Propagation graph restoration device, propagation graph restoration method, and program

Abstract

To construct a propagation graph about an event exhibiting deterministic behavior.SOLUTION: A propagation graph restoration device comprises an intervention execution unit which determines interventions of events exhibiting deterministic behavior for each component in a target system including a plurality of components, and a graph construction unit which estimates a propagation graph describing the chain occurrence of events on the basis of the observation data obtained as a result of the interventions.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a technique for understanding the interdependencies of components in a system. [Background technology]

[0002] Understanding the interdependencies between system components is important for the stable operation of ICT systems. For example, in a network system, if an alarm occurs in one network device and causes other devices to also receive alarms, it is necessary to understand the interdependencies between the network devices and then identify the underlying alarm.

[0003] In addition, understanding the interdependencies between various components is essential to prevent cascading failures and chain-reaction outages caused by abnormal conditions in devices propagating across the network.In recent years, container-based microservice architectures have become increasingly popular, but as infrastructure complexity has grown, the number of components that communicate with each other has also increased, creating similar challenges.

[0004] Fault testing and chaos engineering are approaches to understanding the interdependencies between system components. These involve intentionally injecting anomalies into a verification system or production system, observing system behavior, collecting data, and validating countermeasures.

[0005] This can also include understanding the interdependencies between components. Specifically, by analyzing the impact on other components when an anomaly is introduced into a component, and repeating this process while changing the component into which the anomaly is introduced, it is possible to understand what kind of interdependencies exist between components.

[0006] Such a problem can be formulated as the problem of constructing a causal graph between variables. For example, in conventional technology (Non-Patent Document 1), the state of each component is considered a random variable, and it is assumed that there is a causal relationship between the random variables. Analyses such as conditional independence determination are performed using data on the realized values ​​of other random variables when a certain random variable is fixed to an arbitrary value (this is called "intervention"), and data on the realized values ​​of random variables when nothing is done. In this way, the causal relationships existing between each random variable are extracted and a causal graph is constructed. In many cases, including other technologies, it is assumed that the causal relationships between random variables can be represented by a directed acyclic graph (DAG).

[0007] On the other hand, when considering the dependencies between components in a realistic system, the DAG assumption may not hold. For example, if component X raises an alarm, component Y also raises an alarm, and similarly, if component Y raises an alarm, component X also raises an alarm. Since X and Y can be mutually mutually responsible for each other's "cause" and "effect," the causal graph will have cycles and will not be a DAG. An existing technology for constructing a Directed Cyclic Graph (DCG) that allows for the existence of such cycles is disclosed in Non-Patent Document 2. [Prior art documents] [Non-patent literature]

[0008] [Non-Patent Document 1] Krishna, Rahul, et al. "CADET: A systematic method for debugging misconfigurations using counterfactual reasoning." arXiv preprint arXiv:2010.06061(2020). [Non-patent document 2] Itani, Sleiman, et al. "Structure learning in causal cyclic networks."Causality: Objectives and assessment. PMLR, 2010. Summary of the Invention [Problem to be solved by the invention]

[0009] For events that exhibit deterministic behavior, such as alarms that occur only under specific conditions, the interdependencies between components in a realistic system can be easily understood by expressing the propagation rules between random variables as a propagation graph that describes the chain of events. However, conventional technology has not been able to construct a propagation graph for events that exhibit deterministic behavior.

[0010] The present invention has been made in view of the above points, and has as its object to provide a technique for constructing a propagation graph for events that exhibit deterministic behavior. [Means for solving the problem]

[0011] According to the disclosed technology, in a target system having a plurality of components, an intervention execution unit that determines intervention for an event that exhibits deterministic behavior for each component; a graph construction unit that estimates a propagation graph that describes the chain of events based on observation data obtained as a result of the intervention; A propagation graph reconstruction device is provided, comprising: [Effects of the Invention]

[0012] The disclosed techniques provide techniques for constructing propagation graphs for events that exhibit deterministic behavior. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a configuration diagram of a propagation graph reconstruction device 100. [Figure 2] 10 is a flowchart showing the operation of the propagation graph restoration device 100. [Figure 3] FIG. 10 shows pseudocode for baseline method 2. [Figure 4] FIG. 10 is a diagram illustrating an example of a propagation graph. [Figure 5] FIG. 1 is a diagram illustrating an example of an SCC-DAG. [Figure 6] FIG. 1 shows decomposition of SCC. [Figure 7] FIG. 10 is a diagram showing pseudocode corresponding to the processing procedure of the propagation graph restoration device 100. [Figure 8] FIG. 10 is a diagram illustrating an example of a propagation graph. [Figure 9] FIG. 1 is a diagram illustrating an example of an SCC-DAG. [Figure 10] 1 is a diagram for explaining an example of processing by the propagation graph restoration device 100. FIG. [Figure 11] FIG. 2 illustrates an example of a hardware configuration of the apparatus. [Figure 12] FIG. 10 is a diagram showing evaluation results. [Figure 13] FIG. 10 is a diagram showing evaluation results. [Figure 14] FIG. 10 is a diagram showing evaluation results. [Figure 15] FIG. 10 is a diagram showing evaluation results. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0015] (Summary of the problem and embodiment) In this embodiment, we will explain how to build a propagation graph for phenomena that exhibit deterministic behavior as a way of understanding the interdependencies between each component of a system. Variables that represent the state of a system component include those that fluctuate probabilistically, such as metric values, and those that exhibit deterministic behavior, such as alarms that occur only under specific conditions. In this embodiment, we will explain how to represent the latter type of phenomenon, such as propagation rules between random variables, as a graph (called a propagation graph).

[0016] As mentioned above, in phenomena such as alarm propagation, the causal relationships between variables representing the states of components may include cycles, necessitating a method for constructing a DCG. Existing technology (Non-Patent Document 2) considers the causal relationships between random variables and performs tests such as conditional independence to construct a DCG. However, in the case of deterministic variables, conditional independence tests cannot be performed, limiting the information that can be used to infer graph arcs. Therefore, the existing technology (Non-Patent Document 2) cannot be directly applied.

[0017] In this embodiment, we provide a method for constructing a DCG that represents propagation rules between variables that represent the states of each component by appropriately designing intervention experiments on system components. This method does not use methods that are only applicable to random variables, such as tests of conditional independence, and only assumes that variables exhibit deterministic behavior, i.e., value propagation, making it possible to solve the above-mentioned problems.

[0018] (Device configuration, operation overview) Fig. 1 shows a configuration diagram of a propagation graph restoration device 100 according to this embodiment. As shown in Fig. 1, the propagation graph restoration device 100 includes a graph construction unit 10, a user interface 20, and an intervention execution unit 30. The propagation graph restoration device 100 constructs (estimates) a propagation graph for a target system 40. The target system 40 is a system (e.g., an ICT system) having multiple components. The components are, for example, routers, switches, servers, etc., which are connected via a network.

[0019] The overall operation of the propagation graph reconstruction device 100 will be described with reference to the flowchart in Fig. 2. The propagation graph construction method will be described in detail later.

[0020] In S101 (step 101), the number of vertices of the propagation graph is determined based on information about the target system 40, and the number of vertices is input to the graph constructor .

[0021] In S102, the graph constructor 10 passes information about the graph being estimated to the intervention execution unit 30. The information about the graph being estimated includes the DAG, the SCC-DAG (described later), and information about arcs whose existence is confirmed / unconfirmed.

[0022] In S103, the intervention execution unit 30 intervenes in the components of the target system according to the algorithm shown in Fig. 7, which will be described later. Specifically, it performs an action corresponding to the assignment of a value to a variable, such as forcibly issuing or clearing an alarm. In S104, the intervention execution unit 30 collects observation data on the results of the intervention and feeds it back to the graph construction unit 10.

[0023] In S105, the graph constructor 10 updates information about the graph being estimated in response to the feedback, following the algorithm in Fig. 7. Then, the information is passed to the intervention execution unit 30, which then executes the intervention (No in S106).

[0024] The above process is repeated until the graph construction unit 10 finishes constructing the graph, that is, until the algorithm stops. When the algorithm stops (Yes in S106), the graph construction unit 10 outputs the propagation graph to the user interface 20. The user interface 20 outputs the propagation graph to the outside. Any method may be used to output the propagation graph to the outside. The propagation graph may be displayed graphically, or a list of vertices and arcs representing the propagation graph may be output.

[0025] The processes executed by the graph constructor 10 and the intervention executor 30 will now be described in more detail.

[0026] (Problem setting) First, we explain the problem setting. Let D = D(V,A) represent the DCG that represents the propagation rules between variables. Here, let V = {1,2,...,n} be the vertex set, and A ⊂ V × V be the arc set. We assume that D is simple, that is, there are no self-loops at each vertex, and all arcs are distinct. Each vertex i∈V is connected to a variable X i ∈{0,1}, and there are

[0027]

number

[0028]

number

[0029] The relational expression in Equation 1 means that if the variable of a certain vertex is 1, all of its descendants will be 1 (1 propagates). In the specific example of an ICT system, a value of 1 can be thought of as corresponding to an "abnormal state" such as an alarm being generated or a malfunction, and a value of 0 to a "normal state."

[0030] Next, we define an "intervention" that artificially fixes the value of a variable. The intervention is a vector ξ∈{-1,0,1} n When intervention ξ is executed, for each i∈V,

[0031]

number

[0032]

number

[0033]

number

[0034] For example, ξ i =1 corresponds to forcibly inserting an abnormality into the device in question and generating an alarm, and ξ i = 0 corresponds to clearing the alarm in the device and making it a state where no alarm occurs regardless of the interdependence with other devices, and ξ i =-1 corresponds to leaving the device in its natural state without doing anything special to it. After the intervention is complete, all variables are substituted with 0, and the isolated set is also A ξ Then we return to the original A. Therefore, when another intervention ξ' is performed, it is not affected by the previous intervention ξ.

[0035] Now, suppose that the vertex set V of graph D is known, but the islet set A is unknown (i.e., the propagation rules between each variable are unknown). As a result of the intervention, the value taken by each variable (i.e., each variable X i The actual values ​​of the interventions can be observed. Interventions can be performed multiple times, and the next intervention can be determined based on the observed results of previous interventions. When interventions are performed multiple times, the set of interventions is called an intervention experiment I={ξ 1 ,ξ 2 ,···,ξ |I| Let's call it}. In this case, how should we design an intervention experiment to identify the propagation rules between each variable, i.e., A? As will be discussed later, various intervention experiments can be considered if the sole purpose is to identify A, but intervention is generally costly (corresponding to the time required for anomaly insertion and the operational costs of engineers), so intervention experiments have advantages and disadvantages from the following perspectives:

[0036]

number

[0037] (Baseline method) In relation to the proposed method in this embodiment, two simple methods will be described as baselines. Note that these baseline methods are not publicly known techniques. The propagation graph reconstruction device 100 according to this embodiment may execute baseline method 1 or baseline method 2.

[0038] <Baseline Method 1> Vertex Pair<i,j> In contrast, intervention ξ <i,j> ξ i<i,j> =1,ξ j <i,j> =-1,ξ k <i,j> = 0 (k ≠ i, j), we define the intervention experiment I={ξ <i,j>} <i,j>∈V×V is called baseline method 1. In this method, ξ <i,j> By executing j If =1, it exists and X j = 0, it does not exist), and then repeats this for all vertex pairs, so we can clearly identify the isolating set A. On the other hand, NI=|V|(|V|-1), TI=|V|(|V|-1) 2 ,MI=|V|-1, and there is a problem that each index becomes extremely large.

[0039] <Baseline Method 2> Baseline method 2 is a method for finding the child vertices of each vertex i by exhaustive search, and its pseudocode is shown in Figure 3.

[0040] In intervention ξ, if 0 is assigned to the variables of all child vertices of vertex i, then ξ i = 1, 1 should not be propagated to other vertices. Based on this idea, baseline method 2 starts with the case where the number of child vertices is 0, and executes intervention while increasing the number of child vertices to 1, 2, ..., m, ..., and so on. i When =1 stops propagating (when the child vertex set is identified), ^ Add the arc that is known to exist to A.

[0041] The algorithm in Figure 3 executes the above process for all parent vertices. The number of interventions in this algorithm varies depending on the order in which child vertex candidates are selected, but in the worst case,

[0042]

number

[0043]

number

[0044]

number

[0045] (Preparation of terms) Before describing the technology according to this embodiment, we will first prepare some terminology. A directed graph is said to be strongly connected if there is a directed path between any two points on the graph. A maximal and strongly connected subgraph is called a strongly connected component (SCC). A vertex that loses strong connectivity when removed from a strongly connected directed graph is called a strong articulation point (SAP). A minimal set of vertices that loses strong connectivity when removed from a strongly connected directed graph is called a strong articulation set (SAS) (it should be noted that this term is not commonly used).

[0046] For any strongly connected directed graph, there is not necessarily a SAP, but there is always a SAS. A directed graph that is not strongly connected has multiple SCCs S1,S2,...,S n Then, a new directed graph D'(V'={v' i} n i=1 ,A´) can be defined.

[0047] ·S i o v´ i Considered ·S i From S j There is an arc (v´ ) if and only if there is a directed edge to (j ≠ i). i ,v´ j ) exists ((v´ i ,v´ j )∈A´) Since D' defined in this way is acyclic, we will call it an SCC-DAG. The relationship between SCCs can be described based on the parent-child relationships in an SCC-DAG. For example, if v'1 is the parent vertex of v'2, then S1 is the parent SCC of S2, and if v'3 is the descendant vertex of v'4, then S3 is the descendant SCC of S4.

[0048] The above definitions can be interpreted as follows in terms of a model of alarm propagation in the target system 40. If the propagation graph is strongly connected, when an alarm occurs in any device, the alarm propagates to all devices. In this case, if alarm clearing work is performed in the group of devices that correspond to the SAS, the alarm will only propagate to devices in the SCC to which the device where the alarm first occurred belongs, and devices in the descendant SCCs of that SCC.

[0049] As a specific example, consider the directed graph shown in Figure 4. This graph is not strongly connected because there is no directed path from vertex 3 to vertex 0. It has three SCCs, S1, S2, and S3, and can form an SCC-DAG as shown in Figure 5. According to this, S2 and S3 are child SCCs of S1. Looking at the strongly connected subgraph S3, vertex 9 becomes a SAP. In fact, if vertex 9 is removed as shown in Figure 6, the strong connectivity is lost and it is decomposed into two SCCs.

[0050] (Proposed method) The method proposed in this embodiment will be described below. The propagation graph restoration device 100 of this embodiment performs the operations of this proposed method.

[0051] The propagation graph restoration device 100 obtains the arc set A of the propagation graph D(V, A) in the following procedure. Pseudo code corresponding to the following procedure is shown in FIG. 7. The pseudo code shown in FIG. 7 corresponds to the processing procedure of the program executed by the propagation graph restoration device 100. Line numbers are given in FIG. 7. Below, the line numbers are referred to as steps (S). For example, the first line is S1.

[0052] In S1, a graph (a set of vertices) is input to the propagation graph restoration device 100. In S2, the propagation graph restoration device 100 decomposes the vertices in the graph into a SAS and multiple SCCs or DAGs using the decompose function. Three operations, FindSAS, CreateSCCDAG, and CompleteSCCDAG, are executed within this function (S10 to S21), so these will be explained first.

[0053] FindSAS: First, ξ i =1,ξ j =-1 (∀j≠i) (called "one intervention for vertex i") is performed across all vertices i=1,2,...,|V|. If all variables become 1 when any one intervention is performed, D is strongly connected. If D is not strongly connected, skip this step and jump to CreateSCCDAG. If D is strongly connected, exhaustively perform interventions that set one vertex to 0, another vertex to 1, and all other vertices to -1. If there is a case where the value 1 has not propagated to all vertices (except the vertex fixed to 0), then the vertex fixed to 0 at that time is the SAP. If no SAP is found, exhaustively perform interventions that set two vertices to 0, one vertex to 1, and the remaining vertices to -1, searching for the SAS. If not found, increase the number of vertices fixed to 0 to three, four, and so on, and repeat until the SAS is found.

[0054] CreateSCCDAG: After the SAS is found, an SCC-DAG is created from the subgraph excluding the SAS. First, all patterns of intervention are performed, with the vertices in the SAS set to 0, one of the remaining vertices set to 1, and the others set to -1 (interventions already performed in FindSAS do not need to be repeated). Based on the inclusion relationship of the observation results at this time (the set of vertices with a value of 1), a part of the SCC-DAG can be created using a Hasse diagram. Specifically, the different observation results obtained as a result of performing one intervention on each vertex are represented as X1,...,X n Then, the number of SCCs and n are the same.

[0055] Xi Consider a directed graph with vertices (i=1, ,n), and let X i ⊃X j And X i ⊃X k ⊃X j X such that k If and only if there is no arc (X i ,X j ) Draw an X i From the original X i The SCC S is obtained by removing all elements belonging to the arc vertices of i The parent-child relationship (X i ,X j ) is the parent-child relationship of the desired SCC-DAG (S i ,S j ) This SCC-DAG does not have some arcs that should exist, but these are discovered by the next operation, CompleteSCCDAG.

[0056] As an example, consider the propagation graph shown in Figure 8. There is a vertex set V = {1, 2, , 12}, and an arc set A is indicated by an arrow. When one intervention is performed on each vertex, the resulting patterns of observations are five: X1 = {1, 2, 3, 6, 7}, X2 = {4, 5, 6, 7, 8, 9, 10, 11, 12}, X3 = {6, 7}, X4 = {8, 9, 10, 11, 12}, and X5 = {10, 11, 12}. From this, we can see that there are five SCCs: S1, S2, S3, S4, and S5. Furthermore, from the inclusion relationships of the observation patterns, X1⊃X3, X2⊃X3, and X2⊃X4⊃X5, we can see the parent-child relationships in the SCC-DAG: (S1, S3), (S2, S3), (S2, S4), and (S4, S5). At the same time, we can also see that S1={1,2,3}, S2={4,5}, S3={6,7}, S4={8,9}, and S5={10,11,12}.

[0057] Therefore, this CreateSCCDAG operation constructs an SCC-DAG consisting of five vertices v'1, v'2, v'3, v'4, and v'5 and the arc indicated by the arrow A, as shown in Figure 9. However, it should be noted that it is not possible to determine whether some arcs exist. Since arc (5,12) exists in the actual original graph, arc (v'2, v'5) indicated by the arrow B should also exist in the SCC-DAG. This will be discovered in the next CompleteSCCDAG.

[0058] Complete SCCDAG: In the following intervention, the number of vertices in the SAS is set to 0. We want to find the remaining arcs in the SCC-DAG. First, we find the SCCs in the SCC-DAG with a distance of 2 (reachable by two directed edges). i ,S j >S i S j In the SCC-DAG, we examine the parent-child relationship of i ,S j >, and then calculate the minimum cut set that cuts all paths between them. i An intervention is performed by setting any vertex in to 1 and the others to -1.

[0059] At this time, S j If the vertex in is 1, then the arc (S i ,S j ) exists, and if it is 0 it does not exist. This process is performed between all SCCs with a distance of 2, and a new SCC-DAG with arcs added is obtained. This new SCC-DAG is then used to examine the parent-child relationships between SCCs with a distance of 3. This process is then repeated while successively increasing the distance between the SCCs whose parent-child relationships are being examined, and the SCC-DAG finally obtained is the desired SCC-DAG.

[0060] ​​So far, we have seen that a graph D can be decomposed into one SAS and an SCC-DAG consisting of multiple SCCs using FindSAS, CreateSCCDAG, and CompleteSCCDAG (if an SCC consisting of one vertex has a parent-child relationship in an SCC-DAG, they can be considered a DAG). By recursively applying the above operations to the decomposed SCCs and SASs, it is possible to further decompose them hierarchically into SCC-DAGs and SASs. However, in this case, it is necessary to intervene by substituting 0 for vertices in the appropriate SASs to maintain the decomposed state.

[0061] Ultimately, the original graph D is decomposed into SAPs at some level and a DAG consisting of vertices and arcs. In the algorithm in Figure 7, these SAPs and DAGs are stored in SAPset and DAGset, respectively. Therefore, to reconstruct the arcs for the original graph D, it is necessary to restore the arcs lost by the decomposition by combining the following three operations:

[0062] S3-S4: Find arcs between decomposed DAGs (FindArcsBetweenDAGs) S5~S6: Find arcs between the decomposed DAG and a vertex (SAP at some level) (FindArcsBetweenDAG-SAP) S7~S8: Find arcs between vertices (between SAPs at some level) (FindArcsBetweenSAPs) An example is shown in Figure 10. Here, the propagation graph in Figure 4 is decomposed into multiple DAGs and SASs using FindSAS, CreateSCCDAG, and CompleteSCCDAG. The numbers correspond to the vertices in the graph in Figure 4, the arrows marked A indicate the decomposition process, and the arrows marked B indicate the parent-child relationships between SCCs.

[0063] However, in this example, the SCC-DAG has been determined without the need to perform CompleteSCCDAG. Now, for DAGs and SAPs, it is necessary to estimate the arcs that may exist between them. Possible arcs between DAGs are represented by arrows indicated by C, arcs that may exist between SAPs by arrows indicated by D, and arcs that may exist between DAGs and SAPs by arrows indicated by E (dotted lines are used because they may not actually exist). The direction of the arrows also has meaning; for arrows with one head, the starting point of the arrow (the side without an arrowhead) represents a DAG / SAP that may contain a parent vertex, and the ending point of the arrow (the side with an arrowhead) represents a DAG / SAP that may contain a child vertex. For arrows with both heads, both ends represent DAGs / SAPs that may contain a parent vertex and a child vertex.

[0064] This relationship corresponds to the parent-child relationship of the SCCs upstream of the DAG / SAP. For example, 3 (SAP) and 4 (DAG) share a parent-child relationship with their respective upstream SCCs, 123 (SCC) and 4,5 (SCC), so this relationship is followed. Similarly, 1,2 (DAG) and 3 (SAP) are derived from the same upstream SCC, 1,2,3 (SCC), so the arrows are double-headed. By examining the upstream SCCs in this way, the presence and type of dotted arrows between each DAG / SAP can be determined. Then, the system performs three operations: FindArcsBetweenDAGs (corresponding to the dotted arrow shown in C), FindArcsBetweenDAG-SAP (corresponding to the dotted arrow shown in E), and FindArcsBetweenSAPs (corresponding to the dotted arrow shown in D). The system then determines whether the parent-child relationships indicated by the arrows actually exist, and if so, which vertices are connected by the arcs.

[0065] FindArcsBetweenDAGs: Let us consider the case where there is a dotted arrow from DAG1 to DAG2 for two DAGs, DAG1 and DAG2. In the following intervention, we assume that the original D has been decomposed to the level where DAG1 and DAG2 arise by substituting 0 into the appropriate SAS. The most basic algorithm is as follows:

[0066] First, an intervention is performed by assigning 1 to an appropriate vertex (call it vertex α) in DAG1 and 0 to its child vertices (vertices not mentioned are assigned -1). At this time, if there is no vertex in DAG2 with a value of 1, there will be no arc from vertex α to any vertex in DAG2, but if there is a vertex with a value of 1, then an arc will extend from vertex α to the most upstream vertex among them (all vertices whose parent vertices are not value 1). Then, an intervention is performed by assigning 0 to the most upstream vertex in DAG2.

[0067] As before, if there are no vertices in DAG2 with a value of 1, then there are no more arcs from vertex α to any vertex in DAG2, and if there are vertices with a value of 1, then an arc extends from vertex α to the upstream vertex within DAG2.

[0068] By repeating this process, it is possible to determine whether there are arcs from vertex α to all vertices in DAG2. By repeating this process for all vertices in DAG1, it is possible to determine whether there are arcs from all vertices in DAG1 to all vertices in DAG2.

[0069] The above algorithm is an exhaustive search, so it is effective when it is expected that there will be many arcs from DAG1 to DAG2. However, when it is expected that there will be only a small number of arcs (due to domain knowledge, for example), it may be possible to perform an efficient search. For example, an intervention is performed by assigning 1 only to the most upstream vertex of DAG1. If, as a result, there is no vertex in DAG2 that is 1, it is clear that there is no arc from a vertex in DAG1 to a vertex in DAG2, and further search is unnecessary. Also, an intervention is performed by assigning 1 only to an appropriate vertex (say vertex β), not limited to the most upstream vertex of DAG1. If, as a result, there is no vertex in DAG2 that is 1, it is clear that there is no arc from a descendant vertex of vertex β to a vertex in DAG2. When it is expected that there will be only a small number of arcs, it is possible to perform appropriate intervention to prune the search.

[0070] FindArcsBetweenDAG-SAP: In FindArcsBetweenDAGs, we simply consider one of the DAGs to consist of one vertex.

[0071] FindArcsBetweenSAPs: In FindArcsBetweenDAGs, we simply consider that both DAGs consist of one vertex.

[0072] If there is room for the number of simultaneously intervened vertices, it is also possible to simultaneously perform interventions that are known not to affect each other. For example, in Figure 10, FindArcsBetweenDAG-SAP, which checks whether there is an arc between 4 (DAG) and 5 (SAP), and FindArcsBetweenSAPs, which checks whether there is an arc between 7 (SAP) and 9 (SAP), can be executed simultaneously without any problems, since it is clear from the already known propagation rules that the results of each intervention will not affect each other. When performing such processing, the maximum number of simultaneously intervened vertices MI increases, but the number of interventions NI can be reduced.

[0073] (Other examples) The technology according to the present embodiment has been described above as providing a method for constructing a propagation graph corresponding to the propagation rules for binary variables. However, the technology according to the present embodiment can also be applied to continuous variables that are correlated with each other. For example, the technique according to the present embodiment can be applied by setting an appropriate threshold and establishing a rule that if a certain variable is moved by a certain amount and the value of another variable changes by more than the threshold, the variables are considered to be correlated and an arc is recognized. Furthermore, by allowing multiple interventions and combining a mechanism for determining the dominance of value propagation, the technique can also be applied to random variables.

[0074] (Example of hardware configuration) The propagation graph restoration device 100 can be realized by, for example, causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0075] That is, the propagation graph restoration device 100 can be realized by using hardware resources such as a CPU and memory built into a computer to execute a program corresponding to the processing performed by the propagation graph restoration device 100. The program can be recorded on a computer-readable recording medium (such as a portable memory) and can be saved or distributed. The program can also be provided via a network such as the Internet or email.

[0076] Fig. 11 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 11 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected by a bus BS.

[0077] A program for realizing processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0078] When an instruction to start the program is received, the memory device 1003 reads out the program from the auxiliary storage device 1002 and stores it. The CPU 1004 implements the functions related to the propagation graph restoration device 100 in accordance with the program stored in the memory device 1003. Specifically, the CPU 1004 executes, for example, the procedure shown in FIG.

[0079] The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) etc. according to a program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the calculation results.

[0080] (Effects of the embodiment) As explained above, in this embodiment, by appropriately designing an intervention experiment on system components, a DCG is constructed that represents propagation rules between variables that represent the states of each component. This method only assumes that variables exhibit deterministic behavior, i.e., value propagation, so it is possible to construct a propagation graph even when it is not possible to use a conditional independence test for variables.

[0081] In addition, the method of this embodiment can decompose the entire graph into DAGs, etc., making it possible to examine parent-child relationships between small graphs and prune unnecessary searches. Therefore, depending on the propagation graph, it is expected that the number of interventions, the total number of intervention vertices, and the maximum number of simultaneously intervention vertices can be kept small compared to simple methods, making it possible to realize low-cost intervention experiments.

[0082] Here, we show the results of an evaluation performed on the case where the propagation model D(V, A) is a DAG. |V| = 10, 30, 50, and 100 DAG instances were randomly generated for each with an arc generation probability of 0.3 (disconnected graphs are also allowed). NI, TI, and MI were evaluated using the method proposed in this embodiment and baseline methods 1 and 2.

[0083] The results are shown in Figures 12 to 14 and Figure 15. In Figures 12 to 14, the horizontal axis represents instances and the vertical axis represents the value of each index, and Figure 15 shows the average value of the index for 100 instances for each case. Figures 12 to 14 show that in all cases, the proposed method generally achieves smaller index values ​​than Baselines 1 and 2, demonstrating that DAGs can be identified at low cost. Figure 15 also shows that the proposed method does indeed achieve smaller index values ​​on average. From the above, it can be seen that in such cases, the proposed method of this embodiment has an advantage over simple methods.

[0084] (Addendum) This specification discloses at least the propagation graph restoration device, propagation graph restoration method, and program described in the following sections. (Additional note 1) Memory and at least one processor coupled to said memory; Including, The processor: In a target system having a plurality of components, determining an intervention of an event exhibiting deterministic behavior for each component; Based on the observed data obtained as a result of the intervention, a propagation graph is estimated that describes the chain of events. Propagation graph recovery device. (Additional note 2) The processor: Based on the information of the propagation graph during the estimation, we conduct an intervention experiment to hierarchically decompose the propagation graph into strongly connected components by combining interventions that cause events to occur and interventions that prevent events from occurring and block the propagation of events. Item 1. A propagation graph reconstruction device according to item 1. (Additional note 3) The processor: The propagation graph is estimated by constructing a Hasse diagram based on the inclusion relations of the observations of events propagated by interventions. 3. The propagation graph reconstruction device according to claim 1 or 2. (Additional note 4) The processor: By constructing the Hasse diagram, at least one of the event propagation relations between strongly connected components, the event propagation relations between strongly connected components and vertices, and the event propagation relations between vertices is estimated. Item 3. A propagation graph reconstruction device according to item 3. (Additional note 5) 1. A computer-implemented method for propagation graph reconstruction, comprising: an intervention execution step of determining an intervention for an event exhibiting deterministic behavior for each component in a target system having a plurality of components; a graph construction step of estimating a propagation graph describing the chain of events based on observation data obtained as a result of the intervention; A propagation graph recovery method comprising: (Additional note 6) A non-transitory storage medium storing a program for causing a computer to function as the propagation graph reconstruction device according to any one of appendixes 1 to 4.

[0085] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0086] 10 Graph Construction 20 User Interface 30 Intervention Implementation Department 40 Target Systems 100 Propagation graph restoration device 1000 Drive Device 1001 Recording media 1002 Auxiliary storage 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output Device

Claims

1. an intervention execution unit that determines intervention for an event that exhibits deterministic behavior for each component in a target system having a plurality of components; a graph construction unit that estimates a propagation graph that describes the chain of events based on observation data obtained as a result of the intervention; A propagation graph reconstruction device comprising:

2. The intervention execution unit Based on the information of the propagation graph in the middle of estimation by the graph construction unit, an intervention experiment is performed to hierarchically decompose the propagation graph into strongly connected components by combining an intervention that causes an event to occur and an intervention that prevents the event from occurring and blocks the propagation of the event. The propagation graph reconstruction device according to claim 1 .

3. The graph construction unit A propagation graph is estimated by constructing a Hasse diagram based on the inclusion relationship of the observation results of the events propagated by the intervention executed by the intervention execution unit. The propagation graph reconstruction device according to claim 1 .

4. The graph construction unit By constructing the Hasse diagram, at least one of the event propagation relations between strongly connected components, the event propagation relations between strongly connected components and vertices, and the event propagation relations between vertices is estimated. The propagation graph reconstruction device according to claim 3 .

5. 1. A computer-implemented method for propagation graph reconstruction, comprising: an intervention execution step of determining an intervention for an event exhibiting deterministic behavior for each component in a target system having a plurality of components; a graph construction step of estimating a propagation graph describing the chain of events based on observation data obtained as a result of the intervention; A propagation graph recovery method comprising:

6. A program for causing a computer to function as each unit in the propagation graph restoration device according to any one of claims 1 to 4.

Images