KR20190099710A - System and method for handling network failure - Google Patents

Abstract

The present invention relates to a network failure handling system. According to the present invention, the network failure handling system comprises: a data generation unit which generates a context vector by applying a vectorization algorithm on context information of system log (Syslog) information of network devices, generates a word vector by applying the vectorization algorithm on failure report information for a network including the network devices, and generates training data including the context vector, the word vector, and failure occurrence information of the network devices; and a failure prediction unit for training a failure prediction model with the training data, and determining system log information and failure report information related to a network failure using the failure prediction model.

Description

SYSTEM AND METHOD FOR HANDLING NETWORK FAILURE}

The present invention relates to a technique for dealing with a failure occurring in a network using system log information and failure report information.

When a failure occurs in the network equipment constituting the network, a failure alert is generated to solve the problem. However, not all operation personnel are required to enter the operation site in all situations where a failure alarm has occurred, and even if the operation personnel are dispatched because it is determined that the operation needs to be dispatched, the network device is dispatched to the site with insufficient information on the failure. There is a problem that it is difficult to efficiently handle the disorder because it must look directly to determine the cause of the disorder.

To solve this problem, existing patents use system log information received from network devices, but the following limitations exist. Specifically, in the case of Korean Patent Nos. 10-02466060 and 10-0908131, system logs are collected, classified, and analyzed from a network device to detect or predict a failure. However, since the method relies on statistical numerical analysis based on rules defined by experts, there is a limit in that preemptive measures can be taken only for obstacles that can be identified in advance. Therefore, it is difficult to identify in advance various causes of network failures such as HW failure and SW malfunction, and prevent preemptive measures and prevention.

On the contrary, in case of Korean Patent Publication No. 10-2015-0097351, the collected fault information is analyzed to generate a fault event and propose a countermeasure. However, since the method relies only on analysis of previously collected failure information, there is a limitation in that it is possible to propose an action method to the operating personnel only for the previously occurring failure.

The problem to be solved by the present invention is to learn the system log information received from the network equipment, failure occurrence information, failure report information and action information collected from the customer in the event of a failure, through the system log information received from the network equipment during network operation It provides a system and method that detects signs of a failure and supports decision-making so that operational personnel can take proactive action in the event of a failure.

Network failure processing system according to an embodiment of the present invention generates a context vector by applying a vectorization algorithm to the context information of the system log (Syslog) information of the network equipment, and to the failure notification information for the network including the network equipment Applying a vectorization algorithm to generate a word vector, a data generator for generating training data including failure occurrence information of the context vector, the word vector, and the network equipment, and learning a failure prediction model with the training data, The failure prediction unit may be configured to determine system log information and failure report information related to a network failure by using the failure prediction model.

The data generator determines failure occurrence information of the network devices based on response messages received from each network device.

The failure prediction unit re-learns the failure prediction model using the context vector of the system log information received after the failure prediction model has been learned and the word vector of the failure report information, and the context vector and the word vector generated as a result of re-learning. The system log information and failure report information related to the network failure are determined by using element values of.

The network failure processing system according to an embodiment of the present invention further includes an action method recommendation unit for learning the action method recommendation model using the determined system log information, the failure report information, and the action information as training data.

The action method recommendation unit determines the one or more actions on the system log information and the failure report information by inputting the system log information and the failure report information received after the action method recommendation model has been learned into the action method recommendation model. do.

According to the present invention, it is possible to solve a problem that can be predicted only for a previously generated disorder simply in a method that relies on statistical numerical analysis.

In addition, according to the present invention, it is possible to propose a preemptive action method for the network equipment highly associated with the failure to the operating personnel, it is possible to efficiently handle the failure.

In addition, according to the present invention, it is possible to continuously receive the system log information, failure report information, failure information and action information to update the learning model to ensure the safety of the system.

In addition, according to the present invention, failure classification and prediction are performed using the failure report information collected from the customer, so that service quality can be maintained.

1 is a diagram illustrating an environment in which a network failure processing system according to an embodiment of the present invention is implemented.
2 is a structural diagram of a network failure processing system 200 according to an embodiment of the present invention.
3 is a diagram illustrating an exemplary context vector and word vector generated by a data generator according to an exemplary embodiment of the present invention.
FIG. 4 is a diagram illustrating a method of determining a system log and failure report information that is highly related to a network failure by using a failure prediction unit according to an embodiment of the present invention.
5 is a diagram illustrating a context vector and a word vector generated as a result of re-learning by the disability predicting unit according to an embodiment of the present invention.
6 is a view for explaining a method for the action method recommendation unit generates an action method recommendation model and recommends an action method according to an embodiment of the present invention.
7 is a diagram illustrating a method for recommending a method for dealing with a network failure by a network failure processing system according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. In addition, the terms “… unit”, “… unit”, “module”, etc. described in the specification mean a unit that processes at least one function or operation, which may be implemented by hardware or software or a combination of hardware and software. have.

1 is a diagram illustrating an environment in which a network failure processing system according to an embodiment of the present invention is implemented.

Referring to FIG. 1, the network 100 includes a plurality of network devices 110 to 113, and each of the plurality of network devices 110 to 113 transmits system log information to the network failure processing system 200. do.

The plurality of network devices 110 to 113 may be network devices supporting Syslog, and the type and type of the device are not limited. For example, the plurality of network devices 110 to 113 may be routers, gateways, switches, or hubs constituting the network 100.

The network failure processing system 200 may include a network 100 as training data including system log information received from a plurality of network devices 110 through 113, failure occurrence information, failure report information and action information collected from a customer when a failure occurs. Train the predictive model of

The network failure processing system 200 determines system log information and failure report information highly related to a network failure by using a failure prediction model.

In addition, the network failure processing system 200 learns an action method recommendation model using the determined system log information, failure report information, and action information as training data, and provides information supporting decision making using the learned action method recommendation model. Provide to the operating personnel.

2 is a structural diagram of a network failure processing system 200 according to an embodiment of the present invention, and FIG. 3 is a diagram illustrating an exemplary context vector and a word vector generated by a data generator according to an embodiment of the present invention. 4 is a diagram for describing a method of determining a system log and failure report information that is highly related to a network failure by using a failure prediction unit according to an embodiment of the present invention, and FIG. 5 illustrates an embodiment of the present invention. FIG. 6 is a diagram illustrating a context vector and a word vector generated as a result of re-learning by the failure predicting unit according to an example. It is a figure explaining the method of recommending a method.

Referring to FIG. 2, the network failure processing system 200 includes a data generator 210, a failure predictor 220, and an action method recommender 230.

The data generator 210 may include a context vector of system log information received from the network devices 110 to 130 constituting the network 100, a word vector of the failure notification information for the network 100, and the network devices 110. To 130) to generate training data including failure occurrence information. In this case, failure occurrence information of the corresponding vector is mapped to the context vector and the word vector for supervised learning.

Specifically, the data generator 210 extracts the context information of the system log information so that the deep learning model can learn the system log information received from the network devices 110 to 130, and extracts the extracted context information. Represents as a context vector using a vectorization algorithm.

Here, the context vector refers to a vector representing context information of system log information.

The data generator 210 may vectorize the context information of the system log information received from the network device by using a vectorization algorithm based on Word2Vector or Glove. For example, referring to FIG. 3, the data generator 210 has a three-dimensional vector in each of context information “Timestamp”, “IP”, “Hostname”, “Summary” and “Description” extracted from system log information. Can be assigned to create a context vector.

In this case, the generated context vector includes sequence information of system log information.

Thereafter, the data generator 210 determines the failure occurrence information and maps the determined failure occurrence information to the context vector of the system log information.

In detail, the data generator 210 transmits a response request message to the network devices 110 to 130 at predetermined time intervals, and provides failure occurrence information of the network devices 110 to 130 according to whether the response message is received. And map it with the context vector of the network device.

When the data generator 210 receives a response message from the network devices 110 to 130 for a specific time, the data generator 210 may determine a context vector of system log information received from each of the network devices 110 to 130 at a corresponding time zone. Map "normal" fault information.

In addition, the data generator 210 is a context vector of the system log information received from the network device "normal" failure occurrence information when the response of the actual operating personnel is not performed even if the response message from the specific network equipment is not received Map with.

On the contrary, the data generation unit 210 further maps "abnormal" failure occurrence information and action information indicating an action method performed by the actual operation agent when the action of the actual operation agent is performed. In this case, the data generator 210 may receive the corresponding action information from a separate management server (not shown).

The data generator 210 may express the failure report information as a word vector so that the deep learning model may learn, and map the failure occurrence information to the word vector.

Here, the failure report information refers to the customer's opinion information on the network 100, it may be collected by the customer in various ways and stored in a separate database (not shown). The data generation unit 210 may access the failure report information by accessing the database. In addition, the word vector refers to a vector representing the failure report information using the vectorization algorithm for the failure report information.

For example, referring to FIG. 3, the data generation unit 210 may generate a word vector by assigning a three-dimensional vector to each morpheme of the failure report information "the Internet is frequently disconnected".

In addition, the data generator 210 maps "normal" failure occurrence information or "abnormal" failure occurrence information to the word vector of the failure report information in the same manner as the context vector of the system log information.

The failure prediction unit 220 generates a failure prediction model of the network 100 through a deep learning algorithm using the data generated by the data generation unit 210 as training data.

For example, the failure prediction unit 220 may use an Attention-Based Long Short-Term Memory Network (Attention-Based LSTM Network) model by using the data generated by the data generator 210 as an initial input value. Can learn. The method of generating a learning model using the ROI is a well-known technique, and thus detailed description thereof will be omitted.

The failure prediction unit 220 determines a context vector of system log information related to a network failure and a word vector of failure report information by using a failure prediction model.

For example, referring to FIG. 4, the failure predictor 220 hides the context vector of the system log information and the word vector of the failure report information received at a specific time, based on the interest-recursive neural network. A layer may be configured, and weights and relearning of layers of interest that have already been learned may be performed.

5 is a diagram illustrating a context vector and a word vector generated as a result of relearning.

Referring to FIG. 5, element values of the context vector and the word vector generated as a result of relearning indicate a degree of association with a network failure. That is, as the element values of the context vector and the word vector generated as a result of the re-learning are larger, the system log information related to the context vector and the failure report information related to the word vector mean that the network failure is highly related.

The failure prediction unit 220 determines system log information and failure report information related to a network failure by using element values of the context vector and the word vector generated as a result of the re-learning.

For example, the failure prediction unit 220 may determine the context vector and the word vector having the highest element value among the element values of the context vector and the word vector generated as a result of the re-learning, and the system log information of the context vector and the Failure report information of the word vector may be determined as system log information and failure report information related to a network failure.

In another embodiment, the failure prediction unit 220 may generate a context vector of system log information received from the network devices 110 to 130 and a word vector of failure report information received from a separate database after the failure prediction model is generated. It is input to a failure prediction model to determine whether a failure occurs in the network 100.

In this case, the failure prediction unit 220 may determine the similarity between the vectors based on the "Summary" and / or "Description" part of the context vector of the system log information that is related to the failure information. For example, the failure predictor 220 compares the context vector of the system log information when the failure occurs with the context vector of the system log information received after the failure prediction model is generated. The cosine similarity algorithm can be used to determine the similarity between vectors.

The failure prediction unit 220 may provide the determined system log information and failure report information to the operation personnel.

The action method recommendation unit 230 trains the action method recommendation model using the system log information, the failure report information, and the action information determined by the failure prediction unit 220 as training data, and uses the learned action method recommendation model to network. Determine one or more measures for the failure.

Specifically, referring to FIG. 6, the action method recommending unit 230 uses the context vector or word vector generated as a result of the re-learning and the action information received from the management server as training data, and measures the network through the deep learning algorithm. Train the method recommendation model. In this case, the action method recommendation unit 230 may learn the action method performed by the actual operation personnel included in the action information as a softmax classifier-based action method recommendation model.

In addition, the action method recommendation unit 230 determines a degree of relevance between each action method included in the action information and the context vector and word vector generated as a result of re-learning using the action method recommendation model, and each action method and Corresponding relevance may be provided to the operating personnel. In this case, the action method recommendation unit 230 may calculate the relevance of each action method through the softmax layer, and determine a higher specific number of action methods that are highly related as one or more action methods for the network failure.

7 is a diagram illustrating a method for recommending a method for dealing with a network failure by a network failure processing system according to an embodiment of the present invention.

Referring to FIG. 7, the network failure processing system 200 generates a context vector of system log information and a word vector of failure report information by using a vectorization algorithm (S100), and failure occurrence information in the generated context vector and word vector. To map (S110).

Specifically, the network failure processing system 200 extracts and extracts context information of the system log information so that a deep learning model can learn the system log information received from the network devices 110 to 130. The information is expressed as a context vector using a vectorization algorithm. In addition, the network failure processing system 200 generates a word vector of the failure report information using the vectorization algorithm for the failure report information received from the customer.

In addition, the network failure processing system 200 determines failure occurrence information through a response message received from the network devices 110 to 130 at a specific time, and the system log received at that time for training data for supervised learning. The failure occurrence information is mapped to the context vector of the information and the word vector of the failure notification information.

The network failure processing system 200 generates a failure prediction model using the context vector and the failure report information of the system log information to which the failure occurrence information is mapped (S120). In this case, the network failure processing system 200 may learn an interest-recursive neural network model.

The network failure processing system 200 determines a context vector of system log information related to a network failure and a word vector of failure report information by using a failure prediction model (S130).

Specifically, the network failure processing system 200 re-learns the failure prediction model by using the context vector of the system log information received after the failure prediction model generation or the word vector of the failure report information, and the context vector generated as a result of the re-learning. And the element value of the word vector to determine the degree of association with the network failure.

As the element values of the context vector and the word vector generated as a result of the re-learning are higher, the vector associated with the network failure is higher. It can be determined as a context vector or word vector.

The network failure processing system 200 learns an association with the determined context vector, word vector, and action information (S140).

In detail, the network failure processing system 200 uses the deep learning algorithm of the network 100 through the deep learning algorithm using the action method included in the action information mapped to the determined context vector or the word vector and the context vector or the corresponding word vector as training data. Action Create a recommendation model.

Thereafter, the network failure processing system 200 determines each action method included in the action information and the corresponding degree corresponding thereto (S150). In this case, the network failure processing system 200 may determine the relevance for each action method according to the action method recommendation model, and may provide the operation personnel with the determined action method and the relevance thereto.

According to the present invention, it is possible to solve a problem that can be predicted only for a previously generated disorder simply in a method that relies on statistical numerical analysis.

In addition, according to the present invention, it is possible to propose a preemptive action method for the network equipment highly associated with the failure to the operating personnel, it is possible to efficiently handle the failure.

In addition, according to the present invention, it is possible to continuously receive the system log information, failure report information, failure information and action information to update the learning model to ensure the safety of the system.

In addition, according to the present invention, failure classification and prediction are performed using the failure report information collected from the customer, so that service quality can be maintained.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

Claims (5)

A network fault handling system,
A context vector is generated by applying a vectorization algorithm to context information of Syslog information of network equipments, a word vector is generated by applying a vectorization algorithm to failure notification information about a network including the network equipments, and the context A data generator for generating training data including a vector, the word vector, and failure occurrence information of the network equipment;
A failure prediction unit learning a failure prediction model using the training data and determining system log information and failure report information related to a network failure using the failure prediction model.
Network failure processing system comprising a. In claim 1,
The data generation unit
Network failure processing system for determining the failure occurrence information of the network equipment based on the response message received from each network equipment. In claim 1,
The failure prediction unit
Re-learn the failure prediction model using the context vector of the system log information received after the failure prediction model has been learned and the word vector of the failure report information, and the element values of the context vector and the word vector generated as a result of the re-learning are obtained. And determining system log information and failure report information related to the network failure. In claim 3,
Action method recommending unit for learning the action method recommendation model using the determined system log information, failure report information and action information as training data
Network failure processing system further comprising. In claim 4,
The measures method recommendation part mentioned above
A network failure processing system for determining one or more measures for the system log information and the failure report information by inputting the system log information and the failure report information received after the action method recommendation model is learned into the action method recommendation model. .

Images