Apparatus, method and program for determining log dependency relationships in a mobile core network

Abstract

To analyze the dependence between system longs before application to AI / ML, in a network environment where many system logs are generated simultaneously and frequently from different nodes in a same event.SOLUTION: A log analysis node 20 determines dependence between system logs by analyzing many system logs output by each NF, an AI / ML execution mode 30 uses the dependence between system logs for executing each kind of determination and future prediction of automatization of network operation. A log analysis node 20 is configured so that a log acquiring part 201 receives a system log output from each NF from 5GC. A connection property management part 202 receives a connection relationship between NF and 5GC. A log analysis part 203 analyzes dependence of the system log received. An NF connection management DB 204 stores a connection relationship between NF. A log management DB 205 saves the system log received from 5GC. An event management DB 206 saves the dependence of the event which is linked between NF.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an apparatus, method, and program for analyzing and determining log dependencies in a mobile core network, and in particular to an apparatus, method, and program for determining log dependency relationships in a mobile core network that can reduce the amount of calculations required to build an AI / ML learning model by analyzing the dependencies between each syslog before applying it to AI / ML in a network environment in which many syslogs for the same event occur simultaneously from different nodes. [Background technology]

[0002] A system log (hereafter referred to as syslog) is text data that indicates when a computer system has processed some event, and is used for a variety of purposes on a daily basis in network operations.

[0003] In recent years, attempts have been made to use syslog data to automate network operations such as anomaly detection in networks using AI (artificial intelligence) / ML (machine learning) technology. Non-Patent Document 1 discloses a technology that classifies the degree of correlation between failures based on the generated syslog. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2002-432100 A [Non-patent literature]

[0005] [Non-Patent Document 1] Identifying linked incidents in large-scale online service systems https: / / dl.acm.org / doi / 10.1145 / 3368089.3409768 Summary of the Invention [Problem to be solved by the invention]

[0006] The core network (5GC for 5G) that performs user authentication, billing, and packet forwarding in mobile networks adopts a cloud-native architecture internally. Therefore, functions such as authentication and mobility management are separated, and multiple node functions may generate multiple system logs in response to the same event.

[0007] For example, if five nodes generate a total of 100 system logs for a certain event, each of the 100 system logs will need to be subjected to a series of processes including learning, judgment, and classification using AI / ML, which could result in unnecessary calculation costs and a deterioration in accuracy.

[0008] The object of the present invention is to solve the above-mentioned technical problems and to provide a log dependency determination device, method, and program for a mobile core network that realizes efficient AI / ML calculations and highly accurate network operation by analyzing the dependencies between each syslog before applying it to AI / ML in a network environment where many syslogs for the same event are generated simultaneously from different nodes. [Means for solving the problem]

[0009] In order to achieve the above object, the present invention is characterized in that a log dependency determination device that determines the dependencies of syslogs output by each network function (NF) that constitutes a mobile core network has the following configuration.

[0010] (1) The system is equipped with a means for determining the connection relationships between each network function, a means for determining the dependency relationships between events of each syslog, and a means for determining the dependency relationships of each syslog based on the connection relationships and the dependency relationships between the events.

[0011] (2) A means for managing history information of inquiries made to the NRF when each network function connects to another network function is provided, and the means for determining the connection relationship determines the connection relationship between each network function based on the history information.

[0012] (3) The mobile network is provided with a means for statically storing dependencies between events in each syslog based on the flow of communication between network functions within the mobile core network as defined by 3GPP, and the means for determining the dependencies between the events determines the dependencies between the events in each syslog based on the statically stored dependencies between the events.

[0013] (4) The means for determining the dependency between each of the syslogs focuses on a pair of the syslog with the oldest event occurrence time and the next oldest syslog among the syslogs output by the mobile core network within a specified period, analyzes whether or not there is the connection relationship between the network function that output the oldest syslog and the network function that output the next oldest syslog, and whether or not there is the dependency relationship between the event of the oldest syslog and the event of the next oldest syslog, and determines that there is a dependency relationship between the pair of syslogs having the connection relationship and the dependency relationship between events, while switching the pair of syslogs of interest to the pair of the next oldest syslog and the next oldest syslog determined to have the dependency relationship between the syslogs, and assigns a common ID to a series of syslogs in which the dependency relationships between syslogs are chained. Effect of the Invention

[0014] According to the present invention, the following effects can be achieved.

[0015] (1) By dynamically determining the dependencies between the numerous system logs generated from the numerous NFs in the mobile core network, it is expected that the amount of calculations required to build AI / ML learning models used to automate network operations can be reduced.

[0016] (2) By dynamically determining the dependencies between the numerous system logs generated from the numerous NFs in the mobile core network, it becomes possible for human operators to visualize the dependencies between logs, making it easier to analyze faults and check status. [Brief description of the drawings]

[0017] [Figure 1] 1 is a functional block diagram showing a configuration of a log dependency relationship determination system according to an embodiment of the present invention. [Diagram 2] This is a sequence flow showing the procedure in which each component of the log analysis node works in cooperation with each other to analyze each syslog and determine the dependency relationships between them. [Diagram 3] This is a sequence flow showing the procedure by which NRF saves search history. [Figure 4] FIG. 13 is a diagram showing an example of managing connectivity information based on a search history of an NRF. [Diagram 5] This figure shows an example of changes to the system logs of other NFs in 5GC when an AMF node goes down. [Figure 6] FIG. 13 shows an example of how the AUSF system log changes when an AMF node goes down. [Figure 7] This figure shows an example of changes in the NRF system log triggered by an AMF node down. [Figure 8] This figure shows an example of how the SMF system log changes when an AMF node goes down. [Figure 9] 13 is a diagram showing an example of a syslog (before determining syslog dependency) stored in a log management DB. FIG. [Figure 10] FIG. 13 is a diagram illustrating an example of dependencies between events in a syslog. [Figure 11] 11 is a flowchart showing a procedure in which a log analysis unit determines a dependency relationship between syslogs. [Figure 12] 13 is a diagram showing an example of a syslog (after determining syslog dependency) stored in a log management DB. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Fig. 1 is a functional block diagram showing the configuration of the main part of a log dependency determination system according to an embodiment of the present invention, which is configured by connecting a 5G core network 10 (5GC) which is a mobile network to be monitored, a log analysis node 20 to which the present invention is applied, and an AI / ML implementation node 30 to each other via a network.

[0019] As specified in TS 23.501, 5GC is composed of multiple nodes, and each node is called a network function (hereinafter, NF: Network Function). 5GC is composed of a combination of multiple physical servers, and in this embodiment, it is composed of server SV1 including NFs of NRF, AUSF, NSSF, and NEF, server SV2 including NFs of AMF and SMF, and server SV2 including NFs of PCF and UDM.

[0020] The log analysis node 20 analyzes a large number of syslogs output by each NF, determines dependencies between the syslogs, and provides the determination results to the AI / ML implementation node 30. The AI / ML implementation node 30 uses the dependencies between the provided syslogs to perform various judgments and future predictions for the automation of network operations.

[0021] The log analysis node 20 mainly includes a log acquisition unit 201, a connectivity management unit 202, a log analysis unit 203, an NF connection management DB 204, a log management DB 205, and an event management DB 206.

[0022] The log acquisition unit 201 receives syslogs output by each NF from the 5GC. The connectivity management unit 202 receives connection relationships between NFs from the 5GC. The log analysis unit 203 analyzes dependencies between the received syslogs. The NF connection management DB 204 stores the connection relationships between NFs received by the connectivity management unit 202 from the 5GC. The log management DB 205 stores the syslogs received by the log acquisition unit 201 from the 5GC. The event management DB 206 stores dependencies of events chained between NFs.

[0023] Such a log analysis node 20 can be configured by implementing an application (program) that realizes each function on at least one general-purpose computer or server equipped with a CPU, ROM, RAM, bus, interface, etc. Alternatively, it can be configured as a dedicated machine or a single-function machine in which part of the application is implemented as hardware or software.

[0024] 2 is a sequence flow showing a procedure for analyzing each syslog and determining its dependency relationship by each component of the log analysis node 20 working in cooperation with each other. At time t1, the connection relationship between NFs is transmitted from the 5GC during normal operation to the connectivity management unit 202 of the log analysis node 20.

[0025] As shown in the sequence diagram in Figure 3, when an NF1 (ID=a) wants to connect to another NF2 (ID=b), the 5GC has a mechanism that queries the NRF (Network function Repository Function) once and searches for an appropriate node as NF2.

[0026] In this embodiment, in order to grasp the connection relationships between NFs using this mechanism, the NRF saves a search history, and the connectivity management unit 202 grasps the connection relationships between NFs by transmitting this search history to the log analysis node 20. In the example of Fig. 3, a connection relationship indicating that a connection exists from NF1 (ID=a) to NF2 (ID=b) is transmitted to the connectivity management unit 202.

[0027] At time t2, the connectivity management unit 202 registers the connection relationship between NFs received from the NRF of the 5GC as connectivity information in the NF connectivity management DB 204. Figure 4 is a diagram showing an example of connectivity information between NFs managed by the connectivity management unit 202 based on the search history of the NRF.

[0028] Since 5GC adopts a cloud native architecture and NFs are configured with multiple VMs and containers, there are multiple NFs of the same type. Therefore, in this embodiment, each NF is uniquely identified by its type and ID, and a combination of NFs in a connection relationship is registered in the connectivity management unit 202.

[0029] After that, when a failure such as a node down occurs in the 5GC at time t3 and the syslog of the affected NF changes, the syslog is transmitted from the 5GC to the log acquisition unit 201 of the log analysis node 20. For example, when the AMF node goes down in the example of the 5GC shown in Fig. 5, the syslog changes in many NFs including the AUSF, NRF, and SMF. Figs. 6, 7, and 8 are diagrams showing examples in which the syslogs of the AUSF, NRF, and SMF change as a result of the AMF node down.

[0030] At time t4, the log acquisition unit 201 stores the syslogs generated in each NF received from the 5GC in the log management DB 205. Fig. 9 is a diagram showing an example of a syslog stored in the log management DB 205, and each syslog is composed of (1) the date and time of occurrence, (2) the NF type, (3) the NF ID, and (4) event information.

[0031] In this embodiment, each record of (5) event label and (6) event ID, which are assigned after determining the dependency relationship between syslogs, is also substantially secured. However, since the determination is not completed at the time when the syslog is received from 5GC at time t3, the records of (5) event label and (6) event ID of each syslog are still empty.

[0032] At time t5, the log analysis unit 203 acquires syslogs for which dependency analysis has not been performed from the log management DB 205. Here, all syslogs for which the (5) event label and (6) event ID are blank are acquired.

[0033] At time t6, the log analysis unit 203 acquires the inter-NF connectivity information (FIG. 4) from the NF connection management DB 204. At time t7, the log analysis unit 203 acquires, from the event management DB 206, dependency relationships between events in the syslog.

[0034] 10 is a diagram showing an example of the dependency relationship between each event in the syslog. The communication flow between NFs in the mobile core network is specified in detail by 3GPP (TS23.502). In this embodiment, the dependency relationship between the events in the syslog, that is, the dependency relationship in which an event occurs in a certain NF after an event occurs in a certain NF, is constructed in advance in accordance with the 3GPP standard.

[0035] 10 shows an example of a dependency relationship between events in which Event 1 occurs in AMF, followed by Event 2 in AUSF, and then Event 3 in UDM in UE connection (an action in which a user equipment (UE) requests permission for Internet communication from a carrier), and an example of a dependency relationship between events in which Event 4 occurs in AMF, followed by Event 5 in SMF, then Event 6 in PCF, and then Event 7 in SMF in PDU connection (an action in which equipment such as a server or rack is connected to a power distribution unit (PDU)). Note that in this embodiment, an event label (UE connection, PDU connection, etc.) for identifying each event is previously assigned to each dependency relationship between events.

[0036] At time t8, the log analysis unit 203 determines the dependency relationships between the syslogs based on the acquired information. In this embodiment, the dependency relationships between the syslogs, the connection relationships between the NFs, and the dependency relationships between the events acquired at times t5 to t7 are analyzed to determine the dependency relationships between the syslogs.

[0037] 11 is a flowchart showing the procedure for the log analysis unit 203 to analyze and determine the dependency relationship between syslogs. In step S1, a temporary storage array that temporarily stores the dependency relationship between syslogs is initialized. In step S2, it is determined whether there is a syslog in which the (5) event label and (6) event ID are blank. If such a syslog exists, the process proceeds to step S3.

[0038] In step S3, the syslogs whose "event label" and "event ID" are blank are sorted in order of their occurrence time, and the oldest syslog is extracted and stored in a temporary storage array. In step S4, the next oldest syslog is extracted.

[0039] In step S5, the pair of the oldest syslog and the second oldest syslog is noted, and it is determined whether or not the NF of the oldest syslog and the NF of the second oldest syslog are in a connected relationship based on the connectivity information.

[0040] If the NFs are connected to each other, the process proceeds to step S6, where it is determined whether or not there is a dependency relationship between the oldest syslog event and the next oldest syslog event based on the dependency relationship between the events.

[0041] If there is a dependency between the events, it is determined that there is a dependency between the oldest syslog and the next oldest syslog, and the process proceeds to step S7, where the next oldest syslog is added and saved in the temporary storage array. In step S8, it is determined whether the next oldest syslog among the pair of syslogs determined to have a dependency between them is the last syslog in the dependency of the corresponding event.

[0042] If it is not the last syslog, the process returns to step S4, and the pair of syslogs of interest is switched to the pair of the next oldest syslog and the next oldest syslog that are determined to have a dependency between the syslogs, and the process of determining the dependency between syslogs based on the connection relationship and the dependency between events is repeated.

[0043] On the other hand, if it is determined that the second oldest syslog is the last syslog in the dependency relationship of the corresponding event, the process proceeds to step S9. In step S9, as shown in Fig. 12, a common event ID is assigned to a series of syslogs in which the dependency relationships of syslogs are linked, which are stored in the temporary storage array, and a unique event label is further assigned to each syslog. The temporary storage array is stored in the log management DB 205 at time t9.

[0044] In this embodiment, the same event ID is assigned to syslogs for which connection relationships between the NFs and dependencies between events are established. Therefore, in the example shown in the figure, it can be seen that the syslogs at times T1, T3, and T6 are in a dependent relationship in that order, and the syslogs at times T2, T4, T5, and T7 are in a dependent relationship in that order.

[0045] According to the above embodiment, not only can the amount of calculation required to build an AI / ML learning model used for automating network operations be reduced, but also fault analysis and status confirmation can be easily performed when automating network operations, making it possible to provide the benefits of automating network operations to many people regardless of geographic or economic disparity. As a result, it is possible to contribute to Goal 9 "Build resilient infrastructure and promote inclusive and sustainable industrialization" and Goal 11 "Make cities inclusive, safe, resilient and sustainable" of the Sustainable Development Goals (SDGs) led by the United Nations. [Explanation of symbols]

[0046] 10...5G core network (5GC), 20...log analysis node, 30...AI / ML implementation node, 201...log acquisition unit, 202...connectivity management unit, 203...log analysis unit, 204...NF connection management DB, 205...log management DB, 206...event management DB

Claims

1. A log dependency determination device that determines the dependency of syslogs output by each network function (NF) constituting a mobile core network, A means for managing history information of inquiries made to the NRF when each network function connects to another network function; A means for determining a connection relationship between each network function based on the history information; A means of determining dependencies between events in each syslog; and means for determining the dependency relationship of each syslog based on the connection relationship and the dependency relationship between events.

2. A log dependency determination device that determines the dependency of syslogs output by each network function (NF) constituting a mobile core network, A means for determining a connection relationship between each network function; A means of determining dependencies between events in each syslog; means for determining a dependency relationship between each syslog based on the connection relationship and the dependency relationship between events; The means for determining the dependency relationship of each system log includes: Among the syslogs output by the mobile core network within a given period, a pair of syslogs with the oldest and second oldest event occurrence times is considered; analyzing whether or not there is a connection relationship between the network function that output the oldest syslog and the network function that output the second oldest syslog, and whether or not there is a dependency relationship between an event of the oldest syslog and an event of the second oldest syslog; Repeating the process of determining that a pair of syslogs having the connection relationship and the dependency relationship between events has a dependency relationship between the syslogs while switching the pair of syslogs of interest to the pair of the next oldest syslog and the syslog that is determined to have a dependency relationship between the syslogs, and A log dependency determination device for a mobile core network, characterized in that a common ID is assigned to a series of syslogs that are linked by syslog dependencies.

3. A means for managing history information of an inquiry made to the NRF when each network function connects to another network function is provided; 3. The log dependency determination device for a mobile core network according to claim 2, wherein said means for determining the connection relationship determines the connection relationship between each network function based on said history information.

4. A means for statically storing dependencies between events in each system log based on the flow of communication between network functions in a mobile core network defined by 3GPP is provided; The log dependency determination device for a mobile core network as described in claim 1 or 3, characterized in that the means for determining the dependency between the events determines the dependency between the events of each syslog based on the dependency between the statically stored events.

5. The means for determining the dependency relationship of each system log includes: Among the syslogs output by the mobile core network within a given period, a pair of syslogs with the oldest and second oldest event occurrence times is considered; analyzing whether or not there is a connection relationship between the network function that output the oldest syslog and the network function that output the second oldest syslog, and whether or not there is a dependency relationship between an event of the oldest syslog and an event of the second oldest syslog; Repeating the process of determining that a pair of syslogs having the connection relationship and the dependency relationship between events has a dependency relationship between the syslogs while switching the pair of syslogs of interest to the pair of the next oldest syslog and the syslog that is determined to have a dependency relationship between the syslogs, and 2. The mobile core network log dependency determination device according to claim 1, further comprising a common ID for assigning a common ID to a series of syslogs in which the dependency of syslogs is linked.

6. A method for determining log dependency in which a computer determines the dependency of syslogs output by each network function (NF) constituting a mobile core network, comprising: Manages the history information of inquiries made to the NRF when each network function connects to another network function, determining a connection relationship between each network function based on the history information; Determine dependencies between events in each syslog, A method for determining log dependency relationships in a mobile core network, characterized in that the method determines the dependency relationships of each syslog based on the connection relationships and the dependency relationships between events.

7. A log dependency determination method in which a computer determines the dependency of system logs output by each network function (NF) constituting a mobile core network, comprising: Determine the connections between each network function, Determine dependencies between events in each syslog, determining a dependency relationship between each syslog based on the connection relationship and the dependency relationship between events; When determining the dependencies of each of the above system logs, Among the syslogs output by the mobile core network within a given period, a pair of syslogs with the oldest and second oldest event occurrence times is considered; analyzing whether or not there is a connection relationship between the network function that output the oldest syslog and the network function that output the second oldest syslog, and whether or not there is a dependency relationship between an event of the oldest syslog and an event of the second oldest syslog; Repeating the process of determining that a pair of syslogs having the connection relationship and the dependency relationship between events has a dependency relationship between the syslogs while switching the pair of syslogs of interest to the pair of the next oldest syslog and the syslog that is determined to have a dependency relationship between the syslogs, and A method for determining log dependency relationships in a mobile core network, characterized in that a common ID is assigned to a series of syslogs in which syslog dependencies are linked.

8. In a log dependency determination program that determines the dependency of system logs output by each network function (NF) that constitutes a mobile core network, A procedure for managing history information of inquiries made to the NRF when each network function connects to another network function; determining a connection relationship between each of the network functions based on the history information; Procedures for determining dependencies between events in each syslog; and determining the dependency relationship of each syslog based on the connection relationship and the dependency relationship between events.

9. A log dependency determination program for determining dependencies of system logs output by each network function (NF) constituting a mobile core network, comprising: A procedure for determining the connection relationships between each network function; Procedures for determining dependencies between events in each syslog; determining a dependency relationship between each syslog based on the connection relationship and the dependency relationship between events; In the procedure for determining the dependency relationship between each of the system logs, Among the syslogs output by the mobile core network within a given period, a pair of syslogs with the oldest and second oldest event occurrence times is considered; analyzing whether or not there is a connection relationship between the network function that output the oldest syslog and the network function that output the second oldest syslog, and whether or not there is a dependency relationship between an event of the oldest syslog and an event of the second oldest syslog; Repeating the process of determining that a pair of syslogs having the connection relationship and the dependency relationship between events has a dependency relationship between the syslogs while switching the pair of syslogs of interest to the pair of the next oldest syslog and the syslog that is determined to have a dependency relationship between the syslogs, and A program for determining log dependency relationships in a mobile core network, characterized in that a common ID is assigned to a series of syslogs that are linked by syslog dependencies.

Images