiment of the present disclosure. First, in step S201, the posted text acquisition unit 2 obtains a posted text that includes a predetermined wording for determining the presence or absence of a failure regarding the cloud service from among a plurality of posted texts on the posting site.

The posting site from which the posted text including the obstacle word is acquired may be the same posting site used when creating the above-mentioned contribution index database. However, it is not limited to such an example, and the two may be different. For example, if a user posts to different posting sites using the same account, a contribution index database created using posts from a particular posting site can also be used on other posting sites. can.

The predetermined wording for determining whether a failure has occurred may be the same as the wording used when setting the contribution index described above. In other words, predetermined words (failure words) that indicate the occurrence of a fault include, for example, "failure," "death," "fall," "unusable," "impact," "slow," "stop," and "severe." ” etc., but are not limited to these examples.

When the posting site is Twitter, by using the Twitter API, it is possible to obtain posted texts that include predetermined words notifying a failure during a predetermined period.

Next, in step S202, for each user, for posted texts acquired within a predetermined period, the effective number of posts is calculated by multiplying the number of posted texts by the user by the contribution index of the user.

Here, the "predetermined period" is, for example, 5 minutes. For example, the first predetermined period may be from 10:00 a.m. to 10:05 a.m., and the next predetermined period (second predetermined period) may be from 10:05 a.m. to 10:10 a.m. . However, the present invention is not limited to such an example, and the predetermined period may be any length period.

The effective number of posts is a value obtained by multiplying the number of posts posted by a user by the user's contribution index. For example, if user A posts three times within the first predetermined period, and user A's contribution index is 1.5, the effective number of posts is 4.5. Furthermore, if user A posts four times within the second predetermined period, the effective number of posts will be 6.0. Similarly, if user B makes one post within the first predetermined period and the contribution index of user B is 0.8, the effective number of posts will be 0.8. Furthermore, if user B posts twice within the second predetermined period, the effective number of posts will be 1.6. Similarly, if there are other users C and D who have posted regarding the presence or absence of a disorder within the predetermined period, the user The effective number of posts is calculated by multiplying the number of posts posted by users C and D by the contribution index of users C and D.

Next, in step S203, an integrated value is calculated by integrating the effective number of posts by a plurality of users. For example, if the effective number of posts by users A to D during the first predetermined period above is "4.5", "0.8", "1.5", and "0.6", respectively, , the integrated value is "7.4". Similarly, the effective number of posts by users A to D during the second predetermined period above is "6.0", "1.6", "3.0", and "1.2", respectively. If there is, the integrated value will be "11.8".

Next, in step S204, it is determined whether the integrated value satisfies the first to fourth conditions.

The first condition is that the integrated value continuously increases during a predetermined period. Specifically, the first condition may be that the period during which the integrated value per unit time increases continuously exceeds a reference number of times. FIG. 8 shows a graph showing temporal changes in the integrated value and the number of posts detected using the failure detection device according to an embodiment of the present disclosure. In FIG. 8, the horizontal axis shows time, and the vertical axis shows the integrated value and the number of posts per unit time. The example shown in FIG. 8 shows an example in which a cloud service failure occurred twice in the period from 19:00 on December 15, 2021 to 9:00 on December 16, 2021. The first occurrence occurs at time t10, and the second occurrence occurs at time t20. The integrated value starts to increase at time t12, and if this increasing trend continues for a predetermined period, it is determined that the first condition is satisfied. For example, if the integrated value continues to increase until time t14, it may be determined that the first condition is satisfied. For example, the period from t12 to t14 may be 20 minutes. However, the present invention is not limited to such an example.

The second condition is that the integrated value per unit time exceeds the first threshold. For example, as shown in FIG. 8, if the integrated value per unit time exceeds the first threshold at time t13, it may be determined that the second condition is satisfied. For example, the first threshold may be 3 posts per 10 minutes. However, it is not limited to such an example.

The third condition is that the number of posts per unit time (average number of posts) exceeds the second threshold. The "number of posts per unit time" here is not limited to posts that include troublesome words, but also includes the number of posts posted to posting sites. If the number of posts that do not include the troublesome word is increasing in this way, it is presumed that some kind of abnormal condition is occurring. Counting the number of posts that do not include disability words in this way means that such posts are not counted at all, even if they do not include words (keywords) related to disabilities that have been registered in advance. This is because it is thought that the occurrence of a failure may be overlooked. For example, the second threshold may be 50 posts per 10 minutes. However, it is not limited to such an example.

The fourth condition is that the ratio of the integrated value to the number of posts exceeds the third threshold. This is because when a failure occurs, the number of posts containing the failure word is considered to increase in proportion to the total number of posts. For example, the third threshold may be 20%. However, it is not limited to such an example.

Next, in step S205, it is determined whether two or more of the first to fourth conditions are satisfied.

The failure determination unit 4 may determine that a failure has occurred in the cloud service server 300 when the integrated value satisfies a predetermined condition. For example, if two or more of the first to fourth conditions are satisfied, the failure determination unit 4 may determine that a failure has occurred in step S206.

Thereafter, the failure notification unit 5 may notify the outside (for example, the administrator of the cloud service server 300, etc.) that a failure has occurred in the cloud service server 300. For example, the failure notification unit 5 may share information from an external source such as Twitter with the workspace using Slack or the like. Alternatively, the failure notification unit 5 may notify the administrator of the cloud service server 300 of the occurrence of the failure by e-mail or the like. The failure detection device 100 according to the embodiment of the present disclosure was able to detect the occurrence of a failure 30 to 90 minutes earlier than conventional methods.

On the other hand, in step S205, if any one or none of the first to fourth conditions are satisfied, the process returns to step S201 to continue acquiring posted texts containing the trouble word.

Note that in a specific cloud service, failures may occur multiple times in a row. FIG. 8 shows an example in which a second failure occurs from time t21 to time t23, following the above-mentioned failure (first time). In other words, the first failure is resolved before the second failure occurs. Therefore, when the first failure occurs, the failure detection device 100 notifies the outside that a failure has occurred in a specific cloud service, but when the failure is resolved, it notifies the outside. It's fine. By doing so, the cloud service administrator can recognize that it is no longer necessary to deal with the first failure that has occurred.

As described above, by determining that a failure has occurred when two or more of the first to fourth conditions are satisfied, it is possible to accurately determine whether a failure has occurred. Can be done.

However, from the viewpoint of quickly detecting the occurrence of a failure, it may be determined that a failure has occurred when any one of the first to fourth conditions is satisfied.

In the example shown in FIG. 7, the presence or absence of a failure is detected based on whether the integrated value satisfies two or more of the first to fourth conditions. The presence or absence of a failure may be determined based on whether each of the first, second, and fourth conditions is satisfied individually.

That is, when based only on the first condition, the predetermined condition for determining whether a failure has occurred may be that the integrated value increases continuously in a predetermined period.

In addition, when based only on the second condition, the predetermined condition for determining whether a failure has occurred is that the average integrated value, which is the integrated value per unit time in a predetermined period, exceeds the first threshold value. good.

Further, when based only on the fourth condition, the predetermined condition for determining whether a failure has occurred may be that the ratio of the integrated value to the number of posts in a predetermined period exceeds a third threshold.

By determining whether a failure has occurred based on whether the integrated value satisfies the first, second, and fourth conditions independently, the integrated value satisfies two or more of the first to fourth conditions. The occurrence of a failure can be detected more quickly than in the case where the presence or absence of a failure is detected based on whether the conditions are met. However, the present invention is not limited to this example, and if three or all of the first to fourth conditions are satisfied, it may be determined that a failure has occurred.

Next, an example in which the failure determination unit 4 determines the presence or absence of a failure based on the cumulative value of the integrated values will be described. FIG. 9 shows temporal changes in the cumulative value of integrated values and the cumulative number of failure postings detected using the failure detection device 100 according to an embodiment of the present disclosure. The cumulative number of failure posts is the cumulative value of the number of posts that include failure words. That is, the cumulative number of failure posts is a value that does not take into account the user's contribution index, unlike the failure detection and neglect 100 according to the embodiment of the present disclosure. On the other hand, the cumulative value of the integrated value is a cumulative value of the integrated value, which is a value that takes into account the user's contribution index using the fault detection and neglect 100 according to the embodiment of the present disclosure.

As shown in FIG. 9, it is assumed that a failure occurs in a specific cloud service at time t30. In this case, the period up to time t30 is a period in which no failure occurs (when no failure occurs), and the period after time t30 is a failure period (when failure occurs). Both the cumulative value of the integrated value and the cumulative number of failure posts increase after time t30 when the failure occurs.

Here, the predetermined condition for the fault determination unit 4 to judge the presence or absence of a fault may be that the cumulative value of the integrated values in a predetermined period exceeds a predetermined reference value. Then, as can be seen from FIG. 9, the time when the accumulated value exceeds the predetermined reference value is t31, whereas the time when the cumulative number of failure posts exceeds the predetermined reference value is at time t32, which is later than t31. be. That is, according to the failure detection and neglect 100 according to the embodiment of the present disclosure, the cumulative value of the integrated value exceeds the predetermined reference value at an earlier time than the conventional cumulative number of failure postings, and the occurrence of the failure is prevented from occurring as before. It can be seen that it can be detected faster.

(Machine learning model generation and estimation of possibility of failure)
In the failure detection device according to the embodiment of the present disclosure, the possibility of failure occurrence may be estimated from the content of the posted text using machine learning. The failure detection device according to the embodiment of the present disclosure acquires a posted message including a message related to a failure from the posted message acquisition unit 2 as an input parameter, inputs it to the learning model, and converts the posted message to a posted message related to the occurrence of a failure. The learning unit 7 may further include a learning unit 7 (see FIG. 2) that outputs the possibility that . Here, the learning model is a post that includes text related to a failure, a post that was posted when a failure occurred, and a post that was posted when a failure did not occur as input parameters for learning, and a post that was posted when a failure occurred. The learning model may be generated by machine learning using an input/output data set in which the learning output parameter is the determination result of whether or not the data is relevant.

FIG. 10 shows a procedure for creating a learning model using posted messages posted during failure and non-failure times. As shown in Figure 5, there is a high possibility that posts containing fault words posted during the period of faults I to III are posts notifying the occurrence of a fault, and posts containing fault words posted during periods when no fault has occurred are likely to be posts that notify the occurrence of a fault. It can be said that there is a high possibility that posts containing such information are not posts notifying the occurrence of a failure. For example, a post such as ``Isn't AWS down?'' posted when a failure occurs is a post that notifies the failure, while a post such as ``I failed my AWS qualification'' that is posted when there is no failure is a post that notifies the occurrence of a failure. It is possible to input learning data and create a learning model.

Specifically, first, words are normalized, including unifying the character types of posted sentences and replacing numbers. For example, "AWS" and "AZURE" are replaced with "cloud." Next, morphological analysis is performed using Mecab. For example, a post such as ``There may be a problem with AWS'' is broken down into ``cloud,'' ``in,'' ``failure,'' ``occurrence,'' ``do,'' ``there,'' and ``might.'' After performing the above preprocessing, we used Facebook (registered trademark) fastText to analyze 400 posts posted during failure and non-failure times, and the results were classified with a correct answer rate of 88%. I was able to do that.

For example, using the created learning model, the probability that a post posted by user A such as "I guess there is a problem with AWS..." is a notification of a problem (probability of problem) is 95%. be done. In this case, the cumulative value is calculated using a value obtained by multiplying the number of posts by user A's contribution index, assuming that the posts are notifications of the occurrence of a failure.

On the other hand, for example, using the created learning model, there is a 15% chance that a post posted by user B such as ``I thought it was an AWS problem, but it seems normal'' is notifying that a failure has occurred (probability of failure). It is calculated as follows. In this case, the post by user B may not be counted as it is not a post that notifies the occurrence of a failure.

As a result of classifying faulty words using machine learning as described above, the precision rate increased by more than 20% compared to the case without machine learning, and the correct answer rate indicates that a fault has occurred. could be improved from 90 to 98%. In this way, according to an embodiment of the present disclosure, the accuracy of failure detection can be improved.

A computer program that causes a computer to realize the functions of each part of the processor (not shown) of the failure detection device 100 according to an embodiment of the present disclosure described above is provided in a form stored in a computer-readable recording medium. It's fine. The computer readable recording medium may be, for example, a magnetic recording medium, an optical recording medium, or a semiconductor memory.

1 Contribution index setting unit 2 Posted text acquisition unit 3 Calculation unit 4 Failure determination unit 5 Failure notification unit 6 Storage unit 7 Learning unit 100 Failure detection device 200 Posting site server 300 Cloud service server 400 Terminal 500 Internet service 1000 Failure detection system

Claims (12)

A contribution index setting unit that sets a contribution index for each user, which is an index representing the degree of contribution to providing failure information, based on the content of posts posted by the user in the past regarding the presence or absence of communication failures in the target Internet service. and,
a posted message acquisition unit that obtains a posted message including a predetermined wording for determining whether there is a problem with the Internet service from among a plurality of posted messages on the posting site;
Regarding the posted texts acquired by the posted text acquisition unit within a predetermined period, for each user, calculate the effective number of posts by multiplying the number of posted texts posted by the user by the contribution index of the user, and a calculation unit that calculates an integrated value of the effective number of posts by users;
a failure determination unit that determines that a failure has occurred in the Internet service when the integrated value satisfies a predetermined condition;
a failure notification unit that notifies an external party that a failure has occurred in the Internet service;
A failure detection device characterized by having: 2. The contribution index setting unit adds points to the contribution index when a post is made to notify the occurrence of a failure regarding a failure that occurred in the past. Detection device. 3. The contribution index setting unit sets the number of points to be added to the contribution index to a larger value as the time from the occurrence of a failure to posting is shorter with respect to failures that have occurred in the past. failure detection device. 2. The contribution index setting unit subtracts points from the contribution index when a post is made to notify the occurrence of a failure when no failure has occurred in the past. The failure detection device described in . The failure detection device according to claim 1 or 2, wherein the predetermined condition is that the cumulative value of the integrated values in the predetermined period exceeds a predetermined reference value. The predetermined conditions are:
a first condition that the integrated value increases continuously in the predetermined period;
a second condition in which the average integrated value, which is the integrated value per unit time in the predetermined period, exceeds a first threshold;
a third condition in which the average number of posts, which is the number of posts per unit time in the predetermined period, exceeds a second threshold; and
The failure detection according to claim 1 or 2, wherein at least two or more of a fourth condition in which the ratio of the integrated value to the number of posts in the predetermined period exceeds a third threshold value is satisfied. Device. The failure detection device according to claim 1 or 2, wherein the predetermined condition is that the integrated value continuously increases during the predetermined period. 3. The failure detection device according to claim 1, wherein the predetermined condition is that an average integrated value that is an integrated value per unit time in the predetermined period exceeds a first threshold value. 3. The failure detection device according to claim 1, wherein the predetermined condition is that a ratio of the integrated value to the number of posts in the predetermined period exceeds a third threshold. A learning unit that acquires a posted text including a phrase related to a disorder from the posted text acquisition unit as an input parameter, inputs it into a learning model, and outputs the possibility that the posted text is a posted text related to the occurrence of a disorder as an output parameter. Furthermore,
The learning model uses posted texts that include text related to a failure, posts posted when a fault occurs, and posted texts posted when a fault does not occur, as learning input parameters, and the posted texts are related to the occurrence of a fault. It is a learning model generated by machine learning using an input/output dataset with the learning output parameter as the determination result of whether or not it is a certain object.
The failure detection device according to claim 1 or 2. The contribution index setting unit sets a contribution index for each user, which is an index representing the degree of contribution to providing failure information, based on the content of posts posted by users in the past regarding the presence or absence of communication failures in the target Internet service. Set,
a posted text acquisition unit obtains a posted text that includes a predetermined wording for determining the presence or absence of a failure with respect to the Internet service from among posted texts on the posting site;
The calculation unit calculates, for each user, the effective number of posts by multiplying the number of posts posted by the user by the contribution index of the user, with respect to the posted texts acquired by the posted text acquisition unit within a predetermined period. , and calculate the cumulative value of the effective number of posts by multiple users,
a failure determination unit determines that a failure has occurred in the Internet service when the integrated value satisfies a predetermined condition;
a failure notification unit notifies an external party that a failure has occurred in the Internet service;
A fault detection method characterized by: to the computer,
a step of setting a contribution index for each user, which is an index representing the degree of contribution to providing failure information, based on the content of posts posted by the user in the past regarding the presence or absence of communication failures of the target Internet service;
retrieving a post containing a predetermined wording for determining the presence or absence of a failure with respect to the Internet service from among the posts on the posting site;
Regarding posted texts obtained within a predetermined period, for each user, calculate the effective number of posts by multiplying the number of posts posted by the user by the contribution index of the user, and calculate the effective number of posts by multiple users. a step of calculating an integrated value by integrating the
determining that a failure has occurred in the Internet service if the integrated value satisfies a predetermined condition;
a step of notifying an external party that a failure has occurred in the Internet service;
A fault detection program characterized by causing the execution of.

Images