Abnormality management device and abnormality management method

Abstract

The purpose is to make it easier to manage program operation abnormalities. [Solution] The abnormality management device 1 includes a second learning unit 12 configured to learn a generative model including the generator 121 and the classifier 122 by updating only the classifier parameters of the classifier 122 that distinguishes between true normal data and pseudo-normal data in a direction that maximizes an objective function based on the probability distribution of normal data and the probability distribution of abnormal data determined from the ratio estimated by the first learning unit, while keeping the generator parameters of the generator 121 that generates pseudo-normal data that is sufficiently deviated from the distribution of true normal data, using the usage amount of normal processing resources used in the execution of processes corresponding to each of a plurality of process IDs as true normal data.

Description

[Technical Field]

[0001] The present invention relates to an abnormality management device and an abnormality management method. [Background technology]

[0002] In recent years, the demands on software have become more sophisticated and complex in order to provide high-performance systems and services. The software implemented in high-performance systems consists of programs with huge amounts of source code, and the execution of these programs is becoming increasingly complex.

[0003] When a process failure or an abnormal operation occurs in an operating system, identifying the cause of the program failure or abnormal operation is complicated, time-consuming, and not easy. For example, Patent Document 1 discloses a method for using a core file to retroactively identify the location of the error and the variable values ​​at the time.

[0004] However, the technology disclosed in Patent Document 1 requires analysis of the source code because it is not possible to identify the cause or location of an error from log information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2005-301570 Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, conventional techniques have not made it possible to more easily manage program operation anomalies.

[0007] The present invention has been made to solve the above-mentioned problems, and has an object to more easily manage abnormal program operation. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, the abnormality management device of the present invention includes a first learning unit configured to learn a parameter representing a ratio between a probability distribution of normal data indicating normal processing resource usage amounts used in the execution of processes corresponding to each of a plurality of process IDs and a probability distribution of abnormal data indicating processing resource usage amounts used in the execution of processes corresponding to each of a plurality of process IDs including abnormal processing resource usage amounts that deviate from the range of normal processing resource usage amounts, and to estimate the ratio based on the learned parameter; and a first learning unit configured to estimate pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, using the normal processing resource usage amounts used in the execution of processes corresponding to each of the plurality of process IDs as true normal data. a second learning unit configured to learn a generative model including the generator and the classifier by updating only a classifier parameter of a classifier that distinguishes between the true normal data and the pseudo-normal data in a direction that maximizes an objective function based on the probability distribution of the normal data and the probability distribution of the abnormal data determined from the ratio estimated by the first learning unit, while keeping fixed a generator parameter of the generator that generates the pseudo-normal data; a generation unit configured to make the generator included in the trained generative model constructed by the second learning unit generate the pseudo-normal data; and a threshold setting unit configured to set a threshold for determining abnormal operation of the process, based on the pseudo-normal data generated by the generator included in the trained generative model.

[0009] In addition, in the abnormality management device of the present invention, the threshold setting unit may further include a feature extraction unit including: a first feature extraction unit configured to extract a feature direction of the normal data based on a data matrix consisting of a plurality of observation vectors representing the normal data indicating the usage of the normal processing resources used in executing the processes corresponding to each of the plurality of process IDs; and a second feature extraction unit configured to extract a feature direction of the pseudo-normal data based on a data matrix consisting of a plurality of observation vectors representing the pseudo-normal data generated by the generator provided in the trained generative model; a calculation unit configured to calculate a first index value indicating the spatial coincidence formed between the feature direction of the normal data and the feature direction of the pseudo-normal data; and a setting unit configured to set the first index value calculated by the calculation unit as the threshold.

[0010] In addition, the abnormality management device of the present invention may further include a collection unit configured to collect the normal data indicating the usage of the normal processing resources used in executing the processes corresponding to each of the plurality of process IDs and the abnormal data indicating the usage of the processing resources used in executing the processes corresponding to each of the plurality of process IDs including the usage of the abnormal processing resources, and the first learning unit may learn the parameters based on the normal data and the abnormal data collected by the collection unit.

[0011] In addition, in the abnormality management device of the present invention, the collection unit may collect the usage of processing resources used in the execution of managed processes corresponding to each of a plurality of process IDs, and may further include a determination unit configured to determine that an operational abnormality has occurred in the managed process when the usage of processing resources used in the execution of the managed process exceeds the threshold value.

[0012] Furthermore, in the abnormality management device according to the present invention, the collection unit collects first data indicating usage of processing resources used in executing the managed processes corresponding to each of the plurality of process IDs, observed at a first time, and second data indicating usage of processing resources used in executing the managed processes corresponding to each of the plurality of process IDs, observed at a second time after the first time; the feature extraction unit extracts characteristic directions of the first data and characteristic directions of the second data, based on a first data matrix consisting of observation vectors representing the first data and a second data matrix consisting of observation vectors representing the second data; the calculation unit calculates a second index value indicating a spatial coincidence formed between the extracted characteristic directions of the first data and the extracted characteristic directions of the second data; and the determination unit may determine that an operational abnormality occurred in the managed process at the second time if the second index value calculated by the calculation unit exceeds the threshold value.

[0013] In addition, the abnormality management device of the present invention may further include an instruction unit configured to send an instruction to execute a predetermined response to resolve the operational abnormality of the process when the judgment unit determines that an operational abnormality has occurred in the process being managed.

[0014] In order to solve the above-mentioned problems, the anomaly management method of the present invention includes a first learning step of learning parameters representing a ratio between a probability distribution of normal data indicating normal processing resource usage amounts used in the execution of processes corresponding to each of a plurality of process IDs and a probability distribution of abnormal data indicating processing resource usage amounts used in the execution of processes corresponding to each of a plurality of process IDs including abnormal processing resource usage amounts that deviate from the range of normal processing resource usage amounts, and estimating the ratio based on the learned parameters; and a second learning step of estimating a pseudo-normal data distribution that is sufficiently deviated from the distribution of the true normal data, using the normal processing resource usage amounts used in the execution of processes corresponding to each of the plurality of process IDs as true normal data. The method includes a second learning step of learning a generative model including the generator and the classifier by updating only the classifier parameters of the classifier that distinguishes between the true normal data and the pseudo-normal data in a direction that maximizes an objective function based on the probability distribution of the normal data and the probability distribution of the abnormal data determined from the ratio estimated in the first learning step, while keeping the generator parameters of the generator that generates normal data fixed; a generation step of causing the generator included in the trained generative model constructed in the second learning step to generate the pseudo-normal data; and a threshold setting step of setting a threshold for determining abnormal operation of the process based on the pseudo-normal data generated by the generator included in the trained generative model.

[0015] In addition, in the anomaly management method according to the present invention, the threshold setting step may further include a feature extraction step including: a first feature extraction step of extracting a feature direction of the normal data based on a data matrix consisting of a plurality of observation vectors representing the normal data indicating the usage of the normal processing resources used in executing the processes corresponding to each of the plurality of process IDs; and a second feature extraction step of extracting a feature direction of the pseudo-normal data based on a data matrix consisting of a plurality of observation vectors representing the pseudo-normal data generated by the generator included in the trained generative model; a calculation step of calculating a first index value indicating the spatial coincidence formed between the feature direction of the normal data and the feature direction of the pseudo-normal data; and a setting step of setting the first index value calculated in the calculation step as the threshold.

[0016] In addition, the abnormality management method of the present invention may further include a collection step of collecting the normal data indicating the usage of the normal processing resources used in executing a process corresponding to each of the plurality of process IDs, and the abnormal data indicating the usage of the processing resources used in executing a process corresponding to each of the plurality of process IDs including the usage of the abnormal processing resources, and the first learning step may learn the parameters based on the normal data and the abnormal data collected in the collection step.

[0017] In addition, in the abnormality management method of the present invention, the collection step may include a determination step of collecting the usage of processing resources used in the execution of the managed processes corresponding to each of a plurality of process IDs, and determining that an operational abnormality has occurred in the managed process if the usage of processing resources used in the execution of the managed process exceeds the threshold value.

[0018] Furthermore, in the anomaly management method according to the present invention, the collecting step may collect first data indicating usage of processing resources used in executing the managed processes corresponding to each of the plurality of process IDs, observed at a first time point, and second data indicating usage of processing resources used in executing the managed processes corresponding to each of the plurality of process IDs, observed at a second time point after the first time point; the feature extracting step may extract characteristic directions of the first data and characteristic directions of the second data, based on a first data matrix constituted by observation vectors representing the first data and a second data matrix constituted by observation vectors representing the second data; the calculating step may calculate a second index value indicating a spatial coincidence formed between the extracted characteristic directions of the first data and the extracted characteristic directions of the second data; and the determining step may determine that an operational anomaly has occurred in the managed process at the second time point if the second index value calculated in the calculating step exceeds the threshold value.

[0019] Furthermore, the abnormality management method according to the present invention may further include an instruction step of sending an instruction to execute a predetermined response to resolve the operational abnormality of the process when it is determined in the determination step that an operational abnormality has occurred in the process to be managed. [Effects of the Invention]

[0020] According to the present invention, the amount of normal processing resources used in the execution of processes corresponding to each of a plurality of process IDs is used as true normal data, and while the generator parameters of the generator that generates pseudo-normal data that is sufficiently different from the distribution of true normal data are kept fixed, only the classifier parameters of the classifier that distinguishes true normal data from the pseudo-normal data are updated in a direction that maximizes an objective function based on the probability distribution of normal data and the probability distribution of abnormal data determined from the ratios estimated by the first learning unit, thereby performing training of a generative model that includes a generator and a classifier. This makes it easier to manage program operation abnormalities. [Brief explanation of the drawings]

[0021] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality management system including an abnormality management device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining an operational abnormality of a process managed by the abnormality management device according to this embodiment. [Figure 3] FIG. 3 is a block diagram showing the configuration of a threshold setting unit included in the abnormality management device according to this embodiment. [Figure 4] FIG. 4 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 5] FIG. 5 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 6] FIG. 6 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 7] FIG. 7 is a diagram for explaining the threshold value setting unit included in the abnormality management device according to this embodiment. [Figure 8] FIG. 8 is a diagram for explaining the threshold value setting unit included in the abnormality management device according to this embodiment. [Figure 9] FIG. 9 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 10] FIG. 10 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 11] FIG. 11 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 12] FIG. 12 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 13] FIG. 13 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 14] FIG. 14 is a diagram for explaining the operation of the abnormality management device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0022] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0023] [Configuration of anomaly management system] First, referring to Fig. 1, an overview of an abnormality management system including an abnormality management device 1 according to an embodiment of the present invention will be described. The abnormality management system sets a threshold value for determining abnormal operation of a process based on normal resource usage data that can be collected in large quantities and abnormal resource usage data that can be collected in smaller quantities than the normal data. The abnormality management system includes the abnormality management device 1 and an information processing device 2. The abnormality management device 1 and the information processing device 2 are connected via a network NW.

[0024] The network NW includes, for example, wired networks such as LAN, WAN, the Internet, and ISDN, as well as wireless networks such as wireless LAN and mobile communication networks using LTE / 4G, 5G, and 6G wireless communication systems, but the scope of the present invention is not limited to these.

[0025] The information processing device 2 can be realized as a server, a gateway, a desktop computer, an embedded device, a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, etc. In this embodiment, the information processing device 2 is not limited to one device, but includes the case of multiple devices. In the case of multiple devices, each information processing device 2 executes the same process generated by the same application or the same executable file.

[0026] The information processing device 2 is uniquely identified by network identification information such as an IP address or a MAC address, or a device ID assigned by an anomaly management system. The information processing device 2 can be realized by a computer equipped with a processor, a main memory device, a communication interface, an auxiliary memory device, and an input / output (I / O), and a program that controls these hardware resources.

[0027] The information processing device 2 executes one or more applications (programs) on the OS, with each application running as one or more processes. Each process is assigned a unique process ID (PID) by the OS. A process ID is assigned to each execution unit of a process, and even the same application may have different process IDs when multiple processes are generated, depending on the execution environment and timing. The information processing device 2 calculates CPU utilization as the amount of processing resources used for each process ID corresponding to the currently executing process, and records the calculated CPU utilization in memory. If the configurations of the CPUs of the multiple information processing devices 2, such as the number of cores and clock speed, are not identical, the CPU utilization recorded by each information processing device 2 is normalized or corrected using each CPU benchmark, etc. The normalization or correction process may be performed by the abnormality management device 1.

[0028] In this embodiment, CPU usage rate for each process ID is used as data on processing resource usage, but processing resource usage rate may also be memory usage rate for each process ID, I / O wait time for each process ID, etc. FIG. 2 is a diagram showing normal data a1, which is a normal CPU usage rate, and abnormal data b1, which includes abnormal CPU usage rates. The horizontal axis represents process IDs, which are arranged in the order in which the processes are executed. The vertical axis represents CPU usage rate [%]. Within the range of process IDs in area c, the CPU usage rate of abnormal data b1 is an abnormal value. The abnormal value of CPU usage rate is caused by an abnormal operation of a process executed by information processing device 2.

[0029] A state in which an operational abnormality occurs in a process executed by the information processing device 2 refers to a state in which the process deviates from the normal load range, such as excessive consumption of processing resources. For example, this state applies when the CPU usage rate for each process ID exceeds a preset threshold, or when a normal CPU usage rate range is defined according to the attributes of the process and the CPU usage rate outside that range deviates from the normal load range. Even if the CPU usage rate does not exceed the threshold, a predefined CPU usage rate pattern can be used as a load state pattern when an operational abnormality occurs in the process, and can be used as an abnormal CPU usage rate that deviates from the normal CPU usage rate range.

[0030] In this way, when a process is behaving abnormally, it is assumed that abnormal processing such as an infinite loop or excessive recursive calls is occurring in the execution of the process associated with that process ID.On the other hand, normal CPU usage means that no abnormal processing is occurring in the execution of the process associated with each process ID, and CPU resource consumption is within a normal range.

[0031] [Function block of the abnormality management device] Next, functional blocks of the fault management device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the fault management device 1 includes a collection unit 10, a first learning unit 11, a second learning unit 12, a generation unit 13, a threshold setting unit 14, a determination unit 15, an instruction unit 16, and a storage unit 17.

[0032] The collection unit 10 collects, via the network NW, as normal data, CPU usage rates, which are normal amounts of processing resources used in executing processes corresponding to each of a plurality of process IDs, recorded in the information processing device 2. The collection unit 10 also collects, as abnormal data, CPU usage rates used in executing processes corresponding to each of a plurality of process IDs that include abnormal amounts of processing resources. The collection unit 10 can collect CPU usage rates from multiple information processing devices 2. Process IDs are associated with the CPU usage rate data. The collection unit 10 collects CPU usage rates corresponding to each of N (e.g., 10,000) process IDs at set times.

[0033] The collection unit 10 can classify the collected CPU usage rates into normal and abnormal data by labeling them based on a rule base or statistical threshold, and collect these data. While it is possible to collect a large amount of normal data, abnormal data occurs very rarely, making it difficult to collect a sufficient amount. Therefore, the amount of abnormal data collected by the collection unit 10 is significantly smaller than the amount of normal data (normal data >> abnormal data).

[0034] The collection unit 10 collects normal data that can be considered to consist only of normal CPU utilization rates, and abnormal data that includes process IDs of the normal CPU utilization rates but also includes a certain amount of process IDs of abnormal CPU utilization rates, as training data for the first learning unit 11. The collection unit 10 also collects normal data relating to normal CPU utilization rates for each process ID as training data for the second learning unit 12. The collection unit 10 also collects normal data relating to normal CPU utilization rates for each process ID, which is used by the threshold setting unit 14 to set a threshold value.

[0035] Furthermore, the collection unit 10 collects first data indicating the CPU utilization rate used in the execution of the managed processes corresponding to each of the multiple process IDs observed at a first time, which are targets for abnormality determination by the determination unit 15, and second data indicating the CPU utilization rate used in the execution of the managed processes similarly observed at a second time after the first time. The CPU utilization rates observed and collected at the first time and the second time are both CPU utilization rates corresponding to each of the N process IDs.

[0036] The first learning unit 11 learns parameters that represent the ratio between a probability distribution of normal data indicating normal CPU utilization rates used in the execution of processes corresponding to each of a plurality of process IDs and a probability distribution of abnormal data indicating CPU utilization rates used in the execution of processes corresponding to each of a plurality of process IDs including abnormal CPU utilization rates that deviate from the range of normal CPU utilization rates, and estimates the ratio based on the learned parameters. The first learning unit 11 also estimates a density ratio from the learned parameters.

[0037] Here, let D={x (1) ,x (2) ,…,x (N)}, the set of training data including abnormal data is D'={x' (1) ,x' (2) ,…,x' (N’)} where x indicates the CPU usage rate corresponding to each process ID. (n) is M-dimensional and x (n) =(x1 (n) ,x2 (n) ,…,x M (n) For example, if there are 1000 process IDs (=M), there are 1000 dimensions. Each component x i (n) indicates the CPU usage rate for process IDi.

[0038] In the following, D is called normal data and D' is called abnormal data, and the probability density function of normal data D is called p(x) and the probability density function of abnormal data D' is called p'(x). The probability density function of normal data D, p(x), indicates the distribution of the probability that normal CPU usage rate x is observed for a process ID. Furthermore, the probability density function of abnormal data D' indicates the distribution of the probability that abnormal CPU usage rate x is observed for a process ID. The density ratio r(x) between the probability density function p(x) of normal data D and the probability density function p'(x) of abnormal data D' is expressed by the following equation (1).

number

[0039]

number

[0040] The basis function ψ(x) is defined by the RBF (Radial Basis Function) kernel and expressed by the following equation (3).

number

[0041] Here, based on the above formula (1), the specific form of the above formula (3) in which the number of bases b is the number of training data N (b=N) is given by the following formula (4).

number

[0042] The above equation (4) expresses the density ratio as a linear sum of RBFs centered on all training points. Here, we introduce the generalized Kullback-Leibler divergence (KL divergence), which measures the information-theoretic distance between non-negative functions f and g, as shown in the following equation (5).

number

[0043] In density ratio estimation, f=p(x) and g=r θ Substituting p'(x) into the above equation (5), the following equation (6) is used as the objective function.

number

[0044] In the above equation (6), each x n , x' n’ The optimization objective function obtained by approximating the integral with an empirical distribution that sets values ​​other than θ to 0, ignoring terms that do not depend on the parameter θ, and dropping constants is expressed as the following equation (7).

number

[0045] By minimizing J(θ) in equation (7), the density ratio r θ Since J(θ) is a convex function, the first learning unit 11 updates the parameter θ from the initial value until convergence using the parameter θ update formula by the gradient descent method of the following formula (8).

number

[0046] The result of specifically calculating the gradient of the above formula (7) is expressed by the following formula (9).

number

[0047] The first term in the above equation (9) represents the contribution from abnormal data, and the second term represents the contribution from normal data. Since the second term is dominant in the above equation (9), stable estimation is possible when the number of normal data N is large. In other words, even when the amount of abnormal data N' is small, the parameter θ can be stably calculated.

[0048] Before calculating the optimal solution of the parameter θ using the above equations (7) to (9), the first learning unit 11 calculates an appropriate value for the bandwidth h in the above equation (4) by cross-validation, information criterion (KL convergence minimization criterion), etc. Based on the optimal solution of the parameter θ calculated by the KL density ratio estimation method, the first learning unit 11 calculates the density ratio r for an arbitrary input x using the above equation (2). θ can be estimated.

[0049] The second learning unit 12 learns a generative model by fixing the generator parameters of a generator 121 that generates pseudo-normal data that is sufficiently deviated from the distribution of true normal data, using the amount of normal processing resources used in executing processes corresponding to each of a plurality of process IDs as true normal data, and updating only the classifier parameters of a classifier 122 that distinguishes true normal data from pseudo-normal data, in the direction of maximizing an objective function based on the probability density function (probability distribution) of normal data and the probability density function (probability distribution) of abnormal data determined from the density ratio (ratio) estimated by the first learning unit 11.

[0050] As shown in FIG. 4, the second learning unit 12 executes a Max learning phase of a GAN (Generative Adversarial Network) as a generative model having a generator 121 and a classifier 122, in which only the parameters of the classifier 122 are updated while the generator 121 is fixed. When normal CPU usage rates used in the execution of processes corresponding to each of a plurality of process IDs are considered to be true normal data, the second learning unit 12 aims to generate pseudo-normal data that deviates sufficiently from the distribution of normal data, i.e., a CPU usage rate sequence that can be treated as an abnormal CPU usage rate. Therefore, the second learning unit 12 does not execute the Min learning phase of the normal GAN ​​adversarial learning procedure, in which the generator 121 is updated in the minimization direction.

[0051] As shown in FIG. 4, the generative model according to this embodiment, which includes a generator 121 and a classifier 122, calculates the normal CPU utilization (x1, x2, ..., x) observed in the execution of a process corresponding to each process ID. M ) as training data 124 for learning. Here, pseudo-normal data that deviates sufficiently from the distribution of normal data refers to a generated sequence that, as a statistical property, is located in a region that significantly deviates from the normal region of normal data, as compared to normal data that indicates normal CPU usage. When the index of distance or deviation from normal data is log-likelihood, a sequence with a smaller likelihood corresponds to the pseudo-normal sequence. When the index is cross-entropy, the larger the entropy value, the more deviation the sequence. Furthermore, when the KL distance is used as the index, a sequence with a large deviation in the overall distribution is treated as a sufficiently deviation sequence.

[0052] 5 and 6 are diagrams schematically illustrating the neural network configuration of the generator 121 and the classifier 122 of the generative model used by the second learning unit 12. As shown in FIG. 5, the generator 121 is configured as a neural network having an input layer, a hidden layer, and an output layer. The generator 121 is a model that generates pseudo-normal data from random noise. For example, m randomly sampled Gaussian noise vectors (z1 to z m).

[0053] The generator 121 outputs the output G(z) after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The output G(z) from the generator 121 is pseudo-normal data that deviates from the distribution of true normal data. CNN or ResNet can be used as the neural network that constitutes the generator 121.

[0054] The classifier 122 shown in Fig. 6 is configured with a neural network having an input layer, a hidden layer, and an output layer. In the example of Fig. 6, as training data input, a series of normal CPU utilization rates corresponding to each process ID collected by the collection unit 10 is provided as true normal data.

[0055] The classifier 122 outputs a binary value of 1 or 0 after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The classifier 122 outputs an output y=1 when it correctly identifies the training data related to the input true normal data as true normal data. On the other hand, it outputs an output y=0 when it correctly identifies the training data related to the input pseudo normal data as pseudo normal data. In this way, the classifier 122 is a model that distinguishes the model distribution generated by the generator 121 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 122.

[0056] FIG. 4 is a block diagram for explaining the configuration of the generative model learned by the second learning unit 12. The generator 121 of the generative model adopted by the second learning unit 12 is represented as a function G, and the classifier 122 is represented as a function D. Furthermore, true normal data is represented as x, the predicted value output by the classifier 122 is represented as y, and the correct label is represented as t. The correct label t is set to 1 for true normal data and 0 for pseudo-normal data generated by the generator 121. In this case, the classifier 122 calculates the cross entropy E CE It can be expressed as:

[0057]

number

[0058] The first term in the brace of the above equation (10) represents t n lny n In this case, the predicted value y n is the correct label of the true normal data, t n = 1. On the other hand, the second term in the braces represents (1-t n )ln(1-y n ), the predicted value y n is the correct label value (1-t n ) = 0. In this way, the cross entropy E CE is the maximum value when the predicted value matches the correct label value.

[0059] Here, the generator 121 that configures the generative model uses parameters w G ,θ G and the function G(w G ,θ G ) The classifier 122 also uses the parameter w D ,θ D and function D(w D ,θ D ) The cross entropy E in the above equation (10) CE The objective function E of the generative model including the generator 121 and the discriminator 122 based on the above can be expressed by the following equation (11).

number

[0060] The first term of the above equation (11) represents E D(x)=1 lnD(w D ,θ D ) is the expected value at which the classifier 122 classifies true normal data as true normal data. D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D)) is the expected value at which the classifier 122 classifies the pseudo-normal data generated by the generator 121 as pseudo-normal data. When the expected value of the above formula (11) is expanded into an integral expression using a probability distribution, it is expressed as the following formula (12).

[0061]

number

[0062] Here, for the probability density function p(x) of normal data and the probability density function p'(x) of abnormal data in the above equation (1), in order to form a probabilistic labeled classification problem for Max optimization learning of GAN, let p(x)≡ρ(x|y=1) and p'(x)≡ρ(x|y=0). The density ratio r estimated by the first learning unit 11 is θ (x) is defined by the following equation (13).

number

[0063] The probability density function ρ(x|y=1), which is the conditional probability distribution of normal data in the above equation (13), can be calculated from a large amount of normal data. Using the calculated probability density function ρ(x|y=1) of normal data, the probability density function ρ(x|y=0), which is the conditional probability distribution of abnormal data, can be expressed by the following equation (14).

number

[0064] The probability density function ρ(x|y=1) of normal data and the probability density function ρ(x|y=0) of abnormal data in the above formula (14) are substituted into the objective function E in the above formula (12), and set values ​​are used for the prior probability ρ(y=1) of the normal (y=1) class and the prior probability ρ(y=0) of the abnormal (y=0) class. For example, the prior probability values ​​are arbitrarily set as ρ(y=1):ρ(y=0)=0.99:0.01, and these prior probability values ​​can be adjusted as needed. Furthermore, the posterior probability ρ(y=1|x) of normality for the CPU usage rate x corresponding to the observed process ID is calculated as D(w D ,θ D ) and the posterior probability ρ(y=0|x) of abnormality for the CPU usage rate x corresponding to the process ID is 1-D(G(w G ,θ G ),w D ,θ D ) Each posterior probability corresponds to the density ratio r θ and can be obtained from the prior probability.

[0065] Here, when the generator 121 is fixed, the objective function E becomes a maximization problem of the following equation (16) with respect to the discriminator 122.

number

[0066] In training the generative model of this embodiment, as described above, only Max optimization of the objective function E is performed, and the parameters of the discriminator 122 with the generator 121 fixed are trained. This prevents the output of the generator 121 from converging to the distribution of normal data, and instead maintains a sequence that is sufficiently deviated from the distribution of normal data. Once the update of the discriminator 122 has converged, the pseudo-normal data sequence output by the fixed generator 121 has a low likelihood relative to a normal CPU usage rate. In this case, the generator 121 can generate only pseudo-normal data, which is an abnormal sequence expressed by the following equation (16).

number

[0067] The generation unit 13 causes the generator 121 included in the trained generative model constructed by the second learning unit 12 to generate pseudo-normal data. The generation unit 13 determines the output of the generator 121, for which the output of the classifier 122 is determined to be 0 (abnormal) >> 1 (normal), as pseudo-normal data.

[0068] The threshold setting unit 14 sets a threshold for determining whether an operation of a process is abnormal, based on the pseudo-normal data generated by the generator 121 by the generator 13. As shown in FIG. 3 , the threshold setting unit 14 includes a feature extraction unit (first feature extraction unit, second feature extraction unit) 140, a calculation unit 141, and a setting unit 142.

[0069] The feature extraction unit 140 extracts a feature direction of the normal data based on a data matrix composed of a plurality of observation vectors representing normal data indicating normal CPU utilization rates used in the execution of processes corresponding to each of a plurality of process IDs. The feature extraction unit 140 extracts a feature direction using the normal data collected by the collection unit 10. The feature extraction unit 140 also extracts a feature direction of the pseudo-normal data based on a data matrix composed of a plurality of observation vectors representing the pseudo-normal data generated by the generator 121 by the generation unit 13.

[0070] The feature extraction unit 140 extracts a transformation matrix U of the normal data including a group of orthonormal basis vectors as the feature direction of the normal data by performing singular value decomposition on a data matrix composed of a plurality of observation vectors representing normal data. Similarly, the feature extraction unit 140 extracts a transformation matrix U' of the pseudo-normal data including a group of orthonormal basis vectors as the feature direction of the pseudo-normal data by performing singular value decomposition on a data matrix composed of observation vectors representing pseudo-normal data.

[0071] Furthermore, the feature extraction unit 140 extracts the feature direction of the first data and the feature direction of the second data based on a first data matrix consisting of observation vectors representing first data indicating the CPU usage rate used in the execution of the managed processes corresponding to each of the multiple process IDs observed at a first time, and a second data matrix consisting of observation vectors representing two data indicating the CPU usage rate used in the execution of the managed processes corresponding to each of the multiple process IDs observed at a second time after the first time.

[0072] The feature extraction unit 140 performs singular value decomposition on the first data matrix to extract a transformation matrix U1 of the first data including a group of orthonormal basis vectors as the feature direction of the first data. Similarly, the feature extraction unit 140 performs singular value decomposition on the second data matrix to extract a transformation matrix U2 of the second data including a group of orthonormal basis vectors as the feature direction of the second data.

[0073] 7 is a diagram for explaining the feature directions of normal data extracted by the feature extraction unit 140. In FIG. 7, if the total number of data points in each section is N, data points p1 to p2 indicated by white circles N indicates the CPU utilization rate observed for each process ID collected by the collection unit 10, and here, the series data of normal CPU utilization rates is shown. Therefore, the CPU utilization rate observed for the nth process ID is expressed as p n The feature extraction unit 140 uses a sliding window with a window width of M to convert the normal sequence data of CPU utilization into a set of M-dimensional vectors indicated by the arrows of each sliding window, into multiple observation vectors. Sequence data consisting of observed values ​​of CPU utilization with length L is expressed as L = N - M + 1. The same applies to the feature direction of abnormal data.

[0074] The observation vector, which is a subsequence of length M sequentially extracted by feature extraction unit 140 while moving the sliding window from left to right in the normal CPU utilization rate corresponding to the process ID, is expressed by the following equation (17).

number

[0075] Here, the data matrix X=[x (1) ,…,x (L) ] (an M×L-dimensional real-valued matrix), consider the linear combination Xν of the following equation (18).

number

[0076] From the above equation (18), ν T Under the constraint ν=1, ||Xν|| 2 This can be obtained by introducing the Lagrangian function of the following equation (19) obtained using a multiplier γ.

number

[0077] In order for the above equation (19) to be maximized, 2X differentiated with respect to the vector ν T The value of Xν-2γν is 0. Therefore, the following conditional expression (20) is obtained.

number

[0078] From the above equation (20), X T It can be seen that the eigenvalue of X is γ and the eigenvector is ν. Furthermore, the vector μ is defined by the following equation (21).

number

[0079] Using the above equations (21) and (20), the relationship shown in the following equation (22) can be seen.

number

[0080] Furthermore, multiplying both sides of the above equation (20) by X and using the above equation (21) yields the following relational equation (23).

number

[0081] By applying the above equation (21) to the above equation (23), the following relational equation (24) is obtained.

number

[0082] Here, U and V are set as follows:

number

[0083] The above equation (25) can be expressed as the following equation (26).

number

[0084] U is an orthogonal matrix, and U T By multiplying and transposing both sides of the above equation (26), the relationship in the following equation (27) is obtained.

number

[0085] The above equation (27) is called the singular value decomposition of X. Let U be the left singular vector, V be the right singular vector, and Γ 1 / 2 are called singular values. That is, U is a transformation matrix that represents the feature direction, which is the main direction or pattern of normal data. V represents the axis transformation, which is the direction to which the vector is projected. Γ represents the importance of each feature direction.

[0086] The matrix U of left singular vectors is expressed by the following equation (28).

number

[0087] For example, if there are 10,000 pieces of normal data indicating normal CPU usage observed for each process ID (N=1000), 10,000 left singular vectors U will be found. Singular value decomposition of pseudo-normal data is performed in the same way, and a transformation matrix U', which is the matrix of left singular vectors U', is found. In the case of pseudo-normal data, the same number of transformation matrices U' as the number of transformation matrices U for the normal data are found.

[0088] The calculation unit 141 calculates a first index value indicating the spatial degree of coincidence formed between the feature directions of the normal data and the pseudo-normal data. The calculation unit 141 calculates, as the first index value, the maximum singular value of a matrix formed based on a transformation matrix U that is the feature direction of the normal data and a transformation matrix U' that is the feature direction of the pseudo-normal data. Specifically, the calculation unit 141 calculates the matrix 2-norm ||U T U'||2 is calculated as the first index value.

[0089]

number

[0090]

number

[0091] The calculation unit 141 also calculates a second index value indicating the degree of spatial correspondence formed between the feature direction of the first data, which is the CPU usage rate corresponding to each process ID observed at a first time, and the feature direction of the second data, which is the CPU usage rate corresponding to each process ID observed at a second time, of the processes to be managed extracted by the feature extraction unit 140. The calculation unit 141 calculates, as the second index value, the matrix 2 norm of the transposed matrix U1 of the left singular vectors of the first data and the matrix U2 of the left singular vectors of the second data.

[0092] The setting unit 142 sets the first index value calculated by the calculation unit 141 as a threshold value for determining abnormal operation of the process. As described above, if 10,000 transformation matrices U of normal data and 10,000 transformation matrices U' of pseudo-normal data are calculated, 10,000 matrix 2 norms will be calculated as the first index values. FIG. 8 is a graph showing the probability values ​​of the matrix 2 norms calculated by the calculation unit 141, where the horizontal axis indicates each matrix 2 norm and the vertical axis indicates the probability value of each matrix 2 norm. The setting unit 142 selects the matrix 2 norm of data point b that indicates the highest probability of taking on a value from the matrix 2 norms calculated by the calculation unit 141, and sets 1-(matrix 2 norm) as the threshold value.

[0093] The determination unit 15 determines that an operational abnormality has occurred in the managed process when the CPU utilization rate used by the execution of the managed process corresponding to the process ID exceeds a threshold value. The determination unit 15 determines that an operational abnormality has occurred in the managed process at the second time when the second index value calculated by the calculation unit 141 exceeds the threshold value. In this case, the process ID of a process in which an abnormal CPU utilization rate has occurred exists among the processes with the process IDs executed at the second time.

[0094] When the determination unit 15 determines that an abnormality in the process operation has occurred, the instruction unit 16 sends an instruction to execute a predetermined measure to resolve the abnormality in the process operation. For example, the instruction unit 16 can identify the process ID of the abnormal CPU usage rate, and send an instruction to terminate and restart the corresponding process to the information processing device 2 via the network NW.

[0095] The memory unit 17 stores the parameter θ and the density ratio r estimated by the learning by the first learning unit 11. θ The storage unit 17 also stores the generator 121 and the classifier 122 included in the trained generative model, as well as the pseudo-normal data generated by the generator 121.

[0096] [Hardware configuration of the fault management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the above-described functions will be described with reference to FIG.

[0097] 9, the fault management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program for controlling these hardware resources. Furthermore, the fault management device 1 includes a display device 107.

[0098] The processor 102 is a circuit or device that performs arithmetic processing, and is realized by, for example, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc. Alternatively, the processor 102 may be configured by combining some or all of these.

[0099] The main memory device 103 is configured, for example, by a volatile random access memory (RAM), and pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the abnormality management device 1, such as the collection unit 10, first learning unit 11, second learning unit 12, generation unit 13, threshold setting unit 14, judgment unit 15, and instruction unit 16 shown in FIG.

[0100] The communication interface 104 is an interface circuit for connecting the abnormality management device 1 to various external electronic devices via a network.

[0101] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use non-volatile storage such as a hard disk or flash memory as the storage medium.

[0102] The auxiliary storage device 105 has a program storage area for storing an abnormality management program. The auxiliary storage device 105 also has a program storage area for storing parameters representing the density ratio of the probability density functions of normal data and abnormal data executed by the abnormality management device 1, and a first learning program for estimating the density ratio. The auxiliary storage device 105 also has a program storage area for storing a second learning program for training the classifier 122 of the generative model executed by the abnormality management device 1.

[0103] The auxiliary storage device 105 also has a program storage area for storing a threshold setting program for setting a threshold using the subspace method, which is executed by the abnormality management device 1. The auxiliary storage device 105 realizes the storage unit 17 described in Fig. 1. Furthermore, for example, the auxiliary storage device 105 may have a backup area for backing up the above-mentioned data, programs, etc.

[0104] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0105] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can display on the screen information on the CPU utilization rate used in the execution of a process corresponding to a process ID.

[0106] [Operation of the abnormality management device] Next, the operation of the abnormality management device 1 having the above-described configuration will be described with reference to the flowcharts of FIGS.

[0107] As shown in FIG. 10, first, the collection unit 10 collects normal data relating to normal CPU utilization rates used in the execution of a process corresponding to each process ID, and abnormal data relating to abnormal CPU utilization rates (step S1). The collection unit 10 collects, as normal data, data that includes only normal CPU utilization rates or data that can be considered to be only normal CPU utilization rates from the CPU utilization rate data corresponding to the process ID. The collection unit 10 also collects a smaller amount of abnormal data than the normal data. The collection unit 10 can collect CPU utilization rates for each process ID recorded in the information processing device 2 via the network NW. The collection unit 10 can further classify the data into normal data and abnormal data in advance.

[0108] Next, the first learning unit 11 performs a first learning process (step S2). FIG. 11 is a flowchart illustrating the first learning process of step S2 in more detail. As shown in step S30 of FIG. 11, the first learning unit 11 calculates a density ratio r θ (Step S20). The first learning unit 11 updates the parameter θ by gradient descent or the like using the above equations (7) to (9) to find an optimal solution for the parameter θ.

[0109] Next, the first learning unit 11 calculates the density ratio r from the learned parameter θ calculated in step S20 based on the above formula (2). θ is estimated (step S21).

[0110] 10, the second learning unit 12 performs a second learning process (step S3). In step S2, the second learning unit 12 uses the normal CPU utilization rate corresponding to each process ID as true normal data, and calculates the density ratio r estimated by the first learning unit 11 while keeping the generator parameters of the generator 121 fixed. The generator 121 generates pseudo-normal data that is sufficiently deviated from the distribution of true normal data. θ Only the classifier parameters of the classifier 122 that distinguishes between true normal data and pseudo normal data are updated in the direction of maximizing the objective function E based on the probability density function ρ(x|y=1) of normal data and the probability density function ρ(x|y=0) of abnormal data (the above equation (14)) determined from the above equation.

[0111] 12 is a flowchart for explaining the second learning process in step S3. First, the second learning unit 12 calculates the density ratio r θ The probability density function ρ(x|y=1) of normal data and the probability density function ρ(x|y=0) of abnormal data (the above formula (14)) determined from the above are set as the objective function E (formula (12)) of the GAN (step S30). More specifically, the second learning unit 12 calculates the probability density function ρ(x|y=1), which is the conditional probability distribution of normal data, from the large amount of normal data collected by the collection unit 10. Furthermore, the second learning unit 12 determines the probability density function ρ(x|y=0), which is the conditional probability distribution of abnormal data expressed by the above formula (14), from the calculated probability density function ρ(x|y=1) of normal data.

[0112] The prior probability ρ(y=1) of normality and the prior probability ρ(y=0) of abnormality are set to values ​​previously set in the above equation (12), for example, ρ(y=1):ρ(y=0)=0.99:0.01, because the number of normal data is overwhelmingly large. Furthermore, in the optimal solution of the objective function E in the above equation (12), D(w D ,θ D) is the posterior probability ρ(y=1|x) that the CPU usage rate x corresponding to the observed process ID is normal, and 1-D(G(w G ,θ G ),w D ,θ D ) is the posterior probability ρ(y=0|x) that the CPU usage rate corresponding to the process ID x is abnormal. These posterior probabilities ρ(y=1|x) and ρ(y=0|x) are calculated based on the estimated density ratio r θ and can be obtained from the prior probabilities ρ(y=1), ρ(y=0).

[0113] Next, the second learning unit 12 acquires the normal CPU utilization rate corresponding to each process ID collected in step S1 as true normal data (step S31). Next, the second learning unit 12 inputs the true normal data as training data 124 to the classifier 122, and adjusts the parameter w D ,θ D (Step S32). In Step S32, the second learning unit 12 can cause the classifier 122 to learn true normal data using, for example, an error backpropagation method. By Step S32, the classifier 122 that can distinguish true normal data from true normal data is pre-trained.

[0114] Next, the second learning unit 12 generates Gaussian noise and provides a random vector of the generated Gaussian noise as an input to the generator 121 (step S33). Subsequently, the generator 121 calculates a random vector of the input z and the weight parameter w based on the provided Gaussian noise. G ,θ G Then, a product-sum operation and a threshold process using an activation function are performed to generate pseudo-normal data G(z) (step S34).

[0115] Next, the second learning unit 12 learns the classifier 122. The learning of the classifier 122 is performed by using the parameter w D ,θ DFirst, the second learning unit 12 provides true normal data as training data 124 as input to the classifier 122. Then, the second learning unit 12 adjusts the parameter w by backpropagation or the like so that the objective function E in the above equation (12) is maximized. D ,θ D (Step S35). The label of the training data 124 is set to 1 (true normal data).

[0116] Next, the second learning unit 12 provides the pseudo-normal data generated by the generator 121 in step S34 to the classifier 122 as an input, and calculates the parameter w by backpropagation or the like so that the objective function E in the above equation (12) is maximized. D ,θ D is updated (step S36).

[0117] The learning of the classifier 122 in steps S35 and S36 corresponds to the dashed arrows in the block diagram of the second learning unit 12 shown in FIG. 4, which indicate that a classifier error is calculated in block 125 of the objective function E based on the output 123 from the classifier 122, and then the error is backpropagated to the classifier 122.

[0118] Thereafter, the learning of the classifier 122 from step S34 to step S36 is repeated until the value of the objective function E converges (step S37: NO). On the other hand, if the value of the objective function E converges to the optimal solution of the above equation (15) (step S37: YES), the processing from step S32 to step S37 is repeated using the remaining true normal data in order until the generator 121 and the classifier 122 are learned (step S38: NO).

[0119] Thereafter, when the classifier 122 has been trained using all true normal data (step S38: YES), the second learning unit 12 stores the generator 121 and the classifier 122 of the trained generative model in the storage unit 17 (step S39). Note that steps S32 to S36 can be batch processed. After that, the process proceeds to step S4 in FIG. 10.

[0120] Next, the generation unit 13 causes the generator 121 included in the trained generative model constructed by the second learning unit 12 to generate pseudo-normal data (step S4). At this time, the generation unit 13 determines the output of the generator 121, for which the output of the discriminator 122 is determined to be 0 (abnormal) >> 1 (normal), as pseudo-normal data. The pseudo-normal data generated in step S4 is stored in the storage unit 17. Subsequently, the threshold setting unit 14 sets a threshold for determining abnormal operation of the process based on the pseudo-normal data generated in step S4 (threshold setting process) (step S5). FIG. 13 is a flowchart for explaining the threshold setting process in step S5.

[0121] 13, first, the threshold setting unit 14 acquires normal data, which is normal CPU utilization rates corresponding to each process ID collected by the collection unit 10, and the pseudo-normal data generated in step S4 (step S50). Next, the feature extraction unit 140 performs singular value decomposition on a data matrix composed of a plurality of observation vectors representing the normal data, to extract a transformation matrix U of the normal data including a group of orthonormal basis vectors as the feature direction of the normal data. Similarly, the feature extraction unit 140 performs singular value decomposition on a data matrix composed of observation vectors representing the pseudo-normal data, to extract a transformation matrix U' of the pseudo-normal data including a group of orthonormal basis vectors as the feature direction of the pseudo-normal data (step S51).

[0122] Next, the calculation unit 141 uses the transformation matrices U and U′ extracted in step S51 to calculate the matrix 2-norm ∥U T U'∥2 is calculated (step S52). Next, the setting unit 142 selects the matrix 2 norm with the highest probability value from the matrix 2 norms calculated in step S52, and sets it as the threshold (step S53). Specifically, the matrix 2 norm that peaks in the distribution of matrix 2 norms shown in Fig. 8 is selected, and 1 - (matrix 2 norm) is set as the threshold.

[0123] 10, the collection unit 10 collects first data indicating the CPU utilization rate due to the execution of the managed processes corresponding to the multiple process IDs observed at the first time, and second data indicating the CPU utilization rate due to the execution of the managed processes corresponding to the multiple process IDs observed at the second time after the first time (step S6). Specifically, as shown in FIG. 14, the collection unit 10 collects first data indicating the CPU utilization rate due to the execution of the managed processes corresponding to the multiple process IDs observed at the first time (time T1) for the process IDs p1 to p2. N The collection unit 10 then collects first data including the CPU usage rate from the process ID p1 to the process ID p2 measured at the second time (time T2) immediately after the first time (time T1). N Collect second data including CPU utilization corresponding to

[0124] Next, the feature extraction unit 140 performs singular value decomposition on the first data matrix to extract a transformation matrix U1 of the first data, which includes a group of orthonormal basis vectors, as the feature direction of the first data. Similarly, the feature extraction unit 140 performs singular value decomposition on the second data matrix to extract a transformation matrix U2 of the second data, which includes a group of orthonormal basis vectors, as the feature direction of the second data (step S7). Here, as shown in "step S7" in FIG. 14, the feature extraction unit 140 performs singular value decomposition on the first data matrix and the second data matrix at the first time (time T1) and the second time (time T2), respectively. Furthermore, FIG. 14 shows that the transformation matrices U1 and U2 are extracted as matrices of left singular vectors. In this way, the feature extraction unit 140 performs singular value decomposition on the data matrix of the CPU utilization of the managed process observed at two adjacent times to extract the transformation matrices U1 and U2.

[0125] Next, the calculation unit 141 calculates a second index value indicating the degree of spatial coincidence formed between the feature direction of the first data observed at the first time (time T1) extracted in step S7 and the feature direction of the second data observed at the second time (time T2) (step S8). The calculation unit 141 calculates the maximum singular value, i.e., the matrix 2-norm ||U1 T U2∥2 is calculated as the second index value (“Step S8” in FIG. 14).

[0126] Next, in step S8, if the second index value calculated by the calculation unit 141 exceeds the threshold value set in step S5, the determination unit 15 determines that an operational abnormality has occurred in the managed process executed at the second time (step S9). As shown in Fig. 14, adjacent times T1 and T2 are set as the first and second times, and steps S6 to S9 are executed, and then adjacent times T2 and T3, which are shifted by one time, are set as the first and second times, and steps S6 to S9 are executed, and further adjacent times T3 and T4, which are shifted by one time, are set as the first and second times, and the processing from step S6 to step S9 (steps S7' to S9' in Fig. 14) is repeated each time.

[0127] Next, the instruction unit 16 identifies a process linked to the process ID in which it is determined that an operational abnormality has occurred, and sends an instruction to execute a predetermined response to resolve the operational abnormality (step S10). The instruction unit 16 can send an instruction to terminate and restart the process linked to the identified process ID in which an operational abnormality has occurred to the information processing device 2 via the network NW.

[0128] As described above, the abnormality management device 1 according to this embodiment learns parameters representing the ratio between the probability distribution of normal data and the probability distribution of abnormal data based on normal CPU usage data, which can be collected in large quantities, and abnormal CPU usage data, which can be collected in smaller quantities than the normal data. The abnormality management device 1 then uses the probability distribution of normal data and abnormal data, determined based on the ratio estimated from the learned parameters, as the objective function of the generative model. Furthermore, the generative model is trained to maximize the objective function, and the pseudo-normal data generated by the generator 121 included in the trained generative model is used to set a threshold value for determining abnormal operation of a process associated with a process ID corresponding to a process using an abnormal CPU usage rate. This makes it easier to manage abnormal operation of a program.

[0129] Furthermore, according to the abnormality management device 1 of this embodiment, the density ratio is estimated using abnormal data even if it is a small amount, and the probability density function of normal data and the probability density function of abnormal data determined based on the density ratio are set as coefficients of the objective function of the generative model. Therefore, the generative model is trained by reflecting the patterns of normal data and abnormal data obtained as actual observation data, thereby improving the learning accuracy of the generative model.

[0130] Furthermore, according to the abnormality management device 1 of this embodiment, a process operation abnormality determination process is performed using the subspace method, targeting the CPU utilization rate used by the process execution at the first time and the second time immediately thereafter, so that it is possible to detect the occurrence of a process operation abnormality in real time.

[0131] Furthermore, according to the abnormality management device 1 of this embodiment, the CPU utilization rate used in executing the process corresponding to the process ID is used as observation data, so that the process ID of the process in which an operational abnormality has occurred can be easily identified.

[0132] In the embodiment described above, the second learning unit 12 has been described as having a generative model with a GAN configuration. However, the generative model can be configured not only based on a GAN but also based on a VAE (Variational Autoencoder), Energy-Based Models (EBMs), or the like.

[0133] The above describes embodiments of the abnormality management device and abnormality management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0134] 1...abnormality management device, 2...information processing device, 10...collection unit, 11...first learning unit, 12...second learning unit, 13...generation unit, 14...threshold setting unit, 15...judgment unit, 16...instruction unit, 17...memory unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, 121...generator, 122...identifier, 140...feature extraction unit, 141...calculation unit, 142...setting unit, NW...network.

Claims

1. a first learning unit configured to learn a parameter representing a density ratio indicating a relative relationship between a probability density function of normal data indicating normal processing resource usage amounts used in the execution of processes corresponding to each of a plurality of process IDs and a probability density function of abnormal data indicating processing resource usage amounts used in the execution of processes corresponding to each of a plurality of process IDs including abnormal processing resource usage amounts that deviate from the range of normal processing resource usage amounts, and to estimate the density ratio based on the learned parameter; a second learning unit configured to: learn a generative model including the generator and the classifier by updating only a classifier parameter of a classifier that distinguishes between the true normal data and the pseudo-normal data in a direction that maximizes an objective function based on a probability density function of the normal data and a probability density function of the abnormal data determined from the density ratio estimated by the first learning unit, while keeping fixed a generator parameter of the generator that generates pseudo-normal data that is sufficiently deviated from a distribution of the true normal data, using the usage amount of the normal processing resources used in executing the processes corresponding to each of the plurality of process IDs as true normal data; a generation unit configured to cause the generator included in the trained generative model constructed by the second learning unit to generate the pseudo-normal data; a threshold setting unit configured to set a threshold for determining an operational abnormality of a process based on the pseudo-normal data generated by the generator included in the trained generative model; An abnormality management device comprising:

2. 2. The abnormality management device according to claim 1, further comprising a collection unit configured to collect the normal data indicating the normal processing resource usage amount used in the execution of a process corresponding to each of the plurality of process IDs and the abnormal data indicating the processing resource usage amount used in the execution of a process corresponding to each of the plurality of process IDs including the abnormal processing resource usage amount; The first learning unit learns the parameters based on the normal data and the abnormal data collected by the collecting unit. An abnormality management device characterized by:

3. 3. The abnormality management device according to claim 2, the collection unit collects usage amounts of processing resources used in the execution of processes to be managed that correspond to each of a plurality of process IDs; The system further includes a determination unit configured to determine that an abnormal operation of the managed process has occurred when the usage of the processing resource used in the execution of the managed process exceeds the threshold value. An abnormality management device characterized by:

4. 4. The abnormality management device according to claim 3, The threshold setting unit further a first feature extraction unit configured to extract a feature direction of the normal data based on a data matrix made up of a plurality of observation vectors representing the normal data indicating a usage amount of the normal processing resource used in executing a process corresponding to each of the plurality of process IDs; a second feature extraction unit configured to extract feature directions of the pseudo-normal data based on a data matrix composed of a plurality of observation vectors representing the pseudo-normal data generated by the generator included in the trained generative model; and a feature extraction unit comprising: a calculation unit configured to calculate a first index value indicating a spatial coincidence between a feature direction of the normal data and a feature direction of the pseudo normal data; a setting unit configured to set the first index value calculated by the calculation unit as the threshold value; An abnormality management device comprising:

5. 5. The abnormality management device according to claim 4, the collection unit collects first data indicating usage of processing resources used in the execution of the managed processes corresponding to each of the plurality of process IDs, observed at a first time, and second data indicating usage of processing resources used in the execution of the managed processes corresponding to each of the plurality of process IDs, observed at a second time after the first time; the feature extraction unit extracts a feature direction of the first data and a feature direction of the second data based on a first data matrix constituted by observation vectors representing the first data and a second data matrix constituted by observation vectors representing the second data, the calculation unit calculates a second index value indicating a degree of spatial coincidence formed between the extracted feature direction of the first data and the extracted feature direction of the second data; The determination unit determines that an operational abnormality has occurred in the managed process at the second time when the second index value calculated by the calculation unit exceeds the first index value set as the threshold value. An abnormality management device characterized by:

6. 6. The abnormality management device according to claim 3, Further, an instruction unit configured to, when the determination unit determines that an operational abnormality has occurred in the process to be managed, issue an instruction to execute a predetermined measure to resolve the operational abnormality in the process. An abnormality management device characterized by:

7. A computer-implemented anomaly management method, comprising: a first learning step of learning parameters representing a density ratio indicating a relative relationship between a probability density function of normal data indicating normal processing resource usage amounts used in the execution of processes corresponding to each of a plurality of process IDs and a probability density function of abnormal data indicating processing resource usage amounts used in the execution of processes corresponding to each of a plurality of process IDs including abnormal processing resource usage amounts that deviate from the range of normal processing resource usage amounts, and estimating the density ratio based on the learned parameters; a second learning step of learning a generative model including the generator and the classifier by updating only a classifier parameter of a classifier that distinguishes between the true normal data and the pseudo-normal data in a direction that maximizes an objective function based on a probability density function of the normal data and a probability density function of the abnormal data determined from the density ratio estimated in the first learning step, while keeping fixed a generator parameter of a generator that generates pseudo-normal data that is sufficiently deviated from a distribution of the true normal data, using the usage amount of the normal processing resources used in executing the processes corresponding to each of the plurality of process IDs as true normal data; a generating step of causing the generator included in the trained generative model constructed in the second learning step to generate the pseudo-normal data; a threshold setting step of setting a threshold for determining an operational abnormality of the process based on the pseudo-normal data generated by the generator included in the trained generative model; An abnormality management method comprising:

8. The abnormality management method according to claim 7, further comprising a collecting step of collecting the normal data indicating the normal processing resource usage amount used in the execution of a process corresponding to each of the plurality of process IDs and the abnormal data indicating the processing resource usage amount used in the execution of a process corresponding to each of the plurality of process IDs including the abnormal processing resource usage amount; The first learning step learns the parameters based on the normal data and the abnormal data collected in the collecting step. An abnormality management method characterized by:

9. 9. The abnormality management method according to claim 8, the collecting step collects usage amounts of processing resources used in the execution of the processes to be managed corresponding to each of a plurality of process IDs; Further, the method includes a determination step of determining that an operational abnormality has occurred in the managed process when the usage amount of the processing resource used in the execution of the managed process exceeds the threshold value. An abnormality management method characterized by:

10. The abnormality management method according to claim 9, The threshold value setting step further includes: a first feature extraction step of extracting a feature direction of the normal data based on a data matrix composed of a plurality of observation vectors representing the normal data indicating the usage amount of the normal processing resource used in executing the processes corresponding to each of the plurality of process IDs; a second feature extraction step of extracting feature directions of the pseudo-normal data based on a data matrix composed of a plurality of observation vectors representing the pseudo-normal data generated by the generator included in the trained generative model; a feature extraction step comprising: a calculation step of calculating a first index value indicating a spatial coincidence between the characteristic direction of the normal data and the characteristic direction of the pseudo normal data; a setting step of setting the first index value calculated in the calculation step as the threshold value; An abnormality management method comprising:

11. The abnormality management method according to claim 10, the collecting step collects first data indicating usage of processing resources used in the execution of the managed processes corresponding to each of the plurality of process IDs, observed at a first time, and second data indicating usage of processing resources used in the execution of the managed processes corresponding to each of the plurality of process IDs, observed at a second time after the first time; the feature extraction step extracts a feature direction of the first data and a feature direction of the second data based on a first data matrix constituted by observation vectors representing the first data and a second data matrix constituted by observation vectors representing the second data, the calculating step calculates a second index value indicating a degree of spatial coincidence formed between the extracted feature direction of the first data and the extracted feature direction of the second data; The determining step determines that an operational abnormality has occurred in the managed process at the second time when the second index value calculated in the calculating step exceeds the first index value set as the threshold value. An abnormality management method characterized by:

12. The abnormality management method according to claim 9 or 11, Further, the method includes an instruction step of issuing an instruction to execute a predetermined measure to resolve the operational abnormality of the process when it is determined in the determination step that an operational abnormality has occurred in the process to be managed. An abnormality management method characterized by:

Images