Anomaly detection device, anomaly detection method, and anomaly detection program

Abstract

To obtain an anomaly detection device that can reduce the workload of preparatory work required before commencing operation. [Solution] The abnormality detection device 1 includes: an evaluation target log acquisition unit 12 that acquires an evaluation target log in which information of events that have occurred in the monitored device is recorded; an event key assignment unit 41 that assigns an event key, which is a value that uniquely identifies an event, to an event included in the evaluation target log; an event key replacement unit 42 that replaces an event key assigned by the event key assignment unit 41 to an event included in the evaluation target log with another event key according to an event key replacement table 32 that shows a method of replacing event keys so that the difference between the event keys of two consecutive events included in a series of events that have occurred in a normally operating monitored device becomes small; and a state determination unit 50 that determines whether or not there is an operational abnormality in the monitored device based on the event key after the event key replacement process has been performed.

Description

[Technical Field]

[0001] This disclosure relates to an anomaly detection device, an anomaly detection method, and an anomaly detection program that detect abnormalities in a monitored device (hereinafter referred to as the monitored device) by analyzing log data output from the monitored device. [Background technology]

[0002] Log data, which records the details and results of processes performed within a device, is used to investigate the cause of malfunctions or abnormalities in the device, and to detect abnormalities in the device.

[0003] For example, Patent Document 1 discloses a log analysis system that identifies transactions from logs output from a device, groups together transactions that have common logs for both the start and end times, performs learning on each transaction in the same group, and uses the group-specific learning model created through the learning process to determine whether the transaction under inspection is normal or abnormal. [Prior art documents] [Patent Documents]

[0004] [Patent Document 1] International Publication No. 2019 / 064370 [Overview of the project] [Problems that the invention aims to solve]

[0005] The log analysis system described in Patent Document 1 had the problem of being time-consuming because it required preparing and learning from abnormal data in advance.

[0006] This disclosure is made in view of the above, and aims to provide an anomaly detection device that can reduce the burden of preparatory work required before the start of operation. [Means for solving the problem]

[0007] To solve the above-mentioned problems and achieve the objective, the anomaly detection device according to this disclosure is characterized by comprising: an evaluation target log acquisition unit that acquires an evaluation target log, which is log data recording information of events that occurred in a monitored device in operation; an event key assignment unit that assigns an event key, which is a value that uniquely identifies an event, to each of the events included in the evaluation target log; an event key replacement unit that replaces the event keys assigned by the event key assignment unit to the events included in the evaluation target log with other event keys according to an event key replacement table that shows a method of replacing event keys so that the difference between the event keys of two consecutive events included in a series of events that occurred in a monitored device in normal operation becomes small; and a state determination unit that determines whether or not there is an operational anomaly in the monitored device based on a series of event keys after the event key replacement process by the event key replacement unit has been performed. [Effects of the Invention]

[0008] According to this disclosure, it is possible to obtain an anomaly detection device that can reduce the workload of preparatory work required before the start of operation. [Brief explanation of the drawing]

[0009] [Figure 1] This figure shows an example of the configuration of the anomaly detection device according to Embodiment 1. [Figure 2] A flowchart illustrating the operation of the anomaly detection device according to Embodiment 1 in which it creates an event key correspondence table and an event key replacement table. [Figure 3] This figure shows an example of events and event keys included in the log data acquired from the monitored device by the anomaly detection device according to Embodiment 1. [Figure 4] Figure 1 illustrating an example of the operation of the replacement table creation unit of the anomaly detection device according to Embodiment 1. [Figure 5] Figure 2 illustrates an example of the operation of the replacement table creation unit of the anomaly detection device according to Embodiment 1. [Figure 6]The third figure for explaining the operation example of the replacement table creation unit of the abnormality detection device according to Embodiment 1 [Figure 7] The flowchart showing the operation of the abnormality detection device according to Embodiment 1 for determining the state of the monitoring target device [Figure 8] The first figure for explaining the operation example of the state determination unit of the abnormality detection device according to Embodiment 1 [Figure 9] The second figure for explaining the operation example of the state determination unit of the abnormality detection device according to Embodiment 1 [Figure 10] The figure for explaining the effect of the abnormality detection device according to Embodiment 1 [Figure 11] The figure showing an example of an undirected graph used when the abnormality detection device according to Embodiment 2 creates an event key replacement table [Figure 12] The figure showing an example of a method for creating an undirected graph by the replacement table creation unit of the abnormality detection device according to Embodiment 2 [Figure 13] The figure showing an example of an event key replacement method indicated by the event key replacement table created by the replacement table creation unit of the abnormality detection device according to Embodiment 2 [Figure 14] The figure for explaining the operation example of the replacement table creation unit of the abnormality detection device according to Embodiment 3 [Figure 15] The figure showing a configuration example of the abnormality detection device according to Embodiment 4 [Figure 16] The flowchart showing an example of a learning operation for generating a learned model used by the abnormality detection device according to Embodiment 4 for determining the state of the monitoring target device [Figure 17] The flowchart showing an example of the operation of the abnormality detection device according to Embodiment 4 for determining the state of the monitoring target device [Figure 18] The figure showing a hardware configuration example of the abnormality detection device

Embodiments for Carrying Out the Invention

[0010] The anomaly detection device, anomaly detection method, and anomaly detection program according to embodiments of this disclosure will be described in detail below with reference to the drawings.

[0011] Embodiment 1. Figure 1 is a diagram showing an example configuration of an anomaly detection device 1 according to Embodiment 1. As shown in Figure 1, the anomaly detection device 1 comprises a data acquisition unit 10 consisting of a normal log acquisition unit 11 and an evaluation target log acquisition unit 12, a table creation unit 20 consisting of an event extraction unit 21 and an exchange table creation unit 22, a storage unit 30 that stores an event key corresponding table 31 and an event key exchange table 32, a log event conversion unit 40 consisting of an event key assignment unit 41 and an event key exchange unit 42, and a state determination unit 50.

[0012] The normal log acquisition unit 11 and the evaluation target log acquisition unit 12 of the data acquisition unit 10 acquire log data generated by the monitored device (not shown in the figure). The log data records information about events that occurred in the monitored device.

[0013] The normal log acquisition unit 11 acquires normal log data (which may be referred to as normal logs in the following explanation) generated when the monitored device is operating normally. Here, a normal log is log data generated when the monitored device executes processes in a predetermined and correct order. Even if the operation of the monitored device appears normal, log data generated when processes are not performed in order will not be considered a normal log. For example, if the process of reading data from a specific area of ​​memory is repeated twice, that is, the same data is read twice consecutively from the same address in memory, and then processing is performed using the read data, the apparent operation of the monitored device will be normal. However, since the data reading process that only needs to be performed once is performed twice, one of the two read operations is unnecessary and will be considered abnormal as log data.

[0014] The log acquisition unit 12 acquires log data to be evaluated, specifically log data whose status (whether normal or not) is unknown (which may be referred to as "logs to be evaluated" in the following explanation).

[0015] The event extraction unit 21 of the table creation unit 20 analyzes the normal log to extract various events contained in the normal log, assigns an event key to each of the extracted events, and creates an event key correspondence table 31 that shows the correspondence between events and event keys. An event key is a numerical value that uniquely identifies one of the events that occurred on the monitored device. Events that occurred on the monitored device include processes executed within the monitored device, operations of the monitored device, and operations performed on the monitored device. The event key correspondence table 31 is used by the event key assignment unit 41, which will be described later, when assigning an event key to each event in the evaluation log.

[0016] The replacement table creation unit 22 of the table creation unit 20 creates the event key replacement table 32 used by the event key replacement unit 42, which will be described later. Specifically, it is used in the process by which the event key assignment unit 41 replaces the event keys already assigned to each event in the log under evaluation with other event keys (which may be referred to as the event key replacement process in the following description). The event key replacement table 32 shows the correspondence between the event keys of each event before the event key replacement unit 42 performs the event key replacement process and the event keys of each event after the event key replacement process is performed.

[0017] The event key assignment unit 41 of the log event conversion unit 40 extracts various events included in the log to be evaluated from the log to be evaluated, and assigns an event key to each of the extracted events according to the event key correspondence table 31.

[0018] The event key replacement unit 42 of the log event conversion unit 40 replaces the event keys that the preceding event key assignment unit 41 has assigned to events included in the log under evaluation with other event keys according to the event key replacement table 32. In other words, the event key replacement unit 42 changes the numerical value (=event key) that the event key assignment unit 41 has assigned to each event included in the log under evaluation with another numerical value according to the event key replacement table 32.

[0019] The status determination unit 50 determines whether the monitored device is in a normal state or not based on the series of event keys after the event keys have been swapped by the event key swapping unit 42.

[0020] Next, the operation of the anomaly detection device 1 will be described. In this embodiment, the explanation will be divided into two parts: the preparatory operation for determining the status of the monitored device, specifically the preparatory operation for creating the event key correspondence table 31 and the event key swapping table 32, and the operational operation for actually determining the status of the monitored device. In the following explanation, log data may be referred to as logs. Also, events included in the log data may be referred to as log events.

[0021] (Preparation steps) Figure 2 is a flowchart showing the operation in which the anomaly detection device 1 according to Embodiment 1 creates the event key correspondence table 31 and the event key replacement table 32.

[0022] First, the normal log acquisition unit 11 acquires logs (normal logs) created while the monitored device is operating normally (step S11). The normal log acquisition unit 11 acquires a large number of normal logs.

[0023] Next, the event extraction unit 21 extracts events included in the logs acquired by the normal log acquisition unit 11 (step S12), and further assigns event keys to the extracted events to create an event key correspondence table 31 (step S13). An example of the operation of the event extraction unit 21 in steps S12 and S13 will be explained using Figure 3. Figure 3 is a diagram showing an example of events and event keys included in the log data acquired by the abnormality detection device 1 according to Embodiment 1 from the monitored device. In Figure 3, the left column is log data 101, the middle column is log events 102, and the right column is event keys 103.

[0024] The event extraction unit 21 receives log data 101, which is a normal log, from the normal log acquisition unit 11, and in step S12 extracts log events 102 from the log data 101. The event extraction unit 21 also assigns a unique event key 103 to each of the extracted log events 102 and creates an event key correspondence table 31. The event extraction unit 21 extracts log events 102 and assigns event keys 103 to all normal logs (log data 101) acquired by the normal log acquisition unit 11 and creates the event key correspondence table 31. The event extraction unit 21 outputs the series of event keys 103 assigned to each event extracted from the normal log to the replacement table creation unit 22. If the log data 101 shown in Figure 3 is input from the normal log acquisition unit 11, and the log events 102 shown in Figure 3 are extracted and event keys 103 are assigned, the event extraction unit 21 outputs '5', '6', '7', and '8' to the replacement table creation unit 22.

[0025] Next, the swap table creation unit 22 creates an event key swap table 32 based on the difference in event keys of consecutive events (step S14). Specifically, the swap table creation unit 22 creates an event key swap table 32 that shows how to swap event keys so that the difference in event keys of consecutive events becomes smaller, based on the event keys that the event extraction unit 21 has assigned to each event included in the normal log. The event key swap is performed by the event key swap unit 42 according to the event key swap table 32.

[0026] A specific example of the operation by which the replacement table creation unit 22 creates the event key replacement table 32 will be explained with reference to Figures 4 to 6. Figure 4 is the first diagram illustrating an example of the operation of the replacement table creation unit 22 of the anomaly detection device 1 according to Embodiment 1, Figure 5 is the second diagram illustrating an example of the operation of the replacement table creation unit 22 of the anomaly detection device 1 according to Embodiment 1, and Figure 6 is the third diagram illustrating an example of the operation of the replacement table creation unit 22 of the anomaly detection device 1 according to Embodiment 1.

[0027] The replacement table creation unit 22 first analyzes each of the multiple normal logs, counts the number of occurrences of the event key change pattern of consecutive events, and creates a matrix whose components are the number of occurrences of each change pattern. The replacement table creation unit 22 creates, for example, the matrix 160 shown in the upper part of Figure 4.

[0028] Figure 4 shows the event key A of the nth event that occurred. n and the event key A of the (n+1)th event that occurred. n+1 This diagram shows the relationship with the event key A as a matrix (n=1,2,3,…). The matrix 160 in the upper row shows the event key A before the event key was swapped. n and A n+1 The relationship between the two consecutive event keys A included in the event key column input from the event extraction unit 21 to the replacement table creation unit 22 n and event key A n+1shows the relationship with. As shown in FIG. 5, this matrix 160 has rows corresponding to the event key A of the event that occurred nth, n and columns corresponding to the event key A of the event that occurred (n + 1)th, n+1 . The components of the matrix 160 indicate the number of occurrences of the change pattern from the event key A n of the event that occurred to the event key A n+1 .

[0029] For example, assume that the event keys of each of the plurality of events included in the normal log are as shown in FIG. 6. Note that the horizontal axis in FIG. 6 indicates the order in which the events occurred, and the vertical axis indicates the event keys of the events that occurred.

[0030] In the example shown in FIG. 6, the change pattern from the event key u1 to the event key u2 is "2 → 5", and the number of occurrences of this change pattern is recorded in the component w1 of the matrix 160. Also, the change pattern from the event key u2 to the event key u3 is "5 → 2", and the number of occurrences of this change pattern is recorded in the component w2 of the matrix 160.

[0031] The matrix 160 indicates that the number of times an event with an event key of "0" occurred after an event with an event key of "0" (= the number of times an event with an event key of "0" occurred continuously), that is, the number of occurrences of the change pattern "0 → 0" of the event key is "640", and the number of times an event with an event key of "1" occurred after an event with an event key of "0", that is, the number of occurrences of the change pattern "0 → 1" of the event key is "8". The matrix 160 also indicates that the number of times an event with an event key of "2" occurred after an event with an event key of "0", that is, the number of occurrences of the change pattern "0 → 2" of the event key is "0".

[0032] After creating the matrix 160, the replacement table creation unit 22 uses the event keys A n and A n+1An event key swapping table 32 is created to swap event keys so that the relationship is represented by matrix 161 shown in the lower part of Figure 4. Specifically, the swapping table creation unit 22 swaps the components of matrix 160 so that the non-zero components are grouped diagonally as shown in matrix 161. For example, the swapping table creation unit 22 creates an event key swapping table 32 to swap event keys so that component 300b of matrix 160 shown in Figure 4 is grouped in the region 300a near the diagonal component shown in the lower part of Figure 4. Here, the diagonal components of the matrix whose components are the number of occurrences of event key change patterns of consecutively occurring events represent the number of occurrences of change patterns where the difference in event keys is 0. Also, components close to the diagonal components represent the number of occurrences of change patterns where the difference in event keys is small. Therefore, the swapping table creation unit 22 creates an event key swapping table 32 that shows a method of swapping the event keys of each event so that the difference in event keys of two consecutive events included in the normal log becomes small. In other words, the exchange table creation unit 22 creates an event key exchange table 32 that shows how to exchange event keys so that the difference between the event keys of two consecutive events that occur while the monitored device is operating normally becomes small.

[0033] The swap table creation unit 22 experimentally swaps two randomly selected event keys, and if, after the swap, the non-zero components are more concentrated diagonally than before the swap, the swap of those two event keys is adopted. This process is repeated to obtain the event key swap table 32. Note that the event key swap table 32 may also be created using a method other than this method of repeated random swapping.

[0034] (operational behavior) Figure 7 is a flowchart showing the operation in which the abnormality detection device 1 according to Embodiment 1 determines the status of the monitored device.

[0035] First, the evaluation target log acquisition unit 12 acquires the log (evaluation target log) created by the monitored device in operation (step S21).

[0036] Next, the event key assignment unit 41 extracts events included in the logs acquired by the evaluation target log acquisition unit 12 (step S22), and assigns event keys to the events according to the event key correspondence table 31 (step S23). The operation by the event key assignment unit 41 to extract events from the evaluation target logs is the same as the operation by the event extraction unit 21 to extract events from normal logs.

[0037] Next, the event key swapping unit 42 swaps the event keys of each event according to the event key swapping table 32 (step S24).

[0038] Next, the status determination unit 50 determines whether or not there is an operational abnormality in the monitored device based on the amount of change in the event keys after the event key replacement process has been performed by the event key replacement unit 42 (step S25). The details of the operation of the status determination unit 50 in step S25 will be explained below.

[0039] The state determination unit 50 first calculates the difference between the event keys of two consecutive events for each of the multiple events included in the log to be evaluated (see Figure 8). Figure 8 is the first diagram illustrating an example of the operation of the state determination unit 50 of the abnormality detection device 1 according to Embodiment 1. The upper left of Figure 8 shows an example of a series of event keys after the event key swapping process has been performed, and the lower left shows an example of the difference between the event keys of two consecutive events. The upper right of Figure 8 shows a magnified view of the first 30 event keys shown in the upper left, and the lower right shows a magnified view of the first 29 differences shown in the lower left. In the example shown in Figure 8, as shown in the upper right, a series of event keys u i =2,5,2,1,1,1,… (i=1,2,3,…), and the difference v between the event keys of two consecutive events in this case is i (=u i+1 -u i ) is shown in the lower right section v i The values ​​become =3, -3, -1, 0, 0, ...

[0040] The state determination unit 50 then determines that there is an operational abnormality if the calculated difference is greater than the abnormality determination threshold, which is a predetermined threshold (see Figure 9). Figure 9 is a second diagram illustrating an example of the operation of the state determination unit 50 of the abnormality detection device 1 according to Embodiment 1. The left side of Figure 9 shows an example when the monitored device continues to operate normally, and the right side shows an example when an operational abnormality occurs in the monitored device. The upper part of Figure 9 shows an example of a series of event keys after the event key swapping process has been performed, and the lower part shows an example of the difference between the event keys of two consecutive events. As shown in the lower part of Figure 9, the difference between the event keys of two consecutive events becomes small when the monitored device is operating normally, and becomes large when an operational abnormality occurs in the monitored device. For this reason, the state determination unit 50 determines that there is an operational abnormality if the difference between the event keys of two consecutive events is greater than the abnormality determination thresholds 200c and 200d. In the example of an abnormal situation shown on the right side of Figure 9, there are two instances where the difference in event keys exceeds the abnormality determination thresholds 200c and 200d, and the state determination unit 50 determines that there is an operational abnormality. The abnormality determination thresholds 200c and 200d used in this determination process are determined, for example, based on the analysis results of the normal log. Specifically, an event key is assigned to the event extracted from the normal log according to the event key correspondence table 31, and then the event key is analyzed after swapping this event key according to the event key swap table 32. The abnormality determination threshold is then determined to be greater than the maximum value of the difference in event keys of two consecutive events.

[0041] As described above, the anomaly detection device 1 according to Embodiment 1 assigns an event key to an event extracted from the evaluation target log output by the monitored device according to the event key correspondence table 31, and further changes the event key of each event by performing a swapping process to swap the event keys assigned to each event according to the event key swapping table 32. The device then compares the difference between the event keys of two consecutive events in the changed series of event keys with an anomaly determination threshold to determine whether or not there is an operational anomaly in the monitored device. In the swapping process performed according to the event key swapping table 32, during normal operation, the event keys are swapped in such a way that the difference between the event keys of two consecutive events becomes small. As a result, the difference between the event keys of two consecutive events when an operational anomaly occurs becomes larger than the difference between the event keys of two consecutive events during normal operation. Therefore, compared to not performing the swapping process, that is, compared to determining whether or not there is an operational anomaly using the difference between the event keys of two consecutive events in the series of event keys before the swapping process is performed, it becomes possible to detect operational anomalies in the monitored device with high accuracy. The reason for this will be explained with reference to Figures 9 and 10. Figure 10 is a diagram illustrating the effect of the abnormality detection device 1 according to Embodiment 1. Figure 10 shows an example of a series of event keys before the replacement process according to the event key replacement table 32 is performed, and an example of the difference in event keys between two consecutive events. Similar to Figure 9, the left side of Figure 10 shows an example when the monitored device continues to operate normally, and the right side shows an example when an abnormal operation occurs in the monitored device. The abnormal operation occurs at the same timing as in the example shown in Figure 9. Also, the upper part of Figure 10 shows an example of a series of event keys before the event key replacement process is performed, and the lower part shows an example of the difference in event keys between two consecutive events. As shown in Figure 10, if the replacement process according to the event key replacement table 32 is not performed, the difference in event keys between two consecutive events may become large even when no abnormal operation occurs, making it difficult to accurately detect abnormal operation.On the other hand, when the replacement process is performed according to the event key replacement table 32, as shown in Figure 9, the difference in event keys between two consecutive events does not increase when no operational abnormality occurs, making it easy to detect operational abnormalities. Furthermore, it is possible to detect minor abnormalities that do not appear in the operation of the device, such as errors in the execution order of processes or the execution of unnecessary processes. In addition, the abnormality detection device 1 according to this embodiment does not require preparatory operations such as preparing abnormality data and learning it in advance, thereby reducing the burden of preparation work that users must perform before starting operation.

[0042] Embodiment 2. Next, we will describe the anomaly detection device according to Embodiment 2. The configuration of the anomaly detection device according to Embodiment 2 is the same as that of Embodiment 1 (see Figure 1). In this embodiment, we will describe the parts that differ from Embodiment 1.

[0043] The anomaly detection device 1 according to Embodiment 2 differs from the anomaly detection device 1 according to Embodiment 1 in how the replacement table creation unit 22 creates the event key replacement table 32.

[0044] The replacement table creation unit 22 of the anomaly detection device 1 according to Embodiment 2 creates an event key replacement table 32 using an undirected graph. Specifically, the replacement table creation unit 22 represents the normal log to which event keys have been assigned by the event extraction unit 21 using an undirected graph as shown in Figure 11, and creates the event key replacement table 32 based on the values ​​assigned to the nodes constituting the undirected graph and the connection relationships between the nodes. Figure 11 is a diagram showing an example of an undirected graph used by the anomaly detection device 1 according to Embodiment 2 when creating the event key replacement table 32. In the undirected graph shown in Figure 11, an event key is assigned to each node, and nodes to which event keys of events that may occur consecutively in the normal log are assigned are connected. For example, node 180 is assigned the event key value 11, and this node 180 is connected by line 181 to a node to which the event key value 12 has been assigned. Node 180 is also connected to a node to which the event key value 10 has been assigned. In this case, it means that the events that may occur consecutively with the event key with value 11 during normal operation are the events with event keys with value 10 and the events with event keys with value 12. Since the nodes to which the event keys of events that may occur consecutively are assigned are connected, the swap table creation unit 22 creates an event key swap table 32, which is a table that represents a method of swapping the event keys assigned to each node so that the difference between the event keys assigned to the two connected nodes becomes small.

[0045] A concrete example of the operation of creating an event key swapping table 32 using an undirected graph will be explained using Figures 12 and 13. Figure 12 is a diagram showing an example of the method of creating an undirected graph by the swapping table creation unit 22 of the anomaly detection device 1 according to Embodiment 2, and Figure 13 is a diagram showing an example of the event key swapping method shown in the event key swapping table 32 created by the swapping table creation unit 22 of the anomaly detection device 1 according to Embodiment 2. Note that logs #1 to #5 shown in Figures 12 and 13 are all normal logs.

[0046] As shown in Figures 12 and 13, the event keys for the series of events in log #1 are "1", "2", "3", "4", and "5". Similarly, the event keys for the series of events in log #2 are "1", "6", "3", "4", and "5", the event keys for the series of events in log #3 are "1", "2", "7", "8", and "3", the event keys for the series of events in log #4 are "1", "2", "7", "9", and "5", and the event keys for the series of events in log #5 are "1", "2", "3", "5", and "10". In Figures 12 and 13, event keys enclosed in parentheses are those that overlap with other event keys.

[0047] When the replacement table creation unit 22 receives the event keys for a series of events included in log #1 from the event extraction unit 21, it creates five nodes, each assigned to event keys "1", "2", "3", "4", and "5", and connects the nodes assigned to the event keys of consecutive events in log #1. Similarly, when the replacement table creation unit 22 receives the event keys for a series of events included in log #2 from the event extraction unit 21, it creates a node assigned to event key "6", and connects the created node to the node assigned to event key "1" and the node assigned to event key "3". The replacement table creation unit 22 also connects the nodes assigned to the event keys of consecutive events in log #2. Note that since event keys "1", "3", "4", and "5" overlap with the event keys of the series of events included in log #1, the replacement table creation unit 22 does not create nodes assigned to these event keys. The replacement table creation unit 22 also performs the same processing when the event keys for a series of events contained in logs #3 to #5 are input from the event extraction unit 21. This creates the undirected graph shown in Figure 12.

[0048] The swap table creation unit 22 creates an undirected graph as shown in Figure 12, and then swaps the event keys assigned to each node so that the difference between the event keys assigned to two connected nodes becomes smaller. The swap table creation unit 22 performs the event key swap as shown in Figure 13, for example by performing a breadth-first search. As a result, the maximum difference between the event keys assigned to two connected nodes in the undirected graph is reduced from 5 before the swap process to 3. The swap table creation unit 22 then creates an event key swap table 32 that shows this swap method.

[0049] As described above, the replacement table creation unit 22 of the anomaly detection device 1 according to Embodiment 2 creates an event key replacement table 32 using an undirected graph. Specifically, the replacement table creation unit 22 creates an undirected graph representing the event keys of a series of events included in the normal log, performs a breadth-first search on the created undirected graph to replace the event keys, and creates an event key replacement table 32 that shows how to replace the event keys. As a result, when the monitored device is operating normally, the difference between the event keys of two consecutive events becomes small, and the same effect as in Embodiment 1 can be obtained.

[0050] Furthermore, when performing a breadth-first search using the undirected graph described above, it is necessary to select an event key to serve as the starting point for this search. This selection can be done by arbitrarily selecting an event key, creating an event key swapping table 32, and choosing the one whose event key difference is sufficiently small.

[0051] Embodiment 3. Next, an anomaly detection device according to Embodiment 3 will be described. The configuration of the anomaly detection device according to Embodiment 3 is the same as that of Embodiment 1 (see Figure 1). In this embodiment, the differences from Embodiment 1 will be described.

[0052] The anomaly detection device 1 according to Embodiment 3 differs from the anomaly detection device 1 according to Embodiment 1 in how the replacement table creation unit 22 creates the event key replacement table 32. The operation by which the replacement table creation unit 22 creates the event key replacement table 32 will be explained with reference to Figure 14.

[0053] Figure 14 is a diagram illustrating an example of the operation of the replacement table creation unit 22 of the anomaly detection device 1 according to Embodiment 3. In Figure 14, the vertical axis represents the event key, and the horizontal axis represents the order of a series of events included in the log. Figure 14 shows the time change of the event keys for 21 events. The dotted line shows the time change of the event key before the event key replacement process is performed, and the solid line shows the time change of the event key after the event key replacement process is performed. Also, triangles represent the event key before the event key replacement process is performed, and circles represent the event key after the event key replacement process is performed.

[0054] As shown in Figure 14, the swap table creation unit 22 calculates the average value of the event keys before and after each event key and creates an event key swap table 32 that shows the process of swapping event keys to approach that average value. If there are multiple identical event keys, the unit calculates the average value of the event keys before and after each of the multiple identical event keys and swaps the event keys to approach the calculated average value. For example, in the example shown in Figure 14, there are four event keys with the value 5: event keys 601a, 601b, 601c, and 601d. The event keys before and after each of these event keys are "4", "4", "4", "18", "4", "18", "20", and "14", a total of eight. If the same event key appears consecutively, the event keys before and after the consecutive interval are used as the event keys before and after each consecutive event key. Since the average value of the eight event keys before and after event keys 601a, 601b, 601c, and 601d is 10.75, the swap table creation unit 22 creates an event key swap table 32 indicating that the values ​​of event keys 601a, 601b, 601c, and 601d are swapped from "4" to "11". The swap table creation unit 22 updates the event key swap table 32 by repeatedly performing similar processing for other event keys, specifically, processing to determine the swapped value of the target event key so that it approaches the average value of the event keys before and after the target event key, thereby creating the final event key swap table 32.

[0055] Thus, the replacement table creation unit 22 of the abnormality detection device 1 according to Embodiment 3 creates an event key replacement table 32 that shows the process of replacing each event key assigned to each event by the event extraction unit 21 with a value close to the average value of the preceding and succeeding event keys. As a result, when the monitored device is operating normally, the difference between the event keys of two consecutive events becomes small, and the same effect as in Embodiment 1 can be obtained.

[0056] Embodiment 4. Next, Embodiment 4 will be described. This embodiment will focus on the differences from Embodiment 1 described above. Figure 15 is a diagram showing an example of the configuration of the anomaly detection device 1a according to Embodiment 4.

[0057] Anomaly detection device 1a is configured in which a learning log conversion unit 60, a learning unit 70, and a trained model storage unit 80 are added to the anomaly detection device 1 according to Embodiment 1 shown in Figure 1, and the data acquisition unit 10 and state determination unit 50 of the anomaly detection device 1 are replaced by the data acquisition unit 10a and state determination unit 50a. The data acquisition unit 10a is configured in which a learning data acquisition unit 13 is added to the data acquisition unit 10 of the anomaly detection device 1 according to Embodiment 1. The learning log conversion unit 60 includes an event key assignment unit 61 and an event key replacement unit 62. The operation of the other components of the anomaly detection device 1a other than the state determination unit 50a, the learning log conversion unit 60, the learning unit 70, and the trained model storage unit 80 is the same as the components with the same reference numerals in the anomaly detection device 1 according to Embodiment 1. For this reason, in this embodiment, the description of the other components other than the state determination unit 50a, the learning log conversion unit 60, the learning unit 70, and the trained model storage unit 80 is omitted.

[0058] The training data acquisition unit 13 of the data acquisition unit 10a acquires log data that will be used for training in order for the training unit 70, which will be described later, to generate a trained model.

[0059] The event key assignment unit 61 and event key replacement unit 62 of the learning log conversion unit 60 perform the same operations as the event key assignment unit 41 and event key replacement unit 42 of the log event conversion unit 40, respectively.

[0060] The learning unit 70 performs machine learning using training data based on the data output by the learning log conversion unit 60, and generates a trained model to be used for determining the state of the monitored device.

[0061] The trained model storage unit 80 stores the trained model generated by the learning unit 70.

[0062] The state determination unit 50a determines whether the monitored device is in a normal state or not based on the learned model stored in the learned model storage unit 80 and the series of event keys output from the event key replacement unit 42 after the event key replacement process has been performed.

[0063] Next, we will explain the preparatory operations for generating a trained model used by the anomaly detection device 1a to determine the state of the monitored device. Figure 16 is a flowchart showing an example of the training operations for generating a trained model used by the anomaly detection device 1a to determine the state of the monitored device according to Embodiment 4. In Figure 16, the same step numbers as in Figure 2 are used for processes that are common to the flowchart in Figure 2 described in Embodiment 1. The explanation of processes common to the flowchart in Figure 2 (steps S11 to S14) will be omitted.

[0064] Following steps S11 to S14, the learning data acquisition unit 13 acquires logs (normal logs) created while the monitored device is operating normally (step S31). The learning data acquisition unit 13 acquires a large number of normal logs.

[0065] Next, the event key assignment unit 61 extracts events included in the logs acquired by the learning data acquisition unit 13 (step S32), and assigns an event key to the event according to the event key correspondence table 31 (step S33). Steps S32 and S33 are the same processes as steps S22 and S23 in Figure 7 described in Embodiment 1.

[0066] Next, the event key swapping unit 62 swaps the event keys of each event according to the event key swapping table 32 (step S34). This step S34 is the same process as step S24 in Figure 7 described in Embodiment 1.

[0067] Next, the learning unit 70 learns the event key sequence after the event key swapping process has been performed by the event key swapping unit 62 and generates a trained model (step S35). The learning unit 70 repeatedly learns the relationship between an event key sequence of a predetermined length included in the event key sequence input from the event key swapping unit 62, for example, K consecutive event keys (K is an integer of 2 or more), and the subsequent event key of these K event keys, and generates a trained model that predicts the subsequent event key from an event key sequence of a predetermined length (K consecutive event keys). Alternatively, the learning unit 70 may learn the relationship between a first event key sequence and a second event key sequence that follows the first event key sequence and is shorter in length than the first event key sequence, and generate a trained model that predicts the second event key sequence from the first event key sequence. The algorithm used by the learning unit 70 when generating the trained model can be a known algorithm such as supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning.

[0068] The learning unit 70 learns the event key sequence and the trained model it generates is stored in the trained model storage unit 80.

[0069] Next, we will explain the operational process by which the anomaly detection device 1a determines the status of the monitored device. Figure 17 is a flowchart showing an example of the operation by which the anomaly detection device 1a according to Embodiment 4 determines the status of the monitored device. In Figure 17, the same step numbers as in Figure 7 are used for processes that are common to the flowchart in Figure 7, which was explained in Embodiment 1. The explanation of the processes common to the flowchart in Figure 7 (steps S21 to S24) will be omitted.

[0070] Following steps S21 to S24, the state determination unit 50a calculates a predicted value for the event key (step S41). The state determination unit 50a calculates a predicted value for the event key based on the event key sequence output from the event key swapping unit 42 and the trained model stored in the trained model storage unit 80. For example, the state determination unit 50a predicts the (K+1)th event key output from the event key swapping unit 42 using the event keys from the 1st to the Kth output from the event key swapping unit 42 and a trained model for predicting subsequent event keys from K consecutive event keys.

[0071] Next, the status determination unit 50a determines whether or not there is an operational abnormality in the monitored device based on the calculated predicted value of the event key and the actual data (step S42). The actual data here refers to the actual event key output from the event key swapping unit 42. For example, if the status determination unit 50a predicted the K+1th event key output from the event key swapping unit 42 in step S41, it compares the predicted value of the K+1th event key output from the event key swapping unit 42 with the K+1th event key actually output from the event key swapping unit 42. If the predicted value and the actual event key are the same, it determines that the monitored device is operating normally; if they are different, it determines that an operational abnormality has occurred in the monitored device.

[0072] Thus, the anomaly detection device 1a according to Embodiment 4 learns the event key sequence included in the normal log to generate a trained model for predicting event keys, and determines whether or not there is an operational anomaly in the monitored device based on the comparison result between the event key predicted using the generated trained model and the actual event key. As a result, similar to Embodiments 1 to 3, it is possible to detect anomalies at a level that do not appear in the operation of the device.

[0073] Next, the hardware configurations of the anomaly detection devices 1 and 1a according to the above-described embodiments will be explained. Since the hardware configurations of the anomaly detection devices 1 and 1a are the same, an example of the hardware configuration of anomaly detection device 1 will be explained here.

[0074] Figure 18 shows an example of the hardware configuration of the anomaly detection device 1. The anomaly detection device 1 consists of, for example, the processor 91 and memory 92 shown in Figure 18.

[0075] The processor 91 includes a CPU (Central Processing Unit, also known as a microprocessor, microcomputer, or DSP (Digital Signal Processor)), a system LSI (Large Scale Integration), etc. The memory 92 includes non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, magnetic disks, etc.

[0076] When the anomaly detection device 1 consists of a processor 91 and memory 92, the data acquisition unit 10, table creation unit 20, log event conversion unit 40, and state determination unit 50 of the anomaly detection device 1 are realized by the processor 91 executing programs for each of these units to operate. The programs for operating as the data acquisition unit 10, table creation unit 20, log event conversion unit 40, and state determination unit 50 are pre-stored in memory 92. The processor 91 reads the above programs from memory 92 and executes them to operate as the data acquisition unit 10, table creation unit 20, log event conversion unit 40, and state determination unit 50.

[0077] The programs stored in memory 92 for operating as the data acquisition unit 10, table creation unit 20, log event conversion unit 40, and state determination unit 50 may be provided to the user, for example, by being written to a storage medium such as a CD (Compact Disc)-ROM or DVD (Digital Versatile Disc)-ROM, or by being provided to the user, for example, via a network.

[0078] Furthermore, the storage unit 30 of the anomaly detection device 1 is implemented by the memory 92.

[0079] Furthermore, the data acquisition unit 10, table creation unit 20, log event conversion unit 40, and state determination unit 50 of the anomaly detection device 1 may be implemented using dedicated hardware, such as a single circuit, a composite circuit, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a circuit combining these.

[0080] The configurations shown in the above embodiments are merely examples, and it is possible to combine them with other known technologies, combine different embodiments, and omit or modify parts of the configuration without departing from the gist of the invention.

[0081] For example, in each embodiment, two tables, an event key correspondence table 31 and an event key replacement table 32, are created in the preparation operation, and in the operation operation to determine the status of the monitored device, the two tables are used to perform the process of assigning event keys to events included in the log to be evaluated and the process of replacing the assigned event keys. However, in the preparation operation, a single conversion table is created that represents a single process that combines the two processes shown in the event key correspondence table 31 and the event key replacement table 32, and in the operation operation, the final event key is directly assigned to each event included in the log to be evaluated according to the conversion table and output to the status determination units 50 and 50a. [Explanation of Symbols]

[0082] 1,1a Anomaly detection device, 10,10a Data acquisition unit, 11 Normal log acquisition unit, 12 Evaluation target log acquisition unit, 13 Training data acquisition unit, 20 Table creation unit, 21 Event extraction unit, 22 Replacement table creation unit, 30 Storage unit, 31 Event key correspondence table, 32 Event key replacement table, 40 Log event conversion unit, 41,61 Event key assignment unit, 42,62 Event key replacement unit, 50,50a State determination unit, 60 Training log conversion unit, 70 Training unit, 80 Trained model storage unit.

Claims

1. An evaluation target log acquisition unit acquires evaluation target logs, which are log data recording information about events that occurred in the monitored device while it was in operation. An event key assignment unit assigns an event key, which is a value that uniquely identifies an event, to each event included in the log to be evaluated. An event key replacement unit replaces an event key assigned by the event key assignment unit to an event included in the log to be evaluated with a different event key according to an event key replacement table that shows a method for replacing event keys such that the difference between the event keys of two consecutive events included in a series of events that occurred in the monitored device that is operating normally becomes small. A status determination unit determines whether or not there is an operational abnormality of the monitored device based on a series of event keys after the event key replacement process has been performed by the event key replacement unit, An anomaly detection device characterized by being equipped with the following features.

2. A normal log acquisition unit acquires normal logs, which are log data recording information about events that occurred in the monitored device when the monitored device is operating normally. An event extraction unit that extracts events included in the normal log and assigns the event key, A replacement table creation unit creates an event key replacement table based on the event keys assigned to a series of events extracted from the normal log, An anomaly detection device according to claim 1, characterized by comprising:

3. The replacement table creation unit analyzes the event keys assigned to a series of events extracted from the normal log to detect a change pattern of two consecutive event keys, and creates the event key replacement table based on the detected change pattern. The anomaly detection device according to feature 2.

4. The replacement table creation unit analyzes the event keys assigned to a series of events extracted from the normal log to create an undirected graph representing the normal log, and creates the event key replacement table based on the connection relationships of each node constituting the created undirected graph. The anomaly detection device according to feature 2.

5. The replacement table creation unit creates an event key replacement table that shows the process of replacing the event key to be processed so that it approaches the average value of the two event keys before and after the event key to be processed, for each of the event keys assigned to the series of events extracted from the normal log. The anomaly detection device according to feature 2.

6. The state determination unit calculates the difference between two consecutive event keys included in a series of event keys after the event key replacement process performed by the event key replacement unit, and determines that an operational abnormality has occurred in the monitored device if the calculated difference is greater than a predetermined threshold. An anomaly detection device according to any one of features 1 to 5.

7. A learning data acquisition unit that acquires the aforementioned normal log, A learning log conversion unit generates an event key column by performing the following operations on each event included in the normal log acquired by the learning data acquisition unit: assigning an event key to each event and replacing the event key assigned to the event with another event key according to the event key replacement table; A learning unit that uses training data created based on the aforementioned event key sequence to train and generates a trained model for predicting subsequent event keys from an event key sequence of a predetermined length, Equipped with, The state determination unit calculates a predicted value of the event key based on the series of event keys after the event key replacement process performed by the event key replacement unit and the learned model, and determines that an operational abnormality has occurred in the monitored device if the calculated predicted value of the event key differs from the actual value. An anomaly detection device according to any one of the features described in 2 to 5.

8. The first step is to acquire the evaluation log, which is log data containing information about events that occurred on the monitored device while it was in operation. The second step involves assigning an event key, which is a value that uniquely identifies an event, to each event included in the log to be evaluated. A third step involves replacing the event key assigned to the event included in the evaluation log in the second step with a different event key according to an event key replacement table that shows a method for replacing event keys such that the difference between the event keys of two consecutive events included in a series of events that occurred in the normally functioning monitored device becomes small. A fourth step involves determining whether or not there is an operational abnormality in the monitored device based on a series of event keys after the replacement process has been performed in the third step, An anomaly detection method characterized by including

9. The first step is to acquire the evaluation log, which is log data containing information about events that occurred on the monitored device while it was in operation. The second step involves assigning an event key, which is a value that uniquely identifies an event, to each event included in the log to be evaluated. A third step involves replacing the event key assigned to the event included in the evaluation log in the second step with a different event key according to an event key replacement table that shows a method for replacing event keys such that the difference between the event keys of two consecutive events included in a series of events that occurred in the normally functioning monitored device becomes small. A fourth step involves determining whether or not there is an operational abnormality in the monitored device based on a series of event keys after the replacement process has been performed in the third step, An anomaly detection program characterized by causing a computer to execute a command.

10. The first step is to acquire the evaluation log, which is log data containing information about events that occurred on the monitored device while it was in operation. The second step involves assigning an event key, which is a value that uniquely identifies an event, to each event included in the log to be evaluated. A third step involves replacing the event key assigned to the event included in the evaluation log in the second step with a different event key according to an event key replacement table that shows a method for replacing event keys such that the difference between the event keys of two consecutive events included in a series of events that occurred in the normally functioning monitored device becomes small. A fourth step involves using the training data created based on the series of event keys after the replacement process in the third step to train and generate a trained model for predicting subsequent event keys, A fifth step involves using the trained model to determine whether or not there is an operational abnormality in the monitored device, An anomaly detection method characterized by including

11. The first step is to acquire the evaluation log, which is log data containing information about events that occurred on the monitored device while it was in operation. The second step involves assigning an event key, which is a value that uniquely identifies an event, to each event included in the log to be evaluated. A third step involves replacing the event key assigned to the event included in the evaluation log in the second step with a different event key according to an event key replacement table that shows a method for replacing event keys such that the difference between the event keys of two consecutive events included in a series of events that occurred in the normally functioning monitored device becomes small. A fourth step involves using the training data created based on the series of event keys after the replacement process in the third step to train and generate a trained model for predicting subsequent event keys, A fifth step involves using the trained model to determine whether or not there is an operational abnormality in the monitored device, An anomaly detection program characterized by causing a computer to execute a command.

Images