Calculation device

Abstract

It can sometimes be difficult to properly identify the data that contributed to the anomaly. [Solution] The calculation device includes: a calculation result acquisition unit that acquires the calculation result of the degree of abnormality using time-series log data consisting of log data over a predetermined time width and time-series numerical data representing measured values ​​over a predetermined time width; an edited abnormality acquisition unit that acquires the edited abnormality, which is the degree of abnormality at the time of editing, using time-series numerical data at the time the degree of abnormality was calculated and edited log data obtained by editing a part of the log data included in the time-series log data; and a contribution calculation unit that calculates a contribution that indicates the degree to which the event corresponding to the edited log data contributed to the abnormality using the degree of abnormality and the edited abnormality.

Description

Technical Field

[0001] The present invention relates to a calculation device, a calculation method, and a program.

Background Art

[0002] There are cases where the state of a target such as an information processing system is detected using both numerical data measured using a sensor or the like and text data such as a system log.

[0003] For example, Patent Document 1 discloses an anomaly detection method using a machine learning model that takes into account the correlation between numerical data and text data. According to Patent Document 1, in the anomaly detection method, when inputting log data, which is text data, and numerical data into a learned model, a feature vector including information representing the mutual dependence relationship between the log data and the numerical data is generated. Thereafter, the anomaly detection method performs anomaly detection according to the generated feature vector, the range of the plane space set during learning, and the like. Further, Patent Document 1 discloses performing anomaly detection according to an error between a predicted value of performance output by inputting log data and numerical data into a learning model and the acquired performance data.

[0004] Also, as a related technology, for example, there is Patent Document 2. Patent Document 2 discloses a method for specifying numerical data that contributes to the degree of anomaly. According to Patent Document 2, the method includes an influence degree calculation step of calculating a drift amount indicating the difference in distribution between a first evaluation period and a second evaluation period for the degree of anomaly and calculating an influence degree indicating the degree of influence based on the drift amount, and a factor specifying step of specifying a factor of the prediction error based on the influence degree.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Patent Document 2

[0006] When detecting anomalies using the technology described in Patent Document 1, it is sometimes necessary to identify the numerical and text data that contributed to the anomaly. However, the technology described in Patent Document 1 made it difficult to identify the numerical and text data that contributed to the anomaly. Furthermore, even when using the technology described in Patent Document 2, while it is possible to grasp the degree of contribution in numerical data, it is difficult to grasp the degree of contribution in text data. Thus, when detecting anomalies using numerical and text data, there is a problem in that it is sometimes difficult to appropriately identify the data that contributed to the anomaly.

[0007] Therefore, one of the objectives of this disclosure is to provide a calculation device, calculation method, and program that can solve the above-mentioned problems. [Means for solving the problem]

[0008] To achieve this objective, the computing apparatus in this disclosure is A calculation result acquisition unit that acquires the result of calculating the degree of anomaly using time-series log data consisting of log data over a predetermined time interval and time-series numerical data representing measured values ​​over a predetermined time interval. An editing anomaly acquisition unit obtains an editing anomaly, which is the anomaly at the time of editing, using the time-series numerical data used when calculating the anomaly, and edited log data obtained by editing a portion of the log data included in the time-series log data. A contribution calculation unit that uses the aforementioned abnormality score and the aforementioned editing abnormality score to calculate a contribution score indicating the degree to which the event corresponding to the edited log data contributed to the abnormality, has This is the structure it takes.

[0009] Furthermore, the calculation method in this disclosure is: Information processing device, The anomaly score is calculated using time-series log data consisting of log data over a predetermined time interval and time-series numerical data representing measured values ​​over a predetermined time interval. Using the time-series numerical data used to calculate the anomaly score and the edited log data obtained by editing a portion of the log data included in the time-series log data, the edited anomaly score, which is the anomaly score at the time of editing, is obtained. Using the aforementioned anomaly score and the aforementioned editing anomaly score, a contribution score is calculated that indicates the degree to which the event corresponding to the edited log data contributed to the anomaly. This is the structure it takes.

[0010] Furthermore, the program in this disclosure is In an information processing device, The anomaly score is calculated using time-series log data consisting of log data over a predetermined time interval and time-series numerical data representing measured values ​​over a predetermined time interval. Using the time-series numerical data used to calculate the anomaly score and the edited log data obtained by editing a portion of the log data included in the time-series log data, the edited anomaly score, which is the anomaly score at the time of editing, is obtained. Using the aforementioned anomaly score and the aforementioned editing anomaly score, a contribution score is calculated that indicates the degree to which the event corresponding to the edited log data contributed to the anomaly. This is a program for performing the processing. [Effects of the Invention]

[0011] With the configurations described above, when detecting anomalies using numerical and text data, it is possible to appropriately identify the data that contributed to the anomaly. [Brief explanation of the drawing]

[0012] [Figure 1] This figure shows an overview of the operation of the calculation system in this disclosure. [Figure 2] This diagram shows an example of the configuration of the calculation system. [Figure 3]It is a block diagram showing a configuration example of a calculation device. [Figure 4] It is a diagram for explaining a processing example of an editing candidate extraction unit. [Figure 5] It is a diagram for explaining a processing example of an editing abnormality degree acquisition unit. [Figure 6] It is a flowchart showing an operation example of the calculation device. [Figure 7] It is a diagram for explaining a calculation example of contribution degree. [Figure 8] It is a diagram for explaining a calculation example of contribution degree. [Figure 9] It is a block diagram showing another configuration example of the calculation device. [Figure 10] It is a block diagram showing a hardware configuration example of the calculation device in the second embodiment of the present disclosure. [Figure 11] It is a block diagram showing a configuration example of a calculation device.

Mode for Carrying Out the Invention

[0013] [First Embodiment] A configuration example of a calculation system 100 in the present disclosure will be described with reference to FIGS. 1 to 9. FIG. 1 is a diagram showing an operation outline of the calculation system 100. FIG. 2 is a diagram showing a configuration example of the calculation system 100. FIG. 3 is a block diagram showing a configuration example of the calculation device 300. FIG. 4 is a diagram for explaining a processing example of an editing candidate extraction unit 352. FIG. 5 is a diagram for explaining a processing example of an editing abnormality degree acquisition unit 353. FIG. 6 is a flowchart showing an operation example of the calculation device 300. FIGS. 7 and 8 are diagrams for explaining a calculation example of contribution degree. FIG. 9 is a block diagram showing another configuration example of the calculation device 300. Note that in the present disclosure, the drawings may be associated with one or more embodiments.

[0014] This disclosure describes a calculation system 100 that calculates a contribution score indicating the degree to which at least the log data contributed to the anomaly, based on the result of calculating the anomaly score using log data, which is text data, and numerical data. For example, the calculation system 100 obtains the result of calculating the anomaly score using time-series log data consisting of log data corresponding to each event that occurred in the target within a predetermined time range, and time-series numerical data representing measured values ​​corresponding to a predetermined time range from time-series measured values ​​obtainable by measuring the target. The calculation system 100 also obtains an edited anomaly score, which is the anomaly score at the time of editing, using the time-series numerical data at the time of calculating the anomaly score and edited log data obtained by editing a part of the log data included in the time-series log data. In other words, the calculation system 100 obtains the edited anomaly score by fixing the time-series numerical data, editing the time-series log data, and obtaining the anomaly score again. Subsequently, the calculation system 100 uses the anomaly score and the edited anomaly score to calculate a contribution score indicating the degree to which the event corresponding to the edited log data contributed to the anomaly. For example, the calculation system 100 can calculate the contribution by performing a subtraction process, such as subtracting the editing anomaly score from the anomaly score.

[0015] Figure 1 shows an overview of the operation of the calculation system 100. In the case of Figure 1, the calculation system 100 calculates the degree of editing abnormality and the contribution score using edited log data obtained by deleting one of the log data included in the time-series log data. For example, by performing the above contribution score calculation while changing the log data to be deleted, the calculation system 100 can calculate a contribution score that indicates the degree to which the event corresponding to each log data included in the time-series log data contributed abnormally. As will be described later, the calculation system 100 may also be configured to identify log data that are candidates for editing according to arbitrary conditions, and to perform editing such as deletion on the identified log data.

[0016] In this disclosure, the calculation system 100 obtains an abnormality score by acquiring log data and numerical data from the detection target whose state is to be detected. Here, the detection target is, for example, an information processing system such as a server device. The detection target is not limited to an information processing system, but may be anything such as a plant, a manufacturing plant, or a processing facility. The log data is, for example, text data corresponding to a time, and represents the processing content such as events being executed by the information processing system. The log data may be, for example, a syslog, or any other arbitrary text data representing the processing content due to the operation of equipment and facilities constituting the plant. In this disclosure, the log data is assumed to be grouped based on similarity such as the type of event, and each group can be converted into an embedded vector. In other words, the log data can be converted into an embedded vector according to the corresponding type of event. The conversion to an embedded vector may be performed using any method. The numerical data is numerical series data represented by numerical values ​​such as the CPU (Central Processing Unit) usage rate, memory usage rate, disk access frequency, number of input / output packets, input / output packet rate, and power consumption value of each information processing device constituting the information processing system. The numerical data may be at least a part of the various data exemplified above. Furthermore, the numerical data may include values ​​such as temperature, pressure, flow rate, power consumption, raw material supply amount, and remaining amount within the plant.

[0017] Furthermore, the anomaly score can represent a value corresponding to the state of the detected object. For example, a higher anomaly score may indicate a higher probability that the detected object is in an abnormal state. The anomaly score may also represent a value corresponding to signs or probabilities of failure. For example, the calculation system 100 can calculate the anomaly score based on the results of inputting time-series log data and time-series numerical data into a pre-trained model. As an example, the calculation system 100 may calculate the anomaly score using a feature vector obtainable by inputting time-series log data and time-series numerical data into a pre-trained model trained in the manner described in Patent Document 1. In addition to the method described in Patent Document 1, the calculation system 100 may calculate the anomaly score using any method. For example, the calculation system 100 may calculate the anomaly score based on inputting time-series log data and time-series numerical data into a pre-trained model that calculates reconstruction errors. In other words, the calculation system 100 may input time-series log data and time-series numerical data into a trained model to obtain output values, then reconstruct the output values ​​and check how much difference there is between the reconstructed values ​​and the original values ​​to calculate the anomaly score. The calculation system 100 may also calculate the anomaly score using any method other than those exemplified above.

[0018] Figure 2 shows an example of the configuration included in the calculation system 100. Referring to Figure 2, the calculation system 100 includes an object C, such as a server device, which is the target of detection; a detection device 200 that calculates the degree of abnormality and detects abnormalities; and a calculation device 300 that calculates the degree of contribution using the result of the abnormality calculation by the detection device 200. As shown in Figure 1, the object C and the detection device 200 are connected so that they can communicate with each other. Also, the detection device 200 and the calculation device 300 are connected so that they can communicate with each other.

[0019] Note that the configuration of the calculation system 100 is not limited to the example shown in Figure 2. For example, the calculation system 100 may consist of a target C, an information processing device that includes the functions of a detection device 200 and a calculation device 300, etc. Also, the calculation system 100 may include multiple targets C, etc.

[0020] The detection device 200 is an information processing device that calculates the degree of anomaly using log data and numerical data acquired from target C. For example, the detection device 200 uses time-series log data consisting of log data over a predetermined time interval and time-series numerical data representing measured values ​​corresponding to the predetermined time interval. The abnormality score is calculated based on the results of inputting the data into a pre-trained model. The detection device 200 can also detect abnormalities using the calculated abnormality score.

[0021] The detection device 200 can calculate the anomaly score using a pre-trained model. For example, the detection device 200 obtains feature vectors by inputting time-series log data and time-series numerical data into the pre-trained model. The detection device 200 then calculates the anomaly score using the obtained feature vectors. As an example, the detection device 200 may calculate the anomaly score by calculating the distance between the origin, which is the center of the range in planar space, and the feature vector, as described in Patent Document 1. The detection device 200 may also calculate the anomaly score from the degree of deviation between the distribution learned during training and the feature vector, or it may calculate the anomaly score using any other arbitrary method. The training of the above model may be performed by machine learning using time-series log data, time-series numerical data, and performance data representing performance indicators measured at target C, as described in Patent Document 1. As an example, the detection device 200 generates a feature vector containing information representing the interdirectional dependency between time-series log data and time-series numerical data, using a time-series log vector obtained by converting time-series log data and a time-series numerical vector obtained by converting time-series numerical data. The detection device 200 also generates predicted values ​​from the generated feature vector. In this process, the detection device 200 can perform machine learning using time-series log data, time-series numerical data, and performance data to generate a feature vector with a distribution that minimizes the error between the predicted values ​​and performance data and satisfies pre-set criteria.

[0022] As mentioned above, the detection device 200 may be configured to calculate the anomaly score by training a model different from the model disclosed in Patent Document 1. For example, the detection device 200 may be configured to calculate the anomaly score by inputting time-series log data and time-series numerical data into a trained model that calculates the reconstruction error.

[0023] Furthermore, the detection device 200 can detect anomalies according to the calculated degree of anomaly. For example, the detection device 200 detects an anomaly when predetermined conditions are met, such as the calculated degree of anomaly being equal to or greater than a predetermined value. In response, the detection device 200 transmits a message to the calculation device 300 indicating that an anomaly has been detected. The detection device 200 also transmits a message to the calculation device 300 indicating that an anomaly has been detected, along with at least the time-series log data, which may be time-series log data or time-series numerical data, at the time the anomaly was detected. Note that the transmission of the message indicating that an anomaly has been detected by the detection device 200 may be performed in response to instructions from the calculation device 300 or other devices.

[0024] Furthermore, as will be described later, the detection device 200 may receive instructions from the calculation device 300 to calculate an anomaly score (edited anomaly score) using data edited by the calculation device 300. In other words, the detection device 200 may receive edited log data, which is time-series log data edited by the calculation device 300, from the calculation device 300. Accordingly, the detection device 200 can calculate the edited anomaly score by inputting the data edited by the calculation device 300 into a trained model, similar to when calculating the anomaly score. That is, the detection device 200 calculates the edited anomaly score using the unedited time-series numerical data used when calculating the anomaly score and the edited log data. The detection device 200 then transmits the calculated edited anomaly score to the calculation device 300.

[0025] The calculation device 300 is an information processing device that calculates the degree of contribution using time-series log data and time-series numerical data received from the detection device 200. Figure 3 shows an example of the main configuration of the calculation device 300. Referring to Figure 3, the calculation device 300 has as its main components an operation input unit 310, a screen display unit 320, a communication interface unit 330, a storage unit 340, and an arithmetic processing unit 350.

[0026] Figure 3 illustrates a case where the functions of the calculation device 300 are realized using a single information processing device. However, at least some of the functions of the calculation device 300 may be realized using multiple information processing devices, for example, by being implemented on the cloud. Furthermore, the calculation device 300 does not have to include some of the configurations exemplified above, such as not having an operation input unit 310 or a screen display unit 320, and may have configurations other than those exemplified above.

[0027] The operation input unit 310 consists of an operation input device such as a keyboard or mouse. The operation input unit 310 detects the operation of the operator operating the calculation device 300 and outputs it to the calculation processing unit 350.

[0028] The screen display unit 320 consists of a screen display device such as a liquid crystal display or an organic EL (electro-luminescence) display. The screen display unit 320 can display various information stored in the storage unit 340 on the screen in response to instructions from the arithmetic processing unit 350.

[0029] The communication interface unit 330 consists of data communication circuits and the like. The communication interface unit 330 performs data communication with external devices connected via a communication line.

[0030] The storage unit 340 is a storage device such as a hard disk or memory. The storage unit 340 stores processing information and programs 343 necessary for various processes in the arithmetic processing unit 350. The programs 343 are read into the arithmetic processing unit 350 and executed to realize various processing functions. The programs 343 are pre-read from external devices or recording media via data input / output functions such as the communication interface unit 330 and stored in the storage unit 340. The main information stored in the storage unit 340 includes, for example, data information 341 and abnormality information 342.

[0031] The data information 341 includes various data such as time-series log data and time-series numerical data used by the detection device 200 when detecting an anomaly. In other words, the data information 341 includes log data and numerical data for a time range corresponding to the detection of an anomaly. In the case of time-series log data and time-series numerical data, the log data and numerical data may be associated with information indicating the time when the log data and numerical data were acquired at target C, etc. Furthermore, the log data may be values ​​converted into embedded vectors depending on the type of event that corresponds to it. The data information 341 can be updated when the acquisition unit 351 acquires time-series log data and time-series numerical data from the detection device 200, etc.

[0032] In addition to the time-series log data and time-series numerical data mentioned above, the data information 341 may also include data that has been edited by the editing process described later. In other words, the data information 341 may be updated according to the results of editing by the editing abnormality acquisition unit 353.

[0033] The abnormality level information 342 includes information indicating the degree of abnormality when the detection device 200 detects an abnormality. In other words, the abnormality level information 342 includes information indicating the degree of abnormality calculated using time-series log data and time-series numerical data included in the data information 341. The abnormality level information 342 can be updated when the acquisition unit 351 acquires the degree of abnormality from the detection device 200, etc.

[0034] Furthermore, the abnormality information 342 may include editing abnormality scores, similar to the case of data information 341. In other words, data information 341 may be updated according to the results of editing abnormality score acquisition by the editing abnormality score acquisition unit 353.

[0035] The arithmetic processing unit 350 has an arithmetic device such as a CPU and its peripheral circuits. The arithmetic processing unit 350 reads and executes the program 343 from the storage unit 340, thereby realizing various processing functions by having the hardware and the program 343 cooperate. The main processing functions realized by the arithmetic processing unit 350 include, for example, the acquisition unit 351, the editing candidate extraction unit 352, the editing abnormality acquisition unit 353, the contribution calculation unit 354, and the output unit 355.

[0036] The arithmetic processing unit 350 may have a GPU (Graphic Processing Unit), DSP (Digital Signal Processor), MPU (Micro Processing Unit), FPU (Floating Point Number Processing Unit), PPU (Physics Processing Unit), TPU (Tensor Processing Unit), quantum processor, microcontroller, or a combination thereof, instead of the CPU described above.

[0037] The acquisition unit 351 (calculation result acquisition unit) acquires various data from the detection device 200, such as time-series log data and time-series numerical data used when detecting anomalies, the calculated anomaly degree, and other arbitrary information. The acquisition unit 351 also stores the acquired time-series log data and time-series numerical data in data information 341, and stores the acquired anomaly degree and other information in anomaly degree information 342. The acquisition unit 351 may acquire embedded vectors or other data obtained by converting log data instead of log data.

[0038] The editing candidate extraction unit 352 extracts log data that are candidates for editing from the log data included in the time-series log data. For example, the editing candidate extraction unit 352 can extract log data that are candidates for editing based on the results of calculating the gradient of anomalies using the log data.

[0039] For example, the editing candidate extraction unit 352 obtains an embedded vector for each log data in the time-series log data, which is obtained by transforming the log data according to the type of event, etc. The editing candidate extraction unit 352 also calculates the gradient of the anomaly degree with respect to the embedded vector by performing differentiation, etc. Then, the editing candidate extraction unit 352 extracts log data that are candidates for editing based on the norm of the calculated gradient. As an example, as shown in Figure 4, the editing candidate extraction unit 352 extracts a predetermined number of log data as editing candidate log data in descending order of gradient norm. For example, the editing candidate extraction unit 352 may extract log data that are candidates for editing based on the L2 norm, etc.

[0040] The editing anomaly acquisition unit 353 acquires the editing anomaly degree, which is the degree of anomaly during editing, using time-series numerical data and edited log data obtained by editing a portion of the log data included in the time-series log data. The editing anomaly acquisition unit 353 can acquire the editing anomaly degree from the detection device 200 by transmitting the edited log data to the detection device 200, etc.

[0041] Figure 5 shows an example of the editing anomaly acquisition process by the editing anomaly acquisition unit 353. Referring to Figure 5, the editing anomaly acquisition unit 353 acquires the editing anomaly using edited log data from which one log data from the candidate log data has been deleted. The editing anomaly acquisition unit 353 also acquires the editing anomaly while changing the log data to be deleted. In this way, the editing anomaly acquisition unit 353 acquires the editing anomaly for each candidate log data when one of the extracted candidate log data is deleted. For example, if the candidate extraction unit 352 has extracted α candidate log data, the editing anomaly acquisition unit 353 can acquire α editing anomalies.

[0042] Furthermore, the editing anomaly acquisition unit 353 may acquire the editing anomaly when multiple log data sets grouped together according to arbitrary conditions are deleted. In other words, the editing anomaly acquisition unit 353 may acquire the editing anomaly by editing two or more arbitrary numbers of log data sets that are part of the log data included in the time-series log data. In addition, the editing anomaly acquisition unit 353 may be configured to replace log data instead of deleting it. For example, the editing anomaly acquisition unit 353 may acquire the editing anomaly after replacing one of the log data sets that are candidates for editing with one of the other log data sets included in the time-series log data. Thus, the editing anomaly acquisition unit 353 may perform replacement or other actions instead of deletion as part of the editing process.

[0043] The contribution calculation unit 354 uses the anomaly score and the editing anomaly score to calculate a contribution score, which indicates the degree to which the event corresponding to the edited log data contributed to the anomaly. In other words, the contribution calculation unit 354 uses the anomaly score and the editing anomaly score to calculate the contribution score for the log data, which is text data.

[0044] For example, the contribution calculation unit 354 calculates the contribution by performing a subtraction process, such as subtracting the editing abnormality from the abnormality score. As described above, the editing abnormality acquisition unit 353 acquires the editing abnormality score according to the number of log data that are candidates for editing. Therefore, the contribution calculation unit 354 can calculate the contribution score according to the number of log data that are candidates for editing by performing the above subtraction process for each editing abnormality score.

[0045] Furthermore, the contribution calculation unit 354 may be configured to calculate the contribution to the log data, which is text data, using the method described above, as well as to calculate the contribution to the numerical data. For example, the contribution calculation unit 354 can calculate the contribution to the numerical data using any method after fixing the text data. As an example, the contribution calculation unit 354 may calculate the contribution to the numerical data using a known method such as the one described in Patent Document 2. Also, if a model for calculating the reconstruction error is used as the model for calculating the anomaly score, the contribution calculation unit 354 can obtain the contribution corresponding to each numerical data by obtaining the reconstruction error for each data item from the detection device 200. As an example, the contribution calculation unit 354 may obtain the reconstruction error for each data item as the contribution.

[0046] The output unit 355 outputs the contribution level calculated by the contribution level calculation unit 354. The output unit 355 may also output information such as the editing anomaly level used to calculate the contribution level, the log data used to calculate the editing anomaly level, and the event corresponding to the log data, along with the contribution level. The output unit 355 may display the contribution level on the screen display unit 320 or transmit it to an external device via the communication interface unit 330.

[0047] In addition to the contribution scores exemplified above, the output unit 355 may be configured to output information such as whether or not an anomaly was detected, the degree of the anomaly, information about editing candidates, and other arbitrary information.

[0048] The above is an example of the configuration of the output unit 355. Next, an example of the operation of the calculation device 300 will be described with reference to Figure 6. Note that the operation in Figure 6 may be started at any time, such as when the acquisition unit 351 acquires time-series log data.

[0049] Figure 6 is a flowchart illustrating an example of the operation of the calculation device 300. Referring to Figure 6, for example, the editing candidate extraction unit 352 obtains an embedded vector by transforming the log data according to the type of event, etc. The editing candidate extraction unit 352 also calculates the gradient of the anomaly degree for the embedded vector by performing differentiation, etc. (step S101).

[0050] The editing candidate extraction unit 352 extracts log data that can be used as editing candidates based on the calculated gradient norm (step S102). As an example, the editing candidate extraction unit 352 extracts a predetermined number of log data as editing candidate log data in descending order of gradient norm.

[0051] The editing anomaly acquisition unit 353 uses time-series numerical data and edited log data obtained by editing a portion of the log data included in the time-series log data to acquire the editing anomaly degree, which is the degree of anomaly during editing. For example, the editing anomaly acquisition unit 353 acquires the editing anomaly degree using edited log data obtained by deleting one of the log data that are candidates for editing (step S103). Also, if there are log data among the log data that are candidates for editing that have not been edited, such as by deletion, remaining (step S104, YES), the editing anomaly acquisition unit 353 acquires the editing anomaly degree using edited log data obtained by deleting one of the log data that are candidates for editing and have not been edited (step S103).

[0052] When editing is performed on each log data that is a candidate for editing and the editing anomaly degree is obtained (step S104, NO), the contribution calculation unit 354 uses the anomaly degree and the editing anomaly degree to calculate a contribution degree that indicates the degree to which the event corresponding to the edited log data contributed abnormally (step S105). The contribution calculation unit 354 can calculate a contribution degree according to the number of log data that are candidates for editing.

[0053] The output unit 355 outputs the contribution level calculated by the contribution level calculation unit 354 (step S106). The output unit 355 may display the contribution level on the screen display unit 320 or transmit it to an external device via the communication interface unit 330.

[0054] The above is an example of the operation of the calculation device 300. Note that Figure 6 shows an example of the operation of the calculation device 300, and the operation of the calculation device 300 is not limited to the example shown in Figure 6. For example, the contribution score may be calculated each time the editing anomaly score is obtained. In addition, any other modification may be adopted.

[0055] Thus, the calculation device 300 includes an editing anomaly acquisition unit 353 and a contribution calculation unit 354. With this configuration, the contribution calculation unit 354 can calculate the contribution using the editing anomaly acquired by the editing anomaly acquisition unit 353. This makes it possible to determine the degree to which log data, which is text data, contributed to the anomaly. As a result, it becomes possible to more appropriately identify the data that contributed to the detection of the anomaly.

[0056] Furthermore, the calculation device 300 includes an editing candidate extraction unit 352. With this configuration, the editing anomaly acquisition unit 353 can edit the log data that has been extracted as editing candidates by the editing candidate extraction unit 352 and acquire the editing anomaly degree. This enables a more efficient calculation process of the contribution degree. As a result, it becomes possible to more efficiently identify the data that contributed to the detection of anomalies.

[0057] Figures 7 and 8 show examples of contribution calculation using the calculation device 300. Figure 7 shows an example of acquiring numerical data and log data that have a relationship where the value of the numerical data increases when an event with ID0 occurs. Referring to Figure 7, in the time range enclosed by the frame in Figure 7, an event with ID0 occurs, but no change is observed in the numerical value. Therefore, it can be said that an anomaly occurred in the area indicated by the frame in Figure 7.

[0058] Figure 8 shows an example of how contributions are calculated under these circumstances. Referring to Figure 8, it can be seen that the contribution based on the editing anomaly obtained by editing the log data corresponding to event 0 has the highest value. In other words, according to Figure 8, it can be seen that the log data of event 0 is highly likely to have contributed to the anomaly. In the example shown in Figure 7, even if the contribution of numerical data alone is calculated using the method described in Patent Document 2, it is difficult to appropriately identify the data that contributed to the detection of the anomaly. Referring to Figures 7 and 8, it can be seen that by using the method described in this disclosure, it is possible to appropriately identify the data that contributed to the detection of anomalies when detecting anomalies in information processing systems, plants, etc. In other words, according to the calculation system 100 exemplified in this disclosure, even in cases where it is not possible to distinguish anomalies from numerical data alone in information processing systems, etc., where numerical data and log data can be obtained, it is possible to appropriately identify the data that contributed to the detection of the anomaly.

[0059] The configuration of the calculation device 300 is not limited to the examples provided herein. For example, the calculation device 300 does not need to have an editing candidate extraction unit 352. If the calculation device 300 does not have an editing candidate extraction unit 352, the editing abnormality acquisition unit 353 may, for example, perform editing on each log data included in the time-series log data to acquire the editing abnormality.

[0060] Furthermore, this disclosure states that the contribution calculation unit 354 may be configured to calculate the contribution to log data, which is text data, and to calculate the contribution to numerical data using an existing method such as that described in Patent Document 2. However, the contribution calculation unit 354 may also calculate the contribution to numerical data using a method described later that relates to the method for calculating the contribution to text data exemplified in this disclosure. For example, the contribution calculation unit 354 can calculate the contribution to numerical data using a method described later, such as when calculating the anomaly score using a model other than the one used to calculate the reconstruction error.

[0061] As an example, the contribution calculation unit 354 can perform the following processing after fixing the log data, which is text data. For example, the contribution calculation unit 354 calculates the gradient of the anomaly degree for the input numerical data. Then, the contribution calculation unit 354 generates numerical data that reduces the anomaly degree using methods such as stochastic gradient descent. For example, the contribution calculation unit 354 continues the above generation step a predetermined number of times or until the anomaly value falls below a predetermined value. After that, the contribution calculation unit 354 calculates the contribution by calculating the difference between the finally generated numerical data and the original numerical data for each data item. As an example, the contribution calculation unit 354 may calculate the squared error (mean squared error if there are multiple types of numerical data) as an indicator of the difference.

[0062] For example, as described above, the contribution calculation unit 354 may edit numerical data to calculate the contribution when calculating the anomaly using a model other than the one used to calculate the reconstruction error.

[0063] Furthermore, as described above, the detection device 200 and the calculation device 300 may be composed of a single information processing device or the like. In this case, the calculation device 300 can perform calculations of anomaly scores and detection of anomalies using the calculated anomaly scores, for example, by having a pre-trained model. Similarly, the calculation device 300 can perform calculations of editing anomaly scores.

[0064] Furthermore, the calculation device 300 may have configurations other than those illustrated in Figure 3. For example, Figure 9 shows a modified example of the calculation device 300. Referring to Figure 9, the calculation processing unit 350 of the calculation device 300 can implement a control unit 356 and other components in addition to the configuration illustrated in Figure 3 by reading and executing the program 343.

[0065] The control unit 356 performs predetermined control on target C, etc., based on the contribution calculated by the contribution calculation unit 354.

[0066] For example, the control unit 356 identifies events that are likely to have contributed abnormally based on the contribution level calculated by the contribution level calculation unit 354. As an example, the control unit 356 identifies events that correspond to the highest contribution level as events that are likely to have contributed abnormally. The control unit 356 may identify one or more events depending on conditions other than those exemplified above.

[0067] Furthermore, the control unit 356 can perform predetermined controls on targets corresponding to identified events. For example, the control unit 356 can perform a restart, call a designated person such as an engineer, or perform other arbitrary controls in response to an identified event. As an example, the control unit 356 stores information about the control content, such as restarting, and the target of the control corresponding to the event, for each event in advance. By checking the above information, the control unit 356 can perform event-appropriate controls on targets corresponding to the identified event. The above information may include information indicating the control content corresponding to the event and the value of the contribution. In addition, the control unit 356 may perform processes other than those exemplified above, such as specifying the control content to be executed in response to inputting information indicating the contribution and the identified event into a pre-trained model.

[0068] [Second Embodiment] Next, with reference to Figures 10 and 11, a modified example of the calculation device 300, the calculation device 400, will be described. Figure 10 is a diagram showing an example of the hardware configuration of the calculation device 400. Figure 11 is a block diagram showing an example of the configuration of the calculation device 400.

[0069] The calculation device 400 is an information processing device that calculates at least a contribution score, which indicates the degree to which an event corresponding to the log data contributed to the anomaly, based on the calculation result of the anomaly score using log data and numerical data. Figure 10 shows an example of the hardware configuration of the calculation device 400. Referring to Figure 10, the calculation device 400 has the following hardware configuration as an example. ·CPU(Central Processing Unit)401(Arithmetic unit) ROM (Read Only Memory) 402 (Storage Device) • RAM (Random Access Memory) 403 (storage device) • Program group 404 loaded into RAM 403 • Storage device 405 for storing the program group 404 • Drive device 406 for reading and writing to recording medium 410 outside the information processing device. • Communication interface 407 connecting to a communication network 411 outside the information processing device. • Input / output interface 408 for data input and output. • Bus 409 connecting each component

[0070] Furthermore, the calculation device 400 can realize the functions of the calculation result acquisition unit 421, the editing abnormality acquisition unit 422, and the contribution calculation unit 423 shown in Figure 11 by having the CPU 401 acquire the program group 404 and execute it. The program group 404 is, for example, stored in advance in a storage device 405 or ROM 402, and the CPU 401 loads it into RAM 403 or the like and executes it as needed. Alternatively, the program group 404 may be supplied to the CPU 401 via a communication network 411, or it may be stored in advance in a recording medium 410, and the drive device 406 may read the program and supply it to the CPU 401.

[0071] Figure 10 shows an example of the hardware configuration of the calculation device 400. The hardware configuration of the calculation device 400 is not limited to the case described above. For example, the calculation device 400 may consist of only a part of the configuration described above, such as not having a drive device 406. Also, the CPU 401 may be a GPU or the like as exemplified in the first embodiment.

[0072] The calculation result acquisition unit 421 acquires the abnormality score calculation result using time-series log data consisting of log data corresponding to each event that occurred on the target within a predetermined time range, and time-series numerical data representing the measured values ​​corresponding to the predetermined time range from the time-series measured values ​​that can be obtained by measuring the target. For example, the calculation result acquisition unit 421 may acquire, along with the calculated abnormality score, at least the time-series log data from the time-series log data and time-series numerical data used in calculating the abnormality score.

[0073] The editing anomaly acquisition unit 422 uses the time-series numerical data at the time the acquired anomaly was calculated and the edit log data obtained by editing a portion of the log data included in the time-series log data to acquire the editing anomaly, which is the anomaly at the time of editing.

[0074] The contribution calculation unit 423 uses the anomaly score and the editing anomaly score to calculate a contribution score that indicates the degree to which the event corresponding to the edited log data contributed to the anomaly. For example, the contribution calculation unit 423 may calculate the contribution score by performing a subtraction operation, such as subtracting the editing anomaly score from the anomaly score.

[0075] Thus, the calculation device 400 includes an editing anomaly acquisition unit 422 and a contribution calculation unit 423. With this configuration, the contribution calculation unit 423 can use the editing anomaly to calculate a contribution that indicates the degree to which the event corresponding to the edited log data contributed to the anomaly. This makes it possible to determine the degree to which the log data, which is text data, contributed to the anomaly. As a result, it becomes possible to more appropriately identify the data that contributed to the detection of the anomaly.

[0076] The calculation device 400 described above can be realized by incorporating a predetermined program into an information processing device such as the calculation device 400. Specifically, another form of the program described herein is a program for implementing a process in which an information processing device such as the calculation device 400 obtains a calculation result for the degree of abnormality using time-series log data consisting of log data corresponding to each event that occurred in the target within a predetermined time range, and time-series numerical data representing the measurement values ​​corresponding to a predetermined time range from the time-series measurement values ​​that can be obtained by measuring the target, obtains an edited abnormality score, which is the degree of abnormality at the time of editing, using the time-series numerical data at the time the obtained degree of abnormality was calculated and edited log data obtained by editing a part of the log data included in the time-series log data, and calculates a contribution score, which indicates the degree to which the event corresponding to the edited log data contributed to the abnormality, using the degree of abnormality and the edited abnormality score.

[0077] Furthermore, the calculation method performed by the information processing device such as the calculation device 400 described above involves the information processing device such as the calculation device 400 obtaining the result of calculating the degree of abnormality using time-series log data consisting of log data corresponding to each event that occurred in the target within a predetermined time range, and time-series numerical data representing the measured values ​​corresponding to a predetermined time range from the time-series measured values ​​that can be obtained by measuring the target. The method then involves obtaining an edited abnormality score, which is the degree of abnormality at the time of editing, using the time-series numerical data at the time the degree of abnormality was calculated and edited log data obtained by editing a part of the log data included in the time-series log data, and using the degree of abnormality and the edited abnormality score to calculate a contribution score that indicates the degree to which the event corresponding to the edited log data contributed to the abnormality.

[0078] Even a program having the configuration described above, or a recording medium readable by a computer on which the program is recorded, or a calculation method, can achieve the same functions and effects as the calculation device 400 described above, and thus the objectives of this disclosure described above can be achieved.

[0079] <Note> Some or all of the above embodiments may also be described as follows. The general outline of the calculation apparatus and other components in this disclosure is described below. However, this disclosure is not limited to the following configurations.

[0080] (Note 1) A calculation result acquisition unit that acquires the result of calculating the degree of anomaly using time-series log data consisting of log data over a predetermined time interval and time-series numerical data representing measured values ​​over a predetermined time interval. An editing anomaly acquisition unit obtains an editing anomaly, which is the anomaly at the time of editing, using the time-series numerical data used when calculating the anomaly, and edited log data obtained by editing a portion of the log data included in the time-series log data. A contribution calculation unit that uses the aforementioned abnormality score and the aforementioned editing abnormality score to calculate a contribution score indicating the degree to which the event corresponding to the edited log data contributed to the abnormality, has Calculation device. (Note 2) The system includes an extraction unit that extracts log data from the time-series log data that are candidates for editing, The editing abnormality acquisition unit performs the editing abnormality acquisition process for each of the log data that are candidates for editing, extracted by the extraction unit, using the edited log data obtained by editing one of the log data that are candidates for editing. The calculation device described in Appendix 1. (Note 3) The editing anomaly acquisition unit acquires the editing anomaly using the edited log data from which a portion of the log data included in the time-series log data has been deleted. The calculation device described in Appendix 1 or Appendix 2. (Note 4) The editing anomaly acquisition unit calculates the editing anomaly using the edited log data obtained by replacing a portion of the log data included in the time-series log data with other log data included in the time-series log data. A calculation device as described in any one of the items from Appendix 1 to Appendix 3. (Note 5) The control unit has a control unit that performs predetermined control on an object identified according to the contribution level calculated by the calculation unit. A calculation device as described in any one of the items from Appendix 1 to Appendix 4. (Note 6) The extraction unit extracts log data that are candidates for editing according to the result of calculating the gradient of the degree of abnormality. The calculation device described in Appendix 2. (Note 7) The extraction unit extracts candidate log data for editing based on the gradient norm of the anomaly level for the embedded vector obtained by converting the log data. The calculation device described in Appendix 2. (Note 8) The contribution calculation unit calculates a contribution that indicates the degree to which the edited log data contributed abnormally using the abnormality score and the editing abnormality score, and calculates the contribution of the time-series numerical data using the data generated to reduce the abnormality score based on the gradient of the abnormality score and the time-series numerical data at the time the abnormality score was calculated. A calculation device as described in any one of the items from Appendix 1 to Appendix 7. (Note 9) Information processing device, The anomaly score is calculated using time-series log data consisting of log data over a predetermined time interval and time-series numerical data representing measured values ​​over a predetermined time interval. Using the time-series numerical data used to calculate the anomaly score and the edited log data obtained by editing a portion of the log data included in the time-series log data, the edited anomaly score, which is the anomaly score at the time of editing, is obtained. Using the aforementioned anomaly score and the aforementioned editing anomaly score, a contribution score is calculated that indicates the degree to which the event corresponding to the edited log data contributed to the anomaly. Calculation method. (Note 10) In an information processing device, The anomaly score is calculated using time-series log data consisting of log data over a predetermined time interval and time-series numerical data representing measured values ​​over a predetermined time interval. Using the time-series numerical data used to calculate the anomaly score and the edited log data obtained by editing a portion of the log data included in the time-series log data, the edited anomaly score, which is the anomaly score at the time of editing, is obtained. Using the aforementioned anomaly score and the aforementioned editing anomaly score, a contribution score is calculated that indicates the degree to which the event corresponding to the edited log data contributed to the anomaly. A program to perform the processing.

[0081] Furthermore, some or all of the configurations described in Appendices 2 to 8, which are dependent on the calculation device described in Appendice 1, may also be dependent on the calculation method described in Appendice 9, the program described in Appendice 10, etc., through a similar dependency relationship. Moreover, not limited to Appendices 9 and 10, some or all of the configurations described in the appendices may also be dependent on various hardware, software, various recording means, methods, programs, or systems for recording software, without departing from the embodiments described above.

[0082] The programs described in each of the above embodiments and appendices can be stored and supplied to a computer using various types of non-transitory computer-readable media. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / Ws, and semiconductor memories (e.g., mask ROMs, PROMs (Programmable ROMs), EPROMs (Erasable PROMs), flash ROMs, and RAMs (Random Access Memory)). Programs may also be supplied to a computer using various types of transient computer-readable media. Examples of transient computer-readable media include electrical signals, optical signals, and electromagnetic waves. Transitory computer-readable media can be supplied to a computer via wired communication channels such as electric wires and optical fibers, or via wireless communication channels.

[0083] Although the present disclosure has been described above with reference to the embodiments described above, the present disclosure is not limited to the embodiments described above. Various modifications to the structure and details of the present disclosure can be made as can be understood by those skilled in the art within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate. [Explanation of symbols]

[0084] 100 Calculation System 200 detection devices 300 Calculation device 310 Operation Input Section 320 Screen display section 330 Communication Interface Section 340 Storage section 341 Data Information 342 Abnormality information 343 Programs 350 Arithmetic Processing Unit 351 Acquisition Department 352 Editing Candidate Extraction Unit 353 Editing Anomaly Acquisition Unit 354 Contribution Calculation Unit 355 Output section 356 Control Unit 400 Calculation device 401 CPU 402 ROM 403 RAM 404 Program Group 405 Storage device 406 Drive unit 407 Communication Interface 408 Input / Output Interfaces Bus 409 410 Recording media 411 Communication Network 421 Calculation result acquisition part 422 Editing Anomaly Score Acquisition Unit 423 Contribution Calculation Unit

Claims

1. A calculation result acquisition unit that acquires the result of calculating the degree of anomaly using time-series log data consisting of log data over a predetermined time interval and time-series numerical data representing measured values ​​over a predetermined time interval. An editing anomaly acquisition unit obtains an editing anomaly, which is the anomaly at the time of editing, using the time-series numerical data used when calculating the anomaly, and edited log data obtained by editing a portion of the log data included in the time-series log data. A contribution calculation unit that uses the aforementioned abnormality score and the aforementioned editing abnormality score to calculate a contribution score indicating the degree to which the event corresponding to the edited log data contributed to the abnormality, has Calculation device.

2. The system includes an extraction unit that extracts log data from the time-series log data that are candidates for editing, The editing abnormality acquisition unit performs the editing abnormality acquisition process for each of the log data that are candidates for editing, extracted by the extraction unit, using the edited log data obtained by editing one of the log data that are candidates for editing. The calculation apparatus according to claim 1.

3. The editing anomaly acquisition unit acquires the editing anomaly using the edited log data from which a portion of the log data included in the time-series log data has been deleted. The calculation apparatus according to claim 1.

4. The editing anomaly acquisition unit calculates the editing anomaly using the edited log data obtained by replacing a portion of the log data included in the time-series log data with other log data included in the time-series log data. The calculation apparatus according to claim 1.

5. The unit has a control unit that performs predetermined control on an object identified according to the contribution calculated by the contribution calculation unit. The calculation apparatus according to claim 1.

6. The extraction unit extracts log data that are candidates for editing according to the result of calculating the gradient of the degree of abnormality. The calculation apparatus according to claim 2.

7. The extraction unit extracts candidate log data for editing based on the gradient norm of the anomaly level for the embedded vector obtained by converting the log data. The calculation apparatus according to claim 2.

8. The contribution calculation unit calculates a contribution that indicates the degree to which the edited log data contributed abnormally using the abnormality score and the editing abnormality score, and calculates the contribution of the time-series numerical data using the data generated to reduce the abnormality score based on the gradient of the abnormality score and the time-series numerical data at the time the abnormality score was calculated. The calculation apparatus according to claim 1.

9. Information processing device, The anomaly score is calculated using time-series log data consisting of log data over a predetermined time interval and time-series numerical data representing measured values ​​over a predetermined time interval. Using the time-series numerical data used to calculate the anomaly score and the edited log data obtained by editing a portion of the log data included in the time-series log data, the edited anomaly score, which is the anomaly score at the time of editing, is obtained. Using the aforementioned anomaly score and the aforementioned editing anomaly score, a contribution score is calculated that indicates the degree to which the event corresponding to the edited log data contributed to the anomaly. Calculation method.

10. In an information processing device, The anomaly score is calculated using time-series log data consisting of log data over a predetermined time interval and time-series numerical data representing measured values ​​over a predetermined time interval. Using the time-series numerical data used to calculate the anomaly score and the edited log data obtained by editing a portion of the log data included in the time-series log data, the edited anomaly score, which is the anomaly score at the time of editing, is obtained. Using the aforementioned anomaly score and the aforementioned editing anomaly score, a contribution score is calculated that indicates the degree to which the event corresponding to the edited log data contributed to the anomaly. A program to perform the processing.

Images