Information optimization device, method, and program

Abstract

When optimizing information to be corrected representing the operation status of a system, one embodiment of the present invention: generates at least one event group by grouping a plurality of events related to the information to be corrected, each group being formed from events having a prescribed temporal correlation; calculates a first time difference between first date and time information included in the information to be corrected and second date and time information associated with the event group; specifies, as a corrected date and time candidate, the second date and time information of the event group for which the calculated first time difference satisfies a pre-determined condition; and corrects the first date and time information on the basis of the specified second date and time information.

Description

[Technical field]

[0001] One aspect of the present invention relates to an information optimization device, method, and program used to optimize information used as learning data when generating fault identification rules, for example. [Background technology]

[0002] For example, in order to efficiently identify the causes of faults occurring in a network, a technique has been proposed that uses machine learning to automatically generate fault identification rules (see, for example, Patent Document 1). This technique acquires past fault history information from, for example, an existing database, and generates the fault identification rules by providing the acquired fault history information to a learning device as learning data. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent No. 6637854 Summary of the Invention [Problem to be solved by the invention]

[0004] However, some of the past fault history information is registered by an operator through manual input, and if the fault history information is directly provided to the learning device as learning data, there is a possibility that appropriate learning will not be performed. In particular, the date and time of the fault occurrence is often recorded as the date and time recognized by the maintenance person or an approximate date and time after the fault is dealt with, which is inaccurate and has a large impact on learning. For this reason, the contents of the fault history information are usually manually analyzed and the information contents, especially the date and time of the fault occurrence, are corrected before the fault history information is provided to the learning device as learning data. Therefore, it takes a lot of time and effort to obtain appropriate fault history information as learning data, and it is difficult to determine whether the fault history information is appropriate, and corrections may be overlooked, which may lead to a decrease in the reliability of the information.

[0005] This invention has been made in light of the above-mentioned circumstances, and aims to provide a technology that enables the optimization process of information to be corrected efficiently without relying on human labor, thereby enabling improved work efficiency and improved information reliability. [Means for solving the problem]

[0006] In order to solve the above problem, one aspect of the information optimization device or method according to the present invention is to, when optimizing correction target information that represents an operating state of a system, group a plurality of events that are related to the correction target information with events that have a predetermined time correlation with each other to generate at least one event group, and Indicates the date and time of occurrence of the event to be corrected First date and time information and the event group Indicates the representative time of occurrence of multiple included events A first time difference with second date and time information is calculated, the second date and time information of the event group for which the calculated first time difference satisfies a preset condition is identified as a correction date and time candidate, and the first date and time information is corrected based on the identified second date and time information.

[0007] According to one aspect of the present invention, even if the date and time information written in the correction target information is manually entered and thus inaccurate, the date and time information written in the correction target information is automatically corrected. Therefore, it is possible to correct the date and time information written in the correction target information to an appropriate value without the need for manual analysis or correction work. Effect of the Invention

[0008] In other words, according to one aspect of the present invention, it is possible to efficiently perform optimization processing of correction target information without relying on human labor, thereby providing a technology that enables improved work efficiency and improved information reliability. [Brief description of the drawings]

[0009] [Figure 1]FIG. 1 is a diagram showing the overall configuration of a learning system including an information optimization device according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a block diagram showing an example of a hardware configuration of an information optimization device according to an embodiment of the present invention. [Diagram 3] FIG. 3 is a block diagram showing an example of a software configuration of the information optimization device according to an embodiment of the present invention. [Figure 4] FIG. 4 is a flowchart showing an example of a processing procedure and processing content of the information optimization process executed by the information optimization device shown in FIG. [Diagram 5] FIG. 5 is a flowchart showing the procedure and contents of the information appropriateness determination process from the procedure shown in FIG. [Figure 6] FIG. 6 is a flowchart showing the procedure and contents of the event grouping process, the process of identifying a time to be a correction candidate, the process of correcting the failure occurrence date and time, and the learning data generation process, among the procedures shown in FIG. [Figure 7] FIG. 7 is a diagram showing an example of the failure response history information stored in the failure response history information DB. [Figure 8] FIG. 8 is a diagram showing an example of information acquisition source designation information that is set as one piece of predefined information. [Figure 9] FIG. 9 is a diagram showing an example of a list of date and time rule information that is set as one piece of predefined information. [Figure 10] FIG. 10 is a diagram showing an example of date and time information converted in accordance with the list of date and time rule information shown in FIG. [Figure 11] FIG. 11 is a diagram illustrating an example of network configuration information stored in the related information DB. [Figure 12] FIG. 12 is a diagram showing an example of events that occurred in a time period before and after the failure occurrence date and time that is the object of correction, and reference events extracted from these events. [Figure 13] FIG. 13 is a diagram showing an example of a state in which reference events are grouped together according to the same phenomenon. [Figure 14] FIG. 14 is a diagram showing an example of another failure occurrence date and time included within the maximum error range of a time period before and after the failure occurrence date and time to be corrected. [Figure 15] FIG. 15 is a diagram showing a first example of the time difference between the representative time of the reference events grouped in FIG. 13 and the fault occurrence date and time to be corrected, and the time difference between the representative time of the above-mentioned grouped reference events and other fault occurrence dates and times shown in FIG. 14. [Figure 16] FIG. 16 is a diagram showing a second example of the time difference between the representative time of the reference events grouped in FIG. 13 and the fault occurrence date and time to be corrected, and the time difference between the representative time of the above-mentioned grouped reference events and other fault occurrence dates and times shown in FIG. 14. [Figure 17] FIG. 17 is a diagram showing a third example of the time difference between the representative time of the reference events grouped in FIG. 13 and the fault occurrence date and time to be corrected, and the time difference between the representative time of the above-mentioned grouped reference events and other fault occurrence dates and times shown in FIG. 14. [Figure 18] FIG. 18 is a diagram for explaining the definition of the correction time ratio α. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0011] [One embodiment] (Configuration example) (1) System FIG. 1 is a diagram showing the overall configuration of a fault determination learning system including an information optimization device according to an embodiment of the present invention. This system includes a learning device 2, an information optimization device 1 arranged in front of the learning device 2, a fault response history database (hereinafter, database will be abbreviated as DB) 3, a related information DB 4, and an input device 5.

[0012] The learning device 2 generates and manages a learning model used to determine various types of faults that occur in a network, for example, and includes a learning model storage unit and a learning function. The learning function generates a learning model for fault determination by, for example, CNN (Convolutional Neural Network) machine learning, and stores the generated learning model in the learning model storage unit.

[0013] The failure response history DB3 stores attribute information and response information for each network failure that has occurred in the past. The attribute information includes, for example, the date and time of occurrence, the time of recovery, the name of the device in which the failure occurred, and information indicating the nature of the failure. The response information includes information indicating the content of the response to the failure and the name of the person in charge. Figure 7 shows an example of failure response history information, in which the attribute information and the multiple information elements included in the response information are arranged in a preset order.

[0014] The related information DB4 manages, for example, information representing a network configuration (also called a network topology) and event information, and these pieces of information are shared by the learning device 2 and the information optimization device 1. The information representing the network configuration is used by the information optimization device 1 to determine the suitability of the failure response history information acquired as a candidate for learning data from the failure response history DB3. The event information is used as a reference when the information optimization device 1 corrects the failure occurrence date and time written in the failure occurrence history information that is a candidate for the learning data.

[0015] The input device 5 may be, for example, an input / output device attached to the information optimization device 1, or an independent personal computer, and is used when pre-setting various definition information for the information optimization device 1 to determine the suitability of fault response history information.

[0016] In addition, the information optimization device 1, the learning device 2, the fault response history DB 3, the related information DB 4 and the input device 5 are usually connected via a network such as a LAN (Local Area Network), but may also be connected by a signal cable.

[0017] (2) Information optimization device 1 The information optimization device 1 is used to optimize the learning data to be provided to the learning device 2, and has an acquisition function for acquiring past fault response history information from a fault response history DB3 as a candidate for the learning data, a function for determining the appropriateness of the acquired fault response history information, a function for correcting the fault occurrence date and time recorded in the fault response history information, and a function for generating learning data based on the fault response history information that is determined to be appropriate by the appropriateness determination function and in which the fault occurrence date and time has been corrected by the correction function.

[0018] 2 and 3 are block diagrams showing the hardware and software configurations, respectively, of the information optimization device 1. As shown in FIG.

[0019] The information optimization device 1 is, for example, a personal computer, and includes a control unit 10 using a hardware processor such as a central processing unit (CPU). A storage unit having a program storage unit 20 and a data storage unit 30, and a communication I / F unit 40 are connected to the control unit 10 via a bus 50.

[0020] The communication I / F unit 40, under the control of the control unit 10, uses a communication protocol defined, for example, in a LAN to send and receive data between the learning device 2, the fault response history DB3, and the related information DB4, and has the function of receiving input information from the input device 5.

[0021] The program storage unit 20 is configured, for example, by combining a non-volatile memory such as an HDD (Hard Disk Drive) or SSD (Solid State Drive) as a storage medium that can be written to and read at any time, and a non-volatile memory such as a ROM (Read Only Memory), and stores application programs necessary for executing various control processes according to one embodiment of the present invention, in addition to middleware such as an OS (Operating System).

[0022] The data storage unit 30 is, for example, a combination of a non-volatile memory such as an HDD or SSD, which can be written to and read from at any time, as a storage medium, and a volatile memory such as a RAM (Random Access Memory), and has a management information storage unit 31, a fault response history storage unit 32, a correction date and time candidate storage unit 33, and a learning data storage unit 34 as main storage units in one embodiment of the present invention.

[0023] The management information storage unit 31 is used to store various definition information input from the input device 5. The definition information includes, for example, information specifying an information element to be referenced from among the information elements included in the failure response history information, and date and time rule information representing an expression format of the failure occurrence date and time that can be used in the information optimization process. Fig. 8 shows an example of the information specifying the information elements. Fig. 9 shows an example of the date and time rule information representing the expression format of the failure occurrence date and time.

[0024] The failure response history storage unit 32 is used to temporarily store failure response history information acquired from the failure response history DB3.

[0025] The correction date and time candidate storage unit 33 is used to store correction date and time candidates identified by the control unit 10.

[0026] The learning data storage unit 34 is used to store the learning data generated by the control unit 10 until it is output to the learning device 2.

[0027] The control unit 10 includes, as processing functions according to an embodiment of the present invention, a definition information management processing unit 11, a failure response history information acquisition processing unit 12, an appropriateness determination processing unit 13, a failure occurrence date and time correction processing unit 14, a learning data generation processing unit 15, and a learning data output processing unit 16. All of these processing units 11 to 16 are realized by causing a hardware processor of the control unit 10 to execute a program stored in the program storage unit 20.

[0028] The definition information management processing unit 11 performs a process of acquiring in advance each of the above definition information necessary for determining the suitability of the failure response history information from the input device 5 and storing it in the management information storage unit 31. The definition information management processing unit 11 also performs a process of acquiring in advance parameters such as the maximum error time X and the correction time ratio α necessary for the correction process of the failure occurrence date and time from the input device 5 and storing them in the management information storage unit 31.

[0029] The failure response history information acquisition processing unit 12 acquires failure response history information that is a candidate for learning data from the failure response history DB 3, and performs processing to temporarily store the acquired failure response history information in the failure response history storage unit 32.

[0030] The suitability determination processing unit 13 judges whether the failure response history information is suitable as learning data by referring to each definition information stored in the management information storage unit 31 and information representing the network configuration managed by the related information DB 4. The suitability determination processing unit 13 also judges whether the failure occurrence date and time is described in a processable expression format. Then, the suitability determination processing unit 13 performs processing to pass only the failure response history information judged to be suitable to the failure occurrence date and time correction processing unit 14.

[0031] The fault occurrence date and time correction processing unit 14 has the following processing functions. (1) A process of obtaining, from the related information DB4, events of a faulty device recorded in the fault response history information and devices up to one hop from the faulty device, and which occurred within a range of a maximum error time X from the fault occurrence date and time recorded in the fault response history information, as reference events when correcting the fault occurrence date and time. (2) Grouping the acquired reference events according to those caused by the same event. (3) A process of calculating a time difference between the failure occurrence date and time described in the failure response history information to be corrected and a representative date and time of the grouped reference events, and also calculating a time difference between the failure occurrence date and time of other failure response history information close in time to the failure occurrence date and time to be corrected and a representative date and time of the grouped reference events, and then comparing the calculated time differences and identifying a candidate correction date and time for the failure occurrence date and time to be corrected based on the comparison result. (4) A process of correcting the fault occurrence date and time to be corrected based on the representative date and time of the reference event identified as a candidate for the correction date and time, and storing the fault response history information with the corrected fault occurrence date and time in the fault response history memory unit 32.

[0032] The learning data generation processing unit 15 reads the above-mentioned fault response history information in which the date and time of fault occurrence has been corrected from the fault response history storage unit 32, generates learning data, and performs a process of temporarily storing the above-mentioned generated learning data in the learning data storage unit 34.

[0033] When the learning phase of the learning model is set in the learning device 2, the learning data output processing unit 16 reads out learning data from the learning data memory unit 34 and transmits the read out learning data from the communication I / F unit 40 to the learning device 2.

[0034] (Example of operation) Next, an example of the operation of the information optimization device 1 configured as above will be described. FIG. 4 is a flowchart showing the overall processing procedure and processing contents executed by the control unit 10 of the information optimization device 1.

[0035] (1) Setting definition information The control unit 10 of the information optimization device 1 monitors the input of a setting request for definition information in step S1. When a setting request for definition information is input from the input device 5 in this state, the control unit 10, under the control of the definition information management processing unit 11, acquires each piece of definition information input by the input device 5 via the communication I / F unit 40 in step S2 and stores it in the management information storage unit 31. The definition information to be set includes information specifying the arrangement position (column) of an information element to be extracted from the failure response history information as shown in FIG. 8, for example. The definition information also includes a date and time rule (illustrated in FIG. 9) that indicates a list of expression formats of the failure occurrence date and time that can be handled by the information optimization device 1, and an expression rule for the converted date and time (illustrated in FIG. 10).

[0036] The definition information management processing unit 11 also acquires parameters such as the maximum error time X and the correction time ratio α, which are necessary for the correction process of the failure occurrence date and time, from the input device 5 and stores them in the management information storage unit 31.

[0037] (2) Acquisition of troubleshooting history information When the setting of the definition information and parameters is completed, in step S3, the control unit 10 of the information optimization device 1 acquires the failure response history information from the failure response history DB 3 via the communication I / F unit 40 under the control of the failure response history information acquisition processing unit 12. Then, the acquired failure response history information is stored in the failure response history storage unit 32.

[0038] An example of the acquired failure response history information is shown in Fig. 7. The failure response history information may be acquired periodically or at any time, or may be acquired when the learning device 2 requests the provision of learning data.

[0039] (3) Judgment of appropriateness of troubleshooting history information When the above-mentioned fault response history information is acquired, the control unit 10 of the information optimization device 1, under the control of the appropriateness determination processing unit 13, executes a process in step S4 to determine whether or not the above-mentioned fault response history information is appropriate as information for generating learning data, as follows.

[0040] 5 is a flowchart showing an example of the procedure and contents of the suitability determination process. That is, the suitability determination processing unit 13 first sets i, which indicates a storage number (hereinafter also referred to as a record) of the failure response history information, to 1 in step S41, and reads out the i=1st failure response history information from the failure response history storage unit 32. Then, in step S42, the suitability determination processing unit 13 extracts the information element of the reference destination from the above failure response history information based on the information element designation information stored in the management information storage unit 31.

[0041] For example, if the reference destination is defined in the information element specification information as shown in Fig. 8, the suitability judgment processing unit 13 extracts "date and time of failure occurrence", "location of failure", "details of failure", "details of response", and "time of recovery" from the failure response history information in accordance with this specification information. Note that whether or not to extract "time of recovery" is specified arbitrarily.

[0042] Next, in step S43, the appropriateness determination processing unit 13 judges whether the extracted "failure occurrence date and time" conforms to an expression format. For example, if an expression format for the failure occurrence date and time is currently specified as the definition information as shown in Fig. 9, the appropriateness determination processing unit 13 judges whether the extracted failure occurrence date and time corresponds to any of the expression formats. If the result of this judgment is that the failure occurrence date and time corresponds to any of the expression formats, the expression format for the failure occurrence date and time is converted into a single unified expression format as shown in Fig. 10.

[0043] For example, assume that the expression format of the currently extracted failure occurrence date and time is (2020 / 1 / 1 14:00). In this case, since the expression format of the above failure occurrence date and time corresponds to the expression format in the second line of Fig. 9, the appropriateness determination processing unit 13 adopts this expression format as it is. Also, if the expression format of the extracted failure occurrence date and time is (2020 / 1 / 1 14:00), since it corresponds to the expression format in the third line of Fig. 9, this expression format is converted to the above (2020 / 1 / 1 14:00) shown in Fig. 10.

[0044] In contrast, it is assumed that the expression format of the extracted failure occurrence date and time does not correspond to any of the expression rules shown in Fig. 9. In this case, the suitability determination processing unit 13 determines that the failure response history information in which the failure occurrence date and time is described is inappropriate as learning data, and discards the failure response history information in step S46.

[0045] Next, in step S44, the suitability determination processing unit 13 acquires information representing the network configuration (network topology) from the related information DB 4. Then, it determines whether or not the "fault location" extracted in step S42 exists in the acquired information representing the network configuration. If the "fault location" exists in the information representing the network topology, the failure response history information in which the "fault location" is described is adopted, and if not, it is determined that the failure response history information in which the failure location is described is inappropriate as learning data, and the failure response history information is discarded in step S46.

[0046] For example, assume that the network topology is defined as shown in Fig. 11, and the extracted "fault location" is "Shinjuku Server 01" shown in Fig. 7. In this case, since "Shinjuku Server 01" exists in the network topology shown in Fig. 11, the appropriateness determination processing unit 13 adopts the fault response history information as a candidate for generating learning data.

[0047] On the other hand, if the extracted "fault location" is the "Sendai Server 02" shown in Figure 7, the appropriateness determination processing unit 13 determines that the fault response history information is inappropriate as a candidate for generating learning data since the "Sendai Server 02" does not exist in the network topology of Figure 11, and discards the fault response history information in step S46.

[0048] When the date and time rule determination and the network topology determination are completed, the suitability determination processing unit 13 increments the value of i (i=i+1) in step S45, and executes the above-mentioned determination processes for the next i=2nd failure response history information in steps S42 to S44. Thereafter, the suitability determination processing unit 13 repeats the above-mentioned suitability determination processes in the same manner until the value of i reaches the upper limit number of records in the failure response history information.

[0049] (4) Correction of the date and time of the failure (4-1) Acquiring events and grouping them The control unit 10 of the information optimization device 1 executes a process for correcting the failure occurrence date and time written in the failure response history information determined to be appropriate by the above-mentioned appropriateness determination process. This correction process of the failure occurrence date and time is executed in the following procedure in steps S5 to S7 under the control of the failure occurrence date and time correction processing unit 14.

[0050] FIG. 6 is a flowchart showing an example of the procedure and content of a series of correction processes executed by the failure occurrence date and time correction processor 14. That is, first, in step S51, the failure occurrence date and time correction processing unit 14 reads the i=1th failure response history information from the failure response history storage unit 32, and extracts the failure occurrence date and time to be corrected from the read failure response history information.

[0051] Next, in step S52, the failure occurrence date and time correction processing unit 14 acquires an event to be referred to when correcting the failure occurrence date and time of the correction target from the related information DB 4. At this time, the reference event to be acquired is an event that occurs in a device within a correlation range from the failure device described in the i-th failure response history information (for example, an event of the failure device described in the failure response history information and a device located within one hop from the failure device), and that occurs within the maximum error time X of the time period before and after the failure occurrence date and time described in the i-th failure response history information.

[0052] For example, the time and date of the failure recorded in the i-th failure response history information is Fi Assume that multiple events occur in the time period before and after the event Ea as shown in Fig. 12. In Fig. 12, the correlation range event is represented as Ea, and the other events are represented as Eb. The fault occurrence date and time correction processing unit 14 detects the fault occurrence date and time Time that corresponds to the event Ea in the correlation range among the multiple events and is the correction target. Fi The reference events that occurred within the range of the maximum error time X between the time periods before and after the i-th point are acquired. If the recovery time is recorded in the i-th fault response history information, the events that are acquired are those that occur in the time period before this recovery time.

[0053] Next, in step S53, the fault occurrence date and time correction processing unit 14 groups the acquired reference events into groups of events that were generated by the same event. This grouping is performed by setting the maximum occurrence interval of multiple events that are generated by the same event as ΔTa max When the occurrence time is the maximum occurrence interval ΔTa max This is done by selecting multiple events that fall within the range of a group.

[0054] For example, if a reference event is acquired as shown in FIG. 13, the fault occurrence date and time correction processing unit 14 calculates the occurrence time of the reference event as ΔTa max Then, the fault occurrence date and time correction processing unit 14 groups each of the reference events G j For each of (G1, G2, G3), set the representative time Time1=t1, Time2=t3, and Time3=t5. j For example, Group G j For each group, the occurrence time of the event with the earliest occurrence time within the group is selected.

[0055] (4-2) Acquisition of other failure occurrence dates and times Next, in step S54, the failure occurrence date and time correction processing unit 14 acquires other failure response history information having a failure occurrence date and time and a failure occurrence device close to the i-th failure response history information. For example, as shown in FIG. 14, the other failure response history information is Fi Starting from the starting point, the search range is the maximum error time X in the time period before that and the range twice the maximum error time X in the time period after that, and the failure response history information F in which the failure occurrence date and time are set in these search ranges is ok is acquired by searching the failure response history storage unit 32. The failure response history information to be acquired is limited to devices within a correlation range from the faulty device described in the i-th failure response history information to be acquired (for example, the faulty device described in the failure response history information and devices located within one hop from the faulty device).

[0056] In the example shown in FIG. 14, other fault response history information F ok Time when the failure occurred Fok The time when the error to be corrected occurred is Fi Search for a time range earlier than Time Fo1 However, the search range for the later time period is Fo2 The time when the error occurred is shown in the figure. Fi The reason for setting the search range for the time period before the i-th time as the maximum error time X is that the other fault response history information mentioned above is fault response history information before the i-th time, and the fault occurrence date and time Time Fok This is because the history information has been corrected.

[0057] (4-3) Identification of correction date and time candidates The fault occurrence date and time correction processing unit 14 next selects the fault occurrence date and time to be corrected. Fi The process of identifying a correction candidate date and time for correcting is performed as follows.

[0058] The failure occurrence date and time correction processing unit 14 first sets the event group number j to j=1 in step S61, and selects this j=1st event group. Then, in step S62, the failure occurrence date and time correction processing unit 14 selects the failure occurrence date and time Time Fi and the time difference (first time difference) Δt F,1 of Δt F,1 =β|Time1-Time Fi | However, when the value in the absolute value is negative, β is set to β=α, and otherwise β is set to β=1.

[0059] Here, α represents the correction time ratio. The correction time ratio α indicates the time ratio of negative correction to positive correction, and is used when the tendency of date and time correction is that the rate or time of negative correction is large, or when the rate of time in the negative direction and the rate of time in the positive direction are not evaluated equally.

[0060] For example, if the date and time correction has a strong tendency to go back in time and the candidates for the correction date and time are, for example, -10 minutes and +8 minutes, +8 minutes is selected as the simple correction time difference. However, if it is evaluated that -10 minutes is a smaller error than +8 minutes, the correction time ratio α is used.

[0061] An example of the correction time ratio α is shown in Figure 18. In this example, the average correction time in the + direction is +18 minutes, and the average correction time in the - direction is -25 minutes, so in this example, α = 25:18, and -10 minutes is converted to 10 / 25 x 18 = 7.2 minutes.

[0062] Next, in step S63, the fault occurrence date and time correction processing unit 14 extracts the other fault response history information F previously extracted in step S54. ok Time when the failure occurred Fok and the representative time Time1 of each event group G1, the smallest time difference (second time difference) Δt Fo,1 of,

number

[0063] The first and second time difference Δt F,1 ,Δt Fo,1 After the calculation of the first time difference Δt F,1 and the second time difference Δt Fo,1 Compare with Δt F,1 <Δt Fo,1 Then, the result of this determination, Δt F,1 <Δt Fo,1 If so, step S65 F,1 , Time1 is stored in the correction date and time candidate storage unit 33 as a correction date and time candidate.

[0064] When the process for the j=1-th event group G1 is completed, the failure occurrence date and time correction processing unit 14 increments the value of j (j=j+1) in step S66. Then, the j=2-th event group G2 is selected, and the process of steps S62 to S65 is executed for the selected event group G2. Thereafter, the failure occurrence date and time correction processing unit 14 similarly performs the process for all the event groups G j The process of steps S62 to S65 is repeated for each selected event group until the selection is completed.

[0065] By the above process, in the example shown in FIG. 15, the time difference Δt F,1 ,Δt F,2 ,Δt F,3 , and the time difference Δt Fo,1 ,Δt Fo,2 ,Δt Fo,3 , are calculated. Then, comparing the calculated time differences, Δt F,1 >Δt Fo,1 Δt F,2 >ΔtFo,2 Δt F,3 <Δt Fo,3 Therefore, in this case, the failure occurrence date and time correction processing unit 14 identifies the representative time Time3=t5 of the event group G3 as a correction date and time candidate, and stores it in the correction date and time candidate storage unit 33.

[0066] In contrast, in the example shown in FIG. 16, the calculated time differences are as follows: Δt F,1 >Δt Fo,1 Δt F,2 >Δt Fo,2 Δt F,3 >Δt Fo,3 Therefore, neither of them satisfies the conditions for being a candidate for correction date and time. j is not saved as a correction date and time candidate.

[0067] The examples in Figures 15 and 16 are for α=1, but the same applies when α=0.5. Figure 17 shows an example of the comparison results of the time difference when α=0.5. In the example of Figure 17, Δt F,1 >Δt Fo,1 Δt F,2 <Δt Fo,2 Δt F,3 <Δt Fo,3 Therefore, in this case, the failure occurrence date and time correction processing unit 14 specifies the representative time Time2=t3 of the event group G2 and the representative time Time3=t5 of the event group G3 as correction date and time candidates, and stores them in the correction date and time candidate storage unit 33.

[0068] (4-4) Date and time correction process When the process of identifying the correction date and time candidate is completed, the failure occurrence date and time correction processing unit 14 determines the failure occurrence date and time Time F1The process of correcting the above based on the identified correction date and time candidate is executed as follows.

[0069] That is, the failure occurrence date and time correction processing unit 14 first determines in step S71 whether or not a correction date and time candidate is stored in the correction date and time candidate storage unit 33. If the result of this determination is that a correction date and time candidate is not stored, in step S76, the i-th failure response history information is determined to be inappropriate as a candidate for generating learning data, and is discarded.

[0070] On the other hand, it is assumed that a correction date and time candidate is stored in the correction date and time candidate storage unit 33. In this case, in step S72, the fault occurrence date and time correction processing unit 14 F,j The representative time Time at which is the smallest j Select the selected representative time Time j The time and date of the fault to be corrected is calculated by using the above F1 Time F1 =Time j Then, the corrected failure occurrence date and time is Time F1 is reflected in the i-th failure response history information, and the failure response history information after reflection is stored in the failure response history storage unit 32. Furthermore, in step S73, the failure occurrence date and time correction processing unit 14 calculates the target time of the i-th failure response history information. A predefined failure occurrence date and time range is used to calculate the target time. As a result, for example, when the failure occurrence date and time range is +10 minutes, the failure occurrence date and time (time range specification) is the failure occurrence date and time Time F1 From Time F1 It is calculated as +10 minutes.

[0071] (4-5) Generating training data The date and time when the fault occurred in the i-th fault response history information F1 When the correction is completed, the control unit 10 of the information optimization device 1 generates learning data in the following manner in step S74 under the control of the learning data output processing unit 16.

[0072] That is, the learning data output processing unit 16 receives the failure occurrence date and time Time F1 The i-th fault response history information with the corrected value is read in. Then, the information elements to be learned, namely, "date and time of fault occurrence," "fault device," "content of fault," and "content of response to fault," are extracted from the read fault response history information, and learning data is generated in which each of the extracted information elements is written in a specified format.

[0073] When the date and time correction process and the learning data generation process for the i-th failure response history information are completed, the control unit 10 of the information optimization device 1 increments the value of i (i=i+1) in step S75. Then, the i=2nd failure response history information is selected, and the failure occurrence date and time Time F2 After that, the control unit 10 executes the correction process of the fault occurrence date and time Time until the value of i reaches the upper limit number of records of the fault response history information. Fi The correction process and the learning data generation process are repeated.

[0074] (5) Output of training data The control unit 10 of the information optimization device 1, the learning data output processing unit 16, reads out the learning data from the learning data memory unit 34 when a preset time arrives or when a request for provision of learning data is sent, for example, from the learning device 2, and outputs the read out learning data from the communication I / F unit 40 to the learning device 2.

[0075] In addition, when the learning device 2 performs the fault determination process and the learning model update process in parallel, the learning data output processing unit 16 may be configured to transmit new learning data to the learning device 2 each time the new learning data is generated.

[0076] (Action and effect) As described above, in one embodiment, when correcting the failure occurrence date and time recorded in the failure response history information, first, events that are included in the range of the maximum error time X in the time period before and after the failure occurrence date and time as a starting point and have a correlation with the faulty device recorded in the failure response history information are extracted, and the extracted events are grouped together with those caused by the same phenomenon. Then, the time difference between the representative time of each event group and the failure occurrence date and time of the correction target is calculated, and the representative time of the event group with the smallest time difference is specified as the correction date and time, and the failure occurrence date and time of the correction target is corrected based on the specified representative time.

[0077] Therefore, even if the date and time of occurrence of a failure in the troubleshooting history information is an approximate date and time recognized by a maintenance person or an inaccurate date and time entered after the failure has been handled, the date and time of occurrence of the failure in the troubleshooting history information is automatically corrected, making it possible to correct the date and time of occurrence of the failure in the troubleshooting history information to an appropriate value without the need for manual analysis or correction work.

[0078] In one embodiment, prior to the correction process of the failure occurrence date and time, it is determined whether or not the failure occurrence device described in the failure response history information exists in the network topology, and whether or not the failure occurrence date and time is described in a processable expression format, and if it is not appropriate, it is discarded in advance. This makes it possible to reduce the processing load of the device by preventing unnecessary date and time correction processes from being performed.

[0079] Furthermore, in one embodiment, when correcting the failure occurrence date and time, the failure occurrence date and time is extracted from other failure response history information that is close to the failure occurrence date and time described in the failure response history information to be corrected within a predetermined error time range, and the time difference between the extracted other failure occurrence date and time and the representative time of each event group is calculated. Then, the time difference between the calculated other failure occurrence date and time is compared with the time difference between the representative time of each event group and the failure occurrence date and time to be corrected, and if the time difference between the other failure occurrence date and time is smaller than the time difference between the failure occurrence date and time to be corrected, the representative time of the event group is not used as the correction date and time.

[0080] Therefore, when an event group is uncertain and corresponds to other fault response history information, the fault occurrence date and time to be corrected can be prevented from being corrected using the representative time of the uncertain event group, thereby making it possible to improve the accuracy of the fault occurrence date and time after correction.

[0081] [Other embodiments] In the above embodiment, an example has been described in which the information optimization device 1 according to the present invention is arranged in front of the learning device 2. However, the present invention is not limited to this. For example, the functions of the information optimization device 1 according to the present invention may be arranged in the learning device 2.

[0082] In the embodiment, the event information and the network configuration information representing the network topology are acquired from the external database 4. However, the database 4 may be provided within the information optimization device 1.

[0083] Furthermore, in the above embodiment, the case where the fault response history information is provided as learning data for learning of the learning model has been described as an example. However, the present invention is not limited to this, and can be applied to, for example, a case where a maintenance person or a system administrator arbitrarily uses the fault response history information for the maintenance of system equipment or system management. In this case, the maintenance person or the system administrator can perform more appropriate maintenance or system management based on the more reliable fault response history information.

[0084] Although the embodiment of the present invention has been described in detail above, the above description is merely an example of the present invention in every respect. It goes without saying that various improvements and modifications can be made without departing from the scope of the present invention. In other words, in implementing the present invention, a specific configuration according to the embodiment may be appropriately adopted.

[0085] In short, this invention is not limited to the above-mentioned embodiment as it is, and in the implementation stage, the components can be modified and embodied without departing from the gist of the invention. In addition, various inventions can be formed by appropriately combining multiple components disclosed in the above-mentioned embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, components from different embodiments may be appropriately combined. [Explanation of symbols]

[0086] 1. Information optimization device 2. Learning device 3…Troubleshooting history DB 4. Related information database 5. Input device 10...Control section 20...Program memory section 30...Data storage unit 40…Communication I / F section 50…Bus 11...Definition information management processing section 12...Failure response history information acquisition processing unit 13...Property judgment processing unit 14...Failure occurrence date and time correction processing unit 15...Learning data generation processing unit 16...Learning data output processing unit 31…Management information storage unit 32…Fault response history memory section 33... Correction date and time candidate storage section 34…Learning data storage unit

Claims

1. An information optimization device that optimizes first correction target information representing an operating state of a system, a grouping processing unit that groups a plurality of events related to the first correction target information into groups each having a predetermined time correlation, thereby generating at least one event group; a specification processing unit that calculates a time difference between first date and time information indicating an occurrence date and time of an event to be corrected described in the first correction target information and second date and time information indicating a representative time among occurrence times of a plurality of events included in the event group, and specifies, as a correction date and time candidate, the second date and time information of the event group for which the calculated time difference satisfies a preset condition; a correction processing unit that corrects the first date and time information based on the specified second date and time information; An information optimization device comprising:

2. The information optimization device of claim 1, further comprising an appropriateness determination processing unit that determines whether the first correction target information exists in topology information representing the configuration of the system, and outputs the first correction target information to the grouping processing unit if it is determined that the first correction target information exists.

3. The grouping processing unit: a processing unit that extracts a plurality of events that occurred in a target device described in the first correction target information and in a related device located in a range having a predetermined correlation with the target device, the plurality of events occurring within a first time range that is set in advance in a time zone before and after the first date and time information described in the first correction target information; a processing unit for grouping the extracted plurality of events into groups of events that are included within a second time range that is set in advance; The information optimization device according to claim 1 or 2, comprising:

4. The specific processing unit is a processing unit that calculates the time difference between the first date and time information and the second date and time information as first time difference information; a processing unit that acquires at least one piece of second correction target information, the event occurrence date and time of which is included within a preset third time range of a time period before and after the first date and time information, extracts third date and time information indicating the event occurrence date and time included within the third time range from the acquired second correction target information, and calculates a time difference between the first date and time information and the third date and time information as second time difference information; a processing unit that compares the first time difference information with the second time difference information, and when the first time difference information is smaller than the second time difference information, identifies the second date and time information of the event group for which the first time difference information is calculated as the correction date and time candidate; The information optimization device according to claim 1 , further comprising:

5. The information optimization device according to any one of claims 1 to 4, further comprising a learning data generation processing unit that generates learning data based on the first correction target information including the first date and time information corrected by the correction processing unit, and outputs the generated learning data for training a learning model that determines the operating state of the system.

6. An information optimization method executed by an information processing device for optimizing correction target information representing an operating state of a system, comprising: generating at least one event group by grouping a plurality of events related to the correction target information with events having a predetermined time correlation; calculating a first time difference between first date and time information indicating the occurrence date and time of the event to be corrected described in the correction target information and second date and time information indicating a representative time among occurrence times of a plurality of events included in the event group, and identifying the second date and time information of the event group for which the calculated first time difference satisfies a preset condition as a candidate for correction date and time; correcting the first date and time information based on the identified second date and time information; An information optimization method comprising:

7. 6. A program for causing a processor included in an information optimization device to execute processing functions of the processing units included in the information optimization device according to claim 1.

Images