Estimation system, information processing apparatus, and estimation method

Abstract

To provide an estimation system, an information processing apparatus, and an estimation method for improving the accuracy of identifying a failure cause.SOLUTION: A log analysis unit 101 analyzes a log related to a failure to determine a failure classification of the failure content. A document extraction prompt generation unit 103 causes an LLM 20 to extract a corresponding sentence corresponding to the failure classification determined by the log analysis unit 101 from a predetermined technical document. A failure cause analysis prompt generation unit 104 causes the LLM 20 to infer the failure cause on the basis of the corresponding sentence extracted by the LLM 20 caused by the document extraction prompt generation unit 103. An output unit 105 outputs the failure cause.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an estimation system, an information processing device, and an estimation method. [Background technology]

[0002] For the stable operation of IT (Internet Technology) systems and networks, it is important to have fault cause analysis technology that can speed up fault recovery. In large-scale networks, it is important to both identify the fault location by identifying the device where the fault occurred, and to perform fault cause analysis to identify the specific cause that can lead to countermeasures.

[0003] In recent years, virtualization and multi-vendor support have made information processing systems more complex, resulting in a greater variety of failure causes. For example, consider a network that connects multi-vendor RUs (Remote Units) and DUs (Distributed Units). When a failure occurs in such a network, possible causes include hardware failure, hardware compatibility issues, software bugs, software compatibility issues, and various configuration errors. Due to this diversification of failure causes, fault analysis requires the isolation and analysis of a wide range of failure causes.

[0004] Conventionally, rule-based analysis techniques or fault case-based analysis techniques have been widely used for fault cause analysis. Rule-based analysis techniques classify faults using analytical algorithms and AI (Artificial Intelligence) techniques such as large-scale language models according to rules defined in advance by experts. Fault case-based analysis techniques infer current faults by having AI or LLMs (Large Language Models) learn from logs and documents of past fault cases.

[0005] As a technology for analyzing the cause of failures using AI, for example, a cause estimation system has been proposed that accepts text information about the error that occurs when a failure occurs, and uses feature values ​​created based on the information from both the failure and success times to infer the cause of the failure. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent Publication No. 2021-196730 Summary of the Invention [Problem to be solved by the invention]

[0007] However, while conventional fault cause analysis techniques were able to analyze fault classifications that outlined the general outline of a fault, their analysis of specific fault causes that could lead to countermeasures was limited. Fault classification analysis refers to a broad analysis of faults, such as hardware failures, software bugs, RU configuration errors, or DU configuration errors. In contrast, fault cause analysis refers to an analysis that goes as far as identifying specific causes that could lead to countermeasures, such as incompatibility of cables or mismatched IDs.

[0008] For example, with rule-based analysis techniques, the scope of analysis for specific failure causes is limited to failure causes predefined as rules. Similarly, with failure case-based analysis techniques, the scope of analysis is limited to similar cases of failures that occurred in the past. This makes it difficult to make highly accurate estimates in failure cause analysis.

[0009] Furthermore, the technology that infers the cause of failure using features based on information from both failures and successes is a failure case-based analysis method, and the scope of analysis is limited to similar cases of failures that occurred in the past, making it difficult to make highly accurate inferences in failure cause analysis.

[0010] The disclosed technology has been made in view of the above, and aims to provide an estimation system, an information processing device, and an estimation method that improve the accuracy of identifying the cause of a fault. [Means for solving the problem]

[0011] In one aspect of the estimation system, information processing device, and estimation method disclosed herein, the system includes a machine learning model. The system further includes the following units: a log analysis unit analyzes a log related to a failure and determines a failure classification of the failure content; a first inference execution unit causes the machine learning model to extract corresponding sentences corresponding to the failure classification from a predetermined technical document; a second inference execution unit causes the machine learning model to infer a cause of the failure based on the corresponding sentences; and an output unit outputs the cause of the failure. [Effects of the Invention]

[0012] In one aspect, the present invention can improve the accuracy of identifying the cause of a fault. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram of an estimation system according to a first embodiment. [Figure 2] FIG. 2 is a diagram showing an example of a fault classification logic tree for an RU-DU interoperability test. [Figure 3] FIG. 3 is a diagram showing an example of a fault classification logic tree created using LLM. [Figure 4] FIG. 4 is a diagram showing another example of a fault classification logic tree created using LLM. [Figure 5] FIG. 5 is a diagram showing an example of the occurrence probability acquisition prompt. [Figure 6] FIG. 6 is a diagram illustrating an example of a document extraction prompt. [Figure 7] FIG. 7 is a diagram showing another example of a document extraction prompt. [Figure 8] FIG. 8 is a diagram showing an example of a fault cause analysis prompt. [Figure 9]FIG. 9 is a flowchart of a fault cause analysis process performed by the estimation system according to the first embodiment. [Figure 10] FIG. 10 is a diagram illustrating a comparison of estimation results between the case of simple LLM replacement and the case of using the estimation system according to the first embodiment. [Figure 11] FIG. 11 is a block diagram of an estimation system according to the second embodiment. [Figure 12] FIG. 12 is a flowchart of a fault cause analysis process performed by the estimation system according to the second embodiment. [Figure 13] FIG. 13 is a block diagram of an estimation system according to a third embodiment. [Figure 14] FIG. 14 is a diagram showing an example of a cause analysis prompt. [Figure 15] FIG. 15 is a flowchart of a fault cause analysis process performed by the estimation system according to the third embodiment. [Figure 16] FIG. 16 is a block diagram of an estimation system according to a fourth embodiment. [Figure 17] FIG. 17 is a block diagram of an estimation system according to a fifth embodiment. [Figure 18] FIG. 18 is a block diagram of an estimation system according to a sixth embodiment. [Figure 19] FIG. 19 is a diagram illustrating an example of a hardware configuration of the estimation system. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, embodiments of the estimation system, information processing device, and estimation method disclosed herein will be described in detail with reference to the accompanying drawings. Note that the estimation system, information processing device, and estimation method disclosed herein are not limited to the following embodiments. [Example]

[0015] 1 is a block diagram of an estimation system according to Example 1. As shown in FIG.

[0016] LLM20 is a type of generative AI machine learning model, a language model built using multiple datasets and deep learning techniques. LLM20 is deployed, for example, on a server in a cloud environment.

[0017] Here, in this embodiment, the use of LLM20, a large-scale language model, will be explained as an example, but it is also possible to use other language models such as SLM (Small Language Model), or multimodal generative AI that can input and output images and tables.

[0018] The fault analysis device 10 acquires information about a fault that has occurred in a target system that is the target of fault cause analysis, and estimates the cause of the fault by analyzing the fault using the LLM 20. The fault analysis device 10 is an information processing device.

[0019] The following describes the details of the fault analysis device 10. The fault analysis device 10 has a log analysis unit 101, an occurrence probability acquisition prompt generation unit 102, a document extraction prompt generation unit 103, a fault cause analysis prompt generation unit 104, and an output unit 105. Here, a prompt is instruction information for causing the LLM 20 to output desired information.

[0020] The log analysis unit 101 receives an input of a query describing the details of a failure that has occurred in a target system. Then, the log analysis unit 101 identifies a log to be analyzed according to the acquired details of the failure. Next, the log analysis unit 101 acquires the identified log to be analyzed from logs of various events and operations of the target system. Here, the log analysis unit 101 may acquire the details of the failure and the log to be analyzed directly from the target system, or may acquire them through input by an operator using an input device (not shown).

[0021] Next, the log analysis unit 101 analyzes the acquired log to identify phrases contained in the log and interpret the content. After that, the log analysis unit 101 outputs a query describing the fault content and the analysis result of the log to the occurrence probability acquisition prompt generation unit 102.

[0022] In this way, the log analysis unit 101 analyzes the log related to the failure and determines the failure classification of the failure content. More specifically, the log analysis unit 101 determines the failure classification using a failure analysis logic tree that indicates the failure classification corresponding to the failure content. The failure analysis logic tree is, for example, a failure analysis logic tree automatically generated by AI, a failure analysis logic tree generated based on the experience of an expert, or a failure analysis logic tree generated by an expert making modifications to a logic tree automatically generated by AI.

[0023] The occurrence probability acquisition prompt generation unit 102 has a fault classification logic tree in advance. The fault classification logic tree may be automatically created using LLM or AI, or may be created by an expert using his or her experience. Alternatively, the fault classification logic tree may be created by creating a primary draft using LLM or AI, and then having an expert make minor corrections to the primary draft.

[0024] FIG. 2 is a diagram showing an example of a fault classification logic tree for an RU-DU interoperability test. Here, the RU-DU interoperability test is a test regarding the interoperability of an RU and a DU in a network to which the RU and DU are connected. The fault classification logic tree 120 in FIG. 2 is an example of a fault classification logic tree created for the use case of the "RU-DU interoperability test," and is created by creating a first draft by the LLM and then adding minor revisions by experts. In FIG. 2, along with the fault classification logic tree 120, possible fault causes 123 are also listed as examples for each fault classification.

[0025] The fault classification logic tree 120 is an example of a logic tree held by the occurrence probability acquisition prompt generation unit 102. The fault classification logic tree 120 has a root node 121 representing an occurred fault (Incident), and fault classification nodes 122 indicating possible fault classifications for that fault are arranged below the root node 121. In the fault classification logic tree 120, an example is shown in which the fault classification nodes 122 have one hierarchical level, but the fault classification nodes 122 can also be arranged hierarchically. Furthermore, the fault causes 123 indicate, for each fault classification, fault causes that may be the cause of the occurrence of a fault corresponding to that fault classification. The fault causes 123 are an example of fault causes finally obtained by the fault analysis device 10.

[0026] 2, the names of fault classification items are registered in the fault classification nodes 122. The fault classification logic tree 120 includes, for example, hardware faults or incompatibility and software bugs. Other fault classifications in the fault classification logic tree 120 include poor quality of wireless signal, configuration errors, software versions, and environmental factors.

[0027] Fig. 3 is a diagram showing an example of a fault classification logic tree created using LLM, and Fig. 4 is a diagram showing another example of a fault classification logic tree created using LLM.

[0028] 3 is a fault classification logic tree for an application that runs on specific virtual machine software. The fault classification logic tree 131 displays a list of item names of fault classifications for an application that runs on specific virtual machine software.

[0029] The fault classification logic tree 131 includes fault classifications such as virtual machine configuration errors, software bugs, and hardware compatibility issues. The fault classification logic tree 131 also includes fault classifications such as network connectivity issues, storage issues, and performance issues. The fault classification logic tree 131 also includes fault classifications such as security vulnerabilities, licensing issues, and backup and recovery issues.

[0030] 4 is a fault classification logic tree for a belt conveyor in a plant. The fault classification logic tree 132 displays a list of item names of fault classifications for the belt conveyor in the plant.

[0031] The fault classification logic tree 132 includes fault classifications such as mechanical failures, electrical failures, and operational errors. The fault classification logic tree 132 also includes fault classifications such as maintenance issues, material handling issues, environmental factors, and safety hazards. The fault classification logic tree 132 also includes fault classifications such as equipment age or wear and tear.

[0032] In this way, the fault classification items differ depending on the target system in which the fault occurs. Furthermore, the fault classification items differ depending on the type of fault that has occurred. Therefore, the occurrence probability acquisition prompt generation unit 102 stores a fault classification logic tree for each target in which a fault has occurred and for each fault that has occurred.

[0033] 1, the explanation will be continued. The occurrence probability acquisition prompt generation unit 102 receives input of a query describing the details of the failure and the analysis results of the log from the log analysis unit 101. Then, the occurrence probability acquisition prompt generation unit 102 generates an occurrence probability acquisition prompt that instructs the calculation of the occurrence probability of a failure classification related to the failure that has occurred, based on the query describing the details of the failure, the analysis results of the log, and a failure classification logic tree for classifying the causes of the failure.

[0034] For example, the occurrence probability acquisition prompt generation unit 102 generates an occurrence probability acquisition prompt in the following procedure. Fig. 5 is a diagram showing an example of an occurrence probability acquisition prompt. For example, the occurrence probability acquisition prompt generation unit 102 has a format in which the columns for fault category (Category) and fault content (Incident) in the occurrence probability acquisition prompt 201 shown in Fig. 5 are not entered. Hereinafter, this format will be referred to as an occurrence probability acquisition prompt format.

[0035] The occurrence probability acquisition prompt generation unit 102 identifies the target where the failure occurred and the failure that occurred based on the query describing the failure details and the analysis result of the log. Next, the occurrence probability acquisition prompt generation unit 102 identifies the target where the failure occurred and the failure classification logic tree corresponding to the failure that occurred.

[0036] Next, the occurrence probability acquisition prompt generation unit 102 selects one fault classification from the fault classifications registered in the identified fault classification logic tree. Next, the occurrence probability acquisition prompt generation unit 102 registers the selected fault classification in the fault classification field of the occurrence probability acquisition prompt format. Next, the occurrence probability acquisition prompt generation unit 102 registers the details of the fault that has occurred in the fault classification field of the occurrence probability acquisition prompt format. In this way, the occurrence probability acquisition prompt generation unit 102 generates the occurrence probability acquisition prompt 201.

[0037] Then, the occurrence probability acquisition prompt generation unit 102 inputs the generated occurrence probability acquisition prompt to the LLM 20. Thereafter, the occurrence probability acquisition prompt generation unit 102 acquires the occurrence probability for each failure category regarding the occurred failure as an inference result output from the LLM 20.

[0038] For example, when the occurrence probability acquisition prompt generation unit 102 receives the occurrence probability acquisition prompt 201 in Fig. 5, it acquires a response 202 from the LLM 20. In this case, the occurrence probability acquisition prompt generation unit 102 acquires 90% as the occurrence probability of the fault classification of Hardware Faults or Incompatibility.

[0039] The occurrence probability acquisition prompt generation unit 102 acquires the occurrence probability of the fault classification for all fault classifications in the identified fault classification logic tree. Then, the occurrence probability acquisition prompt generation unit 102 outputs the occurrence probability of each fault classification related to the occurred fault to the document extraction prompt generation unit 103. In addition, the occurrence probability acquisition prompt generation unit 102 outputs a query describing the fault content and the analysis result of the log to the document extraction prompt generation unit 103.

[0040] The occurrence probability acquisition prompt generation unit 102 is an example of a “third inference execution unit.” The occurrence probability acquisition prompt generation unit 102 then causes the LLM 20, which is a machine learning model, to infer the occurrence probability for each of the fault categories.

[0041] The document extraction prompt generation unit 103 receives an input of the occurrence probability of each fault category for the fault that has occurred from the occurrence probability acquisition prompt generation unit 102. The document extraction prompt generation unit 103 also receives an input of a query describing the fault content and the log analysis results from the occurrence probability acquisition prompt generation unit 102. Here, the document extraction prompt generation unit 103 has a threshold value for the occurrence probability of each fault category. The document extraction prompt generation unit 103 identifies a fault category whose occurrence probability exceeds the threshold value.

[0042] Next, the document extraction prompt generation unit 103 receives an input of technical documentation for the failure. The technical documentation for the failure classification is the specification of the device in which the failure occurred or the target system, etc. Then, for each identified failure classification, the document extraction prompt generation unit 103 generates a document extraction prompt that instructs the extraction of a sentence chunk that describes the cause of the failure in each failure classification, based on the failure classification item name and the technical documentation.

[0043] For example, the document extraction prompt generation unit 103 generates a document extraction prompt in the following procedure. Fig. 6 is a diagram showing an example of a document extraction prompt. For example, the document extraction prompt generation unit 103 has a format in which the columns for fault classification (Category) and technical document (Contents) in the document extraction prompt 211 shown in Fig. 6 are not filled in. Hereinafter, this format will be referred to as the document extraction prompt format.

[0044] The document extraction prompt generation unit 103 selects one fault classification from among the fault classifications whose occurrence probability exceeds a threshold. Next, the document extraction prompt generation unit 103 registers the selected fault classification in the fault classification field of the document extraction prompt format. Next, the document extraction prompt generation unit 103 registers the contents of the technical document in the technical document field of the document extraction prompt format. As a result of the above, the document extraction prompt generation unit 103 generates a document extraction prompt 211.

[0045] The document extraction prompt generation unit 103 then inputs the generated document extraction prompt to the LLM 20. After that, the document extraction prompt generation unit 103 acquires a sentence chunk, which is a relevant portion in the technical document regarding the cause of the fault in the fault classification, which is the inference result output from the LLM 20. A document chunk is a group of text, such as a sentence, paragraph, section, or subsection.

[0046] For example, when the document extraction prompt generation unit 103 receives the document extraction prompt 211 in Fig. 6, it acquires a response 212 from the LLM 20. In this case, the document extraction prompt generation unit 103 acquires the sentence chunk described in the response 212 as a document chunk about the cause of a failure in hardware faults or incompatibility.

[0047] 7 is a diagram showing another example of a document extraction prompt. Fig. 7 shows an example of a case where an appropriate text chunk does not exist for the input disability classification, and extraction is not performed. For example, the document extraction prompt generation unit 103 inputs the document extraction prompt 221 in Fig. 7 and obtains a response 222 from the LLM 20. In this case, the document extraction prompt generation unit 103 obtains the response 222 indicating that an appropriate text chunk was not extracted.

[0048] The document extraction prompt generation unit 103 acquires text chunks containing a description of the cause of a failure for all failure classifications whose occurrence probability exceeds a threshold. Then, the document extraction prompt generation unit 103 outputs the text chunks containing a description of the cause of the failure to the failure cause analysis prompt generation unit 104. In addition, the document extraction prompt generation unit 103 outputs to the failure cause analysis prompt generation unit 104 a query containing the details of the failure, the log analysis results, and information on the failure classifications that were the targets of document chunk extraction.

[0049] In this embodiment, the document extraction prompt generation unit 103 reads the entire technical document and causes the LLM 20 to extract document chunks, but the inference method of the LLM 20 is not limited to this. For example, the document extraction prompt generation unit 103 may read the table of contents information of the technical document and cause the LLM 20 to extract document chunks. In this case, the LLM 20 extracts the chapters and sections related to the problem that has occurred, and the document extraction prompt generation unit 103 obtains information about the chapters and sections related to the problem that has occurred.

[0050] The document extraction prompt generation unit 103 is an example of a "first inference execution unit." A sentence chunk containing a description of the cause of a fault in a fault classification is an example of a "corresponding sentence corresponding to the fault classification." A technical document for the fault classification is an example of a "predetermined technical document." The document extraction prompt generation unit 103 causes the LLM 20, a machine learning model, to extract corresponding sentences corresponding to the fault classification determined by the log analysis unit 101 from the predetermined technical document. The document extraction prompt generation unit 103 also generates a sentence extraction prompt for causing the LLM 20 to extract corresponding sentences from the predetermined technical document, inputs the generated sentence extraction prompt to the LLM 20, and causes the LLM 20 to output corresponding sentences. The document extraction prompt generation unit 103 also causes the LLM 20 to extract corresponding sentences corresponding to fault classifications whose occurrence probability is equal to or exceeds a threshold. The document extraction prompt generation unit 103 causes the LLM 20 to extract sentences related to the fault classification as corresponding sentences using technical documents including at least the specifications of the system in which the fault occurred.

[0051] The failure cause analysis prompt generation unit 104 receives an input of a sentence chunk describing the cause of a failure from the document extraction prompt generation unit 103. The failure cause analysis prompt generation unit 104 also receives an input of a query describing the details of the failure, the log analysis results, and information on the failure classification that is the target of document chunk extraction from the document extraction prompt generation unit 103. Then, based on the query describing the details of the failure, the log analysis results, the item names of the failure classifications, and the sentence chunks, the failure cause analysis prompt generation unit 104 generates a failure cause analysis prompt that instructs the user to list the causes of the failure from the perspective of the failure classification.

[0052] For example, the failure cause analysis prompt generation unit 104 generates a failure cause analysis prompt in the following procedure. Fig. 8 is a diagram showing an example of a failure cause analysis prompt. For example, the failure cause analysis prompt generation unit 104 has a format in which the area 232 for entering the failure classification and the column for the occurred failure (Incident) in the failure cause analysis prompt 231 shown in Fig. 8 are not entered. Hereinafter, this format will be referred to as a failure cause analysis prompt format.

[0053] The failure cause analysis prompt generation unit 104 selects one failure classification from the failure classifications from which the sentence chunks were extracted. Next, the failure cause analysis prompt generation unit 104 registers the selected failure classification in area 232. Next, the failure cause analysis prompt generation unit 104 registers the details of the failure that occurred in the failure column. In this way, the failure cause analysis prompt generation unit 104 generates a failure cause analysis prompt 231.

[0054] Then, the failure cause analysis prompt generation unit 104 inputs the generated failure cause analysis prompt and a sentence chunk containing a description of the failure cause in the failure classification to the LLM 20. After that, the failure cause analysis prompt generation unit 104 obtains a list of failure causes in the selected failure classification as an inference result output from the LLM 20.

[0055] 8, the fault cause analysis prompt generating unit 104 acquires a response 233 from the LLM 20. In this case, the fault cause analysis prompt generating unit 104 acquires a list of fault causes indicated in the response 233.

[0056] The fault cause analysis prompt generating unit 104 acquires a list of fault causes for all fault classifications from which document chunks have been extracted, and outputs the acquired list of all fault causes to the output unit 105.

[0057] The failure cause analysis prompt generation unit 104 is an example of a "second inference execution unit." That is, the failure cause analysis prompt generation unit 104 causes the LLM 20, which is a machine learning model, to infer the cause of the failure based on the corresponding sentence that the document extraction prompt generation unit 103, which is the first inference execution unit, causes the LLM 20 to extract. The failure cause analysis prompt generation unit 104 also generates a failure cause analysis prompt that causes the LLM 20 to infer the cause of the failure based on the corresponding sentence, inputs the generated failure cause analysis prompt to the LLM 20, and causes the LLM 20 to output the cause of the failure. The failure cause analysis prompt generation unit 104 causes the LLM 20 to infer multiple items as the cause of the failure, and causes the LLM 20 to output a list of the items of the failure cause.

[0058] The output unit 105 receives an input of a list of failure causes from the failure cause analysis prompt generation unit 104. Then, the output unit 105 provides the list of failure causes to the user by displaying it on a display device such as a monitor (not shown). Alternatively, the output unit 105 may provide the list of failure causes to the user by transmitting the list of failure causes to the user's information terminal device and displaying it on the screen.

[0059] 9 is a flowchart of the fault cause analysis process performed by the estimation system 1 according to the embodiment 1. Next, the flow of the fault cause analysis process performed by the estimation system 1 according to the embodiment 1 will be described with reference to FIG.

[0060] The log analysis unit 101 receives an input of the details of a failure that has occurred in the target system, and then identifies a log to be analyzed according to the acquired details of the failure (step S1).

[0061] The log analysis unit 101 acquires the identified log and performs log analysis to identify phrases contained in the log and interpret the content (step S2).

[0062] The occurrence probability acquisition prompt generation unit 102 receives input of a query describing the details of the failure and the log analysis results from the log analysis unit 101. Next, the occurrence probability acquisition prompt generation unit 102 identifies a failure classification logic tree to be used for analysis from the query describing the details of the failure, the log analysis results, and the cause of the failure. Then, the occurrence probability acquisition prompt generation unit 102 selects one failure classification from the identified failure classification logic tree (step S3).

[0063] Next, the occurrence probability acquisition prompt generation unit 102 generates an occurrence probability acquisition prompt that instructs the calculation of the occurrence probability of the fault classification related to the fault that has occurred, based on a query that describes the selected fault classification and fault content (step S4).

[0064] Next, the occurrence probability acquisition prompt generation unit 102 inputs the generated occurrence probability acquisition prompt to the LLM 20. Then, the occurrence probability acquisition prompt generation unit 102 acquires the occurrence probability of the selected fault classification output from the LLM 20 (step S5).

[0065] The document extraction prompt generator 103 determines whether the occurrence probability of the selected fault classification is equal to or greater than a threshold (step S6). If the occurrence probability of the selected fault classification is less than the threshold (step S6: No), the fault cause analysis process proceeds to step S11.

[0066] On the other hand, if the occurrence probability of the selected fault classification is equal to or greater than the threshold (step S6: Yes), the document extraction prompt generation unit 103 generates a document extraction prompt that instructs the extraction of a sentence chunk based on the item name of the fault classification and the technical document (step S7).

[0067] Next, the document extraction prompt generation unit 103 inputs the generated document extraction prompt to the LLM 20. Then, the document extraction prompt generation unit 103 extracts document chunks that contain descriptions of fault causes related to the selected fault classification from the technical documents output from the LLM 20 (step S8).

[0068] The failure cause analysis prompt generation unit 104 receives an input of a sentence chunk containing a description of the cause of the failure from the document extraction prompt generation unit 103. Then, the failure cause analysis prompt generation unit 104 generates a failure cause analysis prompt based on the query describing the details of the failure, the log analysis results, the failure classification item name, and the sentence chunk (step S9).

[0069] Next, the failure cause analysis prompt generation unit 104 inputs the generated failure cause analysis prompt and a sentence chunk containing a description of the failure cause in the failure classification to the LLM 20. Then, the failure cause analysis prompt generation unit 104 acquires a list of failure causes output from the LLM 20 (step S10).

[0070] The occurrence probability acquisition prompt generator 102 determines whether the analysis of all the fault classifications in the identified fault analysis logic tree has been completed (step S11). If there are any fault classifications that have not been analyzed (step S11: No), the fault cause analysis process returns to step S3.

[0071] On the other hand, if there are no remaining failure classifications that have not been analyzed (step S11: Yes), the output unit 105 outputs a list of failure causes and provides it to the user (step S12).

[0072] 10 is a diagram illustrating a comparison of inference results between a case of simple LLM replacement and a case where the inference system according to the first embodiment is used. The case of simple LLM replacement is a case where in-context learning (ICL) is performed, in which the contents of a specification or the like are input into a prompt to the LLM to instruct a fault cause analysis. Next, a comparison of inference results between a case of simple LLM replacement and a case where the inference system 1 according to the first embodiment is used will be described with reference to FIG.

[0073] Here, an example will be described in which a failure cause analysis is performed for a failure that has occurred due to an "SFP (Small Form-factor Pluggable) compatibility problem." The failure cause list 250 is an inference result in the case of a simple LLM replacement. The failure cause list 260 is an inference result in the case where the estimation system 1 according to this embodiment is used.

[0074] The fault cause list 250 in the case of simple LLM replacement includes a fault cause 251 that is an answer close to the correct answer, which is the actual fault cause. Furthermore, the fault cause list 260 in the case of using the estimation system 1 according to this embodiment includes a fault cause 261 that is an answer close to the correct answer, which is the actual fault cause.

[0075] In this way, an answer close to the correct answer can be provided in either case, but the failure cause list 250 in the case of simple LLM replacement will contain several hundred failure causes. In contrast, the failure cause list 260 in the case of using the estimation system 1 according to this embodiment will contain five failure causes. In other words, by using the estimation system 1 according to this embodiment, it is possible to significantly reduce noise from the failure causes provided as inference results, and the user will be able to easily identify the correct failure cause.

[0076] As described above, the inference system according to this embodiment generates sentence extraction prompts according to a fault classification logic tree prepared in advance and fault cause analysis prompts from the perspective of each fault classification.The inference system according to this embodiment then uses the generated prompts to have the LLM, which is a generation AI, perform inference in stages to identify the cause of the fault.

[0077] This allows the generation AI to be given logical thinking skills to perform fault analysis and list various possible causes of faults, thereby improving the accuracy of fault cause identification. [Example]

[0078] FIG. 11 is a block diagram of an estimation system according to a second embodiment. This embodiment is based on the premise that sufficient training data and empirical knowledge are available for fault classification. The fault analysis device 10 in the estimation system 1 according to this embodiment calculates the occurrence probability of fault classification using an existing fault classification technique instead of the LLM 20. In the following description, the operation of each unit similar to that of the first embodiment will not be described.

[0079] As shown in FIG. 11, the fault analysis device 10 according to this embodiment includes a log analysis unit 101, a document extraction prompt generation unit 103, a fault cause analysis prompt generation unit 104, an output unit 105, and a fault classification determination algorithm unit .

[0080] The fault classification determination algorithm unit 106 has a fault classification determination algorithm for classifying faults that occur using training data and empirical knowledge. For example, the fault classification determination algorithm unit 106 can perform fault classification using a given decision tree algorithm. Alternatively, the fault classification determination algorithm unit 106 can perform fault classification using an expert system that automatically generates a decision tree algorithm from given if-then rules and performs fault classification using the generated decision tree algorithm. Alternatively, the fault classification determination algorithm unit 106 can use classification AI other than LLM, such as cross-iteration batch normalization (CBN), self-organizing map (SOM), or neural network (NN). In this case, the fault classification determination algorithm unit 106 can train the classification AI using log data of fault cases that occurred in the past and infer the fault classification of the occurred fault using the trained classification AI.

[0081] The fault classification determination algorithm unit 106 receives input of a query describing the fault content and the log analysis results from the log analysis unit 101. Then, the fault classification determination algorithm unit 106 uses a fault classification determination algorithm based on the query describing the fault content, the log analysis results, and a fault classification logic tree for classifying the cause of the fault, to identify the fault classification of the fault that has occurred and obtain the occurrence probability for each identified fault classification.

[0082] Then, the fault classification determination algorithm unit 106 outputs to the document extraction prompt generation unit 103 the occurrence probability of the fault classification related to the fault that has occurred, the query describing the fault content, and the analysis result of the log.

[0083] The document extraction prompt generation unit 103 generates a document extraction prompt based on a query describing the details of the failure, the log analysis results, and the occurrence probability of the failure classification.The document extraction prompt generation unit 103 then inputs the generated document extraction prompt to the LLM 20 to acquire text chunks describing the causes of the failure.The failure cause analysis prompt generation unit 104 also generates a failure cause analysis prompt based on the failure classification item names and text chunks describing the causes of the failure in each failure classification.The failure cause analysis prompt generation unit 104 then inputs the failure cause analysis prompt to the LLM 20 to acquire a list of failure causes for all failure classifications from which document chunks have been extracted.

[0084] 12 is a flowchart of the fault cause analysis process performed by the estimation system according to the embodiment 2. Next, the flow of the fault cause analysis process performed by the estimation system 1 according to the embodiment 2 will be described with reference to FIG.

[0085] The log analysis unit 101 receives an input of the details of a failure that has occurred in the target system, and then identifies a log to be analyzed according to the acquired details of the failure (step S21).

[0086] The log analysis unit 101 acquires the identified log and performs log analysis to identify phrases contained in the log and interpret the content (step S22).

[0087] The fault classification determination algorithm unit 106 receives input of a query describing the fault content and the log analysis results from the log analysis unit 101. Then, the fault classification determination algorithm unit 106 identifies the fault classification of the fault that has occurred using a fault classification determination algorithm based on the query describing the fault content, the log analysis results, and the fault classification logic tree, and obtains the occurrence probability for each identified fault classification (step S23).

[0088] The document extraction prompt generating unit 103 selects one of the fault categories whose occurrence probability is equal to or greater than a threshold value (step S24).

[0089] Next, the document extraction prompt generating unit 103 generates a document extraction prompt that instructs extraction of a text chunk based on the item name of the fault classification and the technical document (step S25).

[0090] Next, the document extraction prompt generation unit 103 inputs the generated document extraction prompt to the LLM 20. Then, the document extraction prompt generation unit 103 extracts document chunks that contain descriptions of fault causes related to the selected fault classification from the technical documents output from the LLM 20 (step S26).

[0091] The failure cause analysis prompt generation unit 104 receives an input of a sentence chunk containing a description of the cause of the failure from the document extraction prompt generation unit 103. Then, the failure cause analysis prompt generation unit 104 generates a failure cause analysis prompt based on the query describing the details of the failure, the log analysis results, the failure classification item name, and the sentence chunk (step S27).

[0092] Next, the failure cause analysis prompt generation unit 104 inputs the generated failure cause analysis prompt and a sentence chunk containing a description of the failure cause in the failure classification to the LLM 20. After that, the failure cause analysis prompt generation unit 104 acquires a list of failure causes output from the LLM 20 (step S28).

[0093] Thereafter, the occurrence probability acquisition prompt generation unit 102 determines whether or not the analysis of all the fault categories whose occurrence probability is equal to or greater than the threshold has been completed (step S29). If there are any fault categories that have not been analyzed (step S29: No), the fault cause analysis process returns to step S24.

[0094] On the other hand, if there are no remaining failure classifications that have not been analyzed (step S29: Yes), the output unit 105 outputs a list of failure causes and provides it to the user (step S30).

[0095] As described above, the inference system according to this embodiment performs fault classification using a fault classification algorithm instead of the LLM, and generates sentence extraction prompts and fault cause analysis prompts based on the fault classification. The inference system according to this embodiment then uses the generated prompts to have the LLM, which is a generation AI, perform inference in stages to identify the cause of the fault.

[0096] In this way, if there is sufficient data and empirical knowledge to perform fault classification, fault classification can be performed without using LLM, and fault analysis can be performed by providing the generative AI with logical thinking capabilities, thereby improving the accuracy of identifying the cause of the fault. [Example]

[0097] 13 is a block diagram of an inference system according to a third embodiment. By assigning a viewpoint of fault classification and performing inference using extracted document chunks, it is possible to support fault cause analysis using the LLM20. Furthermore, rather than generating a prompt that simply instructs fault analysis, it is possible to improve the accuracy of identifying the fault cause by generating a prompt that clarifies the basis for the answer.

[0098] The fault analysis device 10 in the estimation system 1 according to this embodiment generates a prompt for identifying the cause of a fault based on a document chunk in two stages. In the first stage, the fault analysis device 10 generates a prompt that lists all possible causes of a fault. In the second stage, the fault analysis device 10 generates a prompt that prompts the user to infer the likelihood of each listed cause of a fault. In the following explanation, the operation of each unit that is the same as in the first embodiment will be omitted.

[0099] As shown in FIG. 13, the fault analysis device 10 according to this embodiment includes a log analysis unit 101, an occurrence probability acquisition prompt generation unit 102, a document extraction prompt generation unit 103, a fault cause enumeration prompt generation unit 141, a cause analysis prompt generation unit 142, and an output unit 105.

[0100] The fault cause enumeration prompt generation unit 141 receives input of a sentence chunk containing a description of the fault cause from the document extraction prompt generation unit 103. The fault cause enumeration prompt generation unit 141 also receives input of a query describing the fault content, the log analysis results, and information on the fault classification that is the target of document chunk extraction from the document extraction prompt generation unit 103.

[0101] Then, the failure cause enumeration prompt generation unit 141 generates a failure cause enumeration prompt that instructs the user to enumerate the causes of the failure from the perspective of the failure classification, based on the query describing the details of the failure, the log analysis results, the item names of the failure classifications, and the sentence chunks. For example, the failure cause enumeration prompt generation unit 141 can generate the failure cause enumeration prompt in the same procedure as the generation of the failure cause analysis prompt by the failure cause analysis prompt generation unit 104.

[0102] The failure cause enumeration prompt generation unit 141 inputs a failure cause enumeration prompt to the LLM 20 and acquires a list of failure causes for all of the failure classifications from which document chunks have been extracted. Then, the failure cause enumeration prompt generation unit 141 outputs the acquired list of all failure causes to the cause analysis prompt generation unit 142. In addition, the failure cause enumeration prompt generation unit 141 outputs to the cause analysis prompt generation unit 142 a query describing the details of the failure, the log analysis results, and information on the failure classifications from which document chunks have been extracted.

[0103] The cause analysis prompt generation unit 142 receives an input of a list of all failure causes from the document extraction prompt generation unit 103. The cause analysis prompt generation unit 142 also receives an input of a query describing the failure details, the log analysis results, and information on the failure classifications targeted for document chunk extraction from the failure cause enumeration prompt generation unit 141.

[0104] Then, the cause analysis prompt generating unit 142 generates a cause analysis prompt that instructs the presentation of the possibility and the reason for each of the failure causes registered in the list of failure causes.

[0105] 14 is a diagram showing an example of a cause analysis prompt. For example, the cause analysis prompt generation unit 142 may generate a cause analysis prompt 241 that instructs the user to provide the probability that each fault cause could be the cause and the basis for that probability. In this case, by inputting the cause analysis prompt 241, the cause analysis prompt generation unit 142 can obtain from the LLM 20 a response 242 that indicates the probability that each fault cause could be the cause and the basis for that probability.

[0106] Here, the failure cause enumeration prompt generation unit 141 and the cause analysis prompt generation unit 142 correspond to an example of a “second inference execution unit.” The failure cause enumeration prompt generation unit 141 and the cause analysis prompt generation unit 142 cause the LLM 20 to clearly indicate the basis for inferring the failure cause.

[0107] 15 is a flowchart of the fault cause analysis process performed by the estimation system 1 according to the embodiment 3. Next, the flow of the fault cause analysis process performed by the estimation system 1 according to the embodiment 3 will be described with reference to FIG.

[0108] The log analysis unit 101 receives an input of the details of a failure that has occurred in the target system, and then identifies a log to be analyzed according to the acquired details of the failure (step S31).

[0109] The log analysis unit 101 acquires the identified log and performs log analysis to identify phrases contained in the log and interpret the content (step S32).

[0110] The occurrence probability acquisition prompt generation unit 102 receives input of a query describing the details of the failure and the log analysis results from the log analysis unit 101. Next, the occurrence probability acquisition prompt generation unit 102 identifies a failure classification logic tree to be used for analysis from the query describing the details of the failure, the log analysis results, and the cause of the failure. Then, the occurrence probability acquisition prompt generation unit 102 selects one failure classification from the identified failure classification logic tree (step S33).

[0111] Next, the occurrence probability acquisition prompt generation unit 102 generates an occurrence probability acquisition prompt that instructs the calculation of the occurrence probability of the fault classification related to the fault that has occurred, based on a query that describes the selected fault classification and fault content (step S34).

[0112] Next, the occurrence probability acquisition prompt generation unit 102 inputs the generated occurrence probability acquisition prompt to the LLM 20. Then, the occurrence probability acquisition prompt generation unit 102 acquires the occurrence probability of the selected fault classification output from the LLM 20 (step S35).

[0113] The document extraction prompt generator 103 determines whether the occurrence probability of the selected fault classification is equal to or greater than a threshold (step S36). If the occurrence probability of the selected fault classification is less than the threshold (step S36: No), the fault cause analysis process proceeds to step S43.

[0114] On the other hand, if the occurrence probability of the selected fault classification is equal to or greater than the threshold (step S36: Yes), the document extraction prompt generation unit 103 generates a document extraction prompt that instructs the extraction of a sentence chunk based on the item name of the fault classification and the technical document (step S37).

[0115] Next, the document extraction prompt generation unit 103 inputs the generated document extraction prompt to the LLM 20. Then, the document extraction prompt generation unit 103 extracts document chunks that contain descriptions of fault causes related to the selected fault classification from the technical documents output from the LLM 20 (step S38).

[0116] The fault cause enumeration prompt generation unit 141 receives an input of a sentence chunk containing a description of the fault cause from the document extraction prompt generation unit 103. Then, the fault cause enumeration prompt generation unit 141 generates a fault cause enumeration prompt based on the query describing the fault content, the log analysis results, the fault classification item names, and the sentence chunk (step S39).

[0117] Next, the failure cause enumeration prompt generation unit 141 inputs the generated failure cause enumeration prompt and a sentence chunk containing a description of the failure cause in the failure classification to the LLM 20. After that, the failure cause enumeration prompt generation unit 141 acquires a list of failure causes output from the LLM 20 (step S40).

[0118] The cause analysis prompt generating unit 142 receives an input of a list of failure causes from the document extraction prompt generating unit 103. Then, the failure cause enumeration prompt generating unit 141 generates a cause analysis prompt based on the query describing the failure details, the log analysis results, the failure classification item names, and the list of failure causes (step S41).

[0119] Next, the cause analysis prompt generating unit 142 inputs the generated cause analysis prompt and a list of failure causes to the LLM 20. Thereafter, the cause analysis prompt generating unit 142 acquires the possibility of each failure cause and its basis, which are output from the LLM 20 (step S42).

[0120] Thereafter, the occurrence probability acquisition prompt generator 102 determines whether or not the analysis of all the fault classifications in the identified fault analysis logic tree has been completed (step S43). If there are any fault classifications that have not been analyzed (step S43: No), the fault cause analysis process returns to step S33.

[0121] On the other hand, if there are no remaining fault classifications that have not been analyzed (step S43: Yes), the output unit 105 outputs a list of fault causes with their respective possibilities and reasons registered, and provides the list to the user (step S44).

[0122] As described above, in the analysis of the cause of a failure, the inference system according to this embodiment outputs a list of possible causes of a failure to the LLM, and then provides the LLM with the possibility of each cause of failure and its basis. In this way, by separating the task of listing possible causes of failure from the task of considering them, it is possible to improve the accuracy of identifying the cause of a failure.

[0123] (Variation) In the third embodiment, the fault cause analysis prompt generated in the first embodiment is divided into two stages of prompts to improve the accuracy of identifying the cause of the fault, but it is also possible to improve the accuracy of identifying the cause of the fault by performing other processing on the fault cause analysis prompt.

[0124] For example, information indicating a series of steps (a chain of thoughts) taken to solve a problem may be added to the fault cause analysis prompt generated in the first embodiment. For example, the fault cause analysis prompt generation unit 104 in FIG. 1 can introduce a chain of thoughts by adding a phrase such as "Think step by step" to the generated fault cause analysis prompt. By using such a fault cause analysis prompt, the LLM 20 can more logically derive the cause of the fault, thereby improving the accuracy of identifying the cause of the fault.

[0125] Additionally, a tree of thoughts may be introduced into the failure cause analysis prompt generated in the first embodiment. For example, the failure cause analysis prompt generation unit 104 in FIG. 1 generates a failure cause analysis prompt that defines multiple expert instances, has each expert list the causes of the failure, and has the experts discuss the possibility and advisability of each cause. This allows the failure cause analysis prompt generation unit 104 to generate a failure cause analysis prompt that incorporates a tree of thoughts. A failure cause analysis prompt that incorporates a tree of thoughts causes the LLM 20 to perform a process similar to automatically performing two tasks: a task to list the causes of the failure and a task to analyze each of the listed causes of the failure. This can improve the accuracy of identifying the cause of the failure. [Example]

[0126] FIG. 16 is a block diagram of an estimation system according to a fourth embodiment. A fault analysis device 10 according to this embodiment detects the occurrence of a fault in a target system 30, automatically identifies the location of the fault, and performs fault cause analysis based on the identified location of the fault. As shown in FIG. 16, the fault analysis device 10 according to this embodiment includes an anomaly detection unit 111, a log collection unit 112, and a fault location identification unit 113 in addition to the units shown in FIG. 1. In the following description, description of the operation of each unit similar to that of the first embodiment will be omitted.

[0127] The anomaly detection unit 111 monitors the operation of the target system 30. Then, the anomaly detection unit 111 detects the occurrence of a failure in the target system 30. When the anomaly detection unit 111 detects the occurrence of a failure, it notifies the log collection unit 112 of the occurrence of the failure together with the details of the failure that has occurred.

[0128] The log collection unit 112 acquires a notification of the occurrence of a failure in the target system 30 and the details of the failure that has occurred from the anomaly detection unit 111. Then, the log collection unit 112 collects a log corresponding to the failure that has occurred from the target system 30. Thereafter, the log collection unit 112 outputs the collected log and the details of the failure that has occurred to the failure point identification unit 113.

[0129] The failure location identification unit 113 acquires the log of the target system 30 collected by the log collection unit 112 and the details of the failure that occurred in the target system 30. Next, the failure location identification unit 113 identifies the location of the failure in the target system 30 from the acquired log based on the details of the failure that occurred. Thereafter, the failure location identification unit 113 outputs the log of the target system 30, the details of the failure that occurred, and information on the identified location of the failure to the log analysis unit 101.

[0130] The log analysis unit 101 receives input of the log of the target system 30, details of the failure that has occurred, and information on the identified failure location from the failure location identification unit 113. The log analysis unit 101 then analyzes the acquired log. The occurrence probability acquisition prompt generation unit 102, document extraction prompt generation unit 103, and failure cause analysis prompt generation unit 104 each generate prompts based on the log analysis results and perform failure cause analysis using the LLM 20.

[0131] As described above, the estimation system according to this embodiment makes it possible to automate processes from anomaly detection to fault cause analysis. [Example]

[0132] Fig. 17 is a block diagram of an estimation system according to a fifth embodiment. The fault analysis device 10 according to this embodiment can perform analysis based on past cases in addition to the fault cause analysis using the LLM 20 described in the first embodiment. As shown in Fig. 17, the fault analysis device 10 according to this embodiment includes a neighborhood search unit 114, a past case-based fault cause analysis prompt generation unit 115, and an answer synthesis unit 116 in addition to the units shown in Fig. 1. In the following description, description of the operation of each unit similar to that of the first embodiment will be omitted.

[0133] The proximity search unit 114 has a document summarizing past failure cases. The proximity search unit 114 receives an input of a query describing the details of the failure and the analysis result of the log from the log analysis unit 101. The proximity search unit 114 then performs a proximity search on the document summarizing past failure cases based on the analysis result of the query describing the details of the failure and the log, and extracts related documents. Thereafter, the proximity search unit 114 outputs the extracted related documents, the analysis result of the query describing the details of the failure, and the log to the past case-based failure cause analysis prompt generation unit 115.

[0134] The past case-based failure cause analysis prompt generation unit 115 receives the extracted related documents, the query describing the details of the failure, and the log analysis results as input from the proximity search unit 114. Then, the past case-based failure cause analysis prompt generation unit 115 generates a past case-based failure cause analysis prompt that instructs the generation of a list of failure causes of the failure that has occurred from the related documents. For example, the past case-based failure cause analysis prompt generation unit 115 can generate the past case-based failure cause analysis prompt by adding the details of the failure and the log analysis results to a predetermined format.

[0135] Then, the past case-based fault cause analysis prompt generation unit 115 inputs the generated past case-based fault cause analysis prompt and related documents to the LLM 20. Thereafter, the past case-based fault cause analysis prompt generation unit 115 acquires a list of past case-based fault causes from the LLM 20. Then, the past case-based fault cause analysis prompt generation unit 115 outputs the list of past case-based fault causes to the answer synthesis unit 116.

[0136] Here, the past case-based fault cause analysis prompt generation unit 115 is an example of a “fourth inference execution unit.” The past case-based fault cause analysis prompt generation unit 115 causes the LLM 20 to infer the cause of a fault based on past cases.

[0137] The fault cause analysis prompt generation unit 104 outputs to the answer synthesis unit 116 a list of fault causes acquired from the LLM 20 using the occurrence probability acquisition prompt generation unit 102, the document extraction prompt generation unit 103, and the prompts generated by itself.

[0138] The answer synthesis unit 116 receives an input of a list of failure causes based on past cases from the past case-based failure cause analysis prompt generation unit 115. The answer synthesis unit 116 also receives an input of a list of failure causes based on technical documents from the failure cause analysis prompt generation unit 104, which list has been generated using the prompts generated by the document extraction prompt generation unit 103 and the failure cause analysis prompt generation unit 104. The answer synthesis unit 116 then synthesizes the list of failure causes based on past cases and the list of failure causes based on technical documents. The answer synthesis unit 116 then outputs the synthesized list of failure causes to the output unit 105.

[0139] The output unit 105 receives an input of the list of failure causes synthesized by the answer synthesis unit 116. Then, the output unit 105 displays the list of failure causes on a monitor (not shown) or the like to provide it to the user. In this way, the output unit 105 outputs both the inference result that the failure cause analysis prompt generation unit 104, which is the second inference execution unit, has caused the LLM 20 to make an inference, and the inference result that the past case-based failure cause analysis prompt generation unit 115, which is the fourth inference execution unit, has caused the LLM 20 to make an inference.

[0140] As described above, the estimation system according to this embodiment can provide both the results of fault cause analysis based on past cases and the results of fault cause analysis based on technical documents. If there are similar cases in the past, fault cause analysis based on past cases may be more accurate in identifying the cause of the fault. Therefore, by adding the results of fault cause analysis based on past cases, it is possible to further improve the accuracy of identifying the cause of the fault. [Example]

[0141] 18 is a block diagram of an estimation system according to a sixth embodiment. A fault analysis device 10 according to this embodiment exchanges information with an LLM 20 via an information terminal device 40. In the following description, the operation of each unit similar to that of the first embodiment will not be described.

[0142] The occurrence probability acquisition prompt generation unit 102 transmits the generated occurrence probability acquisition prompt to the information terminal device 40. The user uses the information terminal device 40 to input the occurrence probability acquisition prompt transmitted from the occurrence probability acquisition prompt generation unit 102 to the LLM 20. Thereafter, the user uses the information terminal device 40 to acquire the information on the occurrence probability of each fault classification output from the LLM 20, and transmits the information on the occurrence probability of each fault classification to the occurrence probability acquisition prompt generation unit 102.

[0143] The document extraction prompt generation unit 103 transmits the generated document extraction prompt to the information terminal device 40. The user uses the information terminal device 40 to input the document extraction prompt transmitted from the document extraction prompt generation unit 103 to the LLM 20. Thereafter, the user uses the information terminal device 40 to obtain the document chunk related to the occurred failure output from the LLM 20, and transmits the document chunk related to the occurred failure to the document extraction prompt generation unit 103.

[0144] The failure cause analysis prompt generation unit 104 transmits the generated failure cause analysis prompt to the information terminal device 40. The user uses the information terminal device 40 to input the failure cause analysis prompt transmitted from the failure cause analysis prompt generation unit 104 to the LLM 20. Thereafter, the user uses the information terminal device 40 to obtain the list of failure causes of the occurred failures output from the LLM 20, and transmits the list of failure causes of the occurred failures to the occurrence probability acquisition prompt generation unit 102.

[0145] Some generative AIs may be difficult to incorporate into a program via an API (Application Programming Interface). In such cases, information is sent and received using a web-based UI (User Interface). The estimation system according to this embodiment uses such generative AI to analyze the cause of a fault, thereby improving the accuracy of identifying the cause of the fault.

[0146] (Hardware configuration) 19 is a diagram showing an example of the hardware configuration of the estimation system. For example, the estimation system 1 can be realized by a personal computer 90 and a cloud server 95. The personal computer 90 and the cloud server 95 are connected via a network and can communicate with each other.

[0147] The cloud server 95 provides an execution environment for the LLM 20. However, the LLM 20 may also be executed in an on-premise environment.

[0148] The personal computer 90 realizes the functions of the fault analysis device 10. The personal computer 90 has a GPU (Graphics Processing Unit) / CPU (Central Processing Unit) 91, a ROM (Read Only Memory) 92, and a RAM (Random Access Memory) 93. The GPU / CPU 91, the ROM 92, and the RAM 93 are connected via a network.

[0149] The ROM 92 stores various programs executed by the GPU / CPU 91. The ROM 92 is used as a temporary memory area for the computer programs executed by the GPU / CPU 91.

[0150] The GPU / CPU 91 may be configured as either a GPU or a CPU, or may include both. The GPU / CPU 91 executes various programs stored in the ROM 92 using the RAM 93. In this way, the GPU / CPU 91 realizes the functions of the fault analysis device 10 according to each embodiment. For example, in the fault analysis device 10 of the first embodiment, the GPU / CPU 91 realizes the functions of a log analysis unit 101, an occurrence probability acquisition prompt generation unit 102, a document extraction prompt generation unit 103, a fault cause analysis prompt generation unit 104, and an output unit 105. [Explanation of symbols]

[0151] 1. Estimation System 10. Fault Analysis Equipment 20 LLM 30 Target Systems 40 Information terminal device 101 Log Analysis Department 102 occurrence probability acquisition prompt generation unit 103 Document Extraction Prompt Generation Unit 104 Failure Cause Analysis Prompt Generation Unit 105 Output section 106 Fault Classification Judgment Algorithm 111 Anomaly Detection Unit 112 Log Collection Unit 113 Fault Location Identification Unit 114 Nearby Search Unit 115 Past Case-Based Failure Cause Analysis Prompt Generation Unit 116 Answer synthesis part 141 Failure Cause Enumeration Prompt Generation Unit 142 Cause analysis prompt generation part

Claims

1. Machine learning models and a log analysis unit that analyzes a log relating to a failure and determines a failure classification of the failure content; a first inference implementation unit that causes the machine learning model to extract corresponding sentences corresponding to the fault classification determined by the log analysis unit from a predetermined technical document; a second inference execution unit that causes the machine learning model to infer a cause of a fault based on the corresponding sentences that the first inference execution unit has caused the machine learning model to extract; an output unit that outputs the cause of the failure; An estimation system comprising:

2. the first inference performing unit generates a sentence extraction prompt for causing the machine learning model to extract the corresponding sentence from the predetermined technical document, inputs the generated sentence extraction prompt to the machine learning model, and causes the machine learning model to output the corresponding sentence; The second inference execution unit generates a fault cause analysis prompt that causes a fault cause to be inferred based on the corresponding sentence, inputs the generated fault cause analysis prompt to the machine learning model, and causes the machine learning model to output the fault cause. The estimation system according to claim 1 .

3. a third inference execution unit that causes the machine learning model to infer an occurrence probability for each of the fault categories; The first inference performing unit causes the machine learning model to extract the corresponding sentences corresponding to the fault classifications whose occurrence probabilities are equal to or greater than a threshold. The estimation system according to claim 1 .

4. The estimation system according to claim 1 , wherein the log analysis unit determines the failure classification using a failure analysis logic tree indicating a failure classification corresponding to the failure content.

5. 5. The estimation system according to claim 4, wherein the log analysis unit determines the fault classification using either the fault analysis logic tree automatically generated by AI (Artificial Intelligence), the fault analysis logic tree generated based on the experience of an expert, or the fault analysis logic tree generated by an expert modifying a logic tree automatically generated by AI.

6. The estimation system described in claim 1, characterized in that the first inference implementation unit uses the technical document including at least the specification of the system in which the failure occurred to cause the machine learning model to extract sentences related to the failure classification as the corresponding sentences.

7. The estimation system according to claim 1, wherein the second inference implementation unit causes the machine learning model to infer multiple items as the cause of the fault and outputs a list of the items of the cause of the fault from the machine learning model.

8. The estimation system according to claim 1 , wherein the second inference execution unit causes the machine learning model to clearly indicate the basis for inferring the cause of the fault.

9. a fourth inference execution unit that causes the machine learning model to infer a cause of a fault based on past cases; The output unit outputs an inference result that the second inference execution unit has caused the machine learning model to make an inference and an inference result that the fourth inference execution unit has caused the machine learning model to make an inference together. The estimation system according to claim 1 .

10. a log analysis unit that analyzes a log relating to a failure and determines a failure classification of the failure content; a first inference implementation unit that causes a machine learning model to extract corresponding sentences corresponding to the fault classification determined by the log analysis unit from predetermined technical documents; a second inference execution unit that causes the machine learning model to infer a cause of a fault based on the corresponding sentences that the first inference execution unit has caused the machine learning model to extract; an output unit that outputs the cause of the failure; An information processing device comprising:

11. The computer Analyze the failure log to determine the failure classification of the failure content, extracting corresponding sentences corresponding to the determined fault classification from a predetermined technical document using a machine learning model; making the machine learning model infer a cause of a failure based on the corresponding sentence extracted by the machine learning model; Output the cause of the failure An estimation method comprising:

Images