Monitoring device, network monitoring system, monitoring method, and monitoring program

Abstract

The network monitoring device (100) includes a learning unit (132), an anomaly degree calculation unit (134), and a hyperparameter search unit (136). The learning unit (132) generates, as a new cluster, a cluster corresponding to partial time series data including data that is chronologically newer than data included in partial time series data corresponding to any of one or more existing clusters in the monitoring data. The anomaly degree calculation unit (134) calculates an anomaly degree corresponding to the new cluster based on a distance between the new cluster and one or more existing clusters. The hyperparameter search unit (136) searches for hyperparameters in the clustering process based on an evaluation index corresponding to a normal period during which no anomaly is detected in the target device.

Description

[Technical field]

[0001] The present disclosure relates to a monitoring device, a network monitoring system, a monitoring method, and a monitoring program. [Background technology]

[0002] A conventional method for detecting anomalies in time-series data is to use a machine learning prediction model. In this method, an actual measurement value at the next time is predicted from actual measurements taken over a certain period of time in the past, and an anomaly degree is calculated based on the deviation between the predicted actual measurement value and the actual actual measurement value, thereby detecting anomalies in the data. In order to obtain a highly accurate anomaly degree, it is necessary to predict the actual measurement value under normal conditions with high accuracy. Therefore, in learning the prediction model, the prediction error is used as an index for determining the quality of the prediction model. That is, even when determining the hyperparameters of the prediction model, a prediction model with high anomaly detection accuracy is generated by searching for hyperparameters that minimize the prediction error of the actual measurement value under normal conditions. Meanwhile, there is also an anomaly detection method that uses a clustering method as a conventional method for detecting anomalies in time-series data. In this method, the degree of anomaly is calculated based on the distance between the input value and the center of an existing cluster. A method derived from the clustering method is the online clustering method, which can forget old learning information and sequentially learn new input information. The online clustering method is useful in cases where re-learning of the anomaly detection model is required after the start of operation. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2022-035686 A Summary of the Invention [Problem to be solved by the invention]

[0004] Even in clustering methods, in order to obtain a highly accurate anomaly detection model, it is necessary to adjust the hyperparameters, and an index for the adjustment is required. Here, while there is a clear index, called the prediction error, in the hyperparameter adjustment of a predictive model, there is no clear index for clustering methods. Patent Document 1 discloses a technique that uses the accuracy rate, recall rate, precision rate, F-measure, and AUC (Area Under the Curve) of anomaly detection as indices for adjusting hyperparameters of an anomaly diagnosis model. However, indices based on the accuracy rate that require a correct label cannot update the anomaly detection model in real time to follow changes in the system state after operation has started. The present disclosure aims to reduce the effort required to update an anomaly detection model after operation begins by using an index that is not based on a correct answer label as an evaluation index in an anomaly detection method for time-series data using a clustering method, and automating the learning of the anomaly detection model and the adjustment of hyperparameters of the anomaly detection model. [Means for solving the problem]

[0005] A network monitoring device according to the present disclosure includes: a learning unit that performs clustering on monitoring data, which is time-series data corresponding to a target device, in accordance with a first hyperparameter, and when clusters corresponding to one or more partial time-series data included in the monitoring data are generated as one or more existing clusters, generates, as a new cluster, a cluster corresponding to partial time-series data including data newer in a chronological order than data included in the partial time-series data corresponding to any of the one or more existing clusters in the monitoring data; an anomaly degree calculation unit that calculates an anomaly degree corresponding to the new cluster based on a distance between the new cluster and the one or more existing clusters; a hyperparameter search unit that searches for the first hyperparameter based on an evaluation index, when an anomaly degree corresponding to each partial time-series data included in the monitoring data has been calculated, the evaluation index being an index corresponding to the anomaly degree corresponding to each partial time-series data, the index corresponding to a normal period, which is a continuous period during which no anomaly is detected in the target device; and Equipped with. Effect of the Invention

[0006] According to the present disclosure, the learning unit performs clustering on the monitoring data, which is time-series data, according to the first hyperparameter. The anomaly degree calculation unit calculates the anomaly degree based on the distance between the clusters. The hyperparameter search unit searches for the first hyperparameter based on an evaluation index corresponding to a normal period. Therefore, according to the present disclosure, in a method for detecting anomalies in time-series data using a clustering method, an index not based on a correct answer label is used as an evaluation index, and learning of the anomaly detection model and adjustment of the hyperparameters of the anomaly detection model are automated, thereby reducing the effort required to update the anomaly detection model after operation begins. [Brief description of the drawings]

[0007] [Figure 1] 1 is a diagram showing an example of the configuration of a network monitoring system 90 according to a first embodiment. [Diagram 2] 1 is a diagram showing an example of a functional configuration of a network monitoring device 100 according to a first embodiment. [Diagram 3] FIG. 4 is a diagram for explaining the processing of an abnormality degree calculation unit 134 according to the first embodiment. [Figure 4] 1 is a diagram showing an example of a hardware configuration of a network monitoring device 100 according to a first embodiment. [Diagram 5] 4 is a flowchart showing processing of a monitoring data processing unit 130 according to the first embodiment. [Figure 6] 5 is a diagram for explaining processing of a monitoring data processing unit 130 according to the first embodiment. [Figure 7]4 is a flowchart showing processing of a hyperparameter search unit 136 according to the first embodiment. [Figure 8] FIG. 13 is a diagram showing an example of a hardware configuration of the network monitoring device 100 according to a modification of the first embodiment. [Figure 9] FIG. 13 is a diagram showing an example of the configuration of a network monitoring system 90 according to a second embodiment. [Figure 10] FIG. 11 is a diagram showing an example of a functional configuration of a network monitoring device 100 according to a second embodiment. [Figure 11] FIG. 11 is a diagram showing an example of a functional configuration of a network device 200 according to a second embodiment. [Figure 12] FIG. 13 is a diagram showing an example of the configuration of a network monitoring system 90 according to a third embodiment. [Figure 13] FIG. 11 is a diagram showing an example of a functional configuration of a network monitoring device 100 according to a third embodiment. [Figure 14] FIG. 11 is a diagram showing an example of a functional configuration of a network device 200 according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] In the description of the embodiments and the drawings, the same elements and corresponding elements are given the same reference numerals. Descriptions of elements given the same reference numerals are omitted or simplified as appropriate. Arrows in the drawings primarily indicate data flow or processing flow. In addition, "part" may be read as "circuit," "step," "procedure," "processing," or "circuitry" as appropriate.

[0009] Embodiment 1 Hereinafter, the present embodiment will be described in detail with reference to the drawings.

[0010] ***Configuration Description*** Fig. 1 shows an example of the configuration of a network monitoring system 90 according to the first embodiment. As shown in Fig. 1, the network monitoring system 90 includes a network monitoring device 100, one or more network devices 200, and a video monitoring device 300. The network monitoring device 100 and the network devices 200 are collectively referred to as monitoring devices. The network monitoring device 100 and the network devices 200 are connected to each other so that they can communicate with each other as appropriate. The two or more devices included in the network monitoring system 90 may be configured as an integrated unit. In this example, the network monitoring apparatus 100 monitors the monitoring data transmitted by each network device 200 . The video monitoring device 300 monitors the video captured by each camera. In the network monitoring system 90, data acquired by devices other than the cameras may be communicated.

[0011] Fig. 2 shows an example of a functional configuration of the network monitoring device 100. As shown in Fig. 2, the network monitoring device 100 includes a receiving unit 110, a monitoring data DB (database) 120, a monitoring data processing unit 130, a user input unit 140, and a presentation unit 150.

[0012] The receiving unit 110 receives monitoring data corresponding to each network device 200. The receiving unit 110 may receive the monitoring data from each network device 200, or may receive the monitoring data from a database or the like that aggregates the monitoring data corresponding to each network device 200. The monitoring data is, as a specific example, time-series data, and includes data indicating alarms issued by the network device 200 and transmission / reception rates at each port of the network device 200. The dimensions of the monitoring data may be any number of dimensions. There may be multiple pieces of monitoring data. As a specific example, each piece of monitoring data is data for each network device 200. There may be multiple pieces of monitoring data corresponding to one network device 200. The monitoring data is also called network monitoring data. The monitoring data received by the receiving unit 110 is stored in the monitoring data DB 120. The monitoring data DB 120 is a database that stores the monitoring data.

[0013] The monitoring data processing unit 130 includes a preprocessing unit 131, a learning unit 132, an anomaly detection model 133, an anomaly degree calculation unit 134, an evaluation index calculation unit 135, and a hyperparameter search unit 136. The network monitoring device 100 includes a monitoring data processing unit 130 for each piece of monitoring data.

[0014] The preprocessing unit 131 reads out the monitoring data from the monitoring data DB 120, and performs a smoothing process and a trend removal process on the monitoring data read out as preprocessing to generate preprocessed data. The smoothing process is a process of smoothing the time series data using a smoothing window size determined by the hyperparameter searching unit 136. The smoothing window is also called a moving window. The trend removal process is a process of removing the trend of the time series data. The preprocessed data is data generated by performing preprocessing on the monitoring data. That is, the preprocessing is specifically composed of a smoothing process that smoothes the monitoring data, and a trend removal process that removes the trend of the monitoring data. The preprocessing unit 131 passes the generated preprocessed data to each of the learning unit 132 and the anomaly degree calculation unit 134.

[0015] The learning unit 132 executes clustering processing on the preprocessed data received from the preprocessing unit 131, using the partial time series size and the number of clusters determined by the hyperparameter searching unit 136. The partial time series size is the size of data to be extracted from the time series data, and is the size of the partial time series data. As a specific example, in the clustering process, the learning unit 132 sequentially generates clusters corresponding to the clustering targets as clustering targets in order from the oldest part of the received preprocessed data, and sequentially includes data indicating the generated clusters in the anomaly detection model 133. The oldest part is determined according to the date and time corresponding to each part of the preprocessed data. In other words, the latest clustering target includes a part that is newer in time series than the part included in the clustering target corresponding to any existing cluster. The existing clusters are each cluster indicated by the anomaly detection model 133. Each cluster corresponds to partial time series data. Note that the learning unit 132 may use the cluster division criterion determined by the hyperparameter search unit 136 instead of the number of clusters. The preprocessed data is data generated by performing preprocessing on the monitoring data using the second hyperparameter. As a specific example, the second hyperparameter indicates a smoothing window size in the smoothing process. That is, the learning unit 132 performs clustering on the monitoring data, which is time series data corresponding to the target device, according to the first hyperparameter. Furthermore, when clusters corresponding to one or more partial time series data included in the monitoring data are generated as one or more existing clusters, the learning unit 132 generates, as a new cluster, a cluster corresponding to partial time series data including data that is chronologically newer than data included in partial time series data corresponding to any of the one or more existing clusters in the monitoring data. The target device is, as a specific example, the network device 200. As a specific example, the first hyperparameter indicates at least one of the size of the partial time series data and a parameter related to the division of the cluster. As a specific example, the parameter related to the division of the cluster indicates either the number of clusters or a cluster division criterion. Note that each of the first hyperparameter and the second hyperparameter corresponds to a hyperparameter of the anomaly detection model 133. As a result of the clustering process, an anomaly detection model 133 is generated. The anomaly detection model 133 is also called a learning model, and as a specific example, is data indicating each cluster generated by the clustering process. The data indicating each cluster may be data indicating each cluster itself, or may be data indicating an outline of each cluster, such as the center or center of gravity of each cluster. Basically, the anomaly detection model 133 is empty at the start of the process of the learning unit 132.

[0016] The anomaly degree calculation unit 134 executes calculation of the anomaly degree using the preprocessed data received from the preprocessing unit 131 and the anomaly detection model 133. At this time, as a specific example, the anomaly degree calculation unit 134 calculates the anomaly degree corresponding to the new cluster based on the distance between the new cluster and one or more existing clusters. The anomaly degree corresponding to the new cluster may be a value indicating the distance between the new cluster and one or more existing clusters. The distance between the new cluster and one or more existing clusters may be the distance between the new cluster and an existing cluster that is closest to the new cluster among the one or more existing clusters. As a specific example of the calculation of the degree of anomaly, in the case where clusters are generated sequentially in the clustering process, the distance between the center of the new cluster and the center of each of the existing clusters is calculated, and the minimum distance among the calculated distances is set as the degree of anomaly corresponding to the new cluster. The new cluster is the most recently generated cluster. Note that, as the distance between clusters, the anomaly calculation unit 134 may adopt the distance between the centers of gravity of the clusters or the distance between representative points within the clusters, instead of the distance between the centers of the clusters. 3 is a diagram for explaining the calculation process of the center of a new cluster and the degree of anomaly. As shown in FIG. 3, the anomaly degree calculation unit 134 determines the minimum distance among the distances between the center of the new cluster and the centers of all the existing clusters as the degree of anomaly.

[0017] The user input unit 140 receives input of the search range and the number of searches for the hyperparameters, and passes data indicating the received search range and the number of searches to the hyperparameter search unit 136 .

[0018] The evaluation index calculation unit 135 refers to the monitoring data DB 120, extracts periods during which no alarms are issued, i.e., normal periods, and calculates evaluation indexes of hyperparameters during the extracted normal periods. The evaluation indexes of hyperparameters during normal periods are, for example, composed of at least one of the average and variance of the degree of abnormality during the normal periods. For example, an alarm is data indicating that an abnormality has occurred in the network device 200. The evaluation index is an index that is based on the premise that the average and variance of the degree of abnormality during normal periods are relatively small. Other evaluation indexes may be used as long as they contribute to making the average and variance of the degree of abnormality during normal periods relatively small in the search for hyperparameters.

[0019] The hyperparameter search unit 136 searches for hyperparameters that minimize the evaluation index calculated by the evaluation index calculation unit 135, within a search range specified by the user input unit 140, the number of searches specified by the user input unit 140. Note that the hyperparameters searched by the hyperparameter search unit 136 may not be the actual global optimal solution. In other words, the hyperparameters that minimize the evaluation index are hyperparameters searched for under the constraints of the specified search range and the number of searches, and may be relatively good hyperparameters. That is, when the degree of anomaly corresponding to each partial time-series data included in the monitoring data is calculated, the hyperparameter search unit 136 searches for the first hyperparameter based on the evaluation index. The evaluation index is an index corresponding to the degree of anomaly corresponding to each partial time-series data, and is an index corresponding to a normal period. The normal period is a continuous period during which no abnormality is detected in the target device. The hyperparameter search unit 136 searches for hyperparameters using Bayesian optimization as a specific example. Moreover, the hyperparameter search unit 136 may search for a second hyperparameter based on the evaluation index.

[0020] The presentation unit 150 displays the degree of abnormality calculated by the abnormality degree calculation unit 134 for each piece of monitoring data on a screen provided in the network monitoring device 100. The network monitoring screen shown in Fig. 1 shows a specific example of a display image of the degree of abnormality.

[0021] 4 shows an example of a hardware configuration of the network monitoring device 100 according to this embodiment. The network monitoring device 100 is made up of a computer. The network monitoring device 100 may be made up of multiple computers.

[0022] 4, the network monitoring device 100 is a computer including hardware such as a processor 11, a memory 12, and data communication hardware 14. These pieces of hardware are appropriately connected via a bus 13.

[0023] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of the computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), a large scale integration (LSI), and a graphics processing unit (GPU). The network monitoring device 100 may include a plurality of processors that replace the processor 11. The plurality of processors share the role of the processor 11.

[0024] Specific examples of memory 12 include non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable Read Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, or a DVD (Digital Versatile Disc).

[0025] The receiving unit 110 is realized by the data communication hardware 14 . Network monitoring data DB 120, network monitoring data processing unit 130, user input unit 140, and presentation unit 150 (hereinafter, these four functional blocks are referred to as a data processing unit) are realized by hardware, software, firmware, or a combination thereof. The software and firmware are written as programs and stored in the memory 12. When the data processing units are realized by software or firmware, the data processing units are realized by the processor 11 reading from the memory 12 and executing the programs for operating as the respective data processing units. That is, the network monitoring device 100 includes the memory 12 for storing programs that result in the execution of steps for implementing the operation of the data processing units when the functions of the network monitoring device 100 are executed by the processor 11. It can also be said that these programs cause a computer to execute the various processes performed by the data processing units. The data processing unit may be realized by dedicated hardware. Specific examples of the dedicated hardware include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination of these. A part of the data processing unit may be realized by dedicated hardware, and the rest may be realized by the processor 11 and the memory 12.

[0026] The operation procedure of the monitoring device corresponds to a monitoring method, and the program that realizes the operation of the monitoring device corresponds to a monitoring program. The monitoring program may be recorded in a computer-readable non-volatile recording medium. Specific examples of the non-volatile recording medium include an optical disk and a flash memory. The monitoring program may be provided as a program product. The hardware configuration of the network device 200 may be similar to the hardware configuration of the network monitoring device 100 .

[0027] ***Explanation of Operation*** 5 shows an example of a processing flow of the monitoring data processing unit 130. The processing flow of the monitoring data processing unit 130 will be described with reference to FIG.

[0028] (Step S1: Smoothing process) The preprocessing unit 131 smoothes the monitoring data, which is time-series data, in accordance with the smoothing window size specified by the hyperparameter searching unit 136. In this case, the preprocessing unit 131 uses an exponential moving average as a specific example. Here, the smoothing window size is a hyperparameter. The purpose of this processing is to improve the robustness of the time series data against periodic fluctuations and amplitude fluctuations.

[0029] (Step S2: Trend removal process) The preprocessing unit 131 calculates the difference between the data before and after the time series to generate a difference series. The generated difference series corresponds to the preprocessed data. The preprocessing unit 131 executes this process on the time series data smoothed in step S1. It should be noted that if there is a trend in the monitoring data, the accuracy of the clustering process in step S3 will decrease, so this process removes the trend from the monitoring data.

[0030] (Step S3: Clustering process) The learning unit 132 generates new clusters by clustering the partial time series of the preprocessed data generated in step S2 according to the partial time series size and the number of clusters specified by the hyperparameter searching unit 136. Here, each of the partial time series size and the number of clusters is a hyperparameter. The learning unit 132 includes data indicating the generated new cluster in the anomaly detection model 133.

[0031] (Step S4: Anomaly Calculation Process) When an existing cluster exists, each time a new cluster is generated in step S3, the anomaly degree calculation unit 134 refers to the anomaly detection model 133 to calculate the distance between the center of the generated new cluster and the center of each of the existing clusters, and sets the minimum distance among the calculated distances as the anomaly degree corresponding to the new cluster.

[0032] Fig. 6 shows a specific example of a process flow for calculating the degree of anomaly of a reception rate included in monitoring data, as a specific example of the process flow shown in Fig. 5. In this example, the hyperparameter search unit 136 executes the process of each step shown in Fig. 5 to search for hyperparameters that minimize the variance of the degree of anomaly in a normal period. Specifically, the hyperparameter search unit 136 searches for an optimal partial time series size and an optimal number of clusters. In this example, the normal period is the period enclosed by a box in the period shown by the graph corresponding to step S4. Each data may be discrete data. The hyperparameter search unit 136 may search for an optimal cluster division criterion instead of an optimal number of clusters.

[0033] 7 shows an example of a processing flow in which the hyperparameter search unit 136 searches for hyperparameters that minimize the variance of the degree of abnormality in a normal period using Bayesian optimization. The processing flow of the hyperparameter search unit 136 will be described with reference to FIG. 7.

[0034] (Step S11) The hyperparameter search unit 136 acquires settings for the search range and the number of searches from the user input unit 140 .

[0035] (Step S12) The hyperparameter search unit 136 extracts a normal period from the period indicated by the monitoring data, based on the presence or absence of an alarm. The hyperparameter search unit 136 may use the normal period extracted by the evaluation index calculation unit 135.

[0036] (Step S13) The hyperparameter search unit 136 initializes the hyperparameters. Thereafter, the hyperparameter search unit 136 repeats steps S14 and S15 the number of times equal to the number of searches.

[0037] (Step S14) The hyperparameter search unit 136 calculates the variance of the degree of abnormality during a normal period.

[0038] (Step S15) The hyperparameter search unit 136 sets new hyperparameters within the search range by Bayesian optimization.

[0039] (Step S16) The hyperparameter search unit 136 sets the hyperparameters finally set in step S15 as the hyperparameters that minimize the variance of the abnormality degree during the normal period.

[0040] ***Explanation of the Effects of the First Embodiment*** As described above, according to this embodiment, the hyperparameters of the anomaly detection model 133 are updated based on the degree of anomaly corresponding to the distance between clusters. Therefore, according to this embodiment, it is possible to automatically update the hyperparameters of the anomaly detection model 133 using an index that is not based on the correct label. Therefore, according to this embodiment, it is possible to reduce the manpower required to update the anomaly detection model after the start of operation.

[0041] ***Other configurations*** <Variation 1> FIG. 8 shows an example of the hardware configuration of the network monitoring device 100 according to this modified example. The network monitoring device 100 includes a processing circuit 18 instead of the processor 11 or instead of the processor 11 and the memory 12 . The processing circuit 18 is hardware that realizes at least a portion of each unit included in the network monitoring device 100 . The processing circuitry 18 may be dedicated hardware, or may be a processor that executes programs stored in the memory 12 .

[0042] When processing circuitry 18 is dedicated hardware, processing circuitry 18 may illustratively be a single circuit, multiple circuits, a programmed processor, parallel programmed processors, an ASIC, an FPGA, or a combination thereof. The network monitoring device 100 may include a plurality of processing circuits that replace the processing circuit 18. The plurality of processing circuits share the role of the processing circuit 18.

[0043] In the network monitoring device 100, some of the functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0044] Processing circuitry 18 is illustratively implemented in hardware, software, firmware, or a combination thereof. The processor 11, memory 12, and processing circuit 18 are collectively referred to as the “processing circuitry.” In other words, the functions of the functional components of the network monitoring device 100 are realized by the processing circuitry. The network device 200 may also have a similar configuration to that of this modified example. The monitoring devices according to other embodiments may also have a similar configuration to that of this modified example.

[0045] Embodiment 2 The following mainly describes the differences from the above-described embodiment with reference to the drawings.

[0046] ***Configuration Description*** 9 shows a configuration example of a network monitoring system 90 according to the second embodiment. In the second embodiment, the network devices 200 learn the anomaly detection model 233, adjust the hyperparameters of the anomaly detection model 233, and calculate the degree of anomaly of the monitoring data. Each network device 200 issues an alarm to the network monitoring apparatus 100 when a failure occurs. A network monitoring system 90 includes a plurality of network devices 200. When each of the plurality of network devices 200 is regarded as a target network device, the target network device executes each process with each of the plurality of network devices 200 as the target device. Moreover, the monitoring data corresponding to the target device is data indicating the behavior of the target device. The network monitoring apparatus 100 determines a period during which no alarm is received from any of the network devices 200 as a normal period, and notifies each network device 200 of information indicating the determined normal period. As a specific example, each network device 200 determines the hyperparameters of the anomaly detection model 233 by searching for hyperparameters that minimize the average and variance of the anomaly degree of the monitoring data during a normal period notified by the network monitoring device 100. The anomaly degree of each monitoring data calculated by each network device 200 is notified to the network monitoring device 100 and displayed on a screen provided in the network monitoring device 100.

[0047] Fig. 10 illustrates an example of a functional configuration of a network monitoring device 100 according to embodiment 2. As illustrated in Fig. 10, the network monitoring device 100 includes a receiving unit 110, a monitoring data DB 120, a monitoring data processing unit 130, a presenting unit 150, and a transmitting unit 160. The monitoring data processing unit 130 according to the second embodiment includes a normal period determination unit 137 .

[0048] The normal period determination unit 137 determines a continuous period during which no alarm has been received from any of the network devices 200 to be a normal period based on the alarm information indicated by the data stored in the monitoring data DB 120, and notifies each network device 200 of information indicating the determined normal period via the transmission unit 160. The receiving unit 110 according to the second embodiment receives information indicating the abnormality level from each network device 200, and stores the received information in the monitoring data DB 120. The presentation unit 150 displays the degree of abnormality for each piece of monitoring data.

[0049] FIG. 11 shows an example of a functional configuration of a network device 200 according to the second embodiment. As shown in FIG. 11, the network device 200 includes a receiving unit 210, a monitoring data DB 220, a monitoring data processing unit 230, a user input unit 240, and a transmitting unit 250. The receiving unit 210 receives information indicating a normal period from the network monitoring device 100 , and passes the received information indicating the normal period to the evaluation index calculation unit 235 . The monitoring data DB 220 is equivalent to the monitoring data DB 120 . The monitoring data processing unit 230 includes a preprocessing unit 231 , a learning unit 232 , an anomaly detection model 233 , an anomaly degree calculation unit 234 , an evaluation index calculation unit 235 , and a hyperparameter search unit 236 . The pre-processing unit 231 is equivalent to the pre-processing unit 131 . The learning unit 232 is equivalent to the learning unit 132 . The anomaly detection model 233 is equivalent to the anomaly detection model 133 . The abnormality degree calculation unit 234 is equivalent to the abnormality degree calculation unit 134 . The evaluation index calculation unit 235 is equivalent to the evaluation index calculation unit 135 . The hyperparameter search unit 236 is equivalent to the hyperparameter search unit 136 . The user input section 240 is equivalent to the user input section 140 . The transmission unit 250 transmits to the network monitoring device 100 data indicating both an alarm corresponding to a failure detected in the network device 200 including the transmission unit 250 and the degree of abnormality calculated by the network device 200 .

[0050] ***Explanation of the Effects of the Second Embodiment*** As described above, according to this embodiment, in the network device 200, it is possible to execute learning of the anomaly detection model 233, adjustment of hyperparameters of the anomaly detection model 233, and calculation of the degree of anomaly of the monitoring data. The calculation of the average and variance of the anomaly degree, which are used as evaluation indexes in tuning the hyperparameters, is a lightweight process. Therefore, the calculation process of the anomaly degree can be executed in an edge device such as the network device 200.

[0051] Embodiment 3 The following mainly describes the differences from the above-described embodiment with reference to the drawings.

[0052] ***Configuration Description*** FIG. 12 shows an example of the configuration of a network monitoring system 90 according to the third embodiment. In the third embodiment, the network monitoring apparatus 100 only displays the degree of anomaly received from each network device 200. Furthermore, in the network device 200, it executes the following: determining a normal period based on the alarm, learning the anomaly detection model 233, adjusting hyperparameters of the anomaly detection model 233, and calculating the degree of anomaly of the monitoring data. When a fault occurs in each network device 200, each network device 200 issues an alarm to all or some of the other network devices 200. As a specific example, each network device 200 determines a period during which no alarm is received from other network devices 200 and during which each network device 200 itself has not detected a fault as a normal period, and determines the hyperparameters of the anomaly detection model 233 by searching for hyperparameters that minimize the average and variance of the degree of anomaly of the monitoring data during the determined normal period.

[0053] 13 shows an example of a functional configuration of the network monitoring device 100 according to the embodiment 3. The network monitoring device 100 includes a receiving unit 110 and a presenting unit 150, as shown in FIG. The receiving unit 110 according to the third embodiment receives information indicating the abnormality degree from each network device 200. The presentation unit 150 according to the third embodiment displays the degree of abnormality for each piece of monitoring data.

[0054] 14 shows an example of a functional configuration of the network device 200 according to the embodiment 3. The functional configuration units included in the network device 200 according to the embodiment 3 are similar to the functional configuration units included in the network device 200 according to the embodiment 2. The evaluation index calculation unit 235 according to the third embodiment is equivalent to the evaluation index calculation unit 135 . The transmitting unit 250 in the third embodiment transmits information indicating an alarm corresponding to a fault detected by the network device 200 having the transmitting unit 250 to another network device 200, and transmits information indicating the degree of abnormality calculated by the network device 200 having the transmitting unit 250 to the network monitoring device 100.

[0055] ***Explanation of the Effects of the Third Embodiment*** As described above, according to this embodiment, in the network device 200, it is possible to determine a normal period based on an alarm, learn the anomaly detection model 233, adjust the hyperparameters of the anomaly detection model 233, and calculate the degree of anomaly of the monitoring data.

[0056] ***Other embodiments*** The above-described embodiments may be freely combined, or any of the components in each embodiment may be modified, or any of the components in each embodiment may be omitted. Moreover, the embodiments are not limited to those shown in the first to third embodiments, and various modifications are possible as necessary. The procedures explained using the flowcharts and the like may be modified as appropriate. [Explanation of symbols]

[0057] 11 processor, 12 memory, 13 bus, 14 data communication hardware, 18 processing circuit, 90 network monitoring system, 100 network monitoring device, 110 receiving unit, 120 monitoring data DB, 130 monitoring data processing unit, 131 preprocessing unit, 132 learning unit, 133 anomaly detection model, 134 anomaly degree calculation unit, 135 evaluation index calculation unit, 136 hyperparameter search unit, 137 normal period determination unit, 140 user input unit, 150 presentation unit, 160 transmission unit, 200 network device, 210 receiving unit, 220 monitoring data DB, 230 monitoring data processing unit, 231 preprocessing unit, 232 learning unit, 233 anomaly detection model, 234 anomaly degree calculation unit, 235 evaluation index calculation unit, 236 hyperparameter search unit, 240 user input unit, 250 transmission unit, 300 video monitoring device.

Claims

1. a learning unit that performs clustering on monitoring data, which is time-series data corresponding to a target device, in accordance with a first hyperparameter, and when clusters corresponding to one or more partial time-series data included in the monitoring data are generated as one or more existing clusters, generates, as a new cluster, a cluster corresponding to partial time-series data including data newer in a chronological order than data included in the partial time-series data corresponding to any of the one or more existing clusters in the monitoring data; an anomaly degree calculation unit that calculates an anomaly degree corresponding to the new cluster based on a distance between the new cluster and the one or more existing clusters; a hyperparameter search unit that searches for the first hyperparameter based on an evaluation index, when an anomaly degree corresponding to each partial time-series data included in the monitoring data has been calculated, the evaluation index being an index corresponding to the anomaly degree corresponding to each partial time-series data, the index corresponding to a normal period, which is a continuous period during which no anomaly is detected in the target device; and A monitoring device comprising:

2. the anomaly degree corresponding to the new cluster is a value indicating a distance between the new cluster and the one or more existing clusters; The monitoring device according to claim 1 , wherein the distance between the new cluster and the one or more existing clusters is a distance between the new cluster and an existing cluster that is closest to the new cluster among the one or more existing clusters.

3. The learning unit generates the new cluster using preprocessed data, the preprocessed data being data generated by performing preprocessing on the monitoring data using a second hyperparameter; The monitoring device according to claim 1 , wherein the hyperparameter search unit searches for the second hyperparameter based on the evaluation index.

4. the pre-processing comprises a smoothing process for smoothing the monitoring data; The monitoring device according to claim 3 , wherein the second hyperparameter indicates a smoothing window size in the smoothing process.

5. 4. The monitoring device of claim 3, wherein the pre-processing comprises a detrending process for removing trends from the monitoring data.

6. The monitoring device according to claim 1 , wherein the first hyperparameter indicates at least one of a size of partial time-series data and a parameter related to division of clusters.

7. The monitoring device according to claim 6 , wherein the parameter relating to the division of the clusters indicates either the number of clusters or a cluster division criterion.

8. 3. The monitoring device according to claim 1, wherein the evaluation index is comprised of at least one of an average and a variance of the degree of abnormality during the normal period.

9. A network monitoring system comprising a plurality of network devices, each of which is the monitoring device according to claim 1 or 2, When each of the plurality of network devices is a target network device, in the target network device, each of the plurality of network devices is set as the target device, A network monitoring system, wherein the monitoring data corresponding to the target device is data indicating a behavior of the target device.

10. a computer performs clustering on monitoring data, which is time-series data corresponding to a target device, in accordance with a first hyperparameter; and when clusters corresponding to one or more partial time-series data included in the monitoring data are generated as one or more existing clusters, generates, as a new cluster, a cluster corresponding to partial time-series data including data newer in a chronological order than data included in the partial time-series data corresponding to any of the one or more existing clusters in the monitoring data; the computer calculates an anomaly measure corresponding to the new cluster based on a distance between the new cluster and the one or more existing clusters; A monitoring method in which, when the computer has calculated a degree of anomaly corresponding to each partial time-series data included in the monitoring data, the computer searches for the first hyperparameter based on an evaluation index, the evaluation index being an index corresponding to the degree of anomaly corresponding to each partial time-series data, and being an index corresponding to a normal period, which is a continuous period during which no abnormality is detected in the target device.

11. a learning process of performing clustering on monitoring data, which is time-series data corresponding to a target device, in accordance with a first hyperparameter, and when clusters corresponding to one or more partial time-series data included in the monitoring data are generated as one or more existing clusters, generating as a new cluster a cluster corresponding to partial time-series data including data newer in time series than data included in any of the partial time-series data corresponding to the one or more existing clusters in the monitoring data; an anomaly calculation process for calculating an anomaly degree corresponding to the new cluster based on a distance between the new cluster and the one or more existing clusters; a hyperparameter search process for searching for the first hyperparameter based on an evaluation index, in a case where an anomaly degree corresponding to each partial time-series data included in the monitoring data has been calculated, the evaluation index being an index corresponding to the anomaly degree corresponding to each partial time-series data, the index corresponding to a normal period, which is a continuous period during which no anomaly is detected in the target device; A monitoring program that causes a monitoring device, which is a computer, to execute the above.

Images