Process control device and process control method

Abstract

This makes it easier to manage program malfunctions. [Solution] The process management device comprises: a first learning unit configured to learn and estimate a first parameter representing the ratio between the probability distribution of first data, which is a series of normal processing resource usage, and the probability distribution of second data, which is a series of processing resource usage that deviates from the range of normal processing resource usage; a second learning unit configured to estimate a second parameter of a class corresponding to the first data and a class-specific probability distribution model corresponding to the second data; a third learning unit configured to learn a plurality of generative models, each having an objective function set by the probability distribution of the first data and the probability distribution of the second data estimated by the first learning unit and the second parameter estimated by the second learning unit; and a generation unit configured to generate pseudo-data using each of a plurality of trained generators obtained by the learning of the third learning unit.

Description

[Technical Field]

[0001] The present invention relates to a process control device and a process control method. [Background technology]

[0002] In recent years, the demands on software have become more sophisticated and complex in order to provide high-performance systems and services. Software implemented in high-performance systems consists of programs with vast amounts of source code, and program execution is becoming increasingly complex.

[0003] When process failures or malfunctions occur in a system in operation, identifying the cause of the program failure or malfunction is complicated, time-consuming, and not easy. For example, Patent Document 1 discloses a method for retrospectively identifying the location of the error and the variable values ​​at the time using a core file.

[0004] However, the technology disclosed in Patent Document 1 does not allow for the identification of the cause or location of errors from log information, thus requiring source code analysis. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2005-301570 [Overview of the Initiative] [Problems that the invention aims to solve]

[0006] Thus, conventional technologies have not made it easier to manage abnormal program behavior.

[0007] This invention was made to solve the above-mentioned problems and aims to make it easier to manage abnormal program behavior. [Means for solving the problem]

[0008] To solve the above-mentioned problems, the process management device according to the present invention includes a first learning unit configured to learn a first parameter representing the ratio between a probability distribution of first data, which is a series of processing resource usage amounts where the range of processing resource usage used in the execution of each of the multiple process IDs is considered normal, and a probability distribution of second data, which is a series of processing resource usage amounts that deviate from the normal range of processing resource usage, and to estimate the ratio based on the learned first parameter; and a second parameter of a class-specific probability distribution model corresponding to the class corresponding to the first data and the class corresponding to the second data, respectively, based on the frequency of occurrence of each of the multiple process IDs, treating each of the series of processing resource usage amounts used in the execution of each of the multiple process IDs as an observed value, treating each observed value as a conditionally independent discrete value, and estimating the second parameter of a class-specific probability distribution model corresponding to the class corresponding to the first data and the class corresponding to the second data, respectively. The system comprises a second learning unit configured to generate pseudo-data that is statistically similar to the true data, with each of the sequences of processing resource usage used in the execution of processes corresponding to each of the plurality of process IDs corresponding to the second data being used as true data; a discriminator that identifies whether the pseudo-data generated by the generator belongs to a class corresponding to the true data or a class corresponding to the pseudo-data, and a third learning unit configured to learn a plurality of generative models, each having an objective function set with the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated by the first learning unit and the second parameter estimated by the second learning unit; and a generation unit configured to generate the pseudo-data using each of the plurality of trained generators obtained by the learning of the third learning unit.

[0009] Furthermore, the process control device according to the present invention may further include an identification unit configured to identify whether each of the pseudo-data generated by the generation unit belongs to a class corresponding to true data or a class corresponding to pseudo-data, using each of a plurality of trained classifiers obtained by learning by the third learning unit, and a storage unit configured to store each of the pseudo-data identified by the identification unit as belonging to a class corresponding to true data.

[0010] Furthermore, the process management device according to the present invention may further include a collection unit configured to collect a series of processing resource usage amounts used in the execution of a managed process corresponding to each of the plurality of process IDs, and a determination unit configured to determine that an operational abnormality has occurred in the managed process when the series of processing resource usage amounts used in the execution of the managed process collected by the collection unit matches the pseudo data stored in the storage unit.

[0011] Furthermore, the process control device according to the present invention may also include a control unit configured to send an instruction to perform a predetermined action to resolve the operational abnormality of the managed process when the determination unit determines that an operational abnormality has occurred in the managed process.

[0012] Furthermore, in the process control device according to the present invention, the probability distribution of the first data is the probability density function of the first data, the probability distribution of the second data is the probability density function of the second data, and the ratio may be the density ratio of the probability density function of the first data and the probability density function of the second data.

[0013] To solve the above-mentioned problems, the process management method according to the present invention includes a first learning step of learning a first parameter that represents the ratio between a probability distribution of first data, which is a series of processing resource usages where the range of processing resource usage used in the execution of each process corresponding to each of a plurality of process IDs is considered normal, and a probability distribution of second data, which is a series of processing resource usages that deviate from the normal range of processing resource usage, and estimating the ratio based on the learned first parameter; and treating each of the series of processing resource usages used in the execution of each process corresponding to each of a plurality of process IDs as an observed value, treating each observed value as a conditionally independent discrete value, and estimating a second parameter of a class-specific probability distribution model corresponding to the class corresponding to the first data and the class corresponding to the second data, respectively, based on the frequency of occurrence of each observed value. The system comprises a second learning step of determining the second data, a generator that generates pseudo-data statistically similar to the true data, with each of the sequences of processing resource usage used in the execution of the process corresponding to each of the plurality of process IDs corresponding to the second data as true data, and a discriminator that identifies whether the pseudo-data generated by the generator belongs to the class corresponding to the true data or the class corresponding to the pseudo-data, and a third learning step of learning a plurality of generative models, each having an objective function set with the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated in the first learning step and the second parameter estimated in the second learning step, and a generation step of generating the pseudo-data using each of the plurality of trained generators obtained by learning in the third learning step.

[0014] Furthermore, the process management method according to the present invention may further include an identification step in which each of the pseudo-data generated in the generation step belongs to either the class corresponding to true data or the class corresponding to pseudo-data, using each of the plurality of trained classifiers obtained by learning in the third learning step; and a storage step in which each of the pseudo-data identified in the identification step as belonging to the class corresponding to true data is stored in a storage unit.

[0015] Furthermore, the process management method according to the present invention may further include a collection step of collecting a series of processing resource usage amounts used in the execution of the managed process corresponding to each of the plurality of process IDs, and a determination step of determining that an operational abnormality has occurred in the managed process when the series of processing resource usage amounts used in the execution of the managed process collected in the collection step matches the pseudo data stored in the storage unit.

[0016] Furthermore, the process management method according to the present invention may also include a management step in which, if it is determined in the determination step that an abnormal operation has occurred in the managed process, an instruction is sent to perform a predetermined action to resolve the abnormal operation of the managed process. [Effects of the Invention]

[0017] According to the present invention, the system includes a generator that generates pseudo-data statistically similar to true data, using each of the sequences of processing resource usage used in the execution of each process corresponding to each of a plurality of process IDs corresponding to the second data as true data, and a discriminator that identifies whether the pseudo-data generated by the generator belongs to the class corresponding to the true data or the class corresponding to the pseudo-data, and learns a plurality of generative models, each having an objective function set with the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated by the first learning unit, and the second parameter estimated by the second learning unit.Therefore, abnormal program behavior can be managed more easily. [Brief explanation of the drawing]

[0018] [Figure 1] Figure 1 is a block diagram showing the configuration of a process management system equipped with a process control device according to an embodiment of the present invention. [Figure 2]Figure 2 is a diagram illustrating the operational abnormalities of the process managed by the process control device according to this embodiment. [Figure 3] Figure 3 is a diagram illustrating the third learning unit included in the process control device according to this embodiment. [Figure 4] Figure 4 is a diagram illustrating the third learning unit included in the process control device according to this embodiment. [Figure 5] Figure 5 is a diagram illustrating the third learning unit included in the process control device according to this embodiment. [Figure 6] Figure 6 is a block diagram showing an example of the hardware configuration of the process control device according to this embodiment. [Figure 7] Figure 7 is a flowchart showing the operation of the process control device according to this embodiment. [Figure 8] Figure 8 is a flowchart showing the operation of the process control device according to this embodiment. [Figure 9] Figure 9 is a flowchart showing the operation of the process control device according to this embodiment. [Figure 10] Figure 10 is a flowchart showing the operation of the process control device according to this embodiment. [Modes for carrying out the invention]

[0019] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to Figures 1 to 10.

[0020] [Process Management System Configuration] First, with reference to Figure 1, an overview of a process management system comprising a process management device 1 according to an embodiment of the present invention will be described. The process management system comprises a process management device 1 and an information processing device 2. The process management device 1 and the information processing device 2 are connected via a network NW.

[0021] The term "network" (NW) includes, for example, wired networks such as LANs, WANs, the Internet, and ISDN, as well as wireless networks such as mobile communication networks using wireless LANs, LTE / 4G, 5G, and 6G wireless communication systems, but the scope of the present invention is not limited to these.

[0022] The information processing device 2 can be implemented as a server, gateway, desktop computer, embedded device, mobile communication terminal such as a smartphone, tablet computer, laptop computer, etc. In this embodiment, the information processing device 2 is not limited to one unit, but includes cases where there are multiple units. In the case of multiple units, each information processing device 2 executes the same process generated by the same application or the same executable file.

[0023] Furthermore, the information processing device 2 is uniquely identified by network identification information such as an IP address or MAC address, or by a device ID assigned by a process management system. The information processing device 2 can be realized by a computer equipped with a processor, main memory, communication interface, auxiliary storage, and input / output I / O, and a program that controls these hardware resources.

[0024] The information processing device 2 runs one or more applications (programs) on the OS, and each application runs as one or more processes. Each process is assigned a unique process ID (PID) by the OS. A process ID is assigned to each execution unit of a process, and even the same application may have different process IDs depending on whether it generates multiple processes or depending on the execution environment and timing. The information processing device 2 calculates the CPU usage rate as the amount of processing resources used for each process ID corresponding to the running process and records it in memory. If the configuration of each CPU of multiple information processing devices 2 is not the same, such as the number of CPU cores and clock speed, the CPU usage rate recorded by each information processing device 2 is normalized or corrected using each CPU benchmark, etc. The normalization or correction process may be performed by the process management device 1.

[0025] In this embodiment, the CPU usage rate for each process ID is used as the processing resource usage data, but the processing resource usage may also be memory usage per process ID, I / O waiting time per process ID, CPU calculation time, etc. Figure 2 shows first data a1, which is a normal CPU usage rate, and second data b1, which includes CPU usage rates that deviate from the normal range. The horizontal axis is the process ID, and the processes are arranged in the order they are executed. The vertical axis is the CPU usage rate [%]. In the range of process IDs in area c, the CPU usage rate in second data b1 is an abnormal value. The abnormal value of the CPU usage rate is due to an abnormal operation of the process executed by the information processing device 2.

[0026] A state in which a process executed by the information processing device 2 experiences an operational abnormality refers to a state in which the process deviates from the normal load range, such as excessive consumption of processing resources. For example, this includes cases where the CPU usage rate for each process ID exceeds a pre-set threshold, or where the CPU usage rate falls outside the range defined for normal CPU usage rates according to the attributes of the process. Furthermore, even if the CPU usage rate does not exceed the threshold, a pre-defined pattern of CPU usage rate that occurs when an operational abnormality occurs in a process can be used as a CPU usage rate that deviates from the normal range.

[0027] Thus, if a process is behaving abnormally, it is assumed that the execution of the process associated with that process ID is experiencing abnormal CPU usage, such as infinite loops or excessive recursive calls. On the other hand, normal CPU usage refers to the case where no abnormal CPU usage occurs in the execution of the process associated with each process ID, and the consumption of CPU resources is within a normal range.

[0028] [Process control system function block] Next, the functional blocks of the process management device 1 according to this embodiment will be described with reference to the block diagram in Figure 1. As shown in Figure 1, the process management device 1 includes a collection unit 10, a first learning unit 11, a second learning unit 12, a third learning unit 13, a generation unit 14, an identification unit 15, an abnormal CPU usage rate database (storage unit) 16, a determination unit 17, a management unit 18, and a storage unit 19.

[0029] The collection unit 10 collects a series of CPU usage data, which represents the amount of processing resources used in the execution of each process corresponding to a plurality of process IDs, via the network NW. More specifically, the collection unit 10 collects first data, which is a series of CPU usage data where the range of CPU usage used in the execution of each process ID is considered normal. The collection unit 10 also collects second data, which is a series of CPU usage data that deviates from the normal range of CPU usage used in the execution of each process ID. The CPU usage data is associated with a process ID. The collection unit 10 collects CPU usage data corresponding to each of M (for example, 10,000) process IDs.

[0030] The collection unit 10 can label the collected CPU usage based on rule-based or statistical thresholds, classify it into first data and second data, and collect this data. The collection unit 10 collects first data consisting of normal CPU usage and second data containing process IDs of CPU usage that deviates from the normal range as training data for the first learning unit 11. The collection unit 10 also collects the first data and second data as training data for the second learning unit 12. Furthermore, the collection unit 10 collects a series of CPU usage data resulting from the execution of managed processes corresponding to each of the multiple process IDs that the judgment unit 17 considers to be subject to abnormality determination.

[0031] The first learning unit 11 learns a parameter (first parameter) that represents the ratio between the probability distribution of the first data, which is a series of CPU usages that are considered normal for the execution of each process corresponding to a plurality of process IDs, and the probability distribution of the second data, which is a series of CPU usages that deviate from the normal range of CPU usages, and estimates the ratio based on the learned parameter.

[0032] More specifically, the first learning unit 11 learns a parameter representing the density ratio of the probability density functions of the first data and the second data using the series data of the CPU usage rate observed for each process ID. Further, the first learning unit 11 estimates the density ratio from the learned parameter.

[0033] Here, let the set of training data including the second data be D = {x (1) , x (2) , …, x (N)}, and the set of training data including the first data be D’ = {x’ (1) , x’ (2) , …, x’ (N’)}. x indicates the CPU usage rate for each process ID. Each observed data x (n) is M-dimensional, and x (n) = (x1 (n) , x2 (n) , …, x M (n) ). For example, when the number of process IDs is 1000 (= M), it is 1000-dimensional. Each component x i (n) indicates the CPU usage rate at process ID i.

[0034] Hereinafter, D is referred to as the second data, D’ is referred to as the first data, the probability density function of the second data D is p(x), and the probability density function of the first data D’ is p’(x). In the present embodiment, the probability density function p(x) of the second data D represents a probability distribution that is a reference distribution indicating the CPU usage rate x that deviates from the normal CPU usage rate range. Also, the probability density function of the first data D’ represents a probability distribution that is a non-reference distribution indicating the normal CPU usage rate x. Therefore, the first learning unit 11 directly models the abnormality likelihood. The density ratio r(x) between the probability density function p(x) of the second data D and the probability density function p’(x) of the first data D’ is expressed by the following equation (1).

Equation

[0035]

number

[0036] The basis function ψ(x) is defined using the RBF (Radial Basis Function) kernel and expressed by the following equation (3).

number

[0037] Here, based on equation (1) above, the specific form of equation (3) where the number of basis vectors b is the number of training data N (b=N) is given by the following equation (4).

number

[0038] Equation (4) above expresses the density ratio as a linear sum of RBFs centered on all learning points. Here, we introduce the generalized Kullback-Leibler divergence, which measures the information-theoretic distance between the non-negative functions f and g shown in equation (5).

number

[0039] In density ratio estimation, f=p(x) and g=r θ Substitute p'(x) into equation (5) above, and the objective function is given by equation (6).

number

[0040] In equation (6) above, each x n , x' n’ The optimization objective function obtained by approximating the integral with an empirical distribution that sets all values ​​except θ to 0, ignoring terms that do not depend on the parameter θ, and removing constants is expressed by the following equation (7).

number

[0041] By minimizing J(θ) in equation (7) above, the density ratio r θ This is estimated. Since J(θ) is a convex function, the first learning unit 11 updates the parameter θ from the initial value to convergence using the parameter θ update formula by gradient descent shown in equation (8) below.

number

[0042] The result of specifically calculating the gradient in equation (7) above is expressed by the following equation (9).

number

[0043] The first term of equation (9) above represents the contribution from the first data, and the second term represents the contribution from the second data. Before calculating the optimal solution for parameter θ using equations (7) to (9) above, the first learning unit 11 determines an appropriate value for the bandwidth h in equation (4) above using cross-validation or an information criterion (KL divergence minimization criterion). Based on the optimal solution for parameter θ obtained by the KL density ratio estimation method, the first learning unit 11 uses equation (2) above to calculate the density ratio r for any input x. θ An estimate of this can be obtained.

[0044] The second learning unit 12 takes each of the CPU usage rate sequences used by the execution of each process ID as an observed value, treats each observed value as a conditionally independent discrete value, and estimates the parameters (second parameters) of the class-specific probability distribution model corresponding to each class of the first data and each class of the second data based on the frequency of occurrence of each observed value. The second learning unit 12 sets up a class-specific probability distribution model using a multinomial distribution for the CPU usage rate data corresponding to the process IDs related to the first data and the CPU usage rate data corresponding to the process IDs related to the second data, estimates its parameters, and calculates the log-likelihood of each observed value sequence based on the class-specific probability distribution model. The second learning unit 12 uses integer discrete values ​​as observed values ​​of CPU usage rate corresponding to each process ID.

[0045] The second learning unit 12 focuses on the fact that the simple Bayes method treats each observation as a conditionally independent discrete variable, and extends the simple Bayes method to a multinomial distribution model to set up a class-based probability distribution model. Here, as shown in equation (10) below, the observed value X is a vector representing the number of occurrences of M categories for the data corresponding to the CPU usage rate corresponding to each process ID. X = x = (x1, x2, ..., x M ) ···(10)

[0046] Furthermore, the class label to which the observed value X belongs, i.e., the event Y, is defined as a binary variable by the following equation (11).

number

[0047] In equation (11) above, the abnormal CPU usage class is a class representing CPU usage that deviates from the range of normal CPU usage, and the normal CPU usage class is a class representing normal CPU usage. In this embodiment, the second learning unit 12 defines the abnormal CPU usage class as event Y=1 and the normal CPU usage class as event Y=0 in order to directly learn and evaluate the characteristics of CPU usage that deviates from the range of normal CPU usage, using normal CPU usage as the reference state. When each of the conditional probabilities P(X|Y) for the occurrence of observed value X under the given conditions of event Y, the observed variable x i The variables are conditionally independent of each other, and the likelihood ρ(x|y) is given by the simple Bayesian estimation method in equation (12).

[0048]

number

[0049] In this embodiment, since we are dealing with a series of data on CPU usage for each integer process ID, we use a category-specific occurrence count vector x=(x1,x2,···,x M We treat each process ID as one sample and extend the model to a multinomial distribution probability model while maintaining the naive assumption that the CPU usage data corresponding to each process ID is conditionally independent. The probability of occurrence of each marginal probability P(X) in which the observed value X is observed is given by θ1,···,θ M Under the constraints that the variables are independent and the sum of their probabilities of occurrence is 1, the probability model of the multinomial distribution can be expressed by the following equation (13).

[0050]

number

[0051] As shown in equation (13) above, the observed value x is the count value of the data corresponding to the CPU usage rate corresponding to each process ID. iThe sum of (x1 + x2 + ... + x M Once the ) is determined, the distribution becomes the product of the following equation (14), and the observed value x corresponds to the CPU usage corresponding to the i-th process ID in the series. i Each with an independent probability θ i xi It is possible to find this.

number

[0052] Therefore, it can be seen that the relationship is similar to that of the simple Bayesian method in (12). Here, the prior probability P(Y) is a binary problem with the first data (normal CPU usage rate) class (Y=0) and the second data (abnormal CPU usage rate) class (Y=1), and the unknown parameters of each are θ. 0 ,θ 1 Let's define D as the marginal probability (result), and the observed value of the first data (normal CPU usage rate) (Y=0) be D. 0 The observed value of the second data (abnormal CPU usage rate) (Y=1) is D 1 Let's assume that equation (14) above can be expressed as equation (15) by transforming the product form into a sum under the Naive Bayes independence assumption and decomposing the log-likelihood for the data set, the set of observed values ​​D, into class-specific forms.

[0053]

number

[0054] Here, the constraint is expressed by equation (16).

number

[0055] Furthermore, applying the Lagrangian multiplier method, the parameter θ related to the class of the first data (normal CPU usage) is obtained. 0 The maximum value of the log-likelihood for the i-th component is given by equation (17).

number

[0056] Parameter θ related to the class of the second data (abnormal CPU usage rate) 1 Similarly, when we find the maximum value of the log-likelihood for this as well, under the constraint of equation (16) above, the parameter θ corresponds to the class of the second data (abnormal CPU usage) and the class of the first data (normal CPU usage), respectively. 1 , θ 0 This can be expressed by the following equation (18).

number

[0057] Note that x i Since x takes an integer value, i (n) To prevent the multinomial distribution from diverging when θ is 0, smoothing can be performed by specifying +α (e.g., α=1) smoothing. In this way, the second learning unit 12 considers the sequence of observed data corresponding to the CPU usage rate corresponding to each process ID to follow a multinomial distribution, estimates the parameters of the class-specific probability distribution model by counting the frequency of occurrence of each category, and uses the likelihood based on this model to evaluate the degree of normal CPU usage represented by the first data and the degree of abnormal CPU usage represented by the second data. The parameter θ estimated by the second learning unit 12 1 θ 0 It will be handed over to the 3rd Learning Department, 13.

[0058] The third learning unit 13 includes a generator 131 that generates pseudo-data statistically similar to true data, using each of the sequences of CPU usage rates used in the execution of processes corresponding to each of the multiple process IDs corresponding to the second data as true data, and a discriminator 132 that identifies whether the pseudo-data generated by the generator 131 belongs to the class corresponding to true data or the class corresponding to pseudo-data. The third learning unit 13 learns multiple generative models, each having an objective function set with the probability distribution of the first data and the probability distribution of the second data determined from the density ratio estimated by the first learning unit 11, and the parameters (second parameters) estimated by the second learning unit 12.

[0059] As shown in Figure 3, the third learning unit 13 performs adversarial learning on a Generative Adversarial Network (GAN) having a generator 131 and a discriminator 132. As shown in Figure 3, the third learning unit 13 performs adversarial learning on each of the multiple Generative Adversarial Networks (GANs) provided for each observed value i (i=1,...,M) corresponding to the CPU usage rate for each process ID. Through the learning of the third learning unit 13, a total of M trained generators 131' are constructed, each corresponding to an observed value 1 to M of the CPU usage rate for each process ID.

[0060] Figures 4 and 5 schematically represent the neural network configuration of the GAN generator 131 and discriminator 132 used by the first learning unit 11. As shown in Figure 4, the generator 131 consists of a neural network having an input layer, a hidden layer, and an output layer. The generator 131 is a model that generates pseudodata from random noise. For example, m randomly sampled Gaussian noise vectors are input to the input nodes of the generator 131 (z1~z m ).

[0061] The generator 131 outputs an output G(z) after performing a sum-of-products operation on the input and weight parameters, followed by thresholding using an activation function. The output G(z) from the generator 131 is pseudo-data similar to the observed value corresponding to the CPU usage of the i-th process ID corresponding to the second data. A CNN or ResNet can be used as the neural network that constitutes the generator 131.

[0062] The classifier 132 shown in Figure 5 consists of a neural network having an input layer, a hidden layer, and an output layer. In the example in Figure 5, the input to the training data is an observed value x corresponding to the CPU usage of the i-th process ID corresponding to the second data, which is acquired by the collection unit 10.

[0063] The classifier 132 outputs a probability value in the range of 1 to 0 after performing a sum-of-products operation on the input and weight parameters and thresholding using an activation function. When the classifier 132 correctly identifies the training data relating to the input true data as true data, it outputs a probability value close to y=1. On the other hand, when it correctly identifies the training data relating to the input pseudo-data as pseudo-data, it outputs a probability value close to y=0. In this way, the classifier 132 is a model that distinguishes the model distribution generated by the generator 131 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 132.

[0064] Figure 3 is a block diagram illustrating adversarial learning of the GAN by the third learning unit 13. The generator 131 of the GAN adopted by the first learning unit 11 is denoted as function G, and the discriminator 132 is denoted as function D. The true data is denoted as x, the predicted value output by the discriminator 132 is denoted as y, and the correct label is denoted as t. The correct label t is set to 1 for the true data and 0 for the pseudo-data generated by the generator 131. In this case, the discriminator 132 is a binary classification problem with the cross-entropy E given by equation (19) below. CE It can be expressed as follows.

[0065]

number

[0066] The first term inside the brace in equation (19) above represents t n lny n In this case, the predicted value y of the classifier 132 n However, the true correct label for the data is t n It is desirable to approach the value of =1. On the other hand, the second term inside the brace represents (1-t n )ln(1-y n In this case, the predicted value y of the classifier 132 n However, the value of the correct label (1-t) that distinguishes the pseudodata from the real data. n It is desirable for cross-entropy E to approach 0. CE This value is maximized when the predicted value matches the correct label value.

[0067] Here, the generator 131 that constitutes the GAN has parameter w G ,θ G It has a function G(w G ,θ G ) is expressed as. Also, the classifier 132 has parameter w D ,θ D It has a function D(w D ,θ D This is expressed as ). The cross-entropy E in equation (19) above CE The objective function E of a GAN comprising a generator 131 and a discriminator 132 based on the above can be expressed by the following equation (20).

number

[0068] The first term of equation (20) above represents E D(x)=1 lnD(w D ,θ D ) is the expected value that the classifier 132 identifies as true data. The second term of equation (20) above represents E D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D)) is the expected value that the classifier 132 identifies the pseudodata generated by the generator 131 as pseudodata. Here, the expected value of equation (20) above can be expressed as equation (21) using a probability distribution.

[0069]

number

[0070] Here, for the probability density function p(x) of the second data (abnormal CPU usage rate) and the probability density function p'(x) of the first data (normal CPU usage rate) in equation (1) above, we set p(x)≡ρ(x|y=1) and p'(x)≡ρ(x|y=0) in order to make them into a probabilistic labeled classification problem for min-max learning of GANs. The density ratio r estimated by the first learning unit 11 θ (x) is defined by the following equation (22).

number

[0071] The probability density function ρ(x|y=0), which is the conditional probability distribution of the first data (normal CPU usage rate) in equation (22) above, can be calculated using the maximum likelihood estimation method or the like from the M-dimensional CPU usage rate data for each process ID of the first data collected in advance by the collection unit 10. Using the calculated probability density function ρ(x|y=0) of the first data, the probability density function ρ(x|y=1), which is the conditional probability distribution of the second data (abnormal CPU usage rate), can be expressed by the following equation (23).

number

[0072] Substitute the probability density function ρ(x|y=1) of the second data and the probability density function ρ(x|y=0) of the first data in equation (23) into the objective function E in equation (21) above, and set the prior probability ρ(y=1) for the class of abnormal CPU usage (y=1) and the prior probability ρ(y=0) for the class of normal CPU usage (y=0) into parameters θ, which correspond to the observed value x corresponding to the CPU usage at the i-th process ID of the normal CPU usage class and the abnormal CPU usage class estimated by the second learning unit 12. 1 θ 0 Furthermore, for an observed value x corresponding to the CPU usage rate at the i-th process ID, the posterior probability ρ(y=1|x) that it is an abnormal CPU usage rate is given by D(w) in the optimal solution of equation (22) above. D ,θ D ) corresponds to the observed value x corresponding to the CPU usage at the i-th process ID, and the posterior probability ρ(y=0|x) that it is the normal CPU usage is given by 1-D(G(w) in the optimal solution of equation (21) above. G ,θ G ),w D ,θ D This corresponds to the density ratio r. θ And it can be determined from the prior probability.

[0073] In GAN training, the generator 131 and the discriminator 132 are trained adversarially by min-max optimization of the objective function E. Therefore, the generator 131 is trained to generate pseudodata that deceives the discriminator 132, and the discriminator 132 is trained to recognize the pseudodata generated by the generator 131 as pseudodata.

[0074] In the training of classifier 132, when given true data, classifier 132 is trained to maximize the first term of the objective function E in equation (21) above by producing an output close to y=1. On the other hand, when given pseudo-data, classifier 132 is trained to maximize the second term of the objective function E by producing an output close to y=0.

[0075] In the learning of generator 131, D(G(w) in equation (21) above G ,θG ), w D , θ D )(D(G(z)) in FIG. 3) is close to 1 for G(w G , θ G )(G(z) in FIG. 3) is output to minimize the objective function E. The third learning unit 13 uses a learning procedure that alternately updates the parameters of the generator 131 and the parameters of the discriminator 132. The details of the learning procedures of the generator 131 and the discriminator 132 by the third learning unit 13 will be described later.

[0076] When the objective function E of the GAN is optimized, the third learning unit 13 passes the trained generator 131' constructed for each observed value i corresponding to the CPU usage rate at the process ID to the generation unit 14. Therefore, finally, M trained generators 131' are constructed.

[0077] The generation unit 14 generates pseudo data using each of the trained generators 131' obtained by the learning by the third learning unit 13. Therefore, the generation unit 14 generates a set of M pseudo data.

[0078] The discrimination unit 15 uses each of the plurality of trained discriminators 132' obtained by the learning by the third learning unit 13 to discriminate to which of the class corresponding to the true data and the class corresponding to the pseudo data each of the pseudo data generated by the generation unit 14 belongs. Each trained discriminator 132' outputs a probability value indicating true data or pseudo data for each of the pseudo data generated by the trained generator 131'. When the probability value output by each trained discriminator 132' is close to 1, the discrimination unit 15 discriminates that it belongs to the class of true data (abnormal CPU usage rate), and when the probability value is close to 0, it discriminates that it belongs to the class of pseudo data (normal CPU usage rate).

[0079] The abnormal CPU usage database 16 stores each of the pseudo-data generated by the generation unit 14 that has been identified by the identification unit 15 as belonging to a class corresponding to true data. The abnormal CPU usage database 16 stores pseudo-data for each information processing device 2. In this way, the abnormal CPU usage database 16 accumulates time-series data of CPU usage that deviates from the range of normal CPU usage, i.e., CPU usage that can be considered abnormal data, as a template for abnormality detection.

[0080] The determination unit 17 determines that an abnormal operation has occurred in the managed process if the series of CPU usage rates used in the execution of the managed process corresponding to each of the multiple process IDs collected by the collection unit 10 matches the pseudo-data stored in the abnormal CPU usage rate database 16. The determination unit 17 can determine that an abnormal operation has occurred in the managed process if at least a portion of the series of CPU usage rates used in the execution of the managed process corresponding to each of the multiple process IDs matches the pseudo-data stored in the abnormal CPU usage rate database 16.

[0081] The determination unit 17 compares the CPU usage rates for each process ID in the pseudo-data, starting with the smallest process ID number or the earliest generation time. When a process ID with matching CPU usage rates is found, it can determine that an abnormal operation has occurred in the managed process. The determination unit 17 can also compare the pseudo-data stored in the abnormal CPU usage rate database 16 with the CPU usage rate series for each managed process ID and make a determination based on whether the similarity meets a predetermined threshold. The threshold is a criterion for determining the similarity between the CPU usage rate series corresponding to each managed process ID and the pseudo-data stored in the abnormal CPU usage rate database 16. For example, it can be arbitrarily set based on the distribution of CPU usage rate series observed in the past, or the conditions for generating the pseudo-data. Even when using a threshold, the comparison may be performed based on the entire CPU usage rate series for each process ID, or based on the CPU usage rates corresponding to some of the process IDs included in the series.

[0082] When the determination unit 17 determines that an abnormal operation has occurred in a managed process, the management unit 18 sends an instruction to perform a predetermined action to resolve the abnormal operation of the process. For example, the management unit 18 can identify the process ID of the process with abnormal CPU usage and send an instruction to the information processing device 2 via the network NW to terminate and restart the corresponding process.

[0083] The memory unit 19 stores the parameters and density ratios estimated by the first learning unit 11, as well as the parameters estimated by the second learning unit 12. The memory unit 19 stores M trained generators 131'.

[0084] [Process control system hardware configuration] Next, an example of a hardware configuration for realizing the process control device 1 having the functions described above will be explained using Figure 6.

[0085] As shown in Figure 6, the process control device 1 can be implemented, for example, by a computer equipped with a processor 102 connected via a bus 101, main memory 103, communication interface 104, auxiliary storage 105, and input / output I / O 106, and a program that controls these hardware resources. Furthermore, the process control device 1 includes a display device 107.

[0086] The processor 102 is a circuit or device that performs arithmetic processing, and can be implemented by, for example, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), etc. Alternatively, some or all of these may be combined to form the processor.

[0087] The main memory 103 is composed of, for example, volatile random access memory (RAM), and pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory 103 work together to realize the various functions of the process management device 1, such as the data collection unit 10, the first learning unit 11, the second learning unit 12, the third learning unit 13, the generation unit 14, the identification unit 15, the determination unit 17, and the management unit 18 shown in Figure 1.

[0088] The communication interface 104 is an interface circuit for networking the process control device 1 with various external electronic devices.

[0089] The auxiliary storage device 105 consists of a read / write storage medium and a drive device for reading and writing various information such as programs and data to the storage medium. The auxiliary storage device 105 can use non-volatile storage such as a hard disk or flash memory as the storage medium.

[0090] The auxiliary storage device 105 has a program storage area for storing the process management program. The auxiliary storage device 105 also has a program storage area for storing parameters representing the density ratio of the probability density functions of the first and second data, and a first learning program for estimating the density ratio, which is executed by the process management device 1. The auxiliary storage device 105 also has a program storage area for storing a second learning program for estimating parameters using polynomial Bayes, which is executed by the second learning unit 12. The auxiliary storage device 105 also has a program storage area for storing a third learning program for performing adversarial learning of a generative model, which is executed by the third learning unit 13.

[0091] The auxiliary storage device 105 enables the implementation of the abnormal CPU usage database 16 and the storage unit 19 described in Figure 1. Furthermore, it may also have, for example, a backup area for backing up the aforementioned data and programs.

[0092] The I / O106 is an input / output device that accepts signals from external devices and outputs signals to external devices.

[0093] The display device 107 is composed of an organic EL display or a liquid crystal display. The display device 107 displays process management information on the screen, such as a series of CPU usage rates for each managed process ID and the judgment results.

[0094] [Process control system operation] Next, the operation of the process control device having the above-described configuration will be explained with reference to the flowcharts in Figures 7 to 10.

[0095] As shown in Figure 7, first, the collection unit 10 collects first data, which is a series of CPU usage rates considered to be normal CPU usage rates used in the execution of processes corresponding to each process ID, and second data, which is a series of CPU usage rates that deviate from the range of normal CPU usage rates, from the information processing device 2 via the network NW (step S1).

[0096] Next, the first learning unit 11 performs first learning processing (step S2). FIG. 8 is a flowchart for explaining the first learning processing in step S2. As shown in FIG. 8, the first learning unit 11 learns a parameter θ representing the density ratio r between the probability density function of the first data and the probability density function of the second data (step S20). The first learning unit 11 updates the parameter θ by the gradient descent method or the like using the above equations (7) to (9), and obtains the optimal solution of the parameter θ. θ Then, based on the above equation (2), the first learning unit 11 estimates the density ratio r from the learned parameter θ obtained in step S20 (step S21).

[0097] Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ, θ for the observed values related to the CPU usage corresponding to each process ID related to the abnormal CPU usage class and the normal CPU usage class (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from the product form (Equation (14)) to the sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameters θ, θ corresponding to the abnormal CPU usage class that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)) (step S33). The estimated parameters θ, θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7. θ

[0098] Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ, θ for the observed values related to the CPU usage corresponding to each process ID related to the abnormal CPU usage class and the normal CPU usage class (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from the product form (Equation (14)) to the sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameters θ, θ corresponding to the abnormal CPU usage class that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)) (step S33). The estimated parameters θ, θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7. 1 、θ<--Removed redundant text here as it seems to be a formatting issue in the original --> 0 Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ, θ for the observed values related to the CPU usage corresponding to each process ID related to the abnormal CPU usage class and the normal CPU usage class (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from the product form (Equation (14)) to the sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameters θ, θ corresponding to the abnormal CPU usage class that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)) (step S33). The estimated parameters θ, θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7. 1 、および正常CPU使用率のクラスに対応するパラメータθ 0 Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ, θ for the observed values related to the CPU usage corresponding to each process ID related to the abnormal CPU usage class and the normal CPU usage class (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from the product form (Equation (14)) to the sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameters θ, θ corresponding to the abnormal CPU usage class that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)) (step S33). The estimated parameters θ, θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7. 1 、θ 0 Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ, θ for the observed values related to the CPU usage corresponding to each process ID related to the abnormal CPU usage class and the normal CPU usage class (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from the product form (Equation (14)) to the sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameters θ, θ corresponding to the abnormal CPU usage class that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)) (step S33). The estimated parameters θ, θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7.

[0099] ​Next, the third learning unit 13 executes the third learning process (step S4). In step S4, the third learning unit 13 includes a generator 131 that generates pseudo-data statistically similar to the true data, using observed CPU usage values ​​for each process ID corresponding to the second data as true data, and a discriminator 132 that identifies whether the pseudo-data generated by the generator 131 belongs to the class corresponding to the true data or the class corresponding to the pseudo-data. The third learning unit 13 learns multiple generative models, each having an objective function set with the probability density functions of the first data and the second data determined from the density ratio estimated by the first learning unit 11 in step S2, and the parameters estimated by the second learning unit 12 in step S3.

[0100] Figure 10 is a flowchart illustrating the third learning process in step S4. As shown in Figure 10, first, the third learning unit processes the density ratio r estimated in the first learning process in step S2 of Figure 7. θ The probability density function ρ(x|y=1) of the second data and the probability density function ρ(x|y=0) of the first data (equation (21) above), determined from the above, are set as the objective function E of the GAN (equation (21)) (step S50). More specifically, the third learning unit 13 calculates the probability density function ρ(x|y=0), which is the conditional probability distribution of the first data, from the first data collected by collection 10 in step S1, using the maximum likelihood estimation method or the like. The third learning unit 13 also determines the probability density function ρ(x|y=1), which is the conditional probability distribution of the second data, expressed by equation (23) above, from the calculated probability density function ρ(x|y=0) of the first data.

[0101] Next, the third learning unit 13 calculates the parameters θ corresponding to the classes of abnormal CPU usage and normal CPU usage, respectively, which were estimated in the second learning process in step S3 of Figure 7. 1 ,θ 0 The prior probability ρ(y=1) represents the abnormal CPU usage rate, and the prior probability ρ(y=0) represents the normal CPU usage rate, and these are set as the objective function E of the GAN (equation (22)) (step S51). Furthermore, in the optimal solution of the objective function E in equation (21) above, D(w D ,θD ) is the posterior probability ρ(y=1|x) that the observed value x corresponding to the CPU usage in process ID is an abnormal CPU usage, and 1-D(G(w G ,θ G ),w D ,θ D ) is the posterior probability ρ(y=0|x) that the observed value x corresponding to the CPU usage of the process ID is normal CPU usage. These posterior probabilities ρ(y=1|x) and ρ(y=0|x) are obtained from the estimated density ratio r θ It can also be calculated from the prior probabilities ρ(y=1) and ρ(y=0).

[0102] Next, the third learning unit 13 acquires each of the series of CPU usage rates used in the execution of each of the multiple process IDs corresponding to the second data acquired in step S1 of Figure 7 as true data (step S52). In step S52, the observed CPU usage rate for process ID i=1, which corresponds to one of the observed CPU usage rates for M process IDs corresponding to the second data (i=1), is taken as true data.

[0103] Next, the third learning unit 13 inputs the true data, which is the observed CPU usage value for process ID i=1 related to the second data acquired in step S52, into the classifier 132 as training data 134, and sets the parameter w of the classifier 132 so that the true data can be distinguished from the true data (y=1). D ,θ D Learn and update (step S53). As shown in the block diagram of the third learning unit 13 in Figure 3, the true data is used as training data 134 that is input when training the classifier 132.

[0104] In step S53, the third learning unit 13 can train the classifier 132 on true data using, for example, the backpropagation method. Step S53 pre-constructs a classifier 132 that can distinguish true data from other true data.

[0105] Next, the third learning unit 13 generates Gaussian noise and provides a random vector of the generated Gaussian noise as input to the generator 131 (step S54). Subsequently, the generator 131 uses the input z and weight parameter w based on the given Gaussian noise. G ,θ G The sum-of-products operation and thresholding using an activation function are performed to generate pseudo-data G(z) (step S55).

[0106] Next, the third learning unit 13 trains the classifier 132. The training of the classifier 132 involves the parameters w of the generator 131. D ,θ D This is done with fixed parameters. First, the third learning unit 13 provides the true data acquired in step S52 as training data 134 to the classifier 132 as input. Then, the third learning unit 13 uses backpropagation or the like to maximize the objective function E in equation (22) above, and the parameters w D ,θ D Update (step S56). Note that the label for training data 134 is set to 1 (true data).

[0107] Next, the third learning unit 13 provides the pseudo-data generated by the generator 131 in step S55 as input to the discriminator 132, and processes the parameters w using backpropagation or the like so that the objective function E in equation (21) above is maximized. D ,θ D Update (step S57). That is, in steps S56 and S57, in order to maximize the objective function E in equation (21) above, the first term is D(w D ,θ D )=1 is output, and the second term is D(G(w G ,θ G ),w D ,θ D The optimization is performed so that ) = 0. Note that the training data 134 has a label of 0 (pseudodata).

[0108] The learning of the classifier 132 in steps S56 and S57 corresponds to the dashed arrows in the block diagram of the third learning unit 13 shown in Figure 3, which indicate that the classifier error is calculated in block 135 of the objective function E based on the output 133 from the classifier 132, and then the error is backpropagated to the classifier 132.

[0109] Next, the third learning unit 13 trains the generator 131. During the training of the generator 131, the parameters of the discriminator 132 are fixed. The third learning unit 13 trains the generator 131 so that when random Gaussian noise is supplied to the generator 131, pseudo-data is generated. Specifically, the first learning unit 11 uses methods such as backpropagation to minimize the objective function E in equation (21) above, thereby adjusting the parameters w G ,θ G Update (Step S58).

[0110] The learning in step S58 corresponds to the dashed arrow flow in the block diagram of the third learning unit 13 in Figure 3, which indicates that the error is backpropagated to the generator 131. In other words, step S58 corresponds to the dashed arrow flow in which the pseudo-data generated by the generator 131 in Figure 3 is input to the discriminator 132, the generator error is calculated from its output 133 in block 135 of the objective function E, and then the error is backpropagated to the generator 131.

[0111] Subsequently, the learning of the discriminator 132 and generator 131 from steps S55 to S58 is repeated until the value of the objective function E reaches a Nash equilibrium and converges (step S59: NO). On the other hand, if the value of the objective function E converges (step S59: YES), the processing from steps S53 to S59 is repeated until the generator 131 and discriminator 132 are learned using all the true data (step S60: NO). Note that the processing from steps S52 to S58 and from steps S59 to S60 can be performed in batches.

[0112] Subsequently, if the generator 131 and discriminator 132 have been trained using all the true data (step S60: YES), the third learning unit 13 stores the trained generator 131' corresponding to the observed CPU usage for process ID i=1 in the storage unit 19 (step S61). Further, as shown in connector a, adversarial learning is performed on each of the generative models constructed for each of the observed CPU usage for process IDs i=2, ..., M (step S61: NO), and after storing M trained generators 131' in the storage unit 19 (step S61: YES), the process moves to step S5 in Figure 7.

[0113] Next, the generation unit 14 generates pseudo-data corresponding to the observed CPU usage for each process ID using each of the trained generators 131' constructed by the third learning unit 13 (step S5). Subsequently, the identification unit 15 identifies whether each of the pseudo-data generated in step S5 belongs to the class corresponding to the true data or the class corresponding to the pseudo-data (step S6). Subsequently, the abnormal CPU usage database 16 stores each of the pseudo-data identified in step S6 as belonging to the class of the true data (step S7).

[0114] Subsequently, the collection unit 10 collects a series of CPU usage rates resulting from the execution of managed processes corresponding to multiple process IDs (step S8). In step S7, the collection unit 10 obtains a series of CPU usage rates corresponding to a managed process executed on one information processing device 2. Next, the determination unit 17 determines that an abnormal operation has occurred in the managed process if the series of CPU usage rates resulting from the execution of managed processes obtained in step S8 matches the pseudo-data stored in the abnormal CPU usage rate database 16 in step S7 (step S9).

[0115] Subsequently, if the determination unit 17 determines in step S9 that an abnormal operation has occurred in the managed process, the management unit 18 sends an instruction to perform a predetermined action to resolve the abnormal operation of the managed process (step S10). More specifically, the management unit 18 can identify the process associated with the process ID that is using the abnormal CPU usage, and send instructions to the information processing device 2 via the network NW to terminate and restart the identified process.

[0116] As described above, according to the process management system of this embodiment, the probability density function and parameters obtained by the first learning unit 11 and the second learning unit 12 are set as the objective function of the GAN, adversarial learning of the GAN is performed using each of the observed values ​​corresponding to the CPU usage rate for each process ID corresponding to the second data as true data, and pseudo-data is generated using each of the generated trained generators 131'. Therefore, abnormal program operation can be managed more easily.

[0117] According to the process management device 1 of this embodiment, a generative model is constructed for each observed value corresponding to the CPU usage rate for each of the M process IDs. For each generative model corresponding to each observed value, parameters for the normal CPU usage class and the abnormal CPU usage class corresponding to the observed value corresponding to the CPU usage rate of that process ID estimated by the second learning unit 12 are set in the objective function. As a result, the learning accuracy of the generative model can be further improved.

[0118] In the embodiment described, the first learning unit 11 was configured to learn parameters representing the ratio of the probability distributions of the first data and the second data, and the case where the density ratio between probability density functions was estimated was described. However, the probability distribution is not limited to a probability density function, but may be represented as a discrete distribution, a mixture distribution, or a model that approximates these. Furthermore, the first learning unit 11 is not limited to learning the density ratio representing the ratio of the probability distribution of the first data and the second data, but may be configured to learn one or more parameters including a weighting coefficient, likelihood ratio, score value, or evaluation index for distinguishing between the first data and the second data, derived based on the ratio.

[0119] Furthermore, in the embodiments described, the third learning unit 13 was explained using the example of a case where the generative model has the configuration of a GAN, but the generative model is not limited to this. For example, the generative model may be constructed based on any generative model that learns the distribution of the second data and generates pseudo-data, such as a VAE (Variational Autoencoder) or an Energy-Based Model (EBM). In this case as well, the discrimination process for determining whether the generated pseudo-data is statistically equivalent to the real data is not limited to the configuration included in the generative model, and may be performed by a separate classifier or evaluation model.

[0120] Although embodiments of the process control apparatus and process control method of the present invention have been described above, the present invention is not limited to the embodiments described above, and various modifications that a person skilled in the art can envision are possible within the scope of the invention described in the claims. [Explanation of Symbols]

[0121] 1...Process control device, 2...Information processing device, 10...Collection unit, 11...First learning unit, 12...Second learning unit, 13...Third learning unit, 14...Generation unit, 15...Identification unit, 16...Abnormal CPU usage database, 17...Determination unit, 18...Management unit, 19...Storage unit, 101...Bus, 102...Processor, 103...Main memory, 104...Communication interface, 105...Auxiliary storage device, 106...Input / output I / O, 107...Display device, 131...Generator, 132...Discriminator, 133...Output, 134...Training data, 135...Block of objective function E

Claims

1. A first learning unit is configured to learn a first parameter that represents the ratio between a probability distribution of first data, which is a series of processing resource usages that are considered normal for the execution of each process corresponding to a plurality of process IDs, and a probability distribution of second data, which is a series of processing resource usages that deviate from the normal range of processing resource usages, and to estimate the ratio based on the learned first parameter. A second learning unit is configured to take each of the sequences of processing resource usage used in the execution of each process corresponding to each of multiple process IDs as an observed value, treat each observed value as a conditionally independent discrete value, and estimate the second parameter of the class-specific probability distribution model corresponding to the class corresponding to the first data and the class corresponding to the second data, respectively, based on the frequency of occurrence of each observed value. A third learning unit is configured to learn a plurality of generative models, each having an objective function set by the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated by the first learning unit, and the second parameter estimated by the second learning unit. The third learning unit includes a generator that generates pseudo-data statistically similar to the true data, with each of the sequence of processing resource usage used in the execution of the process corresponding to each of the plurality of process IDs corresponding to the second data being used as true data, and a discriminator that identifies whether the pseudo-data generated by the generator belongs to the class corresponding to the true data or the class corresponding to the pseudo-data, and each having an objective function set by the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated by the first learning unit, and the second parameter estimated by the second learning unit. A generation unit configured to generate the pseudo-data using each of the multiple trained generators obtained by the learning of the third learning unit, A process control device equipped with the following features.

2. In the process control device according to claim 1, Furthermore, an identification unit is configured to use each of the multiple trained classifiers obtained through training by the third learning unit to identify whether each of the pseudo-data generated by the generation unit belongs to the class corresponding to the true data or the class corresponding to the pseudo-data, A storage unit configured to store each of the pseudo-data identified by the identification unit as belonging to a class corresponding to true data, A process control device equipped with the following features.

3. In the process control apparatus according to claim 2, Furthermore, the collection unit is configured to collect a series of processing resource usage amounts used in the execution of each of the multiple process IDs of the managed process, A determination unit is configured to determine that an operational abnormality has occurred in the managed process when the series of processing resource usage used in the execution of the managed process, collected by the collection unit, matches the pseudo-data stored in the storage unit. A process control device characterized by comprising the following features.

4. In the process control device according to claim 3, Furthermore, the system includes a management unit configured to send an instruction to perform a predetermined action to resolve the operational abnormality of the managed process when the determination unit determines that an operational abnormality has occurred in the managed process. A process control device characterized by the following features.

5. In the process control device according to claim 1, The probability distribution of the first data is the probability density function of the first data, The probability distribution of the second data is the probability density function of the second data, The ratio is the density ratio of the probability density function of the first data to the probability density function of the second data. A process control device characterized by the following features.

6. A first learning step involves learning a first parameter that represents the ratio between a probability distribution of first data, which is a series of processing resource usages that are considered normal for the execution of each process corresponding to multiple process IDs, and a probability distribution of second data, which is a series of processing resource usages that deviate from the normal range of processing resource usage, and estimating the ratio based on the learned first parameter. A second learning step involves taking each of the sequences of processing resource usage used in the execution of each process corresponding to each of multiple process IDs as an observed value, treating each observed value as a conditionally independent discrete value, and estimating the second parameter of the class-specific probability distribution model corresponding to the class corresponding to the first data and the class corresponding to the second data, respectively, based on the frequency of occurrence of each observed value. A third learning step involves learning a plurality of generative models, each having an objective function set by the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated in the first learning step, and the second parameter estimated in the second learning step. The generator generates pseudo-data that is statistically similar to the true data, with each of the sequence of processing resource usage used in the execution of the process corresponding to each of the plurality of process IDs corresponding to the second data being used as true data, and a discriminator that identifies whether the pseudo-data generated by the generator belongs to the class corresponding to the true data or the class corresponding to the pseudo-data, and each objective function set by the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated in the first learning step, and the second parameter estimated in the second learning step. A generation step in which pseudo-data is generated using each of the multiple trained generators obtained through the learning in the third learning step, A process management method that includes the following features.

7. In the process control method described in claim 6, Furthermore, the identification step involves using each of the multiple trained classifiers obtained through the learning in the third learning step to identify whether each of the pseudo-data generated in the generation step belongs to the class corresponding to the true data or the class corresponding to the pseudo-data. A storage step in which each of the pseudo-data identified in the identification step as belonging to a class corresponding to the true data is stored in a storage unit; A process management method that includes the following features.

8. In the process control method described in claim 7, Furthermore, a collection step is performed to collect a series of processing resource usage amounts used in the execution of each of the multiple process IDs of the managed process, A determination step in which, if the series of processing resource usage used in the execution of the managed process collected in the collection step matches the pseudo data stored in the storage unit, it is determined that an abnormal operation of the managed process has occurred. A process control method characterized by comprising:

9. In the process control method described in claim 8, Furthermore, if the determination step determines that an abnormal operation has occurred in the managed process, the system includes a management step that sends an instruction to perform a predetermined action to resolve the abnormal operation of the managed process. A process management method characterized by the following:

Images