WO2016136198A1 - システム監視装置、システム監視方法、及び、システム監視プログラムが記録された記録媒体 - Google Patents
システム監視装置、システム監視方法、及び、システム監視プログラムが記録された記録媒体 Download PDFInfo
- Publication number
- WO2016136198A1 WO2016136198A1 PCT/JP2016/000827 JP2016000827W WO2016136198A1 WO 2016136198 A1 WO2016136198 A1 WO 2016136198A1 JP 2016000827 W JP2016000827 W JP 2016000827W WO 2016136198 A1 WO2016136198 A1 WO 2016136198A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- degree
- series data
- time
- abnormality
- time series
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
- G06F17/10—Complex mathematical operations
- G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
-
- G—PHYSICS
- G01—MEASURING; TESTING
- G01K—MEASURING TEMPERATURE; MEASURING QUANTITY OF HEAT; THERMALLY-SENSITIVE ELEMENTS NOT OTHERWISE PROVIDED FOR
- G01K3/00—Thermometers giving results other than momentary value of temperature
- G01K3/08—Thermometers giving results other than momentary value of temperature giving differences of values; giving differentiated values
- G01K3/10—Thermometers giving results other than momentary value of temperature giving differences of values; giving differentiated values in respect of time, e.g. reacting only to a quick change of temperature
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B23/00—Testing or monitoring of control systems or parts thereof
- G05B23/02—Electric testing or monitoring
- G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
- G05B23/0218—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults
- G05B23/0224—Process history based detection method, e.g. whereby history implies the availability of large amounts of data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
- G06F17/10—Complex mathematical operations
- G06F17/15—Correlation function computation including computation of convolution operations
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2218/00—Aspects of pattern recognition specially adapted for signal processing
Definitions
- the present invention relates to a system monitoring device or the like that can identify a defect related to a monitoring target.
- a state value (measured value, performance value) related to the physical system or the like is measured using a sensor (detection end) such as a thermometer.
- the measured state value is stored as performance information by, for example, associating with the measured time for each sensor used for the measurement.
- time series data time series information, time series records
- an analysis technique such as correlation analysis is used to analyze a relationship that is established between a plurality of measurement values included in the performance information.
- Correlation analysis is also used as a technique for detecting abnormalities in a large-scale information system including a large number of servers and communication network devices.
- the operation management apparatus disclosed in Patent Document 1 measures from two different pieces of performance information (represented as “first performance information” and “second performance information”) during a period in which the physical system is operating normally. Read values as time-series data.
- the operation management apparatus creates a correlation model by deriving a mathematical relational expression that holds between the two read time-series data. For example, the operation management apparatus reads, from the first performance information, the measurement value in the monitoring period for monitoring the physical system as the first time series data, and from the second performance information, the measurement value in the monitoring period is the second time series. Read as data.
- the operation management apparatus estimates the second time series data by applying the created correlation model to the first time series data.
- the operation management apparatus compares the read second time series data with the estimated second time series data, and based on the comparison result, whether or not the created correlation model holds for the time series data in the monitoring period. Determine. That is, the operation management apparatus determines whether or not the created correlation model is maintained for time-series data related to the monitoring period.
- the operation management device disclosed in Patent Document 2 measures the measurement values related to a plurality of performance indexes for each device to be monitored, and determines whether or not the measured measurement values are abnormal. When determining that the measurement value is abnormal, the operation management apparatus extracts a performance index related to the measurement value as an abnormal item. The operation management apparatus excludes the abnormal items extracted for all the monitoring target apparatuses from the respective abnormal items. Thereby, the operation management apparatus can shorten the time required to identify the cause of the abnormality when a plurality of servers detect the abnormality.
- the operation management device disclosed in Patent Document 3 derives a change in time series data regarding a plurality of pieces of performance information measured by a plurality of managed devices such as sensors, and between the changes relating to the plurality of derived time series data.
- a model generation unit for calculating a correlation model representing the relationship is included.
- the operation management apparatus further includes an analysis unit that calculates time-series data regarding the newly detected performance information and determines whether the calculated correlation model holds based on the calculated time-series data.
- the operation management apparatus can detect (determine) a failure based on whether or not the correlation model is established.
- the remote monitoring system disclosed in Patent Document 4 includes a first correlation that is established between a plurality of measurement values measured with respect to the monitoring target and a part of the measurement values during a period in which the monitoring target is operating normally.
- a model construction unit for obtaining a second correlation established between them; Further, the remote monitoring system applies the first correlation and the second correlation to the measurement values measured during the monitoring period with respect to the monitoring target, and monitors based on the calculated results. It has a detection part which detects whether an object is out of order.
- JP 2009-199533 A International Publication No. 2011/083687 JP 2009-211472 A JP 2006-135212 A
- Patent Literature 1 to Patent Literature 4 calculate a correlation between at least two pieces of time-series data, but it is not possible to identify which time-series data is a cause of a malfunction related to a monitoring target. Can not.
- a main object of the present invention is to provide a system monitoring device or the like that can identify the cause of a failure related to a monitoring target.
- a system monitoring device includes: It is determined whether or not the relationship representing the relationship established in the plurality of sets of first time series data measured in the first period is established for the monitoring target in the plurality of sets of second time series data measured in the second period. Determination means for determining; An abnormality degree calculating means for calculating an abnormality degree that represents a certain degree in which the second time series data is abnormal based on the relation that the determination means is satisfied and the relationship that the determination means is not satisfied.
- a system monitoring method includes: It is determined whether or not the relationship representing the relationship established in the plurality of sets of first time series data measured in the first period is established for the monitoring target in the plurality of sets of second time series data measured in the second period.
- the second time-series data is abnormal and calculates a degree of abnormality representing a certain degree, Based on the degree of abnormality calculated with respect to the second time series data, when the second time series data is normal or abnormal, a first degree representing a certain degree of the degree of abnormality is calculated; Calculating a second degree representing the degree to which the plurality of sets of the second time-series data are related based on the relationship with respect to the first period; Based on the first degree and the second degree, it is determined whether the second time series data is normal or abnormal.
- the system monitoring program is It is determined whether or not the relationship representing the relationship established in the plurality of sets of first time series data measured in the first period is established for the monitoring target in the plurality of sets of second time series data measured in the second period.
- a judgment function to judge The degree of abnormality for calculating the degree of abnormality representing the degree to which the second time series data is abnormal based on the relation determined to be satisfied by the determination function and the relationship determined not to be satisfied by the determination function A calculation function; Based on the degree of abnormality calculated with respect to the second time-series data, a first degree that calculates a first degree that represents a certain level of the degree of abnormality when the second time-series data is normal or abnormal A calculation function; A second degree calculation function for calculating a second degree representing the degree to which the plurality of sets of the second time-series data are related based on the relationship with respect to the first period; Based on the first degree and the second degree, the computer realizes a state calculation function for determining whether the second time-series data is normal or abnormal.
- this object is also realized by a computer-readable recording medium that records the system monitoring program.
- FIG. 1 is a diagram conceptually illustrating an example of measurement information referred to by a system monitoring apparatus according to each embodiment of the present invention.
- FIG. 1 is a diagram conceptually illustrating an example of measurement information referred to by a system monitoring apparatus according to each embodiment of the present invention.
- measurement values related to measurement items (upper temperature, room temperature, humidity, etc.) measured by the sensor, date and time when the measurement values were measured, and timing when the measurement values were measured Is associated with the status of the monitoring target (normal or abnormal).
- the units of the lower temperature, the upper temperature, and the room temperature are degrees Celsius (° C.).
- the unit of humidity is “%”. In the following description, description of units is omitted.
- the date “2014/2/6”, the time “0:00”, the state “normal”, the lower temperature “23”, the upper temperature “28”, and the like are associated with the measurement information illustrated in FIG. . This is because the upper temperature measured by the sensor at the time “0:00” of the date “2014/2/6” is 28 (° C.), the lower temperature measured by the sensor is 23 (° C.), and This indicates that the monitoring target is normal.
- time series data time series data set, time series information, time series record
- time series data regarding the measurement value is extracted by extracting each measurement value in time order for a specific period. For example, by extracting the lower temperature related to the date “2014/2/6”, “23, 25, 30, 22” is extracted as time series data related to the lower temperature.
- time series data set is also simply referred to as “time series data”.
- the time series data on humidity is “46”.
- 41, 43, 46 are extracted. That is, the extracted time series data represents a measurement value related to room temperature in a period (abnormal period) in which the monitoring target is in an abnormal state.
- the time series data “22, 23 related to the room temperature” is extracted.
- 25, 24, 22, 23 can be extracted. That is, the time series data represents a measurement value related to room temperature in a period (normal period) in which the monitoring target is in a normal state (normally operating).
- the correlation model mathematically represents the relationship that holds between one time-series data and the other time-series data with respect to time-series data related to two measured values (for example, room temperature and lower temperature) in a normal period.
- the correlation model (correlation of different performance indicators in a certain period) includes a mathematical model such as a correlation coefficient AutoRegressive_eXgeneous (ARX) model.
- ARX AutoRegressive_eXgeneous
- Corruption of a correlation model means that when a correlation model calculated based on time series data in a certain period is applied to time series data in a period different from the certain period, the estimated time series data and in a certain period This means that the time series data deviates.
- the determination regarding whether or not there is a divergence is, for example, whether or not the difference between the estimated time-series data and the time-series data in a certain period (that is, estimation error, prediction error) exceeds a predetermined threshold (that is, Whether or not a predetermined condition is satisfied.
- Destruction is expressed as “break” and “destruction”.
- the time-series data may be time-series data related to measured values such as a usage rate of a computing device, a usage rate of a memory, a frequency of disk access, and the like included in operation information related to an information processing system that is an example of a monitoring target Good.
- the time series data may be time series data related to measurement values such as power consumption and the number of calculations.
- the time series data may be, for example, time series data regarding values such as performance indexes measured during a period in which the information processing system is operating. Further, the time series data does not necessarily have to be a numerical value, and may be a symbol, a code, or the like. The time series data is not limited to the example described above.
- a system monitoring apparatus according to the present embodiment will be described using an example in which an abnormal location (factor) in a monitoring target is specified.
- a plurality of measurement values for example, temperature, humidity, etc.
- FIG. 2 is a block diagram showing the configuration of the system monitoring apparatus 101 according to the first embodiment of the present invention.
- the system monitoring apparatus 101 includes an information creation unit (model creation unit) 103 and an abnormality calculation unit 106.
- the system monitoring apparatus 101 may further include an index input unit 102 and an abnormal part output unit 110.
- the system monitoring apparatus 101 may be connected to a storage unit 111 including a time series storage unit 112, an information storage unit 113, and an abnormality storage unit 116.
- the system monitoring apparatus 101 reads the storage unit 111 in which performances measured by a plurality of sensors (analyzed apparatuses) 120 or measured values are stored with respect to the monitoring target 121. it can.
- the system monitoring apparatus 101 according to the first embodiment may be realized by a mode of receiving information transmitted by the sensor 120. In the following description, for convenience of explanation, it is assumed that the system monitoring apparatus 101 can receive information transmitted by the sensor 120.
- the sensor 120 measures, for example, the performance related to the monitoring target 121 as a measurement value at regular time intervals.
- the sensor 120 transmits the measurement value measured for the monitoring target 121 to the system monitoring apparatus 101.
- the measured value is, for example, the operation information such as the usage rate in the central processing unit (CPU), the usage rate related to the memory, the frequency related to the disk access, and the performance information such as the power consumption and the number of calculations, which are measured for the monitoring target 121 Etc.
- the measured value is represented using, for example, a numerical value such as an integer or a decimal, a sign such as “ON” or “OFF”, or a symbol such as “True” or “False”.
- the index input unit 102 receives the measurement value transmitted from the sensor 120, and stores the received measurement value in the storage unit 111 as measurement information as exemplified in FIG.
- the index input unit 102 extracts, from the measurement information (illustrated in FIG. 1), measurement values in a specific (for example, normal state) period as time series data, and the extracted time series data is a time series storage unit. 112. Furthermore, the index input unit 102 extracts, for example, measurement values in the monitoring period (a certain period) as time series data from the measurement information, and the extracted time series data is time series as illustrated in FIG.
- the information is stored in the time series storage unit 112 as information.
- FIG. 3 is a diagram conceptually illustrating an example of time-series information referred to by the system monitoring apparatus according to each embodiment of the present invention.
- a time-series identifier for identifying time-series data (hereinafter, the identifier is expressed as “ID”), a measurement item, a state related to a monitoring target, and time-series data Is associated.
- ID time-series identifier for identifying time-series data
- the measurement item is temperature and the measurement value is measured when the state related to the monitoring target is normal with respect to the time-series data.
- the information creation unit 103 includes a model information creation unit 104 that creates a correlation model or the like representing the relationship between two time series data. Further, the information creation unit 103 creates probability models (described later with reference to FIG. 9) that can calculate a state indicating whether the time series data is normal based on the created correlation model. A creation unit 105 is included.
- the model information creation unit 104 reads time-series data regarding the measurement item (sensor 120) during the period in which the monitoring target 121 is operating normally from the time-series storage unit 112.
- the model information creation unit 104 creates, as a correlation model, a relationship (for example, a correlation) that holds for a combination between two time-series data in the read time-series data.
- the model information creation unit 104 stores the created correlation model in the model information storage unit 114 as correlation model information as illustrated in FIG.
- FIG. 4 is a diagram conceptually illustrating an example of correlation model information referred to by the system monitoring apparatus according to each embodiment of the present invention.
- a correlation model ID that can uniquely identify the correlation model is associated with the correlation model by the correlation model information.
- the model information creation unit 104 may create the correlation model (relationship) for a combination between arbitrary time series data. Specific processing for creating the correlation model (for example, the least square method) will be described later.
- the probability information creation unit 105 reads the correlation model stored in the model information storage unit 114, and based on the read correlation model, a probability model (Fig. 9 will be described later with reference to FIG. The process in which the probability information creation unit 105 creates the probability model will be described later with reference to FIG.
- the abnormality calculation unit 106 includes a destruction detection unit 107, an abnormality degree calculation unit 108, and an abnormality determination unit 109.
- the destruction detection unit 107 reads, for example, the time series data related to the measurement values in the monitoring period from the time series storage unit 112. For example, the destruction detection unit 107 reads a correlation model (illustrated in FIG. 4) related to the time series data from the model information storage unit 114. The destruction detection unit 107 may read time-series data related to the read correlation model from the time-series storage unit 112.
- the destruction detection unit 107 reads from the probability information storage unit 115 a probability model (described later with reference to FIG. 9) created based on the read correlation model.
- the destruction detection unit 107 detects the cause (factor) of the abnormality in a certain period based on the read time series data, the read correlation model, and the read probability model.
- the destruction detection unit 107 reads time-series data regarding measured values in a certain period from the time-series storage unit 112.
- the destruction detection unit 107 reads a correlation model (illustrated in FIG. 4) related to the read time series data from the model information storage unit 114.
- the destruction detection unit 107 determines whether each read correlation model is established with respect to the read time-series data. For example, the destruction detection unit 107 estimates time-series data related to the measurement values in the certain period based on the read correlation model, and calculates a difference (prediction error) between the estimated time-series data and the read time-series data. To do.
- the destruction detection unit 107 determines that the read correlation model is not established (is no longer maintained or has been destroyed). judge.
- the destruction detection unit 107 stores the destroyed correlation model in the destruction model storage unit 117 as a destruction model.
- the destruction detection unit 107 may store a correlation model ID representing a destruction model in the destruction model storage unit 117.
- the abnormality degree calculation unit 108 reads the destruction model from the destruction model storage unit 117. Next, the degree of abnormality calculation unit 108 calculates the degree of abnormality representing the degree to which the time series data is related to the destruction model based on the read destruction model. A method for calculating the degree of abnormality will be described later with reference to FIG.
- the abnormality determination unit 109 reads a probability model (described later with reference to FIG. 9) from the probability information storage unit 115.
- the abnormality determination unit 109 reads the destruction model related to the read probability model from the destruction model storage unit 117. Furthermore, the abnormality determination unit 109 reads the abnormality level related to the node (sensor) from the abnormality level storage unit 118.
- the abnormality determination unit 109 identifies a sensor that is a factor causing the abnormality by estimating a state that best matches the read degree of abnormality. A processing procedure in which the abnormality determination unit 109 identifies a sensor that causes an abnormality will be described later with reference to FIG.
- the information storage unit 113 can store a model information storage unit 114 capable of storing the correlation model created by the model information creation unit 104 and a probability model created by the probability information creation unit 105 (described later with reference to FIG. 9).
- a random probability information storage unit 115 can store a model information storage unit 114 capable of storing the correlation model created by the model information creation unit 104 and a probability model created by the probability information creation unit 105 (described later with reference to FIG. 9).
- a random probability information storage unit 115 can store a model information storage unit 114 capable of storing the correlation model created by the model information creation unit 104 and a probability model created by the probability information creation unit 105 (described later with reference to FIG. 9).
- the abnormality storage unit 116 includes a destruction model storage unit 117 capable of storing the destruction model created by the destruction detection unit 107, and an abnormality degree storage unit 118 capable of storing the abnormality degree calculated by the abnormality degree calculation unit 108. Furthermore, the abnormality storage unit 116 includes an abnormality location storage unit 119 that can store, as an abnormality location, a sensor relating to time-series data representing the cause of the abnormality identified by the abnormality determination unit 109.
- the abnormal part output unit 110 reads an item indicating the cause of the abnormality from the abnormal part storage unit 119 and outputs the read item.
- FIG. 5 is a flowchart showing a flow of processing in which the system monitoring apparatus 101 according to the first embodiment creates a probability model.
- the index input unit 102 receives the measurement value (measurement information) transmitted by the sensor 120 (step S101). For example, the index input unit 102 creates measurement information as illustrated in FIG. 1 by arranging the received measurement values in time order, and stores the created measurement information in the storage unit 111. Next, the index input unit 102 creates time series information as illustrated in FIG. 3 by extracting measurement values in a certain period as time series data based on the measurement information, and creates the time series information created as shown in FIG. Is stored in the time-series storage unit 112 (step S102).
- the index input unit 102 determines whether or not measurement values have been received from all sensors 120 (step S103). If there is a measurement value that has not yet been received (NO in step S103), index input unit 102 repeats the processes shown in steps S101 and S102.
- the model information creation unit 104 reads a plurality of time series data stored in the time series storage unit 112 (step S104).
- the model information creation unit 104 when creating a correlation model for all combinations of time series data stored in the time series storage unit 112, the model information creation unit 104 generates correlation models for all combinations of time series data. It is determined whether it has been created (step S107). If there is a combination for which a correlation model has not been created (NO in step S107), model information creation unit 104 repeats the processing shown in steps S105 and S106.
- the probability information creation unit 105 reads the correlation model from the model information storage unit 114 (step S108).
- the probability information creation unit 105 creates a probability model (to be described later with reference to FIG. 9) that can calculate a state representing whether the time series data is normal or abnormal based on the read correlation model (Steps). S109).
- the probability information creation unit 105 may read all correlation models from the model information storage unit 114 and create a probability model based on the read correlation models.
- the probability information creation unit 105 stores the created probability model in the probability information storage unit 115.
- the probability model and the process for creating the probability model will be described later with reference to FIG.
- FIG. 6 is a flowchart showing the flow of processing for determining whether or not the system monitoring apparatus 101 according to the first embodiment is abnormal with respect to time-series data.
- the model information storage unit 114 stores a correlation model
- the probability information storage unit 115 stores a probability model.
- the index input unit 102 receives a measurement value from a sensor 120 during a certain period (monitoring period).
- the index input unit 102 may read time-series data for a certain period from the time-series storage unit 112.
- the index input unit 102 receives measured values (performance information, observed values) in a certain period from the sensor 120 (step S201). For example, the index input unit 102 stores the received measurement values in the time series storage unit 112 as time series data in time order (step S202).
- the index input unit 102 determines whether or not measurement values have been received from all the sensors 120 (step S203). When there is a sensor 120 that has not received (NO in step S203), the index input unit 102 repeats the processes shown in steps S201 and S202.
- the fracture detection unit 107 stores the correlation model from the model information storage unit 114 that can store the correlation model information as illustrated in FIG. Read.
- the destruction detection unit 107 reads time-series data (illustrated in FIG. 3) related to the read correlation model (illustrated in FIG. 4) from the time-series storage unit 112 (step S204). For example, regarding the correlation model represented by the correlation model ID “2” that can uniquely identify the correlation model, the destruction detection unit 107 represents the time series data represented by the time series ID “2” and the time series ID “5”. Read time-series data. For example, referring to FIG. 3, the time-series data represented by the time-series ID “2” is time-series data in a certain period related to the measurement item (ie, sensor) “humidity” associated with the time-series ID “2”. is there.
- the destruction detection unit 107 determines whether or not the read correlation model holds for time-series data in a certain period (step S205). For example, the destruction detection unit 107 applies the read correlation model (illustrated as the correlation model ID “2” in FIG. 4) to time-series data (eg, time-series ID “5”) in a certain period, Series data (for example, time series ID “2”) is estimated. The destruction detection unit 107 calculates an error between the time series data in a certain period and the estimated time series data, and determines whether or not the read correlation model holds based on the calculated error.
- the read correlation model illustrated as the correlation model ID “2” in FIG. 4
- time-series data eg, time-series ID “5”
- Series data for example, time series ID “2”
- the destruction detection unit 107 calculates an error between the time series data in a certain period and the estimated time series data, and determines whether or not the read correlation model holds based on the calculated error.
- the destruction detection unit 107 When the correlation model does not hold (does not hold) with respect to time-series data in a certain period (NO in step S205), the destruction detection unit 107 indicates that the read correlation model does not hold with respect to time-series data in a certain period. Set to destruction model. The destruction detection unit 107 stores the destruction model in the destruction model storage unit 117 (step S206).
- the fracture detection unit 107 determines whether or not correlation models are established for all correlation models (step S207). That is, the destruction detection unit 107 determines whether correlation destruction has occurred for all correlation models based on time-series data in a certain period.
- destruction detection unit 107 repeats the processing shown in steps S204 to S206.
- the destruction detection unit 107 refers to the destruction model storage unit 117, and the destruction model exists. It is determined whether or not to perform (step S208).
- the system monitoring apparatus 101 outputs (for example, displays) a message “no abnormal part” (step S212).
- the abnormality degree calculation unit 108 calculates the abnormality degree with respect to the time series data based on whether or not the correlation model is the destruction model (step S209).
- the degree of abnormality and the process for calculating the degree of abnormality will be described later with reference to FIG.
- the abnormality determination unit 109 reads the probability model (illustrated in FIG. 9) from the probability information storage unit 115 (step S210).
- the abnormality determination unit 109 calculates whether each node (for example, the sensor 120) included in the probability model is abnormal based on the abnormality degree calculated by the abnormality degree calculation unit 108 and the read probability model. (Step S211). Details of the probability model will be described later with reference to FIG.
- the abnormal part output unit 110 outputs, for example, items (locations, sensors 120) related to time series data that the abnormality determination unit 109 determines to be abnormal (step S213).
- the correlation model, the probability model, and the destruction model will be described in detail with reference to an example. First, the correlation model and the process for creating the correlation model will be described.
- the model information creation unit 104 Based on the read time-series data (for example, time-series data in a normal period), the model information creation unit 104 follows the procedure of minimizing the sum of squares of errors related to the correlation model (that is, the least-squares method) according to the constant “a, b "is calculated. For example, the model information creation unit 104 creates correlation model information as illustrated in FIG. 4 for the calculated constants “a, b”, and stores the created correlation model information in the model information storage unit 114. Note that the approximate value (predicted value) z of y when x is input can be calculated according to “a ⁇ x + b”, and the error can be calculated as the difference between y and z.
- the model information creation unit 104 further determines that the calculated correlation model is appropriate depending on whether or not the sum of squared errors satisfies a predetermined condition (for example, whether or not the sum of squared errors is equal to or less than a predetermined threshold). It may be determined whether or not. For example, the model information creation unit 104 determines that the calculated correlation model is not appropriate as a correlation model for estimating time-series data when the sum of squares of errors is larger than a predetermined threshold. In this case, the model information creation unit 104 may not store the correlation model in the model information storage unit 114.
- a predetermined condition for example, whether or not the sum of squared errors is equal to or less than a predetermined threshold. It may be determined whether or not. For example, the model information creation unit 104 determines that the calculated correlation model is not appropriate as a correlation model for estimating time-series data when the sum of squares of errors is larger than a predetermined threshold. In this case, the model information creation unit 104 may not store the correlation model in
- the model information creation unit 104 may create related information (FIG. 7) that conceptually represents an appropriate correlation model as a correlation model for estimating time series data.
- FIG. 7 is a diagram conceptually illustrating an example of related information.
- nodes nodes, numbers surrounded by circles
- branches edges, lines connecting numbers connecting the nodes
- the node represents certain time series data (or the sensor 120 that calculates the time series data).
- a branch indicates that a correlation model established between time series data represented by nodes at both ends of the branch is appropriate as a correlation model for estimating time series data.
- the model information creation unit 104 obtains time series data related to the correlation model (or the sensor 120 that calculates the time series data) according to whether or not the above-described error sum of squares is larger than a predetermined threshold. Set a branch between the two nodes to be represented.
- FIG. 8 is a diagram conceptually illustrating an example of related information.
- the node representing the sensor is adjacent to the node representing the time series data.
- the sensor Arabic numerals surrounded by circles
- time-series data represented by the nodes adjacent to the nodes Roman numerals surrounded by circles
- the branch connecting the nodes represented by Arabic numerals surrounded by ⁇ indicates that the sum of squares of the error relating to the correlation model between the time series data measured by the sensor represented by the node satisfies a predetermined condition.
- the nodes connected to both ends of the branch indicate that the time series data represented by the nodes has a relationship (correlation) that satisfies a predetermined condition.
- FIG. 9 is a diagram conceptually illustrating an example of the probability model.
- the probability model is calculated based on the created correlation model (related information, illustrated in FIGS. 7 and 8).
- the nodes in the probability model include the nodes (representing time-series data or sensors) shown in FIG. 7 and two nodes (that is, node S and node D).
- the branches in the probability model are the branches in the created related information (that is, the correlation model that satisfies the predetermined condition), the branches that connect the nodes in the node S and related information (illustrated in FIG. 7), the nodes D and the related information. And a branch connecting each node in the information.
- a branch connecting the nodes S and the nodes in the related information is represented as a second branch
- a branch connecting the nodes D and the nodes in the related information is represented as a first branch
- each branch in the related information (illustrated in FIG. 7).
- the node S may be expressed as a second node.
- the node D may be expressed as a third node.
- the node included in the related information (illustrated in FIG. 7) may be expressed as the first node.
- Each branch in the probability model is given a weight according to the process described later.
- the weight given to the second branch and the third branch is given the weight based on the above-described degree of abnormality.
- the weight given to the first branch is given a weight based on whether or not the branch exists. The process for assigning the weight will be described later.
- Markov random field is a probabilistic model in which only nodes adjacent to each other probabilistically influence each other.
- the created probability model is a Markov random field.
- a node is represented by v
- a set of nodes included in the probability model is represented by V.
- a node set other than the node v is represented as “V ⁇ ⁇ v ⁇ ”.
- T denote a set of nodes adjacent to the node v.
- Equation 1 In the case of a Markov random field, since only adjacent nodes affect each other stochastically, Equation 1 is established. That is, p (v
- V ⁇ ⁇ v ⁇ ) p (v
- the node 2 is adjacent to the node 1, the node 3, the node 4, the node 5, the node 6, the node 7, and the node “II”.
- Node 2 is not adjacent to nodes such as node 8 and node 9.
- Equation 2 is established. That is, p (2
- V ⁇ ⁇ 2 ⁇ ) p (2
- the destruction detection unit 107 determines that the correlation models represented by the branches included in the related information are respectively in a certain period. It is determined whether or not the series data is satisfied.
- the destruction detection unit 107 determines that the correlation model including the following nine branches does not hold for time-series data in a certain period. That is, Between node 3 and node 5, Between node 3 and node 6, Between nodes 6 and 7, Between node 2 and node 5, Between nodes 5 and 7, Between node 2 and node 7, Between nodes 8 and 9, Between node 1 and node 4, Between node 1 and node 7.
- the destruction detection unit 107 may create related information as exemplified in FIG. 10 by distinguishing the correlation model that is a destruction model (represented by using a dotted line).
- FIG. 10 is a diagram conceptually illustrating an example of related information.
- the degree of abnormality A illustrated in Equation 3 represents the ratio of the branch representing the destruction model among the branches connected to the node x.
- the destruction detection unit 107 calculates the degree of abnormality related to the node in the related information, and associates the calculated degree of abnormality with the node ID (time series ID or measurement item (index)) representing the node.
- the abnormality level information as illustrated in FIG. 11 is created.
- FIG. 11 is a diagram conceptually illustrating an example of the degree of abnormality information. Note that the degree of abnormality in the degree-of-abnormality information illustrated in FIG. 11 is not the degree of abnormality calculated based on the related information illustrated in FIG. 10 but a degree of abnormality set for convenience of explanation.
- the node ID (in other words, time series ID, measurement item (index), etc.) and the node abnormality level represented by the node ID are associated with each other by the abnormality level information.
- the node ID “1” is associated with the abnormality degree “0.333333” by the abnormality degree information illustrated in FIG. This indicates that, for example, the degree of abnormality calculated by the destruction detection unit 107 according to Equation 3 for the node indicated by the node ID “1” is “0.333333”.
- the number of nodes is N.
- the degree of abnormality related to the node i (where 1 ⁇ i ⁇ N) is expressed as x i, and the state related to the node i is expressed as y i . That is, y i represents a label that can identify whether it is normal (for example, 0) or abnormal (for example, 1).
- the abnormality determination unit 109 calculates, for example, y i (where 1 ⁇ i ⁇ N) that occurs with the highest probability when the degree of abnormality is x i (where 1 ⁇ i ⁇ N). In other words, the abnormality determination unit 109 maximizes the posterior probability p (y 1 , y 2 ,..., Y N
- Equation 4 p (y 1 , y 2 ,..., Y N
- ⁇ represents a proportional relationship.
- Equation 5 the base of the logarithmic function is, for example, the number of Napiers.
- ⁇ represents a set of branches (edges) in the probability model.
- the abnormality determination unit 109 obtains y 1 , y 2 ,..., Y N when the value calculated according to Equation 5 is the maximum. “Expression 5 ⁇ ( ⁇ 1)” is called an energy function.
- y 1 , y 2 ,..., Y N that maximize Equation 5 are This can result in a problem of finding the maximum flow for the weighted graph. That is, y 1 , y 2 ,..., Y N maximizing Equation 5 is a problem for obtaining a minimum cut that minimizes the weight to be cut when the calculated weighted graph is separated into two. It can be brought back.
- the problem of obtaining y 1 , y 2 ,..., Y N that maximizes Equation 5 is, for example, the maximum flow from the node S to the node D based on the probability model illustrated in FIG. It is reduced to the problem that is sought. That is, the problem is reduced to a minimum cut problem that separates the graph illustrated in FIG. 9 into two while minimizing the weight of the cut branch.
- y i ) corresponds to the weights related to the second branch and the third branch in the probability model.
- p (y m , y n ) corresponds to the weight related to the first branch in the probability model.
- y i ) for example, it is defined using the beta distribution defined using the probability density shown in Equation 6 or the probability density shown in Equation 7.
- a gamma distribution can be used.
- ⁇ represents a gamma function. “/” Represents division. A, b, k, and ⁇ represent constants.
- y i ) is a value calculated when x in Expression 6 or 7 is set as the degree of abnormality.
- the abnormality determination unit 109 may set a large value calculated according to Equation 6 as p (x i
- the abnormality determination unit 109 may set a small value calculated according to Equation 6 as p (x i
- the first degree represents a certain degree (probability) of the degree of abnormality with a specific value when the node (time-series data, sensor) is in a specific state. That is, the first degree represents a certain degree (probability) of the degree of abnormality with a specific value when, for example, the node (time-series data, sensor) is normal. The first degree represents a certain degree (probability) of the degree of abnormality with a specific value when, for example, the node (time-series data, sensor) is abnormal.
- the abnormality determination unit 109 may calculate p (x i
- the abnormality determination unit 109 calculates the constant a and the constant b based on the average of the abnormalities and the variance of the abnormalities. May be.
- the abnormality determination unit 109 may calculate the constant k and the constant ⁇ according to the maximum likelihood estimation procedure.
- an Ising model shown in Expression 8 can be used as a model for defining p (y m , y n ).
- e represents the base of the natural logarithm (Napier number).
- W m, n represents the degree to which the node m and the node n are related.
- a plurality of nodes adjacent to each other e.g., the node m, node n
- y m and y n are prone to the same value.
- Equation 8 (y m, y n), for example, mutually whether y m and y n regarding nodes that are adjacent is the same, depending on whether they differ in value calculated is there. For example, with respect to formulas 8, if y m and y n are the same value, it calculates a value higher than y m and y n are different values.
- p (y m , y n ) may be expressed as the second degree. That is, the second degree represents the degree to which the nodes (time series data, sensors) are related to each other.
- the abnormality determination unit 109 calculates the weights of the branches included in the probability model as illustrated in FIG. 9, and applies the algorithm for solving the maximum flow problem to the calculated weighted probability model.
- FIG. 12 is a diagram conceptually showing the determination information calculated by the abnormality determination unit 109.
- the abnormality determination unit 109 may display the probability model (graph) illustrated in FIG. 9 on the display unit 122.
- the abnormality determination unit 109 may display the probability model on the display unit 122 in a manner of displaying a weight related to the branch in the vicinity of the branch included in the graph.
- the node ID “2” is associated with the state “normal” according to the determination information illustrated in FIG. This indicates that the state calculated by the abnormality determination unit 109 for the node ID “2” is normal according to the above-described processing.
- the node ID represents an identifier that can identify a time-series ID, a measurement item, or a performance index, as in the description related to FIG.
- the system monitoring apparatus 101 determines that the time series data regarding the node ID “7” where the correlation destruction is concentrated is abnormal by executing the above-described processing. Further, the system monitoring apparatus 101 does not determine that the node ID “5” is abnormal even if a correlation destruction unrelated to the abnormality in the monitoring target 121 has occurred. Furthermore, since the system monitoring apparatus 101 calculates whether it is normal or abnormal by obtaining y 1 , y 2 ,..., Y N that maximizes Equation 5 as described above, No threshold for judging normality or abnormality is set.
- the system monitoring apparatus 101 even if a correlation destruction unrelated to the abnormality in the monitoring target 121 occurs, it is possible to identify an abnormal part without setting a threshold value.
- the reason for this is that the use of a correlation model (dependency) between performance indexes (nodes) causes the adjacent performance indexes to be destroyed even if the correlation model is not related to the actual anomalies. This is because the influence of destruction can be reduced based on the information on the above. Further, the reason is that the system monitoring apparatus 101 calculates the state where the posterior probability is maximum as shown in Equation 5, even if there is no threshold for determining normality or abnormality, the probability This is because the most appropriate state can be calculated.
- the system monitoring apparatus 101 it is possible to specify the cause of the malfunction in the monitoring target.
- the system monitoring apparatus 101 calculates the state of the sensor 120 based on the degree of abnormality and the relationship between the plurality of sensors 120.
- FIG. 13 is a block diagram showing the configuration of the system monitoring apparatus 201 according to the second embodiment of the present invention.
- the system monitoring apparatus 201 includes a determination unit 202, an abnormality degree calculation unit 203, a first degree calculation unit 204, a second degree calculation unit 205, and a state calculation unit 206.
- the determination unit 202 receives a correlation model representing a relationship between a plurality of sets of time-series data (represented as “first time-series data”) measured in a first period (for example, a normal period). To do. Further, the determination unit 202 receives time-series data (represented as “second time-series data”) measured in a second period (for example, a monitoring period) regarding time-series data related to the received correlation model.
- the set is an expression including time-series data measured in a certain period by a plurality of sensors of a certain type.
- the determination unit 202 estimates the time series data by applying the received correlation model to the received second time series data, and calculates an error between the received second time series data and the estimated time series data. To do.
- the determination unit 202 reads, for example, the time series ID associated with the correlation model based on the correlation model information as illustrated in FIG. 4, and the time series information as illustrated in FIG. Based on the above, a measurement item associated with the read time series ID is extracted. Next, the determination unit 202 estimates the time series data by applying the correlation model to the time series data measured by the extracted measurement item (sensor 120) in the second period.
- the determination unit 202 determines whether or not the received correlation model is established based on whether or not the calculated error is equal to or greater than a predetermined threshold. For example, when the calculated error is equal to or greater than a predetermined threshold, the determination unit 202 determines that no correlation model holds for the time series data measured in the second period. In addition, when the calculated error is less than the predetermined threshold, the determination unit 202 determines that a correlation model is established for the time series data measured in the second period.
- the determination unit 202 can be realized by using the destruction detection unit 107 in the system monitoring apparatus 101 according to the first embodiment.
- the degree-of-abnormality calculation unit 203 establishes the second time-series data based on the number of received correlation models and the number of correlation models determined not to be associated with the time-series data measured in the second period.
- the degree of abnormality representing the degree related to the relationship that is not (abnormal) is calculated.
- the abnormality degree calculation unit 203 can be realized by the abnormality calculation unit 106 in the system monitoring apparatus 101 according to the first embodiment.
- the first degree calculation unit 204 specifies the abnormality degree calculated by the abnormality degree calculation unit 203 when the second time series data is normal or abnormal based on the abnormality degree calculated by the abnormality degree calculation unit 203. A first degree that represents a certain level is calculated.
- the first degree calculation unit 204 is a process in which the abnormality determination unit 109 in the system monitoring apparatus 101 according to the first embodiment calculates the value of p (x i
- the process of calculating the first degree can be realized.
- the second degree calculation unit 205 calculates a second degree that represents the degree to which the second time series data related to the correlation model are related.
- the second degree calculation unit 205 is a process in which the abnormality determination unit 109 in the system monitoring apparatus 101 according to the first embodiment calculates the value of p (y m , y n ) according to Equation 8 based on the correlation model.
- the process of calculating the second degree can be realized.
- the state calculation unit 206 determines whether the first time series data is normal based on the first degree calculated by the first degree calculation unit 204 and the second degree calculated by the second degree calculation unit 205. Is calculated.
- y 1 state calculation unit 206, the abnormality determination unit 109 in the system monitoring apparatus 101 based on a probabilistic model, such as illustrated in FIG. 9, for example, according to the procedure for obtaining the minimum cut, the equation 5 to the maximum , Y 2 ,..., Y N can be realized.
- the system monitoring apparatus 201 it is possible to identify the cause of the malfunction in the monitoring target.
- the system monitoring apparatus 201 calculates the state of the sensor 120 based on the degree of abnormality and the relationship between the plurality of sensors 120.
- the system monitoring apparatus may be realized using at least two calculation processing apparatuses physically or functionally.
- the system monitoring apparatus may be realized as a dedicated apparatus.
- FIG. 14 is a diagram schematically illustrating a hardware configuration example of a calculation processing apparatus capable of realizing the system monitoring apparatus according to the first embodiment and the second embodiment.
- the computer 20 includes a central processing unit (Central_Processing_Unit, hereinafter referred to as “CPU”) 21, a memory 22, a disk 23, and a nonvolatile recording medium 24.
- the calculation processing device 20 further includes a communication interface (hereinafter, referred to as “communication IF”) 27 and a display 28.
- the calculation processing device 20 may be connected to the input device 25 and the output device 26.
- the calculation processing device 20 can transmit / receive information to / from other calculation processing devices and communication devices via the communication IF 27.
- the non-volatile recording medium 24 is a computer-readable, for example, compact disc (Compact_Disc) or digital versatile disc (Digital_Versatile_Disc).
- the nonvolatile recording medium 24 may be a universal serial bus memory (USB memory), a solid state drive (Solid_State_Drive), or the like.
- the non-volatile recording medium 24 retains such a program without being supplied with power, and can be carried.
- the nonvolatile recording medium 24 is not limited to the above-described medium. Further, the program may be carried via the communication network via the communication IF 27 instead of the nonvolatile recording medium 24.
- the CPU 21 copies a software program (computer program: hereinafter simply referred to as “program”) stored in the disk 23 to the memory 22 and executes arithmetic processing.
- the CPU 21 reads data necessary for program execution from the memory 22.
- the CPU 21 displays the output result on the display 28.
- the CPU 21 outputs an output result to the output device 26.
- the CPU 21 reads the program from the input device 25.
- the CPU 21 interprets and executes the system monitoring program (FIG. 5 or FIG. 6) in the memory 22 corresponding to the function (process) represented by each unit shown in FIG. 2 or FIG.
- the CPU 21 sequentially performs the processes described in the above-described embodiments of the present invention.
- the present invention can also be realized by such a system monitoring program. Furthermore, it can be understood that the present invention can also be realized by a computer-readable non-volatile recording medium in which the system monitoring program is recorded.
- calculation processing device 21 CPU 22 Memory 23 Disk 24 Non-volatile recording medium 25 Input device 26 Output device 27 Communication IF 28 Display 101 System Monitoring Device 102 Index Input Unit 103 Information Creation Unit 104 Model Information Creation Unit 105 Probability Information Creation Unit 106 Abnormality Calculation Unit 107 Destruction Detection Unit 108 Abnormality Calculation Unit 109 Abnormality Determination Unit 110 Abnormality Location Output Unit 111 Storage Unit 112 Time series storage unit 113 Information storage unit 114 Model information storage unit 115 Probability information storage unit 116 Abnormal storage unit 117 Destruction model storage unit 118 Abnormality storage unit 119 Abnormal part storage unit 120 Sensor 121 Monitor object 122 Display unit 201 System monitoring device 202 Determination unit 203 Abnormality calculation unit 204 First degree calculation unit 205 Second degree calculation unit 206 State calculation unit
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Mathematical Optimization (AREA)
- Pure & Applied Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Mathematical Physics (AREA)
- Computational Mathematics (AREA)
- Mathematical Analysis (AREA)
- Algebra (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Databases & Information Systems (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Biology (AREA)
- Life Sciences & Earth Sciences (AREA)
- Probability & Statistics with Applications (AREA)
- Operations Research (AREA)
- Bioinformatics & Computational Biology (AREA)
- Automation & Control Theory (AREA)
- Computing Systems (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
Description
監視対象に関して、第1期間に測定された複数セットの第1時系列データに成り立つ関係を表す関係性が、第2期間に測定された前記複数セットの第2時系列データについて成り立つか否かを判定する判定手段と、
前記判定手段が成り立つと判定する前記関係性と、前記判定手段が成り立たないと判定する前記関係性とに基づき、前記第2時系列データが異常である程度を表す異常度を算出する異常度算出手段と、
前記第2時系列データに関して算出された前記異常度に基づき、前記第2時系列データが正常または異常である場合において前記異常度が特定の値である程度を表す第1程度を算出する第1程度算出手段と、
前記第1期間に関する前記関係性に基づき、前記複数セットの前記第2時系列データが関連している程度を表す第2程度を算出する第2程度算出手段と、
前記第1程度と、前記第2程度とに基づき、前記第2時系列データが正常であるか異常であるかを求める状態算出手段と
を備える。
監視対象に関して、第1期間に測定された複数セットの第1時系列データに成り立つ関係を表す関係性が、第2期間に測定された前記複数セットの第2時系列データについて成り立つか否かを判定し、
成り立つと判定された前記関係性と、成り立たないと判定する前記関係性とに基づき、前記第2時系列データが異常である程度を表す異常度を算出し、
前記第2時系列データに関して算出された前記異常度に基づき、前記第2時系列データが正常または異常である場合において前記異常度が特定の値である程度を表す第1程度を算出し、
前記第1期間に関する前記関係性に基づき、前記複数セットの前記第2時系列データが関連する程度を表す第2程度を算出し、
前記第1程度と、前記第2程度とに基づき、前記第2時系列データが正常であるか異常であるかを求める。
監視対象に関して、第1期間に測定された複数セットの第1時系列データに成り立つ関係を表す関係性が、第2期間に測定された前記複数セットの第2時系列データについて成り立つか否かを判定する判定機能と、
前記判定機能によって成り立つと判定された前記関係性と、前記判定機能によって成り立たないと判定された前記関係性とに基づき、前記第2時系列データが異常である程度を表す異常度を算出する異常度算出機能と、
前記第2時系列データに関して算出された前記異常度に基づき、前記第2時系列データが正常または異常である場合において前記異常度が特定の値である程度を表す第1程度を算出する第1程度算出機能と、
前記第1期間に関する前記関係性に基づき、前記複数セットの前記第2時系列データが関連している程度を表す第2程度を算出する第2程度算出機能と、
前記第1程度と、前記第2程度とに基づき、前記第2時系列データが正常であるか異常であるかを求める状態算出機能と
をコンピュータに実現させる。
本実施形態においては、監視対象における異常な箇所(要因)を特定する場合の例を用いながら、本実施形態に係るシステム監視装置について説明する。尚、本実施形態においては、監視対象を測定しているセンサを介して、該監視対象に関する複数の測定値(たとえば、温度、湿度等)を測定できるとする。
p(v|V\{v})=p(v|T)・・・(式1)、
(ただし、pは確率を表す。「|」は条件付き確率を表す)。
p(2|V\{2})=p(2|II,1,3,4,5,6,7)・・・(式2)。
節点3及び節点5間、
節点3及び節点6間、
節点6及び節点7間、
節点2及び節点5間、
節点5及び節点7間、
節点2及び節点7間、
節点8及び節点9間、
節点1及び節点4間、
節点1及び節点7間。
(異常度A)=(xに接続している破壊モデルを表す枝数)÷(xに接続しているすべての枝数)・・・(式3)。
次に、上述した第1の実施形態における主要な機能を実現する本発明の第2の実施形態について説明する。
上述した本発明の各実施形態におけるシステム監視装置を、1つの計算処理装置(情報処理装置、コンピュータ)を用いて実現するハードウェア資源の構成例について説明する。但し、係るシステム監視装置は、物理的または機能的に少なくとも2つの計算処理装置を用いて実現してもよい。また、係るシステム監視装置は、専用の装置として実現してもよい。
21 CPU
22 メモリ
23 ディスク
24 不揮発性記録媒体
25 入力装置
26 出力装置
27 通信IF
28 ディスプレー
101 システム監視装置
102 指標入力部
103 情報作成部
104 モデル情報作成部
105 確率情報作成部
106 異常算出部
107 破壊検出部
108 異常度算出部
109 異常判定部
110 異常箇所出力部
111 記憶部
112 時系列記憶部
113 情報記憶部
114 モデル情報記憶部
115 確率情報記憶部
116 異常記憶部
117 破壊モデル記憶部
118 異常度記憶部
119 異常箇所記憶部
120 センサ
121 監視対象
122 表示部
201 システム監視装置
202 判定部
203 異常度算出部
204 第1程度算出部
205 第2程度算出部
206 状態算出部
Claims (10)
- 監視対象に関して、第1期間に測定された複数セットの第1時系列データに成り立つ関係を表す関係性が、第2期間に測定された前記複数セットの第2時系列データについて成り立つか否かを判定する判定手段と、
前記判定手段が成り立つと判定する前記関係性と、前記判定手段が成り立たないと判定する前記関係性とに基づき、前記第2時系列データが異常である程度を表す異常度を算出する異常度算出手段と、
前記第2時系列データに関して算出された前記異常度に基づき、前記第2時系列データが正常または異常である場合において前記異常度が特定の値である程度を表す第1程度を算出する第1程度算出手段と、
前記第1期間に関する前記関係性に基づき、前記複数セットの前記第2時系列データが関連している程度を表す第2程度を算出する第2程度算出手段と、
前記第1程度と、前記第2程度とに基づき、前記第2時系列データが正常であるか異常であるかを求める状態算出手段と
を備えるシステム監視装置。 - 前記判定手段は、前記第2時系列データに前記関係性を適用することにより算出された値に関する誤差に基づき、前記関係性が成り立つか否かを判定する
請求項1に記載のシステム監視装置。 - 前記第2程度算出手段は、複数の前記第2時系列データが前記関係性に関連しているか否かに応じて、前記第2程度を算出する
請求項1または請求項2に記載のシステム監視装置。 - 前記第1程度算出手段は、前記異常度にベータ分布を適用することにより、前記第1程度を算出する
請求項1乃至請求項3のいずれかに記載のシステム監視装置。 - 前記第1程度算出手段は、前記異常度にガンマ分布を適用することにより、前記第1程度を算出する
請求項1乃至請求項3のいずれかに記載のシステム監視装置。 - 前記第2程度算出手段は、前記関係性に基づくイジングモデルに従い、前記第2程度を算出する
請求項1乃至請求項5のいずれかに記載のシステム監視装置。 - 前記状態算出手段は、前記第2時系列データを表す第1節点と、前記第1節点とは異なる第2節点と、前記第1節点及び前記第2節点とは異なる第3節点とを含む節点と、複数の前記第1節点の間を結ぶ第1枝と、前記第1節点及び前記第2節点を結ぶ第2枝と、前記第1節点及び前記第3節点とを結ぶ第3枝からなるグラフに関して、前記第1枝に関する重みを、前記第2程度に基づき算出し、前記第2枝及び前記第3枝に関する前記重みを、前記第1程度に基づき算出し、重み付けされた前記グラフを2つに分離する場合に切断される前記重みを最小にする最小カットを算出し、算出された結果に基づき、正常であるか否かを算出する
請求項1乃至請求項6のいずれかに記載のシステム監視装置。 - 前記グラフを表示可能な表示手段
をさらに備え、
前記状態算出手段は、重み付けされた前記グラフを前記表示手段に表示する
請求項7に記載のシステム監視装置。 - 監視対象に関して、第1期間に測定された複数セットの第1時系列データに成り立つ関係を表す関係性が、第2期間に測定された前記複数セットの第2時系列データについて成り立つか否かを判定し、
成り立つと判定された前記関係性と、成り立たないと判定する前記関係性とに基づき、前記第2時系列データが異常である程度を表す異常度を算出し、
前記第2時系列データに関して算出された前記異常度に基づき、前記第2時系列データが正常または異常である場合において前記異常度が特定の値である程度を表す第1程度を算出し、
前記第1期間に関する前記関係性に基づき、前記複数セットの前記第2時系列データが関連する程度を表す第2程度を算出し、
前記第1程度と、前記第2程度とに基づき、前記第2時系列データが正常であるか異常であるかを求めるシステム監視方法。 - 監視対象に関して、第1期間に測定された複数セットの第1時系列データに成り立つ関係を表す関係性が、第2期間に測定された前記複数セットの第2時系列データについて成り立つか否かを判定する判定機能と、
前記判定機能によって成り立つと判定された前記関係性と、前記判定機能によって成り立たないと判定された前記関係性とに基づき、前記第2時系列データが異常である程度を表す異常度を算出する異常度算出機能と、
前記第2時系列データに関して算出された前記異常度に基づき、前記第2時系列データが正常または異常である場合において前記異常度が特定の値である程度を表す第1程度を算出する第1程度算出機能と、
前記第1期間に関する前記関係性に基づき、前記複数セットの前記第2時系列データが関連している程度を表す第2程度を算出する第2程度算出機能と、
前記第1程度と、前記第2程度とに基づき、前記第2時系列データが正常であるか異常であるかを求める状態算出機能と
をコンピュータに実現させるシステム監視プログラムが記録された記録媒体。
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2017501909A JP6828679B2 (ja) | 2015-02-25 | 2016-02-17 | システム監視装置、システム監視方法、及び、システム監視プログラム |
US15/553,435 US10539468B2 (en) | 2015-02-25 | 2016-02-17 | Abnormality detection apparatus, abnormality detection method, and non-transitory computer-readable medium |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2015-034631 | 2015-02-25 | ||
JP2015034631 | 2015-02-25 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2016136198A1 true WO2016136198A1 (ja) | 2016-09-01 |
Family
ID=56788436
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2016/000827 WO2016136198A1 (ja) | 2015-02-25 | 2016-02-17 | システム監視装置、システム監視方法、及び、システム監視プログラムが記録された記録媒体 |
Country Status (3)
Country | Link |
---|---|
US (1) | US10539468B2 (ja) |
JP (1) | JP6828679B2 (ja) |
WO (1) | WO2016136198A1 (ja) |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2019016039A (ja) * | 2017-07-04 | 2019-01-31 | Jfeスチール株式会社 | プロセスの異常状態診断方法および異常状態診断装置 |
WO2019026193A1 (ja) * | 2017-08-02 | 2019-02-07 | 日本電気株式会社 | 情報処理装置、情報処理システム、情報処理方法、及び、記録媒体 |
JP2019159610A (ja) * | 2018-03-09 | 2019-09-19 | 富士通株式会社 | レポート作成プログラム、およびレポート作成方法 |
JP2019203759A (ja) * | 2018-05-22 | 2019-11-28 | 株式会社日立製作所 | データ処理装置およびデータ処理方法 |
JPWO2020136859A1 (ja) * | 2018-12-28 | 2021-11-11 | 日本電気株式会社 | 推定装置、推定方法、及びプログラム |
Families Citing this family (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11113364B2 (en) * | 2017-05-08 | 2021-09-07 | Hitachi, Ltd. | Time series data analysis control method and analysis control device |
JP6919596B2 (ja) * | 2018-03-01 | 2021-08-18 | オムロン株式会社 | 計測システムおよび方法 |
JP7268722B2 (ja) * | 2019-03-27 | 2023-05-08 | 日産自動車株式会社 | 異常検知装置、及び異常検知方法 |
TWI829895B (zh) * | 2020-03-20 | 2024-01-21 | 中華電信股份有限公司 | 基於健康度之模型監控系統及其方法 |
JP7481897B2 (ja) * | 2020-05-12 | 2024-05-13 | 株式会社東芝 | 監視装置、監視方法、プログラムおよびモデル訓練装置 |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2006135412A (ja) * | 2004-11-02 | 2006-05-25 | Tokyo Gas Co Ltd | 遠隔監視システム |
JP2009199533A (ja) * | 2008-02-25 | 2009-09-03 | Nec Corp | 運用管理装置、運用管理システム、情報処理方法、及び運用管理プログラム |
JP2009211472A (ja) * | 2008-03-05 | 2009-09-17 | Fuji Xerox Co Ltd | 故障診断装置およびプログラム |
JP5267684B2 (ja) * | 2010-01-08 | 2013-08-21 | 日本電気株式会社 | 運用管理装置、運用管理方法、及びプログラム記憶媒体 |
JP2013210945A (ja) * | 2012-03-30 | 2013-10-10 | Toshiba Corp | 波形分析装置および波形分析方法 |
Family Cites Families (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPS5267684A (en) | 1975-12-02 | 1977-06-04 | Nippon Bunko Kogyo Kk | Spectrophotometer |
-
2016
- 2016-02-17 WO PCT/JP2016/000827 patent/WO2016136198A1/ja active Application Filing
- 2016-02-17 JP JP2017501909A patent/JP6828679B2/ja active Active
- 2016-02-17 US US15/553,435 patent/US10539468B2/en active Active
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2006135412A (ja) * | 2004-11-02 | 2006-05-25 | Tokyo Gas Co Ltd | 遠隔監視システム |
JP2009199533A (ja) * | 2008-02-25 | 2009-09-03 | Nec Corp | 運用管理装置、運用管理システム、情報処理方法、及び運用管理プログラム |
JP2009211472A (ja) * | 2008-03-05 | 2009-09-17 | Fuji Xerox Co Ltd | 故障診断装置およびプログラム |
JP5267684B2 (ja) * | 2010-01-08 | 2013-08-21 | 日本電気株式会社 | 運用管理装置、運用管理方法、及びプログラム記憶媒体 |
JP2013210945A (ja) * | 2012-03-30 | 2013-10-10 | Toshiba Corp | 波形分析装置および波形分析方法 |
Cited By (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2019016039A (ja) * | 2017-07-04 | 2019-01-31 | Jfeスチール株式会社 | プロセスの異常状態診断方法および異常状態診断装置 |
WO2019026193A1 (ja) * | 2017-08-02 | 2019-02-07 | 日本電気株式会社 | 情報処理装置、情報処理システム、情報処理方法、及び、記録媒体 |
US11941495B2 (en) | 2017-08-02 | 2024-03-26 | Nec Corporation | Information processing device, information processing method, and recording medium |
JPWO2019026193A1 (ja) * | 2017-08-02 | 2020-07-02 | 日本電気株式会社 | 情報処理装置、情報処理システム、情報処理方法、及び、プログラム |
JP2019159610A (ja) * | 2018-03-09 | 2019-09-19 | 富士通株式会社 | レポート作成プログラム、およびレポート作成方法 |
JP6996360B2 (ja) | 2018-03-09 | 2022-01-17 | 富士通株式会社 | レポート作成プログラム、およびレポート作成方法 |
KR20210002594A (ko) * | 2018-05-22 | 2021-01-08 | 가부시키가이샤 히타치세이사쿠쇼 | 데이터 처리 장치 및 데이터 처리 방법 |
WO2019225125A1 (ja) * | 2018-05-22 | 2019-11-28 | 株式会社日立製作所 | データ処理装置およびデータ処理方法 |
KR102562115B1 (ko) | 2018-05-22 | 2023-08-02 | 가부시키가이샤 히타치세이사쿠쇼 | 데이터 처리 장치 및 데이터 처리 방법 |
JP2019203759A (ja) * | 2018-05-22 | 2019-11-28 | 株式会社日立製作所 | データ処理装置およびデータ処理方法 |
JPWO2020136859A1 (ja) * | 2018-12-28 | 2021-11-11 | 日本電気株式会社 | 推定装置、推定方法、及びプログラム |
US11579600B2 (en) | 2018-12-28 | 2023-02-14 | Nec Corporation | Estimation apparatus, estimation method, and computer-readable storage medium |
JP7283485B2 (ja) | 2018-12-28 | 2023-05-30 | 日本電気株式会社 | 推定装置、推定方法、及びプログラム |
Also Published As
Publication number | Publication date |
---|---|
US10539468B2 (en) | 2020-01-21 |
US20180245987A1 (en) | 2018-08-30 |
JPWO2016136198A1 (ja) | 2017-12-07 |
JP6828679B2 (ja) | 2021-02-10 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2016136198A1 (ja) | システム監視装置、システム監視方法、及び、システム監視プログラムが記録された記録媒体 | |
JP6394726B2 (ja) | 運用管理装置、運用管理方法、及びプログラム | |
US10747188B2 (en) | Information processing apparatus, information processing method, and, recording medium | |
US9274869B2 (en) | Apparatus, method and storage medium for fault cause extraction utilizing performance values | |
EP2963553B1 (en) | System analysis device and system analysis method | |
EP3015989A1 (en) | System analysis device, system analysis method and system analysis program | |
JP5768983B2 (ja) | 契約違反予測システム、契約違反予測方法および契約違反予測プログラム | |
EP2963552B1 (en) | System analysis device and system analysis method | |
JP4573179B2 (ja) | 性能負荷異常検出システム、性能負荷異常検出方法、及びプログラム | |
EP2690559B1 (en) | Operation administration system, operation administration method, and program | |
JP2020052714A (ja) | 監視システム及び監視方法 | |
CN112380073B (zh) | 一种故障位置的检测方法、装置及可读存储介质 | |
US10157113B2 (en) | Information processing device, analysis method, and recording medium | |
BR102015000309A2 (pt) | método para um sistema de estimativa da vida útil restante |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16754950 Country of ref document: EP Kind code of ref document: A1 |
|
ENP | Entry into the national phase |
Ref document number: 2017501909 Country of ref document: JP Kind code of ref document: A |
|
WWE | Wipo information: entry into national phase |
Ref document number: 15553435 Country of ref document: US |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 16754950 Country of ref document: EP Kind code of ref document: A1 |