Anomaly detection device and anomaly detection method

Abstract

The aim is to make it easier to manage program malfunctions. [Solution] Anomaly management device 1 includes a second learning unit 13 configured to learn a generative model comprising generator 131 and discriminator 132. The generator parameters of generator 131, which generates pseudo-normal data before conversion that deviates sufficiently from the distribution of true normal data, are fixed, while updating the discriminator parameters of discriminator 132, which distinguishes true normal data from pseudo-normal data, in a direction that maximizes an objective function based on the probability distribution of normal data and the probability distribution of abnormal data determined from the ratio estimated by the first learning unit 11. The pseudo-normal data is also obtained by converting the pseudo-normal data before conversion so that the above-mentioned dependencies are reflected.

Description

[Technical Field]

[0001] The present invention relates to an abnormality management device and an abnormality management method. [Background technology]

[0002] In recent years, the demands on software have become more sophisticated and complex in order to provide high-performance systems and services. Software implemented in high-performance systems consists of programs with vast amounts of source code, and program execution is becoming increasingly complex.

[0003] When process failures or malfunctions occur in a system in operation, identifying the cause of the program failure or malfunction is complicated, time-consuming, and not easy. For example, Patent Document 1 discloses a method for retrospectively identifying the location of the error and the variable values ​​at the time using a core file.

[0004] However, the technology disclosed in Patent Document 1 does not allow for the identification of the cause or location of errors from log information, thus requiring source code analysis. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2005-301570 [Overview of the project] [Problems that the invention aims to solve]

[0006] Thus, conventional technologies have not made it easier to manage abnormal program behavior.

[0007] This invention was made to solve the above-mentioned problems and aims to make it easier to manage abnormal program behavior. [Means for solving the problem]

[0008] To solve the above-mentioned problems, the abnormality management device according to the present invention includes: a first learning unit configured to learn a parameter representing the ratio between a probability distribution of normal data, which is a series of normal usage amounts of processing resources by each process, and a probability distribution of abnormal data, which is a series of usage amounts of processing resources by each process that includes abnormal usage amounts that deviate from the range of normal usage amounts, and to estimate the ratio based on the learned parameter; a first conversion unit configured to convert the normal data into normal data that reflects the dependency relationship, using a sequence learning model that has pre-set model parameters representing the temporal or sequential dependency relationship between usage amounts inherent in the series of usage amounts of processing resources by each process; and, while fixing the generator parameters of a generator that generates pseudo-normal data before conversion that deviates sufficiently from the distribution of the true normal data, the normal data determined from the ratio estimated by the first learning unit, using the normal data that reflects the dependency relationship converted by the first conversion unit as true normal data. A second learning unit configured to learn a generative model comprising a generator and a classifier by updating the classifier parameters of a classifier that distinguishes between true normal data and pseudo-normal data in a direction that maximizes an objective function based on the probability distribution of the data and the probability distribution of the abnormal data, wherein the pseudo-normal data is obtained by transforming the pre-transformation pseudo-normal data using the sequence learning model so that the dependency relationships are reflected; a generation unit configured to generate pre-transformation pseudo-normal data using the generator of the generative model learned by the second learning unit; a second transformation unit configured to transform the pre-transformation pseudo-normal data generated by the generation unit into pseudo-normal data that reflects the dependency relationships using the sequence learning model; and a storage unit configured to store the pseudo-normal data that has been transformed by the second transformation unit and reflects the dependency relationships, and which has been identified as pseudo-normal data by the classifier of the generative model learned by the second learning unit.

[0009] Furthermore, the abnormality management device according to the present invention may further include an adjustment unit configured to adjust the model parameters of the sequence learning model according to the learning state of the generation model by the second learning unit, the first conversion unit configured to convert the normal data into normal data reflecting the dependency relationships using the sequence learning model having the model parameters adjusted by the adjustment unit, and the second conversion unit configured to convert the pseudo-normal data before conversion generated by the generation unit into pseudo-normal data reflecting the dependency relationships using the sequence learning model having the model parameters adjusted by the adjustment unit.

[0010] Furthermore, the abnormality management device according to the present invention may further include: a collection unit configured to collect managed data which is a series of managed usage amounts of processing resources by each process; a third conversion unit configured to convert the managed data into managed data that reflects the dependencies using the series learning model; and a determination unit configured to determine that an abnormality in process operation has occurred when one of the managed data that reflects the dependencies matches at least a portion of one of the pseudo-normal data that reflects the dependencies and is stored in the storage unit.

[0011] Furthermore, the abnormality management device according to the present invention may also include an instruction unit configured to send an instruction to perform a predetermined action to resolve a process malfunction when the determination unit determines that a process malfunction has occurred.

[0012] Furthermore, in the anomaly management device according to the present invention, the sequence learning model may be a recurrent neural network model.

[0013] To solve the above-mentioned problems, the anomaly management method according to the present invention includes: a first learning step in which parameters are learned to estimate the ratio based on the learned parameters, which are parameters that represent the ratio between the probability distribution of normal data, which is a series of normal usage amounts of processing resources by each process, and the probability distribution of abnormal data, which is a series of usage amounts of processing resources by each process that includes abnormal usage amounts that deviate from the range of normal usage amounts; a first transformation step in which the normal data is converted into normal data that reflects the dependency relationships, using a sequence learning model that has pre-set model parameters that represent the temporal or sequential dependency relationships between usage amounts inherent in the series of usage amounts of processing resources by each process; and, with the generator parameters of a generator that generates pseudo-normal data before conversion that deviates sufficiently from the distribution of true normal data, the normal data determined from the ratio estimated in the first learning step, with the normal data that reflects the dependency relationships converted in the first transformation step as true normal data. A second learning step of training a generative model comprising a generator and a classifier, wherein the classifier parameters of a classifier that distinguishes between true normal data and pseudo-normal data are updated in a direction that maximizes an objective function based on the probability distribution of the data and the probability distribution of the abnormal data, the pseudo-normal data being obtained by transforming the pre-transformation pseudo-normal data using the sequence learning model so that the dependency relationships are reflected; a generation step of generating the pre-transformation pseudo-normal data using the generator of the generative model trained in the second learning step; a second transformation step of transforming the pre-transformation pseudo-normal data generated in the generation step into pseudo-normal data that reflects the dependency relationships using the sequence learning model; and a storage step of storing in a storage unit the pseudo-normal data that has been identified as pseudo-normal data by the classifier of the generative model trained in the second learning unit from the pseudo-normal data that reflects the dependency relationships transformed in the second transformation step.

[0014] Furthermore, the anomaly management method according to the present invention may further include an adjustment step of adjusting the model parameters of the sequence learning model according to the learning state of the generation model in the second learning step, wherein the first conversion step converts the normal data into normal data reflecting the dependencies using the sequence learning model having the model parameters adjusted in the adjustment step, and the second conversion step converts the pseudo-normal data before conversion generated in the generation step into pseudo-normal data reflecting the dependencies using the sequence learning model having the model parameters adjusted in the adjustment step.

[0015] Furthermore, the abnormality management method according to the present invention may further include: a collection step of collecting managed data which is a series of managed usage amounts of processing resources by each process; a third conversion step of converting the managed data into managed data that reflects the dependencies using the series learning model; and a determination step of determining that an abnormality in process operation has occurred when one of the managed data that reflects the dependencies matches at least a portion of one of the pseudo-normal data that is stored in the storage unit and reflects the dependencies.

[0016] Furthermore, the abnormality management method according to the present invention may also include an instruction step that, if it is determined in the determination step that an abnormality in the process has occurred, sends an instruction to perform a predetermined action to resolve the abnormality in the process.

[0017] In the anomaly management method according to the present invention, the sequence learning model may be a recurrent neural network model. [Effects of the Invention]

[0018] According to the present invention, the generator parameters of the generator that generates pseudo-normal data before transformation that deviates sufficiently from the distribution of true normal data, while keeping the generator parameters of the generator fixed, the discriminator parameters of the discriminator that distinguishes between true normal data and pseudo-normal data are updated in a direction that maximizes the objective function based on the probability distribution of normal data and the probability distribution of abnormal data determined from the ratio estimated by the first learning unit, thereby training a generative model comprising a generator and a discriminator. Therefore, abnormalities can be managed even when there is little abnormal data. [Brief explanation of the drawing]

[0019] [Figure 1] Figure 1 is a block diagram showing the configuration of an abnormality management system equipped with an abnormality management device according to an embodiment of the present invention. [Figure 2] Figure 2 is a diagram illustrating the operational abnormalities of the process managed by the abnormality management device according to this embodiment. [Figure 3] Figure 3 is a schematic diagram showing an example of the configuration of the sequence learning model used by the anomaly management device according to this embodiment. [Figure 4] Figure 4 is a diagram illustrating the second learning unit and conversion unit included in the abnormality management device according to this embodiment. [Figure 5] Figure 5 is a diagram illustrating the second learning unit included in the abnormality management device according to this embodiment. [Figure 6] Figure 6 is a diagram illustrating the second learning unit included in the abnormality management device according to this embodiment. [Figure 7] Figure 7 is a diagram illustrating the generation unit included in the abnormality management device according to this embodiment. [Figure 8] Figure 8 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 9] Figure 9 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 10]Figure 10 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 11A] Figure 11A is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 11B] Figure 11B is a flowchart showing the operation of the abnormality management device according to this embodiment. [Modes for carrying out the invention]

[0020] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to Figures 1 to 11B.

[0021] [Configuration of the anomaly management system] First, with reference to Figure 1, an overview of an abnormality management system comprising an abnormality management device 1 according to an embodiment of the present invention will be described. The abnormality management system sets thresholds for determining process operation abnormalities based on normal resource usage data that can be collected in large quantities and abnormal resource usage data that can be collected in small quantities compared to the normal data. The abnormality management system comprises an abnormality management device 1 and an information processing device 2. The abnormality management device 1 and the information processing device 2 are connected via a network NW.

[0022] The network NW includes, for example, wired networks such as LAN, WAN or the Internet, ISDN, mobile communication networks using wireless LAN, LTE / 4G, 5G, 6G wireless communication systems, and wireless networks such as Bluetooth (registered trademark), but the scope of the present invention is not limited to these.

[0023] The information processing device 2 can be implemented as a server, gateway, desktop computer, embedded device, mobile communication terminal such as a smartphone, tablet computer, laptop computer, etc. In this embodiment, the information processing device 2 is not limited to one unit, but includes cases where there are multiple units. In the case of multiple units, each information processing device 2 executes the same process generated by the same application or the same executable file.

[0024] Furthermore, the information processing device 2 is uniquely identified by network identification information such as an IP address or MAC address, or by a device ID assigned by the anomaly management system. The information processing device 2 can be realized by a computer equipped with a processor, main memory, communication interface, auxiliary storage, and input / output I / O, and a program that controls these hardware resources.

[0025] The information processing device 2 runs one or more applications (programs) on the OS, and each application runs as one or more processes. Each process is assigned a unique process ID (PID) by the OS. A process ID is assigned to each execution unit of a process, and even the same application may have different process IDs depending on whether it generates multiple processes or depending on the execution environment and timing. The information processing device 2 calculates the CPU usage rate as the amount of processing resources used by each process, i.e., the process ID corresponding to the running process, and records it in memory. If the configuration of each CPU of multiple information processing devices 2 is not the same, such as the number of CPU cores and clock speed, the CPU usage rate recorded by each information processing device 2 may be normalized or corrected using each CPU benchmark, etc. The normalization or correction process may be performed by the error management device 1.

[0026] In this embodiment, the processing resource usage data is either the process ID or the CPU usage rate per process. However, the processing resource usage may also be the process ID, the memory usage rate per process, the process ID, or the I / O waiting time per process. Figure 2 shows normal data a1, which is a normal CPU usage rate, and abnormal data b1, which includes an abnormal CPU usage rate. The horizontal axis represents the process ID, which is arranged in the order of process execution. The vertical axis represents the CPU usage rate [%]. Within the range of process IDs in area c, the CPU usage rate in abnormal data b1 is an abnormal value. The abnormal CPU usage rate is due to an abnormal operation of the process executed by the information processing device 2.

[0027] A state in which a process executed by the information processing device 2 experiences an operational abnormality refers to a state in which the process deviates from the normal load range, such as excessive consumption of processing resources. For example, this includes cases where the process ID or the CPU usage rate for each process exceeds a predetermined threshold, or where the CPU usage rate falls outside the normal load range defined according to the attributes of the process. Furthermore, even if the CPU usage rate does not exceed the threshold, a CPU usage rate pattern that has been predetermined as a load state pattern when an operational abnormality occurs in a process can be used as an abnormal CPU usage rate that deviates from the normal CPU usage range.

[0028] Thus, when abnormal behavior occurs in a process, it is likely that abnormal processing, such as infinite loops or excessive recursive calls, is occurring in the execution of the process associated with that process ID. On the other hand, normal CPU usage refers to a situation where no abnormal processing occurs in the execution of the process associated with each process ID, and the consumption of CPU resources is within a normal range.

[0029] [Functional blocks of the anomaly management device] Next, the functional blocks of the abnormality management device 1 according to this embodiment will be described with reference to the block diagram in Figure 1. As shown in Figure 1, the abnormality management device 1 includes a collection unit 10, a first learning unit 11, a conversion unit (first conversion unit, second conversion unit, third conversion unit) 12, a second learning unit 13, an adjustment unit 14, a generation unit 15, an abnormal CPU usage rate database 16, a determination unit 17, an instruction unit 18, and a storage unit 19.

[0030] The collection unit 10 collects normal data, which is a series of CPU usage rates that represent the normal processing resource usage (normal usage of processing resources by each process) used in the execution of each process, corresponding to each of the multiple process IDs recorded by the information processing device 2 via the network NW. The collection unit 10 also collects abnormal data, which is a series of CPU usage rates used in the execution of each of the multiple process IDs that contain abnormal processing resource usage (CPU usage rates). The collection unit 10 can collect CPU usage rates from multiple information processing devices 2. Process IDs are associated with the CPU usage rate data. The collection unit 10 collects CPU usage rates corresponding to each of M (for example, 10,000) process IDs or processes at set time intervals.

[0031] The data collection unit 10 can label the collected CPU usage based on rule-based or statistical thresholds, classify it into normal and abnormal data, and collect this data. While it is possible to collect a large amount of normal data, abnormal data occurs very infrequently, making it difficult to collect a sufficient amount. Therefore, the amount of abnormal data collected by the data collection unit 10 is significantly less than the amount of normal data (normal data >> abnormal data).

[0032] The collection unit 10 collects sequence data that can be considered to consist only of normal CPU usage (normal data, which is a sequence of normal usage of processing resources by each process) and sequence data that includes normal CPU usage but also a certain amount of abnormal CPU usage (abnormal data, which is a sequence of processing resource usage by each process that includes abnormal usage that deviates from the range of normal usage) as training data for the first learning unit 11. The collection unit 10 also collects sequence data of normal CPU usage for each process (the normal data mentioned above) as data to be converted by the conversion unit 12. The collection unit 10 also collects sequence data of managed CPU usage for each process that the determination unit 17 will use to determine abnormality (managed data, which is a sequence of managed usage of processing resources by each process).

[0033] The first learning unit 11 learns parameters that represent the ratio between the probability distribution of normal data, which is a series of normal CPU usage rates for each process, and the probability distribution of abnormal data, which is a series of CPU usage rates for each process that includes abnormal CPU usage rates that deviate from the range of normal CPU usage rates. Based on the learned parameters, the first learning unit 11 estimates the ratio. The first learning unit 11 learns parameters that represent the density ratio of the probability density functions, which are the probability distributions of normal data and abnormal data, using a series of normal CPU usage rates for processes that can be obtained in large quantities, and a series of CPU usage rates that include abnormal CPU usage rates for processes that can only be obtained in small quantities compared to normal CPU usage rates. The first learning unit 11 also estimates the density ratio from the learned parameters.

[0034] Here, the set of normal training data is defined as D = {x (1) ,x (2) ,…,x (N)}, the set of training data which is anomalous data is D'={x' (1) ,x' (2) ,…,x' (N’) Let's assume that each observation data x (n) (1≦n≦N) may be data collected by the collection unit 10 at a certain time n, where n can be smaller as it represents the past. Also, each observation data x(n) (1 ≤ n ≤ N) is M-dimensional, and x (n) = (x1 (n) , x2 (n) , …, x M (n) ) is expressed. For example, when there are 10,000 processes (= M) according to the process ID, it is 10,000-dimensional. Each component x m (n) (1 ≤ m ≤ M) indicates the CPU usage rate of the process corresponding to process m. The same applies to x’ (n‘) (1 ≤ n’ ≤ N’).

[0035] Hereinafter, D is called normal data and D’ is called abnormal data. Let the probability density function of normal data D be p(x), and the probability density function of abnormal data D’ be p’(x). The probability density function p(x) of normal data D indicates the distribution of the probability that a normal CPU usage rate x is observed with the process ID. Also, the probability density function of abnormal data D’ indicates the distribution of the probability that an abnormal CPU usage rate x is observed with the process ID. The density ratio r(x) between the probability density function p(x) of normal data D and the probability density function p’(x) of abnormal data D’ is expressed by the following equation (1).

Equation

[0036]

Equation

[0037] The basis function ψ(x) is defined by an RBF (Radial Basis Function) kernel and is expressed by the following equation (3).

Equation

[0038] Here, based on equation (1) above, the specific form of equation (3) where the number of basis vectors b is the number of training data N (b=N) is given by the following equation (4).

number

[0039] Equation (4) above expresses the density ratio as a linear sum of RBFs centered on all learning points. Here, we introduce the generalized Kullback-Leibler divergence, which measures the information-theoretic distance between the non-negative functions f and g shown in equation (5).

number

[0040] In density ratio estimation, f=p(x) and g=r θ Substitute p'(x) into equation (5) above, and the objective function is given by equation (6).

number

[0041] In equation (6) above, each x n , x' n’ The optimization objective function obtained by approximating the integral with an empirical distribution that sets all values ​​except θ to 0, ignoring terms that do not depend on the parameter θ, and removing constants is expressed by the following equation (7).

number

[0042] By minimizing J(θ) in equation (7) above, the density ratio r θThis is estimated. Since J(θ) is a convex function, the first learning unit 11 updates the parameter θ from the initial value to convergence using the parameter θ update formula by gradient descent shown in equation (8) below.

number

[0043] The result of specifically calculating the gradient in equation (7) above is expressed by the following equation (9).

number

[0044] In equation (9) above, the first term represents the contribution from abnormal data, and the second term represents the contribution from normal data. Since the second term is dominant in equation (9), stable estimation is possible when the number of normal data points N is large. In other words, even when the number of abnormal data points N' is small, it is possible to stably determine the parameter θ.

[0045] Furthermore, before using equations (7) to (9) above to find the optimal solution for parameter θ, the first learning unit 11 finds an appropriate value for the bandwidth h in equation (4) above using cross-validation or an information criterion (KL divergence minimization criterion). Based on the optimal solution for parameter θ obtained by the KL density ratio estimation method, the first learning unit 11 uses equation (2) above to determine the density ratio r for any input x. θ An estimated value can be obtained. The density ratio estimated by the first learning unit 11 is passed to the second learning unit 13, which will be described later.

[0046] The transformation unit 12 is used as a feature transformation model to transform the sequence data of CPU usage handled by the generative model in the second learning unit 13 (described later) into data that reflects features representing the temporal or sequential dependency between CPU usages in the sequence data. The transformation unit 12 uses a sequence learning model equipped with pre-set model parameters that represent the temporal or sequential dependency between CPU usages inherent in each process ID or the sequence of CPU usages of each process to transform normal data into normal data that reflects the temporal or sequential dependency.

[0047] Furthermore, the conversion unit 12 uses a sequence learning model to convert the pseudo-normal data (pre-conversion pseudo-normal data) generated by the generation unit 15 (described later) into pseudo-normal data that reflects the temporal or sequential dependencies between CPU usage rates inherent in the sequence of CPU usage rates. Also, the conversion unit 12 uses a sequence learning model having model parameters adjusted by the adjustment unit 14 (described later) to convert normal data into normal data that reflects the temporal or sequential dependencies between CPU usage rates inherent in the sequence of CPU usage rates. Similarly, the conversion unit 12 converts the pre-conversion pseudo-normal data generated by the generation unit 15 into pseudo-normal data that reflects the temporal or sequential dependencies between CPU usage rates inherent in the sequence of CPU usage rates. Furthermore, the conversion unit 12 (third conversion unit) converts the managed data, which is a sequence of CPU usage rates of each managed process collected by the collection unit 10, into managed data that reflects the temporal or sequential dependencies between CPU usage rates inherent in the sequence of CPU usage rates, and passes it to the determination unit 17.

[0048] A sequence learning model is a model that sequentially inputs the CPU usage of each process constituting the input sequence, and generates a feature representation that considers the relationship between CPU usage in sequential inputs while continuously updating its internal state. Therefore, if the input sequence is a time series, this sequence learning model will generate a feature representation that considers the relationship between CPU usage in time while continuously updating its internal state. Sequential learning models include, but are not limited to, models equipped with a recurrent neural network (RNN), a long short-term memory (LSTM), or a self-attention mechanism.

[0049] When a sequence of data with normal CPU usage (normal data) is input to the sequence learning model, the sequence learning model performs calculations on the input sequence based on the model parameters and outputs normal data as an output sequence, in which the temporal or sequential dependencies in the sequence are extracted or emphasized while retaining the sequential features contained in the CPU usage of the input sequence. As shown in Figure 4, by providing the sequence learning model on the output side of the generator 131 and the input side of the discriminator 132 of the generative model described later, it becomes possible for the generative model to generate data while retaining the features between the CPU usages of the sequence data.

[0050] Here, we will explain using the case where an RNN is used as a sequential learning model as an example. Figure 3 is a schematic diagram showing the network structure of an RNN. As shown in Figure 3, an RNN is a neural network consisting of an input layer X, a hidden layer H which is a memory cell, and an output layer Y. Each node in Figure 3 is the input x at each time step t. (t) , hidden state (internal state) h (t) , and output y (t) This will show the input x (t) and the hidden state h of the previous time. (t-1) By multiplying these values ​​by the corresponding weight matrices U and W, and adding the bias term b, the linear operation shown in equation (10) is performed.

[0051]

number

[0052] In equation (10) above, a (t) This is an intermediate value for updating the hidden state at time t, representing a weighted sum that integrates the input and past state information. Furthermore, a (t) By applying the nonlinear activation function σ(·), a new hidden state h is obtained as shown in equation (11). (t) You can obtain this.

[0053]

number

[0054] The hidden state h in equation (11) above (t) This is an internal representation that retains past sequence information while reflecting features based on the current input, and is carried over to the next time step t+1. Furthermore, this hidden state h (t) Based on this, the output y is obtained by the calculation shown in equation (12) below. (t) This is calculated.

[0055]

number

[0056] In equation (12) above, V represents the weight matrix from the hidden state to the output, and c represents the bias term of the output layer. Thus, RNNs recursively use the hidden state from the previous time step in the input processing of the next time step, transmitting information from the hidden state of the previous time step to the hidden state of the next time step, and thus have a structure that generates an output that reflects the temporal dependencies inherent in the time series data.

[0057] The model parameters of the sequential learning model use pre-set values. In the RNN shown in Figure 3, the values ​​of the model parameters U, W, V, b, and c are pre-set values ​​based on empirical rules or the like. Furthermore, once the values ​​of the model parameters are adjusted by the adjustment unit 14 (described later), the transformation unit 12 performs a transformation process based on the sequential learning model with the adjusted model parameters (U', W', V', b', c') set.

[0058] The second learning unit 13 trains a generative model by updating the discriminator parameters of the discriminator 132, which distinguishes between true normal data and pseudo-normal data, in a direction that maximizes the objective function based on the probability density function (probability distribution) of normal data and the probability density function (probability distribution) of abnormal data determined from the density ratio (ratio) estimated by the first learning unit 11, while keeping the generator parameters of the generator 131 fixed.

[0059] As shown in Figure 4, the second learning unit 13, as a generative model having a generator 131 and a discriminator 132, executes the Max learning phase of a GAN (Generative Adversarial Network), where the generator 131 is fixed and only the parameters of the discriminator 132 are updated. The objective of the second learning unit 13 is to generate a series of CPU usage rates that can be treated as pseudo-normal data, i.e., abnormal CPU usage rates, which deviate sufficiently from the distribution of normal data, when the series of normal CPU usage rates for each process transformed by the transformation unit 12 is considered true normal data. Therefore, the learning of the Min learning phase in the normal adversarial learning procedure of a GAN, which updates the generator 131 in the direction of minimization, is not performed.

[0060] As shown in Figure 4, the generation model according to this embodiment, which includes a generator 131 and a discriminator 132, has a normal CPU usage rate x=(x1,x2,…,x) for each process converted by the conversion unit 12. MThe model is trained using the following data. Here, pseudo-normal data that deviates significantly from the distribution of normal data is a generated sequence that, statistically speaking, lies in a region that deviates significantly from the normal range of normal data, relative to normal data which represents a normal series of CPU usage rates. The distance or degree of deviation from normal data is such that, if the metric is log-likelihood, a sequence with a smaller likelihood is considered a pseudo-normal sequence, and if the metric is cross-entropy, a sequence with a larger entropy value is considered a sequence with a larger deviation. Furthermore, if the KL distance is used as the metric, a sequence with a large deviation in the overall distribution is treated as a sufficiently deviated sequence.

[0061] Furthermore, as mentioned above, as shown in Figure 4, a conversion unit 12 equipped with a sequence learning model is provided on the input side of the classifier 132 of the generative model and on the output side of the generator 131. In addition, an adjustment unit 14 for adjusting the model parameters of the sequence learning model is provided between the objective function 135 of the generative model and the conversion unit 12.

[0062] Figures 5 and 6 schematically represent the neural network configurations of the generator 131 and discriminator 132 of the generative model used by the second learning unit 13. As shown in Figure 5, the generator 131 consists of a neural network having an input layer, a hidden layer, and an output layer. The generator 131 is a model that generates pseudo-normal data from random noise. For example, m randomly sampled Gaussian noise vectors are input to the input nodes of the generator 131 (z1~z m ).

[0063] The generator 131 outputs an output G(z) after performing a sum-of-products operation on the input and weight parameters, followed by thresholding using an activation function. The output G(z) from the generator 131 is pseudo-normal data that deviates from the distribution of true normal data. A CNN or ResNet can be used as the neural network that constitutes the generator 131.

[0064] The classifier 132 shown in Figure 6 consists of a neural network having an input layer, a hidden layer, and an output layer. In the example in Figure 6, the training data input is a sequence of normal CPU usages transformed by the transformation unit 12, which reflects the temporal or sequential dependencies between CPU usages, and is provided as true normal data. Each input node shown in Figure 6 has CPU usage (x) from time 1 to N. (1) ,x (2) ,…,x (N) CPU usage x at each time point in the list of ) (n) Output values ​​x1~x of the sequential learning model for (1≦n≦N) M These will be entered respectively.

[0065] The classifier 132 outputs a probability value between 0 and 1 after performing a sum-of-products operation on the input and weight parameters, and thresholding using an activation function. When the classifier 132 correctly identifies the training data related to the input true normal data as true normal data, it outputs a value close to output y=1. On the other hand, when it correctly identifies the training data related to the input pseudo-normal data as pseudo-normal data, it outputs a value close to output y=0. In this way, the classifier 132 is a model that distinguishes the model distribution generated by the generator 131 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 132.

[0066] As shown in the block diagram of Figure 4, the generator 131 of the generative model adopted by the second learning unit 13 is denoted as function G, and the discriminator 132 is denoted as function D. Furthermore, true normal data is denoted as x, the predicted value output by the discriminator 132 is denoted as y, and the correct label is denoted as t. The correct label t is set to 1 for true normal data and 0 for pseudo-normal data generated by the generator 131. In this case, the discriminator 132 performs a binary classification problem with the cross-entropy E given by equation (13) below. CE It can be expressed as follows.

[0067]

number

[0068] The first term inside the brace in equation (13) above represents t n lny n In this case, the predicted value y of the classifier 132 n However, the correct label for the true normal data is t n It is desirable to approach the value of =1. On the other hand, the second term inside the brace represents (1-t n )ln(1-y n In this case, the predicted value y of the classifier 132 n However, the value of the correct label (1-t) that distinguishes it from pseudo-normal data is the value of the correct label. n It is desirable for cross-entropy E to approach 0. CE This value is maximized when the predicted value matches the correct label value.

[0069] Here, the generator 131 that constitutes the generative model has parameter w G ,θ G It has a function G(w G ,θ G ) is expressed as. Also, the classifier 132 has parameter w D ,θ D It has a function D(w D ,θ D This is expressed as ). The cross-entropy E in equation (13) above CE The loss function (objective function E) of a generative model comprising a generator 131 and a discriminator 132 based on the above can be expressed by the following equation (14).

number

[0070] The first term of equation (14) above represents E D(x)=1 lnD(w D ,θ D ) is the expected value that the classifier 132 identifies as true normal data. The second term of equation (14) above represents E D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D)) is the expected value that the classifier 132 identifies the pseudo-normal data generated by the generator 131 as pseudo-normal data. Here, the expected value of equation (14) above can be expressed as equation (15) using a probability distribution.

[0071]

number

[0072] Here, for the probability density functions p(x) for normal data and p'(x) for abnormal data in equation (1) above, we set p(x)≡ρ(x|y=1) and p'(x)≡ρ(x|y=0) in order to make them into a probabilistic labeled classification problem for Max optimization learning of GANs. The density ratio r estimated by the first learning unit 11 θ (x) is defined by the following equation (16).

number

[0073] The probability density function ρ(x|y=1), which is the conditional probability distribution of normal data in equation (16) above, can be calculated from a large amount of normal data. Using the calculated probability density function ρ(x|y=1) of normal data, the probability density function ρ(x|y=0), which is the conditional probability distribution of abnormal data, can be expressed by the following equation (17).

number

[0074] Substitute the probability density function ρ(x|y=1) for normal data and the probability density function ρ(x|y=0) for abnormal data from equation (17) into the objective function E in equation (15), and use set values ​​for the prior probabilities ρ(y=1) for the normal (y=1) class and ρ(y=0) for the abnormal (y=0) class. For example, the prior probability values ​​can be arbitrarily set as ρ(y=1):ρ(y=0)=0.99:0.01, and these prior probability values ​​can be adjusted at any time. Furthermore, the posterior probability ρ(y=1|x) of normality for the observed CPU usage rate x is given by D(w) in the optimal solution of equation (12). D ,θ D ) corresponds to the posterior probability ρ(y=0|x) that the CPU usage rate x is abnormal, and in the optimal solution of equation (15) above, 1-D(G(w G ,θ G ),w D ,θ D This corresponds to the density ratio r. θ And it can be determined from the prior probability.

[0075] Here, when the generator 131 is fixed, the objective function E becomes a maximization problem of equation (18) with respect to the discriminator 132.

number

[0076] In the training of the generative model of this embodiment, as described above, only the Max optimization of the objective function E is performed, and the parameters of the classifier 132 with the generator 131 fixed are learned. Therefore, it is possible to avoid the output of the generator 131 converging to the distribution of normal data, and conversely, to maintain a sequence that deviates sufficiently from the distribution of normal data. When the update of the classifier 132 converges, the sequence of pseudo-normal data output by the fixed generator 131 and transformed by the transformation unit 12 has a low likelihood with respect to the sequence of normal CPU usage. At this time, the generator 131 can generate pseudo-normal data having the statistical properties expressed by the following equation (19).

number

[0077] The adjustment unit 14 adjusts the model parameters of the sequential learning model according to the learning state of the generative model by the second learning unit 13. As mentioned above, the model parameters of the sequential learning model are initially set to preset values ​​based on empirical rules, etc. As shown in Figure 4, the adjustment unit 14 monitors the progress of the loss of the classifier 132 and the distribution of the output during the optimization learning process of the generative model by the second learning unit 13, and adjusts the values ​​of the model parameters of the sequential learning model based on the evaluation (arrow between the objective function 135 and the transformation unit 12 in Figure 4). For example, the adjustment unit 14 performs an evaluation each time the loss of the classifier 132 is calculated, and adaptively adjusts the values ​​of the model parameters of the sequential learning model independently of the gradient propagation of the generative model based on the evaluation result. By adjusting the model parameters of the sequential learning model by the adjustment unit 14, the learning accuracy of the generative model can be improved.

[0078] The generation unit 15 generates pseudo-normal data (pre-conversion pseudo-normal data) using the generator 131' provided by the generation model learned in the second learning unit 13. As shown in Figure 7, the generation unit 15 inputs noise into the learned generator 131' and generates a large amount of pre-conversion pseudo-normal data. The pre-conversion pseudo-normal data generated by the generation unit 15 is passed to the conversion unit 12. Furthermore, the conversion unit 12, which is connected to the output side of the learned generator 131', converts it into pseudo-normal data that reflects the temporal or sequential dependencies between CPU usage rates through calculations of the sequential learning model.

[0079] The abnormal CPU usage database 16 stores pseudo-normal data that reflects the temporal or sequential dependencies between CPU usage rates converted by the conversion unit 12 (second conversion unit). More specifically, the abnormal CPU usage database 16 stores the pseudo-normal data converted by the conversion unit 12 from the pre-conversion pseudo-normal data generated in large quantities by the generator 131' trained by the generation unit 15. The abnormal CPU usage database 16 accumulates the pseudo-normal data as a series of abnormal CPU usage rates and constructs a database of abnormal CPU usage rate series used in the abnormality detection process. The abnormal CPU usage database 16 can store only the pseudo-normal data converted by the conversion unit 12 in which the output of the trained classifier 132' is determined to be 0 (abnormal) >> 1 (normal).

[0080] The determination unit 17 determines that a process malfunction has occurred if one of the managed CPU usage series (managed data) converted by the conversion unit 12, which reflects the temporal or sequential dependencies between CPU usage rates, matches at least partially with one of the pseudo-normal data stored in the abnormal CPU usage database 16, which also reflects the temporal or sequential dependencies between CPU usage rates. The determination unit 17 can determine that a match has occurred and that a process malfunction has occurred if the difference between one of the managed data reflecting the temporal or sequential dependencies and one of the pseudo-normal data stored in the abnormal CPU usage database 16 is zero, or within a certain range.

[0081] One of the pseudo-normal data (1 to L items) (L being a positive integer of 2 or more) consisting of a series of CPU usage rates for each of the 1 to D processes (D being a positive integer of 2 or more) stored in the abnormal CPU usage database 16, and one of the series of managed CPU usage rates (converted managed data) that reflects the temporal dependencies related to a particular information processing device 2, is represented as follows:

number

[0082] The determination unit 17 compares the CPU usage rate of each of the 1 to D processes in the converted management target data with the CPU usage rate of each of the 1 to D processes in the pseudo-normal data. If they match, it is determined that an operation abnormality has occurred in the process. It is possible to compare the CPU usage rates in only some of the processes from 1 to n (n < D) among the 1 to D processes and output a determination result.

[0083] Further, the determination unit 17 can use the conditional expression of the following formula (20) to determine that they match when exceeding a predetermined threshold TH, and determine that an operation abnormality has occurred in the process.

[0084]

Equation

[0085] In the above formula (20), 1 ≤ l ≤ L, and the threshold TH defines an allowable range for determining the similarity between one of the converted management target data and the pseudo-normal data, and can be arbitrarily set based on the distance distribution of the converted management target data, etc. In the above formula (20), the pseudo-normal data from 1 to L is used in order to perform threshold determination. Note that even when the above formula (20) is adopted, the determination can be made based on the CPU usage rate data of some of the processes among the CPU usage rate data of all the processes from 1 to D.

[0086] When it is determined by the determination unit 17 that an operation abnormality has occurred in the process, the instruction unit 18 sends out an instruction to execute a predetermined measure for eliminating the operation abnormality of the process. The instruction unit 18 can, for example, identify the process with an abnormal CPU usage rate and send an instruction to end and restart the corresponding process to the information processing apparatus 2 via the network NW. In this case, the information processing apparatus 2 may identify the process with the abnormal CPU usage rate itself by any method.

[0087] The memory unit 19 stores the parameter θ and density ratio r estimated by the learning performed by the first learning unit 11. θ The memory unit 19 also stores the generator 131 and discriminator 132 of the trained generative model, as well as the model parameters of the sequence learning model adjusted by the adjustment unit 14.

[0088] [Hardware configuration of the anomaly management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the functions described above will be explained using Figure 8.

[0089] As shown in Figure 8, the error management device 1 can be implemented, for example, by a computer equipped with a processor 102 connected via a bus 101, main memory 103, communication interface 104, auxiliary storage device 105, and input / output I / O 106, and a program that controls these hardware resources. Furthermore, the error management device 1 includes a display device 107.

[0090] The processor 102 is a circuit or device that performs arithmetic processing, and can be implemented by, for example, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), etc. Alternatively, some or all of these may be combined to form the processor.

[0091] The main memory 103 is composed of, for example, volatile random access memory (RAM), and pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory 103 work together to realize the various functions of the abnormality management device 1, such as the collection unit 10, the first learning unit 11, the conversion unit 12, the second learning unit 13, the adjustment unit 14, the determination unit 17, and the notification unit 18 shown in Figure 1.

[0092] The communication interface 104 is an interface circuit for networking the abnormality management device 1 with various external electronic devices.

[0093] The auxiliary storage device 105 consists of a read / write storage medium and a drive device for reading and writing various information such as programs and data to the storage medium. The auxiliary storage device 105 can use non-volatile storage such as a hard disk or flash memory as the storage medium.

[0094] The auxiliary storage device 105 has a program storage area for storing an anomaly management program. The auxiliary storage device 105 also has a program storage area for storing parameters representing the density ratio of the probability density functions of normal data and abnormal data, and a first learning program for estimating the density ratio, which is executed by the anomaly management device 1. The auxiliary storage device 105 also has a program storage area for storing a program in which the conversion unit 12 performs calculations on the sequential learning model. The auxiliary storage device 105 also has a program storage area for storing a second learning program for training the classifier 132 of the generative model, which is executed by the anomaly management device 1.

[0095] The auxiliary storage device 105 enables the abnormal CPU usage database 16 and the storage unit 19 described in Figure 1. Furthermore, it may also have a backup area for backing up the aforementioned data and programs, for example.

[0096] The I / O106 is an input / output device that accepts signals from external devices and outputs signals to external devices.

[0097] The display device 107 is composed of an organic EL display or a liquid crystal display, etc. The display device 107 can display information on the screen about the CPU usage rate used in the execution of the process corresponding to the process ID.

[0098] [Anomaly detection device operation] Next, the operation of the abnormality management device 1 having the above-described configuration will be explained with reference to the flowcharts in Figures 9 to 11B.

[0099] As shown in Figure 9, first, the collection unit 10 collects normal data, which is a series of normal CPU usage rates for each process, and abnormal data, which is a series of CPU usage rates for each process that includes abnormal CPU usage rates (step S1). The collection unit 10 collects data that includes only normal CPU usage rates or data that can be considered to include only normal CPU usage rates as normal data. The collection unit 10 also collects a small amount of abnormal data compared to the normal data. The collection unit 10 can collect CPU usage rates for each process recorded by the information processing device 2 via the network NW. Furthermore, the collection unit 10 can classify the collected frequency spectrum into normal data and abnormal data in advance.

[0100] Next, the first learning unit 11 performs the first learning process (step S2). Figure 10 is a flowchart that explains the first learning process in step S2 in more detail. As shown in step S30 of Figure 10, the first learning unit 11 calculates the density ratio r between the probability density function of normal data and the probability density function of abnormal data. θ The first learning unit 11 learns the parameter θ that represents (step S20). The first learning unit 11 updates the parameter θ using the gradient descent method or the like with equations (7) to (9) above and finds the optimal solution for the parameter θ.

[0101] Next, the first learning unit 11 calculates the density ratio r from the learned parameter θ obtained in step S20, based on equation (2) above. θ We estimate (step S21).

[0102] Returning to Figure 9, the transformation process using the sequential learning model by the transformation unit 12 is performed, along with the second learning process by the second learning unit 13 (step S3). In step S3, the second learning unit 13, while keeping the generator parameters of the generator 131 fixed, generates pseudo-normal data that deviates sufficiently from the distribution of true normal data, using the normal data that has been transformed by the transformation unit 12 based on the calculations of the sequential learning model and reflects the temporal or sequential dependencies between CPU usage rates as true normal data, the density ratio r estimated by the first learning unit 11 θ Only the classifier parameters of the classifier 132, which distinguishes between true normal data and pseudo-normal data, are updated in the direction of maximizing the objective function E, which is based on the probability density function ρ(x|y=1) for normal data and the probability density function ρ(x|y=0) for abnormal data (equation (17) above).

[0103] Figures 11A and 11B are flowcharts illustrating the transformation process and the second learning process in step S3. First, the second learning unit 13 processes the density ratio r estimated in the first learning process in step S2. θ The probability density functions ρ(x|y=1) for normal data and ρ(x|y=0) for abnormal data (equation (17) above), determined from the above, are set as the objective function E of the GAN (equation (15)) (step S300). More specifically, the second learning unit 13 calculates the probability density function ρ(x|y=1), which is the conditional probability distribution of normal data, from the large amount of normal data collected by the collection unit 10 using the maximum likelihood estimation method or the like. The second learning unit 13 also determines the probability density function ρ(x|y=0), which is the conditional probability distribution of abnormal data, expressed in equation (17) above, from the calculated probability density function ρ(x|y=1) for normal data.

[0104] The prior probability ρ(y = 1) of being normal and the prior probability ρ(y = 0) of being abnormal, since the number of normal data is overwhelmingly large, for example, the values set in advance such as ρ(y = 1):ρ(y = 0)=0.99:0.01 are adopted into the above formula (12). Furthermore, in the optimal solution of the objective function E of the above formula (15), D(w D ,θ D ) becomes the posterior probability ρ(y = 1|x) of being normal with respect to the observed CPU usage rate x, and 1 - D(G(w G ,θ G ),w D ,θ D ) becomes the posterior probability ρ(y = 0|x) of being abnormal with respect to the CPU usage rate x. These posterior probabilities ρ(y = 1|x), ρ(y = 0|x) can be obtained from the estimated density ratio r θ and the prior probabilities ρ(y = 1), ρ(y = 0).

[0105] Next, the second learning unit 13 acquires the series of normal CPU usage rates for each process collected in step S1 as normal data (step S301) (the training data 134 before conversion in FIG. 4). Next, the conversion unit 12 sets the initial values of the model parameters of the series learning model (step S302). In step S302, the model parameters set in advance can be set, for example, values based on empirical rules or randomly set values can be adopted. Next, the conversion unit 12 inputs the normal data acquired in step S'301 into the series learning model, converts it into normal data in which the temporal or sequential dependency between CPU usage rates inherent in the series of CPU usage rates is reflected based on the model parameters, and outputs the converted normal data as true normal data (step S303).

[0106] Next, the second learning unit 13 inputs the true normal data output from the series learning model in step S303 into the discriminator 132 as training data, and the parameters w D ,θ DLearn and update it (step S304). In step S304, the second learning unit 13 can cause the discriminator 132 to learn true normal data using, for example, the error backpropagation method. By step S304, the discriminator 132 that can identify true normal data as true normal data is pre-trained.

[0107] Next, the second learning unit 13 generates Gaussian noise and gives a random vector of the generated Gaussian noise to the generator 131 as an input (step S305). Subsequently, the generator 131 performs a sum-of-products operation of the input z and the weight parameters w G , θ G and threshold processing by an activation function to generate pre-conversion pseudo-normal data G(z) (step S306).

[0108] Next, the conversion unit 12 gives the pre-conversion pseudo-normal data G(z) generated in step S306 to the sequence learning model as an input, and based on the operation of the sequence learning model, converts it into pseudo-normal data G(z) in which the temporal or sequential dependency between CPU usages is reflected (step S307). Subsequently, as shown in the combiner A in FIG. 11B, the second learning unit 13 performs learning of the discriminator 132. The learning of the discriminator 132 is performed by fixing the parameters w G , θ G of the generator 131. First, the second learning unit 13 gives the true normal data obtained in step S303 to the discriminator 132 as training data. Then, the second learning unit 13 updates the parameters w D , θ D by the error backpropagation method or the like so that the objective function E in the above formula (15) becomes maximum (step S308). Note that the label of the training data is set to 1 (true normal data).

[0109] Next, the second learning unit 13 gives the pseudo-normal data generated by the generator 131 in step S306 and further converted in step S307 to the discriminator 132 as an input, and updates the parameters w D , θD Update (step S309).

[0110] The learning of the classifier 132 in steps S308 and S309 corresponds to the dashed arrows in the block diagram of the second learning unit 13 shown in Figure 4, which indicate that the classifier error is calculated in block 135 of the objective function E based on the output 133 from the classifier 132, and then the error is backpropagated to the classifier 132.

[0111] Subsequently, if the value of the objective function E has not converged (step S310: NO), the adjustment unit 14 adjusts the model parameters of the sequential learning model (step S311), and the learning of the classifier 132 by the second learning unit 13 is repeated. The adjustment unit 14 sets the model parameters adjusted in step S311 to the sequential learning model (step S312). Next, the conversion unit 12 inputs the normal data acquired in step S301 back into the sequential learning model with the adjusted model parameters set, performs calculations on the sequential learning model, converts it into normal data that reflects the temporal or sequential dependencies between CPU usages inherent in the sequence of CPU usages, and outputs it as true normal data (step S313).

[0112] Next, the conversion unit 12 inputs the pre-conversion pseudo-normal data generated by the generator 131 based on noise into a sequence learning model with adjusted model parameters, performs calculations on the sequence learning model, and outputs the converted pseudo-normal data that reflects the temporal or sequential dependencies between CPU usages inherent in the sequence of CPU usages (step S314). Subsequently, the second learning unit 13 repeats steps S308 and S309, and when the value of the objective function E converges to the optimal solution of equation (15) above (step S310: YES), it repeats the processing from steps S302 to S314 as shown by connector B in the figure, using other normal data in sequence until the generator 131 and discriminator 132 are trained (step S315: NO).

[0113] Subsequently, if the classifier 132 has been trained using all normal data (step S315: YES), the storage unit 19 stores the generator 131' and classifier 132' of the trained generative model, as well as the model parameters of the sequential learning model adjusted by the adjustment unit 14 (step S316). Steps S302 to S314 can be performed in batch processing. After that, the process proceeds to step S4 in Figure 9.

[0114] Next, the generation unit 15 causes the generator 131', which is part of the trained generative model constructed by the second learning unit 13, to generate pseudo-normal data before conversion (step S4). Subsequently, the conversion unit 12 uses the sequence learning model with the adjusted model parameters set to convert the pseudo-normal data before conversion generated in step S4 into pseudo-normal data that reflects the temporal or sequential dependencies between CPU usages inherent in the sequence of CPU usages (step S5). Next, the abnormal CPU usage database 16 stores the pseudo-normal data (step S6). In step S6, the pseudo-normal data converted in step S5 is further passed through the classifier 132', which is part of the trained generative model, and only the pseudo-normal data for which the output of the classifier 132' is determined to be 0 (abnormal) >> 1 (normal) can be stored in the abnormal CPU usage database 16. Note that the determination process by the classifier 132' may be performed after the generation of the pseudo-normal data before conversion by the generator 131' in step S305.

[0115] The collection unit 10 collects a series of CPU usage data for each managed process (step S7). Next, the transformation unit 12 performs calculations on a sequence learning model with adjusted model parameters and transforms the series of CPU usage data collected in step S6 into a series of CPU usage data that reflects the temporal or sequential dependencies between CPU usage data inherent in the sequence (step S8).

[0116] Subsequently, when one piece of data in the series of CPU usage rates of the management target, which has been converted in step S8, matches at least one piece of data among the pseudo-normal data stored in the abnormal signal database 16, the determination unit 17 determines that an operation abnormality of the process has occurred (step S9). In step S9, the determination unit 17 can determine the occurrence of an operation abnormality of the process by regarding the data of the CPU usage rate of the management target that satisfies the conditional expression of the above formula (20) as being within the allowable range with respect to the pseudo-normal data. The determination unit 17 applies the conditional expression of the above formula (20) in order from the first pseudo-normal data among the 1 to L pieces of pseudo-normal data stored in the abnormal CPU usage rate database 16, and when the conditional expression is satisfied in the nth (n < D) pseudo-normal data, it can be determined that an operation abnormality of the process has occurred.

[0117] Next, the instruction unit 18 sends out an instruction to execute a predetermined measure for eliminating the operation abnormality of the process (step S10).

[0118] As described above, the abnormality management device 1 according to this embodiment learns a parameter representing the density ratio between the probability density function of normal data and the probability density function of abnormal data, based on normal data, which is a series of normal CPU usage rates for each process that can be collected in large quantities, and abnormal data, which is a series of abnormal CPU usage rates for each process that can be collected even in small quantities, and estimates the density ratio. Furthermore, the probability density function of normal data and the probability density function of abnormal data, determined based on the estimated density ratio, are set as the objective function of the generative model, and the classifier 132 is updated in a direction that maximizes the objective function. In addition, in the training of the generative model, training data that reflects the temporal or sequential dependencies between CPU usage rates, transformed by the sequence learning model, is used as input data for the classifier 132. Subsequently, pseudo-normal data, which is generated in large quantities by the generator 131' of the trained generative model and deviates sufficiently from the distribution of true normal data showing normal CPU usage rates, is further transformed using the sequence learning model to construct a database as a template for abnormal data. Therefore, abnormalities in signals can be managed even when there is little measurement data for abnormal signals.

[0119] Furthermore, according to the anomaly management device 1 of this embodiment, the density ratio is estimated using anomaly data that can be obtained even in small quantities, and the probability density functions of normal data and anomaly data determined based on the density ratio are set as coefficients of the objective function of the generative model. Therefore, the generative model is trained while reflecting the patterns of normal and anomaly data obtained as actual observed data, thereby improving the training accuracy of the generative model.

[0120] Furthermore, according to the abnormality management device 1 of this embodiment, a sequence learning model that extracts features representing the temporal or sequential dependencies between CPU usage rates inherent in the sequence of CPU usage rates for each process is interposed on the input side of the classifier 132 of the generation model and the output side of the generator 131, and the values ​​of the model parameters of the sequence learning model are adjusted according to the progress of learning of the generation model. As a result, the learning accuracy of the generation model can be further improved.

[0121] Furthermore, in the embodiment described, the second learning unit 13 was described in the case where the generative model has a GAN configuration. However, the generative model can be made using configurations other than GANs, such as VAE (Variational Autoencoder) or Energy-Based Models (EBMs).

[0122] Furthermore, in the embodiment described, the transformation unit 12 was described as employing a neural network such as RNN, LSTM, or self-attention as the sequence learning model. However, the sequence learning model may also be an Autoencoder or Transformer, as long as it learns the temporal or sequential dependencies inherent in the sequence data and extracts features, transforms, or reconstructs the input sequence based on those dependencies.

[0123] Furthermore, in the embodiment described, the example given was that the series of processing resource usage by each process in the information processing terminal 2 is time-series data of CPU usage. However, the series that is subject to anomaly detection is not limited to CPU usage, as long as it is a series of processing resources by each process in the information processing terminal 2. For example, the series of processing resource usage by each process may be time-series data of memory usage or I / O waiting time for each process.

[0124] Although embodiments of the abnormality management device and abnormality management method of the present invention have been described above, the present invention is not limited to the embodiments described above, and various modifications that a person skilled in the art can envision are possible within the scope of the invention described in the claims. [Explanation of Symbols]

[0125] 1...Anomaly management device, 2...Communication terminal, 10...Collection unit, 11...First learning unit, 12...Conversion unit, 13...Second learning unit, 14...Adjustment unit, 15...Generation unit, 16...Anomaly CPU usage database, 17...Determination unit, 18...Instruction unit, 19...Storage unit, 101...Bus, 102...Processor, 103...Main memory, 104...Communication interface, 105...Auxiliary memory, 106...Input / output I / O, 107...Display device, 131...Generator, 132...Identifier, NW...Network.

Claims

1. A first learning unit is configured to learn a parameter that represents the ratio between a probability distribution of normal data, which is a series of normal usage amounts of processing resources by each process, and a probability distribution of abnormal data, which is a series of usage amounts of processing resources by each process that includes abnormal usage amounts that deviate from the range of normal usage amounts, and to estimate the ratio based on the learned parameter. A first transformation unit is configured to transform the normal data into normal data that reflects the dependencies, using a sequence learning model that includes pre-configured model parameters representing the temporal or sequential dependencies between usages inherent in the sequence of processing resource usages by each process. A second learning unit is configured to learn a generative model comprising the generator and the classifier, wherein the generator parameters of the generator that generates pre-transformation pseudo-normal data that deviates sufficiently from the distribution of the true normal data, using the normal data that reflects the dependency relationships transformed by the first transformation unit as true normal data, are fixed, and the classifier parameters of the classifier are updated in a direction that maximizes the objective function for the classifier to distinguish between the true normal data and the pseudo-normal data, based on the ratio estimated by the first learning unit, wherein the pseudo-normal data is obtained by transforming the pre-transformation pseudo-normal data using the sequence learning model so that the dependency relationships are reflected, A generation unit configured to generate pseudo-normal data before conversion using the generator provided by the generation model learned in the second learning unit, A second transformation unit is configured to use the sequence learning model described above to transform the pre-transformation pseudo-normal data generated by the generation unit into pseudo-normal data that reflects the dependencies, A storage unit configured to store pseudo-normal data that has been converted by the second conversion unit and reflects the dependencies, and which has been identified as pseudo-normal data by the classifier of the generative model learned by the second learning unit. An abnormality management device equipped with the following features.

2. In the abnormality management device according to claim 1, Furthermore, the system includes an adjustment unit configured to adjust the model parameters of the sequential learning model according to the learning state of the generative model by the second learning unit, The first conversion unit is configured to convert the normal data into normal data that reflects the dependencies, using the sequence learning model having the model parameters adjusted by the adjustment unit. The second transformation unit is configured to use the sequence learning model having the model parameters adjusted by the adjustment unit to transform the pre-transformation pseudo-normal data generated by the generation unit into pseudo-normal data that reflects the dependencies. An abnormality management device characterized by the following features.

3. In the abnormality management device according to claim 1, Furthermore, the collection unit is configured to collect managed data, which is a series of managed usage amounts of processing resources by each process, A third transformation unit configured to use the sequence learning model described above to transform the managed data into managed data that reflects the dependencies described above, A determination unit is configured to determine that a process malfunction has occurred when one of the managed data reflecting the dependency matches at least partially with one of the pseudo-normal data stored in the storage unit that reflects the dependency. An abnormality management device equipped with the following features.

4. In the abnormality management device described in claim 3, Furthermore, the system includes an instruction unit configured to send an instruction to perform a predetermined action to resolve a process malfunction if the determination unit determines that a process malfunction has occurred. An abnormality management device characterized by the following features.

5. In the abnormality management device according to claim 1, The aforementioned sequence learning model is a recurrent neural network model. An abnormality management device characterized by the following features.

6. A first learning step involves learning a parameter that represents the ratio between the probability distribution of normal data, which is a series of normal usage amounts of processing resources by each process, and the probability distribution of abnormal data, which is a series of usage amounts of processing resources by each process that includes abnormal usage amounts that deviate from the range of normal usage amounts, and estimating the ratio based on the learned parameter. A first transformation step involves using a sequence learning model that includes pre-configured model parameters representing the temporal or sequential dependencies between usages inherent in the sequence of processing resource usages by each process, to transform the normal data into normal data that reflects the dependencies. A second learning step in which a generative model comprising the generator and the classifier is trained, wherein the normal data reflecting the dependency relationships transformed in the first transformation step is treated as true normal data, and the generator parameters of the generator that generates pre-transformation pseudo-normal data that deviates sufficiently from the distribution of the true normal data are fixed, and the classifier parameters of the classifier are updated in a direction that maximizes the objective function for the classifier to distinguish between the true normal data and the pseudo-normal data, based on the ratio estimated in the first learning step, wherein the pseudo-normal data is obtained by transforming the pre-transformation pseudo-normal data using the sequence learning model so that the dependency relationships are reflected, A generation step in which the generator provided in the generation model learned in the second learning step generates pseudo-normal data before conversion, A second transformation step in which the pseudo-normal data before transformation generated in the generation step is transformed into pseudo-normal data that reflects the dependencies, using the aforementioned sequence learning model, A storage step in which, among the pseudo-normal data that reflects the dependency relationships converted in the second conversion step, the pseudo-normal data that is identified as pseudo-normal data by the classifier of the generative model learned in the second learning step is stored in a storage unit. An abnormality management method comprising the following features.

7. In the abnormality management method described in claim 6, Furthermore, the system includes an adjustment step to adjust the model parameters of the sequential learning model according to the learning state of the generative model in the second learning step, The first conversion step converts the normal data into normal data that reflects the dependencies, using the sequence learning model having the model parameters adjusted in the adjustment step. The second transformation step uses the sequence learning model having the model parameters adjusted in the adjustment step to transform the pre-transformation pseudo-normal data generated in the generation step into pseudo-normal data that reflects the dependencies. An abnormality management method characterized by the following.

8. In the abnormality management method described in claim 6, Furthermore, there is a collection step that collects managed data, which is a series of managed usage amounts of processing resources by each process, A third transformation step involves using the sequence learning model to transform the managed data into managed data that reflects the dependencies, A determination step in which it is determined that a process malfunction has occurred if one of the managed data reflecting the dependency matches at least partially with one of the pseudo-normal data stored in the storage unit that reflects the dependency. An abnormality management method comprising the following features.

9. In the abnormality management method described in claim 8, Furthermore, if the determination step determines that a process malfunction has occurred, the system includes an instruction step that sends an instruction to perform a predetermined action to resolve the process malfunction. An abnormality management method characterized by the following.

10. In the abnormality management method described in claim 6, The aforementioned sequence learning model is a recurrent neural network model. An abnormality management method characterized by the following.

Images