Anomaly location estimation device, anomaly location estimation method, and program

Abstract

Provided is an anomaly site inference apparatus that infers an anomaly site in a communication network having a plurality of devices, said anomaly site inference apparatus comprising: an observation data collection unit that collects logs which are produced from a second device and which indicate that communication with a first device has become impossible; and a causal model inference unit that, in a causal model comprising device nodes which represent the state of each device and observation nodes which represent an observation result for each device, determines an input value for an observation node corresponding to the first device on the basis of the logs, and infers an anomaly site from the causal model in which the determined input value has been applied.

Description

[Technical Field]

[0001] The present invention relates to a technique for estimating an abnormality in a communication network from logs collected from the communication network. [Background technology]

[0002] For telecommunications carriers, it is important to understand the status of anomalies and respond quickly to any anomalies that occur within their communication networks. In this context, research is being conducted on early detection of anomalies within communication networks and on estimating the location of anomalies.

[0003] As a method for estimating the location of an anomaly, a method has been proposed in which a Bayesian network is used to model (called a causal model) the relationship between the anomaly location and the changes in data (called observed data) within the communication network caused by it, and the anomaly location is estimated from the observed data at the time of the anomaly (Non-Patent Document 1).

[0004] The communication network is operated using Interior Gateway Protocol (IGP) communication protocols, such as iBGP (https: / / datatracker.ietf.org / doc / html / rfc4271) and OSPF (https: / / datatracker.ietf.org / doc / html / rfc5340), which handle routing within an Autonomous System (AS). When communication between routers becomes impossible, a syslog is generated indicating that communication with the opposing router is no longer possible. In the event of an abnormality, an expert operator can use the syslog regarding link down generated from the router to determine whether the router is operating normally or abnormally.

[0005] In conventional technology, based on the knowledge of expert operators and the assumption that a router abnormality only affects the observation data of the router that has become abnormal and the observation data of adjacent routers, a causal model is constructed for devices within a communications network, consisting of device nodes that represent the status of each device and observation nodes that indicate whether a syslog related to a link down has been generated from that device, and the location of the abnormality is determined. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] Srikanth Kandula, Dina Katabi, and Jean-philippe Vasseur. Shrink: A tool for failure diagnosis in IP networks. Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data, pages 173-178, 2005. Summary of the Invention [Problem to be solved by the invention]

[0007] In conventional technology, a causal model was created based on the assumption that a router abnormality only affects the observation data of the abnormal router and the observation data of adjacent routers. However, in the case of an abnormality in a communication network, a router that has become abnormal may not be able to generate a syslog indicating a link down.

[0008] For example, if a CPU chip fails, the router where the failure occurred will no longer be able to process programs, and will therefore no longer be able to generate a syslog. As a result, with conventional technology, the input (observation data) to the causal model may contradict the assumption (a syslog related to a link down is generated from an adjacent router, but no syslog is generated from an abnormal router), resulting in a problem of reduced accuracy in estimating the location of the abnormality.

[0009] The present invention has been made in consideration of the above points, and aims to improve the accuracy of estimating an abnormality location in a technology for estimating an abnormality location in a communication network by using logs collected from the communication network. [Means for solving the problem]

[0010] According to the disclosed technology, there is provided an anomaly location estimation device that estimates an anomaly location in a communication network having a plurality of devices, the anomaly location estimation device comprising: an observation data collection unit that collects logs generated from the second device indicating that communication with the first device has become impossible; a causal model inference unit that determines an input value to an observation node corresponding to the first device based on the log in a causal model consisting of a device node representing the state of each device and an observation node representing the observation result of each device, and infers an abnormality location from a causal model to which the determined input value is applied; An abnormality location estimation device comprising the above is provided. [Effects of the Invention]

[0011] According to the disclosed technology, it is possible to improve the accuracy of estimating an abnormality location in a technology for estimating an abnormality location in a communication network by using logs collected from the communication network. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a configuration diagram of an abnormality location estimation device. [Figure 2] FIG. 2 illustrates an example of a hardware configuration of the apparatus. [Figure 3] FIG. 1 is a diagram illustrating an example of the configuration of a communication network. [Figure 4] FIG. 1 is a diagram illustrating a causal model. [Figure 5] FIG. 1 illustrates inputs to a causal model. [Figure 6] FIG. 1 illustrates inputs to a causal model. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0014] (Device configuration example) 1 shows an example of the configuration of an abnormality location estimating device 100 according to this embodiment. As shown in Fig. 1, the abnormality location estimating device 100 includes a causal model construction engine 110, a causal model inference engine 120, an observation data collection engine 130, an observation data DB 140, and an output interface 150.

[0015] The causal model construction engine 110, the causal model inference engine 120, and the observation data collection engine 130 may also be referred to as the causal model construction unit 110, the causal model inference unit 120, and the observation data collection unit 130, respectively. Furthermore, the causal model construction engine 110, the causal model inference engine 120, and the observation data collection engine 130 may also be referred to as the causal model construction circuit 110, the causal model inference circuit 120, and the observation data collection circuit 130, respectively. An overview of the operation of the anomaly location estimation device 100 is as follows.

[0016] The observation data collection engine 130 collects observation data (such as logs generated by devices) from the communication network and stores the occurrence status of logs related to link down in the observation data DB 140. Hereinafter, in this embodiment, a syslog will be described as an example of a log.

[0017] The causal model construction engine 110 takes expert knowledge and the like as input and constructs a causal model based on communication network information acquired from the observation data collection engine 130. The causal model inference engine 120 determines the value of the observation node based on the occurrence status of syslogs related to link downs stored in the observation data DB 140, estimates the location of the anomaly, and outputs the estimated result of the anomaly location to the output interface 150.

[0018] The output interface 150 displays to the user the location of an anomaly in the communication network and the maximum a posteriori probability at that time, etc. Furthermore, when a new machine is added to the operational system, the output interface 150 can add a node to the causal graph and also allow the user to correct any changes in the causal relationships that result from this.

[0019] (Example of hardware configuration) The abnormality point estimating device 100 can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0020] That is, the anomaly location estimating device 100 can be realized by using hardware resources such as a CPU and memory built into a computer to execute a program corresponding to the processing performed by the anomaly location estimating device 100. The program can be recorded on a computer-readable recording medium (such as a portable memory) and can be saved or distributed. The program can also be provided via a network such as the Internet or email.

[0021] Fig. 2 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 2 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected by a bus BS.

[0022] A program for realizing processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0023] The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes functions related to the anomaly location estimation device 100 in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like according to the program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the calculation results.

[0024] (Example of operation) The operation of the anomaly location estimating device 100 will be described below using a more specific example. Note that, although a communication network configured with routers is shown in this embodiment, this is merely an example. The present invention is applicable regardless of the type of nodes that configure the communication network.

[0025] <About causal models> 3 shows an example of a communication network from which the observation data collection engine 130 collects observation data. As shown in FIG. 3, this communication network is a network in which routers 1 to 6 are connected as shown. For example, router 1 and router 2 are directly connected and are adjacent to each other. Router 1 and router 4 are not directly connected and are not adjacent to each other.

[0026] The causal model construction engine 110 constructs the causal model shown in Figure 4 for the communication network shown in Figure 3 based on the knowledge of an expert operator, etc. The causal model consists of device nodes that represent the status of each device (router) in the communication network, and observation nodes that represent whether a syslog related to link down has been generated from that device. In other words, the observation nodes represent the observation results of each device. The causal model may also be called a Bayesian network.

[0027] The causal model for the communication network in Figure 3 is as shown in Figure 4. For example, in the causal model in Figure 4, Router 1, which is an equipment node, is connected to Routers 1 and 2, which are observation nodes. This indicates that if an abnormality occurs in Router 1, it may affect the observation data of Router 1 and the observation data of Router 2.

[0028] Also, for example, in the causal model of Figure 4, Router 2, which is an equipment node, is connected to Routers 1, 2, 3, and 6, which are observation nodes. This indicates that if an abnormality occurs in Router 2, it may affect the observation data of Routers 1, 2, 3, and 6.

[0029] <Input to the causal model> In this embodiment, the accuracy of estimating anomaly locations is improved by defining the input to the observation node of the causal model taking into account the contents of the syslog generated by the IGP protocol. The details are as follows.

[0030] In this embodiment, the IGP protocols iBGP and OSPF are used as examples, but the present invention can be applied to other protocols as well. In addition, in this embodiment, the syslog generated by iBGP and OSPF is used as an example. However, in monitoring a communication network, messages and the like may be normalized based on the generated syslog to generate a new log and notify the operator, or a tool such as ping may be used to perform alive monitoring, and the results may be notified to the operator as an alarm. In such cases, the technology according to the present invention can be applied as long as the alarm message contains information about the opposing router (the other router adjacent to a certain router).

[0031] First, we will explain the syslog for iBGP and OSPF. In iBGP and OSPF, a syslog is generated when a router cannot communicate with an adjacent router due to an abnormality in the communication network. An example of a syslog message is shown below.

[0032] 2021-12-21 13:00:00 Router1 192.168.10.1 OSPF neighbor down (Router2 192.168.10.2) Although syslogs vary depending on the iBGP / OSPF version and alarms generated by processing the iBGP / OSPF syslog, as shown above, they contain information such as a timestamp, host name, host information (IP address, etc.), and information about the opposing router that has lost communication (host name and IP address of the opposing router, etc.).

[0033] In this embodiment, the problem is solved by defining the value of the observation node based on the information of the opposing router.

[0034] Here, the device node in the causal model of the system (communication network) that is the target of anomaly location estimation is denoted by x i , the observation node is y i , i∈(1,…N), where N is the number of devices.

[0035] each xi takes on the value of 0 (normal state) or 1 (abnormal state). Note that instead of the two values of 0 or 1, it can also take on three or more values, in which case the minimum value is the normal state, the maximum value is the abnormal state, and any value c between them is defined as a value that indicates abnormality at the rate of "c / (maximum value - minimum value)".

[0036] Each y i takes the value of 0 or 1, and if a BGP / OSPF syslog indicating that communication with the i-th router has been lost occurs on a router other than the i-th router, y i is set to 1, and otherwise to 0. Note that instead of the two values 0 and 1, it is also possible to have three or more values, in which case the value is defined as the number of syslog entries at other nodes related to link down of the i-th router.

[0037] The input values to the above causal model are determined (calculated) by the causal model inference engine 120 from the syslog read from the observation data DB 140. Alternatively, the observation data collection engine 130 may determine the input values from the collected syslog and store them in the observation data DB 140. In this case, the causal model inference engine 120 calculates the values read from the observation data DB 140 as y i can be used as the value of

[0038] Regarding input to the causal model, the difference between the prior art (Non-Patent Document 1) and the technology according to the present invention will be explained using Figures 5 and 6. Here, we will explain the input to the observation node when a syslog indicating that communication with the opposing router (router 2) is not possible is generated in routers 1, 3, and 6. In the observation nodes in Figures 5 and 6, shaded nodes indicate a value of 1 (abnormal state), and unshaded nodes indicate a value of 0 (normal state).

[0039] Figure 5 shows the input to the causal model in the conventional technology. As shown in Figure 5, the input value as the observation node for routers 1, 3, and 6, which observed the syslog, is 1, and the input value as the observation node for router 2, which is considered to have a high possibility of an abnormality, is 0.

[0040] Figure 6 shows the input to the causal model in the technology according to the present invention. As shown in Figure 6, the input values for Routers 1, 3, and 6, which observed the syslog, as observation nodes are 0, and the input value for Router 2, which is considered to have a high probability of an abnormality occurring, as an observation node is 1. In this way, it is possible to obtain input values that match the event that is likely to have actually occurred, thereby improving estimation accuracy.

[0041] <Inference using causal models> The inference using the causal model itself is the same as the prior art (e.g., Non-Patent Document 1), and the prior probability P(x i ) and the conditional probability P(y j |x i ) and perform inference. Below, we will explain the outline of inference processing using a causal model.

[0042] 4 (information indicating which nodes are to be connected by edges) is created by the causal model construction engine 110 based on information obtained from the communication network, and is passed to the causal model inference engine 120. Note that the causal model (information indicating which nodes are to be connected by edges) may be created in advance and stored in a storage unit (memory, etc.) provided in the causal model inference engine 120.

[0043] Prior probability P(x i ) is determined in advance and stored in a storage unit (memory or the like) included in the causal model inference engine 120, for example.

[0044] where X=(x i ,x2,…,x N ),x i ∈{0,1}, Y=(y i ,y2,…,y N ),yi ∈{0,1}. X is the device node, i.e., the estimation target, and Y is the observation node, i.e., the value of the observation result obtained based on the log.

[0045] The causal model estimation engine 120 uses the observation results (input value Y to the causal model) to find X' shown in the following equation: In the following equation, argmax is the argmax for X, and X' is X that maximizes the posterior probability P(X|Y).

[0046] X'=argmaxP(X|Y)=argmax(P(Y|X)P(X)) Conditional probability P(y j For example, the calculation of |X) is performed for the observation node y j If the status of all device nodes connected to is normal, the observation node y j The probability that the observed node y j If the status of only some of the device nodes connected to the observation node y is normal, j The calculation may be performed by any method that can calculate that the probability ... is 0 (normal) is a value that depends on the number of normal device nodes out of all device nodes.

[0047] Regarding the estimation results obtained by the causal model estimation engine 120, the output interface 150 may output a device with a value of 1 as the estimated fault location, or may output a link between a device with a value of 1 and an opposing device connected to that device as the estimated fault location.

[0048] (About the effects) As shown above, when a log occurs on another router indicating that communication with a router i is not possible, the input value (y i Therefore, even if the i-th router goes into an abnormal state and is unable to generate a syslog related to the link down, it is possible to estimate the location of the abnormality using information from the opposite router that is in a normal state, thereby improving the accuracy of estimating the location of the abnormality.

[0049] (Addendum) The following additional clauses are disclosed in relation to the above-described embodiment. (Additional note 1) An anomaly location estimation device that estimates an anomaly location in a communication network having a plurality of devices, Memory and at least one processor coupled to said memory; Including, The processor: Collecting logs from the second device that indicate an inability to communicate with the first device; In a causal model consisting of a device node representing the state of each device and an observation node representing the observation result of each device, an input value to the observation node corresponding to the first device is determined based on the log, and an abnormality location is estimated from the causal model to which the determined input value is applied. Anomaly location estimation device. (Additional note 2) The processor determines a value indicating an abnormality as an input value to an observation node corresponding to the first device. Item 1. An abnormality location estimation device. (Additional note 3) An anomaly location estimation method executed by a computer used as an anomaly location estimation device that estimates an anomaly location in a communication network having a plurality of devices, comprising: Collecting logs from the second device that indicate an inability to communicate with the first device; In a causal model consisting of a device node representing the state of each device and an observation node representing the observation result of each device, an input value to the observation node corresponding to the first device is determined based on the log, and an abnormality location is estimated from the causal model to which the determined input value is applied. Method for estimating abnormality locations. (Additional note 4) A non-transitory storage medium storing a program for causing a computer to execute each process in the abnormality location estimation device according to appended claim 1 or 2.

[0050] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0051] 100 Abnormality location estimation device 110 Causal Model Building Engine 120 Causal Model Inference Engine 130 Observation data collection engine 140 Observation Data DB 150 output interface 1000 Drive Device 1001 Recording media 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output Device

Claims

1. An anomaly location estimation device that estimates an anomaly location in a communication network having a plurality of devices, an observation data collection unit that collects logs generated from the second device indicating that communication with the first device has become impossible; a causal model inference unit that determines an input value to an observation node corresponding to the first device based on the log in a causal model consisting of a device node representing the state of each device and an observation node representing the observation result of each device, and infers an abnormality location from a causal model to which the determined input value is applied; An abnormality location estimation device comprising:

2. The causal model inference unit determines a value indicating an abnormality as an input value to an observation node corresponding to the first device. The abnormality location estimation device according to claim 1 .

3. An anomaly location estimation method executed by a computer used as an anomaly location estimation device that estimates an anomaly location in a communication network having a plurality of devices, comprising: collecting a log generated from the second device indicating that communication with the first device has been lost; In a causal model consisting of a device node representing the state of each device and an observation node representing the observation result of each device, an input value to the observation node corresponding to the first device is determined based on the log, and an abnormality location is estimated from the causal model to which the determined input value is applied. Method for estimating abnormality locations.

4. A program for causing a computer to function as each unit in the abnormality location estimation device according to claim 1 or 2.

Images