Learning devices, monitoring systems, learning methods, and programs
The learning device automates log format creation and anomaly detection by classifying logs and generating trained models, addressing inefficiencies in existing systems and improving accuracy.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Patents
- Current Assignee / Owner
- MITSUBISHI ELECTRIC CORP
- Filing Date
- 2022-05-27
- Publication Date
- 2026-07-03
Smart Images
Figure 0007884373000001 
Figure 0007884373000002 
Figure 0007884373000003
Abstract
Description
Technical Field
[0001] The present disclosure relates to a learning device, a monitoring system, a learning method, and a program for generating a learned model used for monitoring logs.
Background Art
[0002] In a control system that controls various plants, facilities, etc., or an information processing system that performs information processing, etc., as a method for determining the presence or absence of an incident, there is a method of collecting and analyzing logs stored on devices within the system. Patent Document 1 discloses a log analysis system that stores normal configuration patterns in advance regarding configuration patterns indicating combinations of log messages in a log file, and determines an abnormality when the configuration pattern of a log file to be monitored does not match the normal configuration pattern.
Prior Art Documents
Patent Documents
[0003]
Patent Document 1
Summary of the Invention
Problems to be Solved by the Invention
[0004] The technology described in Patent Document 1 detects anomalies occurring within an information processing system, and therefore determines anomalies using combinations of log messages in a log file. When detecting incidents related to monitored objects such as plants, it may be necessary to monitor each log message itself in the log file, rather than just combinations of log messages. There is a technology that uses a trained model generated by machine learning to monitor each log message, but the format (style) of each log message is diverse, and if all log messages are trained at once, it is difficult to capture features and generate a highly accurate trained model. For this reason, the accuracy of the trained model can be improved by classifying each log message into groups and training each group separately. On the other hand, determining the format of the logs (log messages) corresponding to each group in advance requires manual analysis, which is time-consuming. Furthermore, even if the technology described in Patent Document 1 is applied to the monitoring of each log message, it is still necessary to manually create a format for a normal log message in advance, and this does not solve the problem of the time required to create the format.
[0005] This disclosure is made in view of the above, and aims to provide a learning device that can efficiently create log formats. [Means for solving the problem]
[0006] To solve the above-mentioned problems and achieve the objective, the learning device according to this disclosure comprises: a data acquisition unit that acquires logs recorded in a monitored device; a classification information storage unit that stores log formats, which are the format of the logs; and a classification unit that classifies logs into groups according to log formats using the log formats stored in the classification information storage unit. The learning device further comprises: a model generation unit that generates a trained model for inferring whether a log is normal or not using the classification result from the classification unit and features extracted from the log; and a classification information generation unit that, if a log format matching the log is not stored in the classification information storage unit, generates a new log format using the log and stores the generated log format in the classification information storage unit. The log format includes fixed characters and numbers, as well as special characters in regular expressions. The classification information generation unit calculates an index indicating the degree of match between additional candidate logs, which are logs whose matching log format is not stored in the classification information storage unit, and log formats stored in the classification information storage unit. If there are similar log formats whose index is above a threshold, the unit generates an integrated log format by combining the additional candidate logs and the similar log formats, stores the integrated log format in the classification information storage unit, and deletes the similar log formats from the classification information storage unit. ru. [Effects of the Invention]
[0007] According to this disclosure, the log format can be created efficiently. [Brief explanation of the drawing]
[0008] [Figure 1] A diagram showing an example configuration of the monitoring system according to the embodiment. [Figure 2] This figure shows an example of a log format stored in the classification information storage unit of the embodiment. [Figure 3] A diagram showing an example of logs acquired by the learning device of the embodiment. [Figure 4] A diagram illustrating the automatic generation of the log format in the embodiment. [Figure 5] A flowchart showing an example of the log format generation procedure for the embodiment. [Figure 6] A flowchart showing an example of the process for generating a trained model in the embodiment. [Figure 7] A flowchart showing an example of the monitoring process in the embodiment. [Figure 8] This figure shows an example configuration of a computer system that implements the learning device of the embodiment. [Modes for carrying out the invention]
[0009] The learning device, monitoring system, learning method, and program according to the embodiment will be described in detail below with reference to the drawings.
[0010] Embodiment. Figure 1 shows an example of the configuration of a monitoring system according to an embodiment. The monitoring system 100 of this embodiment comprises a learning device 2 and a monitoring device 3. The monitoring system 100 of this embodiment detects incidents by, for example, monitoring logs acquired by monitored devices 11-1 to 11-n (where n is an integer of 1 or more) in the monitored system 1. Hereinafter, when monitored devices 11-1 to 11-n are not individually distinguished, they will be referred to as monitored devices 11. Figure 1 shows an example in which there are multiple monitored devices 11 in the monitored system 1, but there may be only one monitored device 11 in the monitored system 1. Monitored devices 11-1 to 11-n are, for example, devices in various plants such as power plants, business systems, information processing systems, etc. Monitored devices 11 can be of multiple types, such as control devices for controlling machinery and equipment in a plant, various computers, maintenance terminals, etc., and may be a combination of these. Hereinafter, an example in which the monitored devices 11 are devices in a plant will be described, but it is not limited to this. The monitored device 11 is one that records events related to the monitored device 11, such as its usage status, operating status, and data transmission / reception status, as logs, but is not limited to these.
[0011] The learning device 2 and the monitoring device 3 may, for example, be installed inside the plant, or at least one of the learning device 2 and the monitoring device 3 may be installed outside the plant. For example, the monitoring device 3 may be installed inside the plant and the learning device 2 may be installed outside the plant. At least one of the learning device 2 and the monitoring device 3 may be installed on a cloud system (cloud computing system).
[0012] The learning device 2 generates a trained model for detecting incidents using logs during the preparation phase before the start of incident detection operations. Furthermore, after the start of incident detection operations, the learning device 2 updates the trained model using newly obtained logs. The learning device 2 comprises a data acquisition unit 21, a data storage unit 22, a classification information generation unit 23, a classification information storage unit 24, a classification unit 25, a feature extraction unit 26, a model generation unit 27, and a trained model storage unit 28.
[0013] The data acquisition unit 21 acquires logs recorded in the monitored devices 11. Specifically, the data acquisition unit 21 acquires logs by receiving them from each monitored device 11 and stores the acquired logs in the data storage unit 22. For example, the data acquisition unit 21 acquires a log file containing log messages. In Figure 1, the learning device 2 acquires logs from each monitored device 11, but a data collection device (not shown) may be provided, and the data collection device may collect logs from each monitored device 11, with the data acquisition unit 21 acquiring the logs via the data collection device. Alternatively, the logs used for learning may be input from the monitored devices 11 to the learning device 2 via a recording medium or the like. In this case, the data acquisition unit 21 acquires the logs by reading them from the recording medium.
[0014] The following describes an example in which the learning device 2 generates a normal model as a trained model, which learns information indicating normal logs. However, the learning device 2 is not limited to this example; it may also generate a trained model using supervised machine learning, or it may generate an abnormal model that learns information indicating abnormal logs. When using supervised learning, the data acquisition unit 21 also acquires ground truth data for each log indicating whether it is normal or not, and stores the log and ground truth data in the data storage unit 22. When the learning device 2 generates a normal model, the logs acquired by the data acquisition unit 21 are logs corresponding to a state in which no incident has occurred or is expected to occur with extremely low frequency, i.e., logs in a normal state. When the learning device 2 generates an abnormal model, the logs acquired by the data acquisition unit 21 are logs corresponding to a state in which an incident is expected to have occurred or is estimated to be abnormal, i.e., logs in an abnormal state.
[0015] If a log format matching the log is not stored in the classification information storage unit 24, the classification information generation unit 23 generates a new log format using the log and stores the generated log format in the classification information storage unit 24. Specifically, the classification information generation unit 23 reads the log file from the data storage unit 22, divides the log file into individual logs, stores each divided log in the data storage unit 22, and generates a log format using each log. The log format is classification information used to classify logs into groups according to their format, and it indicates the format of the log corresponding to each group. The log format is expressed, for example, using regular expressions, and includes, for example, ordinary characters and numbers (fixed characters and numbers) and special characters (metacharacters) in regular expressions. Special characters in regular expressions are special characters that have a special meaning as regular expressions. The classification information generation unit 23 stores the generated log format in the classification information storage unit 24.
[0016] The classification information storage unit 24 stores the log format for each group. In the present embodiment, the log format is automatically generated based on the logs, but some log formats may be registered by an administrator, an operator, an operator, or the like. In this case, the registered log format may be input by the input means of the learning device 2 (not shown), for example, or may be transmitted from another device (not shown).
[0017] FIG. 2 is a diagram showing an example of the log format stored in the classification information storage unit 24 of the present embodiment. FIG. 2 shows an example in which there are a plurality of types of logs such as syslog and cslog, and information indicating the type of log and the log format are stored for each group.
[0018] Returning to the description of FIG. 1, the classification unit 25 classifies the logs into groups for each log format using the log formats stored in the classification information storage unit 24. Specifically, the classification unit 25 compares the log format stored in the classification information storage unit 24 with the logs stored in the data storage unit 22, classifies the logs into groups for each log format, and outputs the classification result and the logs to the feature extraction unit 26.
[0019] The feature extraction unit 26 extracts features from each log according to the classification result of the group, and outputs the extracted features together with the classification result to the model generation unit 27. The features to be extracted are determined for each group. For example, which position information of the log is used to extract the features is determined according to the log format. Thus, by determining the features to be extracted according to the log format, features suitable for the log format can be defined, and the accuracy of learning can be improved. Note that the feature may be the log itself. When the log itself is the feature, the feature extraction unit 26 may not be provided, and the log itself is input to the model generation unit 27 as a feature extracted from the log.
[0020] Note that the order of feature extraction by the feature extraction unit 26 and classification by the classification unit 25 may be reversed. For example, if feature extraction by the feature extraction unit 26 is performed first, features used in all groups may be extracted, and then the features corresponding to each group may be selected after classification. Alternatively, the same features may be used in all groups, and a normal model may be generated for each group by the model generation unit 27, which will be described later.
[0021] The model generation unit 27 generates a trained model for inferring whether a log is normal or not, using the classification results from the classification unit 25 and the features extracted from the log. Specifically, the model generation unit 27 generates a trained model using the features and the classification results. If the trained model is a normal model, the model generation unit 27 generates a normal model, for example, by calculating a probability distribution using the features of multiple normal logs for each group, i.e., for each log format, and stores the generated normal model in the trained model storage unit 28. For example, the normal model may include the features of a normal log and a threshold for determining whether it is normal. In this case, during inference, for example, if the distance between the features of the monitored log and the features of a normal log is less than or equal to the threshold, it is inferred that the log is normal. The normal model is not limited to this example. Note that the model generation unit 27 determines this threshold, but after the start of operation, the threshold may be changed by an administrator or operator according to the results of monitoring using the trained model.
[0022] When the model generation unit 27 generates an abnormal model, it similarly generates an abnormal model for each log format using logs that are known to be abnormal. For example, the abnormal model may include features of the abnormal log and a threshold for determining whether it is abnormal. The abnormal model is not limited to this example. Also, when the model generation unit 27 generates a trained model that infers whether or not something is normal using supervised learning, the correct data is also input to the model generation unit 27 via the classification unit 25 and the feature extraction unit 26. Alternatively, the model generation unit 27 may read the correct data corresponding to each log from the data storage unit 22. When the model generation unit 27 generates a trained model that infers whether or not something is normal using supervised learning, it generates a trained model for inferring whether or not something is normal from the features using multiple datasets containing features and correct data for each log format.
[0023] The monitoring device 3 uses a trained model generated by the learning device 2 to monitor logs collected from the monitored device 11 in the monitored system 1 to detect the presence or absence of an incident, and if an incident is detected, it performs a predetermined process. The predetermined process is, for example, issuing an alarm, but is not limited to this. The monitoring device 3 comprises a data acquisition unit 31, a classification information storage unit 32, a classification unit 33, a feature extraction unit 34, a detection unit 35, a trained model storage unit 36, and a result output unit 37.
[0024] The data acquisition unit 31 acquires logs by receiving logs from each monitored device 11 and outputs the acquired logs to the classification unit 33. Similar to the learning device 2 described above, a data collection device (not shown) may be provided, and the data collection device may collect logs from each monitored device 11, and the data acquisition unit 31 may acquire logs via the data collection device. Alternatively, the data acquisition unit 31 may receive the logs as a log file and receive the logs in a state where they have been divided into individual logs (log messages).
[0025] The classification information storage unit 32 stores the log format generated by the learning device 2. That is, the classification information storage unit 32 stores the log format stored in the classification information storage unit 24 of the learning device 2. The log format may be transmitted from the learning device 2 to the monitoring device 3, or it may be transmitted from the learning device 2 to the monitoring device 3 via a recording medium.
[0026] The trained model storage unit 36 stores the trained models generated by the learning device 2. That is, the trained model storage unit 36 stores the trained models stored in the trained model storage unit 28 of the learning device 2. The trained models may be transmitted from the learning device 2 to the monitoring device 3, or they may be transmitted from the learning device 2 to the monitoring device 3 via a recording medium.
[0027] The classification unit 33 uses the log format stored in the classification information storage unit 32 to classify the logs acquired by the data acquisition unit 31 into groups, and outputs the logs along with the classification results to the feature extraction unit 34. The feature extraction unit 34 extracts features according to the classification results and outputs the extracted features to the detection unit 35.
[0028] The detection unit 35 infers whether the monitored log is normal or not using features extracted from the monitored log, which is the log of the monitored device 11, the classification result obtained by classifying the monitored log using the log format, and the trained model. In detail, the detection unit 35 detects an incident using the trained model stored in the trained model storage unit 36 and the features received from the feature extraction unit 34. That is, the detection unit 35 infers whether the log is normal or not using the trained model stored in the trained model storage unit 36 and the features received from the feature extraction unit 34. Since a trained model is generated for each group, for example, the detection unit 35 detects an incident using the trained model of the group corresponding to the classification result of the classification unit 33. The detection unit 35 notifies the result output unit 37 of the detection result. The detection unit 35 may, only when it detects an incident, notify the result output unit 37 that an incident has been detected as a detection result, or it may output a detection result to the result output unit 37 indicating whether or not the system is normal (whether or not an incident has been detected).
[0029] The result output unit 37 issues an alarm if the detection result notified by the detection unit 35 indicates that an incident has been detected. The result output unit 37 may display that an incident has been detected as an alarm, notify that an incident has been detected by voice or other means, or send information indicating that an incident has been detected to terminals of administrators or operators (not shown). The result output unit 37 may also display that the detection result is normal if it indicates that the detection result is normal. Note that the processing when an incident is detected is not limited to the examples described above.
[0030] Next, the method for generating the log format of this embodiment will be described. Figure 3 is a diagram showing an example of a log acquired by the learning device 2 of this embodiment. In the example shown in Figure 3, the log file contains multiple logs. In the example shown in Figure 3, the first log, which is not underlined, matches one of the log formats stored in the classification information storage unit 24, while the second and subsequent logs, which are underlined, do not match any of the log formats stored in the classification information storage unit 24. In such a case, if automatic generation of the log format of this embodiment is not performed, the second and subsequent logs, which are underlined, will be classified as, for example, "other group," and the logs classified as "other group" will have to be manually analyzed to generate a log format corresponding to a new group, or they will have to be manually integrated with other log formats, making the log format generation process extremely time-consuming.
[0031] Figure 4 is a diagram illustrating the automatic generation of log formats in this embodiment. In the example shown in Figure 4, the log shown in Figure 3 is classified into log 4, which matches an existing log format; log 5, which corresponds to a new first log format that does not match an existing log format; and log 6, which corresponds to a new second log format that does not match an existing log format. As explained using Figure 3, log 4 matches one of the log formats stored in the classification information storage unit 24. In this embodiment, a first log format represented as ".* picpc01387 systemd: Started Session .* of user root." is generated based on the common part of each log shown as log 5, and a second log format represented as ".* picpc01387 chronyd .*: Source .* replaced with .*" is generated based on the common part of each log shown as log 6. Note that "." and "*" are special characters in regular expressions, and "picpc01387 systemd: Started Session" etc. are fixed characters and numbers. In this embodiment, a log format is generated from similar logs using regular expressions. The detailed procedure for automatically generating the log format will be described later.
[0032] In this embodiment, since a log format is automatically generated from logs that do not match the log format stored in the classification information storage unit 24, there is no need to manually create the log format, and the log format can be created efficiently. Furthermore, even if one attempts to create a log format in advance, there may be cases where sufficient information about the monitored device 11 cannot be obtained, making it difficult to know what log format will be generated. From a confidentiality standpoint, it may also not be possible to obtain logs from the monitored device 11 in advance. In this embodiment, since a log format can be automatically generated from logs that do not match the log format stored in the classification information storage unit 24, the log format can be created efficiently even when sufficient information cannot be obtained in advance.
[0033] Figure 5 is a flowchart showing an example of the log format generation procedure in this embodiment. The classification information generation unit 23 reads a log file from the data storage unit 22, divides the log file into individual logs, and performs the processing shown in Figure 5 for each divided log. The processing shown in Figure 5 is performed before generating the trained model. Alternatively, after the start of operation, the log format may be generated similarly using newly acquired logs. For example, multiple logs may be collected together in the preparation phase, the log format may be generated using these multiple logs, and after the log format generation is completed, the trained model may be generated using these multiple logs. Or, if multiple new logs are acquired after the start of operation, the log format may be generated using these new multiple logs, and after the log format generation is completed, the trained model may be updated using these new multiple logs.
[0034] As shown in Figure 5, the classification information generation unit 23 of the learning device 2 compares the log to be processed, i.e., the divided log, with the stored log format (step S1). More specifically, the classification information generation unit 23 compares the divided log with each log format stored in the classification information storage unit 24.
[0035] The classification information generation unit 23 determines whether or not there is a matching log format based on the comparison result (step S2). If there is a matching log format (step S2 Yes), the process is terminated.
[0036] If no matching log format is found (Step S2 No), the classification information generation unit 23 determines whether there is a log format with many common parts (Step S3). Specifically, for example, the classification information generation unit 23 determines whether there are many common parts based on an index that shows the degree of agreement of fixed character and numeric parts between the log and the log format. The index that shows the degree of agreement may be calculated, for example, based on the number of words in the common part among the words in the fixed character and numeric parts. The index that shows the degree of agreement may be the number of matching words in the fixed character and numeric parts (number of matching words), the number of matching characters and numbers (number of matching characters), or the ratio of the number of matching words to the total number of words in the fixed character and numeric parts. The index that shows the degree of agreement is not limited to these examples. If there is a log format for which the index that shows the degree of agreement is equal to or greater than a threshold, the classification information generation unit 23 determines that the log format with many common parts (similar log format) is a log format with many common parts. Furthermore, if there are multiple log formats whose degree of similarity index is above a threshold, the classification information generation unit 23 may use the one with the highest degree of similarity index as the log format with the most common elements.
[0037] If there is no log format with many common parts (step S3 No), the classification information generation unit 23 defines a new group, sets the log to be processed as the log format for the new group (step S4), and terminates the process. More specifically, in step S4, the classification information generation unit 23 stores the log to be processed itself as the log format for the new group in the classification information storage unit 24.
[0038] If there are log formats with many common parts (Step S3 Yes), the classification information generation unit 23 integrates the log formats (Step S5) and terminates the process. Specifically, in Step S5, the common parts of the log to be processed and the log formats with many common parts are extracted, and the parts other than the common parts are made common using regular expressions, thereby integrating the log to be processed and the log formats with many common parts.
[0039] As described above, the classification information generation unit 23 calculates an index indicating the degree of match between an additional candidate log, which is a log whose matching log format is not stored in the classification information storage unit 24, and a log format stored in the classification information storage unit 24. If there is a similar log format whose index indicating the degree of match is above a threshold, the classification information generation unit 23 generates an integrated log format by integrating the additional candidate log and the similar log format, stores the integrated log format in the classification information storage unit 24, and deletes the similar log format from the classification information storage unit 24.
[0040] For example, suppose a first log format ".* picpc01387 systemd: Started Session .* of user root." and a second log format ".* picpc01387 chronyd .*: Source .* replaced with .*" have already been generated and are stored in the classification information storage unit 24. In this case, if the log to be processed is "Jan 9 06:47:13 picpc01387 systemd 1011 Source 149.202.156.97 replaced with 116.205.61.148", then the common part between the log to be processed and the first log format is "picpc01387 systemd", and the common parts between the log to be processed and the second log format are "picpc01387", "Source", and "replaced with". The log to be processed has more common parts in the second log format than in the first log format. For example, if the indicator showing the degree of agreement between the log to be processed and the second log format is above a threshold, the log to be processed is not defined as a new group, but is integrated with the group of the second log format, and the integrated log format ".* picpc01387 .*: Source .* replaced with .*" is generated. The classification information generation unit 23 deletes the second log format from the classification information storage unit 24 and stores the integrated log format in the classification information storage unit 24. In this way, even if there is no match with an existing log format, the number of groups can be reduced by integrating the log formats if there are many common parts.
[0041] Furthermore, after the log format is generated by the process shown in Figure 5, it is possible to determine whether there are any log formats with a lot of common parts among the generated log formats, similar to step S3. If there are log formats with a lot of common parts, they may be integrated, similar to step S5.
[0042] The generated log format is stored in the classification information storage unit 24 of the learning device 2, but as described above, it is also stored in the classification information storage unit 32 of the monitoring device 3. For example, if the log format stored in the classification information storage unit 24 is updated, the log format stored in the classification information storage unit 32 is also updated.
[0043] Furthermore, in the examples described above, the log format was generated before the creation of the trained model or before updating the trained model, but it may also be done during the log classification process, which is performed as a preprocessing step when generating the trained model.
[0044] Next, the process for generating a trained model in this embodiment will be described. Figure 6 is a flowchart showing an example of the process for generating a trained model in this embodiment. The process for generating a trained model is performed before the start of operation of the monitoring system 100. After the start of operation of the monitoring system 100, the trained model is updated using newly acquired logs in the same procedure. As shown in Figure 6, the learning device 2 acquires logs (training logs) (step S11). In detail, as described above, the data acquisition unit 21 acquires training logs, and the acquired logs are stored in the data storage unit 22.
[0045] Next, the learning device 2 classifies the logs (step S12). Specifically, the classification unit 25 classifies the logs stored in the data storage unit 22 based on the data format stored in the classification information storage unit 24, and outputs the classification result along with the logs to the feature extraction unit 26.
[0046] Next, the learning device 2 extracts features (step S13). Specifically, the feature extraction unit 26 extracts features from the log based on the classification result and outputs the extracted features and the classification result to the model generation unit 27.
[0047] Next, the learning device 2 generates a trained model (step S14). Specifically, the model generation unit 27 generates a trained model using the features and stores the generated trained model in the trained model storage unit 28. As described above, when generating a trained model using ground truth data, the model generation unit 27 generates the trained model using the features and ground truth data.
[0048] Next, the monitoring process of this embodiment will be described. The monitoring process is performed after the start of operation of the monitoring system 100. Figure 7 is a flowchart of an example of the monitoring process of this embodiment. As shown in Figure 7, the monitoring device 3 acquires logs (monitored logs) (step S21). In detail, as described above, the data acquisition unit 31 acquires the monitored logs, which are the logs to be monitored, and the acquired logs are output to the classification unit 33.
[0049] Next, the monitoring device 3 classifies the logs (step S22). Specifically, the classification unit 33 classifies the logs received from the data acquisition unit 31 based on the data format stored in the classification information storage unit 32, and outputs the classification results along with the logs to the feature extraction unit 34.
[0050] Next, the monitoring device 3 extracts features (step S23). Specifically, the feature extraction unit 34 extracts features from the log based on the classification result and outputs the extracted features and the classification result to the detection unit 35.
[0051] Next, the monitoring device 3 performs detection processing (step S24). Specifically, the detection unit 35 uses the feature quantities and the trained model stored in the trained model storage unit 36 to infer whether the log is normal or not, thereby detecting an incident.
[0052] Next, the monitoring device 3 determines whether the situation is normal or not (step S25), and if it is normal (step S25 Yes), it terminates the process. More specifically, in step S25, the detection unit 35 determines whether or not it has obtained an inference result that the log is normal.
[0053] If the monitoring device 3 determines that something is not normal (step S25 No), it outputs an alarm (step S26) and terminates the process. Specifically, if the detection unit 35 obtains an inference result that the log is not normal, i.e., if an incident is detected, it notifies the result output unit 37 of this fact, and the result output unit 37 outputs an alarm. As mentioned above, the processing when an incident is detected is not limited to this example.
[0054] In the example described above, the learning device 2 and the monitoring device 3 are provided separately, but the monitoring device 3 may also function as the learning device 2. In this case, all the components of the learning device 2 may be added to the monitoring device 3. Alternatively, a data storage unit 22, a classification information generation unit 23, and a model generation unit 27 may be added to the monitoring device 3, and the data acquisition unit 31, classification information storage unit 32, classification unit 33, feature extraction unit 34, and trained model storage unit 36 may function as the data acquisition unit 21, classification information storage unit 24, classification unit 25, feature extraction unit 26, and trained model storage unit 28, respectively, so that the data acquisition unit 31, classification information storage unit 32, classification unit 33, feature extraction unit 34, and trained model storage unit 36 are shared during both learning and inference. In this case, the log format generated by the classification information generation unit 23 is stored in the classification information storage unit 32, and the trained model generated by the model generation unit 27 is stored in the trained model storage unit 36.
[0055] Alternatively, the learning device 2 may not have a classification information storage unit 24 and a trained model storage unit 28, but instead have a separate device equipped with a classification information storage unit 24 and a trained model storage unit 28, and the learning device 2 may store the log format and trained model in the classification information storage unit 24 and trained model storage unit 28 of that device. Furthermore, the monitoring device 3 may not have a classification information storage unit 32 and a trained model storage unit 36, but may read the log format and trained model from the device equipped with a classification information storage unit 24 and a trained model storage unit 28.
[0056] Next, the hardware configuration of the learning device 2 in this embodiment will be described. In this embodiment, the learning device 2 functions as a computer system when a program (computer program) describing the processing in the learning device 2 is executed on the computer system. Figure 8 is a diagram showing an example of the configuration of a computer system that realizes the learning device 2 in this embodiment. As shown in Figure 8, this computer system includes a control unit 101, an input unit 102, a storage unit 103, a display unit 104, a communication unit 105, and an output unit 106, which are connected via a system bus 107.
[0057] In Figure 8, the control unit 101 is, for example, a processor such as a CPU, which executes a program describing the processing in the learning device 2 of this embodiment. The input unit 102 consists of, for example, a keyboard and mouse, and is used by the user of the computer system to input various information. The storage unit 103 includes various types of memory such as RAM (Random Access Memory) and ROM (Read Only Memory), and storage devices such as a hard disk, and stores the program to be executed by the control unit 101, necessary data obtained during the processing, etc. The storage unit 103 is also used as a temporary storage area for the program. The display unit 104 consists of a display, LCD (Liquid Crystal Display Panel), etc., and displays various screens to the user of the computer system. The communication unit 105 is a receiver and transmitter that perform communication processing. The output unit 106 is a printer, speaker, etc. Note that Figure 8 is just one example, and the configuration of the computer system is not limited to the example in Figure 8. For example, the computer system does not have to have an output unit 106.
[0058] Here, an example of the operation of the computer system until the program of this embodiment becomes executable will be described. In a computer system with the above configuration, for example, the program is installed in the storage unit 103 from a CD-ROM or DVD-ROM set in a CD (Compact Disc)-ROM drive or DVD (Digital Versatile Disc)-ROM drive (not shown). When the program is executed, the program read from the storage unit 103 is stored in the main memory area of the storage unit 103. In this state, the control unit 101 performs processing as the learning device 2 of this embodiment according to the program stored in the storage unit 103.
[0059] In the above explanation, a program describing the processing in the learning device 2 is provided using a CD-ROM or DVD-ROM as the recording medium. However, the explanation is not limited to this, and depending on the configuration of the computer system, the capacity of the program to be provided, a program provided via a transmission medium such as the Internet via the communication unit 105 may also be used.
[0060] For example, the program of this embodiment causes the learning device 2 to perform the following steps: acquire logs recorded in the monitored device 11; store the log format in the classification information storage unit 24 of the learning device 2; classify the logs into groups according to their log format using the log formats stored in the classification information storage unit 24; generate a trained model for inferring whether the logs are normal or not using the classification results and features extracted from the logs; and, if a log format matching the log is not stored in the classification information storage unit 24, generate a new log format using the log and store the generated log format in the classification information storage unit 24.
[0061] The classification information generation unit 23, classification unit 25, feature extraction unit 26, and model generation unit 27 shown in Figure 1 are realized by executing a program stored in the storage unit 103 shown in Figure 8 by the control unit 101 shown in Figure 8. The storage unit 103 shown in Figure 8 is also used to realize the classification information generation unit 23, classification unit 25, feature extraction unit 26, and model generation unit 27. The data acquisition unit 21 shown in Figure 1 is realized by the communication unit 105 shown in Figure 8. The data acquisition unit 21 may also be a device that reads data from a recording medium. The data storage unit 22, classification information storage unit 24, and trained model storage unit 28 shown in Figure 1 are part of the storage unit 103 shown in Figure 8. The learning device 2 may be realized by multiple computer systems. For example, the learning device 2 may be realized by a cloud system.
[0062] The monitoring device 3 can also be implemented, for example, by the computer system shown in Figure 8. The classification unit 33, feature extraction unit 34, and detection unit 35 shown in Figure 1 are implemented by executing a program stored in the storage unit 103 shown in Figure 8 by the control unit 101 shown in Figure 8. The storage unit 103 shown in Figure 8 is also used to implement the classification unit 33, feature extraction unit 34, and detection unit 35. The data acquisition unit 31 shown in Figure 1 is implemented by the communication unit 105 shown in Figure 8. The classification information storage unit 32 and trained model storage unit 36 shown in Figure 1 are part of the storage unit 103 shown in Figure 8. The result output unit 37 shown in Figure 1 is implemented, for example, by at least one of the display unit 104 and the communication unit 105 shown in Figure 8. The monitoring device 3 may be implemented by multiple computer systems. For example, the monitoring device 3 may be implemented by a cloud system.
[0063] As described above, in this embodiment, the learning device 2 automatically generates a log data format for classifying machine learning input data using the logs when monitoring logs using machine learning. Therefore, the log format can be created efficiently.
[0064] The configurations shown in the above embodiments are merely examples, and it is possible to combine them with other known technologies, combine different embodiments, and omit or modify parts of the configuration without departing from the gist of the invention. [Explanation of Symbols]
[0065] 1 System to be monitored, 2 Learning device, 3 Monitoring device, 11-1, 11-n System to be monitored, 21, 31 Data acquisition unit, 22 Data storage unit, 23 Classification information generation unit, 24, 32 Classification information storage unit, 25, 33 Classification unit, 26, 34 Feature extraction unit, 27 Model generation unit, 28, 36 Trained model storage unit, 35 Detection unit, 37 Result output unit, 100 Monitoring system.
Claims
1. A data acquisition unit that acquires logs recorded on the monitored device, A classification information storage unit that stores the log format, which is the format of the log, A classification unit that classifies the logs into groups according to the log format using the log format stored in the classification information storage unit, A model generation unit generates a trained model for inferring whether the log is normal or not, using the classification results from the classification unit and the features extracted from the log. If a log format matching the log is not stored in the classification information storage unit, a classification information generation unit generates a new log format using the log and stores the generated log format in the classification information storage unit. Equipped with, The aforementioned log format includes fixed characters and numbers, and special characters in regular expressions. The learning device is characterized in that the classification information generation unit calculates an index indicating the degree of agreement between an additional candidate log, which is a log whose matching log format is not stored in the classification information storage unit, and the log format stored in the classification information storage unit, and if there is a similar log format whose index is equal to or greater than a threshold, it generates an integrated log format by integrating the additional candidate log and the similar log format, stores the integrated log format in the classification information storage unit, and deletes the similar log format from the classification information storage unit.
2. The learning device according to claim 1, characterized in that the index is calculated based on the number of words in the fixed characters and numbers that match between the additional candidate log and the similar log format.
3. A detection unit that infers whether the monitored log is normal or not using features extracted from the monitored log, which is a log of the monitored device acquired from the monitored device, classification results obtained by classifying the monitored log using the log format, and the trained model. A learning device according to claim 1 or 2, characterized by comprising the following:
4. A monitoring system that monitors the monitored log, which is a log of the monitored device recorded on the monitored device, Learning device, Monitoring device, Equipped with, The learning device is A data acquisition unit that acquires learning logs, which are learning logs recorded in the monitored device, A classification information storage unit that stores the log format, which is the format of the log, A classification unit that classifies the learning logs into groups according to the log format using the log format stored in the classification information storage unit, A model generation unit generates a trained model for inferring whether the training log is normal or not, using the classification results from the classification unit and the features extracted from the training log. If the log format matching the learning log is not stored in the classification information storage unit, the classification information generation unit generates a new log format using the learning log and stores the generated log format in the classification information storage unit. Equipped with, The monitoring device uses the features extracted from the monitored log, the classification result obtained by classifying the monitored log using the log format, and the trained model to infer whether the monitored log is normal or not. The aforementioned log format includes fixed characters and numbers, and special characters in regular expressions. The monitoring system is characterized in that the classification information generation unit calculates an index indicating the degree of agreement between an additional candidate log, which is a log whose matching log format is not stored in the classification information storage unit, and the log format stored in the classification information storage unit, and if there is a similar log format whose index is equal to or greater than a threshold, the unit generates an integrated log format by integrating the additional candidate log and the similar log format, stores the integrated log format in the classification information storage unit, and deletes the similar log format from the classification information storage unit.
5. A learning method in a learning device, The acquisition step involves obtaining logs recorded on the monitored device, A storage step of storing the log format, which is the format of the log, in the classification information storage unit of the learning device, A classification step of classifying the logs into groups according to the log format using the log format stored in the classification information storage unit, A model generation step that generates a trained model for inferring whether the log is normal or not using the classification results and the features extracted from the log, If no log format matching the log is stored in the classification information storage unit, the classification information generation step involves generating a new log format using the log and storing the generated log format in the classification information storage unit. Includes, The aforementioned log format includes fixed characters and numbers, and special characters in regular expressions. In the classification information generation step, an index is calculated that indicates the degree of agreement between an additional candidate log, which is a log whose matching log format is not stored in the classification information storage unit, and the log format stored in the classification information storage unit. If there is a similar log format whose index is equal to or greater than a threshold, an integrated log format is generated by integrating the additional candidate log and the similar log format. The integrated log format is then stored in the classification information storage unit, and the similar log format is deleted from the classification information storage unit. This learning method is characterized in that, in the classification information generation step, an index is calculated that indicates the degree of agreement between an additional candidate log, which is a log whose matching log format is not stored in the classification information storage unit, and the matching log format is stored in the classification information storage unit.
6. In the learning device, The acquisition step involves obtaining logs recorded on the monitored device, A storage step of storing the log format, which is the format of the log, in the classification information storage unit of the learning device, A classification step of classifying the logs into groups according to the log format using the log format stored in the classification information storage unit, A model generation step that generates a trained model for inferring whether the log is normal or not using the classification results and the features extracted from the log, If no log format matching the log is stored in the classification information storage unit, the classification information generation step involves generating a new log format using the log and storing the generated log format in the classification information storage unit. A program that executes, The aforementioned log format includes fixed characters and numbers, and special characters in regular expressions. The program is characterized in that, in the classification information generation step, an index is calculated that indicates the degree of agreement between an additional candidate log, which is a log whose matching log format is not stored in the classification information storage unit, and the log format stored in the classification information storage unit; if there is a similar log format whose index is equal to or greater than a threshold, an integrated log format is generated by integrating the additional candidate log and the similar log format; the integrated log format is stored in the classification information storage unit and the similar log format is deleted from the classification information storage unit.