Searching device, searching method, and searching program

Abstract

Provided is a searching device 1 that searches an inspection range of a fault occurring in a communication network, said searching device 1 comprising: a generation unit 16 that, on the basis of a connection configuration of a device included in the communication network, generates a graph connecting a plurality of devices within a certain inspection range including a suspected location of a fault using artificial intelligence (AI); and a search unit 17 that, on the basis of past fault records for the graph, inputs an inspection range into a search model capable of searching and causes the search model to infer whether the inspection range of the graph should be expanded, wherein when the inspection range of the graph should be expanded, the generation unit 17 adds, to the graph, an adjacent device which is adjacent to a device in the graph.

Description

[Technical field]

[0001] The present invention relates to a searching device, a searching method, and a searching program. [Background technology]

[0002] Self-evolving zero-touch operation, in which operation systems autonomously adapt to changes in the communication network environment, is being considered. To achieve this, the introduction of AI (Artificial Intelligence) into operation systems is also being promoted.

[0003] However, further improvements in accuracy are necessary to ensure that AI judgments can be made while taking into account various changes in the communication network environment. In particular, there is a demand for technology that assumes that there is an error in the location of a suspected fault detected by AI and explores the scope of the investigation of the fault based on that assumption.

[0004] In other words, in an actual communication network, there are cases where the device that outputs the alarm information does not match the failed device, and the network configuration at the time of the failure may differ from that at the time of construction, etc., so it is not possible to simply select the adjacent device that sent the alarm information as the scope of investigation when a failure occurs, and it is necessary to comprehensively investigate devices that may be at fault.

[0005] One method for searching the investigation range of a fault is to use a rule-based workflow. Another method is to have the operator of the communication network himself perform the search. Another method is to use a graph search algorithm. Specifically, the breadth-first search method searches from the hierarchy closest to the starting point, and the depth-first search method searches by proceeding from the starting point to any dead end and then returning to the final branch (see Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] Hideya Ochiai, "Discrete Mathematics Graph Search Algorithms", [online], [Retrieved February 1, 2022],<URL: https: / / www.hongo.wide.ad.jp / ~jo2lxq / dm / lecture / 07.pdf> Summary of the Invention [Problem to be solved by the invention]

[0007] However, in the case of a search method using a rule-based workflow, it is very difficult to create a workflow because it is necessary to comprehensively consider complex conditional branching including changes in environmental conditions such as failure events and the state of the target communication network when a fault occurs, etc. This is particularly unrealistic for large-scale communication networks with tens of thousands of network devices.

[0008] In addition, when a search method is performed by an operator, the scope of investigation is determined based on the operator's knowledge and experience, so it is highly dependent on the individual's skills, and the time it takes from the occurrence of a problem to identifying the scope of investigation and the conclusions reached will vary.

[0009] Furthermore, in the case of a search method using a graph search algorithm, since it is assumed that the search goal or search goal conditions are defined in advance, a solution (quasi-suspect location) cannot be derived in a communication network where the conditions are determined during the search. In the case of a depth-first search method, since the search is performed up to the terminal point of the graph, the amount of calculation is always enormous in the large-scale communication network described above, and it takes a long time to obtain the search results.

[0010] The present invention has been made in consideration of the above circumstances, and an object of the present invention is to provide a technique that can appropriately search the investigation range of a fault. [Means for solving the problem]

[0011] A search device of one embodiment of the present invention is a search device that searches for an investigation range of a fault that has occurred in a communication network, and includes a generation unit that generates a graph connecting multiple devices within a certain investigation range including a suspected location of the fault using AI (Artificial Intelligence) based on the connection configuration of the devices that make up the communication network, and a search unit that inputs the graph into a search model that can explore the investigation range based on past fault records and causes the search model to infer whether the investigation range of the graph should be expanded, and if the investigation range of the graph should be expanded, the generation unit adds adjacent devices adjacent to the devices in the graph to the graph.

[0012] A search method of one embodiment of the present invention is a search method for searching the investigation range of a fault that has occurred in a communication network, the search device performing the steps of generating a graph connecting multiple devices within a certain investigation range including a suspected location of the fault using AI (Artificial Intelligence) based on the connection configuration of the devices that make up the communication network, inputting the graph into a search model capable of searching the investigation range based on past fault records and having the search model infer whether the investigation range of the graph should be expanded, and if the investigation range of the graph should be expanded, adding adjacent devices adjacent to the devices in the graph to the graph.

[0013] A search program according to one aspect of the present invention causes a computer to function as the search device. Effect of the Invention

[0014] According to the present invention, a technique is provided that can appropriately search the investigation range of a fault. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a diagram showing a configuration of a search system. [Diagram 2] FIG. 2 is a diagram illustrating a functional block configuration of the searching device. [Diagram 3] FIG. 3 is a diagram illustrating a processing flow of the searching device. [Figure 4] FIG. 4 is a diagram illustrating an example of an initial graph. [Diagram 5] FIG. 5 is a diagram showing an example of a graph after the update is completed. [Figure 6] FIG. 6 is a diagram illustrating a hardware configuration of the searching device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the description of the drawings, the same parts are given the same reference numerals and the description will be omitted.

[0017] [Summary of the Invention] The present invention discloses a technology that can appropriately search the scope of a failure investigation to ensure the safety of recovery measures for failures in a communication network. Specifically, as described above, it is assumed that there is an error in the suspected location of the failure determined by AI, and the investigation scope including the suspected location of the failure is appropriately searched. More specifically, when a failure occurs in a communication network, the investigation scope is appropriately searched not only for the suspect device that is most likely to be at fault, but also based on past failure records. This makes it possible to appropriately search the scope of a failure investigation, and improves the safety of failure recovery operations.

[0018] [Search system configuration] 1 is a diagram showing the configuration of a search system 100 according to this embodiment. The search system 100 includes a search device 1, a workflow engine 2, a fault location estimation AI 3, an operator terminal 4, and a facility information management DB 5.

[0019] The workflow engine 2 is a device that uses a workflow to automate failure recovery operations by utilizing an external system. Specifically, the workflow engine 2 starts an automated operation flow based on alarm information output from the communication network NW. The workflow engine 2 outputs a task start command (search start command) to the failure location estimation AI 3 and the search device 1 according to a branch in the flow.

[0020] The fault location estimation AI 3 is an AI machine or AI program that estimates the suspected location of the fault. Specifically, the fault location estimation AI 3 inputs alarm information output from the communication network NW, and estimates the suspected location of the fault based on a search start command output from the workflow engine 2.

[0021] The operator terminal 4 is a terminal that an operator operates to manage the communication network NW. Specifically, the operator terminal 4 outputs a suspected location of a fault that the operator presumes based on alarm information output from the communication network NW.

[0022] The equipment information management DB5 is a database that manages various information of the devices that constitute the communication network NW. For example, the equipment information management DB5 stores the name of each device, the IP address of each device, the port number of each IF of each device, and NW topology information. The NW topology information is, for example, physical connection information (cable connection between device ports) and logical connection information (for example, connection between adjacent devices in a routing protocol, connection between endpoint devices in a tunneling protocol).

[0023] The search device 1 is a device that searches the investigation range of a fault that has occurred in the communication network NW. As mentioned above, there is a possibility that the suspected fault location determined by the fault location estimation AI 3 is incorrect. Therefore, the search device 1 searches the investigation range of the fault using a search model of a graph neural network that has learned the details of the isolation investigation for past fault events.

[0024] Specifically, the search device 1 generates a graph reflecting the topology configuration of the communication network NW to be searched and the AI ​​inference result (suspected fault location) by the fault location inference AI 3 in response to a search start command output from the workflow engine 2. The search device 1 then inputs the graph into the above-mentioned search model to determine (infer) the need for a peripheral investigation of the suspected fault location, and adds the relevant peripheral device to the graph if an investigation is necessary. This makes it possible to appropriately search the range of the fault investigation, and improves the safety of fault recovery operations.

[0025] In addition, the search device 1 reflects not only the AI ​​estimation result by the fault location estimation AI 3, but also the fault isolation information by the operator output from the operator terminal 4 and the fault information included in the alarm information output from the communication network NW in the graph. These may also be input directly to the search model. This makes it possible to more appropriately search the investigation range of the fault, and further improve the safety of the fault recovery operation.

[0026] In addition, the searching device 1 repeats the judgment (inference) of the necessity of further investigating the peripheral devices according to the investigation result. This makes it possible to more appropriately investigate the range of the failure, and further improve the safety of the failure recovery operation.

[0027] [Functional configuration of the search device] 2 is a diagram showing a functional block configuration of the searching device 1 according to this embodiment. The searching device 1 includes a receiving unit 11, a first input unit 12, a first storage unit 13, a second input unit 14, a second storage unit 15, a generating unit 16, a searching unit 17, a third storage unit 18, and an output unit 19.

[0028] The receiving unit 11 has a function of receiving a search start command output from the workflow engine 2 and notifying the generating unit 16 of the search start command.

[0029] The first input unit 12 has a function of inputting the AI ​​inference results by the fault location estimation AI 3, the fault isolation information by the operator output from the operator terminal 4, and the fault information contained in the alarm information output from the communication network NW, and storing various information such as these AI inference results in the first memory unit 13.

[0030] The first storage unit 13 has a function of storing various information such as the AI ​​estimation results input by the first input unit 12.

[0031] The second input unit 14 has a function of acquiring NW topology information of the communication network NW from the equipment information management DB 5 and storing the NW topology information in the second storage unit 15.

[0032] The second storage unit 15 has a function of storing the NW topology information acquired by the second input unit 14.

[0033] The generation unit 16 has a function of generating a graph connecting multiple devices within a certain investigation range including a suspected location of a fault by the fault location estimation AI 3 based on the connection configuration of the devices constituting the communication network NW. Specifically, the generation unit 16 has a function of identifying a suspected fault device, a device for which investigation information such as an alarm is known, and adjacent devices based on the AI ​​estimation result by the fault location estimation AI 3, fault isolation information by an operator, and fault information included in the alarm information, and generating a graph connecting the identified devices based on the NW topology information of the communication network NW.

[0034] Furthermore, the generation unit 16 has a function of adding adjacent devices adjacent to devices in the graph to the graph when the search unit 17 infers that the investigation range of the graph should be expanded.

[0035] The search unit 17 has a function of inputting the graph generated by the generation unit 16 into a search model of a graph neural network that can learn the investigation range to be divided for past failures and search the investigation range based on past failure records, and has the function of having the search model infer whether the investigation range of the above graph should be expanded.

[0036] The search unit 17 also has a function of inputting fault isolation information by an operator to the search model during inference using the search model, and performing inference using the fault isolation information.

[0037] In addition, the search unit 17 has a function of repeating, one or more times, an inference as to whether the investigation range of the graph to which the adjacent device has been added should be further expanded, depending on the results of an investigation of a fault based on alarm information output from the communication network NW.

[0038] The third storage unit 18 has a function of storing a graph.

[0039] The output unit 19 has a function of outputting a graph that is a search result of the investigation range of the fault.

[0040] [Processing the Search Device] Fig. 3 is a diagram showing a processing flow of the searching device 1 according to this embodiment. A searching method for searching an investigation range of a fault that has occurred in the communication network NW will be described with reference to Figs. 1 to 3. It is assumed that the workflow engine 2 starts an automated operation flow based on alarm information output from the communication network NW, and transmits a search start command to the workflow engine 2.

[0041] Step S1; First, the reception unit 11 receives a search start command outputted from the workflow engine 2 .

[0042] Step S2; Next, the first input unit 12 inputs the AI ​​inference result v1 of the suspected fault location inferred by the fault location inferring AI 3, the fault isolation result v2 inferred by the operator, and the fault warning v3 included in the warning information for the communication network NW that output the warning information. The second input unit 14 also acquires the NW topology information of the communication network NW from the equipment information management DB 5.

[0043] The alarm information is an alarm, a system log, etc., and is output from multiple devices in response to one failure (physical failure, link down, etc.). Figure 1 shows how six devices E to J output alarms in response to a failure that occurs in one device F.

[0044] Step S3; Next, the generation unit 16 identifies devices suspected of failure, known devices for which investigation information such as alarms is known, and adjacent devices adjacent to them, based on the AI ​​estimation result v1 by the failure location estimation AI 3, the failure isolation result v2 by the operator, and the failure alarm v3 included in the alarm information. Then, the generation unit 16 generates an initial graph connecting the identified devices based on the NW topology information of the communication network NW.

[0045] An example of the initial graph is shown in Fig. 4. For example, the generation unit 16 inputs device A, for which (v1 = 1), into the graph as a device suspected of a fault. Next, the generation unit 16 further inputs devices B to D, which are one hop away from device A, into the graph as adjacent devices, and also inputs the values ​​of v2 and v3 related to devices B to D into the graph.

[0046] Step S4; Next, the search unit 17 inputs the initial graph to a search model of a graph neural network that can learn the investigation range to be divided for past failures and can search the investigation range based on past failure records, and has the search model infer whether the investigation range of the initial graph should be expanded. The search model outputs, for example, an inference value h indicating the degree of necessity for investigation expansion for each device in the initial graph.

[0047] Step S5; Next, the generation unit 16 updates the initial graph based on the inference result by the above-mentioned search model. Specifically, if the generation unit 16 infers that the search range of the initial graph should be expanded, it adds adjacent devices adjacent to the devices in the initial graph to the initial graph, and if it infers that the search range of the initial graph should not be expanded, it does not add adjacent devices. For example, the generation unit 16 updates the initial graph based on the inference result when the inference value h is greater than or equal to a threshold value hth Add adjacent devices to the initial graph, and if the inference value h is less than the threshold h th Neighbors adjacent to devices with less than 1000 neighbors are not added.

[0048] Step S6; After that, the generation unit 16 judges whether there is any device adjacent to the device added in step S5 based on the NW topology information of the communication network NW. If there is any device adjacent to the device, the process returns to step S4 to infer whether there is any device to be added.

[0049] At this time, if the AI ​​inference result v1', the fault isolation result v2', and the fault alarm v3' changed over time are input to the search device 1, the search unit 17 may input them to the search model before or during inference to perform inference. Also, the search unit 17 may repeat the inference process using the search model one or more times each time the AI ​​inference result v1, the fault isolation result v2, and the fault alarm v3 are changed according to the results of an investigation into the fault.

[0050] Step S7; If there are no more neighbors, the generator 16 completes the graph update. An example of the graph after the update is completed is shown in FIG. 5. In this example, th = 0.5. Device E (h = 0.6) adjacent to device B (h = 0.7) is added. Furthermore, device H (h = 0.1) adjacent to device E is added. Device F (h = 0.2) is added to device B (h = 0.7). Device G (h = 0.2) is added to device D (h = 0.7). Devices C, F, G, and H have h less than 0.5, so their adjacent devices have not been added. Note that the value of the fault alarm v3 for device C has been updated with the changed fault alarm v3'.

[0051] Step S8; Finally, the generation unit 16 stores the updated graph in the third storage unit 18. The output unit 19 outputs the graph to the operator terminal 4.

[0052] Thus, in this embodiment, the output of the search model is not simply the classification result of the device, but rather a judgment (inference) is made as to "the degree to which information about a certain device should be propagated to adjacent devices and judged using a larger graph (degree of need for investigation expansion)," and the inferred graph itself is expanded to infer an investigation range that reflects the status and changes of individual events. Another feature is that isolation information learned during operations is dynamically input into the input data during the inference phase of device search. This makes it possible to appropriately explore the investigation range of the failure, and improves the safety of failure recovery operations.

[0053] [effect] According to this embodiment, there is provided a generation unit 16 that generates a graph connecting multiple devices within a certain investigation range including a suspected location of a fault by AI based on the connection configuration of the devices that make up the communication network, and a search unit 17 that inputs the graph into a search model that can search the investigation range based on past failure records and causes the search model to infer whether the investigation range of the graph should be expanded. If the investigation range of the graph should be expanded, the generation unit 16 adds adjacent devices adjacent to the devices in the graph to the graph, making it possible to appropriately search the investigation range of the fault and improving the safety of fault recovery operations.

[0054] Furthermore, according to this embodiment, the search unit 17 inputs fault isolation information from an operator into the search model during inference using the search model, and performs the inference using the fault isolation information, thereby making it possible to more appropriately explore the scope of investigation of the fault, and further improving the safety of fault recovery operations.

[0055] Furthermore, according to this embodiment, the search unit 17 repeats the inference one or more times as to whether the investigation range of the graph to which the adjacent device has been added should be further expanded depending on the results of the investigation of the fault based on the alarm information from the communication network, thereby making it possible to more appropriately search the investigation range of the fault and further improve the safety of the fault recovery operation.

[0056] [others] The present invention is not limited to the above-described embodiment, and various modifications are possible within the scope of the present invention.

[0057] The searching device 1 of the present embodiment described above can be realized, for example, as shown in Fig. 6, by using a general-purpose computer system including a CPU 901, a memory 902, a storage 903, a communication device 904, an input device 905, and an output device 906. The memory 902 and the storage 903 are storage devices. In the computer system, the CPU 901 executes a predetermined program loaded on the memory 902, thereby realizing each function of the searching device 1.

[0058] The search device 1 may be implemented in one computer. The search device 1 may be implemented in multiple computers. The search device 1 may be a virtual machine implemented in a computer. The program for the search device 1 may be stored in a computer-readable recording medium such as an HDD, SSD, USB memory, CD, or DVD. The program for the search device 1 may also be distributed via a communication network. [Explanation of symbols]

[0059] 1: Search device 11: Reception 12: First input section 13: 1st memory section 14: Second input section 15:Second memory section 16: Generation part 17: Search Department 18:Third memory section 19: Output section 2: Workflow engine 3. AI for estimating fault locations 4: Operator terminal 5: Equipment information management DB 100: Exploration system 901:CPU 902: Memory 903: Storage 904: Communication equipment 905: Input device 906: Output device

Claims

1. A searching device for searching an investigation range of a fault occurring in a communication network, A generating unit that generates a graph that connects a plurality of devices within a certain investigation range including a suspected location of a fault using AI (Artificial Intelligence) based on a connection configuration of devices that constitute a communication network; a search unit that inputs the graph into a search model capable of searching an investigation range based on past failure records, and causes the search model to infer whether the investigation range of the graph should be expanded; The generation unit is If the scope of the graph is to be expanded, the search unit adds to the graph neighboring devices adjacent to devices in the graph.

2. The search unit is 2. The searching device according to claim 1, wherein fault isolation information by an operator is input to said search model during inference by said search model, and said inference is made using said fault isolation information.

3. The search unit is The searching device according to claim 1 , wherein the searching device repeats one or more times an inference as to whether the search range of the graph to which the adjacent device has been added should be further expanded depending on the results of a failure investigation based on alarm information from the communication network.

4. The search model is 2. The searching device according to claim 1, which is a graph neural network that has learned a search range to be isolated for past faults.

5. A method for searching an investigation range of a fault occurring in a communication network, comprising: The search device, A step of generating a graph that connects a plurality of devices within a certain investigation range including a suspected location of a fault by AI (Artificial Intelligence) based on a connection configuration of devices that constitute a communication network; inputting the graph into a search model capable of searching a search range based on past failure records, and having the search model infer whether the search range of the graph should be expanded; if the scope of the graph should be expanded, adding to the graph neighboring devices adjacent to devices in the graph; A discovery method that:

6. A search program that causes a computer to function as the search device according to any one of claims 1 to 4.

Images