Abnormality management device and abnormality management method

Abstract

The purpose is to easily manage abnormal program operation. [Solution] The abnormality management device 1 is equipped with a second learning unit 13 configured to update the classifier parameters of a classifier 132 that distinguishes between true normal data and pseudo-normal data in a direction that maximizes an objective function based on the probability distribution of normal data and the probability distribution of abnormal data determined from the ratio estimated by the first learning unit 11, while keeping the generator parameters of a generator 131 fixed, which generates pre-conversion pseudo-normal data before the dependency relationships converted by the conversion unit 12 are reflected, assuming that the normal data reflects the dependency relationships converted by the conversion unit 12 as true normal data.

Description

[Technical Field]

[0001] The present invention relates to an abnormality management device and an abnormality management method. [Background technology]

[0002] In recent years, the demands on software have become more sophisticated and complex in order to provide high-performance systems and services. The software implemented in high-performance systems consists of programs with huge amounts of source code, and the execution of these programs has become even more complex due to parallelization such as multithreading.

[0003] When a process failure or operational abnormality occurs in an operational system, it takes time to identify the part of the program that is causing the failure or abnormality. If it takes a long time to recover from the failure, the service will be interrupted for a long time, which will have a significant impact on users.

[0004] Conventionally, when an error that makes it impossible to continue processing occurs due to a system failure or abnormal program processing during process execution and the program is forcibly terminated, a configuration is known in which the memory state is dumped to a core file in the system. For example, Patent Document 1 discloses a technology in which a core file output to a hard disk is read into a debugger to retroactively analyze the location where the error occurred, the values ​​of variables at that time, etc.

[0005] However, the technology disclosed in Patent Document 1 cannot detect potential errors, so when a fatal error occurs, the program is forcibly terminated and the cause of the error is analyzed, making it difficult to easily manage abnormal program operation. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Laid-Open No. 2005-301570 Summary of the Invention [Problem to be solved by the invention]

[0007] As described above, with the conventional technology, when an abnormality in the operation of a program occurs, it is not possible to easily manage the abnormality in the operation of the program.

[0008] The present invention has been made to solve the above-mentioned problems, and has as its object to easily manage abnormalities in program operation. [Means for solving the problem]

[0009] In order to solve the above-described problems, the anomaly management device according to the present invention includes a first learning unit configured to learn parameters representing a ratio between a probability distribution of normal data indicating a normal transition sequence of an execution state for each observation unit, observed in response to an operation of a process, and a probability distribution of abnormal data indicating a transition sequence of an execution state for each observation unit, including abnormal transitions of the execution state that deviate from the normal transitions of the execution state, and to estimate the ratio based on the learned parameters; a first conversion unit configured to convert the normal data into normal data that reflects the dependency relationships, using a sequence learning model including pre-set model parameters that represent the dependency relationships between observation units inherent in the transition sequence of the normal execution state for each observation unit; and a first conversion unit configured to consider the normal data that reflects the dependency relationships converted by the first conversion unit as true normal data and generate pre-conversion pseudo-normal data before the dependency relationships are reflected, which corresponds to pseudo-normal data that is sufficiently deviated from the distribution of the true normal data. The system includes: a second learning unit configured to update classifier parameters of a classifier that distinguishes between the true normal data and the pseudo-normal data in a direction that maximizes an objective function based on the probability distribution of the normal data and the probability distribution of the abnormal data determined from the ratio estimated by the first learning unit, while keeping generator parameters of the generator fixed, and to train a generative model including the generator and the classifier; a generation unit configured to generate the pre-conversion pseudo-normal data by the generator included in the generative model trained by the second learning unit; a second conversion unit configured to convert the pre-conversion pseudo-normal data generated by the generation unit into the pseudo-normal data reflecting the dependency relationship, using the sequence learning model; and a storage unit configured to store data that has been converted by the second conversion unit and reflects the dependency relationship and that has been identified as the pseudo-normal data by the classifier included in the generative model trained by the second learning unit.

[0010] In addition, the abnormality management device of the present invention may further include an adjustment unit configured to adjust the model parameters of the sequence learning model according to the state of learning of the generation model by the second learning unit, wherein the first conversion unit is configured to convert the normal data into normal data reflecting the dependency relationship using the sequence learning model having the model parameters adjusted by the adjustment unit, and the second conversion unit is configured to convert the pre-conversion pseudo-normal data generated by the generation unit into the pseudo-normal data reflecting the dependency relationship using the sequence learning model having the model parameters adjusted by the adjustment unit.

[0011] In addition, the abnormality management device of the present invention may further include a collection unit configured to collect a transition sequence of execution states for each observation unit observed in response to the operation of the managed process; a third conversion unit configured to convert, using the sequence learning model, the transition sequence of execution states for each observation unit observed in response to the operation of the managed process into a transition sequence of execution states for each observation unit observed in response to the operation of the managed process in which the dependency is reflected; and a determination unit configured to determine that an operational abnormality has occurred in the managed process when the transition sequence of execution states for each observation unit observed in response to the operation of the managed process in which the dependency is reflected matches the pseudo-normal data in which the dependency is reflected and which is stored in the memory unit.

[0012] In addition, the abnormality management device of the present invention may further include an instruction unit configured to send an instruction to perform predetermined control to respond to the operational abnormality of the managed process when the judgment unit determines that an operational abnormality has occurred in the managed process.

[0013] In the abnormality management device according to the present invention, the execution state for each observation unit may include the execution state of a thread that constitutes the process, or the execution state of the process.

[0014] In the abnormality management device according to the present invention, the sequence learning model may be a recurrent neural network model.

[0015] In order to solve the above-mentioned problems, the anomaly management method according to the present invention includes a first learning step of learning parameters representing a ratio between a probability distribution of normal data indicating a normal transition sequence of an execution state for each observation unit, observed in response to an operation of a process, and a probability distribution of abnormal data indicating a transition sequence of an execution state for each observation unit, including abnormal transitions of an execution state that deviate from the normal transitions of the execution state, and estimating the ratio based on the learned parameters; a first conversion step of converting the normal data into normal data that reflects the dependency relationship between the observation units, using a sequence learning model having pre-set model parameters that represent the dependency relationship between the observation units inherent in the transition sequence of the normal execution state for each observation unit; and a generator of generating pre-conversion pseudo-normal data before the dependency relationship is reflected, which corresponds to pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, using the normal data that reflects the dependency relationship converted in the first conversion step as true normal data. a second learning step of learning a generative model including the generator and the classifier by updating classifier parameters of a classifier that distinguishes between the true normal data and the pseudo-normal data in a direction that maximizes an objective function based on the probability distribution of the normal data and the probability distribution of the abnormal data determined from the ratio estimated in the first learning step while keeping the generator parameters fixed; a generation step of generating the pre-conversion pseudo-normal data by the generator included in the generative model trained in the second learning step; a second conversion step of converting the pre-conversion pseudo-normal data generated in the generation step into the pseudo-normal data reflecting the dependency relationship using the sequence learning model; and a storage step of storing, in a storage unit, the data that has been identified as the pseudo-normal data by the classifier included in the generative model trained in the second learning step, from the pseudo-normal data that has been converted in the second conversion step and reflects the dependency relationship.

[0016] Furthermore, the anomaly management method according to the present invention may further include an adjustment step of adjusting the model parameters of the sequence learning model according to the state of learning of the generative model in the second learning step, wherein the first conversion step uses the sequence learning model having the model parameters adjusted in the adjustment step to convert the normal data into normal data reflecting the dependency, and the second conversion step uses the sequence learning model having the model parameters adjusted in the adjustment step to convert the pre-conversion pseudo-normal data generated in the generation step into the pseudo-normal data reflecting the dependency.

[0017] Furthermore, the anomaly management method according to the present invention may further include a collection step of collecting a transition sequence of the execution state for each observation unit observed in response to the operation of the managed process; a third conversion step of converting, using the sequence learning model, the transition sequence of the execution state for each observation unit observed in response to the operation of the managed process into a transition sequence of the execution state for each observation unit observed in response to the operation of the managed process in which the dependency is reflected; and a determination step of determining that an operational anomaly has occurred in the managed process when the transition sequence of the execution state for each observation unit observed in response to the operation of the managed process in which the dependency is reflected matches the pseudo-normal data in which the dependency is reflected and which is stored in the memory unit.

[0018] Furthermore, the abnormality management method according to the present invention may further include an instruction step of sending an instruction to perform predetermined control to deal with the operational abnormality in the managed process when it is determined in the determination step that an operational abnormality has occurred in the managed process. [Effects of the Invention]

[0019] According to the present invention, normal data that has been converted by a first conversion unit and reflects the dependency relationship is regarded as true normal data, and pre-conversion pseudo-normal data that corresponds to pseudo-normal data that is sufficiently deviated from the distribution of true normal data is generated. While fixing generator parameters of the generator, which generates pre-conversion pseudo-normal data before the dependency relationship is reflected, the classifier parameters of the classifier that distinguishes true normal data from pseudo-normal data are updated in a direction that maximizes an objective function based on the probability distribution of normal data and the probability distribution of abnormal data determined from the ratios estimated by the first learning unit, thereby performing training of a generative model including the generator and the classifier. This makes it possible to easily manage program operation abnormalities. [Brief explanation of the drawings]

[0020] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality management system including an abnormality management device according to an embodiment of the present invention. [Figure 2A] FIG. 2A is a diagram for explaining an operational abnormality of a process managed by the abnormality management device according to this embodiment. [Figure 2B] FIG. 2B is a diagram for explaining an operational abnormality of a process managed by the abnormality management device according to this embodiment. [Figure 3] FIG. 3 is a schematic diagram showing an example of the configuration of a sequence learning model used by the abnormality management device according to this embodiment. [Figure 4] FIG. 4 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 5] FIG. 5 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 6] FIG. 6 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 7] FIG. 7 is a diagram for explaining the generating unit included in the abnormality management device according to this embodiment. [Figure 8] FIG. 8 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 9]FIG. 9 is a sequence diagram showing the operation of the abnormality management system according to this embodiment. [Figure 10] FIG. 10 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 11A] FIG. 11A is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 11B] FIG. 11B is a flowchart showing the operation of the abnormality management device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0021] Preferred embodiments of the present invention will now be described in detail with reference to FIGS. 1 to 11B.

[0022] [Configuration of anomaly management system] First, an overview of an abnormality management system including an abnormality management device 1 according to an embodiment of the present invention will be described. As shown in Fig. 1, the abnormality management system includes the abnormality management device 1 and an information processing device 2, and the abnormality management device 1 and the information processing device 2 are connected via a network NW such as a WAN (Wide Area Network), a LAN (Local Area Network), or the Internet.

[0023] The anomaly management system of this embodiment reflects a ratio based on the probability distribution of normality and abnormality in the objective function of a generative model that handles transition series of execution states that reflect the dependencies between observation units inherent in the transition series of execution states observed for each observation unit, generates pseudo-normal data that deviates from the normal distribution, and builds a database for determining process operation abnormalities.

[0024] The information processing device 2 can be realized by a computer equipped with a processor, a main memory device, a communication interface, an auxiliary memory device, and an input / output (I / O), and a program that controls these hardware resources. The information processing device 2 records a transition sequence of the execution state for each observation unit observed according to the operation of the process in the target program, and sends it to the fault management device 1.

[0025] The information processing device 2 is a device that applies a general-purpose multitasking OS such as Linux (registered trademark), Windows (registered trademark), etc. The information processing device 2 may be a device that cooperatively executes multiple processes or threads, such as a communication control device provided in a core network of a mobile communication network, a cloud server, a distributed database server, a machine learning inference server, or an industrial control device, and its use and configuration are not limited.

[0026] The programs executed on the computer of the information processing device 2 include single-threaded and multi-threaded processes. A process, which is the execution unit of a program, is managed by the OS, holds variables and states used within the program, and is composed of one or more threads.

[0027] In addition, in this embodiment, the execution state observed according to the operation of a process includes the execution state of one or more threads constituting the process, and indicates information characterizing the operation of the thread, such as the state of a CPU core assigned to the thread and the state of various variable values ​​in a memory area accessed or held by the thread. The transition of the execution state of a thread refers to a state transition that changes while reflecting the operation state of its constituent threads as the thread executes instructions sequentially, in parallel, or concurrently. In the following description, the execution state will be referred to as the execution state, but the execution state observed may be on a process-by-process basis.

[0028] When a process is operating normally, the threads that make up the process execute predetermined instructions sequentially or in parallel according to the source code, thereby allowing the process as a whole to perform predetermined processing. On the other hand, if an operational abnormality occurs in the process, one of the threads will stop or become unable to respond, and the process as a whole will be unable to execute the next instruction. In this way, in this embodiment, the state transitions that are managed are those in which the process is unable to execute all of the predetermined instructions due to some kind of operational abnormality and is unable to transition to the next execution state.

[0029] Each execution state is defined based on the type of instructions and functions executed by the thread, the processing phase, etc. At this time, the corresponding location in the source code and function block can be identified from the instructions executed in each execution state. Here, source code refers to a sequence of instructions written in a programming language that specifies the operational structure and processing procedure of a thread or process. Note that a thread transitions between each execution state by executing instructions converted from source code into machine code.

[0030] 2A and 2B are diagrams illustrating normal data, which is a normal execution state transition sequence for each observation unit observed according to the operation of a process, and abnormal data, which includes abnormal execution state transitions. An observation unit is a division for identifying the operation of a thread that constitutes a process, and examples include time, occurrence of a state transition, occurrence of an event, execution thread, and processing phase. A thread execution state transition sequence is a chronological or logical sequence of states observed in each observation unit.

[0031] Each node S in Figure 2A represents an execution state, which is the internal state of a process, for example, representing the execution state in a single thread. Each arrow represents a state transition, with solid arrow C representing normal data, which is a transition sequence of the normal execution state of a thread, and dotted arrow E1 representing abnormal data, which is a transition sequence of the abnormal execution state of a thread. As shown in Figure 2A, the abnormal data E1 has some state transitions that are different from the transition sequence of the normal data C, indicating a deviation from the normal operation sequence. The abnormal data E1 indicates a violation of the state transition order or a transition to an undefined state.

[0032] FIG. 2B shows an example of the transition of the execution state of threads based on the observation results of process numbers 1 to n (n is an integer equal to or greater than 2). n-1 ,S n indicates normal data, which is a transition sequence of the normal execution states of the threads that make up the process. On the other hand, S1, S2,...,S n-2 ,S n-2 ,S n-2 As such, the same state S n-2 A transition sequence in which the following is repeatedly observed indicates abnormal data including abnormal execution state transition E2. Here, the process number corresponds to the observation unit in which the execution state is observed, and as described above, is the order in which the state transitions of data processing units, such as the execution order of threads constituting a process, time, event occurrence order, or transaction or request processing order, are observed and recorded. As shown in Figure 2B, in the abnormal data, state updates have stopped from process number n-2 to process number n, and the same state transition E2 is repeatedly observed, which indicates the occurrence of an error such as a deadlock.

[0033] In this embodiment, known transition anomalies such as transition order anomalies exemplified in FIGS. 2A and 2B, state transition anomalies in which a loop of the same state occurs, transition timing anomalies, parallel conflict anomalies, etc. can be managed.

[0034] [Function block of the abnormality management device] Next, functional blocks of the abnormality management device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the abnormality management device 1 includes a collection unit 10, a first learning unit 11, conversion units (first conversion unit, second conversion unit, third conversion unit) 12, a second learning unit 13, an adjustment unit 14, a generation unit 15, an abnormal operation database (storage unit) 16, a determination unit 17, an instruction unit 18, and a storage unit 19.

[0035] The collection unit 10 collects normal data indicating normal execution state transition sequences for each observation unit observed in accordance with the operation of the process, and abnormal data indicating execution state transition sequences observed for each observation unit, including abnormal execution state transitions that deviate from the normal execution state transitions. The collection unit 10 collects, from the information processing device 2, execution state transition sequences of threads within a process of a target program that have been processed and recorded by the information processing device 2. The collection unit 10 may collect execution state transition sequences from multiple information processing devices 2. In this case, the collection unit 10 performs preprocessing such as abstraction of the execution state and feature scaling on the collected data to correct for differences in execution timing, processing load, etc. specific to each device.

[0036] The collection unit 10 can classify the collected execution state transition sequences into normal data and abnormal data by labeling them based on a rule base or statistical threshold, and collect these data. Abnormal data can include not only fatal errors that result in the forced termination of a process, but also data indicating predefined potential errors, such as deadlocks and hangs. While it is possible to collect a large amount of normal data, abnormal data occurs very rarely, making it difficult to collect a sufficient amount. Therefore, the amount of abnormal data collected by the collection unit 10 is significantly smaller than the amount of normal data (normal data >> abnormal data).

[0037] The collection unit 10 collects, as training data for the first learning unit 11, sequence data consisting only of transitions of the execution states of normal threads and sequence data in which the transitions of the execution states of some threads include abnormal transitions. The collection unit 10 also collects normal data relating to normal transition sequences of the execution states for each observation unit, observed in accordance with the operation of the process, as data to be converted by the conversion unit 12. The collection unit 10 also collects transition sequences of the execution states for each observation unit, observed in accordance with the operation of the process to be managed, which are the targets of abnormality judgment by the judgment unit 17. In addition to collecting data of the managed objects, the collection unit 10 also collects identification information of the information processing device 2 that executes the managed processes.

[0038] The first learning unit 11 learns parameters representing the ratio between a probability distribution of normal data indicating a normal execution state transition sequence for each observation unit observed in response to the operation of the process and a probability distribution of abnormal data indicating an execution state transition sequence observed for each observation unit, including abnormal execution state transitions that deviate from the normal execution state transitions, and estimates the ratio based on the learned parameters. The first learning unit 11 learns parameters representing the density ratio of a probability density function, which is the probability distribution of normal data and abnormal data, using the normal execution state transition sequence of a thread observed for each observation unit, which is available in large quantities, and the abnormal execution state transition sequence of a thread observed for each observation unit, which is available in small quantities compared to the normal execution state transition sequence. The first learning unit 11 also estimates the density ratio from the learned parameters.

[0039] Here, let D={x (1) ,x (2) ,…,x (N)}, the set of training data including abnormal data is D'={x' (1) ,x' (2) ,…,x' (N’)}. x indicates the transition of the thread execution state for each observation unit. Each observation data x (n) is M-dimensional and x (n) =(x1 (n) ,x2 (n) ,…,xM (n) For example, if there are 1000 observation units (=M), the dimension is 1000. Each component x i (n) indicates the transition of the execution state of a thread in observation unit i.

[0040] In the following, D is called normal data and D' is called abnormal data, and the probability density function of normal data D is called p(x) and the probability density function of abnormal data D' is called p'(x). The probability density function p(x) of normal data D indicates the distribution of the probability that a normal execution state transition x of a thread is observed in a certain observation unit. Also, the probability density function of abnormal data D' indicates the distribution of the probability that a thread execution state transition x is observed in a certain observation unit. The density ratio r(x) between the probability density function p(x) of normal data D and the probability density function p'(x) of abnormal data D' is expressed by the following equation (1).

number

[0041]

number

[0042] The basis function ψ(x) is defined by the RBF (Radial Basis Function) kernel and expressed by the following equation (3).

number

[0043] Here, based on the above formula (1), the specific form of the above formula (3) in which the number of bases b is the number of training data N (b=N) is given by the following formula (4).

number

[0044] The above equation (4) expresses the density ratio as a linear sum of RBFs centered on all training points. Here, we introduce the generalized Kullback-Leibler divergence (KL divergence), which measures the information-theoretic distance between non-negative functions f and g, as shown in the following equation (5).

number

[0045] In density ratio estimation, f=p(x) and g=r θ Substituting p'(x) into the above equation (5), the following equation (6) is used as the objective function.

number

[0046] In the above equation (6), each x n , x' n’ The optimization objective function obtained by approximating the integral with an empirical distribution that sets values ​​other than θ to 0, ignoring terms that do not depend on the parameter θ, and dropping constants is expressed as the following equation (7).

number

[0047] By minimizing J(θ) in equation (7), the density ratio r θ Since J(θ) is a convex function, the first learning unit 11 updates the parameter θ from the initial value until convergence using the parameter θ update formula by the gradient descent method of the following formula (8).

number

[0048] The result of specifically calculating the gradient of the above formula (7) is expressed by the following formula (9).

number

[0049] The first term in the above equation (9) represents the contribution from abnormal data, and the second term represents the contribution from normal data. Since the second term is dominant in the above equation (9), stable estimation is possible when the number of normal data N is large. In other words, even when the amount of abnormal data N' is small, the parameter θ can be stably calculated.

[0050] Before calculating the optimal solution of the parameter θ using the above equations (7) to (9), the first learning unit 11 calculates an appropriate value for the bandwidth h in the above equation (4) by cross-validation, information criterion (KL divergence minimization criterion), etc. Based on the optimal solution of the parameter θ calculated by the KL density ratio estimation method, the first learning unit 11 calculates the density ratio r for an arbitrary input x using the above equation (2). θ The density ratio estimated by the first learning unit 11 is passed to the second learning unit 13, which will be described later.

[0051] The conversion unit 12 is used as a feature conversion model for converting transition sequence data of the execution states of threads for each observation unit handled by a generative model in the second learning unit 13 described below into data reflecting features that represent the dependency between the preceding and succeeding observation units in the sequence data. The conversion unit 12 converts normal data into normal data that reflects the dependency, using a sequence learning model that has pre-set model parameters that represent the dependency between the observation units inherent in the transition sequence of the execution states of threads for each observed observation unit.

[0052] Furthermore, the converter 12 uses a sequence learning model to convert pre-conversion pseudo-normal data generated by the generator 15 (described later) into pseudo-normal data that reflects the inter-observation unit dependency relationships inherent in the execution state transition sequences for each observation unit. The converter 12 also uses a sequence learning model having model parameters adjusted by the adjuster 14 (described later) to convert normal data into normal data that reflects the inter-observation unit dependency relationships inherent in the execution state transition sequences. Similarly, the converter 12 uses a sequence learning model having model parameters adjusted by the adjuster 14 to convert pre-conversion pseudo-normal data generated by the generator 15 into pseudo-normal data that reflects the inter-observation unit dependency relationships inherent in the execution state transition sequences observed for each observation unit. Furthermore, the converter 12 converts the execution state transition sequences observed for each observation unit in the operation of the managed process collected by the collector 10 into execution state transition sequences observed for each observation unit that reflect the inter-observation unit dependency relationships inherent in the execution state transition sequences observed for each observation unit, and passes the converted data to the determiner 17.

[0053] A sequence learning model is a model that sequentially inputs the transitions of thread execution states observed for each observation unit that constitutes an input sequence, and generates feature representations that take into account the relationship between previous and next observation units while sequentially updating the internal state. Sequence learning models include, but are not limited to, a recurrent neural network (RNN), a long short-term memory (LSTM), or a model equipped with a self-attention mechanism.

[0054] When a transition sequence (normal data) of the normal execution state of a thread observed for each observation unit is input to the sequence learning model, the sequence learning model performs calculations on the input sequence based on the model parameters, and outputs normal data as an output sequence, which is a data representation in which dependencies between sequences have been extracted or emphasized, while retaining the sequence features contained in the transition sequence of the execution state of the thread observed for each observation unit of the input sequence. As shown in Figure 4, by providing the sequence learning model on the output side of generator 131 and on the input side of classifier 132 included in the generative model described below, it becomes possible for the generative model to generate data while retaining the features between observation units of the sequence data.

[0055] Here, we will explain an example in which an RNN is used as a sequence learning model. Figure 3 is a schematic diagram showing the network structure of an RNN. As shown in Figure 3, the RNN is composed of a neural network consisting of an input layer X, a hidden layer H which is a memory cell, and an output layer Y. Each node in Figure 3 represents the input x at each observation unit t. (t) , hidden state (internal state) h (t) , and output y (t) First, input x (t) and the hidden state of the previous observation unit h (t-1) are multiplied by the corresponding weight matrices U and W, respectively, and a bias term b is added, thereby performing the linear operation shown in the following equation (10).

[0056]

number

[0057] In the above equation (10), a (t) is the intermediate value for updating the hidden state at observation unit t, and represents the weighted sum that integrates the information of the input and past states. (t) By applying the nonlinear activation function σ(·) to the new hidden state h, as shown in the following equation (11), (t) is obtained.

[0058]

number

[0059] The hidden state h in the above equation (11) (t) is an internal representation that reflects the features based on the current input while retaining the past sequence information, and is carried over to the processing of the next observation unit t+1. Furthermore, this hidden state h (t) Based on this, the output y (t) is calculated.

[0060]

number

[0061] In the above equation (12), V is the weight matrix from the hidden state to the output, and c is the bias term for the output layer. In this way, the RNN recursively uses the hidden state of the previous observation unit in the input processing of the next observation unit, and conveys information from the hidden state of the previous observation unit to the hidden state of the next observation unit, so it is structured to generate an output that reflects the sequential dependency inherent in the transition sequence of the thread execution state.

[0062] Pre-set values ​​are used for the model parameters of the sequence learning model. In the RNN of FIG. 3, values ​​set in advance based on empirical rules are used for the model parameters U, W, V, b, and c. When the model parameter values ​​are adjusted by the adjustment unit 14 (described later), the conversion unit 12 performs conversion processing based on the sequence learning model in which the adjusted model parameters (U', W', V', b', c') are set.

[0063] The second learning unit 13 regards normal data, in which the dependency relationships between observation units converted by the conversion unit 12 (first conversion unit) are reflected, as true normal data, and generates pre-conversion pseudo-normal data before the dependency relationships between observation units are reflected, corresponding to pseudo-normal data that is sufficiently deviated from the distribution of true normal data, while keeping fixed generator parameters of the generator 131 that generates pre-conversion pseudo-normal data before the dependency relationships between observation units are reflected, in a direction that maximizes an objective function based on the probability density function (probability distribution) of normal data and the probability density function (probability distribution) of abnormal data determined from the density ratio (ratio) estimated by the first learning unit 11, thereby learning a generative model. The pre-conversion pseudo-normal data before the dependency relationships between observation units corresponding to pseudo-normal data are reflected is data before being converted by the conversion unit 12 (second conversion unit).

[0064] As shown in FIG. 4, the second learning unit 13 executes a Max learning phase of a GAN (Generative Adversarial Network) as a generative model having a generator 131 and a classifier 132, in which only the parameters of the classifier 132 are updated while the generator 131 is fixed. When the transition sequence of normal execution states of threads for each observation unit converted by the conversion unit 12 is considered to be true normal data, the second learning unit 13 aims to generate pseudo-normal data (pseudo-normal data before being converted by the conversion unit 12) that deviates sufficiently from the distribution of normal data, that is, a transition sequence of execution states of threads that can be treated as abnormal data. For this reason, the second learning unit 13 does not execute the Min learning phase of the normal GAN ​​adversarial learning procedure in which the generator 131 is updated in the minimization direction.

[0065] As shown in FIG. 4, the generative model according to this embodiment, which includes the generator 131 and the discriminator 132, generates a normal execution state transition x=(x1, x2, ..., x) of the thread observed in each observation unit converted by the conversion unit 12. M) as training data for learning. Here, pseudo-normal data that deviates sufficiently from the distribution of normal data is a generated sequence that, in terms of statistical properties, is located in a region that significantly deviates from the normal range of normal data, relative to normal data that indicates the transition sequence of normal thread execution states. When the index used for distance or deviation from normal data is log-likelihood, a sequence with a smaller likelihood corresponds to the pseudo-normal data. When the index used is cross-entropy, the larger the entropy value, the more deviation the sequence. Furthermore, when the KL distance is used as the index, a sequence with a large deviation in the overall distribution is treated as a sequence that deviates sufficiently.

[0066] 4, a conversion unit 12 equipped with a sequence learning model is provided on the input side of the classifier 132 of the generative model and on the output side of the generator 131. An adjustment unit 14 that adjusts the model parameters of the sequence learning model is provided between the objective function 135 of the generative model and the conversion unit 12.

[0067] 5 and 6 are diagrams schematically illustrating the neural network configuration of the generator 131 and the classifier 132 of the generative model used by the second learning unit 13. As shown in FIG. 5, the generator 131 is configured as a neural network having an input layer, a hidden layer, and an output layer. The generator 131 is a model that generates pseudo-normal data from random noise. For example, m randomly sampled vectors of Gaussian noise (z1 to z m ).

[0068] The generator 131 outputs the output G(z) after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The output G(z) from the generator 131 is pseudo-normal data before conversion that corresponds to pseudo-normal data that deviates from the distribution of true normal data. CNN or ResNet can be used as the neural network that constitutes the generator 131.

[0069] The classifier 132 shown in Fig. 6 is configured with a neural network having an input layer, a hidden layer, and an output layer. In the example of Fig. 6, as the input of training data, a transition sequence of the normal execution state of a thread, which has been converted by the conversion unit 12 and reflects the dependency relationship between observation units, is given as true normal data. Each input node shown in Fig. 6 is provided with times t1 to t M and the output values ​​x1 to x of the sequence learning model for the transition of the thread execution state for process numbers 1 to M. M are input respectively.

[0070] The classifier 132 outputs a probability value between 0 and 1 after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. When the classifier 132 correctly identifies the training data related to the input true normal data as true normal data, it outputs a value close to the output y=1. On the other hand, when the classifier 132 correctly identifies the training data related to the input pseudo normal data as pseudo normal data, it outputs a value close to the output y=0. In this way, the classifier 132 is a model that distinguishes the model distribution generated by the generator 131 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 132.

[0071] As shown in the block diagram of FIG. 4, the generator 131 of the generative model adopted by the second learning unit 13 is represented as a function G, and the discriminator 132 is represented as a function D. Furthermore, true normal data is represented as x, the predicted value output by the discriminator 132 is represented as y, and the correct label is represented as t. The correct label t is set to 1 for true normal data and 0 for pseudo-normal data generated by the generator 131 and converted by the conversion unit 12. In this case, the discriminator 132 calculates the cross entropy E CE It can be expressed as:

[0072]

number

[0073] The first term in the brace of the above equation (13) represents t n lnyn In this case, the predicted value y n is the correct label of the true normal data, t n = 1. On the other hand, the second term in the braces represents (1-t n )ln(1-y n ), the predicted value y n is the correct label value (1-t n ) = 0. In this way, the cross entropy E CE is the maximum value when the predicted value matches the correct label value.

[0074] Here, the generator 131 that configures the generative model uses parameters w G ,θ G and the function G(w G ,θ G ) The classifier 132 uses the parameter w D ,θ D and function D(w D ,θ D ) The cross entropy E in the above equation (13) CE The loss function (objective function E) of the generative model including the generator 131 and the discriminator 132 based on the above can be expressed by the following equation (14).

number

[0075] The first term of the above equation (14) represents E D(x)=1 lnD(w D ,θ D ) is the expected value at which the classifier 132 classifies true normal data as true normal data. D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D )) is the expected value at which the classifier 132 classifies the pseudo-normal data generated by the generator 131 and converted by the converter 12 as pseudo-normal data. Here, the expected value of the above formula (14) can be expressed as the following formula (15) using a probability distribution.

[0076]

number

[0077] Here, for the probability density function p(x) of normal data and the probability density function p'(x) of abnormal data in the above formula (1), in order to form a probabilistic labeled classification problem for Max optimization learning of GAN, let p(x)≡ρ(x|y=1) and p'(x)≡ρ(x|y=0). The density ratio r estimated by the first learning unit 11 is θ (x) is defined by the following equation (16).

number

[0078] The probability density function ρ(x|y=1), which is the conditional probability distribution of normal data in the above equation (16), can be calculated from a large amount of normal data using maximum likelihood estimation, etc. Using the calculated probability density function ρ(x|y=1) of normal data, the probability density function ρ(x|y=0), which is the conditional probability distribution of abnormal data, can be expressed by the following equation (17).

number

[0079] The probability density function ρ(x|y=1) of normal data and the probability density function ρ(x|y=0) of abnormal data in the above formula (17) are substituted into the objective function E in the above formula (15), and the prior probability ρ(y=1) of the normal (y=1) class and the prior probability ρ(y=0) of the abnormal (y=0) class are set to set values. For example, the prior probability values ​​are arbitrarily set as ρ(y=1):ρ(y=0)=0.99:0.01, and these prior probability values ​​can be adjusted as needed. Furthermore, the posterior probability ρ(y=1|x) of normality for a transition x of the thread execution state for each observed observation unit is calculated as D(w D ,θ D) and the posterior probability ρ(y=0|x) of anomaly for a transition x of the thread execution state for each observation unit is 1-D(G(w G ,θ G ),w D ,θ D ) Each posterior probability corresponds to the density ratio r θ and can be obtained from the prior probability.

[0080] Here, when the generator 131 is fixed, the objective function E becomes a maximization problem of the following equation (18) with respect to the discriminator 132.

number

[0081] In the training of the generative model of this embodiment, as described above, only Max optimization of the objective function E is performed, and the parameters of the discriminator 132 with the generator 131 fixed are trained. This prevents the output of the generator 131 from converging to the distribution of normal data, and instead maintains a sequence that is sufficiently deviated from the distribution of normal data. When the update of the discriminator 132 has converged, the pseudo-normal data sequence output by the fixed generator 131 and converted by the conversion unit 12 has a low likelihood relative to the transition sequence of a normal execution state. At this time, the generator 131 can generate pseudo-normal data before conversion that has the statistical properties expressed by the following equation (19).

number

[0082] The adjustment unit 14 adjusts the model parameters of the sequence learning model according to the state of learning of the generative model by the second learning unit 13. As described above, the model parameters of the sequence learning model are set as initial values ​​based on predetermined values ​​such as empirical rules. As shown in FIG. 4, the adjustment unit 14 monitors the loss transition and output distribution of the classifier 132 during the optimization learning process of the generative model by the second learning unit 13, and adjusts the values ​​of the model parameters of the sequence learning model based on the evaluation (the arrow between the objective function 135 and the conversion unit 12 in FIG. 4). The adjustment unit 14 performs an evaluation, for example, every time the loss of the classifier 132 is calculated, and adaptively adjusts the values ​​of the model parameters of the sequence learning model based on the evaluation result, independently of the gradient propagation of the generative model. Adjusting the model parameters of the sequence learning model by the adjustment unit 14 can improve the learning accuracy of the generative model.

[0083] The generation unit 15 generates pre-conversion pseudo-normal data using a generator 131' included in the generative model trained by the second learning unit 13. As shown in FIG. 7, the generation unit 15 inputs noise to the trained generator 131', causing the conversion unit 12 to generate a large amount of pre-conversion pseudo-normal data. The pre-conversion pseudo-normal data generated by the generation unit 15 is passed to the conversion unit 12. Furthermore, the conversion unit 12, connected to the output side of the trained generator 131', converts the pre-conversion pseudo-normal data into pseudo-normal data that reflects the dependency between observation units through the operation of the sequence learning model.

[0084] The abnormal operation database 16 stores data that is identified as pseudo-normal data by the classifier 132' included in the generative model trained by the second learning unit 13, out of the pseudo-normal data that has been converted by the conversion unit 12 (second conversion unit) and that reflects the dependency relationships between observation units. Specifically, the abnormal operation database 16 stores data that has been determined as 0 (abnormal) >> 1 (normal) as the output of the trained classifier 132' in the pseudo-normal data converted by the conversion unit 12. In this way, the abnormal operation database 16 accumulates pseudo-normal data that can be considered as a transition sequence of abnormal execution states for each observation unit in the operation of a process, and constructs a database of transition sequences to be used in the abnormality determination process.

[0085] The judgment unit 17 judges that an abnormal operation has occurred in the managed process when the transition series of execution states for each observation unit, which is converted by the conversion unit 12 and observed according to the operation of the managed process in which the dependency relationships between the observation units are reflected, matches the pseudo-normal data that reflects the dependency relationships between the observation units stored in the abnormal operation database 16.

[0086] The pseudo-normal data (1 to L pieces) (L is a positive integer of 2 or more) stored in the abnormal operation database 16 is composed of a transition sequence of thread execution states observed in observation units of 1 to D (D is a positive integer of 2 or more), and the transition sequence of thread execution states for each observation unit observed according to the operation of a certain managed process, and are expressed as follows:

number

[0087] The judgment unit 17 compares the transition series of the execution state of the thread observed in accordance with the operation of the managed process in observation units of 1 to D with the transition series of the execution state of the pseudo-normal data in observation units of 1 to D, and if there is a match, judges that an abnormal operation of the managed process has occurred.

[0088] Furthermore, the determining unit 17 can determine that an abnormal operation has occurred in a process to be managed when a predetermined threshold value TH is exceeded, using the conditional expression of the following equation (20).

[0089]

number

[0090] In the above formula (20), l represents pseudo-normal data from 1 to L, and the threshold value TH determines the allowable range for determining the similarity between the pseudo-normal data and the transition sequence of the execution state of the thread for each observation unit converted by the conversion unit 12, and can be set arbitrarily based on the distance distribution of the transition sequence of the execution state of the thread for each observation unit in the operation of the converted managed process. In the above formula (20), the pseudo-normal data from 1 to L are used in order to perform threshold determination.

[0091] When the determination unit 17 determines that an operational abnormality has occurred, the instruction unit 18 sends an instruction to perform predetermined control to deal with the operational abnormality of the managed process. The instruction unit 18 instructs the information processing device 2 that executes the managed process to restart or switch to a backup system. The instruction unit 18 can also send data on the transition sequence of the abnormal execution state of the managed process to an analysis device (not shown) and instruct it to identify the location of the error.

[0092] The memory unit 19 stores the parameter θ and the density ratio r estimated by the learning by the first learning unit 11. θ The storage unit 19 also stores the generator 131′ and the classifier 132′ included in the trained generative model, as well as the model parameters of the sequence learning model adjusted by the adjustment unit 14.

[0093] [Hardware configuration of the fault management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the above-described functions will be described with reference to FIG.

[0094] 8, the fault management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program for controlling these hardware resources. Furthermore, the fault management device 1 includes a display device 107.

[0095] The processor 102 is a circuit or device that performs arithmetic processing, and is realized by, for example, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc. Alternatively, the processor 102 may be configured by combining some or all of these.

[0096] The main memory device 103 is configured, for example, with a volatile random access memory (RAM), and pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 realize the functions of the abnormality management device 1, such as the collection unit 10, first learning unit 11, conversion unit 12, second learning unit 13, adjustment unit 14, determination unit 17, and instruction unit 18 shown in FIG.

[0097] The communication interface 104 is an interface circuit for connecting the abnormality management device 1 to various external electronic devices via a network.

[0098] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use non-volatile storage such as a hard disk or flash memory as the storage medium.

[0099] The auxiliary storage device 105 has a program storage area for storing an abnormality management program. The auxiliary storage device 105 also has a program storage area for storing parameters representing the density ratio of the probability density functions of normal data and abnormal data executed by the abnormality management device 1, and a first learning program for estimating the density ratio. The auxiliary storage device 105 also has a program storage area for storing a program by which the conversion unit 12 performs calculations on the sequence learning model. The auxiliary storage device 105 also has a program storage area for storing a second learning program for learning the generative model executed by the abnormality management device 1.

[0100] The auxiliary storage device 105 realizes the abnormal operation database 16 and the storage unit 19 described in Fig. 1. Furthermore, for example, it may have a backup area for backing up the above-mentioned data, programs, etc.

[0101] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0102] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can display data of the transition sequence of the execution state of the process to be managed on the screen.

[0103] [Operation of the abnormality management device] Next, the operation of the abnormality management device 1 having the above-described configuration will be described with reference to the flowcharts of FIGS. 9 to 11B.

[0104] 9, first, the collection unit 10 collects normal data relating to a transition sequence of a normal execution state of a thread and abnormal data including transitions of an abnormal execution state from the information processing device 2 (step S1). The amount of abnormal data collected by the collection unit 10 is smaller than the amount of normal data. The collection unit 10 can first collect a transition sequence of the execution state of a thread for each observation unit, which is observed according to the operation of a process recorded by the information processing device 2, and then classify the data into normal data and abnormal data.

[0105] Next, the first learning unit 11 performs a first learning process (step S2). FIG. 10 is a flowchart illustrating the first learning process of step S2 in more detail. As shown in step S20 of FIG. 10, the first learning unit 11 calculates a density ratio r θ (Step S20). The first learning unit 11 updates the parameter θ by gradient descent or the like using the above equations (7) to (9) to find an optimal solution for the parameter θ.

[0106] Next, the first learning unit 11 calculates the density ratio r from the learned parameter θ calculated in step S20 based on the above formula (2). θ is estimated (step S21).

[0107] 9, the second learning unit 13 executes a second learning process in addition to the conversion process using the sequence learning model by the conversion unit 12 (step S3). In step S3, the second learning unit 13 regards normal data converted by the conversion unit 12 based on the calculation of the sequence learning model and reflecting the dependency between observation units as true normal data, and generates pre-conversion pseudo-normal data before the dependency between observation units is reflected by the conversion unit 12, which corresponds to pseudo-normal data sufficiently deviating from the distribution of true normal data, while keeping fixed the generator parameters of the generator 131. θThe classifier parameters of the classifier 132 that distinguishes between true normal data and pseudo normal data are updated in the direction of maximizing the objective function E based on the probability density function ρ(x|y=1) of normal data and the probability density function ρ(x|y=0) of abnormal data (the above equation (17)) determined from the above equation.

[0108] 11A and 11B are flowcharts for explaining the conversion process and the second learning process in step S3. First, the second learning unit 13 converts the density ratio r θ The probability density function ρ(x|y=1) of normal data and the probability density function ρ(x|y=0) of abnormal data (the above formula (17)) determined from the above are set as the objective function E (formula (15)) of the GAN (step S300). More specifically, the second learning unit 13 calculates the probability density function ρ(x|y=1), which is the conditional probability distribution of normal data, from the large amount of normal data collected by the collection unit 10 using a maximum likelihood estimation method or the like. In addition, the second learning unit 13 determines the probability density function ρ(x|y=0), which is the conditional probability distribution of abnormal data expressed by the above formula (17), from the calculated probability density function ρ(x|y=1) of normal data.

[0109] The prior probability ρ(y=1) of normality and the prior probability ρ(y=0) of abnormality are set to values ​​previously set, for example, ρ(y=1):ρ(y=0)=0.99:0.01, in the above equation (12), because the number of normal data is overwhelmingly large. Furthermore, in the optimal solution of the objective function E in the above equation (15), D(w D ,θ D ) is the posterior probability ρ(y=1|x) that the transition x of the thread execution state for each observed observation unit is normal, and 1-D(G(w G ,θ G ),w D ,θ D ) is the posterior probability ρ(y=0|x) that the transition x of the thread execution state observed for each observation unit is abnormal. These posterior probabilities ρ(y=1|x) and ρ(y=0|x) are calculated by the estimated density ratio r θ and can be obtained from the prior probabilities ρ(y=1), ρ(y=0).

[0110] Next, the second learning unit 13 acquires, as normal data, a transition sequence of the normal execution states of the threads observed for each observation unit collected in step S1 (step S301) (training data 134 before conversion in FIG. 4). Next, the conversion unit 12 sets initial values ​​of model parameters of the sequence learning model (step S302). In step S302, pre-set model parameters are set, and for example, values ​​based on empirical rules or randomly set values ​​can be used. Next, the conversion unit 12 inputs the normal data acquired in step S301 into the sequence learning model, converts it into normal data that reflects the dependency relationships between observation units inherent in the transition sequence of the execution states of the threads observed for each observation unit based on the model parameters, and outputs the converted normal data as truly abnormal data (step S303).

[0111] Next, the second learning unit 13 inputs the true normal data output from the sequence learning model in step S303 to the classifier 132 as training data, and adjusts the parameter w of the classifier 132 so that the true normal data is classified as true normal data (y=1). D ,θ D (Step S304). In Step S304, the second learning unit 13 can cause the classifier 132 to learn true normal data using, for example, an error backpropagation method. In Step S304, the classifier 132 that can distinguish true normal data from true normal data is pre-trained.

[0112] Next, the second learning unit 13 generates Gaussian noise and provides a random vector of the generated Gaussian noise as an input to the generator 131 (step S305). Subsequently, the generator 131 calculates a random vector of the input z and the weight parameter w based on the provided Gaussian noise. G ,θ G and threshold processing using an activation function to generate pseudo-normal data G(z) before conversion (step S306).

[0113] Next, the conversion unit 12 provides the pseudo normal data G(z) before conversion generated in step S306 as input to the sequence learning model, and converts it into pseudo normal data G(z) that reflects the dependency between observation units based on the calculation of the sequence learning model (step S307). Subsequently, as shown by the connector A in FIG. 11B, the second learning unit 13 trains the classifier 132. The training of the classifier 132 is performed by using the parameter w of the generator 131. G ,θ G First, the second learning unit 13 provides the true normal data obtained in step S303 as training data to the classifier 132 as input. Then, the second learning unit 13 adjusts the parameter w by backpropagation or the like so that the objective function E in the above equation (15) is maximized. D ,θ D (Step S308). The label of the training data is set to 1 (true normal data).

[0114] Next, the second learning unit 13 provides the pseudo-normal data generated by the generator 131 in step S306 and further converted in step S307 as input to the discriminator 132, and calculates the parameter w by backpropagation or the like so that the objective function E in the above equation (15) is maximized. D ,θ D is updated (step S309).

[0115] The learning of the classifier 132 in steps S308 and S309 corresponds to the dashed arrows in the block diagram of the second learning unit 13 shown in FIG. 4 , which indicate that a classifier error is calculated in block 135 of the objective function E based on the output 133 from the classifier 132, and then the error is backpropagated to the classifier 132.

[0116] Thereafter, if the value of the objective function E has not converged (step S310: NO), the adjustment unit 14 adjusts the model parameters of the sequence learning model (step S311), and the second learning unit 13 repeatedly learns the classifier 132. The adjustment unit 14 sets the model parameters adjusted in step S311 to the sequence learning model (step S312). Next, the conversion unit 12 again inputs the normal data acquired in step S301 to the sequence learning model for which the adjusted model parameters have been set, performs calculations on the sequence learning model, and converts the normal data into normal data that reflects the dependency relationships between observation units inherent in the transition sequence of the execution states of threads for each observation unit, and outputs the normal data as true abnormal data (step S313).

[0117] Next, the conversion unit 12 inputs the pseudo-normal data before conversion generated by the generator 131 based on noise into the sequence learning model to which the adjusted model parameters are set, performs calculations on the sequence learning model, and converts the pseudo-normal data into pseudo-normal data that reflects the dependency relationships between the observation units inherent in the transition sequences of the execution states of the threads for each observation unit, and outputs the pseudo-normal data (step S314). Thereafter, the second learning unit 13 repeats steps S308 and S309, and when the value of the objective function E converges to the optimal solution of the above equation (15) (step S310: YES), it repeats the processes from step S302 to step S314 using other normal data in turn, as shown by the connector B in the figure, until the generator 131 and the discriminator 132 are trained (step S313: NO).

[0118] Thereafter, when the classifier 132 has been trained using all normal data (step S315: YES), the storage unit 19 stores the trained generative models, the generator 131' and the classifier 132', and the model parameters of the sequence learning model adjusted by the adjustment unit 14 (step S316). Note that steps S302 to S314 can be batch processed. After that, the process proceeds to step S4 in FIG. 9.

[0119] Next, the generation unit 15 causes the generator 131′ included in the trained generative model constructed by the second learning unit 13 to generate pre-conversion pseudo-normal data (step S4). Subsequently, the conversion unit 12 uses the sequence learning model in which the adjusted model parameters are set to convert the pre-conversion pseudo-normal data generated in step S4 into pseudo-normal data that reflects the inter-observation unit dependency relationships inherent in the transition sequences of execution states observed for each observation unit (step S5). Next, the abnormal operation database 16 stores, among the pseudo-normal data converted in step S5, pseudo-normal data that is identified as pseudo-normal data by the classifier 132′ included in the trained generative model constructed by the second learning unit 13 (step S6). In step S6, the pseudo-normal data converted in step S5 is further passed through the classifier 132′ included in the trained generative model, and pseudo-normal data for which the output of the classifier 132′ is determined to be 0 (abnormal) >> 1 (normal) is stored in the abnormal operation database 16.

[0120] Thereafter, the collection unit 10 collects a transition sequence of the execution states of threads observed for each observation unit from the information processing device 2 that executes the process to be managed (step S8). Next, the conversion unit 12 performs calculations on the sequence learning model to which the adjusted model parameters are set, and converts the transition sequence of the execution states of threads observed for each observation unit collected in step S8 into a transition sequence of the execution states of threads for each observation unit that reflects the dependency relationships between the observation units inherent in the sequence (step S9).

[0121] Next, the determination unit 17 determines that an abnormality has occurred in the managed process if the transition sequence of the thread execution states for each observation unit observed based on the operation of the managed process converted in step S9 matches the pseudo-normal data stored in the abnormal operation database 16 (step S9). In step S9, the determination unit 17 can determine that an abnormality has occurred in the managed process if the conditional expression of the above formula (20) is satisfied.

[0122] Next, when an operational abnormality is determined in step S9, the instruction unit 18 transmits an instruction to the information processing device 2 executing the managed process to perform a predetermined response, such as restarting or switching to a backup system (step S10). Furthermore, while the information processing device 2 is switching to the backup system, the instruction unit 18 can transmit an instruction to an external analysis device to analyze the cause of the operational abnormality of the managed process. For example, the analysis device can identify an abnormal thread based on the transition sequence of the execution state of a thread related to the managed process determined to have an operational abnormality. Thereafter, the information processing device 2 can forcibly terminate and regenerate the identified abnormal thread.

[0123] As described above, the anomaly management device 1 according to this embodiment learns parameters representing the density ratio between the probability density function of normal data and the probability density function of abnormal data based on normal data indicating a normal execution state transition sequence of a thread observed for each observation unit, which can be collected in large quantities, and abnormal data indicating an abnormal execution state transition sequence of a thread observed for each observation unit, which can be collected even in small quantities, and estimates the density ratio. Furthermore, the probability density function of normal data and the probability density function of abnormal data determined based on the estimated density ratio are set as the objective function of the generative model, and the classifier 132 is updated in a direction that maximizes the objective function. Furthermore, in training the generative model, training data that reflects the inter-observation unit dependency transformed by the sequence learning model is used as input data for the classifier 132. Then, pseudo-normal data that is sufficiently deviated from the distribution of true normal data indicating normal execution state transition sequences, generated in large quantities by the generator 131′ of the trained generative model, is further transformed using the sequence learning model to generate pseudo-normal data. The pseudo-normal data identified as pseudo-normal data by the classifier 132′ of the trained generative model is used as an abnormal data template to build a database. This makes it easy to manage program operation anomalies.

[0124] Furthermore, according to the abnormality management device 1 of this embodiment, the density ratio is estimated using abnormal data that is available even in small amounts, and the probability density function of normal data and the probability density function of abnormal data determined based on the density ratio are set as coefficients of the objective function of the generative model. Therefore, the generative model is trained by reflecting the patterns of normal data and abnormal data obtained as actual observation data, thereby improving the learning accuracy of the generative model.

[0125] Furthermore, according to the anomaly management device 1 of this embodiment, a sequence learning model that extracts features that represent dependencies between observation units inherent in the transition sequence of the execution state for each observation unit is interposed between the input side of the classifier 132 of the generative model and the output side of the generator 131, and the values ​​of the model parameters of the sequence learning model are adjusted according to the progress of learning of the generative model. This makes it possible to further improve the learning accuracy of the generative model.

[0126] Furthermore, the abnormality management device 1 according to this embodiment uses pseudo-normal data corresponding to the transition series of abnormal execution states of threads generated by the generative model to construct the abnormal operation database 16. This makes it possible to manage not only fatal errors in processes but also potential errors that do not involve forced termination of processes, thereby effectively suppressing the occurrence of failures in the entire system.

[0127] In the embodiment described above, the second learning unit 13 has been described as having a generative model with a GAN configuration. However, the generative model can be configured not only based on a GAN but also based on a VAE (Variational Autoencoder), Energy-Based Models (EBMs), or the like.

[0128] In addition, in the described embodiment, the conversion unit 12 employs a neural network such as an RNN, LSTM, or self-attention as the sequence learning model. However, the sequence learning model may be an autoencoder, a transformer, or the like, as long as it learns the temporal or sequential dependencies inherent in sequence data and extracts features, converts, or reconstructs the input sequence based on the dependencies.

[0129] The above describes embodiments of the abnormality management device and abnormality management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0130] 1...abnormality management device, 2...information processing device, 10...collection unit, 11...first learning unit, 12...conversion unit, 13...second learning unit, 14...adjustment unit, 15...generation unit, 16...abnormal operation database, 17...determination unit, 18...instruction unit, 19...memory unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, 131...generator, 132...identifier, NW...network.

Claims

1. a first learning unit configured to learn a parameter representing a density ratio indicating a relative relationship between a probability density function of normal data indicating a normal transition sequence of an execution state for each observation unit observed in response to an operation of a process and a probability density function of abnormal data indicating a transition sequence of an execution state for each observation unit including an abnormal transition of an execution state that deviates from the normal transition of the execution state; and to estimate the ratio based on the learned parameter; a first conversion unit configured to convert the normal data into normal data that reflects the dependency relationships using a sequence learning model having pre-set model parameters that represent dependency relationships between observation units inherent in the transition sequence of the normal execution state for each observation unit; a second learning unit configured to: consider the normal data, in which the dependency relationship converted by the first conversion unit is reflected, as true normal data, generate pre-conversion pseudo-normal data before the dependency relationship is reflected, which corresponds to pseudo-normal data sufficiently deviating from the distribution of the true normal data, while keeping fixed generator parameters of a generator that generates pre-conversion pseudo-normal data before the dependency relationship is reflected, in a direction that maximizes an objective function based on a probability density function of the normal data and a probability density function of the abnormal data determined from the density ratio estimated by the first learning unit, thereby learning a generative model including the generator and the classifier; a generation unit configured to generate the pre-conversion pseudo-normal data using the generator included in the generative model trained by the second learning unit; a second conversion unit configured to convert the pre-conversion pseudo-normal data generated by the generation unit into the pseudo-normal data reflecting the dependency relationship using the sequence learning model; a storage unit configured to store data identified as the pseudo-normal data by the classifier included in the generative model trained by the second learning unit, from the pseudo-normal data converted by the second conversion unit and reflecting the dependency; An abnormality management device comprising:

2. 2. The abnormality management device according to claim 1, further comprising an adjustment unit configured to adjust the model parameters of the sequence learning model according to a state of learning of the generative model by the second learning unit; the first conversion unit is configured to convert the normal data into normal data in which the dependency is reflected, using the sequence learning model having the model parameters adjusted by the adjustment unit; The second conversion unit is configured to convert the pre-conversion pseudo-normal data generated by the generation unit into the pseudo-normal data reflecting the dependency relationship, using the sequence learning model having the model parameters adjusted by the adjustment unit. An abnormality management device characterized by:

3. 2. The abnormality management device according to claim 1, a collection unit configured to collect a transition sequence of the execution state for each observation unit, the transition sequence being observed in accordance with the operation of the process to be managed; a third conversion unit configured to convert, using the sequence learning model, a transition sequence of the execution state for each observation unit observed in response to an operation of the process to be managed, into a transition sequence of the execution state for each observation unit observed in response to an operation of the process to be managed, in which the dependency relationship is reflected; a determination unit configured to determine that an operational abnormality has occurred in the process under management when a transition sequence of the execution state for each observation unit, which is observed in accordance with the operation of the process under management in which the dependency relationship is reflected, matches the pseudo-normal data in which the dependency relationship is reflected and which is stored in the storage unit; and An abnormality management device comprising:

4. 4. The abnormality management device according to claim 3, Further, an instruction unit configured to send an instruction to perform predetermined control to deal with the operational abnormality of the managed process when the determination unit determines that an operational abnormality has occurred in the managed process. An abnormality management device characterized by:

5. 2. The abnormality management device according to claim 1, The execution state for each observation unit includes the execution state of a thread constituting the process, or the execution state of the process. An abnormality management device characterized by:

6. 2. The abnormality management device according to claim 1, The sequence learning model is a recurrent neural network model. An abnormality management device characterized by:

7. a first learning step of learning a parameter representing a density ratio indicating a relative relationship between a probability density function of normal data indicating a normal transition sequence of an execution state for each observation unit observed in response to the operation of the process and a probability density function of abnormal data indicating a transition sequence of an execution state for each observation unit including an abnormal transition of an execution state that deviates from the normal transition of the execution state, and estimating the ratio based on the learned parameter; a first conversion step of converting the normal data into normal data that reflects the dependency relationships using a sequence learning model having pre-set model parameters that represent the dependency relationships between observation units that exist in the transition sequence of the normal execution state for each observation unit; a second learning step of learning a generative model including the generator and the classifier by updating a classifier parameter of a classifier that distinguishes between the true normal data and the pseudo-normal data in a direction that maximizes an objective function based on a probability density function of the normal data and a probability density function of the abnormal data determined from the density ratio estimated in the first learning step, while keeping fixed a generator parameter of a generator that generates pre-conversion pseudo-normal data before the dependency relationship is reflected, where the pre-conversion pseudo-normal data corresponds to pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, with the normal data that has been converted in the first conversion step and in which the dependency relationship is reflected being treated as true normal data; a generating step of generating the pre-conversion pseudo-normal data by the generator included in the generative model trained in the second learning step; a second conversion step of converting the pre-conversion pseudo-normal data generated in the generation step into the pseudo-normal data reflecting the dependency relationship using the sequence learning model; a storage step of storing, in a storage unit, data identified as the pseudo-normal data by the classifier included in the generative model trained in the second learning step, from the pseudo-normal data converted in the second conversion step and reflecting the dependency; An abnormality management method comprising:

8. The abnormality management method according to claim 7, further comprising an adjustment step of adjusting the model parameters of the sequence learning model according to a learning state of the generative model in the second learning step; the first conversion step converts the normal data into normal data that reflects the dependency relationship using the sequence learning model having the model parameters adjusted in the adjustment step; The second conversion step converts the pre-conversion pseudo-normal data generated in the generation step into the pseudo-normal data reflecting the dependency relationship, using the sequence learning model having the model parameters adjusted in the adjustment step. An abnormality management method characterized by:

9. The abnormality management method according to claim 7, a collection step of collecting a transition sequence of an execution state for each observation unit, the transition sequence being observed in accordance with the operation of the process to be managed; a third conversion step of converting, using the sequence learning model, a transition sequence of the execution state for each observation unit observed in response to the operation of the process to be managed into a transition sequence of the execution state for each observation unit observed in response to the operation of the process to be managed, in which the dependency is reflected; a determining step of determining that an operational abnormality has occurred in the process to be managed when a transition sequence of the execution state for each observation unit, which is observed in accordance with the operation of the process to be managed in which the dependency relationship is reflected, matches the pseudo-normal data in which the dependency relationship is reflected and which is stored in the storage unit; An abnormality management method comprising:

10. The abnormality management method according to claim 9, Further, the method includes an instruction step of issuing an instruction to perform predetermined control to deal with the operational abnormality of the process to be managed when it is determined in the determination step that an operational abnormality has occurred in the process to be managed. An abnormality management method characterized by:

Images