WO2015059896A1 - Information processing device and time-series data analysis method - Google Patents

Abstract

The present invention provides a time-series data analysis device whereby it is possible to estimate the cause of occurrence of information in time-series data even if the information does not have periodicity. The time-series data analysis device is provided with: a time-series data acquisition unit (11) which obtains time-series data; a determination rule storage unit (12) which stores a determination rule comprising targeted data identification information identifying targeted data included in the time-series data, occurrence pattern information specifying conditions for occurrence patterns for the targeted data, and cause information indicating the cause of occurrence of the targeted data; a targeted data extraction unit (13) which extracts targeted data, as identified by the targeted data identification information, from time-series data; an occurrence pattern determination unit (14) which determines whether the occurrence pattern of the extracted targeted data matches the occurrence pattern information; and a cause estimation unit (15) which estimates the cause of occurrence of the extracted targeted data on the basis of the cause information if the occurrence pattern of the extracted targeted data is determined to match the occurrence pattern information.

Description

Information processing apparatus and time series data analysis method

The present invention relates to a technique for acquiring desired information by analyzing time series data.

A technique for acquiring desired information by analyzing time series data is known.

For example, Patent Document 1 and Patent Document 2 describe a technique for detecting an abnormality of a network system based on a frequency component of traffic data.

The related technology described in Patent Document 1 collects logs output from each network device, and extracts parameters to be analyzed from the collected logs. Next, this related technique obtains a distribution on the time axis of events related to parameters to be analyzed. Next, this related technique converts the distribution into a distribution on the frequency axis. Furthermore, this related technique calculates and outputs a value representing the degree of abnormality such as an attack on the network system by performing ratio analysis or rare rate analysis on the distribution on the frequency axis.

The related technology described in Patent Document 2 acquires time-series data of the traffic of a packet having a predetermined header, and Fourier-transforms the acquired time-series data every predetermined time. And this related technique detects the abnormality of traffic based on the comparison result by comparing the pattern on the frequency axis obtained by the Fourier transform with a reference pattern prepared in advance.

Patent Document 3 describes a technique for detecting the occurrence of a system abnormality based on log information obtained from a managed computer.

The related technology described in Patent Document 3 records log information obtained from a management computer separately into detailed log information and summary log information obtained by integrating a plurality of detailed log information. Then, this related technique converts the time axis distribution of the summary log information into the frequency axis distribution, and calculates the frequency band intensity that is the sum of the intensity in the frequency band to be monitored. This related technique monitors the time change of the frequency band intensity, and detects the occurrence of an abnormality when the fluctuation of the frequency band intensity exceeds a predetermined threshold. In addition, this related technique specifies an abnormality occurrence source based on a time axis distribution of detailed log information at a time that goes back a predetermined time from the abnormality occurrence time.

Also, for example, Patent Document 4 describes a technique for estimating the encryption method and application used by analyzing traffic data.

The related technology described in Patent Document 4 classifies input traffic into subscriber traffic to be observed and teacher traffic whose encryption method and application are known and used for calibration. Extract features from the flow. And this related technique produces | generates the information for teachers for evaluation based on the feature-value extracted from the teacher traffic. This related technique estimates subscriber traffic encryption methods and applications based on subscriber traffic feature values and teacher information.

JP 2005-151289 A JP 2005-236547 A JP 2010-134862 A JP 2013-127504 A

By the way, there is a case where it is desired to estimate the appearance factor of data appearing in time series data. For example, in this case, there is a case where it is desired to estimate a factor in which certain system information is recorded in various system information logs recorded by the operation system of the information processing system.

When applied to such needs, the related techniques described in Patent Document 1 to Patent Document 4 described above have the following problems.

The related techniques described in Patent Documents 1 to 3 detect desired information based on the intensity and distribution by analyzing frequency components of time-series data. For this reason, these related techniques are not suitable for estimating a factor of information that appears in time-series data and has no periodicity. The related technique described in Patent Document 4 estimates the content (encryption scheme and application) of time-series data based on the time-series feature amount of subscriber traffic data. However, Patent Document 4 does not describe a method for estimating an information factor that appears in time-series data and has no periodicity.

The present invention has been made in order to solve the above-described problem, and provides a technique capable of estimating a factor of appearance of information even when the information appearing in time-series data has no periodicity. For the purpose.

An information processing apparatus according to an aspect of the present invention includes time-series data acquisition means for acquiring time-series data, target data specifying information for specifying target data that is target data among data constituting the time-series data, and From the time-series data, determination rule storage means for storing a determination rule consisting of appearance tendency information in which conditions regarding the appearance tendency of the target data are defined, and factor information representing the appearance factor of the target data, Target data extracting means for extracting target data specified by the target data specifying information, and appearance tendency for determining whether or not the appearance tendency of the target data extracted by the target data extracting means matches the appearance tendency information The appearance factor of the target data determined to match the appearance tendency information by the determination means and the appearance tendency determination means Including the factor estimating means for estimating, based on the factor information.

The time-series data analysis method according to one aspect of the present invention includes a target data specifying information for specifying target data that is target data among data constituting the time-series data, and the appearance of the target data. Time series data is acquired using a determination rule consisting of appearance trend information in which conditions related to the trend are defined and factor information representing the appearance factor of the target data, and the target data specifying information is obtained from the time series data. The target data identified by the above is extracted, it is determined whether the appearance tendency of the extracted target data matches the appearance tendency information, and the appearance factor of the target data determined to match the appearance tendency information is Estimate based on the factor information.

The non-transitory computer-readable recording medium according to one embodiment of the present invention includes target data specifying information for specifying target data that is target data among data constituting time-series data, and the appearance of the target data. A time-series data acquisition step for acquiring time-series data using a determination rule consisting of appearance-trend information for which conditions related to the trend are defined, and factor information representing an appearance factor of the target data; A target data extraction step for extracting target data specified by the target data specifying information, and whether or not the appearance tendency of the target data extracted in the target data extraction step matches the appearance tendency information The appearance factor of the target data determined to match the appearance tendency information is estimated based on the factor information. Recording a computer program for causing a factor estimating step, to the computer device.

The present invention can provide a technique capable of estimating the factor of appearance of information even when the information appearing in the time series data has no periodicity.

FIG. 1 is a functional block diagram of a time-series data analysis apparatus as a first embodiment of the present invention. FIG. 2 is a hardware configuration diagram of the time-series data analysis apparatus as the first embodiment of the present invention. FIG. 3 is a flowchart for explaining the operation of the time-series data analysis apparatus as the first embodiment of the present invention. FIG. 4 is a functional block diagram of the time-series data analysis apparatus as the second embodiment of the present invention. FIG. 5 is a diagram illustrating an example of time-series data according to the second embodiment of the present invention. FIG. 6 is a diagram illustrating an example of a determination rule according to the second embodiment of this invention. FIG. 7 is a diagram illustrating an example of measurement data that is a basis for determining a determination rule according to the second embodiment of the present invention. FIG. 8 is a diagram illustrating an example of other measurement data that is a basis for determining a determination rule according to the second embodiment of the present invention. FIG. 9 is a flowchart for explaining the operation of the time-series data analysis apparatus as the second embodiment of the present invention. FIG. 10 is a diagram illustrating an example of time-series data of a target period according to the second embodiment of the present invention. FIG. 11 is a functional block diagram of a time-series data analysis apparatus as the third embodiment of the present invention. FIG. 12 is a diagram illustrating an example of a determination rule according to the third embodiment of this invention. FIG. 13 is a diagram illustrating an example of measurement data that is a basis for determining a determination rule according to the third embodiment of the present invention. FIG. 14 is a flowchart for explaining the operation of the time-series data analysis apparatus as the third embodiment of the present invention. FIG. 15 is a diagram showing an example of time-series data in which information on a plurality of target systems that can be processed by the second and third embodiments of the present invention is mixed. FIG. 16 is a diagram showing an example of a storage medium as an embodiment of the storage medium of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

(First embodiment)
FIG. 1 shows a functional block configuration of a time-series data analysis apparatus (also referred to as an information processing apparatus) 1 as a first embodiment of the present invention. In FIG. 1, the time-series data analysis device 1 includes a time-series data acquisition unit 11, a determination rule storage unit 12, a target data extraction unit 13, an appearance tendency determination unit 14, and a factor estimation unit 15.

Here, the time-series data analysis device 1 can be configured by a computer device 10 as shown in FIG. The computer device 10 includes a CPU (Central Processing Unit) 1001, a RAM (Random Access Memory) 1002, a ROM (Read Only Memory) 1003, a storage device 1004 such as a hard disk, an input device 1005, and an output device 1006. Including.

In this case, the time-series data acquisition unit 11 includes an input device 1005 and a CPU 1001 that reads a computer program and various data stored in the ROM 1003 and the storage device 1004 into the RAM 1002 and executes them.

Further, the determination rule storage unit 12 includes a storage device 1004.

Further, the target data extraction unit 13 and the appearance tendency determination unit 14 are configured by a CPU 1001 that reads a computer program and various data stored in the ROM 1003 and the storage device 1004 into the RAM 1002 and executes them.

The factor estimating unit 15 includes an output device 1006 and a CPU 1001 that reads a computer program and various data stored in the ROM 1003 and the storage device 1004 into the RAM 1002 and executes them. Note that the hardware configuration of the time-series data analysis device 1 and each functional block thereof is not limited to the above-described configuration.

Next, the details of each functional block will be described.

The time series data acquisition unit 11 acquires time series data. For example, the time series data acquisition unit 11 may acquire time series data stored in the storage device 1004. The time series data acquisition unit 11 may acquire time series data from the outside via a network interface (not shown) or the like. The time-series data acquisition unit 11 may acquire time-series data indicated by the storage position input by the input device 1005.

The determination rule storage unit 12 stores a determination rule including target data specifying information, appearance tendency information, and factor information. The target data specifying information is information for specifying target data among the data constituting the time series data. The appearance tendency information is information in which conditions regarding the appearance tendency of the target data are defined. The factor information is information representing the appearance factor of the target data.

The target data extraction unit 13 extracts the target data specified by the target data specifying information included in the determination rule from the time series data.

The appearance tendency determination unit 14 determines whether the appearance tendency of the target data extracted by the target data extraction unit 13 matches the appearance tendency information included in the determination rule.

The factor estimating unit 15 estimates the appearance factor of the target data determined to match the appearance tendency information by the appearance tendency determining unit 14 based on the factor information included in the determination rule.

The operation of the time series data analysis apparatus 1 configured as described above will be described with reference to FIG.

In FIG. 3, first, the time-series data acquisition unit 11 acquires time-series data (step S1).

Next, the target data extraction unit 13 extracts target data specified by the target data specifying information of the determination rule stored in the determination rule storage unit 12 from the time-series data acquired in step S1 (step S2). .

Next, the appearance tendency determination unit 14 determines whether the appearance tendency of the target data extracted in step S2 matches the appearance tendency information of the determination rule stored in the determination rule storage unit 12 (step S3). ).

Here, when it is determined that it matches the appearance tendency information, the factor estimation unit 15 estimates the factor information included in the determination rule stored in the determination rule storage unit 12 as an appearance factor of the target data, and outputs (Step S4).

Thus, the time series data analysis apparatus 1 ends its operation.

If a plurality of determination rules are stored in the determination rule storage unit 12, the time-series data analysis device 1 may repeat the operations of steps S2 to S4 for each determination rule.

Next, the effect of the first embodiment will be described.

The time-series data analysis device as the first embodiment can estimate the appearance factor of information even when the information appearing in the time-series data has no periodicity.

The reason is that the following configuration is included. First, the determination rule storage unit includes target data specifying information for specifying target data among data constituting time-series data, appearance tendency information that defines conditions regarding the appearance tendency of target data, and appearance factors of the target data The determination rule consisting of the factor information indicating is stored. Second, the target data extraction unit extracts the target data specified by the target data specifying information from the time series data. Third, the appearance tendency determination unit determines whether or not the appearance tendency of the extracted target data matches the appearance tendency information. Fourth, the factor estimation unit identifies factor information included in the determination rule as an appearance factor of the target data determined to match the appearance tendency information.

Thereby, even if the target data appearing in the time-series data has no periodicity, the present embodiment stores in advance a determination rule that defines the appearance tendency of such target data. Therefore, it is possible to estimate the cause of the appearance of the target data.

(Second Embodiment)
Next, a second embodiment of the present invention will be described in detail with reference to the drawings. In the present embodiment, an example will be described in which the time-series data analysis device is applied to a device that estimates a user operation or application that has caused a high load in the target system. Note that in each drawing referred to in the description of the present embodiment, the same reference numerals are given to the same configuration and steps that operate in the same manner as in the first embodiment, and the detailed description in the present embodiment is omitted. To do.

First, FIG. 4 shows a functional block configuration of the time-series data analysis apparatus 2 as the second embodiment. In FIG. 4, the time-series data analysis device 2 includes a time-series data acquisition unit 21, a determination rule storage unit 22, a target data extraction unit 23, an appearance tendency determination unit 24, and a factor estimation unit 25.

Here, the time-series data analysis device 2 and its respective functional blocks are constituted by the same hardware elements as the time-series data analysis device 1 and its respective functional blocks as the first embodiment described with reference to FIG. It is configurable.

The time-series data acquisition unit 21 acquires, as time-series data, a history of data including information regarding the load on the target information processing system (hereinafter also referred to as a target system). For example, the time series data may be a log of load data collected from the target system (hereinafter also referred to as load history data).

Here, the load may be a usage rate or usage amount related to a CPU, memory, disk, network resource, or the like included in the target system. For example, in this case, the load data may include a value representing the load and a time when the load value is observed in the target system. Further, load history data including such load data may be accumulated in the storage device 1004.

Fig. 5 shows an example of load history data. In this example, the CPU usage rate is adopted as the load. In FIG. 5, each row represents load data, and includes items of date, number of seconds, and CPU usage rate. Each load data represents the CPU usage rate observed in the target system at the date and time represented by the number of seconds. In addition, the item of the number of seconds represents the number of elapsed seconds counted from 0:00 on the corresponding date. For example, 8:30 am is represented as 3600 × 8.5 = 30600 seconds.

Further, the time series data acquisition unit 21 may acquire load history data in the target period. The target period is an analysis period that is a target for estimating a user operation or application that has caused a high load. For example, the time-series data acquisition unit 21 may acquire information representing the target period via the input device 1005 or a network interface (not shown). In addition, the time-series data acquisition unit 21 may set a period of a predetermined length until that time as a target period for each predetermined timing. Then, the time-series data acquisition unit 21 may acquire a portion included in the target period from, for example, load history data stored in the storage device 1004.

The determination rule storage unit 22 includes a condition indicating a high load as target data specifying information, a condition regarding a frequency and a period as appearance tendency information, and information indicating a user operation or application as factor information. Remember. For example, the target data specifying information may be represented by a high load range (for example, a range such as a CPU usage rate). Hereinafter, load data that matches the condition indicating high load is also referred to as high load data. The high load data corresponds to an embodiment of target data in the present invention.

FIG. 6 shows an example of the determination rule. In FIG. 6, each row represents a determination rule and includes items of a load range, a cycle, a frequency, and an application / operation. The “load range” represents a range of the CPU usage rate and corresponds to target data specifying information. “Frequency” represents how many times every second appears, and corresponds to a condition regarding frequency (appearance tendency information). Further, “period” indicates the presence / absence of periodicity and the number of seconds of the period when there is periodicity, and corresponds to a condition related to the period (appearance tendency information). “Application / operation” corresponds to factor information. The item “number” is a number assigned for the purpose of explanation. Hereinafter, the determination rule to which the number “X” is assigned is also referred to as determination rule X.

For example, the determination rule 1 includes a load (CPU usage rate) range “40% or more”, a frequency condition “at least once every 180 seconds”, a period condition “no periodicity”, and an application / operation “ Web browsing ". In other words, the determination rule 1 is “if the frequency at which the CPU usage rate rises to 40% or more is once or more in 180 seconds and there is no periodicity at the time when the CPU usage rate of 40% or more is observed, It shows a rule for “determining that web browsing by a user is being performed”.

Here, an increase in load due to web browsing is considered to be caused by a significant rewriting of the screen due to movement of the site, etc., but the timing depends on the user's operation. Since the user's operation does not have a constant interval as in mechanical processing, in the determination rule 1 relating to web browsing, the condition relating to the cycle is defined as “no periodicity”. This is because, when periodicity is recognized at a high load, there is a high possibility that the cause of the load increase is not web browsing by a user operation.

Further, for example, the determination rule 2 includes a load (CPU usage rate) range “20% or more”, a frequency condition “N / A (no regulation)”, a period condition “300, 600, 900”, It consists of the application / operation "Mailer's periodic mail check". In other words, the determination rule 2 is that if the time when the CPU usage rate rises to 20% or more is periodic and the period is any of 300, 600, or 900 seconds, the periodic mail by the mailer (e-mail software) It shows a rule for “determining that confirmation has been performed”.

These determination rules may be defined based on actual load data measured in advance when a user operation or application operation is occurring, which may cause a high load.

For example, FIG. 7 shows an example of CPU usage rate measurement data when web browsing is performed by the user. FIG. 8 shows an example of CPU usage rate measurement data when periodic mail confirmation by the mailer is operating. 7 and 8, the horizontal axis represents the number of seconds elapsed from 0:00 on the corresponding date, and the vertical axis represents the CPU usage rate. The CPU usage rate measurement interval (data collection interval) is 10 seconds.

For example, the determination rule 1 in FIG. 6 may be defined from the measurement data in FIG. 7 and stored in the determination rule storage unit 22 in advance. Further, for example, the determination rule 2 in FIG. 6 may be defined from the measurement data in FIG. 8 and stored in the determination rule storage unit 22 in advance.

The target data extraction unit 23 refers to the determination rule stored in the determination rule storage unit 22 and extracts high load data that matches a condition indicating high load (target data specifying information) from the load history data in the target period. For example, if the condition indicating a high load represents a load range as shown in FIG. 6, the target data extraction unit 23 determines that the load value included in the load data is within the range. What is necessary is just to extract as data.

The appearance tendency determination unit 24 refers to the determination rule to determine whether or not the appearance tendency of the high load data matches the period condition and the frequency condition.

For example, the frequency-related conditions are represented by the minimum number of appearances during a predetermined period as shown in FIG. In this case, the appearance tendency determination unit 24 can determine whether or not the frequency condition is satisfied based on the length of the target period, the load data collection interval, and the number of high load data in the target period.

Further, for example, the appearance tendency determination unit 24 may adopt the related techniques described in Patent Document 1, Patent Document 2, and Patent Document 3 for the determination processing of the condition regarding the period. For example, the appearance tendency determination unit 24 obtains the frequency components of the time-series data by regarding all the load values included in the load data other than the extracted high load data as 0 and performing a discrete Fourier transform on the load values. Is possible. Then, the appearance tendency determination unit 24 can determine the presence or absence of periodicity in the time-series data by determining the frequency region and comparing the integrated value of the frequency intensity with a threshold value. In this case, since noise is removed by considering all the values of loads other than high load data as 0, highly accurate determination is possible.

In addition, for example, the appearance tendency determination unit 24 calculates the difference in seconds between each time (seconds) of the high load data by brute force, and examines whether there is an equal difference relationship, thereby relating to the cycle. The condition may be determined. For example, if the assumed period is limited in advance to 1 minute, 5 minutes, 10 minutes, etc., such a brute force method can be implemented with a relatively small amount of calculation.

The factor estimating unit 25 estimates information representing a user operation or an application that has caused a high load in the target system. Specifically, the factor estimating unit 25 determines that the application or user operation indicated by the factor information causes the high load when the high load data extracted by the target data extracting unit 23 satisfies the condition regarding the frequency and the period. As output.

The operation of the time-series data analysis device 2 configured as described above will be described with reference to FIG. Here, it is assumed that the load history data illustrated in FIG. 5 is stored in the storage device 1004, and the determination rule illustrated in FIG. 6 is stored in the determination rule storage unit 22.

In FIG. 9, first, the time-series data acquisition unit 21 acquires information representing the target period (step S11). For example, it is assumed that the time series data acquisition unit 21 acquires information such as “from August 21, 2013 13:00 to August 21, 2013 14:00”.

Next, the time-series data acquisition unit 21 acquires load history data in the target period (step S12). For example, the time series data acquisition unit 21 may acquire a portion included in the target period from the load history data stored in the storage device 1004. Here, the load history data shown in FIG. 10 from August 1, 2013 13:00 (46800 seconds) to August 21, 2013 14:00 (50400 seconds) is acquired from the load history data shown in FIG. Suppose that

Next, the target data extraction unit 23 extracts, from the load history data acquired in step S12, high load data that matches a condition (target data specifying information) indicating a high load included in the determination rule (step S13). .

For example, the target data extraction unit 23 extracts high load data having a CPU usage rate of 40% or more from the load history data shown in FIG. 10 based on the determination rule 1 in FIG. Here, the extracted high load data (a set of the number of seconds from 0 o'clock and the CPU usage rate) is “(46840, 60.16), (46920, 41.96), (46950, 45.04), (47080, 42.28),...

Next, the appearance tendency determination unit 24 determines the condition regarding the frequency for the high load data extracted in step S13 (step S14).

For example, in the above example, load history data for one hour (3600 seconds) is acquired by the time-series data acquisition unit 21 in step S12. In the determination rule 1, the condition regarding the frequency is once or more in 180 seconds. Here, in this load history data, load data is collected once every 10 seconds. Therefore, if there are (3600/10) * (10/180) = 3600/180 = 20 or more high load data among the load history data for one hour, the condition regarding the frequency of the determination rule 1 is satisfied. become. Therefore, in this case, the appearance tendency determining unit 24 may count the number of high load data extracted in step S13 and determine whether or not it exceeds 20.

Next, the appearance tendency determination unit 24 determines the condition regarding the period for the high load data extracted in step S13 (step S15).

For example, in the determination rule 1 related to web browsing, as described above, the condition regarding the period is defined as “no periodicity”, which indicates that there should be no periodicity. Therefore, the appearance tendency determination unit 24 may determine the presence / absence of periodicity by the above-described method of performing discrete Fourier transform by regarding all values of CPU utilization other than high load data as 0 in the load history data.

When it is determined in step S14 and step S15 that the frequency condition and the period condition are satisfied, the factor estimating unit 25 estimates the user operation or application that has caused a high load in the target period based on the factor information. (Step S16).

For example, when there are 20 or more high load data based on the determination rule 1 in the load history data in the target period and it is determined that there is no periodicity, the factor estimating unit 25 performs web browsing by the user in the target period. Is determined to have been performed.

When the determination rule storage unit 22 stores another determination rule that has not yet been determined (Yes in step S17), the time-series data analysis device 2 operates from step S13 for the determination rule. repeat.

For example, the time-series data analysis device 2 repeats the determination process for the determination rule 2 regarding the mailer's periodic mail confirmation after the determination process for the determination rule 1 regarding the web browsing is completed.

Specifically, the target data extraction unit 23 extracts high load data with a CPU usage rate of 20% or more from the load history data of the target period based on the determination rule 2 (step S13). Next, the appearance tendency determination unit 24 determines the conditions regarding the period of the high load data (step S15). For example, the appearance tendency determination unit 24 may determine the condition related to the cycle by the above-described method of calculating the difference in seconds between each time (seconds) of the high load data. In addition, in the determination rule 2, since the condition regarding frequency is not prescribed | regulated, the appearance tendency determination part 24 abbreviate | omits the condition determination process (step S14) regarding frequency.

And the factor estimation part 25 should just determine whether the mailer's regular mail confirmation was performed in the object period based on the result of step S15 (step S16). In other words, if the regular mail confirmation of the mailer in the target period is performed, it is estimated that it is an appearance factor.

On the other hand, when the determination process regarding each determination rule stored in the determination rule storage unit 22 is completed (No in step S17), the time-series data analysis device 2 ends the operation.

Next, the effect of the second embodiment will be described.

The time-series data analysis apparatus as the second embodiment can estimate user operations and applications that cause high loads in the target system.

The reason is that the following configuration is included. First, the time series data acquisition unit acquires load history data in the target system. Second, the determination rule storage unit stores a condition indicating high load as target data specifying information, a condition regarding frequency and a condition regarding frequency as appearance tendency information, and information indicating a user operation and an application as factor information. deep. Third, the target data extraction unit extracts high load data that matches the target data specifying information from the load history data. Fourth, the appearance tendency determination unit determines whether or not the appearance tendency of the high load data satisfies a condition regarding frequency and a condition regarding cycle. Fifth, the factor estimating unit determines that the user operation and the application indicated by the factor information were performed in the target system during the target period based on the determination result of the appearance tendency determining unit.

As described above, user operations and application operations in the information processing system often have no periodicity. However, in the present embodiment, user operations and users having no periodicity are obtained from load history data that is time-series data. Application behavior due to use can also be estimated. In addition, this Embodiment can prescribe | regulate not only the case where there is no periodicity as conditions regarding the period of a determination rule, but the conditions when there is periodicity. For this reason, this Embodiment can estimate those even if it is a case where the user operation and application which become a high load factor in a target system have periodicity.

Furthermore, the present embodiment can reduce the cost of collecting time-series data necessary for estimating user operations and applications that have caused high loads in the target system.

The reason is that the time series data acquisition unit acquires the load history data regarding the resource load in the target system as time series data.

Here, for example, in the related technique described in Patent Document 4 described above, although the encryption method and application of subscriber traffic data are estimated, it is necessary to collect traffic data for that purpose. However, capturing network packets consumes a large amount of computer resources, so that dedicated equipment is often required, which increases the traffic data collection cost.

On the other hand, this embodiment gives a high load to the target system based on the rising frequency and the rising period from the load history data of the resource load (CPU usage rate, etc.) that can be easily collected from the target system. User operations and applications used by users can be estimated. For this reason, this Embodiment does not require the traffic data with a high collection cost.

Also, the time-series data analysis apparatus as the second embodiment can provide information useful for user allocation in a thin client system or the like.

The thin client system accommodates desktop environments of many users as virtual machines (VMs) on a small number of servers. In such a thin client system, the user operation and application information estimated using this embodiment are useful when deciding to which server a user or a VM used by the user is assigned.

For example, if a group of users who frequently perform web browsing is concentrated on a specific server, the server will be heavily loaded, and the possibility that the user's experience quality will deteriorate. On the other hand, processing that is mechanically executed by an application, such as periodic confirmation of mail, does not significantly affect the quality of experience of the user even if a delay occurs due to a high load.

As described above, in a thin client system, it is important in terms of operation to estimate what kind of application or user operation causes a load and how it affects the user's quality of experience.

Furthermore, since this embodiment uses resource load history data when estimating user operations or user-use applications that cause high loads in the target system, it is not necessary to directly monitor user operations. Therefore, this embodiment does not cause a privacy problem.

(Third embodiment)
Next, a third embodiment of the present invention will be described in detail with reference to the drawings. In the present embodiment, an example will be described in which the determination rule is extended with respect to the second embodiment on the assumption that a high load continues for several minutes, for example. Note that in each drawing referred to in the description of the present embodiment, the same reference numerals are given to the same configurations and steps that operate in the same manner as in the first and second embodiments, and the detailed description in the present embodiment. Description is omitted.

First, FIG. 11 shows a functional block configuration of a time-series data analysis apparatus 3 as a third embodiment of the present invention. In FIG. 11, the time-series data analysis device 3 is different from the time-series data analysis device 2 according to the second embodiment in that a determination rule storage unit 32 and an appearance tendency determination unit 24 are used instead of the determination rule storage unit 22. The point which includes the appearance tendency determination part 34 instead of is different. Furthermore, the time-series data analysis device 3 is different in that it includes a duration determination unit 36 and a duration data removal unit 37. Here, the time-series data analysis device 3 can be configured by the same hardware elements as the time-series data analysis device 1 as the first embodiment described with reference to FIG. In this case, the continuation period determination unit 36 and the continuation data removal unit 37 are configured by the CPU 1001 that reads the computer program and various data stored in the ROM 1003 and the storage device 1004 into the RAM 1002 and executes them. Note that the hardware configuration of the time-series data analysis device 3 and each functional block thereof is not limited to the above-described configuration.

The determination rule storage unit 32 further stores the determination rule in the second embodiment including duration information. Here, the duration information is a condition regarding the duration of the high load data.

FIG. 12 shows an example of the determination rule. In FIG. 12, each row indicates a determination rule, a condition indicating high load as target data specifying information, a condition regarding frequency and a condition regarding frequency as appearance tendency information, and information indicating a user operation or application as factor information In addition, duration information is included. In this example, the value of the duration information represents the minimum value of the duration, and the duration information is satisfied if the duration of the high load data is equal to or greater than this value.

For example, the determination rule 3 indicates a rule for “determining that a moving image is viewed when a high load with a CPU usage rate of 60% or more is continuously observed for 60 seconds or more”. If the load value is load history data observed at an interval of 10 seconds, the duration information is satisfied if 6 or more high load data continues. Here, “if the load value is load history data observed at intervals of 10 seconds” can be said to be “if the load history data has load values observed at intervals of 10 seconds”.

In addition, since it is considered that there is no periodicity in the video browsing operation by the user, in the determination rule 3, the condition regarding the period is “no periodicity”. Moreover, since it is thought that there is no tendency in the frequency of the video browsing operation by a user, the condition regarding frequency is not prescribed | regulated.

In addition, the determination rule including the duration information may be defined based on actual load data measured in advance when a user operation or application operation that may cause a continuous high load occurs. Good. For example, FIG. 13 shows an example of CPU usage rate measurement data when the user browses four types of moving images. As described above, the load at the time of viewing a moving image has a feature that a high load continues for several minutes. Therefore, in such a determination rule relating to video browsing, the duration condition may be defined based on the length of content that is frequently accessed on a video providing site or the like.

Further, the determination rule 1 related to the web browsing and the determination rule 2 related to the periodic mail check similar to those of the second embodiment are, in the determination rule shown in FIG. Is set. This is because continuation of a high load is not expected in web browsing by a user and periodic mail check by a mailer. The duration condition is not limited to the number of seconds, and may be defined by the number of high load data.

The duration determination unit 36 determines whether or not the high load data extracted by the target data extraction unit 23 satisfies the duration information included in the determination rule and continues.

The continuation data removal unit 37 removes a part of a series of high-load data determined to continue after satisfying the duration information. For example, the continuation data removal unit 37 may leave only the first high load data that is earlier in time out of a series of high load data that continues and satisfies the continuation period information, and may remove subsequent high load data. . If there are a plurality of portions that continue and satisfy the duration information, the continuation data removal unit 37 may remove some high load data for each continuation portion.

The appearance tendency determination unit 34 uses the high load data extracted by the target data extraction unit 23 and the appearance tendency in the second embodiment for the high load data after a part is removed by the continuous data removal unit 37. Similar to the determination unit 24, frequency and cycle determination processing is performed.

The operation of the time-series data analysis device 3 configured as described above will be described with reference to FIG.

In FIG. 14, first, the time-series data analysis device 3 operates in the same manner as the time-series data analysis device 2 as the second embodiment from step S11 to S13. Extract data.

Next, the duration determination unit 36 determines whether there is a duration that satisfies the duration information for the extracted high-load data (step S21). For example, as described above, when the duration information indicates the minimum value of the duration, the duration determination unit 36 determines whether the duration of the high load data is equal to or greater than the minimum value indicated in the determination rule. Can be judged.

Here, when it is determined that there is such a continuation period, the continuation data removal unit 37 removes a part of a series of high-load data that continues and satisfies the continuation period information (step S22). For example, as described above, the continuation data removal unit 37 may leave only the first high load data that is earlier in time among a series of continuous high load data, and remove subsequent high load data.

Next, the appearance tendency determination unit 34 performs steps S14 and S15 on the high load data after a part of the continuous high load data is removed, similarly to the second embodiment, It is determined whether or not the conditions regarding the period are satisfied.

On the other hand, when it is determined in step S21 that there is no such duration, the appearance tendency determining unit 34 performs steps S14 and S15 on the high load data extracted in step S13, as in the second embodiment. Execute. Subsequently, the appearance tendency determination unit 34 determines whether or not the condition regarding the frequency and the condition regarding the period are satisfied.

And the factor estimation part 25 performs step S16 similarly to 2nd Embodiment, and estimates the user operation or application used as the factor of high load.

If there is another determination rule (Yes in step S17), the time-series data analysis device 3 repeats the operations of step S13, step S21 to step S22, and step S14 to step S16.

Further, when the time-series data analysis device 3 finishes the determination process for each determination rule (No in step S17), the operation ends.

Next, the effect of the third embodiment will be described.

The time-series data analysis apparatus as the third embodiment can estimate the user operation and application that cause the problem more accurately when a high load continues in the target system.

The reason is that the determination rule storage unit stores a determination rule including duration information in addition to the target data specifying information and the factor information. Then, the duration determination unit determines whether there is a portion in the high load data specified by the target data identification information that continues with the duration information, and the duration data removal unit satisfies the duration information. This is because a part of a series of high-load data that continues is removed. Then, the appearance tendency determination unit determines the conditions regarding the frequency and the period for the high load data after removing a part, and the factor estimation unit is a user indicated by the factor information based on the determination result of the appearance tendency determination unit This is because the operation and application are determined.

As described above, the present embodiment can be used by the user by storing the determination rule including the duration condition even when a process with no periodicity is performed, such as moving image reproduction with a high load. It is possible to determine the application and operation performed.

Further, in this embodiment, the accuracy of determining the presence / absence of periodicity by the appearance tendency determining unit is improved by removing a part of the continuous data. Here, the presence / absence of periodicity defined in the condition relating to the period is mainly determined in order to distinguish whether a high load generation factor is a human operation or a mechanical event. However, the high load during reproduction other than the processing start time as in the case of moving image reproduction is not caused by a human operation or a mechanical event. For this reason, the high load data after the high load data of such a continuation part is removed is more suitable for the determination of the condition regarding the period than when the high load data is not removed.

In addition, this embodiment can provide information useful for user assignment in a thin client system that provides a user with a function of continuing high load.

For example, a moving image playback process in which a high load continues is an application in which playback is interrupted or image quality becomes unstable when the system is heavily loaded, so that the system load affects the user's quality of experience. In addition, the usage status of an application with a high load such as a moving image reproduction process has a great influence on user assignment in the thin client system. By using this embodiment, it is possible for users who have been found to play videos frequently to be isolated to another server in order to suppress the impact on other users with low load. Become. Alternatively, it is possible to perform operations such as urging the user to move to a server that can occupy many resources at a higher charge.

In the second and third embodiments described above, the example in which the CPU usage rate is applied as an example of load data has been mainly described. This CPU usage rate may represent a usage rate for one CPU core, or may represent a usage rate for a plurality of cores mounted on a CPU. However, it is necessary to unify whether the value indicated by the CPU usage rate is a value for one CPU core or a value for a plurality of cores. In addition, in each embodiment, the load data is not limited to the CPU usage rate, and may be data representing the load of other resources.

In the second and third embodiments described above, the load history data may include a mixture of load data observed in a plurality of target systems as shown in FIG. In this example, the “host name” in each row represents the target system. In this case, in step S11, the time-series data acquisition unit may acquire information representing the target system (for example, a host name or a host ID (Identifier)) in addition to the information representing the target period. In step S12, the time series data acquisition unit may extract the load history data related to the target system in the target period from the load history data.

In addition, in the second and third embodiments described above, the description has been mainly focused on the case where the appearance tendency information is made up of the condition relating to the frequency and the condition relating to the period. A combination of these may be used.

Further, in each of the above-described embodiments, the description has focused on an example in which each functional block of the time-series data analysis device is realized by a CPU that executes a computer program stored in a storage device or ROM. However, some, all, or a combination of each functional block may be realized by dedicated hardware (circuit).

In each of the above-described embodiments, the functional blocks of the time series data analysis device may be realized by being distributed to a plurality of devices.

In each of the above-described embodiments, the operation of the time-series data analysis device described with reference to each flowchart may be stored in a storage device (storage medium) of the computer device as the computer program of the present invention. it can. Then, the computer program may be read and executed by the CPU. In such a case, the present invention is constituted by the code of the computer program or a storage medium.

FIG. 16 is a diagram illustrating an example of the storage medium 1007. The storage medium 1007 shown in FIG. 7 may be a computer-readable non-transitory recording medium.

Also, the above-described embodiments can be implemented in appropriate combination.

Further, the present invention is not limited to the above-described embodiments, and can be implemented in various modes.

The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

This application claims priority based on Japanese Patent Application No. 2013-218939 filed on October 22, 2013, the entire disclosure of which is incorporated herein.

1, 2, 3 Time-series data analysis device 11, 21 Time-series data acquisition unit 12, 22, 32 Determination rule storage unit 13, 23 Target data extraction unit 14, 24, 34 Appearance tendency determination unit 15, 25 Factor estimation unit 36 Duration determination unit 37 Continuous data removal unit 1001 CPU
1002 RAM
1003 ROM
1004 Storage device 1005 Input device 1006 Output device

Claims (10)

1. Time series data acquisition means for acquiring time series data;
   Target data specifying information for specifying target data that is target data among data constituting the time series data, appearance tendency information in which conditions relating to the appearance tendency of the target data are defined, and appearance factors of the target data Determination rule storage means for storing a determination rule comprising:
   Target data extracting means for extracting target data specified by the target data specifying information from the time series data;
   Appearance tendency determination means for determining whether or not the appearance tendency of the target data extracted by the target data extraction means matches the appearance tendency information;
   Factor estimation means for estimating the appearance factor of the target data determined to match the appearance tendency information by the appearance tendency determination means based on the factor information;
   An information processing apparatus including:
2. The time-series data acquisition means acquires a history of load data including information related to a load of a target system that is a target information processing system as the time-series data,
   The determination rule storage unit stores a condition indicating high load as the target data specifying information, and a condition regarding the appearance tendency of high load data that is load data indicating the high load is defined as the appearance tendency information. The information processing apparatus according to claim 1, wherein information is stored, and information representing a cause of occurrence of the high load is stored as the factor information.
3. The determination rule storage means stores, as the factor information, information representing a user operation or application in the target system,
   The information processing apparatus according to claim 2, wherein the factor estimating unit estimates information representing a user operation or an application that has caused a high load in the target system.
4. The information processing apparatus according to any one of claims 1 to 3, wherein the determination rule storage unit stores a condition regarding the frequency of the target data as the appearance tendency information.
5. The information processing apparatus according to any one of claims 1 to 4, wherein the determination rule storage unit stores a condition related to a cycle of the target data as the appearance tendency information.
6. The determination rule storage means further includes and stores in the determination rule continuation period information in which a condition regarding the continuation period of the target data is defined,
   Duration determination means for determining whether the target data extracted by the target data extraction means has a portion that satisfies the duration information and continues.
   Of the target data, continuous data removing means for removing a part of a series of target data that satisfies the duration information and continues;
   Further comprising
   The appearance tendency determination means determines whether or not the target data after the part of the target data extracted by the target data extraction means is partially removed by the continuous data removal means matches the appearance tendency information. The information processing apparatus according to any one of claims 1 to 5.
7. The information processing according to claim 6, wherein the continuation data removing unit removes the subsequent target data while leaving the first target data earlier in time among the series of target data that satisfies the continuation period information and continues. apparatus.
8. The time series data acquisition means acquires time series data of a target period,
   The information processing apparatus according to any one of claims 1 to 7, wherein the factor estimation unit estimates an appearance factor of target data determined to match the appearance tendency information in the target period.
9. Computer equipment
   The target data specifying information for specifying the target data which is the target data among the data constituting the time series data, the appearance tendency information in which the conditions regarding the appearance tendency of the target data are defined, and the appearance factor of the target data Using the determination information consisting of the factor information to represent,
   Get time series data,
   Extracting the target data specified by the target data specifying information from the time series data,
   Determine whether the appearance tendency of the extracted target data matches the appearance tendency information,
   Estimating an appearance factor of target data determined to match the appearance tendency information based on the factor information;
   Time series data analysis method.
10. The target data specifying information for specifying the target data which is the target data among the data constituting the time series data, the appearance tendency information in which the conditions regarding the appearance tendency of the target data are defined, and the appearance factor of the target data Using the determination information consisting of the factor information to represent,
    A time series data acquisition step for acquiring time series data;
    A target data extraction step for extracting target data specified by the target data specifying information from the time series data;
    Determining whether the appearance tendency of the target data extracted in the target data extraction step matches the appearance tendency information;
    A factor estimating step of estimating an appearance factor of the target data determined to match the appearance tendency information based on the factor information;
    A computer-readable non-transitory recording medium in which a computer program for causing a computer device to execute is recorded.

Images