Event information generating device, event information generating method, and event information generating program

Abstract

An event information generating device according to the present invention includes a grouping unit that performs clustering and grouping with respect to alarm information of a target network environment and alarm information of an existing similar network environment that is already-existing and is similar to the target network environment, and generates a cluster that is not similar in form but has the same meaning, and an event converting unit that converts existing event information of the existing similar network environment, using the cluster that is not similar in form but has the same meaning that is generated by the grouping unit, and generates new event information.

Description

[Technical Field]

[0001] The present invention relates to an event information generating device, an event information generating method, and an event information generating program. [Background technology]

[0002] To maintain network reliability, it is necessary to estimate the location of a failure and quickly carry out recovery work after a network failure occurs.One method for estimating the location of a failure in a network is to use rules created from past experience based on events that occur due to the failure. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-28778 Summary of the Invention [Problem to be solved by the invention]

[0004] In the method described above, maintenance personnel must compare the results of the rule-based judgment with the results of the troubleshooting that is the root cause to determine whether the judgment results are correct. This means that it takes time to generate rules for estimating the location of a fault, including event judgment and troubleshooting methods.

[0005] The present invention has been made in light of the above-mentioned circumstances, and its object is to provide an event information generation device, an event information generation method, and an event information generation program that generate event information for generating rules for estimating fault locations in a short period of time. [Means for solving the problem]

[0006] One aspect of the present invention is an event information generation device that generates new event information to be applied to a rule for estimating a failure location in a target network environment. The event information generation device performs clustering and grouping on alarm information of the target network environment and alarm information of an existing similar network environment that is similar to the target network environment, format The grouping part generates clusters that are dissimilar but have the same meaning, and the format The system has an event conversion unit that converts existing event information of an existing similar network environment by using clusters that are dissimilar but have the same meaning, and generates new event information.

[0007] One aspect of the present invention is Executing in the event information generating device: This is an event information generation method for generating new event information to be applied to a rule for estimating the location of a failure in a target network environment. The event information generation method performs clustering and grouping on alarm information of the target network environment and alarm information of existing similar network environments that are similar to the target network environment, format A process to generate clusters that are dissimilar but have the same meaning, and a process to generate clusters that are dissimilar but have the same meaning. format The method has a process of converting existing event information of an existing similar network environment by using clusters that are dissimilar but have the same meaning, and generating new event information.

[0008] One aspect of the present invention is an event information generation program that causes a processor included in the event information generation device to execute the processes performed by the grouping unit and the event conversion unit of the event information generation device. [Effects of the Invention]

[0009] According to the present invention, an event information generating device, an event information generating method, and an event information generating program are provided that generate event information for generating rules for estimating a failure location in a short period of time. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram illustrating an example of a hardware configuration of an event information generating device according to an embodiment. [Figure 2] FIG. 2 is a block diagram illustrating an example of a software configuration of the event information generating device according to the embodiment. [Figure 3] FIG. 3 is a diagram showing the flow of data within the event information generator shown in FIG. 2, and the flow of information between the event information generator and an existing similar network environment and a target network environment. [Figure 4] FIG. 4 is a flowchart showing the processing procedure and processing contents of the event information generating device shown in FIG. [Figure 5] FIG. 5 is a diagram schematically illustrating the transfer of learned event information by an operation example of the event information generating device according to the flowchart shown in FIG. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [One embodiment] (Configuration example) (Hardware configuration) First, an example of the hardware configuration of an event information generation device 1 according to an embodiment will be described with reference to Fig. 1. Fig. 1 is a block diagram showing an example of the hardware configuration of the event information generation device 1 according to an embodiment. In addition to the event information generation device 1, Fig. 1 also shows an existing similar network environment 2 and a target network environment 3.

[0012] The event information generation device 1 is configured by a computer such as a server computer or a personal computer. The event information generation device 1 has a control unit 10, a program storage unit 20, a data storage unit 30, and an input / output interface 40. The control unit 10, the program storage unit 20, the data storage unit 30, and the input / output interface 40 are connected to each other via a bus 50 so as to be able to communicate with each other.

[0013] The control unit 10 controls the event information generating device 1. The control unit 10 has a hardware processor such as a central processing unit (CPU).

[0014] The input / output interface 40 is an interface that enables information to be sent and received between the existing similar network environment 2 and the target network environment 3. The input / output interface 40 is, for example, a wireless communication interface. The event information generation device 1 can at least receive information from the existing similar network environment 2 and send and receive information to and from the target network environment 3 via a network such as a LAN or the Internet.

[0015] The program storage unit 20 is configured by combining, for example, a nonvolatile memory such as a hard disk drive (HDD) or a solid state drive (SSD) that can be written to and read from as needed as a storage medium, with a nonvolatile memory such as a read-only memory (ROM). The program storage unit 20 stores application programs required to execute various control processes of the event information generation device 1, in addition to middleware such as an operating system (OS).

[0016] The data storage unit 30 is configured by combining, for example, a nonvolatile memory such as an HDD or SSD as a storage medium that can be written to and read from at any time, and a volatile memory such as a RAM (Random Access Memory). It temporarily stores data required for various control processes of the event information generation device 1.

[0017] The similar existing network environment 2 has a function of transmitting information to the event information generation device 1. That is, the similar existing network environment 2 can pass information to the control unit 10 via the input / output interface 40.

[0018] The target network environment 3 has a function to receive information from the event information generation device 1 and a function to transmit information to the event information generation device 1. In other words, the target network environment 3 can exchange information with the control unit 10 via the input / output interface 40.

[0019] (Software configuration) Next, an example of the software configuration of the event information generation device 1 according to the embodiment will be described with reference to Fig. 2. Fig. 2 is a block diagram showing the software configuration of the event information generation device 1 according to the embodiment. In Fig. 2, in addition to the event information generation device 1, an existing similar network environment 2 and a target network environment 3 are also shown.

[0020] First, prior to describing the event information generating device 1, the existing similar network environment 2 and the target network environment 3 will be described.

[0021] The similar existing network environment 2 has rules for estimating the location of a failure in a network. These rules for estimating the location of a failure have already been learned and verified, and are therefore reliable rules. Hereinafter, these rules for estimating the location of a failure that have already been learned and verified will be simply referred to as learned rules. The learned rules have event information related to events related to network failures. An event is an occurrence that causes the occurrence of a network failure or a symptom of the occurrence. The learned rules estimate the location of a failure in the network based on the event information. The event information also includes alarm information. The alarm information is information related to the occurrence of a failure or a symptom.

[0022] The target network environment 3 is, for example, a network environment where a fault has occurred or is showing signs of occurring in the network, and where prompt recovery work is required. The target network environment 3 also has rules for estimating the location of the fault, event information, and alarm information.

[0023] The existing similar network environment 2 is a network environment similar to the target network environment 3. For example, the existing similar network environment 2 is similar to the target network environment 3 in terms of the network configuration, the network equipment, and the like.

[0024] Next, we will explain the event information generation device 1. The event information generation device 1 is a device that generates event information to be applied to rules for estimating the location of a failure in the target network environment 3. As described with reference to FIG. 1, the event information generation device 1 has a control unit 10, a program storage unit 20, a data storage unit 30, and an input / output interface 40.

[0025] The control unit 10 has a grouping unit 60 and an event conversion unit 70. The grouping unit 60 performs clustering and grouping on the alarm information of the similar existing network environment 2 and the alarm information of the target network environment 3 to generate clusters that are dissimilar in shape and format but have the same meaning. The event conversion unit 70 uses cluster information on the clusters generated by the grouping unit 60 to convert existing event information of the similar existing network environment 2 and generate new event information to be applied to rules for estimating the location of a failure in the target network environment 3.

[0026] The data storage unit 30 has a cluster information storage unit 31 and an event information storage unit 32. The cluster information storage unit 31 stores the cluster information generated by the grouping unit 60. The event information storage unit 32 stores the event information generated by the event conversion unit 70.

[0027] (Software configuration of grouping unit 60) The grouping unit 60 includes an existing event processing unit 61 , a data preprocessing unit 62 , a clustering processing unit 63 , a grouping processing unit 64 , and a data management processing unit 65 .

[0028] The existing event processing unit 61 acquires existing event information of the learned rules from the similar existing network environment 2, and extracts alarm information for event determination from the acquired event information of the similar existing network environment 2.

[0029] The data preprocessing unit 62 acquires alarm information of the similar existing network environment 2 from the existing event processing unit 61, and also acquires alarm information from the target network environment 3. The data preprocessing unit 62 performs preprocessing on the acquired alarm information of the similar existing network environment 2 and the alarm information of the target network environment 3. The preprocessing is a process of shaping the alarm information into data that is easy to cluster and group. This preprocessing includes processes such as data shaping (for example, data ranging and number conversion), morphological analysis, and vectorization (for example, one-hot vectorization).

[0030] The clustering processing unit 63 acquires the preprocessed alarm information for each of the similar existing network environment 2 and the target network environment 3 from the data preprocessing unit 62, and performs clustering on the acquired preprocessed alarm information in terms of shape and format. That is, the clustering processing unit 63 groups together data with similar shapes and formats from each of the preprocessed alarm information into the same cluster. For example, in clustering on shape and format, similarity is determined from a classification perspective using methods such as Euclidean distance and cosine distance. As a result, the clustering processing unit 63 generates clusters with similar shapes and formats for the alarm information for each of the similar existing network environment 2 and the target network environment 3.

[0031] The grouping processing unit 64 acquires the preprocessed alarm information and cluster information from the clustering processing unit 63, and based on the acquired information, performs semantic clustering on the preprocessed alarm information and clusters, resulting in grouping of alarm information and clusters that are dissimilar in shape and format but have the same meaning. That is, the grouping processing unit 64 groups together data from the preprocessed alarm information and clusters that are dissimilar in shape and format but have the same meaning into the same cluster. For example, in grouping, from the perspective of hierarchical clustering, methods such as Ward's method, group average method, and shortest distance method are used to calculate distances to determine whether the data are similar. As a result, the grouping processing unit 64 generates clusters that are dissimilar in shape and format but have the same meaning.

[0032] The data management processing unit 65 acquires cluster information about the clusters generated by the grouping processing unit 64, and stores and manages the acquired cluster information. As part of the storage and management process, the data management processing unit 65 stores the acquired cluster information in the cluster information storage unit 31.

[0033] (Software Configuration of Event Converter 70) The event conversion unit 70 includes an event conversion processing unit 71 and an event management processing unit 72 .

[0034] The event conversion processing unit 71 acquires existing event information from the similar existing network environment 2. The event conversion processing unit 71 also acquires cluster information from the cluster information storage unit 31. The event conversion processing unit 71 uses the acquired cluster information to convert the event information of the similar existing network environment 2. For example, the event conversion processing unit 71 recognizes that the alarm information of the similar existing network environment 2 and the target network environment 3, which belong to the same cluster, is the same, and rewrites the event information of the similar existing network environment 2 based on this recognition. The event conversion processing unit 71 generates the rewritten event information as new event information to be applied to the rules for estimating the location of a failure in the target network environment 3.

[0035] The event management processing unit 72 acquires new event information from the event conversion processing unit 71, and stores and manages the acquired new event information. As part of the storage and management process, the event management processing unit 72 stores the new event information in the event information storage unit 32. The event management processing unit 72 also transmits the new event information to the target network environment 3.

[0036] (Means for realizing the grouping unit 60 and the event conversion unit 70) Each processing unit of the grouping unit 60, i.e., the existing event processing unit 61, the data pre-processing unit 62, the clustering processing unit 63, the grouping processing unit 64, and the data management processing unit 65, and each processing unit of the event conversion unit 70, i.e., the event conversion processing unit 71 and the event management processing unit 72, are realized by the hardware processor of the control unit 10 executing the event information generation program stored in the program memory unit 20.

[0037] (Example of operation) Next, an example of the operation of the event information generation device 1 configured as above will be described with reference to Figures 3 and 4. Figure 3 is a diagram showing the flow of data within the event information generation device 1 and the flow of information between the event information generation device 1 and the existing similar network environment 2 and the target network environment 3.

[0038] The operation example described below is an operation performed by the control unit 10 of the event information generation device 1 under the control of the grouping unit 60, event conversion unit 70, data storage unit 30, existing similar network environment 2, and target network environment 3.

[0039] The operation of the event information generation device 1 is initiated when a failure occurs in the target network environment 3. Here, it is assumed that the environment is as follows: The occurrence of a failure in the target network environment 3 is notified to the event information generation device 1 by a device or the like (not shown). The event information generation device 1 is provided with information on the existing similar network environment 2 that corresponds to the target network environment 3. The event information generation device 1 begins operation upon receiving notification of the occurrence of a failure in the target network environment 3.

[0040] In the operation described below, steps S11 to S15 are processes executed by the grouping section 60, and steps S16 to S20 are processes executed by the event conversion section .

[0041] (Operation of grouping unit 60) After the event information generation device 1 starts operating, first, in step S11, the existing event processing unit 61 acquires existing event information of learned rules from the existing similar network environment 2. Next, the existing event processing unit 61 extracts alarm information for event determination from the acquired event information of the existing similar network environment 2. The existing event processing unit 61 passes the extracted alarm information to the data preprocessing unit 62.

[0042] Next, in step S12, the data pre-processing unit 62 acquires alarm information for the similar existing network environment 2 from the existing event processing unit 61. The data pre-processing unit 62 also acquires alarm information from the target network environment 3. Next, the data pre-processing unit 62 performs pre-processing on the alarm information for the similar existing network environment 2 and the alarm information for the target network environment 3, and formats the data into data that is easy to cluster and group. The data pre-processing unit 62 passes the pre-processed alarm information to the clustering processing unit 63.

[0043] Next, in step S13, the clustering processing unit 63 acquires the preprocessed alarm information of the similar existing network environment 2 and the target network environment 3 from the data preprocessing unit 62. Next, the clustering processing unit 63 performs clustering on the alarm information of the similar existing network environment 2 and the alarm information of the target network environment 3 in terms of shape and format. That is, the clustering processing unit 63 groups together data with similar shapes and formats among the alarm information of the similar existing network environment 2 and the target network environment 3 into the same cluster. As a result, the clustering processing unit 63 generates clusters with similar shapes and formats for the alarm information of the similar existing network environment 2 and the alarm information of the target network environment 3. The clustering processing unit 63 passes cluster information on the generated clusters to the grouping processing unit 64.

[0044] Next, in step S14, the grouping processing unit 64 acquires the preprocessed alarm information and cluster information from the clustering processing unit 63. Next, based on the acquired information, the grouping processing unit 64 performs a second clustering of the preprocessed alarm information and clusters in terms of meaning. That is, the grouping processing unit 64 groups data with the same meaning in the preprocessed alarm information and clusters into the same cluster. In this way, the grouping processing unit 64 groups alarm information and clusters that are different in shape and format but have the same meaning. As a result, the grouping processing unit 64 generates grouped clusters that are different in shape and format but have the same meaning. In this way, the grouping processing unit 64 performs mapping of alarm information with the same meaning for the existing similar network environment 2 and the target network environment 3 through clustering and grouping. The grouping processing unit 64 passes cluster information on the grouped clusters to the data management processing unit 65.

[0045] Subsequently, in step S15, the data management processing unit 65 acquires cluster information from the grouping processing unit 64, and stores and manages the acquired cluster information. As part of the storage and management process, the data management processing unit 65 stores the cluster information related to the clusters after grouping in the cluster information storage unit 31.

[0046] (Operation of the event converter 70) Next, in step S16, the event conversion processing unit 71 acquires existing event information of the learned rules from the existing similar network environment 2. The event conversion processing unit 71 also acquires cluster information about the clusters after grouping from the cluster information storage unit 31. Next, the event conversion processing unit 71 compares the cluster information about the clusters after grouping with the existing event information of the learned rules.

[0047] Next, in step S17, the event conversion processing unit 71 uses the cluster information to rewrite the event information of the similar existing network environment 2. For example, the event conversion processing unit 71 recognizes that the alarm information of the similar existing network environment 2 and the alarm information of the target network environment 3, which belong to a cluster with the same meaning but different shapes and formats, are the same, and based on this recognition, rewrites the existing event information of the similar existing network environment 2. That is, the event conversion processing unit 71 rewrites the alarm information of the existing event information of the similar existing network environment 2 with the alarm information of the target network environment 3, which belongs to a cluster with the same meaning but different shapes and formats.

[0048] Next, in step S18, the event conversion processing unit 71 generates the rewritten event information as a new event to be applied to the target network environment 3. The event conversion processing unit 71 passes the generated new event to the event management processing unit 72.

[0049] Subsequently, in step S19, the event management processing unit 72 acquires new event information from the event conversion processing unit 71, and stores and manages the acquired new event information. As part of the storage and management process, the event management processing unit 72 stores the new event information in the event information storage unit 32.

[0050] Next, in step S20, the event management processing unit 72 transmits the new event information to the target network environment 3. The target network environment 3 applies the received new event information to the rules for estimating the location of a failure.

[0051] (Transfer of Learned Event Information in Operation Example of Event Information Generation Device 1) FIG. 5 schematically illustrates the transfer of learned event information through mapping of alarm information in the exemplary operation of the event information generation device 1 described above. In FIG. 5, environment A represents the existing similar network environment 2, and environment B represents the target network environment 3. In the example of FIG. 5, environment A has two learned event information items (events A-1 and A-2), the learned event information item (event A-1) has alarm information items (alarms A, B, and C), and the learned event information item (event A-2) has alarm information items (alarms B, D, and E). Meanwhile, environment B has alarm information items (alarms A', B', and C'; alarms B', D', and E') that respectively correspond to the alarm information items (alarms A, B, and C; alarms B, D, and E) of environment A.

[0052] FIG. 5 shows how the event information and alarm information change according to the processing described below.

[0053] (1) Clustering By clustering based on shape and format, the alarm information (alarms A, B, C) of learned event information A-1 in environment A and the alarm information (alarms B, D, E) of learned event information A-2 are classified into five clusters (alarms A, B, C, D, E), and the alarm information (alarms A', B', C', alarms B', D', E') of environment B are classified into five clusters (alarms A', B', C', D', E').

[0054] (2) Grouping Through semantic clustering and grouping, the clusters from Environment A (Alarms A, B, C, D, E) and Environment B (Alarms A', B', C', D', E') are grouped into five clusters with different shapes and formats but the same meaning (Alarms A, A'; B, B'; C, C'; D, D'; E, E').

[0055] (3) Rewriting and application Based on the recognition that two pieces of alarm information belonging to each of the five clusters (alarms A,A'; B,B'; C,C'; D,D'; E,E') are the same, alarm information (alarms A,B,C,D,E) is rewritten to alarm information (alarms A',B',C',D',E'). Furthermore, based on the rewritten alarm information (alarms A',B',C',D',E'), new event information (rewritten learning event B-1) having alarm information (alarms A',B',C') and new event information (rewritten learning event B-2) having alarm information (alarms B',D',E') are generated for environment B.

[0056] (Actions and Effects) The embodiment described above uses reliable event information that has already been learned from rules for estimating the location of a failure in an existing similar network environment 2 that is similar to the target network environment 3, and generates new event information to be applied to generating rules for estimating the location of a failure in the target network environment 3, for the target network environment 3 where a failure has occurred or is showing signs of occurring in the network. The generation of this new event information by the event information generation device 1 does not require a maintenance person to make a judgment on the rule judgment results or the failure response results.

[0057] As a result, one embodiment makes it possible to generate rules for estimating a failure location, including event judgment and response methods, in a short period of time. That is, one embodiment provides an event information generation device, an event information generation method, and an event information generation program that generate event information for generating rules for estimating a failure location in a short period of time.

[0058] The present invention is not limited to the above-described embodiments, and various modifications can be made in the implementation stage without departing from the spirit of the invention. Furthermore, the embodiments may be implemented in appropriate combinations, in which case the combined effects can be obtained. Furthermore, the above-described embodiments include various inventions, and various inventions can be extracted by combining selected elements from the disclosed elements. For example, if the problem can be solved and the desired effect can be obtained even if some elements are deleted from all elements shown in the embodiments, the configuration from which these elements are deleted can be extracted as an invention. [Explanation of symbols]

[0059] 1...Event information generating device 2...Existing similar network environment 3. Target network environment 10...Control unit 20...Program memory section 30...Data storage unit 31...Cluster information storage unit 32...Event information storage unit 40...Input / output interface 50...Bus 60...Grouping section 61...Existing event processing section 62...Data preprocessing section 63...Clustering processing unit 64...Grouping processing unit 65...Data management processing section 70...Event conversion section 71...Event conversion processing unit 72...Event management processing unit

Claims

1. An event information generation device for generating new event information to be applied to a rule for estimating a failure location in a target network environment, comprising: a grouping unit that performs clustering and grouping on the alarm information of the target network environment and the alarm information of an existing similar network environment that is similar to the target network environment, and generates clusters that have different formats but the same meaning; an event conversion unit that converts existing event information of the existing similar network environment by using the clusters that have different formats but the same meaning generated by the grouping unit, and generates the new event information; Event information generating device.

2. The grouping unit an existing event processing unit that acquires existing event information of a learned rule for estimating a failure location in the existing similar network environment, and extracts alarm information of the existing similar network environment from the acquired existing event information; a clustering processing unit that performs clustering on the alarm information of each of the existing similar network environment and the target network environment in terms of the format, and generates clusters having similar formats; a grouping processing unit that performs clustering and grouping on the clusters having similar formats generated by the clustering processing unit in terms of meaning, and generates clusters having dissimilar formats but the same meaning; The event information generating device according to claim 1 .

3. the grouping unit further includes a data preprocessing unit that converts alarm information of the existing similar network environment and the target network environment into data that is easy to cluster and group by the clustering processing unit and the grouping processing unit; The event information generating device according to claim 2 .

4. the event conversion unit acquires existing event information of the existing similar network environment, and also acquires the clusters having dissimilar formats but the same meaning generated by the grouping unit, and converts the existing event information of the existing similar network environment using the clusters having dissimilar formats but the same meaning. The event information generating device according to claim 1 .

5. the event conversion processing unit recognizes that the alarm information of the existing similar network environment and the target network environment, which belong to clusters having different formats but the same meaning, is the same, rewrites the existing event information of the existing similar network environment, and generates the rewritten event information as the new event information. The event information generating device according to claim 4 .

6. the event conversion processing unit rewrites alarm information of the existing event information of the existing similar network environment with alarm information of the target network environment that belongs to a cluster having a dissimilar format but the same meaning; The event information generating device according to claim 5 .

7. An event information generation method executed in an event information generation device, for generating new event information to be applied to a rule for estimating a failure location in a target network environment, comprising: A process of performing clustering and grouping on the alarm information of the target network environment and the alarm information of an existing similar network environment that is similar to the target network environment, to generate clusters that have different formats but the same meaning; converting existing event information of the existing similar network environment using the generated clusters that have different formats but have the same meaning, and generating the new event information; Event information generation method.

8. a processor included in the event information generating device is caused to execute the processes of the grouping unit and the event conversion unit of the event information generating device according to claim 1; Event information generator.

Images