RULE CREATION DEVICE, RULE CREATION METHOD, AND RULE CREATION PROGRAM

Abstract

A rule creation device according to an embodiment is provided with a first analysis unit, a second analysis unit, a selection unit, and a rule creation unit. The first analysis unit calculates a first feature quantity representing features of an event message obtained from a target system. The second analysis unit calculates a second feature quantity representing features of text that includes information indicating a user's intention relating to the identification of a failure in the target system. The selection unit selects a candidate message corresponding to the user's intention from the event message on the basis of the degree of similarity between the first feature quantity and the second feature quantity. The rule creation unit creates an identification rule for identifying the failure in the target system from the event message, on the basis of the candidate message and the text.

Description

[Technical field]

[0001] An embodiment of the present invention relates to a rule creating device, a rule creating method, and a rule creating program. [Background technology]

[0002] In service maintenance work, when a failure occurs in a monitored system, it is necessary to identify the failure. Attempts to identify the failure based on event messages output by devices or applications in the monitored system have been proposed.

[0003] For example, a method has been proposed for identifying the cause of a failure by causal inference from system log data (see, for example, Non-Patent Document 1). In addition, a method has been proposed for analyzing logs based on correlations between log entries (see, for example, Non-Patent Document 2), and a method has been proposed for estimating combinations of event messages that are highly correlated with failure information, and learning rules for identifying failures (see, for example, Non-Patent Document 3). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] S. Kobayashi, K. Otomo, K. Fukuda and H. Esaki, "Mining Causality of Network Events in Log Data," in IEEE Transactions on Network and Service Management, VOL. 15, NO. 1, pp. 53-67, March 2018, DOI: 10.1109 / TNSM.2017.2778096. [Non-Patent Document 2] Marc Platini, Thomas Ropars, Benoit Pelletier, and Noel De Palma. “LogFlow: Simplified Log Analysis for Large Scale Systems,” In International Conference on Distributed Computing and Networking 2021 (ICDCN '21), January 5-8, 2021. Association for Computing Machinery, New York, NY, USA, 116-125. [Non-Patent Document 3] Shunsuke KANAI, et al., “The Learning Process Using Machine Learning for Network Failure,” in IEICE Trans, 2021 / 03 / 01. Summary of the Invention [Problem to be solved by the invention]

[0005] When trying to identify faults from event messages using rules, whether or not the fault can be properly identified depends on whether the rules are properly designed. However, the faults to be identified vary depending on the operator and also on the service being maintained. Furthermore, rules for identifying faults from event messages are vulnerable to changes in the event messages. It is desirable to create rules that reflect the operator's intentions, and to make it possible to easily modify already-created rules according to the situation.

[0006] Conventional methods are limited to analyzing the relevance of event messages, and it is difficult to create flexible rules that reflect the operator's intentions. In addition, modifying rules that have already been created usually requires specialized skills, which increases the costs associated with developing or modifying a monitoring system.

[0007] An object of the present invention is to provide a rule creation device, a rule creation method, and a rule creation program that make it possible to create more appropriate rules for identifying a fault from an event message without requiring skill. [Means for solving the problem]

[0008] In one aspect of the present invention, a rule creation device includes a first analysis unit, a second analysis unit, a selection unit, and a rule creation unit. The first analysis unit calculates a first feature amount indicating a feature of an event message acquired from a target system. The second analysis unit calculates a second feature amount indicating a feature of text including information indicating a user's intention regarding identifying a fault in the target system. The selection unit selects a candidate message corresponding to the user's intention from the event message based on the similarity between the first feature amount and the second feature amount. The rule creation unit creates an identification rule for identifying a fault in the target system from the event message based on the candidate message and the text. Effect of the Invention

[0009] According to one aspect of the present invention, if a user (operator) prepares text including information expressing an intention regarding identifying a fault in a target system, a rule for identifying a fault is automatically created based on the similarity between the feature of the text and the feature of an event message. The user is not required to have specialized skills to prepare the text, and if the user wishes to modify or change a rule, they can simply prepare new text. This makes it possible to flexibly reflect the intention of the operator or changes in the situation, and to create more appropriate fault identification rules without the need for skill.

[0010] According to one aspect of the present invention, it is possible to provide a rule creation device, a rule creation method, and a rule creation program that enable more appropriate rules for identifying faults from event messages to be created without skill. [Brief description of the drawings]

[0011] [Figure 1]FIG. 1 is a schematic diagram showing an example of use of a rule creation device according to an embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a hardware configuration of the rule creation device according to the embodiment. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a functional configuration of the rule creation device according to the embodiment. [Figure 4] FIG. 4 is a flowchart showing an example of an information processing operation of the rule creation device according to the embodiment. [Diagram 5] FIG. 5 is a schematic diagram showing an example of how the rule creation device according to the embodiment is used together with examples of input and output data. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the following, elements that are the same as or similar to elements already described will be given the same or similar reference numerals, and duplicated descriptions will basically be omitted. For example, when there are multiple identical or similar elements, a common reference numeral may be used to describe each element without distinguishing between them, and a subnumber may be used in addition to the common reference numeral to describe each element with distinction between them.

[0013] [Embodiment] (1) Composition FIG. 1 is a schematic diagram showing an example of use of a rule creating device 10 according to an embodiment. As shown in FIG. 1, the rule creation device 10 is a computer that analyzes input data, generates output data, and outputs the output data. The rule creation device 10 receives, as input data, an event message EM output from a monitored system, and a text TX including information indicating an operator's intention (hereinafter, also simply referred to as "operator's intention"). The rule creation device 10 creates and outputs a fault identification rule RL as output data. The rule creation device 10 can also generate a summary sentence SM of the event message EM and output it as output data. The rule creation device 10 can exchange data with an external device, for example, via a wired or wirelessly connected network. The rule creation device 10 may read input data from a built-in or externally connected storage device. The rule creation device 10 may exchange data with an input / output device that is provided integrally or is connected in an expanded manner.

[0014] Here, the "monitored system (also simply referred to as the "target system")" may include systems related to a wide variety of service and maintenance operations. The monitored system includes, for example, one or more devices and one or more applications that constitute a wide range of networks, from small networks to large networks. The devices or applications that constitute the monitored system generate and output event messages, for example, periodically or when some state change occurs. The event messages may be referred to as event logs, system logs, application logs, or the like. The event messages may include messages regarding normal operation, messages regarding abnormal operation or errors, and messages regarding security, etc.

[0015] Furthermore, the term "user" as used herein includes any user capable of inputting text including information expressing an intention directly or indirectly to the rule creation device 10. The term "user" may also include a single user or multiple users. The user may include, for example, an operator, developer, manager, designer, or the like involved in the monitored system, the monitoring system, or service maintenance work. The term "operator" as used herein is not intended to be limited to an operator, and may be appropriately read as a developer, manager, designer, or the like.

[0016] (1-1) Hardware configuration Fig. 2 is a block diagram showing an example of a hardware configuration of the rule creation device 10 according to the embodiment. As shown in Fig. 2, the rule creation device 10 includes, for example, a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, a communication device 14, and a storage device 15.

[0017] The CPU 11 is an integrated circuit capable of executing various programs. The CPU 11 controls the overall operation of the rule creation device 10. The ROM 12 is a non-volatile semiconductor memory. The ROM 12 stores programs and control data for controlling the rule creation device 10. The RAM 13 is, for example, a volatile semiconductor memory. The RAM 13 is used as a working area for the CPU 11. The CPU 11 develops the programs stored in the ROM 12 in the RAM 13, and interprets and executes them to realize various functions described later. The communication device 14 is a communication circuit configured to be connectable to a network. The rule creation device 10 can transfer data received via the communication device 14 to the RAM 13 or the storage device 15. The rule creation device 10 can also output output data generated by the CPU 11 to an external device via the communication device 14. The storage device 15 is a non-volatile storage device. The storage device 15 stores, for example, system software of the rule creation device 10, data acquired via a network, data generated, and the like. Other hardware configurations may be used for the rule creation device 10. A display, an input / output interface, a removable storage device, or the like may be connected to the rule creation device 10.

[0018] (1-2) Functional configuration Fig. 3 is a block diagram showing an example of a functional configuration of the rule creation device 10 according to the embodiment. As shown in Fig. 3, the rule creation device 10 includes, for example, a message acquisition unit 21, a message analysis unit 22, an intention acquisition unit 23, an intention analysis unit 24, a related message selection unit 25, a rule creation unit 26, a summary sentence generation unit 27, and an output unit 28.

[0019] The message acquisition unit 21 acquires an event message output from the monitored system, performs necessary processing, and passes the message to the message analysis unit 22. The message acquisition unit 21 is configured to read out event messages accumulated for a certain period of time from a storage unit (not shown) inside or outside the rule creation device 10 in response to an instruction from a user, for example. The message acquisition unit 21 may be configured to read out a certain amount of event messages from the storage unit. The message acquisition unit 21 is an example of a first acquisition unit that acquires multiple event messages from a storage unit that stores event messages output from a device or application included in the monitored system, and passes the event messages to the first analysis unit.

[0020] The message analysis unit 22 extracts features from the event message received from the message acquisition unit 21. The message analysis unit 22 can extract features by a wide variety of methods. For example, the message analysis unit 22 uses a language pre-training model to extract features from the event message on a message-by-message or word-by-word basis. The message analysis unit 22 outputs the calculated message features (message-by-message features) to the related message selection unit 25. The message analysis unit 22 can also output the calculated message features or word features (word-by-word features) to the summary sentence generation unit 27. The message analysis unit 22 is an example of a first analysis unit that calculates a first feature indicating a feature of an event message acquired from a target system.

[0021] The intention acquisition unit 23 acquires text including information representing the user's intention regarding identifying a fault in the target system, input by the user, performs necessary processing, and passes the text to the intention analysis unit 24. The user can input the intention to the rule creation device 10 as text in natural language including free expression via an input device (not shown). The intention acquisition unit 23 acquires text input by the user via, for example, a keyboard or the like, or reads text from data previously stored in the storage device 15. Alternatively, the intention acquisition unit 23 may acquire text by voice recognition from voice information input by the user via a microphone or the like. The intention acquisition unit 23 is an example of a second acquisition unit that acquires natural language input by the user as text and passes it to the second analysis unit.

[0022] The intention analysis unit 24 extracts features from the text received from the intention acquisition unit 23. The intention analysis unit 24 can also extract features by a wide variety of methods. For example, like the message analysis unit 22, the intention analysis unit 24 extracts features from the text using a language pre-learning model. The intention analysis unit 24 outputs the feature amount calculated from the text (which may also be referred to as the feature amount of the intention) to the related message selection unit 25. The intention analysis unit 24 is an example of a second analysis unit that calculates a second feature amount indicating a feature of the text including information indicating the user's intention regarding identifying a fault in the target system.

[0023] The related message selection unit 25 extracts an event message related to the user's intention based on the similarity between the feature amount of the message received from the message analysis unit 22 and the feature amount of the text received from the intention analysis unit 24, and passes the extracted event message to the rule creation unit 26. A wide variety of methods may be used to determine the similarity. For example, the related message selection unit 25 selects and extracts an event message having the highest similarity between the user's intention and the feature amount from among the acquired event messages. The event message selected and extracted by the related message selection unit 25 is also referred to here as a "candidate message corresponding to the user's intention." The event message extracted as the candidate message may be one or more. The related message selection unit 25 is an example of a selection unit that selects a candidate message corresponding to the user's intention from the event message based on the similarity between the first feature amount and the second feature amount.

[0024] The rule creating unit 26 generates a regular expression that matches the event message extracted by the related message selecting unit 25, and outputs the regular expression to the output unit 28. The regular expression can be rephrased as a specific rule for identifying an event message related to a fault from a large number of event messages. The specific rule can also be rephrased as a fault event specific rule because it can be used to identify an event (event) related to a fault, and can also be rephrased as a fault specific rule because it can be used to identify a fault or a fault cause. The rule creating unit 26 can generate a regular expression (or create a specific rule) by a wide variety of methods. The rule creating unit 26 generates a regular expression by using, for example, a log analysis method. The rule creating unit 26 is an example of a rule creating unit that creates a specific rule for identifying a fault in a target system from an event message based on a candidate message and text.

[0025] The summary generation unit 27 receives message features or word features from the message analysis unit 22, extracts important messages or important words based on the features, and generates a summary based on the extracted important messages or words. The summary generation unit 27 outputs the generated summary to the output unit 28. The summary generation unit 27 can generate a summary using a wide variety of methods. For example, the summary generation unit 27 can generate a summary by utilizing log anomaly detection data. The summary may be rephrased as summary information of the acquired event message. The summary generation unit 27 is an example of a summary generation unit that generates a summary of an event message based on a first feature.

[0026] The output unit 28 receives the specific rule created by the rule creation unit 26 and outputs it to a predetermined output destination. The output unit 28 also receives the summary generated by the summary generation unit 27 and outputs it to a predetermined output destination. For example, the output unit 28 outputs the specific rule or the summary to an external device via the communication device 14 for presentation to the user. The output unit 28 can also output the specific rule or the summary to the storage device 15 for storage. In one embodiment, the output unit 28 outputs the specific rule and the summary to a display or the like and presents them to the user. The output unit 28 is an example of an output unit that outputs the summary and the specific rule for presentation to the user.

[0027] The rule creation device 10 according to the embodiment is used, for example, to narrow down event messages for the purpose of analyzing the cause of a malfunction that occurs in a service during service maintenance work. A huge number of event messages are output from devices and applications constituting a target system from moment to moment, and many of the output event messages are unrelated to the malfunction that has occurred. It is impossible for humans to visually check all of those event messages. With the above-mentioned configuration, for example, the rule creation device 10 creates rules for identifying event messages related to a malfunction from a large number of event messages based on the intention of a user (such as an operator).

[0028] (operation) Next, the information processing operation of the rule creation device 10 according to the embodiment will be described with reference to Figures 4 and 5. As a premise for the operation, it is assumed that event messages output from devices and applications constituting the target system are collected in advance by an arbitrary device (not shown), processed as necessary, and stored in a database.

[0029] Fig. 4 is a flowchart showing an example of an information processing operation of the rule creation device 10 according to the embodiment. The processing in Fig. 4 is started in response to a user inputting an operation start instruction to the rule creation device 10 when, for example, a malfunction occurs in the target system. The operation start instruction may include information indicating the user's intention.

[0030] First, in step S1, the rule creation device 10 acquires event messages for a certain period of time from the above-mentioned database by the message acquisition unit 21. The message acquisition unit 21 reads out event messages for a certain period of time in the past from the time when an operation start instruction was received from the user, or for a period specified by the user. The message acquisition unit 21 passes the acquired event messages to the message analysis unit 22.

[0031] 5 is a schematic diagram showing an example of use of the rule creation device 10 according to the embodiment together with example input and output data. Event messages sent from a device group 100A and an application group 100B included in a target system 100 are stored in a database 101 in advance.

[0032] 5, the rule creation device 10 acquires an event message EM1 from the database 101 by the message acquisition unit 21 (S1). As shown in Fig. 5, the acquired event message EM1 includes a plurality of event messages as follows, merely by way of example. Each of the plurality of messages corresponds to an event that has occurred in any of the devices or applications. “module 6 outlet temperature crossed threshold (100C).” “It has exceeded allowed operating temperature range.” “The interface status changes.” “The LACP state is down.” “Reason = The interface went down physically.” “The local fault alarm has resumed.” “The interface status changes.” “Physical link is up, mainName=Eth-Trunk104…” ...

[0033] Next, in step S2 of FIG. 4, the rule creation device 10 calculates message features from the acquired event message by the message analysis unit 22. The message analysis unit 22 can extract features by, for example, transferring a language model trained on a general language corpus to the domain of the event message. A known method may be used for the transfer method. For example, the language model proposed by Devlin et al. can be used (see Devlin, J. et al. “BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding.” NAACL-HLT (2019)). For example, when the language model BERT of Devlin et al. is used, a 768-dimensional feature (feature vector) is obtained. The message analysis unit 22 can calculate such features on a message-by-message or word-by-word basis. The message analysis unit 22 passes the calculated message features to the related message selection unit 25. The message analysis unit 22 also passes the calculated message features or word features to the summary sentence generation unit 27.

[0034] 4, the rule creation device 10 acquires text including information expressing the intention of the operator (user) by the intention acquisition unit 23, and passes the acquired text to the intention analysis unit 24. The intention acquisition unit 23 acquires the above text as text written in a natural language input by the user via, for example, a keyboard.

[0035] In the example of FIG. 5, a user (operator) OP inputs text TX1 "I want to identify the link disconnection fault" as text including information expressing an intention (OP1). As in this example, the user can input an intention in any expression and in any language. The rule creation device 10 acquires the input text TX1 by the intention acquisition unit 23 (S3). The text TX1 input by the user may be temporarily stored in the storage device 15 of the rule creation device 10 or an external storage device, and then read out by the intention acquisition unit 23.

[0036] Next, in step S4 of FIG. 4, the rule creation device 10 calculates features of text including information expressing the user's intention by the intention analysis unit 24. The intention analysis unit 24 can be implemented by a mechanism similar to that of the message analysis unit 22 as described above. As an example, the intention analysis unit 24 uses the language model BERT proposed by Devlin et al. to obtain features of 768 dimensions. The intention analysis unit 24 passes the calculated features of text to the related message selection unit 25.

[0037] In step S5 of FIG. 4, the rule creation device 10 selects a candidate message corresponding to the user's intention from among the event messages acquired by the message acquisition unit 21, based on the similarity between the feature amount of the message received from the message analysis unit 22 and the feature amount of the text received from the intention analysis unit 24, by the related message selection unit 25. For example, the related message selection unit 25 calculates the cosine similarity between the feature amounts (feature vectors) and selects the event message having the highest similarity between the feature amount of the text as the candidate message. As an example, it is assumed here that, of the event message EM1 illustrated in FIG. 5, "module 6 outlet temperature crossed threshold (100C)." and "The LACP state is down." are selected as the candidate messages. The related message selection unit 25 passes the selected candidate message to the rule creation unit 26. The related message selection unit 25 may select more event messages as candidate messages, or may select one event message as the candidate message.

[0038] In step S6 of FIG. 4, the rule creation device 10 creates a fault identification rule for identifying a fault by the rule creation unit 26 based on the selected candidate message. The fault identification rule can also be rephrased as a regular expression or template for detecting an event message related to a fault. The rule creation unit 26 can use, for example, a log analysis method proposed by Huang et al. (see Huang, Shaohan et al. “Paddy: An Event Log Parsing Approach using Dynamic Dictionary.”, NOMS 2020 - 2020 IEEE / IFIP Network Operations and Management Symposium (2020)) or a rule creation method proposed by Kanai et al. (see Non-Patent Document 3). When these methods are used, for example, a fault identification rule in the “IF··· THEN···” format is created. The rule creation unit 26 passes the created fault identification rule to the output unit 28.

[0039] In the example of Figure 5, the fault identification rule RL1 "IF interface went down THEN link down" is created based on the candidate messages "module 6 outlet temperature crossed threshold (100C)" and "The LACP state is down" and the text TX1 "We want to identify the link down fault." In this fault identification rule RL1, "interface went down" after IF defines the event, and "link down" after THEN defines the fault (including the cause of the fault or the location of the fault). If such a fault identification rule is suitable for the target service or target system, it is very useful for identifying faults from a large number of event messages, but if it is not suitable, it may become useless. However, specialized rule design skills are required to modify the fault identification rule according to the situation.

[0040] Even if the intention input by the user is not suitable for identifying a failure in the target service or target system, the rule creation device 10 according to the embodiment enables optimization of a specific rule without advanced specialized skills by using an interactive framework that repeatedly presents the created rule to the user and receives a correction of the intention from the user. The rule creation device 10 further presents a summary of the event message to the user together with the created rule, thereby helping the user understand the situation and determine the correction of the intention, and promoting the optimization of the rule.

[0041] 4, the rule creation device 10 generates a summary of the event message by the summary generation unit 27 based on the features of the message or words received from the message analysis unit 22. The summary generation unit 27 selects important words based on the features of each word extracted from the event message, for example, and generates a summary using the selected words. More specifically, the summary sentence generation unit 27 can generate a summary sentence using, for example, a method of generating sentences using multi-task learning proposed by Nishino et al. (see Nishino, Toru et al. “Keeping Consistency of Sentence Generation and Document Classification with Multi-Task Learning.” EMNLP / IJCNLP (2019)), a log anomaly detection model proposed by Meng et al. (see Meng, Weibin et al. “LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs.” IJCAI (2019)), or a word selection method by a decoder of a summary model proposed by Liu et al. (see Liu, Yang and Mirella Lapata. “Text Summarization with Pretrained Encoders.” EMNLP / IJCNLP (2019)). The summary sentence generation unit 27 passes the generated summary sentence to the output unit 28. In the example shown in FIG. 5, "Temperature abnormality in module 6" is generated as the summary sentence SM1.

[0042] Next, in step S8 of Fig. 4, the rule creation device 10 outputs the fault identification rule and the summary sentence by the output unit 28 to present them to the user. For example, the output unit 28 outputs the fault identification rule and the summary sentence as character information to an external display device such as a display, and displays them to the user. The fault identification rule and the summary sentence may be output as audio information by a speaker or the like. The fault identification rule and the summary sentence may be output together or separately. The output unit 28 may also output one or both of the fault identification rule and the summary sentence to the storage device 15 to store them.

[0043] In the example of Fig. 5, the fault identification rule RL1 "IF interface went down THEN link disconnected" and summary sentence SM1 "temperature abnormality in module 6" are output from the rule creation device 10 and presented to the user OP (S8). As shown in Fig. 5, in addition to or instead of the summary sentence SM1, a candidate message SM2 selected by the related message selection unit 25 may be presented to the user OP. As shown in the figure, the candidate message SM2 includes "module 6 outlet temperature ..." and "The LACP state is down." from the event message EM1.

[0044] The user OP can check the presented content and consider whether or not to modify the intention that was previously entered. In this case, the user OP wants to modify the intention, and inputs new text TX2 "I want to identify the abnormal temperature fault in module 6" that reflects the modified intention (OP2).

[0045] 4, the rule creation device 10 determines whether or not a text correction has been received from the user, for example, by the intention acquisition unit 23. For example, if the rule creation device 10 does not receive a user operation within a certain time after outputting a fault identification rule, the rule creation device 10 determines that a text correction has not been received (NO in step S9) and ends the process. On the other hand, if the rule creation device 10 receives a text correction (input of new text) from the user within a certain time after outputting a fault identification rule (YES in step S9), the rule creation device 10 proceeds to step S3.

[0046] In step S3, the rule creation device 10 again acquires the corrected text by the intention acquisition unit 23, and executes the subsequent steps S4 to S6 in the same manner. Here, as an example, the event message is not reacquired before and after the intention is corrected, and the process is repeated using the same feature amount of the event message. Therefore, in step S5, the related message selection unit 25 reselects a candidate message based on the similarity between the feature amount of the event message calculated before the intention is corrected and the feature amount newly calculated from the corrected text. When a new fault identification rule is created in step S6, the rule creation device 10 outputs the new fault identification rule in step S8 and presents it to the user. In this case, the rule creation device 10 may output the new fault identification rule alone, or may output the summary sentence that has already been output together with the new fault identification rule. After that, in step S9, the rule creation device 10 again determines whether or not a text correction has been accepted. Note that the rule creation device 10 may set a limit on the number of times (or time, etc.) that the text correction is accepted, or may accept an unlimited number of corrections.

[0047] (effect) As described above in detail, the rule creation device 10 according to the embodiment receives the user's intention (for example, "I want to identify a link disconnection fault") as natural language, and repeats the task of creating fault identification rules that identify faults from event messages, thereby making it possible to design rules that can identify various faults in a target system without requiring skill. Furthermore, the rule creation device 10 presents the user with the created rules along with summary information of event messages, thereby enabling the user to easily grasp the status of the target system and supporting the updating of intentions to optimize the fault identification rules.

[0048] When a problem occurs during service maintenance work, it is necessary to quickly identify the failure in the devices and applications that make up the monitored system. To identify the failure, event messages generated in the monitored system are monitored, but since there is a large amount of event messages unrelated to the failure, specific rules are useful for narrowing down the event messages to those related to the failure. However, specific rules are specific to each service and require specialized knowledge to design and modify, so it was costly to create rules for each service that met the intentions of the operators, etc.

[0049] The rule creation device 10 according to the embodiment allows an operator or the like to create a desired rule without skill while adjusting the input of the intention through an interactive framework using natural language. Therefore, according to the embodiment, it is possible to flexibly respond to system renewal and reduce the development / modification costs of the monitoring system.

[0050] [Other embodiments] It should be noted that the present invention is not limited to the above-described embodiment. For example, the flowchart illustrated in FIG. 4 is merely an example, and as long as the same results as those of the embodiment can be obtained, the order of processing may be changed as much as possible, or other processing may be added. For example, steps S3 to S6 related to fault identification rule creation and step S7 related to summary sentence generation shown in FIG. 4 may be executed simultaneously in parallel, or may be executed separately. Also, steps S1 to S2 and steps S3 to S4 may be executed in the reverse order, or may be executed simultaneously in parallel. The summary sentence generation in step S7 may be omitted. When step S7 is omitted, only the created fault identification rule may be presented to the user, and the intention may be corrected. Alternatively, the selected candidate message may be presented to the user together with the created fault identification rule, and the intention may be corrected.

[0051] In this specification, rule creation device 10 may be called a "server" or a "processing server." CPU 11 may be called a "processor." ROM 12, RAM 13, and storage device 15 may each be called a "storage circuit." Furthermore, each of units 21 to 28 included in rule creation device 10 may be distributed across multiple devices, and these devices may work together to perform processing.

[0052] As exemplified above, the rule creation device 10 according to the embodiment can be applied without restricting the language of the event message and the text expressing the intention. If the event message and the text expressing the intention are in the same language, it is expected that the accuracy will be improved. If the event message and the text expressing the intention are in different languages, for example, XLM (cross-lingual language model) or the like may be used (for example, see https: / / arxiv.org / abs / 1901.07291, January 22, 2019).

[0053] The hardware configuration of the rule creation device 10 described in the embodiment is merely an example. The CPU 11 included in the rule creation device 10 may be another circuit. For example, in the rule creation device 10, an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-programmable gate array), or the like may be used instead of the CPU 11. Each process described in the embodiment may be realized by dedicated hardware. Each process of the rule creation device 10 may be a mixture of processes executed by software and processes executed by hardware, or may be only one of them.

[0054] The above-described method can be stored as a program (software means) that can be executed by a calculator (computer) on a recording medium (storage medium) such as a magnetic disk (floppy disk, hard disk, etc.), an optical disk (CD-ROM, DVD, MO, etc.), or a semiconductor memory (ROM, RAM, flash memory, etc.), and can also be distributed by transmitting it via a communication medium. The program stored on the medium side also includes a setting program that configures the software means (including not only execution programs but also tables and data structures) that the calculator executes within the computer. The computer that realizes the above-described device reads the program recorded on the recording medium, and in some cases, configures the software means by the setting program, and executes the above-described processing by controlling the operation of the software means. The recording medium in this specification is not limited to a recording medium for distribution, but also includes a storage medium such as a magnetic disk or semiconductor memory provided inside the computer or in a device connected via a network.

[0055] The present invention is not limited to the above-mentioned embodiment, and can be modified in various ways without departing from the gist of the present invention. The embodiments may be combined as appropriate, and in that case, the combined effect can be obtained. Furthermore, the above-mentioned embodiment includes various inventions, and various inventions can be extracted by combinations selected from the multiple components disclosed. For example, if the problem can be solved and the effect can be obtained even if some components are deleted from all the components shown in the embodiment, the configuration from which the components are deleted can be extracted as an invention. [Explanation of symbols]

[0056] 10. Rule-making device 11...CPU 12...ROM 13…RAM 14...Communication equipment 15...Storage device 21...Message acquisition section 22...Message analysis section 23…Intention acquisition section 24…Intention Analysis Unit 25…Related message selection section 26…Rule Creation Department 27…Summary sentence generation unit 28...Output section

Claims

1. A first analysis unit that calculates a first feature amount indicating a feature of an event message acquired from a target system; A second analysis unit that calculates a second feature amount indicating a feature of a text including information expressing a user's intention regarding identifying a fault in the target system; a selection unit that selects a candidate message corresponding to the user's intention from the event messages based on a similarity between the first feature amount and the second feature amount; a rule creation unit that creates a specific rule for identifying a fault in the target system from the event message based on the candidate message and the text; A rule creating device comprising:

2. a summary generation unit that generates a summary of the event message based on the first feature amount; an output unit that outputs the summary and the specific rule for presentation to the user; The rule creation device according to claim 1 , further comprising:

3. When the text including the information expressing the user's intent is modified, The second analysis unit calculates a third feature amount indicating a feature of the corrected text, the selection unit further reselects the candidate messages from the event messages based on a similarity between the first feature amount and the third feature amount; The rule creation unit further creates a new specific rule based on the reselected candidate message and the corrected text, and updates the specific rule created before the text was corrected with the new specific rule. The rule creating device according to claim 1 or 2.

4. a first acquisition unit that acquires a plurality of event messages from a storage unit that stores event messages output from a device or an application included in the target system, and passes the event messages to the first analysis unit; a second acquisition unit that acquires the natural language input by the user as the text and passes the text to the second analysis unit; The rule creation device according to claim 1 , further comprising:

5. the selection unit calculates a cosine similarity between the first feature amount and the second feature amount, and selects the candidate message by extracting an event message having a first feature amount that has the highest similarity to the second feature amount. The rule creating device according to claim 1 .

6. Calculating a first feature amount indicating a feature of an event message acquired from a target system; Calculating a second feature amount indicating a feature of a text including information expressing a user's intention regarding identifying a fault in the target system; selecting a candidate message corresponding to the user's intention from the event message based on a similarity between the first feature amount and the second feature amount; creating a specific rule based on the candidate message and the text for identifying a fault in the target system from the event message; The method for creating a rule comprises:

7. A rule creation program that causes a computer to execute processing by each unit of the rule creation device according to any one of claims 1 to 5.

Images