Communication management device and communication management method

Abstract

To allow the location where an abnormality has occurred to be identified with a simpler configuration when the abnormality occurs in a hierarchical network.SOLUTION: A communication management device 1 includes a first acquisition unit 10 that acquires observation data including the number of times an alarm signal indicating an abnormality occurring in a network is detected in each of a plurality of UDMs 31, a setting unit 11 that sets the probability of an abnormality occurring in a UDR 32 under the condition that an alarm signal is detected in each of the plurality of UDMs 31 based on the observation data as a likelihood function of a Bayesian estimation model, a determination unit 12 that determines whether an abnormality has occurred in the UDR 32 based on a value of the set likelihood function, and a presentation unit 14 that presents a determination result by the determination unit 12.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a communication management device and a communication management method. [Background technology]

[0002] Conventionally, techniques for identifying abnormalities such as faults that occur in networks or systems with a logical hierarchical structure have been known. For example, in a communication network in which upper-level devices and lower-level devices in a hierarchical structure communicate with each other, if a fault occurs in the upper-level device, an alarm indicating the occurrence of the fault is detected not only in the upper-level device but also in the lower-level device. It is also known that there are cases in which an alarm signal is not detected in all lower-level devices when a fault occurs in the upper-level device.

[0003] In this way, an alarm signal indicating a failure that has spread to a downstream device does not necessarily indicate the device in the communication network where the failure occurred. Therefore, to identify which device the failure occurred in, it was necessary to analyze the logs of both the upstream and downstream devices. As a result, it could take a long time to identify the location of the failure.

[0004] For example, Patent Document 1 discloses a technology in which a server connected to a top-level router in a hierarchical communication network analyzes packets received via a lower-level router to identify the router in which an abnormality has occurred. However, the technology disclosed in Patent Document 1 requires the installation of a dedicated server in the existing communication network to identify the abnormality, and also requires packet analysis, which complicates the system structure. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2009-246534 Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, according to the conventional technology, when an abnormality occurs in a hierarchical network, it is difficult to identify the location where the abnormality has occurred with a simpler configuration.

[0007] The present invention has been made to solve the above-mentioned problems, and aims to identify the location of an abnormality with a simpler configuration when an abnormality occurs in a hierarchical network. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, the communication management device of the present invention is a communication management device that manages abnormalities that occur in a hierarchical network having a first device belonging to a first layer and a plurality of second devices that belong to a second layer below the first layer and communicate with the first device, and is equipped with a first acquisition unit configured to acquire observation data including the number of times an alarm signal indicating an abnormality that has occurred in the network is detected in each of the plurality of second devices, a setting unit configured to set, based on the observation data, the probability that an abnormality will occur in the first device under the condition that the alarm signal is detected in each of the plurality of second devices as a likelihood function of a Bayesian estimation model, a judgment unit configured to determine whether or not an abnormality has occurred in the first device based on the value of the set likelihood function, and a presentation unit configured to present the judgment result by the judgment unit.

[0009] In addition, the communication management device of the present invention may further include a classification unit configured to provide the likelihood function as an unknown input to a trained machine learning model, perform calculations on the trained machine learning model, and classify into classification classes including a first classification class indicating that an abnormality has occurred in the first device and a second classification class indicating that an abnormality has occurred in any of the plurality of second devices, and the presentation unit may present the classification results by the classification unit.

[0010] In order to solve the above-mentioned problems, the communication management device of the present invention further includes a second acquisition unit configured to acquire learning data in which the likelihood function and the classification class indicated by the judgment result are associated, a learning unit configured to learn the relationship between the likelihood function and the classification class based on the learning data using a machine learning model, and a memory unit configured to store the trained machine learning model constructed by the learning unit, and the classification unit may read the trained machine learning model from the memory unit and perform calculations on the trained machine learning model.

[0011] In the communication management device according to the present invention, the network may be a core network conforming to a predetermined communication standard, and the first device and the plurality of second devices may be devices within the core network.

[0012] In order to solve the above-mentioned problems, the communication management method of the present invention is a communication management method for managing abnormalities that occur in a hierarchical network having a first device belonging to a first layer and a plurality of second devices belonging to a second layer below the first layer and communicating with the first device, and includes a first acquisition step for acquiring observation data including the number of times an alarm signal indicating an abnormality that has occurred in the network is detected by each of the plurality of second devices; a setting step for setting, based on the observation data, the probability that an abnormality will occur in the first device under conditions in which the alarm signal is detected by each of the plurality of second devices, as a likelihood function of a Bayesian estimation model; a determination step for determining whether or not an abnormality has occurred in the first device based on the value of the set likelihood function; and a presentation step for presenting the determination result from the determination step.

[0013] In addition, the communication management method of the present invention may further include a classification step of providing the likelihood function as an unknown input to a trained machine learning model, performing calculations on the trained machine learning model, and classifying the data into classification classes including a first classification class indicating that an abnormality has occurred in the first device and a second classification class indicating that an abnormality has occurred in any of the plurality of second devices, and the presentation step may present the classification results from the classification step.

[0014] In addition, the communication management method of the present invention further includes a second acquisition step of acquiring learning data in which the likelihood function and the classification class indicated by the judgment result are associated, a learning step of learning the relationship between the likelihood function and the classification class based on the learning data using a machine learning model, and a storage step of storing the trained machine learning model constructed in the learning step in a storage unit, and the classification step may read out the trained machine learning model from the storage unit and perform calculations on the trained machine learning model. [Effects of the Invention]

[0015] According to the present invention, the probability that an anomaly will occur in a first device under the condition that an alarm signal is detected in each of a plurality of second devices based on observation data is set as a likelihood function of a Bayesian estimation model, and the presence or absence of an anomaly in the first device is determined based on the value of the set likelihood function. Therefore, when an anomaly occurs in a hierarchical network, the location of the anomaly can be identified with a simpler configuration. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 1 is a block diagram showing the configuration of an estimation system including a communication management device according to a first embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram illustrating a hardware configuration of the communication management device according to the first embodiment. [Figure 3]FIG. 3 is a flowchart illustrating the operation of the communication management device according to the first embodiment. [Figure 4] FIG. 4 is a block diagram showing the configuration of a communication management device according to the second embodiment. [Figure 5] FIG. 5 is a diagram illustrating a learning unit included in the communication management device according to the second embodiment. [Figure 6] FIG. 6 is a flowchart showing the operation of the communication management device according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0017] Preferred embodiments of the present invention will be described in detail below with reference to Figures 1 to 6. In the following description, a communication network including a core network 3 conforming to the 5G standard will be described as an example of a network with a logical hierarchical structure. Also, a case will be illustrated in which a first device belonging to a first layer on the upper side and multiple second devices belonging to a second layer on the lower side are devices within the core network 3. Furthermore, a case will be described in which the first device is a UDR32 (Unified Data Repository) and multiple second devices are UDM31 (Unified Data Management).

[0018] Furthermore, abnormalities occurring in the network include failures of hardware modules of control devices such as UDR 32 and UDM 31 provided in the core network 3 .

[0019] [First embodiment] 1 is a block diagram showing the configuration of a communication management system including a communication management device 1 according to a first embodiment of the present invention. When an alarm signal is detected between a UDR 32 belonging to an upper layer of a hierarchical core network 3 and a plurality of UDMs 31 belonging to a lower layer, the communication management system according to this embodiment identifies whether an abnormality has occurred on the UDR 32 or UDM 31 side.

[0020] [Communication Management System Configuration] As shown in Fig. 1, the communication management system according to this embodiment includes a communication management device 1, multiple base stations 2, a core network 3, and a monitoring device 4. The communication management device 1 and the monitoring device 4 are connected to each other via a network NW such as a LAN, a WAN, or the Internet. The monitoring device 4 is connected to the core network 3 via a network L2 such as a LAN or a WAN. Furthermore, the multiple base stations 2 are connected to the core network 3 via a high-speed line network L1.

[0021] The base station 2 is composed of a wireless base station compatible with the 5G communication standard, and relays communication between user terminals present in the communication area and the core network 3. The base station 2 includes a plurality of base stations 2 arranged within the 5G mobile communication network. Each base station 2 is connected to the AMF 30 via the network L1.

[0022] The core network 3 includes, as nodes in the control plane (C-plane), multiple AMFs (Access and Mobility Management Functions) 30, multiple UDMs 31, and a UDR 32. Note that other functional nodes included in the core network 3 are not shown in the figure. The core network 3 is configured as a closed IP network.

[0023] In this embodiment, the multiple base stations 2 and the multiple AMFs 30, multiple UDMs 31, and UDRs 32 included in the core network 3 have a logical hierarchical structure. A UDR 32 (first device) belonging to the highest layer (first layer) of the hierarchical structure is communicatively connected to multiple UDMs 31 (second devices) belonging to a lower layer (second layer). Each of the multiple UDMs 31 is communicatively connected to multiple AMFs 30 belonging to a lower layer. Each of the multiple AMFs 30 is further connected to multiple base stations 2 belonging to the lowest layer.

[0024] The AMF 30 is a device that provides mobility control functions and performs mobility control such as location registration, paging, and handover. A plurality of AMFs 30 are provided, and k base stations 2 (k is a positive integer) are connected to one AMF 30.

[0025] The UDM 31 is a device that manages user contract information and authentication information. A plurality of UDMs 31 (n units, n is an integer equal to or greater than 2) are provided, and m units (m is a positive integer) of AMFs 30 are connected to one UDM 31. When the UDM 31 detects an abnormality that has occurred in the device itself, it generates and outputs an alarm signal. In this specification, detection of an alarm signal refers to the output of an alarm signal due to the detection of an abnormality that has occurred in the device itself, as well as the detection of an alarm signal that has occurred based on an abnormality that has occurred in another device.

[0026] An alarm signal detected by the UDM31 based on an abnormality occurring in the UDM31 is detected by the devices of the core network 3, including the upper-side UDR32 and the lower-side AMF30. Similarly, an alarm signal detected by the UDR32 based on an abnormality occurring in the upper-side UDR32 is also detected by the lower-side UDM31.

[0027] The UDR 32 is a device that stores a subscriber profile that holds the subscriber identification number (International Mobile Subscriber Identity: IMSI) of the user terminal and location information. As an example, one UDR 32 is provided, and n UDMs 31 are communicably connected to the UDR 32. The UDR 32 detects an alarm signal based on the detection of an abnormality that has occurred in the device itself. In this case, the alarm signal detected by the UDR 32 spreads to the core network 3, and the alarm signal is also detected in the downstream UDMs 31 and AMF 30. Meanwhile, the UDR 32 detects an alarm signal based on the abnormality that has occurred in the downstream UDM 31.

[0028] The monitoring device 4 is, for example, an operation system that is provided outside the core network 3, monitors each of the AMF 30, UDM 31, and UDR 32, and performs consolidated monitoring of the occurrence of alarm signals and abnormalities in the core network 3. The monitoring device 4 records a log of alarm signals detected in each of the AMF 30, UDM 31, and UDR 32. The monitoring device 4 can also record an occurrence log of abnormalities that occur in the AMF 30, UDM 31, and UDR 32. The monitoring device 4 can send the alarm signal detection log and abnormality occurrence log to the communication management device 1 via the network NW.

[0029] [Communication management device functional block] The communication management device 1 includes a first acquisition unit 10, a setting unit 11, a determination unit 12, a first storage unit 13, and a presentation unit 14. The communication management device 1 manages abnormalities that occur in a core network 3 having a hierarchical structure including a UDR 32 belonging to the top first layer and a plurality of UDMs 31 belonging to a second layer below the first layer and communicating with the UDR 32. Based on the observation data, the communication management device 1 also sets the probability of an abnormality occurring in the UDR 32 under the condition that an alarm signal is detected in each of the plurality of UDMs 31 as a likelihood function of a Bayesian estimation model, and determines whether an abnormality has occurred in the UDR 32.

[0030] The first acquisition unit 10 acquires observation data including the number of times an alarm signal indicating an abnormality occurring in the core network 3 has been detected in each of the multiple UDMs 31. More specifically, the first acquisition unit 10 acquires a log of alarm signals detected in each UDM 31 during a set period from the monitoring device 4, and acquires the number of times an alarm signal was detected during the set period for each UDM 31. For example, one alarm signal is notified for one second. The first acquisition unit 10 can count how many times an alarm signal was detected in each UDM 31 during a set period of 1000 seconds.

[0031] The first acquisition unit 10 can further acquire a log of alarm signals detected by the UDR 32 from the monitoring device 4, and acquire the number of times that an alarm signal is detected by the UDR 32 within a set period.

[0032] The setting unit 11 sets the probability of an abnormality occurring in the UDR 32 under the condition that an alarm signal is detected in each of the plurality of UDMs 31 based on the observation data as a likelihood function of the Bayesian estimation model. The setting unit 11 sets the likelihood function P(Y i |X) = (number of times an alarm signal is detected) / (set period, for example, 1000 seconds). The (number of times an alarm signal is detected) is calculated by (number of times an alarm signal occurs) x (transmission interval of an alarm signal). For example, if an alarm signal occurs 200 times at 1-second intervals, the likelihood function P(Y i |X) can be calculated by (200 x 1 second) / (1000 seconds).

[0033] In the Bayesian estimation model used in this embodiment, the probability that an abnormality occurs in the UDR 32 is set as a prior distribution P(X), and a likelihood function P(Y i The probability distribution updated by (|X) is taken as the posterior distribution P(X|Y). The posterior distribution P(X|Y) is the probability that an alarm signal will be detected in each of the multiple UDMs 31 under the condition that an abnormality has occurred in the UDR 32. In this way, the Bayesian inference model is a probability model that determines the probability of an event under certain conditions from known probabilities and observation data. The parameters of the Bayesian inference model are explained below.

[0034] In the Bayesian estimation model, first, event X is defined as an event that has a certain cause. Furthermore, event Y is defined as an event that is assumed to have occurred due to a certain cause. Events X and Y are treated as random variables. Specifically, event X is defined as an event in which an abnormality occurs in the UDR 32, and event Y is defined as an event in which an alarm signal is detected between a plurality of UDMs 31 and UDRs 32. In this embodiment, event Y is particularly defined as an event Y={Y1, Y2, ..., Y n-1 ,Y n}, and an event in which an alarm signal is detected in each UDM 31 is used.

[0035] The probability distribution P(X) of the occurrence of event X can be assumed as a prior distribution, which is the distribution of parameters before observation data is given. Also, the probability distribution P(Y) of the occurrence of event Y, which is the probability distribution of an alarm signal being detected among multiple UDMs 31 and UDRs 32, is expressed as a marginal likelihood.

[0036] Likelihood function P(Y i |X) is a representation of observed data, and indicates how likely observed data Y is to occur from the model when the parameter values are conditioned. Specifically, it is expressed as the probability that an abnormality will occur in the UDR 32 under the condition that an alarm signal is detected in each UDM 31. In this embodiment, the likelihood function P(Y i |X) is set based on the observation data acquired by the first acquisition unit 10. More specifically, as described above, for each UDM 31, the value P(Y |X) is calculated by (the number of times an alarm signal is detected) / (a set period, for example, 1000 seconds). i |X) is used as the likelihood function P(Y|X). The above (number of times an alarm signal is detected) is calculated by multiplying the number of times an alarm signal is generated by the transmission interval of the alarm signal (for example, 1 second).

[0037] In Bayesian estimation, Bayes' theorem is used to reflect information obtained from a likelihood function, a prior distribution, and observation data, and to estimate a posterior distribution P(X|Y), which is the probability that an event X will occur under the condition that an event Y has occurred. In this case, the posterior distribution P(X|Y) is a probability distribution in which an alarm signal is detected in at least one of the multiple UDMs 31 under the condition that an abnormality has occurred in the UDR 32. In this embodiment, a Bayesian estimation formula expressed by the following formula (2) based on Bayes' theorem of the following formula (1) is used.

[0038]

number

[0039] In the denominator of the above equation (1), P(Y) = Σ X Substituting P(Y|X)P(X), the following equation (2) is obtained.

[0040]

number

[0041] In Bayes' theorem (1) and Bayes' estimation (2), when the number of training data N is sufficiently large (N → ∞), the likelihood function P(Y|X) generally becomes dominant over the prior distribution P(X). In other words, the relationship between the posterior distribution P(X|Y) and the likelihood function P(Y|X) is expressed by the following equation (3): P(X|Y) ≒ P(Y|X) (3)

[0042] In this embodiment, the likelihood function P(Y|X) is set by naive Bayes based on Bayes' theorem in equation (1) above and Bayes' estimation in equation (2) above.

[0043] Naive Bayes is a generative model that obtains the results of class classification as probabilities. Naive Bayes assumes conditional independence between explanatory variables when a target variable is given. Specifically, in the posterior distribution P(X|Y), which is the probability distribution of event X under the condition of event Y, Y is the explanatory variable and X is the target variable representing the class. Therefore, when Y is input, the probability that an anomaly has occurred in UDR32 and the probability that it has not occurred are output as the probability of each class X.

[0044] In this embodiment, the setting unit 11 considers the event X of the likelihood function P(Y|X) as an explanatory variable and the event Y as a response variable from the above formula (3). The event Y is a set of n multidimensional variables Y={Y1, Y2, ..., Y n-1 ,Y n}, and each variable Y i is y1,y2,…,y n-1 ,y n That is, each variable Y iindicates that an alarm signal has been detected in each UDM 31. As mentioned above, the variable Y i are assumed to be independent of each other, and the likelihood function P(Y|X) can be expressed as the product of probabilities in the following equation (4).

[0045]

number

[0046] The determination unit 12 determines whether or not an abnormality has occurred in the UDR 32 based on the value of the likelihood function P(Y|X) set by the setting unit 11. The determination unit 12 can determine whether or not an abnormality has occurred in the UDR 32 using a preset threshold value. The threshold value can be any value (for example, 0.8 in the case of n UDMs 31). n ) can be set. In this case, when the value of the likelihood function P(Y|X) exceeds the set threshold value, the determination unit 12 determines that an abnormality has occurred in the UDR 32. When the value does not exceed the threshold value, the determination unit 12 can determine that an abnormality has occurred on the UDM 31 side. Note that the threshold value can be adjusted based on, for example, the actual location of the abnormality identified by a separate analysis of the location of the abnormality.

[0047] The first storage unit 13 stores the Bayesian estimation model of the above equations (1) to (4).

[0048] The presentation unit 14 presents the determination result by the determination unit 12. The presentation unit 14 can present the determination result to an external server via the network NW, for example. The presentation unit 14 can also cause the display device 107 to output the determination result.

[0049] [Hardware configuration of communication management device] Next, an example of a hardware configuration for realizing the communication management device 1 having the above-described functions will be described with reference to FIG.

[0050] 2, the communication management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program that controls these hardware resources. The communication management device 1 can also include a display device 107 connected via the bus 101.

[0051] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the communication management device 1, such as the first acquisition unit 10, the setting unit 11, and the determination unit 12 shown in FIG.

[0052] The communication interface 104 is an interface circuit for connecting the communication management device 1 to various external electronic devices via a network.

[0053] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0054] The auxiliary storage device 105 has a program storage area for storing the Bayesian estimation program executed by the communication management device 1. The auxiliary storage device 105 realizes the first storage unit 13 described in Fig. 1. Furthermore, for example, the auxiliary storage device 105 may have a backup area for backing up the above-mentioned data, programs, etc.

[0055] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0056] The display device 107 is configured by an organic EL display, a liquid crystal display, or the like, and realizes the presentation unit 14 .

[0057] [Operation of the communication management device] Next, the operation of the communication management device 1 having the above-described configuration will be described with reference to the flowchart in Fig. 3. In the following, it is assumed that an alarm signal is detected in UDR32 belonging to the highest layer and UDM31 belonging to a lower layer in a hierarchical network including a core network 3.

[0058] First, the first acquisition unit 10 acquires, from the monitoring device 4, observation data including the number of alarm signals detected in each of the plurality of UDMs 31 (step S1). The first acquisition unit 10 can acquire, from the monitoring device 4, the number of alarm signals detected in each of the n UDMs 31 during a set period.

[0059] Next, the setting unit 11 sets the probability of an abnormality occurring in the UDR 32 under the condition that an alarm signal is detected in each of the plurality of UDMs 31 based on the observation data acquired in step S1 as a likelihood function P(Y|X) of the Bayesian estimation model (step S2). In this embodiment, the setting unit 11 calculates the value P(Y|X) for each UDM 31 based on the observation data acquired in step S1 by dividing the number of times an alarm signal is detected by a set period, for example, 1000 seconds. i |X) is set as the likelihood function P(Y|X). If an alarm signal is transmitted at 1-second intervals and 200 alarm signals are generated, the above (number of alarm signal detections) is 200 times x 1 second. Furthermore, in this case, the likelihood function P(Y|X) is calculated as 200 x 1 second / 1000 seconds.

[0060] The Bayesian estimation model uses the probability of an abnormality occurring in UDR32 as a prior distribution P(X), and calculates the likelihood function P(Y i The posterior distribution P(X|Y) updated by (X|Y) is defined as the probability that each of the plurality of UDMs 31 detects an alarm signal under the condition that an abnormality occurs in the UDR 32.

[0061] The setting unit 11 uses Naive Bayes based on the Bayes estimation formula of the above formula (2) and the approximation relationship P(X|Y)≒P(Y|X) of the above formula (3) to determine the event X of the likelihood function P(Y|X) as an explanatory variable and the event Y={Y1, Y2, ..., Y n-1 ,Y n} is considered as the target variable. i indicates that an alarm signal has been detected in each UDM 31.

[0062] The setting unit 11 sets the variable Y i Based on the assumption that the likelihood functions P(Y|X) represented by the product of probabilities in the above formula (4) are independent of each other, the likelihood functions P(Y i |X).

[0063] Next, if the value of the likelihood function P(Y|X) set in step S2 exceeds a preset threshold, the determination unit 12 determines that an abnormality has occurred in the UDR 32, and if the value does not exceed the threshold, the determination unit 12 determines that an abnormality has occurred on the UDM 31 side (step S3). The threshold used by the determination unit 12 in the determination process can be adjusted, for example, based on the results of an analysis of the actual abnormality location in the core network 3, which will be performed separately at a later date.

[0064] Thereafter, the presentation unit 14 presents the determination result obtained in step S3 (step S4). For example, the presentation unit 14 can send information about the location of the abnormality indicated by the determination result to an external server or the like via the network NW.

[0065] As described above, according to the communication management device 1 of the first embodiment, the probability that an abnormality will occur in the UDR 32 under the condition that an alarm signal is detected in each of the multiple UDMs 31 based on the observation data is set as the likelihood function P(Y|X) of the Bayesian estimation model, and whether an abnormality has occurred in the UDR 32 is determined based on the set likelihood function P(Y|X). Therefore, when an alarm signal is detected in each of the upper and lower devices in the hierarchical structure, it is possible to identify with a simpler configuration which of the opposing devices the abnormality has occurred in.

[0066] [Second embodiment] Next, a second embodiment of the present invention will be described. In the following description, the same components as those in the first embodiment will be denoted by the same reference numerals, and the description thereof will be omitted.

[0067] In the first embodiment, a case has been described in which the presence or absence of an abnormality in the UDR 32 belonging to a higher hierarchy is determined based on a likelihood function P(Y|X) set from observation data using Naive Bayes. In contrast, in the second embodiment, the abnormality is classified into the UDR 32 and the UDM 31 using a trained machine learning model that is trained using the determination result by the determination unit 12 as learning data.

[0068] [Communication management device functional block] FIG. 4 is a block diagram showing the configuration of a communication management device 1A according to this embodiment. The communication management device 1A includes a first learning device 1-1 and a second learning device 1-2. The first learning device 1-1 includes a first acquisition unit 10, a setting unit 11, a determination unit 12, a first memory unit 13, and a presentation unit 14. The first learning device 1-1 corresponds to the functional blocks of the communication management device 1 according to the first embodiment. The second learning device 1-2 includes a second memory unit 15 (memory unit), a second acquisition unit 16, a learning unit 17, and a classification unit 18. This embodiment differs in configuration from the first embodiment in that it includes the second learning device 1-2. The following description will focus on the configuration that differs from the first embodiment.

[0069] The second storage unit 15 stores learning data that associates likelihood functions P(Y|X) with classification classes indicated by the determination results of the determination unit 12. The likelihood function P(Y|X) is the probability that an abnormality will occur in the UDR 32 under the condition that an alarm signal is detected in each of the plurality of UDMs 31 based on the observation data, as set by the setting unit 11. In this embodiment, for each of 1 to n UDMs 31, a value P(Y|X) is calculated by dividing (the number of times an alarm signal is detected) by (a set period, for example, 1000 seconds). i|X) is used as the likelihood function P(Y|X). More specifically, if an alarm signal is transmitted at one-second intervals, the (number of alarm signal detections) is calculated by multiplying the (number of alarm signal occurrences) by the transmission interval of one second. For example, if an alarm signal occurs 200 times at 1000-second intervals, the value of the likelihood function P(Y|X) is 200 x 1 second / 1000 seconds.

[0070] The second storage unit 15 stores the likelihood function P(Y i The classification classes stored in association with the likelihood function P(Y |X) are the classification classes obtained by determining the results of the determination by the determination unit 12 of the first learning device 1-1, i.e., the occurrence of an abnormality in the UDR 32 and the occurrence of an abnormality in the UDM 31, as the first classification class and the second classification class, respectively. i |X) is the correct label given to

[0071] If the determination result by the determination unit 12 differs from the actual fault location, the second storage unit 15 stores a correct label indicating the correct fault location using a likelihood function P(Y i For example, after the determination unit 12 determines that an abnormality has occurred in the UDR 32, a separate analysis of the fault location is performed and it is found that the actual fault location is the UDM 31. In this case, the second storage unit 15 stores the learning data attached to the likelihood function P(Y i |X), the second classification class is assigned as the correct label instead of the first classification class, and the learning data is stored.

[0072] The second acquisition unit 16 calculates the likelihood function P(Y i The second acquisition unit 16 acquires, from the second storage unit 15, learning data in which the likelihood function P(Y |X) and the classification class are associated. More specifically, the second acquisition unit 16 can be configured to acquire learning data when a certain amount of learning data has been accumulated in the second storage unit 15. The second acquisition unit 16 also acquires unknown inputs to be used in inference processing using the trained machine learning model. Specifically, the second acquisition unit 16 acquires likelihood functions P(Y |X) corresponding to each of the n UDMs 31, which are set by the setting unit 11 included in the first learning device 1-1. i|X) can be taken as the unknown input.

[0073] The learning unit 17 calculates a likelihood function P(Y i The relationship between |X) and classification classes is learned using a machine learning model. FIG. 5 is a schematic diagram showing the structure of a neural network used as the machine learning model in this embodiment. The neural network can have a multi-layer structure consisting of an input layer x, a hidden layer h, and an output layer y. Each input node of the input layer x is connected to a likelihood function P(Y i The input signal given to the input layer x is expressed as likelihood functions P(Y1|X), P(Y2|X), . . . , P(Y n-1 |X),P(Y n |X).

[0074] The neural network shown in FIG. 5 uses likelihood functions P(Y i For |X), an activation function is applied to the weighted sum of the inputs, and the output determined by threshold processing is passed to the output layer y. As shown in Figure 5, the number of input nodes provided is n, which corresponds to the number of UDMs 31.

[0075] Each output node of the output layer y indicates a binary classification class consisting of a first classification class and a second classification class. The output layer y can output the probability of belonging to each class. As shown in the example of Figure 5, the first classification class can be "an abnormality has occurred in UDR32" and the second classification class can be "an abnormality has occurred in UDM31."

[0076] The learning unit 17 calculates a likelihood function P(Y iThe weights w of the connections between nodes are adjusted so that the output when |X) is given as input is the value of the classification class indicated by the label of the training data. The learning unit 17 uses, for example, backpropagation to compare the obtained output value with the given input value, examine the error of each weight w, and propagate it backward, ultimately determining parameters such as the weight w. Through this learning process, the learning unit 17 constructs a trained neural network.

[0077] The trained neural network constructed by the training unit 17 is stored in the second storage unit 15.

[0078] Returning to FIG. 4, the classification unit 18 calculates the likelihood function P(Y i |X) is given to the trained machine learning model as an unknown input, and the trained machine learning model is operated to classify the data into classification classes including the first classification class and the second classification class. The classification unit 18 uses the likelihood function P(Y i |X) is given to the trained machine learning model as an unknown input. The likelihood function P(Y i |X) is a probability distribution set by the setting unit 11 of the first learning device 1-1 that performs learning using a Bayesian estimation model. The first classification class indicates that an abnormality has occurred in the UDR 32, and the second classification class indicates that an abnormality has occurred in one of the multiple UDMs 31.

[0079] The classification unit 18 performs product-sum operations on parameters such as learned weights w and threshold processing using an activation function on unknown inputs, and outputs classification results. The classification results by the classification unit 18 are presented by the presentation unit 14. The classification results can be sent to an external server or the like via the network NW.

[0080] [Operation of the communication management device] The operation of the communication management device 1A having the above-described configuration will be described with reference to the flowchart in Fig. 6. The processing from step S1 to step S4 shown in Fig. 6 is executed by the first learning device 1-1 and is the same as the processing related to the operation of the communication management device 1 described in the first embodiment. The processing from step S10 onwards will be described below.

[0081] After the determination process in step S4, the second storage unit 15 stores the likelihood function P(Y i The learning data in which the classification classes are associated with |X are stored (step S10). i |X) is the value set in step S2, and the classification class is the value corresponding to the determination result in step S4. More specifically, the learning data is a likelihood function P(Y i |X) is data to which the classification class indicated by the determination result in step S4 is assigned as a correct label.

[0082] The classification class of the learning data stored in step S10 is a value that reflects the classification class that correctly corresponds to the abnormality location based on a separate analysis of the abnormality location, relative to the determination result in step S4. Next, if the set number of learning data have been accumulated in the second storage unit 15 (step S11: YES), the second acquisition unit 16 acquires the learning data from the second storage unit 15 (step S12).

[0083] On the other hand, if the set number of pieces of learning data have not been stored in the second storage unit 15 in step S10 (step S11: NO), the processes from step S1 to step S4 are repeated. After that, the learning unit 17 calculates the likelihood function P(Y i The relationship between |X) and the classification class is learned using a machine learning model (step S13). The trained machine learning model constructed in step S13 is stored in the second storage unit 15.

[0084] Next, the classification unit 18 reads out the trained machine learning model constructed in step S13 from the second storage unit 15 and performs classification processing (step S14). i |X) is given to a trained machine learning model as an unknown input, and the trained machine learning model is operated to output a classification class.

[0085] Thereafter, the presentation unit 14 presents the classification result obtained in step S14 (step S15). For example, the presentation unit 14 can send the classification result to an external server via the network NW. The classification result indicates the classification class for the unknown input. Specifically, when an alarm signal is detected in the UDR 32 and the UDM 31, it is indicated whether the input belongs to a first classification class indicating that an abnormality has occurred in the UDR 32, or a second classification class indicating that an abnormality has occurred on the UDM 31 side.

[0086] As described above, according to the communication management device 1A of the second embodiment, the second learning device 1-2 uses the determination result obtained by the first learning device 1-1 as learning data to calculate the likelihood function P(Y i A trained machine learning model is constructed that has learned the relationship between |X) and classification classes. Therefore, for example, when only a small amount of observation data can be obtained, such as when a relatively short time has passed since the start of service, a judgment process can be performed using a Bayesian estimation model. On the other hand, when a certain amount of learning data has been accumulated, a machine learning model that performs supervised learning can be trained to perform classification processing. Therefore, appropriate learning processing can be performed over time since the start of service. Furthermore, more accurate classification processing can identify the location of an abnormality in a hierarchical network.

[0087] In the above-described embodiment, the first learning device 1-1 and the second learning device 1-2 are configured in the same device. However, the first learning device 1-1 and the second learning device 1-2 can be configured as separate devices. In this case, the first learning device 1-1 and the second learning device 1-2 can each have the hardware configuration described in FIG. 2.

[0088] In the above embodiment, the location of an abnormality in a hierarchical network is identified when an alarm signal is detected by a control device in the core network 3. However, the target for identifying the location of an abnormality is not limited to the communication equipment in the core network 3, as long as the hierarchical network has a structure in which an alarm signal propagates. For example, the present invention can be applied to a hierarchical structure consisting of circuit switches and terminals, such as a PSTN (Public Switched Telephone Network).

[0089] In the above-described embodiment, a neural network consisting of an input layer, a hidden layer, and an output layer has been exemplified as a machine learning model. The neural network can be, for example, a deep learning model with multiple hidden layers, as long as it is a model that handles classification problems using supervised learning. Other machine learning models that can be used include SVM, decision trees, random forests, and logistic regression.

[0090] In the above-described embodiment, a communication management system that complies with 5G has been exemplified, but the communication management system may also be one that complies with 3G / LTE, 6G, or the like.

[0091] The above describes the embodiments of the communication management device and communication management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can imagine are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0092] 1, 1A...communication management device, 1-1...first learning device, 1-2...second learning device, 10...first acquisition unit, 11...setting unit, 12...judgment unit, 13...first memory unit, 14...presentation unit, 15...second memory unit, 16...second acquisition unit, 17...learning unit, 18...classification unit, 2...base station, 3...core network, 4...monitoring device, 30...AMF, 31...UDM, 32...UDR, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, L1, L2, NW...network.

Claims

1. A communication management device that manages abnormalities that occur in a hierarchical network including a first device belonging to a first layer and a plurality of second devices that belong to a second layer below the first layer and communicate with the first device, a first acquisition unit configured to acquire observation data including a detection count of an alarm signal indicating an abnormality occurring in the network, the alarm signal being detected by each of the plurality of second devices; a setting unit configured to set, based on the observation data, a probability that an abnormality will occur in the first device under a condition that the alarm signal is detected in each of the plurality of second devices, as a likelihood function of a Bayesian estimation model; a determination unit configured to determine whether or not an abnormality has occurred in the first device based on the set value of the likelihood function; a presentation unit configured to present a determination result by the determination unit; A communication management device comprising:

2. 2. The communication management device according to claim 1, a classification unit configured to provide the likelihood function as an unknown input to a trained machine learning model, perform an operation on the trained machine learning model, and classify the data into classification classes including a first classification class indicating that an abnormality has occurred in the first device and a second classification class indicating that an abnormality has occurred in any of the plurality of second devices; The presentation unit presents the classification result by the classification unit. A communication management device characterized by:

3. 3. The communication management device according to claim 2, a second acquisition unit configured to acquire learning data in which the likelihood function and the classification class indicated by the determination result are associated with each other; a learning unit configured to learn the relationship between the likelihood function and the classification class using a machine learning model based on the learning data; a storage unit configured to store the trained machine learning model constructed by the learning unit; Equipped with The classification unit reads the trained machine learning model from the storage unit and performs calculations on the trained machine learning model. A communication management device characterized by:

4. 2. The communication management device according to claim 1, the network is a core network conforming to a predetermined communication standard, The first device and the plurality of second devices are devices within the core network. A communication management device characterized by:

5. 1. A communication management method for managing an abnormality occurring in a hierarchical network including a first device belonging to a first layer and a plurality of second devices belonging to a second layer below the first layer and communicating with the first device, comprising: a first acquisition step of acquiring observation data including the number of times an alarm signal indicating an abnormality occurring in the network is detected in each of the plurality of second devices; a setting step of setting, based on the observation data, a probability that an abnormality will occur in the first device under a condition that the alarm signal is detected in each of the plurality of second devices, as a likelihood function of a Bayesian estimation model; a determining step of determining whether or not an abnormality has occurred in the first device based on the set value of the likelihood function; a presentation step of presenting the determination result in the determination step; A communication management method comprising:

6. 6. The communication management method according to claim 5, The method further comprises a classification step of providing the likelihood function as an unknown input to a trained machine learning model, performing an operation on the trained machine learning model, and classifying the data into classification classes including a first classification class indicating that an abnormality has occurred in the first device and a second classification class indicating that an abnormality has occurred in any of the plurality of second devices, The presentation step presents the classification result obtained in the classification step. A communication management method comprising:

7. 7. The communication management method according to claim 6, a second acquisition step of acquiring learning data in which the likelihood function is associated with the classification class indicated by the determination result; a learning step of learning the relationship between the likelihood function and the classification class using a machine learning model based on the learning data; a storage step of storing the trained machine learning model constructed in the learning step in a storage unit; Equipped with The classification step reads out the trained machine learning model from the storage unit and performs a calculation on the trained machine learning model. A communication management method comprising:

Images