Abnormality management device and abnormality management method

Abstract

The purpose is to easily manage abnormal program operation. [Solution] The abnormality management device 1 includes a first learning unit 11 that uses normal data indicating processing resource usage data in which the processing resource usage corresponding to each process ID is normal as training data from among a plurality of processing resource usage data each including the usage of processing resources used in executing a process corresponding to each process ID, and learns parameters of a probability model that outputs a posterior probability that the processing resource usage corresponding to each process ID is normal by maximum likelihood estimation, and a derivation unit 12 that derives a probability distribution of abnormal data indicating processing resource usage data including abnormal processing resource usage based on the posterior probability estimated by the learned probability model, the probability distribution of the normal data, and the prior probability of normality.

Description

[Technical Field]

[0001] The present invention relates to an abnormality management device and an abnormality management method. [Background technology]

[0002] In recent years, the demands on software have become more sophisticated and complex in order to provide high-performance systems and services. The software implemented in high-performance systems consists of programs with huge amounts of source code, and the execution of these programs is becoming increasingly complex.

[0003] When a process failure or an abnormal operation occurs in an operating system, identifying the cause of the program failure or abnormal operation is complicated, time-consuming, and not easy. For example, Patent Document 1 discloses a method for using a core file to retroactively identify the location of the error and the variable values ​​at the time.

[0004] However, the technology disclosed in Patent Document 1 requires analysis of the source code because it is not possible to identify the cause or location of an error from log information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2005-301570 Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, with conventional techniques, it has not been possible to easily manage abnormal program operation.

[0007] The present invention has been made to solve the above-mentioned problems, and has as its object to easily manage abnormalities in program operation. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, the abnormality management device of the present invention includes: a first learning unit configured to use normal data, which indicates that the processing resource usage corresponding to each process ID is normal, as training data among a plurality of processing resource usage data each including usage amounts of processing resources used in executing a process corresponding to each process ID, to learn parameters of a probability model that outputs a posterior probability that the processing resource usage corresponding to each process ID is normal, by maximum likelihood estimation; a derivation unit configured to derive a probability distribution of abnormal data indicating processing resource usage data including abnormal processing resource usage, based on the posterior probability estimated by the learned probability model, the probability distribution of the normal data, and the prior probability of normality; a data processing unit configured to obtain processing resource usage data of the abnormal data based on the derived probability distribution of the abnormal data; a second learning unit configured to learn a generator that generates pseudo-abnormal data that is statistically similar to the true abnormal data, using the processing resource usage data of the abnormal data obtained by the data processing unit as true abnormal data; and a memory unit configured to store the pseudo-abnormal data generated using the trained generator constructed by the second learning unit.

[0009] In addition, the abnormality management device of the present invention may further include a collection unit configured to collect processing resource usage data of managed objects, and a judgment unit configured to judge that an operational abnormality has occurred in a process in the processing resource usage data of the managed objects when the collected processing resource usage data of the managed objects matches the pseudo-abnormal data stored in the memory unit.

[0010] In addition, the abnormality management device of the present invention may further include an instruction unit configured to send an instruction to execute a predetermined response to resolve the operational abnormality of the process when the judgment unit determines that an operational abnormality has occurred in the process.

[0011] Furthermore, in the anomaly management device according to the present invention, the second learning unit may perform adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data.

[0012] In order to solve the above-mentioned problems, an anomaly management method according to the present invention includes: a first learning step of using normal data, as training data, from a plurality of processing resource usage data each including usage amounts of processing resources used in executing a process corresponding to each process ID, which normal data indicates that the processing resource usage amount corresponding to each process ID is normal; a derivation step of deriving a probability distribution of abnormal data indicating processing resource usage data including abnormal processing resource usage amounts, based on the posterior probability estimated by the trained probability model, a probability distribution of the normal data, and a prior probability of normality; a data processing step of obtaining processing resource usage data of the abnormal data, based on the derived probability distribution of the abnormal data; a second learning step of using the processing resource usage data of the abnormal data obtained in the data processing step as true abnormal data, to learn a generator that generates pseudo-abnormal data that is statistically similar to the true abnormal data; and a storage step of storing the pseudo-abnormal data generated using the trained generator constructed in the second learning step in a storage unit.

[0013] In addition, the abnormality management method of the present invention may further include a collection step of collecting processing resource usage data of the managed object, and a determination step of determining that an operational abnormality has occurred in a process in the processing resource usage data of the managed object if the collected processing resource usage data of the managed object matches the pseudo-abnormality data stored in the memory unit.

[0014] Furthermore, the abnormality management method according to the present invention may further include an instruction step of sending an instruction to execute a predetermined response to resolve the operational abnormality of the process when it is determined in the determination step that an operational abnormality has occurred in the process.

[0015] In addition, in the anomaly management method according to the present invention, the second learning step may perform adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo anomalous data generated by the generator and the true anomalous data. [Effects of the Invention]

[0016] According to the present invention, among a plurality of processing resource usage data each including the usage of processing resources used in the execution of a process corresponding to each process ID, normal data indicating that the processing resource usage corresponding to each process ID is normal is used as training data, and parameters of a probabilistic model that outputs the posterior probability that the processing resource usage corresponding to each process ID is normal are learned by maximum likelihood estimation, thereby making it possible to easily manage program operation abnormalities. [Brief explanation of the drawings]

[0017] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality management system including an abnormality management device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining abnormal data of signals managed by the abnormality management device according to this embodiment. [Figure 3] FIG. 3 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 4] FIG. 4 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 5] FIG. 5 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 6]FIG. 6 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 7] FIG. 7 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 8] FIG. 8 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 9] FIG. 9 is a flowchart showing the operation of the abnormality management device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0018] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0019] [Configuration of anomaly management system] First, with reference to FIG. 1, an overview of an abnormality management system including an abnormality management device 1 according to an embodiment of the present invention will be described.

[0020] The fault management system includes a fault management device 1 and an information processing device 2. The fault management device 1 and the information processing device 2 are connected via a network NW. The fault management system according to this embodiment builds a database of fault data for detecting operational faults in processes based on the CPU usage rate (processing resource usage data) of the processes executed by the information processing device 2.

[0021] The network NW includes, for example, wired networks such as LAN, WAN, the Internet, and ISDN, as well as wireless networks such as wireless LAN and mobile communication networks using LTE / 4G, 5G, and 6G wireless communication systems, but the scope of the present invention is not limited to these.

[0022] The information processing device 2 can be realized as a server, a gateway, a desktop computer, an embedded device, a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, etc. In this embodiment, the information processing device 2 is not limited to one device, but includes the case of multiple devices. In the case of multiple devices, each information processing device 2 executes the same process generated by the same application or the same executable file.

[0023] The information processing device 2 is uniquely identified by network identification information such as an IP address or a MAC address, or a device ID assigned by an anomaly management system. The information processing device 2 can be realized by a computer equipped with a processor, a main memory device, a communication interface, an auxiliary memory device, and an input / output (I / O), and a program that controls these hardware resources.

[0024] The information processing device 2 runs one or more applications (processes) on the OS, and each process is assigned a unique process ID (PID) by the OS. A process ID is assigned to each execution unit of a process, and even the same application may have a different process ID depending on the execution environment and timing. The information processing device 2 calculates the CPU usage rate for each process ID corresponding to the running process and records it in memory. If the configurations of the CPUs of the multiple information processing devices 2, such as the number of cores and clock speed, are not the same, the CPU usage rate recorded by each information processing device 2 is normalized or corrected using each CPU benchmark, etc. The normalization or correction process may be performed by the abnormality management device 1.

[0025] In this embodiment, CPU usage rate for each process ID is used as the processing resource usage data, but the processing resource usage data may also be memory usage rate for each process ID, I / O wait time for each process ID, etc. Figure 2(a) is a diagram showing normal data a1, which is a normal CPU usage rate, and abnormal data b1, which includes abnormal CPU usage rates. The horizontal axis represents process IDs, which are arranged in the order in which the processes were executed. The vertical axis represents CPU usage rate [%]. Within the range of process IDs in area c, the CPU usage rate of abnormal data b1 is an abnormal value. The abnormal value of CPU usage rate is caused by an abnormal operation of a process executed by information processing device 2.

[0026] A state in which an operational abnormality occurs in a process executed by the information processing device 2 refers to a state in which the process deviates from its normal load range, such as excessive consumption of processing resources. For example, this state applies when the CPU usage rate for each process ID exceeds a preset threshold, or when a normal CPU usage rate range is defined according to the attributes of the process and the CPU usage rate falls outside that range and deviates from the normal load range. Furthermore, even if the CPU usage rate does not exceed the threshold, a predefined CPU usage rate pattern can be used as the load state pattern when an operational abnormality occurs in the process.

[0027] In this way, when a process is behaving abnormally, it is assumed that abnormal processing such as an infinite loop or excessive recursive calls is occurring in the execution of the process associated with that process ID.On the other hand, normal CPU usage means that no abnormal processing is occurring in the execution of the process associated with each process ID, and CPU resource consumption is within a normal range.

[0028] [Function block of the abnormality management device] Next, functional blocks of the fault management device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the fault management device 1 includes a collection unit 10, a first learning unit 11, a derivation unit 12, a data processing unit 13, a second learning unit 14, a generation unit 15, a storage unit 16, a determination unit 17, and an instruction unit 18.

[0029] The collection unit 10 collects, via the network NW, a plurality of CPU usage data, each of which includes a CPU usage rate, which is the processing resource usage rate of a process corresponding to each process ID recorded in the information processing device 2. The collection unit 10 can collect CPU usage rates, which are processing resource usage data, from a plurality of information processing devices 2. The collection unit 10 collects normal data, which indicates normal CPU usage rate data, for the CPU usage rate of each process ID used for learning by the first learning unit 11. The collection unit 10 also collects CPU usage rate data of the management target, which is the target for abnormality determination by the determination unit 17.

[0030] The first learning unit 11 uses normal data indicating that the CPU utilization rate corresponding to each process ID is normal as training data from among a plurality of CPU utilization rate data that are processing resource utilization data, each of which includes a CPU utilization rate that is the utilization amount of processing resources used in executing a process corresponding to each process ID, to learn parameters of a probabilistic model that outputs a posterior probability that the CPU utilization rate corresponding to each process ID is normal by maximum likelihood estimation. The first learning unit 11 can use a plurality of CPU utilization rate data that includes a certain amount or more of normal data as training data.

[0031] Here, x is the CPU usage rate x in the process execution corresponding to a process ID at a certain observation point. Also, as shown in the following equation (1), the density function of normal data is expressed as ρ d (x), the density function of the abnormal data is ρ g (x) and (x) respectively.

number

[0032] In the above formula (1), y=1 indicates the normal class, and y=0 indicates the abnormal class. d (x) indicates the appearance tendency of CPU usage rate x when it belongs to normal class y=1, and ρ g(x) shows the tendency of CPU usage x when it belongs to the abnormal class y=0. Here, (b) in Figure 2 shows the CPU usage on the horizontal axis and the probability distribution on the vertical axis, and shows the density function (probability distribution) a2 of normal data and the density function (probability distribution) b2 of abnormal data at the data points of the black circles for normal data a1 and abnormal data b1 in (a) in Figure 2. In the example of (b) in Figure 2, the probability distributions of both normal data and abnormal data follow normal distributions.

[0033] The density ratio γ(x) of the density function in the above equation (1) is expressed by the following equation (2):

number

[0034]

number

[0035] Here, if π=ρ(y=1), the above equation (3) can be further expressed as the following equation (4).

number

[0036] Therefore, we first calculate the posterior probability ρ(y=1|x) that the observed value x is normal (y=1) in large quantities. Assuming that the posterior probability ρ(y=1|x) of normal data follows a normal distribution, it is defined as shown in the following equation (5).

number

[0037] Furthermore, the output of the probabilistic model f(x n ) can be expressed as a linear combination as shown in the following equation (6).

number

[0038]

number

[0039]

number

[0040] Furthermore, the CPU utilization f(x) is estimated based on the learned parameter w. n ) and the actual normal CPU usage t n The average error from the (teacher signal) is the variance σ of the normal distribution shown in the following equation (9). 2 The value becomes

number

[0041] In this way, when a linear combination of probabilistic models estimates the posterior probability that CPU usage is normal for an input x, each observed value t is calculated based on the estimated value f(x n ) is assumed to follow a normal distribution with mean x n ,t n ) to obtain the parameters w and error variance σ of the probability model. 2 In addition, from the definition of the normal distribution in equation (5) above, the density function ρ d (x) is found.

[0042] Here, if we approximately estimate the posterior probability ρ(y=1|x) of normal data, then ρ(y=1|x)≒q w The relationship is (y=1|x). The posterior probability that the input CPU usage rate x is normal is estimated as q w Based on (y=1|x), the cross entropy is defined as the loss function U as shown in the following equation (10).

number

[0043] The convergence value (minimum value) of the loss function U in the above equation (10) is expressed by the following equation (11).

number

[0044] The derivation unit 12 transforms the above formula (11) into the following formula (12), and calculates the density function ρ g Derive (x).

number

[0045] In the above equation (12), the probability distribution of normal data, i.e., the density function of normal data, ρ d (x) is calculated from normal data collected by the collection unit 10. The prior probability of normal data, π, is much larger than the prior probability of abnormal data, (1-π), and can be set to, for example, 0.99. Furthermore, the logarithmic likelihood lnq when y=1 for the observed value x is w As shown in the above equations (6) to (9), (y=1|x) is calculated by maximum likelihood estimation based on a large amount of normal data (teacher signal). In this way, even if there is a small amount of abnormal data, the probability distribution of abnormal data can be calculated from the normal data.

[0046] The derivation unit 12 calculates the estimated value q of the posterior probability estimated by the probability model learned by the first learning unit 11. w (y=1|x) and the density function ρ of normal data d Based on (x) and the prior probability of normality π, the density function ρ of abnormal data indicating abnormal CPU usage is g Derive (x).

[0047] The data processing unit 13 obtains CPU utilization data related to the abnormal data based on the derived probability distribution of the abnormal data. The data processing unit 13 calculates the density function ρ gBy using (x), for example, by random sampling to generate values ​​of CPU utilization in an abnormal state and sorting them in order by process ID, CPU utilization data related to abnormal data can be obtained. Furthermore, the data processing unit 13 can obtain CPU utilization related to abnormal data corresponding to any multiple data points in the range c of process IDs in which an abnormal state occurs in (a) of Figure 2.

[0048] The second learning unit 14 learns a generator 141 that generates pseudo-anomalous data that is statistically similar to true abnormal data, using the CPU usage rate data of the abnormal data obtained by the data processing unit 13 as true abnormal data. The second learning unit 14 performs adversarial learning of a generative model that includes, for example, the generator 141 and a classifier 142 that distinguishes between the pseudo-anomalous data generated by the generator 141 and true abnormal data.

[0049] As shown in FIG. 3, the second learning unit 14 performs adversarial learning on a GAN (Generative Adversarial Network) having a generator 141 and a classifier 142.

[0050] 4 and 5 are diagrams schematically illustrating the neural network configurations of the generator 141 and the classifier 142 of the GAN used by the second learning unit 14. As shown in FIG. 4, the generator 141 is configured as a neural network having an input layer, a hidden layer, and an output layer. The generator 141 is a model that generates pseudo-anomalous data from random noise. For example, m randomly sampled Gaussian noise vectors (z1 to z m ).

[0051] The generator 141 performs a product-sum operation on the input and weight parameters and performs threshold processing using an activation function to output the output G(z). The output G(z) from the generator 141 is data similar to true abnormal data. CNN or ResNet can be used as the neural network that constitutes the generator 141.

[0052] The classifier 142 shown in Fig. 5 is configured with a neural network having an input layer, a hidden layer, and an output layer. In the example of Fig. 5, CPU usage rate data of abnormal data obtained by the data processing unit 14 as a result of learning by the first learning unit 11 is provided as input of training data.

[0053] The classifier 142 outputs a binary value of 1 or 0 after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The classifier 142 outputs an output y=1 when it correctly identifies the training data related to the input true anomalous data as true anomalous data. On the other hand, it outputs an output y=0 when it correctly identifies the training data related to the input pseudo anomalous data as pseudo anomalous data. In this way, the classifier 142 is a model that distinguishes the model distribution generated by the generator 141 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 142.

[0054] FIG. 3 is a block diagram for explaining the adversarial learning of GAN by the second learning unit 14. The generator 141 of the GAN adopted by the second learning unit 14 is represented as a function G, and the classifier 142 is represented as a function D. Furthermore, true abnormal data is represented as x, the predicted value output by the classifier 142 is represented as y, and the correct label is represented as t. The correct label t is set to 1 for true abnormal data and 0 for pseudo abnormal data generated by the generator 141. In this case, the classifier 142 calculates the cross entropy E CE It can be expressed as:

[0055]

number

[0056] The first term in the brace of the above equation (13) represents t n lny n In this case, the predicted value y n is the correct label for the true anomaly data, t n = 1. On the other hand, the second term in the braces represents (1-t n)ln(1-y n ), the predicted value y n is the correct label value (1-t n ) = 0. In this way, the cross entropy E CE is the maximum value when the predicted value matches the correct label value.

[0057] Here, the generator 141 constituting the GAN has parameters w G ,θ G and the function G(w G ,θ G ) The classifier 142 uses the parameter w D ,θ D and function D(w D ,θ D ) The cross entropy E in the above equation (13) CE The objective function E of the GAN including the generator 141 and the discriminator 142 based on the above can be expressed by the following equation (14).

number

[0058] The first term of the above equation (14) represents E D(x)=1 lnD(w D ,θ D ) is the expected value at which the classifier 142 classifies true abnormal data as true abnormal data. D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D )) is the expected value at which the classifier 142 classifies the pseudo-anomalous data generated by the generator 141 as pseudo-anomalous data. In GAN learning, the generator 141 and the classifier 142 are trained adversarially through min-max optimization of the objective function E. Therefore, the generator 141 is trained to be able to generate pseudo-anomalous data that can fool the classifier 142, and the classifier 142 is trained to classify the pseudo-anomalous data generated by the generator 141 as pseudo-anomalous data.

[0059] In learning of the classifier 142, when true abnormal data is given, the classifier 142 outputs an output close to y=1, thereby maximizing the first term of the objective function E in the above equation (14). On the other hand, when pseudo abnormal data is given, the classifier 142 learns to output an output close to y=0, thereby maximizing the second term of the objective function E.

[0060] In the learning of the generator 141, D(G(w G ,θ G ),w D ,θ D ) (D(G(z)) in Figure 3) is close to 1. G ,θ G ) (G(z) in FIG. 3 ), thereby minimizing the objective function E. The second learning unit 14 uses a learning procedure that alternately updates the parameters of the generator 141 and the classifier 142. Details of the learning procedure of the generator 141 and the classifier 142 by the second learning unit 14 will be described later.

[0061] The generation unit 15 generates pseudo abnormal data using a trained generator 141′ in which the objective function E of the GAN has been optimized by the second learning unit 14.

[0062] The storage unit 16 stores the generated pseudo abnormal data as well as the true abnormal data obtained by the data processing unit 13.

[0063] The determination unit 17 determines that an abnormal operation of a process has occurred in the CPU utilization data of the managed object when the CPU utilization data of the managed object collected by the collection unit 10 matches the pseudo-abnormal data stored in the storage unit 16. More specifically, when the CPU utilization data matches the pseudo-abnormal data and true abnormal data stored in the storage unit 16, the determination unit 17 identifies the process ID in which the abnormal CPU utilization is occurring and the corresponding process.

[0064] When the determination unit 17 determines that an abnormality in the process has occurred, the instruction unit 18 sends an instruction to execute a predetermined response to resolve the abnormality in the process. For example, the instruction unit 18 can send, via the network NW, to the information processing device 2, the process ID of the process in which the abnormal CPU usage rate has occurred and an instruction to terminate and restart the corresponding process.

[0065] [Hardware configuration of the fault management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the above-described functions will be described with reference to FIG.

[0066] 6, the fault management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program for controlling these hardware resources. Furthermore, the fault management device 1 includes a display device 107.

[0067] The processor 102 is realized by a CPU, a GPU, an FPGA, an ASIC, or the like.

[0068] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the abnormality management device 1, such as the collection unit 10, the first learning unit 11, the derivation unit 12, the data processing unit 13, the second learning unit 14, the generation unit 15, the determination unit 17, and the instruction unit 18 shown in FIG.

[0069] The communication interface 104 is an interface circuit for connecting the abnormality management device 1 to various external electronic devices via a network.

[0070] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0071] The auxiliary storage device 105 has a program storage area for storing the abnormality management program. The auxiliary storage device 105 also has a program storage area for storing a learning program for performing GAN adversarial learning executed by the abnormality management device 1. The auxiliary storage device 105 also has a program storage area for storing a first learning program executed by the abnormality management device 1. The auxiliary storage device 105 realizes the storage unit 16 described in FIG. 1. Furthermore, for example, the auxiliary storage device 105 may have a backup area for backing up the above-mentioned data, programs, etc.

[0072] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0073] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can display the CPU utilization rate data collected from the information processing device 2 on the screen.

[0074] [Operation of the abnormality management device] Next, the operation of the abnormality management device 1 having the above-described configuration will be described with reference to the flowcharts of FIGS.

[0075] 7, first, the collection unit 10 collects CPU utilization data that includes a certain number of normal data or more (step S1). The collection unit 10 collects CPU utilization data that, for example, 99% is normal data from among the multiple CPU utilization data. The collection unit 10 can collect the CPU utilization data from the information processing device 2 via the network NW.

[0076] Next, the first learning unit 11 performs a first learning process (step S2). After that, the derivation unit 12 derives a density function of the abnormal data (step S3). FIG. 8 is a flowchart illustrating steps S2 and S3 in more detail. As shown in step S30 of FIG. 8, based on the CPU utilization data collected in step S1, which includes normal data at a rate above a certain level, the first learning unit 11 uses the normal data as training data to derive an estimated value q of the posterior probability that the CPU utilization x is normal. w Parameters w,σ of the probabilistic model that outputs (y=1|x) 2 is learned by maximum likelihood estimation (step S30).

[0077] In step S30, the first learning unit 11 performs learning by maximum likelihood estimation in accordance with the above equations (6) to (9). Also, in step S30, the first learning unit 11 uses the parameters w, σ estimated by maximum likelihood estimation. 2 From the probability model with w Find (y=1|x).

[0078] Furthermore, the first learning unit 11 calculates the density function ρ of normal data based on the normal CPU utilization rate x of the process corresponding to each process ID. d (x) (normal distribution) is estimated (step S31).

[0079] Next, the derivation unit 12 adds the log likelihood lnq of the posterior probability calculated in step S30 to the above equation (12). w (y=1|x), the density function ρ of the normal data obtained in step S31 d (x) and the prior probability of normal data π (e.g., 0.99) to obtain the density function ρ of the abnormal data. g (x) is derived (step S33).

[0080] Thereafter, the process proceeds to step S4 in Fig. 7. Subsequently, the data processing unit 13 calculates the density function ρ of the abnormal data derived in step S3. gBased on (x), the CPU utilization rate for each process ID of the abnormal data is sorted in order to obtain CPU utilization rate data (step S4). For example, in step S4, the density function ρ g From (x), create 10,000 data points centered around the median. If there are 1,000 process IDs, create (10,000 to the power of 1,000) CPU usage data points.

[0081] Next, the second learning unit 14 learns a generator 141 that generates pseudo-abnormal data that is statistically similar to the true abnormal data, using the CPU utilization data related to the abnormal data obtained in step S4 as the true abnormal data (step S5) (second learning process).

[0082] Specifically, the second learning unit 14 performs adversarial learning of a GAN having a generator 141 that generates pseudo-anomalous data similar to the true abnormal data, using the CPU usage rate data related to the abnormal data obtained in step S4 as true abnormal data, and a classifier 142 that distinguishes between the pseudo-anomalous data generated by the generator 141 and the true abnormal data. Details of the learning process in step S5 will be described later.

[0083] Next, the generation unit 15 generates pseudo abnormal data using the trained generator 141′ (step S6). The generated pseudo abnormal data is stored in the storage unit 16 (step S7). In step S7, the true abnormal data used as training data for the GAN is also stored in the storage unit 16.

[0084] Thereafter, the collection unit 10 collects CPU utilization data of the management target from the information processing device 2 (step S8). Next, the determination unit 17 determines that an operational abnormality has occurred in the process if the CPU utilization data collected in step S8 matches the pseudo-abnormal data or the true abnormal data stored in the storage unit 16 (step S9).

[0085] In step S9, it can be determined that an operational abnormality has occurred when the CPU utilization data of the managed object matches the pseudo-abnormal data or true abnormal data completely, or when it matches within a certain tolerance range. Additionally, the CPU utilization data can be collated sequentially for each process ID, and an operational abnormality can be determined when it matches, for example, a process ID in the process ID range c on the abnormal data curve b1 in FIG. 2(a) or a process ID before that range. The determination unit 17 identifies the process associated with the process ID in which the operational abnormality has occurred.

[0086] Next, when it is determined that an operational abnormality has occurred in the process, the instruction unit 18 sends an instruction to execute a predetermined measure to resolve the operational abnormality (step S10). The instruction unit 18 can send an instruction to terminate and restart the process associated with the identified process ID in which the operational abnormality has occurred to the information processing device 2 via the network NW.

[0087] Next, the second learning process (step S5) of the abnormality management device 1 described in FIG. 7 will be described with reference to FIG. 9. First, the second learning unit 14 inputs true abnormal data to the classifier 142 as training data 144, and adjusts the parameter w of the classifier 142 so that the true abnormal data is classified as true abnormal data (y=1). D ,θ D is learned and updated (step S20).

[0088] In step S20, the second learning unit 14 can cause the classifier 142 to learn true abnormal data using, for example, an error backpropagation method. By step S20, the classifier 142 that can distinguish true abnormal data from true abnormal data is constructed in advance.

[0089] Next, the second learning unit 14 generates Gaussian noise and provides a random vector of the generated Gaussian noise as an input to the generator 141 (step S21). Subsequently, the generator 141 calculates a random vector of the input z and the weight parameter w based on the provided Gaussian noise. G ,θ GThen, a product-sum operation and a threshold process using an activation function are performed to generate pseudo abnormal data G(z) (step S22).

[0090] Next, the second learning unit 14 learns the classifier 142. The learning of the classifier 142 is performed by using the parameter w D ,θ D First, the second learning unit 14 provides true abnormal data as training data 144 as input to the classifier 142. Then, the second learning unit 14 adjusts the parameter w by backpropagation or the like so that the objective function E in the above equation (14) is maximized. D ,θ D (Step S23). The label of the training data 144 is set to 1 (true abnormal data).

[0091] Next, the second learning unit 14 provides the pseudo abnormal data generated by the generator 141 in step S22 to the discriminator 142, and calculates the parameter w by backpropagation or the like so that the objective function E in the above equation (14) is maximized. D ,θ D That is, in steps S23 and S24, in order to maximize the objective function E in the above equation (14), the first term is updated as D(w D ,θ D )=1 is output, and the second term is D(G(w G ,θ G ),w D ,θ D )=0. Note that the training data 144 is set to a label of 0 (pseudo abnormal data).

[0092] The learning of the classifier 142 in steps S23 and S24 corresponds to the dashed arrows in the block diagram of the second learning unit 14 shown in FIG. 3 , which indicate that a classifier error is calculated in block 145 of the objective function E based on output 143 from the classifier 142, and then the error is backpropagated to the classifier 142.

[0093] Next, the second learning unit 14 performs learning of the generator 141. The learning of the generator 141 is performed with the parameters of the discriminator 142 fixed. The second learning unit 14 trains the generator 141 so that pseudo abnormal data is generated when random Gaussian noise is given to the generator 141. Specifically, the second learning unit 14 uses the backpropagation method or the like to learn the parameters w G ,θ G is updated (step S25).

[0094] The learning in step S25 corresponds to the flow indicated by the dashed arrow indicating backpropagation of error to the generator 141 in the block diagram of the second learning unit 14 in Fig. 3. That is, step S25 corresponds to the flow indicated by the dashed arrow in which pseudo abnormal data generated by the generator 141 in Fig. 3 is input to the discriminator 142, a generator error is calculated from the output 143 thereof in the block 145 of the objective function E, and the error is further backpropagated to the generator 141.

[0095] Thereafter, learning of the discriminator 142 and the generator 141 from step S22 to step S25 is repeated until the value of the objective function E reaches a Nash equilibrium and converges (step S26: NO). On the other hand, if the value of the objective function E has converged (step S26: YES), the processing from step S20 to step S26 is repeated using the remaining true abnormal data in turn until learning of the generator 141 and the discriminator 142 is performed (step S27: NO).

[0096] Thereafter, when the generator 141 and the classifier 142 have been trained using all true abnormal data (step S27: YES), the second learning unit 14 stores the trained generator 141' in the storage unit 16 (step S28). The trained generator 141' is constructed by the above-described processes from step S20 to step S28. After that, the process proceeds to step S6 in FIG. 7.

[0097] As described above, the abnormality management device 1 according to this embodiment estimates the posterior probability that CPU utilization is normal by learning the parameters of a probabilistic model that outputs the posterior probability that CPU utilization is normal using normal data as training data through maximum likelihood estimation. Furthermore, a density function for abnormal data is derived based on the estimated value of the posterior probability, the density function for normal data, and the prior probability for normal data. Furthermore, CPU utilization data related to the abnormal data obtained from the derived density function for the abnormal data is used as true abnormal data in the generative model, and pseudo-abnormal data similar to the true abnormal data is generated. The generated pseudo-abnormal data is stored in the memory unit 16 as a database together with the true abnormal data. This makes it possible to easily manage program operation abnormalities.

[0098] Furthermore, the abnormality management device 1 according to this embodiment compares the CPU usage rate for each process ID in the CPU usage rate data indicated by the pseudo abnormality data generated by the trained generator 141' with the CPU usage rate for each process ID in the actually collected CPU usage rate data, so that if a portion of the data matches, it becomes possible to predict an operational abnormality in the process. Therefore, when an operational abnormality in a program occurs, the cause of the operational abnormality can be easily identified.

[0099] In the embodiment described above, the second learning unit 14 performs GAN learning. However, the learning of the generator 141 can be performed using a VAE (Variational Autoencoder), a diffusion model, Energy-Based Models (EBMs), or the like in addition to adversarial learning.

[0100] The above describes embodiments of the abnormality management device and abnormality management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0101] 1...abnormality management device, 2...communication terminal, 3...base station, 4...core network, 10...collection unit, 11...first learning unit, 12...derivation unit, 13...data processing unit, 14...second learning unit, 15...generation unit, 16...memory unit, 17...judgment unit, 18...instruction unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, 141...generator, 142...identifier, NW...network.

Claims

1. a first learning unit configured to use normal data, which indicates that the processing resource usage amount corresponding to each process ID is normal, as training data among a plurality of processing resource usage data each including usage amounts of processing resources used in executing a process corresponding to each process ID, and to learn parameters of a probabilistic model that outputs a posterior probability that the processing resource usage amount corresponding to each process ID is normal, by maximum likelihood estimation; a derivation unit configured to derive a probability distribution of abnormal data indicating processing resource usage data including abnormal usage of the processing resource based on the posterior probability estimated by the trained probability model, the probability distribution of the normal data, and a prior probability of normality; a data processing unit configured to determine processing resource usage data for the abnormal data based on the derived probability distribution of the abnormal data; a second learning unit configured to learn a generator that generates pseudo-abnormal data that is statistically similar to the true abnormal data, using the processing resource usage data of the abnormal data obtained by the data processing unit as true abnormal data; a storage unit configured to store the pseudo abnormal data generated using the trained generator constructed by the second learning unit; An abnormality management device comprising:

2. 2. The abnormality management device according to claim 1, a collection unit configured to collect managed processing resource usage data; a determining unit configured to determine that an operational abnormality has occurred in a process in the processing resource usage data of the managed object when the collected processing resource usage data matches the pseudo-abnormal data stored in the storage unit; An abnormality management device comprising:

3. 3. The abnormality management device according to claim 2, and an instruction unit configured to, when the determination unit determines that an operational abnormality has occurred in the process, issue an instruction to execute a predetermined measure to resolve the operational abnormality in the process. An abnormality management device comprising:

4. 2. The abnormality management device according to claim 1, The second learning unit performs adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data. An abnormality management device characterized by:

5. A computer-implemented anomaly management method, comprising: a first learning step of learning, by maximum likelihood estimation, parameters of a probabilistic model that outputs a posterior probability that the processing resource usage corresponding to each process ID is normal, using normal data, among a plurality of processing resource usage data each including usage amounts of processing resources used in executing a process corresponding to each process ID, as training data, which data indicates that the processing resource usage corresponding to each process ID is normal; a derivation step of deriving a probability distribution of abnormal data indicating processing resource usage data including abnormal usage of the processing resource based on the posterior probability estimated by the trained probability model, the probability distribution of the normal data, and the prior probability of normality; a data processing step of determining processing resource usage data for the abnormal data based on the derived probability distribution of the abnormal data; a second learning step of learning a generator that generates pseudo-anomalous data that is statistically similar to the true abnormal data, using the processing resource usage data of the abnormal data obtained in the data processing step as true abnormal data; a storage step of storing the pseudo abnormal data generated using the trained generator constructed in the second learning step in a storage unit; An abnormality management method comprising:

6. 6. The abnormality management method according to claim 5, Further, a collection step of collecting managed processing resource usage data; a determining step of determining that an operational abnormality has occurred in a process in the processing resource usage data of the managed object when the collected processing resource usage data matches the pseudo-abnormal data stored in the storage unit; An abnormality management method comprising:

7. 7. The abnormality management method according to claim 6, and an instruction step of issuing an instruction to execute a predetermined measure to resolve the operational abnormality of the process when it is determined in the determination step that an operational abnormality has occurred in the process. An abnormality management method comprising:

8. 6. The abnormality management method according to claim 5, The second learning step performs adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data. An abnormality management method characterized by:

Images