Information processing device, information processing method, and program

Abstract

To streamline analysis of a command log obtained from a communication device.SOLUTION: An information processing device comprises: an acquisition unit which acquires a command log indicative of execution results of a command output from a communication device; a repetition cycle identification unit which extracts a repetition structure appearing in a plurality of log lines constituting the command log and identifies the cycle of the repetition structure; and a repetition location identification unit which identifies a location where the repetition structure appears in the command log.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] Currently, with the spread of high-quality video distribution services and communications by vehicles and IoT (Internet of Things), the communication networks built by telecommunications carriers are becoming large-scale and complex. Patent Document 1 discloses a technology for monitoring communication devices and their communication paths used in IP relay networks managed by telecommunications carriers. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2005-184638 A Summary of the Invention [Problem to be solved by the invention]

[0004] The communication devices that make up a communication network are becoming multi-vendor, and furthermore, the software and multiplexing of communication devices are progressing due to the advancement of virtualization technology. As communication networks become larger and more complex, network monitoring and management tasks such as troubleshooting are becoming very difficult. Therefore, it is considered important to improve the efficiency of analysis of command logs output from communication devices in order to improve the efficiency of network monitoring and management tasks.

[0005] Therefore, an object of the present invention is to provide a technique that enables more efficient analysis of command logs obtained from a communication device. [Means for solving the problem]

[0006] One aspect of the present disclosure provides an information processing device including an acquisition unit that acquires a command log indicating a result of command execution output from a communication device, a repetitive period identification unit that extracts a repetitive structure that appears in multiple log lines that make up the command log and identifies the period of the repetitive structure, a repetitive point identification unit that identifies the point at which the repetitive structure appears in the command log, and a characteristic information extraction unit that extracts information characterizing the repetitive structure from the command log.

[0007] Another aspect of the present disclosure provides an information processing method executed by an information processing device, the method including the steps of acquiring a command log indicating a result of command execution, output from a communication device, identifying a period of a repeating structure of a plurality of log lines constituting the command log, and identifying a position within the command log of the log lines constituting the repeating structure.

[0008] Yet another aspect of the present disclosure provides a program for causing a computer to execute the steps of acquiring a command log indicating a result of command execution, output from a communication device, identifying a period of a repeating structure of a plurality of log lines constituting the command log, and identifying a position within the command log of the log lines constituting the repeating structure. Effect of the Invention

[0009] According to the present invention, it is possible to provide a technique that makes it possible to efficiently analyze a command log obtained from a communication device. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing an example of the system configuration of a monitoring system according to this embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of the command log. [Diagram 3] FIG. 3 is a diagram showing an outline of a process in which the monitoring device identifies the period of a repetitive structure from a command log. [Figure 4]FIG. 4 is a diagram illustrating an example of a hardware configuration of the monitoring device. [Diagram 5] FIG. 5 is a diagram illustrating an example of a functional block configuration of the monitoring device. [Figure 6] FIG. 6 is a flowchart showing an example of a process in which the monitoring device generates a feature vector. [Figure 7A] FIG. 7A is a diagram showing an example of a command log before division. [Figure 7B] FIG. 7B is a diagram showing an example of the command log after it has been divided into blocks. [Figure 8A] FIG. 8A is a diagram illustrating an example of a processing procedure for identifying a period of a repeating structure appearing in a block. [Figure 8B] FIG. 8B is a diagram illustrating an example of a processing procedure for identifying a period of a repeating structure appearing in a block. [Figure 8C] FIG. 8C is a diagram illustrating an example of a processing procedure for identifying a period of a repeating structure appearing in a block. [Figure 8D] FIG. 8D is a diagram illustrating an example of a processing procedure for identifying a period of a repeating structure appearing in a block. [Figure 9A] FIG. 9A is a diagram illustrating an example of a processing procedure for identifying a location where a repetitive structure appears in a block. [Figure 9B] FIG. 9B is a diagram illustrating an example of a processing procedure for identifying a location where a repetitive structure appears in a block. [Figure 9C] FIG. 9C is a diagram illustrating an example of a processing procedure for identifying a location where a repetitive structure appears in a block. [Figure 9D] FIG. 9D is a diagram illustrating an example of a processing procedure for identifying a location where a repetitive structure appears in a block. [Figure 10] FIG. 10 is a diagram illustrating an example of a processing procedure for identifying a dominant period of a repetitive structure appearing in a block. [Figure 11A]FIG. 11A is a diagram illustrating an example of a processing procedure for identifying a dominant period of a repetitive structure appearing in a block. [Figure 11B] FIG. 11B is a diagram illustrating an example of a processing procedure for identifying a dominant period of a repeating structure appearing in a block. [Figure 11C] FIG. 11C is a diagram illustrating an example of a processing procedure for identifying a dominant period of a repeating structure appearing in a block. [Figure 11D] FIG. 11D is a diagram illustrating an example of a processing procedure for identifying a dominant period of a repetitive structure appearing in a block. [Figure 12] FIG. 12 is a flowchart illustrating an example of a processing procedure for estimating an operational state of a communication device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described with reference to the accompanying drawings, in which the same reference numerals denote the same or similar configurations.

[0012] <System configuration> 1 is a diagram showing an example of the system configuration of a monitoring system 1 according to this embodiment. The monitoring system 1 includes a monitoring device 10 (information processing device), a terminal 20, and a network 30.

[0013] The network 30 may be configured with a plurality of communication devices 40 and may be connected to a user network, the Internet, etc. The communication devices 40 are, for example, routers or switches, and perform routing of various data, etc. The communication devices 40 may have a redundant configuration and may be configured to be able to continue services even if one system fails.

[0014] The monitoring device 10 is a device that monitors the operation status of a plurality of communication devices 40. The monitoring device 10 acquires a command log, which is a result of executing an apparatus command, from the communication device 40, and generates a feature of the command log by analyzing the acquired command log. Furthermore, the monitoring device 10 estimates the operation status of the communication device 40 based on the feature of the generated command log. The command log may be called an apparatus command log. The apparatus command may be any command, and examples of the command include ping, traceroute, show interface, show onu uni-status, show service id, and show LAG (Link Aggregation Group). The apparatus command may be called a command.

[0015] The terminal 20 is a terminal used by an operator or the like, and may be any terminal equipped with a communication function, such as a personal computer (PC), a notebook PC, a smartphone, a tablet terminal, a mobile phone, etc. The terminal 20 is communicably connected to the monitoring device 10, and displays various information output by the monitoring device 10.

[0016] FIG. 2 is a diagram showing an example of a command log. A command log C10 shows an example of a command log of a Ping command output from the communication device 40. A command log C11 shows an example of a command log of a Show interface command output from the communication device 40. A command log is an unstructured message spanning from a dozen to several hundred lines, and the contents of the message differ for each device command. In addition, there are many device commands that the communication device 40 can execute, and the device commands that can be used also differ depending on the type and vendor of the communication device 40. Therefore, it is very time-consuming and difficult to manually construct an analysis logic for each device command in order to realize automatic monitoring of the communication device 40. In the following, in this embodiment, as shown in FIG. 2, the command log includes multiple lines of commands, and each line is also referred to as a log line below.

[0017] Here, there is a regularity in the character strings output as the command log. In other words, the command log can be considered to be generated by a combination of one or more templates in which an output pattern of the character string is defined. Therefore, in this embodiment, the monitoring device 10 identifies a template by analyzing the command log, and generates a feature vector indicating the feature amount of the command log using the template. In addition, the command log has a repetitive structure constituted by a plurality of log lines constituting the command log. In this embodiment, a period of the repetitive structure is identified, and an occurrence location of the repetitive structure is identified to generate a feature vector indicating the feature amount of the command log in the repetitive structure. The plurality of log lines constituting the command log include a template portion and a parameter portion, and in this embodiment, the feature amount of the command log is represented by a feature vector generated using a word corresponding to the parameter portion included in the log line. Furthermore, in this embodiment, a trained model capable of estimating the operation state of the communication device 40 from the feature vector of the command log is generated in advance, and the monitoring device 10 generates a feature vector from the command log obtained from the communication device 40 to be monitored and inputs the feature vector into the trained model to estimate the operation state of the communication device 40.

[0018] In this embodiment, a "word" may mean a character or a character string consisting of one or more characters or numbers. That is, a character or a character string consisting of only numbers, such as "5" and "1111", and a character string consisting of letters and numbers, such as "abc1111", may be included in a word.

[0019] FIG. 3 is a diagram showing an outline of a process in which the monitoring device 10 identifies a period in which a command appears in a command log.

[0020] First, the monitoring device 10 acquires a command log (S302). In this embodiment, an acquisition unit 102 of the monitoring device 10, which will be described later, acquires a command log output from the communication device 10 and indicates a result of executing a command.

[0021] Next, the monitoring device 10 divides the command log into a plurality of blocks based on a predetermined condition (S304). In this embodiment, the command log includes a plurality of log lines, and dividing the command log generates a plurality of blocks, each of which is composed of a plurality of log lines. In this embodiment, the command log is divided into blocks, and processing is performed to identify the period of the repetitive structure appearing in the divided blocks. However, processing may be performed to identify the period of the repetitive structure or the location where the repetitive structure appears for the log lines constituting the command log without dividing the command log into blocks.

[0022] Next, the monitoring device 10 selects a block to be subjected to the period specification process from among the multiple blocks (S306). Note that in this embodiment, the continuous repetition of several lines of logs is called a repeat structure, and the number of lines constituting the repeated small unit is called a period.

[0023] Next, the monitoring device 10 identifies the period of the repetitive structure appearing in the target block (S308). In this embodiment, the repetitive period identification unit 104 of the monitoring device 10, which will be described later, extracts the repetitive structure appearing in multiple log lines constituting the command log, and identifies the period of the repetitive structure. More specifically, in this embodiment, the repetitive period identification unit 104 identifies a repetitive structure candidate consisting of n log lines based on the similarity between a first log line, which is an arbitrary log line in the command log, and a second log line that is n lines (n is a natural number) away from the first log line. Next, the repetitive period identification unit 104 identifies the repetitive structure candidate consisting of n log lines as a repetitive structure having a periodicity of n based on a periodicity score indicating the continuity of repetition in the command log of the repetitive structure candidate consisting of n log lines.

[0024] Next, the monitoring device 10 identifies the location of the repetitive structure in the block (S310). In this embodiment, the repetitive part identification unit 106 of the monitoring device 10, which will be described later, identifies the location of the repetitive structure in the command log. In this embodiment, more specifically, the repetitive part identification unit 106 identifies an offset from the first line of the command log in which the repetitive structure with period n appears most frequently, and identifies this as the location of the repetitive structure with period n in the command log. As will be described later in detail, the monitoring device 10 determines, for example, that a repetitive structure with multiple periods appears in a target block, and identifies the location of each of the repetitive structures with multiple periods in the block. For example, when it is determined that repetitive structures with periods 2, 6, and 14 appear in the block, the monitoring device 10 identifies the location of each of the repetitive structures with periods 2, 6, and 14 in the block.

[0025] Next, the monitoring device 10 extracts a plurality of repetitive portions (S312). After that, the monitoring device 10 may be configured to extract information that characterizes the repetitive structure extracted from the block of the command log. For example, the monitoring device 10 may be configured to extract parameters included in the repetitive structure. In this embodiment, a feature information extraction unit 108 of the monitoring device 10 described later extracts information that characterizes the repetitive structure from the command log. In this embodiment, the feature information extraction unit may include, for example, a parameter extraction unit, and the parameter extraction unit may extract parameters included in the repetitive structure from the command log. In this embodiment, more specifically, the feature information extraction unit 108, which is a parameter extraction unit, may extract parameters in descending order of periodicity scores from the repetitive structures of the periods identified as having periodicity. For example, parameters included in each of the repetitive structures of periods 2, 6, and 14 may be extracted. The extracted parameters may then be used, for example, as teacher data for a learning model for automatic monitoring.

[0026] <Hardware configuration> 4 is a diagram showing an example of a hardware configuration of the monitoring device 10. The monitoring device 10 has a processor 11 such as a CPU (Central Processing Unit) or a GPU (Graphical Processing Unit), a storage device 12 such as a memory, an HDD (Hard Disk Drive) and / or an SSD (Solid State Drive), a communication IF (Interface) 13 for wired or wireless communication, an input device 14 for accepting input operations, and an output device 15 for outputting information. The input device 14 is, for example, a keyboard, a touch panel, a mouse, and / or a microphone. The output device 15 is, for example, a display, a touch panel, and / or a speaker.

[0027] The monitoring device 10 may be configured with one or more physical servers, or may be configured using a virtual server operating on a hypervisor, or may be configured using a cloud server.

[0028] The program for identifying a repetitive structure appearing in a command log according to the present embodiment may be provided by being stored in a computer-readable storage medium such as the storage device 12. Alternatively, the program may be provided from outside the monitoring device 10 via a communication network to which the monitoring device 10 is connected. In the monitoring device 10, for example, the processor 11 executes the program for identifying a repetitive structure appearing in a command log according to the present embodiment, thereby realizing the various operations described above with reference to FIGS. 1 to 3. Note that these physical configurations are merely examples, and do not necessarily have to be independent configurations. For example, the monitoring device 10 according to the present embodiment may include an LSI (Large-Scale Integration) in which the processor 11 and the storage device 12 are integrated. Also, as described above, the monitoring device 10 may include a GPU as the processor 11, and in this case, the GPU may execute the program for identifying a repetitive structure appearing in a command log, thereby realizing the various operations described with reference to FIGS. 1 to 3.

[0029] <Function block configuration> FIG. 5 is a diagram showing an example of a functional block configuration of the monitoring device 10. The monitoring device 10 includes a storage unit 100, an acquisition unit 102, a repetition period identification unit 104, a repetition part identification unit 106, a feature information extraction unit 108, a learning processing unit 110, and an estimation unit 112. The storage unit 100 can be realized by using a storage device 12 included in the monitoring device 10. The acquisition unit 102, the repetition period identification unit 104, the repetition part identification unit 106, the feature information extraction unit 108, the learning processing unit 110, and the estimation unit 112 can be realized by the processor 11 of the monitoring device 10 executing a program stored in the storage device 12. The program can be stored in a storage medium. The storage medium storing the program may be a non-transitory computer readable storage medium. The non-transitory storage medium is not particularly limited, and may be, for example, a storage medium such as a USB memory or a CD-ROM.

[0030] The memory unit 100 stores a command log DB (Data Base) 100a that accumulates command logs collected from the communication device 40, and a trained model 100b that has been trained to output the operating status of the communication device 40 by inputting the feature vector of the command log.

[0031] The acquiring unit 102 acquires a plurality of command logs (first command logs) indicating execution results of commands output from the communication device 40. The command logs (first command logs) may be command logs acquired in order to generate training data for training a template and / or a model.

[0032] The repetition period identification unit 104 analyzes the command log acquired by the acquisition unit 102 to identify the period of the repetition structure appearing in the command log. More specifically, the repetition period identification unit 104 divides the command log into a plurality of blocks based on a predetermined condition, and identifies the period of the repetition structure appearing in a target block among the plurality of blocks. At this time, the repetition period identification unit 104 calculates the similarity between a certain log line in a block and a log line separated by one or more log lines from the certain log line, and identifies the period of the repetition structure appearing in the block. For example, for the separated log lines, the similarity is calculated for a plurality of different numbers of lines, and candidates for the period in which the repetition structure appears are determined.

[0033] The repetitive part identifying unit 106 identifies the location in the command log where the repetitive structure appears. More specifically, the repetitive part identifying unit 106 identifies the location in the command log where the repetitive structure of the period identified by the repetitive period identifying unit 104 appears. In this embodiment, the command log may be divided into a plurality of blocks as described above, and the repetitive part identifying unit 106 identifies the location in the block where the repetitive structure appears.

[0034] The feature information extraction unit 108 extracts information that characterizes the repetitive structure from the command log. The feature information extraction unit 108 is configured to extract various information that characterizes the repetitive structure, such as the number of repetitions of the repetitive structure in the command log and parameters included in the repetitive portion. In this embodiment, the feature information extraction unit 108 includes, for example, a parameter extraction unit, and extracts parameters included in the command log. More specifically, the feature information extraction unit 108, which is a parameter extraction unit, may identify a repetitive structure in the command log based on the period and appearance position of the repetitive structure identified by the repetitive period identification unit 104 and the repetitive portion identification unit 106, and extract parameters included in the identified repetitive structure. After this, a feature vector may be generated based on, for example, one or more words corresponding to the extracted parameters in the command log.

[0035] In this embodiment, the characteristic information means parameters included in the command log as described above, but is not limited to this. The characteristic information is information other than the repetitive structure, and is information that has some useful value when extracted.

[0036] The learning processing unit 110 generates a model that outputs the operational state of the communication device 40 when the characteristic vector is input by training the model using training data including the characteristic vector of the command log and the operational state of the communication device 40. The learning processing unit 110 stores a parameter set that defines the generated model in the trained model 100b of the storage unit 100.

[0037] The estimation unit 112 estimates the operational state of the communication device 40 by, for example, inputting the feature vector of the generated command log into a model trained by the learning processing unit 103.

[0038] <Processing Procedure> (Generating feature vectors) 6 is a flowchart showing an example of a process in which the monitoring device 10 generates a feature vector. The process procedure described below may be executed for each device command. That is, when generating feature vectors for a command log of a ping command and a command log of a show service id command, the monitoring device 10 may execute the process procedure described below separately for the ping command and the show service id command.

[0039] First, in step S602, the acquisition unit 102 acquires command logs for device commands for generating a feature vector from one or more communication devices 40 present in the network 30. The acquisition unit 102 may acquire command logs used to generate a feature vector from the log data of the command logs stored in the command log DB 100a of the monitoring device 10. For example, when generating a feature vector for a command log of a ping command, the command log of the ping command may be acquired from the command log DB 100a. Alternatively, the acquisition unit 102 may acquire the command log of the ping command directly from the monitoring device 10 by logging in to the monitoring device 10 and inputting the ping command. The number of command logs to be acquired is not particularly limited, but it is considered desirable to acquire command logs of more patterns from more communication devices 40 in consideration of the accuracy of the extracted parameters.

[0040] Next, in step S604, the command log acquired in step S602 may be divided into a plurality of blocks according to a predetermined condition. In this embodiment, the "predetermined condition" may be, for example, a blank line. That is, dividing the command log according to a predetermined condition may be dividing the command log at blank lines. Note that the predetermined condition is not limited to blank lines, and may be a specific character string. In the following description, the predetermined condition is assumed to be a blank line.

[0041] FIG. 7A is a diagram showing an example of a command log before division. FIG. 7A shows a command log of admin display-config as an example of a command log. Note that admin display-config is a command that displays various configuration information (i.e., setting information) of a communication device such as a router. Other examples of command logs include a ping command that checks network communication, a show interfaces command that displays detailed interface information, a show environment command that displays the status of hardware such as a fan or power supply of a device case, and a show tech support command that displays all information at once for detailed analysis by a vendor. As shown in FIG. 7A, there are two blank lines in the command log of the example admin display config. The command log of the example admin display config is divided into three blocks by being divided by the blank lines. Note that in the case of a device command that has three or four or more blank lines, the command log is divided into four or five or more blocks, respectively. In the process of identifying a repetitive structure according to this embodiment, the command log is divided into blocks, and a process of identifying the period of the repetitive structure appearing in the divided blocks is performed, but as described above, the process of identifying the period of the repetitive structure and the location of the repetitive structure may be performed for the log lines constituting the command log without dividing it into blocks. For example, in cases where there are no blank lines in the command log, the process of identifying the period of the repetitive structure and the location of the repetitive structure may be performed without dividing the command log.

[0042] Fig. 7B is a diagram showing an example of a command log after being divided into blocks. Block 1, block 2, and block 3 shown in Fig. 7B correspond to the first 1 / 3 part, the middle part, and the last 1 / 3 part of the command log shown in Fig. 7A, respectively. Returning to Fig. 6, the explanation will be continued.

[0043] Next, in step S606, the repeating period of the target block among the divided blocks is identified. In this embodiment, a process of identifying the period of consecutive repeating parts appearing in each block is performed by calculating a periodicity score for log lines constituting blocks, which are units obtained by dividing the command log by blank lines.

[0044] The periodicity score of a block used in this embodiment is based on the idea that if a repeating portion in a block has a period of n, the similarity between the lines corresponding to the repeating portion will be high when comparing the block with a block obtained by moving n lines backward from the beginning, line by line. Therefore, in this embodiment, a repeating structure candidate consisting of n log lines is identified based on the similarity between an arbitrary log line (first log line) in a command log and a log line (second log line) that is n lines (n is a natural number) away from the arbitrary log line. Then, based on the periodicity score indicating the continuity of repetition in the command log of the repeating structure candidate consisting of n log lines, the repeating structure candidate consisting of n log lines is identified as a repeating structure having a periodicity of n.

[0045] In the calculation of the periodicity score, first, the block (b k represents the kth row of the block),

number

number

[0046] Next, the similarity between each row of the original block and the transformed block is calculated, and the number of rows that exceed a predetermined threshold T1 is counted.

[0047] In this embodiment, the similarity is calculated by the similarity score of the log lines, as described below. Here, the word list included in the block is L i Here, we define the word list L i is a list of all words in a log line in a block extracted using whitespace as a delimiter, without allowing duplicates. Also, the word list L i The number of words in i Similarly, define the word list contained in other log lines as L j Here, we define the word list L j is a list of all words in the log line, extracted using whitespace as a delimiter, without allowing duplicates. j The number of words in j In this case, the similarity score S between different log lines is defined as ij is defined as the following Equation 3.

number

[0048] For example, the word list L of two log lines for which similarity is to be calculated i and L j For each log line, the number of words in common is 8, and the number of words in each log line is N i and N j If the larger number of these is 13, then the similarity score S between these log lines will be 8 / 13 (approximately 0.62).

[0049] A repeating structure candidate consisting of n log lines is identified based on the calculated similarity between two log lines in the command log. In this embodiment, for example, a predetermined threshold is set for the similarity, and when the calculated similarity exceeds the predetermined threshold, it is identified as a repeating structure candidate with a period n at that time.

[0050] The calculation method of similarity that can be used in this embodiment is not limited to the above. In this embodiment, for example, a method used for calculating the similarity between sets, such as Jaccard coefficient or Dice coefficient, may be used. In addition, a calculation method based on distributed representation may be used. For example, Word2vec may be used to express words as feature vectors by distributed representation, feature vectors corresponding to sets of words (each log line or block, etc.) may be constructed, and the similarity between log lines and the similarity between small blocks contained in a block as described later may be calculated. As a method of constructing a feature vector of a word set from the feature vector of each word, various methods may be used, such as a method of simply taking an average, a method of taking a sum, or a method of calculating a center of gravity. Similarly, various methods may be used as an index for measuring the similarity between feature vectors, such as Euclidean distance, cosine similarity, and norms for various vectors, such as L1 norm and maximum norm.

[0051] In addition, since there are cases in which lines that are not included in the repeated portion of the device command log have a high similarity, in this embodiment, even if the similarity between log lines exceeds a threshold, if there is no log line whose similarity exceeds the threshold within a range of n lines before and after it, it will not be included in the calculation of the periodicity score. Finally, the number of lines whose similarity exceeds the threshold is divided by n and normalized to obtain the periodicity score. Through the above operations, the periodicity score (if there is a period) will be a maximum of 1 less than the number of repetitions. Furthermore, by summarizing the above steps, the periodicity score can be expressed by the following formula 4.

number

number

number

[0052] The process of identifying a repetition period executed in this embodiment will be specifically described with reference to Figures 8A to 8D. Figures 8A, 8B, 8C, and 8D are diagrams for explaining the calculation of the periodicity score by the above-mentioned method for n=1, 2, 3, and 4, respectively. Therefore, in the following, the process for each of n=1 to 4 will be described for a block of the command log (e.g., block 1 shown in Figure 7B).

[0053] First, as shown in FIG. 8A, in the case of n=1, a log line in block 1 is compared with a block obtained by moving one line back from the log line in block 1 line by line. In FIG. 8A, since none of the log lines in the original block 1 have been moved, n=0 is shown. Also, in FIG. 8A, the block to be compared is shown as n=1 since each log line constituting block 1 has been moved one line back. As shown in FIG. 8A, in the block of n=1, the log lines from the second line to the 32nd line, which is the last line, of block 1 of n=0 are moved to the first line to the 31st line, respectively, and the log line of the first line is moved immediately after the 31st line. Also, as shown in FIG. 8A, here, the log lines of the 4th line, the 5th line, the 6th line, the 7th line, ... of block 1 of n=0 are compared with the log lines of the 5th line, the 6th line, the 7th line, ... of block 1 of n=1, respectively.

[0054] Next, as shown in FIG. 8B, in the case of n=2, a log line in block 1 is compared with a block obtained by moving two lines back from the log line in a line unit. In FIG. 9B, the block to be compared is shown as n=2 because each log line constituting block 1 is moved two lines back. As shown in FIG. 8B, in the block of n=2, the log lines from the third line to the 32nd line, which is the last line, of block 1 of n=0 are moved to the first line to the 30th line, respectively, and the log lines of the first line and the second line are moved to immediately after the 30th line, respectively. Also, as shown in FIG. 8B, here, the log lines of the fourth line, the fifth line, the sixth line, the seventh line, the eighth line, the ninth line, the sixth line, the ninth line, the sixth line, the seventh line, the eighth line, the sixth ...

[0055] Next, as shown in FIG. 8C, in the case of n=3, a certain log line in block 1 is compared with a block obtained by moving three lines back from the certain log line, line by line. In FIG. 8C, the block to be compared is shown as n=3 because each log line constituting block 1 is moved three lines back. Also, as shown in FIG. 8C, in the block of n=3, the log lines of lines 4 to 32 of block 1 of n=0 are moved to lines 1 to 29, respectively, and the log lines of lines 1, 2, and 3 are moved to immediately after line 29, respectively. Also, as shown in FIG. 8C, here, the log lines of lines 4, 5, 6, 7, ... of block 1 of n=0 are compared with the log lines of lines 7, 8, 9, 10, ... of block 1 of n=3, respectively.

[0056] Next, as shown in FIG. 8D, in the case of n=4, a certain log line in block 1 is compared with a block obtained by moving four lines back from the certain log line, line by line. In FIG. 8D, the block to be compared is shown as n=4 because each log line constituting block 1 is moved four lines back. Also, as shown in FIG. 8D, in the block of n=4, the log lines of lines 5 to 32 of block 1 of n=0 are moved to lines 1 to 28, respectively, and the log lines of lines 1, 2, and 3 are moved to immediately after line 28, respectively. Also, as shown in FIG. 8D, here, the log lines of lines 4, 5, 6, 7, ... of block 1 of n=0 are compared with the log lines of lines 8, 9, 10, 11, ... of block 1 of n=4, respectively.

[0057] Comparing the examples shown in Figures 8A to 8D, in comparing the log lines in each figure, it can be seen that block 1 with n=0 shown in Figures 8A, 8B, and 8C, respectively, is relatively different from blocks with n=1, 2, and 3, whereas in comparing block 1 with n=0 shown in Figure 8D with block with n=4, the log lines compared in both blocks are relatively similar to each other. For example, as shown in FIG. 8D, the fourth line of block 1 with n=0 and the fifth line of the log line with n=4, which is the log line to be compared, are identical in the "static-route-entry" portion, which corresponds to the template portion (shown by a solid-line rectangle in FIG. 8D), but differ in the "edf6d50c80df59365fd9c370e814d33c / 28" and "0ac496f54d51e977beeba51541a02a1e / 28" portions, which correspond to the parameter portion (shown by a dashed-line rectangle in FIG. 8D). The same is true for other log lines; for example, the fifth line of the log line of block 1 with n=0 is identical to the fifth line of the log line of block 4 with n=4 in the template portion, "next-hop", but the parameter portion is different. Also, the sixth and seventh lines of the log lines are identical in "no shutdown" and "exit", respectively. Similarly, for the log lines from line 8 to line 27, the template portion and the word "exit" are the same, but the parameter portion is different for the log lines having a parameter portion. Meanwhile, as shown in Figures 8A to 8C, between block 1 of n=0 and blocks of n=1, n=2, and n=3, there is no identical template portion as seen between the log line constituting block n=0 and the log line constituting block n=4 shown in Figure 8D.

[0058] As described above with reference to Figures 8A to 8D, in block 1, which is the target for identifying the exemplary period in this embodiment, it can be seen that there is high similarity between block 1 with n=0 and block 1 with n=4. The same result can be obtained by calculating the similarity between the log lines described above. Thus, in block 1, period 4 is considered as a candidate for n that shows a relatively high periodicity, and it can be estimated that there is a candidate for the period of n=4 in block 1.

[0059] After this, similarities are calculated for n=5 and above in the same manner. As described below, the calculated similarities for all n (1≦n≦[L / 2]) are compared with each other, and it is determined that a repeating structure candidate having a period for n with a relatively high similarity appears in the target command log block. For example, it is determined that a repeating structure candidate with a period n whose similarity is equal to or greater than a predetermined threshold appears. Or, for example, it is determined that a predetermined number of repeating structure candidates with a period n appear in descending order of calculated similarity.

[0060] In this embodiment, thereafter, for example, the repetition period identification unit 104 identifies a repetition structure candidate consisting of n log lines as a repetition structure having a periodicity of period n based on a periodicity score indicating the continuity of repetition within a block of a command log of the repetition structure candidate consisting of n log lines, which is the period n of the repetition structure candidate. The periodicity score is calculated, for example, using the above-mentioned formula 4. Returning to FIG. 6, the explanation will be continued.

[0061] Next, in step S608, the repeating part is identified. In this embodiment, the repeating part is identified with the period n of the repeating structure in the block being known. That is, in step S608, a process is performed to identify the repeating part, which is the part where the repeating structure with the period identified in step S606 appears. Therefore, in this embodiment, the repeating part identifying unit 106 identifies an offset (offset d, described later) from the first row of the command log in which the repeating structure with period n appears most frequently, and identifies this as the part in the command log where the repeating structure with period n appears.

[0062] Here, if the number of repetitions of a repetitive structure with a certain period n is M, the start position and end position of the repetitive part can be expressed as the mn+d+1th line and the (m+M)n+dth line (m=0,1,...,d=0,1,...,n-1), respectively. That is, in this embodiment, in block 1, there are log lines of the sum of m*n lines and d corresponding to the offset before the start of the M repetitive structure, and from the (mn+d+1)th line, which is the next line of the (mn+d) line, there is an M repetitive structure, so that the M repetitive structure with a period n appears in the log lines of Mn lines up to the (mn+d)+Mn=((m+M)n+d)th line, and no repetitive structure appears from the next line ((m+M)+d+1)th line to the last line of block 1, and the log lines in block 1 are defined as follows. In this way, within block 1 where m, M, and d are defined, M, m, and d are calculated, and d (0≦d≦n-1) that can maximize the number of iterations M is calculated by the following method.

[0063] First, d rows are removed from the beginning of block 1, and then the blocks are divided into n rows each in sequence from the beginning, which are defined as small blocks. These are expressed by Equation 7.

number

[0064] The process of identifying the repeating portion according to this embodiment is executed by dividing the log lines constituting the block for each period of n, excluding d (0≦d≦n-1) lines from the beginning of the block (as described above, the division unit is also called a "small block"), and selecting d so that each repeating structure fits into a small block. In this embodiment, d is selected, for example, by the following method.

[0065] First, the similarity between two consecutive small blocks is calculated. The similarity between two consecutive small blocks may be calculated, for example, by the same method as the calculation of the similarity between log lines described above. That is, similar to the calculation of the similarity between log lines described using the above formula 3, a word list included in each of the two small blocks to be subjected to the similarity calculation may be created, and the similarity may be calculated as a value based on the total number of words included in each of the two small blocks relative to the total number of words in the larger of the two small blocks.

[0066] Next, the combination of small blocks that are most consecutive and have a similarity that exceeds a predetermined threshold is extracted. Through this process, for example, small blocks that are highly similar to each other are extracted from among the multiple small blocks contained in a block.

[0067] Next, d is selected so that the number of repetitions M is maximized. For example, d is selected so that the number of small blocks that are highly similar to each other are maximized. Small blocks that are highly similar to each other are locations where small blocks of period n appear. Therefore, by selecting d so that the number of small blocks that are highly similar to each other is maximized, d is selected so that the number of repetitions of the repeating structure of period n is maximized.

[0068] With reference to Figures 9A to 9D, a process of identifying the location of a repetitive structure in block 1 of a command log in which the repetitive period n has been identified in S606 will be described. Figures 9A to 9D are diagrams for explaining the process of identifying a repetitive portion executed in this embodiment. Figures 9A to 9D exemplify a process of identifying a repetitive portion when it is determined that a repetitive structure with a period of n=4 appears in the process described with reference to Figures 8A to 8D. Figures 9A, 9B, 9C, and 9D respectively show examples in which the above-mentioned d=0, d=1, d=2, and d=3 are used.

[0069] As shown in Fig. 9A, when d = 0 and m = 1, it is determined whether a repeating structure with period n (n = 4) exists in lines 1 to 4, lines 5 to 8, ..., lines 29 to 32. In this case, when the similarity between each small block (small blocks each consisting of four log lines including the log lines in lines 1 to 4, lines 5 to 8, ..., lines 29 to 32) is calculated, the similarity between the small block including the log lines in lines 1 to 4 and the small block including the log lines in lines 29 to 32 and the adjacent small blocks (small blocks including the log lines in lines 5 to 8 and the small block including the log lines in lines 25 to 28, respectively) is lower than the similarity between other consecutive small blocks. For example, the small block containing the log lines from lines 5 to 8, ..., the small block containing the log lines from lines 25 to 28 contain the same template parts "next-hop", "no shutdown", "exit", and "static-route-entry" (shown by solid rectangles in FIG. 9A), so the similarity between these small blocks is high. Therefore, when d=0, the number of repetitions M is 6.

[0070] As shown in Fig. 9B, when d = 1 and m = 1, it is determined whether a repeating structure with period n (n = 4) exists in lines 2 to 5, lines 6 to 9, ..., lines 26 to 29. In this case, when the similarity between each small block (small blocks each consisting of four log lines including the log lines in lines 2 to 5, lines 6 to 9, ..., lines 26 to 29) is calculated, the similarity between the small block including the log lines in lines 2 to 5 and the small block adjacent thereto (small block including the log lines in lines 6 to 9) is lower than the similarity between other consecutive small blocks. For example, the small block including the log lines from lines 6 to 9, ..., the small block including the log lines from lines 26 to 29 include the same template parts (shown by solid rectangles in FIG. 9B) of "no shutdown", "exit", "static-route-entry", and "next-hop", so the similarity between these small blocks is high. Therefore, even if d=1, the number of repetitions M is 6.

[0071] As shown in Fig. 9C, when d = 2 and m = 1, it is determined whether a repeating structure with period n (n = 4) exists in lines 3 to 6, lines 7 to 10, ..., lines 27 to 30. In this case, when the similarity between each small block (small blocks each consisting of four log lines including the log lines in lines 3 to 6, lines 7 to 10, ..., lines 27 to 30) is calculated, the similarity between the small block including the log lines in lines 3 to 6 and the small block adjacent thereto (small block including the log lines in lines 7 to 10) is lower than the similarity between other consecutive small blocks. For example, the small block including the log lines from lines 7 to 10, ..., the small block including the log lines from lines 27 to 30 include the same template parts (shown by solid rectangles in FIG. 9C) of "exit", "static-route-entry", "next-hop", and "no shutdown", so the similarity between these small blocks is high. Therefore, even if d=2, the number of repetitions M is 6.

[0072] As shown in FIG. 9D, when d=3 and m=1, it is determined whether the repeating structure of period n (n=4) exists in lines 4 to 7, lines 8 to 11, ..., lines 28 to 31. In this case, when the similarity between each small block (each small block consisting of four log lines including the log lines in lines 4 to 7, lines 8 to 11, ..., lines 28 to 31) is calculated, unlike the case described with reference to FIG. 9A, FIG. 9B, and FIG. 9C for d=0, 1, and 2, all small blocks contain the same template parts (shown by solid-line rectangles in FIG. 9D), namely, "static-route-entry", "next-hop", "no shutdown", and "exit", and the similarity between these small blocks becomes high. Therefore, when d=3, the number of repetitions M is 7.

[0073] In this way, the number of repetitions M is the maximum of 7. * = 7, and the offset d at that time can be set to d * =3 can be selected.

[0074] In this embodiment, when multiple repetitive periods are confirmed, the period with the highest priority may be identified. In the device command log, there may be repetitive portions corresponding to multiple periods within the same block. In such a case, the above-mentioned period identification and repetitive portion identification can be repeated to extract periods with higher periodicity scores in order. At this time, for example, the repetitive structure obtained by applying the above-mentioned repetitive period identification process and repetitive portion identification process is removed from the original block. After that, the same process is executed again, and this operation may be repeated until no periodicity score exceeding the threshold value (threshold value T0) appears.

[0075] The process of identifying a dominant period will be described with reference to Figures 10 to 11D. Figure 10 shows blocks into which an example command log is divided. In the example block shown in Figure 10, for example, multiple repeating structures appear for period 2, period 6, and period 14, as shown overlapping in Figure 10.

[0076] The results of calculating the similarity for this block are shown in Fig. 11A. In Fig. 11A, the horizontal axis represents the period n, and the vertical axis represents the similarity at each period n. As shown in Fig. 11A, the similarity is high for n=2, 6, and 14, resulting in 29.000, 29.167, and 29.000, respectively. Therefore, it can be seen that the repeating structures of periods 2, 6, and 14 are highly dominant in this command log block.

[0077] At this time, for example, a threshold T0 of 25.0 is set for the periodicity score. As shown in Fig. 11A, the highest periodicity score is first compared with the threshold T0. In the example shown here, the periodicity score for n=6 is the highest, at 29.167, which is higher than the threshold T0. Therefore, n=6 is determined to be the dominant period in the target command log block here, and the repeating structure of the period of n=6 is deleted from the command log block.

[0078] Next, for the block from which the repeating structure with a period of n=6 has been deleted, the periodicity score is calculated for each n by the same method. The recalculated periodicity score (vertical axis) versus n (horizontal axis) is shown in FIG. 11B. As shown in FIG. 11B, the periodicity score corresponding to the repeating structure with n=6 is 9.000, which is approximately 1 / 3 or less of the value shown in FIG. 11A. Here, as shown in FIG. 11A, the periodicity score is also high for n that is an integer multiple of n (n=2, 6, and 14) with a high periodicity score, such as n=4, 12, and 24, and for example, the periodicity score for n=12 is approximately 18.250. This is because it is determined that a large integer multiple period appears in the period of an integer multiple of the period n with a high periodicity score. 11B, which shows the periodicity score calculated after the repeating structure with a period of 6 is deleted, when the repeating structure with a period of n=6 is deleted and the periodicity score is calculated for each n, the periodicity score decreases from 18.250 to 4.083 not only for n=6 but also for n=12. Similarly, the periodicity scores decrease for n=18, 24, 30, 36, and 42. Therefore, by deleting the repeating structure with a period of n=6, it is possible to remove the influence of the repeating structure with a period that is an integer multiple of 6 and proceed with the processing of the repeating structure with a period that corresponds to the next largest periodicity score.

[0079] Next, in the distribution of periodicity scores shown in FIG. 11B, n corresponding to the next largest periodicity score is identified. In the example shown in FIG. 11B, the periodicity score for n=2 is the next largest. Therefore, similar to the process for the periodicity score corresponding to n=6, the repeating structure with a period of n=2 is next deleted from the block. Then, for the block from which the repeating structure with a period of n=2 has been deleted, the periodicity score for each n is calculated. The periodicity score (vertical axis) for n (horizontal axis) calculated in this manner is shown in FIG. 11C. As shown in FIG. 11C, the periodicity score corresponding to the repeating structure with n=2 is 0.500, which is 1 / 50 or less compared to the cases shown in FIG. 11A and FIG. 11B. Also, as shown in FIG. 11C, the periodicity score corresponding to n, which is an integer multiple of 2, is a very small value, approximately 1 or less. Therefore, just as in the case of deleting the repeating structure with a period of n=6, by deleting the repeating structure with a period of n=2, the influence of the repeating structure with a period that is an integer multiple of 2 is also removed, making it possible to proceed with processing of the repeating structure with a period corresponding to the next largest periodicity score.

[0080] Next, in the distribution of periodicity scores shown in Fig. 11C, n corresponding to the next highest periodicity score is identified. In the example shown in Fig. 11C, the periodicity score for n=14 is the next highest. Also, as shown in Fig. 11C, high periodicity scores appear for n=28 and 42, which are integer multiples of 14. For the identified n=14, the repeating structure for n=14 is further deleted from the block. For the block from which the repeating structure corresponding to n=14 has also been deleted, a periodicity score is further calculated for each n.

[0081] The calculation results of the periodicity scores for each n are shown in Fig. 11D. As shown in Fig. 11D, compared with the distribution of periodicity scores shown in Fig. 11C, the periodicity scores corresponding to n = 14 and integer multiples of 14 are very small, periodicity scores of 1.0 or less appear for n = 1 to 3, and only relatively small periodicity scores of 0.2 or less appear for n = 4 or more.

[0082] A process is performed to confirm the next largest periodicity score for the distribution of periodicity scores shown in Fig. 11D. In the distribution of periodicity scores shown in Fig. 11D, almost no dominant periodicity scores are observed, and for example, when the threshold T0 is set to 25.0 as described above, none of the periodicity scores exceed the threshold T0 and are not determined to be dominant. Thus, the process of identifying dominant periods is completed.

[0083] Thus, in the example command log block, it is determined that repeating structures with periods of n=2, 6, and 14 appear, and the repeating structures with periods of n=2, 6, and 14 that are determined to appear are extracted and used, for example, in the next process.

[0084] Returning to FIG. 6, next, in step S610, information that characterizes the repetitive structure is extracted. In this embodiment, for example, parameters included in the repetitive structure are extracted. As described above, each log line that constitutes the command log to be processed in this embodiment includes a template portion and a parameter portion, and in the process of step S610, for example, the parameter portion is extracted from the log line. That is, in this embodiment, the characteristic information extraction unit 108, which is the parameter extraction unit, may extract parameters in descending order of periodicity scores from the repetitive structures with a period n that are identified as having periodicity. Note that, in step S610 of FIG. 6, a case in which parameters of the repetitive structure are extracted is illustrated as an example, but the extracted information that characterizes the repetitive structure is not limited to parameters, and as described above, for example, various information that characterizes the repetitive structure or the repetitive portion, such as the number of repetitions, may be extracted.

[0085] In this embodiment, when a parameter S is extracted as information characterizing a repetitive structure, for example, a template appearing in a block is extracted by applying sequence alignment to each small block corresponding to a repetitive structure contained in the block to be processed. Here, sequence alignment is a method of identifying similar subsequences between a plurality of sequences. For example, the Needleman-Wunsch algorithm is known as an algorithm for realizing sequence alignment. By using the Needleman-Wunsch algorithm, it is possible to extract a common part (match) and a non-common part (either a mismatch or a gap) from a word string contained in each of two pieces of text data. A match means that the same word exists in the same part of a word string in two pieces of text data. A mismatch means that some word exists in the same part of a word string in two pieces of text data, but a different word exists. A gap means that a word exists in only one of the two pieces of text data, and no word exists in the other.

[0086] In this embodiment, the word strings included in each small block are classified into common parts and non-common parts (either mismatches or gaps) by using the Needleman-Wunsch algorithm. The word strings classified into non-common parts may be classified into, for example, "numeric parameters" consisting of only numerical values, "word parameters" consisting of only characters not including numerical values, and "other parameters" including both numerical values ​​and characters. A template part may be generated by arranging the words corresponding to the common parts, the codes indicating the numerical parameters, the codes indicating the word parameters, and the codes indicating the other parameters. For the template part corresponding to the common parts, the non-common parts other than the common parts may be regarded as parameters, and the parameters may be specified. Returning to FIG. 6, the description will be continued.

[0087] In step S612, a feature vector of the command log is generated using the template. In this embodiment, for example, the feature vector of the command log may be generated by extracting numerical values ​​or character strings of portions corresponding to the numerical parameters and word parameters in the template from the word strings constituting the log lines of the block of the command log, and arranging values ​​generated from the extracted numerical values ​​or character strings.

[0088] As described above, the monitoring device 10 performs a process of learning a model using the feature vector, and a process of estimating the operating state of the communication device 40 using the learned model. Therefore, the number of dimensions of the feature vector generated from the command log and the meaning of each element may be determined. Therefore, for the feature vector generated by the processing procedure described above, information (hereinafter also referred to as "feature vector definition data") defining the correspondence between each element included in the feature vector and the template and the generation method of each element may be generated for each command and stored in the storage unit 100. Note that the generation method of each element may include, for example, information instructing that a standardized value of a numerical parameter is stored in the element, and / or information instructing which number of words among the word parameters is stored in which element.

[0089] (Model training) The learning processing unit 110 generates a model that outputs the operation state of the communication device 40 when the feature vector is input by learning the model using teacher data including each of the feature vectors of the multiple command logs and information indicating the operation state of the communication device 40. The learning processing unit 103 may generate a different model for each command type. For example, the learning processing unit 110 may generate a model for each command type, such as a model for a ping command and a model for a show interface command. The algorithm used for the model is not particularly limited, but for example, a neural network, a support vector machine, a decision tree, a random forest, a gradient boosting decision tree, or the like may be used.

[0090] The information indicating the operation state of the communication device 40 may be, for example, a flag capable of expressing two types of operation states of the communication device 40 (e.g., 0 for normal and 1 for abnormal), or a flag capable of expressing three or more types of states of the communication device 40 (e.g., 0 for normal with both systems, 1 for abnormal with one system, 2 for abnormal with both systems, etc.). Note that the teacher data may be generated by an operator adding the operation state of the communication device 40 to log data when a monitoring task was performed in the past.

[0091] (Estimation of the operating state of a communication device) 12 is a flowchart showing an example of a processing procedure for estimating the operation state of the communication device 40. In the following description, it is assumed that a trained model capable of outputting the operation state of the communication device 40 when a feature vector is input has been generated in advance.

[0092] First, in step S1202, the acquiring unit 101 acquires a command log output from the communication device 40. The command log may be output as a response to a device command input to the communication device 40 by an operator or the monitoring device 10 in order to perform a monitoring operation of the communication device 40, for example.

[0093] Next, in step S1204, the above-mentioned template is applied to the command log obtained in step S1302, thereby extracting one or more words (one or more second words) that correspond to the parameter portion indicated in the template from the word string included in the command log, and generating a feature vector of the command log based on the one or more extracted words.

[0094] Next, in step S1206, the estimation unit 112 inputs the feature vector generated in the processing procedure of step S1304 to the trained model, thereby estimating the operation state of the communication device 40. For example, if the command log acquired in the processing procedure of step S1304 is a ping command, the estimation unit 112 inputs the feature vector generated in the processing procedure of step S1204 to the trained model corresponding to the ping command. Furthermore, the estimation unit 112 estimates the operation state of the communication device 40 based on the value output from the trained model. The estimation unit 112 may output the estimated operation state of the communication device 40 to the screen of the terminal 20.

[0095] <Summary> According to the embodiment described above, the monitoring device 10 is adapted to identify the period of the repetitive structure in the command log and the location where the repetitive structure appears by analyzing the command log of the device command. The monitoring device 10 is also adapted to generate a feature vector based on the parameter portion of the command log. This makes it possible to efficiently analyze the command log obtained from the communication device. The monitoring device 10 is also adapted to estimate the operating state of the communication device 40 from the command log of the communication device 40 by using a trained model trained using the generated feature vector as training data. This makes it possible to realize a fast and efficient monitoring operation. The technology according to this embodiment can also contribute to the achievement of Goal 9 of the Sustainable Development Goals (SDGs), "Build resilience, innovate and innovate."

[0096] The above-described embodiments are intended to facilitate understanding of the present invention, and are not intended to limit the present invention. The flow charts, sequences, elements included in the embodiments, and their arrangements, materials, conditions, shapes, sizes, etc. are not limited to those illustrated, and can be changed as appropriate. The calculation methods described in the above-described embodiments are also not limited to those illustrated. In addition, the configurations illustrated in different embodiments can be partially replaced or combined. [Explanation of symbols]

[0097] 1... monitoring system, 10... monitoring device, 11... processor, 12... storage device, 13... communication IF, 14... input device, 15... output device, 20... terminal, 30... network, 40... communication device, 100... storage unit, 100a... command log DB, 100b... trained model, 100c... word dictionary DB, 102... acquisition unit, 104... repetition period identification unit, 106... repetition part identification unit, 108... feature information extraction unit, 110... learning processing unit, 112... estimation unit

Claims

1. an acquisition unit that acquires a command log that indicates a result of executing a command, the command log being output from the communication device; a repetition period identification unit that extracts a repetition structure appearing in a plurality of log lines constituting the command log and identifies a period of the repetition structure; a repetitive portion identifying unit that identifies an occurrence portion of the repetitive structure in the command log; a characteristic information extraction unit that extracts information that characterizes the repetitive structure from the command log; An information processing device comprising:

2. the repetition period identification unit identifies a repetition structure candidate consisting of n log lines based on a similarity between a first log line in the command log and a second log line that is n lines (n is a natural number) away from the first log line; The information processing device according to claim 1 .

3. the repetition period identification unit identifies the repetition structure candidate consisting of the n log lines as a repetition structure having a periodicity of the period n, based on a periodicity score indicating a continuity of repetition in the command log of the repetition structure candidate consisting of the n log lines. The information processing device according to claim 2 .

4. The information processing device according to claim 1 , wherein the repetitive part identification unit identifies an offset from a first line of the command log in which the repetitive structure of the period n appears most frequently, and identifies the offset as the appearance part of the repetitive structure of the period n in the command log.

5. acquiring a command log output from the communication device, the command log indicating a result of execution of the command; Identifying a period of a repetitive structure of a plurality of log lines constituting the command log; identifying the positions in the command log of log lines that constitute the repeating structure; An information processing method executed by an information processing device, comprising:

6. acquiring a command log output from the communication device, the command log indicating a result of execution of the command; Identifying a period of a repetitive structure of a plurality of log lines constituting the command log; identifying the positions in the command log of log lines that constitute the repeating structure; A program for causing a computer to execute the following.

Images