JP7720005B2 - Anomaly location estimation device, anomaly location estimation method, and program - Google Patents

Description

The present invention relates to a technology for estimating abnormal locations in a communication network from logs collected from the communication network.

For telecommunications carriers, it is important to understand the status of anomalies and respond quickly to any abnormalities that occur within their communications networks. In this context, research is being conducted into early detection of anomalies within communications networks and estimating the location of anomalies.

As a method for estimating the location of an anomaly, a method has been proposed that uses a Bayesian network to model (called a causal model) the relationship between the anomaly location and the changes in data (called observed data) within the communication network that are caused by it, and then estimate the location of the anomaly from the observed data at the time of the anomaly (Non-Patent Document 1).

The communication network is operated using Interior Gateway Protocol (IGP) communication protocols, such as iBGP (https://datatracker.ietf.org/doc/html/rfc4271) and OSPF (https://datatracker.ietf.org/doc/html/rfc5340), which handle routing within autonomous systems (AS).When communication between routers is disabled, a syslog is generated indicating that communication with the opposing router is no longer possible.In the event of an abnormality, expert operators can use the syslog regarding link downs generated by the router to determine whether the router is operating normally or abnormally.

In conventional technology, based on the knowledge of expert operators and the assumption that a router abnormality only affects the observation data of the router in an abnormal state and the observation data of adjacent routers, a causal model is constructed for devices within a communication network, consisting of device nodes that represent the status of each device and observation nodes that indicate whether a syslog related to a link down has been generated from that device, and the location of the abnormality is determined.

Srikanth Kandula, Dina Katabi, and Jean-philippe Vasseur. Shrink: A tool for failure diagnosis in IP networks. Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data, pages 173-178, 2005.

In conventional technology, causal models were created based on the assumption that router abnormalities only affect the observation data of the router in an abnormal state and the observation data of adjacent routers.However, in the case of an abnormality in a communication network, it is not necessarily the case that a router in an abnormal state will be able to generate a syslog indicating a link down.

For example, if a CPU chip fails, the router where the failure occurred will no longer be able to process programs and will therefore no longer be able to generate a syslog. Therefore, with conventional technology, the input (observed data) to the causal model may contradict the assumption (a syslog related to a link down will be generated from an adjacent router, but no syslog will be generated from the abnormal router), resulting in a problem of reduced accuracy in estimating the location of the abnormality.

The present invention has been made in consideration of the above points, and aims to improve the accuracy of estimating abnormal locations in a technology that uses logs collected from a communication network to estimate abnormal locations in the communication network.

According to the disclosed technology, there is provided an anomaly location estimation device that estimates an anomaly location in a communication network having a plurality of devices, the anomaly location estimation device comprising:
an observation data collection unit that collects logs generated from the second device indicating that communication with the first device has become impossible;
An anomaly location estimation device is provided, comprising: a causal model inference unit that determines an input value to an observation node corresponding to the first device based on the log in a causal model consisting of device nodes that represent the state of each device and observation nodes that represent the observation results of each device, and estimates an anomaly location from a causal model to which the determined input value is applied.

The disclosed technology makes it possible to improve the accuracy of estimating abnormal locations in a communication network by using logs collected from the communication network.

FIG. 1 is a configuration diagram of an abnormality location estimation device. FIG. 2 illustrates an example of a hardware configuration of the apparatus. FIG. 1 is a diagram illustrating an example of the configuration of a communication network. FIG. 1 is a diagram illustrating a causal model. FIG. 1 illustrates inputs to a causal model. FIG. 1 illustrates inputs to a causal model.

The following describes an embodiment of the present invention (the present embodiment) with reference to the drawings. The embodiment described below is merely an example, and the embodiments to which the present invention can be applied are not limited to the following embodiment.

(Device configuration example)
1 shows an example of the configuration of an abnormality location estimation device 100 according to this embodiment. As shown in Fig. 1, the abnormality location estimation device 100 includes a causal model construction engine 110, a causal model inference engine 120, an observation data collection engine 130, an observation data DB 140, and an output interface 150.

The causal model construction engine 110, the causal model inference engine 120, and the observation data collection engine 130 may also be referred to as the causal model construction unit 110, the causal model inference unit 120, and the observation data collection unit 130, respectively. The causal model construction engine 110, the causal model inference engine 120, and the observation data collection engine 130 may also be referred to as the causal model construction circuit 110, the causal model inference circuit 120, and the observation data collection circuit 130, respectively. The operation of the anomaly location estimation device 100 is outlined below.

The observation data collection engine 130 collects observation data (such as logs generated by devices) from the communication network and stores the occurrence of link-down related logs in the observation data DB 140. Hereinafter, in this embodiment, syslog will be used as an example of a log.

The causal model construction engine 110 takes expert knowledge and other information as input and constructs a causal model based on communication network information acquired from the observation data collection engine 130. The causal model inference engine 120 determines the value of the observation node based on the occurrence status of syslogs related to link downs stored in the observation data DB 140, estimates the location of the anomaly, and outputs the estimated result of the anomaly location to the output interface 150.

The output interface 150 displays to the user the location of an anomaly in the communication network and the maximum a posteriori probability at that time. In addition, when a new machine is added to the operational system, the output interface 150 can add a node to the causal graph and also allow the user to correct any changes in the causal relationships that result from this.

(Example of hardware configuration)
The anomaly location estimation device 100 can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

In other words, the anomaly location estimation device 100 can be realized by using hardware resources such as a CPU and memory built into a computer to execute a program corresponding to the processing performed by the anomaly location estimation device 100. The program can be recorded on a computer-readable recording medium (such as portable memory) and saved or distributed. The program can also be provided via a network such as the Internet or email.

Figure 2 is a diagram showing an example of the hardware configuration of the computer. The computer in Figure 2 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are interconnected by a bus BS.

The program that realizes processing on the computer is provided by a recording medium 1001, such as a CD-ROM or memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001; it may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

When an instruction to start a program is received, the memory device 1003 reads and stores the program from the auxiliary storage device 1002. The CPU 1004 realizes functions related to the anomaly location estimation device 100 in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like according to the program. The input device 1007 is composed of a keyboard, mouse, buttons, touch panel, or the like, and is used to input various operational instructions. The output device 1008 outputs the results of calculations.

(Example of operation)
The operation of the anomaly location estimation device 100 will be described below using a more specific example. Note that, although a communication network configured with routers is shown in this embodiment, this is merely an example. The present invention is applicable regardless of the type of nodes that configure the communication network.

<About the causal model>
3 shows an example of a communication network from which the observation data collection engine 130 collects observation data. As shown in FIG. 3, this communication network is a network in which routers 1 to 6 are connected as shown. For example, routers 1 and 2 are directly connected and are adjacent to each other. Routers 1 and 4 are not directly connected and are not adjacent to each other.

The causal model construction engine 110 constructs the causal model shown in Figure 4 for the communication network shown in Figure 3 based on the knowledge of an expert operator, etc. The causal model consists of device nodes that represent the status of each device (router) within the communication network, and observation nodes that represent whether a syslog related to a link down has occurred from that device. In other words, the observation nodes represent the observation results of each device. The causal model may also be called a Bayesian network.

The causal model for the communication network in Figure 3 is as shown in Figure 4. For example, in the causal model in Figure 4, Router 1, an equipment node, is connected to Routers 1 and 2, which are observation nodes. This indicates that if an abnormality occurs in Router 1, it may affect the observation data of Router 1 and the observation data of Router 2.

Also, for example, in the causal model of Figure 4, Router 2, an equipment node, is connected to Routers 1, 2, 3, and 6, which are observation nodes. This indicates that if an abnormality occurs in Router 2, it may affect the observation data of Routers 1, 2, 3, and 6.

<Input to the causal model>
In this embodiment, the accuracy of estimating anomaly locations is improved by defining the input to the observation node of the causal model in consideration of the contents of the syslog generated by the IGP protocol. The details are as follows.

In this embodiment, the IGP protocols iBGP and OSPF are used as examples, but the technology can be applied to other protocols as well. Furthermore, while the syslog generated by iBGP and OSPF is used as an example in this embodiment, in monitoring communication networks, messages and the like may be normalized based on the generated syslog to generate a new log and notify the operator, or a tool such as ping may be used to perform alive monitoring, and the results may be notified to the operator as an alarm. In such cases, the technology of the present invention can be applied to alarms as long as the message contains information about the opposing router (the other router adjacent to a given router).

First, let's explain the syslog for iBGP and OSPF. In iBGP and OSPF, a syslog is generated when a router cannot communicate with an adjacent router due to an abnormality in the communication network. An example of a syslog message is shown below.

2021-12-21 13:00:00 Router1 192.168.10.1 OSPF neighbor down (Router2 192.168.10.2)
Although the syslog differs depending on the iBGP/OSPF version and the alarms generated by processing the iBGP/OSPF syslog, as described above, it contains a timestamp, host name, host information (IP address, etc.), information about the opposing router that has lost communication (host name and IP address of the opposing router, etc.), etc.

In this embodiment, the problem is solved by defining the value of the observation node based on information from the opposing router.

Here, the device node in the causal model of the system (communication network) that is the target of anomaly location estimation is denoted by x _i , and the observation node is denoted by y _i , where iε(1, . . . N), where N is the number of devices.

Each x _i takes on a value of 0 (normal state) or 1 (abnormal state). Note that instead of the two values of 0 and 1, it is possible for it to take on three or more values, in which case the minimum value is the normal state, the maximum value is the abnormal state, and the value c between them is defined as a value that means that the abnormality occurs at the rate of "c/(maximum value - minimum value)".

Each _yi takes on a value of 0 or 1, and if a BGP/OSPF syslog indicating that communication with the i-th router has been lost occurs at a router other than the i-th router, _yi is set to 1, otherwise it is set to 0. Note that instead of the binary values of 0 and 1, it is also possible for yi to take on three or more values, in which case the value is defined as the number of syslog occurrences at other nodes related to link-down of the i-th router.

The input values to the above causal model are determined (calculated) by the causal model inference engine 120 from the syslog read from the observation data DB 140. Alternatively, the observation data collection engine 130 may determine the input values from the collected syslog and store them in the observation data DB 140. In this case, the causal model inference engine 120 can use the value read from the observation data DB 140 as the value of _yi as is.

The differences between the conventional technology (Non-Patent Document 1) and the technology of the present invention regarding input to the causal model are explained using Figures 5 and 6. Here, we will explain the input to the observation node when a syslog occurs in routers 1, 3, and 6 indicating that communication with the opposing router (router 2) is not possible. In the observation nodes of Figures 5 and 6, shaded nodes indicate a value of 1 (abnormal state), and unshaded nodes indicate a value of 0 (normal state).

Figure 5 shows the input to the causal model in the prior art. As shown in Figure 5, the input value as the observation node for routers 1, 3, and 6, which observed the syslog, is 1, and the input value as the observation node for router 2, which is considered to have a high probability of an abnormality, is 0.

Figure 6 shows the input to the causal model in the technology of the present invention. As shown in Figure 6, the input value as the observation node for routers 1, 3, and 6, which observed the syslog, is 0, and the input value as the observation node for router 2, which is considered to have a high probability of an abnormality having occurred, is 1. In this way, it is possible to obtain input values that match the event that is likely to have actually occurred, thereby improving estimation accuracy.

<Inference using causal models>
The inference itself using a causal model is the same as that in the prior art (for example, Non-Patent Document 1), and inference is performed by specifying the prior probability P(x _i ) and the conditional probability P(y _j |x _i ). An overview of the inference process using a causal model will be explained below.

The causal model shown in Figure 4 (information indicating which nodes are connected by edges) is created by the causal model construction engine 110 based on information obtained from the communication network and passed to the causal model inference engine 120. Note that the causal model (information indicating which nodes are connected by edges) may be created in advance and stored in a storage unit (memory, etc.) provided in the causal model inference engine 120.

The prior probability P(x _i ) is determined in advance and stored in, for example, a storage unit (memory or the like) provided in the causal model inference engine 120 .

Here, let X = ( _xi , _x2 , ..., _xN ), _xiε {0,1}, and Y = ( _yi , _y2 , ..., _yN ), _yiε {0,1}. X is a device node, i.e., an estimation target, and Y is an observation node, i.e., a value of an observation result obtained based on a log.

The causal model estimation engine 120 uses the observation results (input value Y to the causal model) to find X' shown in the following equation. In the equation below, argmax is the argmax for X, and X' is X that maximizes the posterior probability P(X|Y).

X'=argmaxP(X|Y)=argmax(P(Y|X)P(X))
Regarding the calculation of the conditional probability P(y _j |X), any method may be used as long as it can calculate, for example, that if the states of all device nodes connected to observation node y _j are normal, the probability that _observation node y _j will be 0 (normal) is approximately 1, and if the states of only some device nodes among all device nodes connected to observation node y _{j are normal, the probability that observation node y j} will be 0 (normal) will be a value that depends on the number of normal device nodes among all device nodes.

Regarding the estimation results obtained by the causal model estimation engine 120, the output interface 150 may output the equipment with a value of 1 as the estimated fault location, or may output the link between the equipment with a value of 1 and the opposing equipment connected to that equipment as the estimated fault location.

(About the effects)
As described above, the input value (value of y _i ) of the observation node of router i is determined based on a log generated in another router indicating that communication with that router i is not possible. Therefore, even if the i-th router goes into an abnormal state and is unable to generate a syslog related to link down, it is possible to estimate the location of the abnormality based on information from the opposing router that is in a normal state, thereby improving the accuracy of estimating the location of the abnormality.

(Additional Note)
The following additional clauses are disclosed in relation to the above-described embodiment.
(Additional note 1)
An anomaly location estimation device that estimates an anomaly location in a communication network having a plurality of devices,
Memory and
at least one processor coupled to said memory;
Including,
The processor:
collecting a log generated from the second device indicating that communication with the first device has been lost;
an anomaly location estimation device that, in a causal model consisting of an equipment node that represents the state of each equipment and an observation node that represents the observation result of each equipment, determines an input value to an observation node that corresponds to the first equipment based on the log, and estimates an anomaly location from the causal model to which the determined input value is applied.
(Additional note 2)
The anomaly location estimation device according to supplementary item 1, wherein the processor determines a value indicating an anomaly as an input value to an observation node corresponding to the first device.
(Additional note 3)
An anomaly location estimation method executed by a computer used as an anomaly location estimation device that estimates an anomaly location in a communication network having a plurality of devices, comprising:
collecting a log generated from the second device indicating that communication with the first device has been lost;
An anomaly location estimation method, in which, in a causal model consisting of device nodes representing the state of each device and observation nodes representing the observation results of each device, an input value to an observation node corresponding to the first device is determined based on the log, and an anomaly location is estimated from the causal model to which the determined input value is applied.
(Additional note 4)
A non-transitory storage medium storing a program for causing a computer to execute each process in the abnormality location estimation device according to appended item 1 or 2.

The present embodiment has been described above, but the present invention is not limited to such a specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention as described in the claims.

100 Abnormality location estimation device 110 Causal model construction engine 120 Causal model inference engine 130 Observation data collection engine 140 Observation data DB
150 Output interface 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU
1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims (4)

An anomaly location estimation device that estimates an anomaly location in a communication network having a plurality of devices,
an observation data collection unit that collects logs generated from the second device indicating that communication with the first device has become impossible;
an anomaly location inference device comprising: a causal model inference unit that determines an input value to an observation node corresponding to the first device based on the log in a causal model consisting of device nodes that represent the state of each device and observation nodes that represent the observation results of each device, and infers an anomaly location from a causal model to which the determined input value is applied. The anomaly location estimating device according to claim 1 , wherein the causal model inference unit determines a value indicating an anomaly as an input value to an observation node corresponding to the first device. An anomaly location estimation method executed by a computer used as an anomaly location estimation device that estimates an anomaly location in a communication network having a plurality of devices, comprising:
collecting a log generated from the second device indicating that communication with the first device has been lost;
An anomaly location estimation method, in which, in a causal model consisting of device nodes representing the state of each device and observation nodes representing the observation results of each device, an input value to an observation node corresponding to the first device is determined based on the log, and an anomaly location is estimated from the causal model to which the determined input value is applied. A program for causing a computer to function as each part of the abnormality location estimation device described in claim 1 or 2.