Alarm analysis device, alarm analysis method, Bayesian network model, and alarm analysis program

Abstract

An alarm analysis device 1, provided with: a Bayesian network model; an estimation unit 12 for estimating a first relevance of a plurality of alarms by using the Bayesian network model; and, an assessment unit 13 for using the first relevance to perform grouping of alarm groups that have occurred in the same event. The Bayesian network model has: a plurality of type nodes that indicate alarm type; and, a time node and a location node that are linked to each type node. The time node is set with a second relevance that corresponds to the difference from the time of occurrence of an alarm in a child node or a parent node of a linked type node. The location node is set with a third relevance that corresponds to the difference from the location of occurrence of an alarm in a child node or a parent node of a linked type node.

Description

[Technical field]

[0001] The present invention relates to an alarm analysis device, an alarm analysis method, a Bayesian network model, and an alarm analysis program. [Background technology]

[0002] Network monitoring operations involve processes that involve constant monitoring to detect changes in the status of devices and alarms, identifying events such as failures and construction, analyzing and judging to isolate the causes of failures, and implementing (dealing with) failure recovery.

[0003] This process is realized by dispatching a local technician to the site when physical work such as repairing or replacing a faulty device is required by the maintenance technician (remote technician) who manages the entire network. The maintenance technician remotely manages the devices located throughout the country from a centralized location.

[0004] In order to deal with events that occur on a network, it is important for maintenance personnel to understand what events (construction or failure) caused the detected alarms.

[0005] Non-Patent Document 1 describes a technique for correlating multiple alarms generated by one event by combining network connection configuration information and predefined rules. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] "Proposal of an alarm correlation and main cause analysis method using network configuration information", Institute of Electronics, Information and Communication Engineers, Information and Communication Management Research Group (ICM), March 2, 2020 Summary of the Invention [Problem to be solved by the invention]

[0007] Since a single event can cause an alarm to be generated from multiple devices, and multiple events can occur simultaneously on a national network, a large number of alarms are generated. Maintenance personnel correlate these alarms by event.

[0008] Telecommunications carrier networks are multi-layered, consisting of multiple layers, such as the transmission layer made up of transmission devices and the IP layer made up of NGN mass devices, and therefore there are a large number of diverse devices and a large number of different types of alarms. Correlating alarms that occur in such networks requires advanced knowledge and experience from maintenance personnel, and places a large burden on them. For this reason, there is a demand to reduce the burden on maintenance personnel who determine the correlation of alarms and to make it less skilled.

[0009] In Non-Patent Document 1, the maintainer needs to define the rules in advance, and this rule definition requires the maintainer to have advanced knowledge and experience, and therefore cannot be fully automated.

[0010] The present invention has been made in consideration of the above circumstances, and an object of the present invention is to provide an alarm analysis device, an alarm analysis method, a Bayesian network model, and an alarm analysis program for easily correlating alarms. [Means for solving the problem]

[0011] In order to achieve the above-mentioned object, one embodiment of the present invention is an alarm analysis device comprising a Bayesian network model, an estimation unit that estimates a first relevance degree of multiple alarms using the Bayesian network model, and a determination unit that uses the first relevance degree to group a group of alarms that have occurred due to the same event, wherein the Bayesian network model has a plurality of type nodes indicating alarm types, and a time node and a location node linked to the type node, wherein a second relevance degree is set to the time node according to the difference between the time of occurrence of an alarm of a child node or parent node of the linked type node, and a third relevance degree is set to the location node according to the difference between the location of occurrence of an alarm of a child node or parent node of the linked type node.

[0012] One aspect of the present invention is an alarm analysis method performed by an alarm analysis device, which includes the steps of estimating a first relevance of multiple alarms using a Bayesian network model and grouping alarms that have occurred due to the same event using the first relevance, wherein the Bayesian network model has a plurality of type nodes indicating alarm types, and a time node and a location node linked to the type node, and a second relevance is set to the time node according to the difference between the time of occurrence of an alarm of a child node or parent node of the linked type node, and a third relevance is set to the location node according to the difference between the location of occurrence of an alarm of a child node or parent node of the linked type node.

[0013] One aspect of the present invention is an alarm analysis program that causes a computer to function as the above-mentioned alarm analysis device. Effect of the Invention

[0014] According to the present invention, it is possible to provide an alarm analysis device, an alarm analysis method, a Bayesian network model, and an alarm analysis program for easily correlating alarms. [Brief description of the drawings]

[0015] [Figure 1] 1 is a configuration diagram showing a configuration of an alarm analysis device according to an embodiment of the present invention. [Diagram 2] FIG. 1 is a diagram illustrating an example of a Bayesian NW model. [Diagram 3] FIG. 11 is a diagram illustrating an example of alarm information. [Figure 4] FIG. 11 is a diagram illustrating an example of a determination result. [Diagram 5] 4 is a flowchart showing an operation of the alarm analysis device. [Figure 6] 2 is an example of a hardware configuration. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0017] 1 is a configuration diagram showing the configuration of an alarm analysis device 1 of this embodiment. A group of alarms occurring due to the same event occurs almost simultaneously from multiple devices having physical or logical connections. Therefore, if the alarm occurrence time and the alarm occurrence location (occurrence area) are close, it can be estimated that there is a high possibility that the alarms have occurred due to the same event. In this embodiment, if the alarm occurrence time and occurrence location, and the type of alarm occurring due to one event, among multiple newly occurring alarms, are close to the Bayesian NW model, it is determined that the group of alarms has occurred due to the same event.

[0018] The illustrated alarm analysis device 1 includes an acquisition unit 11, an estimation unit 12, a determination unit 13, an alarm information DB 14, a model storage unit 15, and a configuration information DB 16.

[0019] The acquisition unit 11 acquires alarm information 101 (alarm list) issued from a plurality of devices, and stores it in the alarm information DB 15. The alarm information 101 includes a plurality of alarms. The alarms include an alarm type, an occurrence time, an occurrence location, an apparatus identifier, and the like.

[0020] For example, the acquisition unit 11 acquires alarm information from at least one OpS (Operation Support System). General telecommunications carrier devices (e.g., network devices) are monitored by the OpS. The OpS provides maintenance personnel with functions such as collecting alarm information from the devices and displaying the alarm on a screen. The acquisition unit 11 acquires alarm information saved by the OpS at a predetermined timing, stores the alarm information in the alarm information DB 15, and sends it to the estimation unit 12.

[0021] The estimation unit 12 estimates the relevance of a plurality of warnings included in the warning information by using a Bayesian NW model.

[0022] The determination unit 13 groups alarms that have occurred due to the same event using the degree of association. Specifically, the determination unit 13 determines whether a certain alarm (first alarm) and another alarm (second alarm) have occurred due to the same event based on the degree of association, and groups the alarms by event.

[0023] The model storage unit 15 stores a Bayesian network model (hereinafter, "Bayesian NW model") in advance.

[0024] 2 is a diagram showing an example of a Bayesian NW model of this embodiment. The Bayesian NW model is one of the probability models having a graph structure. In the Bayesian NW model, each event is represented by a node, and the nodes are connected by a one-way link (arrow) indicating a dependency relationship. A conditional probability table (CPT) is attached to each node.

[0025] The Bayesian NW model shown in the figure has multiple type nodes A, B, and C indicating alarm types (ALM types), and time nodes A1, B1, B3, and C1 and location nodes A2, B2, B4, and C2 linked to the type nodes. The type nodes are main nodes, and the time nodes and location nodes are subnodes. Note that the Bayesian NW model in FIG. 2 is an example and is not limited to the model in FIG. 2. For example, the Bayesian NW model may have two type nodes or four or more type nodes.

[0026] For each time node, a relevance (second relevance) is set according to the difference between the time when the alarm occurred for the child node or parent node of the linked type node. For each location node, a relevance (third relevance) is set according to the difference between the location when the alarm occurred for the child node or parent node of the linked type node.

[0027] Specifically, type node A is an event indicating the occurrence of an alarm of alarm type A, type node B is an event indicating the occurrence of an alarm of alarm type B, and type node C is an event indicating the occurrence of an alarm of alarm type C. The dependency relationship between type nodes A, B, and C can be expressed as type node A → type node B → type node C.

[0028] The node at the end of the link is the child node, and the node at the start of the link is the parent node. In the case of type node A → type node B, type node A is the parent node and type node B is the child node. A conditional probability is set for each type node A, B, and C. The conditional probability is set to the probability of occurrence according to the difference between the time of occurrence of the alarm and the difference between the occurrence location and the child node or parent node of the type node.

[0029] 2 shows a conditional probability 201 for type node A, which is the starting point. Although not shown here, the conditional probability for type node B is set to an occurrence probability based on the difference between the time and location of the alarm occurrence of the parent node and the difference between the time and location of the alarm occurrence of the child node. The conditional probability for type node C is set to an occurrence probability based on the difference between the time and location of the alarm occurrence of the parent node.

[0030] In the illustrated conditional probability 201, the probability of occurrence is set according to the difference in occurrence time and the difference in occurrence location of the alarm of the child node (type node B) of type node A. For example, when there is no difference in the occurrence location (i.e., when the alarm occurs in the same device) and the difference in occurrence time is less than ±5 seconds, the probability of an alarm of alarm type A occurring is defined as "0.9" and the probability of it not occurring is defined as "0.1." In addition, when there is no difference in the occurrence location and the difference in occurrence time is ±5 seconds or more, the probability of an alarm of alarm type A occurring is defined as "0.8" and the probability of it not occurring is defined as "0.2."

[0031] Additionally, when the difference in occurrence location is within the same building and the difference in occurrence time is less than ±5 seconds, the probability of an alarm of alarm type A occurring is defined as "0.8" and the probability of it not occurring is defined as "0.2." Additionally, when the difference in occurrence location is within the same building and the difference in occurrence time is ±5 seconds or more, the probability of an alarm of alarm type A occurring is defined as "0.7" and the probability of it not occurring is defined as "0.3."

[0032] In the conditional probability 201 shown in the figure, two probabilities are set by dividing the difference in occurrence time into less than 5 seconds and 5 seconds or more, but it is also possible to divide it into three or more and set the probability to be higher as the difference in occurrence time is smaller.

[0033] In addition, in the conditional probability 201 shown in the figure, the difference in the occurrence location is divided into same device with no difference, in the same building, in the same prefecture, and others (different prefectures), and is set so that the smaller the difference in the occurrence location, the higher the probability, but the difference in the occurrence location may be classified in other ways.

[0034] In the Bayesian network model of this embodiment, time nodes and place nodes linked to type nodes A, B, and C are defined. For example, type node B has time nodes B1 and B3 and place nodes B2 and B4 defined. Time node B1 is a node related to the difference in occurrence time with a parent node (type node A in this case), and time node B3 is a node related to the difference in occurrence time with a child node (type node C in this case). Place node B2 is a node related to the difference in occurrence place with a parent node, and place node B4 is a node related to the difference in occurrence place with a child node. A conditional probability is assigned to each of these nodes B1 to B4.

[0035] For example, the conditional probability 202 of time node B1 has a relevance of “0.9” when the difference in occurrence time with respect to the parent node (type node A) alarm is less than ±5 seconds, and a relevance of “0.1” when the difference in occurrence time is ±5 seconds or more.

[0036] For the conditional probability 203 of location node B2, the relevance is set to "0.5" if the alarm occurred in the same device as the parent node (type node A), "0.3" if the alarm occurred in a device in the same building as the device of the parent node, "0.15" if the alarm occurred in a device in the same prefecture as the device of the parent node, and "0.05" otherwise (if the alarm occurred in a device in a different prefecture than the device of the parent node).

[0037] In this way, a higher degree of association (second degree of association) is set for a time node as the difference in occurrence times is smaller, and a higher degree of association (third degree of association) is set for a place node as the difference in occurrence places is smaller.

[0038] Other time nodes A1, B3, C1 and other location nodes A2, B4, C2 are omitted in FIG. 2 but have similar conditional probabilities defined.

[0039] In this embodiment, for alarms occurring at similar times and locations, a Bayesian NW model that calculates a high relevance (first relevance) is used to group alarms occurring due to the same event.

[0040] The process of grouping alarms by the estimation unit 12 and the determination unit 13 using a Bayesian NW model will be specifically described below.

[0041] 3 shows an example of alarm information (alarm list) input to the alarm analysis device 1. The alarm information includes a plurality of alarms. Each alarm shown in the figure has an alarm identifier, an occurrence time (occurrence date and time), an alert type (ALM type), a prefecture, a building, and an equipment identifier. This alarm information shows that each alarm has occurred in order starting with the alarm with alarm identifier 1.

[0042] The alarm type includes, for example, a type indicating a device failure (e.g., Eqp failure alarm), a type indicating an abnormality related to the device interface (e.g., Link down alarm), etc. The prefecture, building, and device identifier are information indicating the location where the alarm occurred.

[0043] Fig. 4 shows an example of a determination result for each alarm in the alarm information shown in Fig. 3. In the determination result, a group number is set for each alarm (alarm identification information).

[0044] The estimation unit 12 sequentially reads out each warning in the warning information and estimates the degree of association between the warning and the warning that was read before that warning, and the determination unit 13 groups warnings that have occurred due to the same event using the degree of association.

[0045] (1) Alarm with alarm identifier 1 [ALM type B] The estimation unit 12 reads out an alarm with an [ALM type B] and an alarm identifier 1 from the alarm information 101 shown in Fig. 3. Since there is no alarm that occurred before the alarm identifier 1, the estimation unit 12 does not estimate the relevance of the alarm identifier 1, and the determination unit 13 sets a predetermined group number for the alarm. In the determination result shown in Fig. 4, the determination unit 13 sets the group number to "1".

[0046] (2) Alarm with alarm identifier 2 [ALM type A] Next, the estimation unit 12 reads out the alarm of [ALM type A] of the alarm identifier 2, and estimates the degree of association with an alarm (alarm identifier 1 [ALM type B]) on the child node side that occurred before the read alarm. That is, the estimation unit 12 estimates the degree of association between the alarm identifiers 2-1 by using a Bayesian NW model.

[0047] As shown in Fig. 3, the difference in occurrence time between the warnings with warning identifiers 1 and 2 is 5 seconds, and the difference in occurrence location is other (different prefectures). Therefore, the estimation unit 12 estimates the degree of association to be "0.3", which is the probability that the difference in occurrence location in the conditional probability 201 in Fig. 2 is other and the difference in occurrence time is 5 seconds or more.

[0048] P(ALM type A = occurrence | time difference = ±5s or more, location difference = other) = 0.3 Because the relevance level "0.3" is less than a predetermined threshold value (e.g., 0.5), the determination unit 13 determines that the warnings with warning identifier 2 and warning identifier 1 belong to different groups. The determination unit 13 sets group number "2", which is different from group number "1" of warning identifier 1, to the warning with warning identifier 2.

[0049] If some information about the alarm is missing, the estimation unit 12 uses the conditional probability of the time node A1 and the location node A2. For example, if the occurrence time of [ALM type A] of alarm identifier 2 cannot be obtained and is missing, the evidence (condition) of "difference in occurrence time" does not exist. In this case, the following formula is obtained, and the estimation unit 12 uses the conditional probability of the location node A2 to calculate probabilistic inference using only the evidence of "difference in occurrence location".

[0050] P(ALM type A = occurrence | location difference = other) = 0.48 In the Bayesian NW model, even if all the evidence is not known, it is possible to calculate the probability of occurrence of a state of interest using probabilistic inference based on the available evidence.

[0051] (3) Alarm with alarm identifier 3 [ALM type B] Next, the estimation unit 12 reads out the alarm with alarm identifier 3 [ALM type B], and among the alarms that occurred before this alarm, the alarm with alarm identifier 1 has the same ALM type, so the estimation unit 12 does not estimate the degree of association, but estimates the degree of association with the alarm on the parent node side (alarm identifier 2 [ALM type A]). That is, the estimation unit 12 estimates the degree of association between alarm identifiers 3 and 2 using a Bayesian NW model.

[0052] 3, the difference in occurrence time between the warnings with warning identifiers 3 and 2 is 1 second, and the difference in occurrence location is the same prefecture. The estimation unit 12 calculates the degree of association between warning identifiers 3 and 2 using the conditional probability 202 of time node B1 in FIG. 2, location nodes B2 and 203, and the conditional probability of type node B (not shown).

[0053] For example, the estimation unit 12 calculates the degree of association between the alarm identifiers 3-2 by determining, by probabilistic inference, the probability that ALM type B occurs from the conditional probability 202 of "0.9," the conditional probability 203 of "0.15," and the corresponding probability of the conditional probability of type node B (not shown). The calculated degree of association is assumed to be "0.8" here.

[0054] P(ALM type B = occurrence | time difference = less than ±5s, location difference = same prefecture) = 0.8 Because the degree of association "0.8" is equal to or greater than a predetermined threshold (e.g., 0.5), the determination unit 13 determines that the alarms with alarm identifier 3 and alarm identifier 2 belong to the same group. In other words, the determination unit 13 associates the alarms with alarm identifier 3 and alarm identifier 2 as a group of alarms that occurred due to the same event. Therefore, the determination unit 13 sets the group number "2", which is the same as the group number "2" of alarm identifier 2, to the alarm with alarm identifier 3.

[0055] (4) Alarm with alarm identifier 4 [ALM type A] Next, the estimation unit 12 reads out the alarm with alarm identifier 4 [ALM type A], and estimates the degree of association with the alarms on the child node side (alarm identifier 1 [ALM type B], alarm identifier 3 [ALM type B]) that occurred before the alarm.

[0056] First, the estimation unit 12 estimates the relevance between the alarm identifiers 4-1 using a Bayesian NW model. As shown in Fig. 3, the difference in occurrence time between the alarms with alarm identifiers 4 and 1 is 5 seconds or more, and the difference in occurrence location is the same building. Therefore, the estimation unit 12 estimates the probability "0.7" of the occurrence location difference of the conditional probability 201 of the type node A in Fig. 2 occurring in the same building and the difference with the child node A being 5 seconds or more, as the relevance.

[0057] P(ALM type A = occurrence | time difference = ±5s or more, location difference = same building) = 0.7 Then, the estimation unit 12 estimates the degree of association between the alarm identifiers 4 and 3 by using a Bayesian NW model. As shown in Fig. 3, the difference in occurrence time between the alarms with alarm identifiers 4 and 3 is less than 5, and the difference in occurrence location is other than that. Therefore, the estimation unit 12 estimates the degree of association as "0.5", which is the probability that the difference in occurrence location of the conditional probability 201 of type node A in Fig. 2 is other than that and the difference with child node A occurs within 5 seconds.

[0058] P(ALM type A = occurrence | time difference = less than ±5s, location difference = other) = 0.5 Although both have a relevance level of 0.5 or higher, the judgment unit 13 judges that the warnings with warning identifiers 1 and 4, which have the higher relevance level, are in the same group, and sets the warning with warning identifier 4 to the same group number "1" as the group number "1" of warning identifier 1.

[0059] The estimation unit 12 and the determination unit 13 similarly set group numbers for the alarms with alarm identifier 5 and onward, and group the alarms.

[0060] For example, when calculating the degree of association between ALM type C and ALM type B, if the read alarm is ALM type C, the estimation unit 12 uses the conditional probabilities of type node C, time node C1, and location node C2. If the difference in occurrence time and the difference in occurrence location are known, the estimation unit 12 calculates the degree of association using only the conditional probability of type node C. On the other hand, if the read alarm is ALM type B, the conditional probabilities of type node B, time node B3, and location node B4 are used. As for the degree of association between ALM type C and ALM type A, since type node C and type node A are separated by two or more nodes, the estimation unit 12 does not calculate the degree of association.

[0061] In this way, the alarm analysis device 1 of this embodiment uses a Bayesian NW model that increases the calculated relevance for alarms that occur at similar times and locations, and can determine that among multiple newly occurring alarms, if the alarm occurrence time, location, and type are close to the Bayesian NW model, they are a group of alarms that occurred due to the same event.

[0062] In this embodiment, the estimation unit 12 acquires the location of each alarm from the alarm information shown in Fig. 3, but the location may be acquired from the configuration information DB 16. The configuration information DB 16 is a database that stores information about the network configuration of each device. The information about the network configuration includes the device ID, physical location (building name, prefecture, etc.), logical location (AS number, IP address, IP address subnetwork, etc.), port (IF), and port connection destination information of each device. In this case, the estimation unit 12 may acquire the location of each alarm from the configuration information DB 16 using the device identifier included in the alarm as a key.

[0063] In addition, in this embodiment, the difference in physical location (distance) is used as the difference in the location where an alarm occurred, but the difference in the location where an alarm occurred may be the difference in logical location such as an AS number or IP address subnetwork. In this case, the estimation unit 12 may acquire the logical location of occurrence contained in each alarm, or may acquire the logical location of occurrence of each alarm from the configuration information DB 16 using a device identifier or the like included in the alarm as a key.

[0064] 5 is a flowchart showing the operation of the alarm analysis device 1. The acquisition unit 11 acquires alarm information issued by each device, for example, from an OpS at a predetermined timing (time interval) (S11). The estimation unit 12 reads out a first alarm included in the alarm information, and estimates the degree of association (first degree of association) with a second alarm read out before the first alarm, using a Bayesian NW model (S12).

[0065] The determination unit 13 determines whether the first and second alarms are alarms that occurred due to the same event and belong to the same group by comparing the relevance with a predetermined threshold (S13). If it is determined that the first and second alarms belong to the same group (S13: YES), the determination unit 13 sets the same group number as the second alarm to the first alarm and groups them (S14). On the other hand, if it is determined that the first and second alarms belong to different groups (S13: NO), the determination unit 13 sets a group number different from that of the second alarm to the first alarm (S15).

[0066] If the warning information includes a next unprocessed warning (S16: YES), the estimation unit 12 returns to S12 and performs subsequent processing. If the warning information does not include a next warning (S16: NO), the estimation unit 12 outputs the determination result as shown in FIG. 4 (S17) and terminates processing.

[0067] The alarm analysis device 1 of the present embodiment described above comprises a Bayesian network model, an estimation unit 12 that estimates a first relevance degree of multiple alarms using the Bayesian network model, and a determination unit 13 that uses the first relevance degree to group alarms that have occurred due to the same event, and the Bayesian network model has a plurality of type nodes indicating alarm types, and time nodes and location nodes linked to the type nodes, and a second relevance degree is set to the time node according to the difference between the time of occurrence of an alarm of a child node or parent node of the linked type node, and a third relevance degree is set to the location node according to the difference between the location of occurrence of an alarm of a child node or parent node of the linked type node.

[0068] As a result, in this embodiment, correlation of alarms can be easily performed. Specifically, correlation of alarms, which is a heavy burden on maintenance personnel, is automated, and alarms can be efficiently grouped simply by inputting newly occurring alarm information.

[0069] The above-described alarm analysis device 1 can use, for example, a general-purpose computer system as shown in Fig. 6. The computer system shown in the figure includes a CPU (Central Processing Unit, processor) 901, a memory 902, a storage 903 (HDD: Hard Disk Drive, SSD: Solid State Drive), a communication device 904, an input device 905, and an output device 906. The memory 902 and the storage 903 are storage devices. In this computer system, the CPU 901 executes a predetermined program loaded on the memory 902, thereby realizing each function of the alarm analysis device 1.

[0070] The alarm analysis device 1 may be implemented in one computer or in multiple computers, and may be a virtual machine implemented in a computer.

[0071] The program for the alarm analysis device 1 can be stored in a computer-readable recording medium such as an HDD, SSD, USB (Universal Serial Bus) memory, CD (Compact Disc), or DVD (Digital Versatile Disc), or can be distributed via a network.

[0072] The present invention is not limited to the above-described embodiment and modifications, and various modifications are possible within the scope of the present invention. [Explanation of symbols]

[0073] 1: Alarm analysis device 11: Acquisition part 12: Estimation part 13: Judgment section 14: Alarm information DB 15: Model memory section 16: Configuration information DB

Claims

1. Bayesian network model, an estimation unit that estimates a first relevance degree of a plurality of alarms by using the Bayesian network model; a determination unit that uses the first relevance degree to group a group of alarms that have occurred due to the same event, The Bayesian network model has a plurality of type nodes indicating alarm types, and a time node and a location node linked to each type node, A second relevance degree is set for the time node according to a difference between the time when an alarm occurred in a child node or parent node of the linked type node, and a third relevance degree is set for the place node according to a difference between the place when an alarm occurred in a child node or parent node of the linked type node. Warning analysis device.

2. The type node is set with an occurrence probability according to the difference between the occurrence time of the alarm of the child node or parent node of the type node and the occurrence location. The alarm analysis device according to claim 1 .

3. The smaller the difference in occurrence time is, the higher the second relevance is set for the time node, and the smaller the difference in occurrence place is, the higher the third relevance is set for the place node.

3. The alarm analysis device according to claim 1 or 2.

4. The difference in the occurrence location is a difference in the physical location of the device that output the alarm, or a difference in the logical location of the device. The alarm analysis device according to any one of claims 1 to 3.

5. An alarm analysis method performed by an alarm analysis device, comprising: estimating a first relevance of the plurality of alarms using a Bayesian network model; using the first relevance to group a group of alarms generated by the same event; The Bayesian network model has a plurality of type nodes indicating alarm types, and a time node and a location node linked to each type node, A second relevance degree is set for the time node according to a difference between the time when an alarm occurred in a child node or parent node of the linked type node, and a third relevance degree is set for the place node according to a difference between the place when an alarm occurred in a child node or parent node of the linked type node. Alarm analysis method.

6. A plurality of type nodes indicating alarm types; a time node and a place node linked to each type node; The time node is set with a degree of association according to the difference between the time of occurrence of an alarm of a child node or a parent node of the linked type node, and the place node is set with a degree of association according to the difference between the place of occurrence of an alarm of a child node or a parent node of the linked type node. Bayesian network model.

7. An alarm analysis program that causes a computer to function as the alarm analysis device according to any one of claims 1 to 4.

Images