Failure estimation device, failure estimation method, and program

Abstract

A failure estimation device according to an embodiment of the present invention comprises: a generation unit that, on the basis of a history of events generated in a topology composed of a plurality of nodes, generates a rule including a combination of a plurality of conditions in a condition part and including occurrence of a failure in the topology in a conclusion part; a calculation unit that calculates an occurrence rate of each of the plurality of conditions for each node type of the plurality of nodes; an adjustment unit that, on the basis of the occurrence rate, adjusts the condition part of the rule so as to specify that the node type in which each of the plurality of conditions is generated is restricted; and an estimation unit that estimates the occurrence of a failure from an event group newly generated in the topology on the basis of the adjusted rule.

Description

Fault estimation device, fault estimation method, and program

[0001] The embodiments relate to a fault estimation device, a fault estimation method, and a program.

[0002] Fault estimation techniques are known that estimate the cause and location of faults that occur on a network. These techniques use events such as alarms generated when a fault occurs to estimate the fault.

[0003] A technology has been proposed that uses rules that take into account the proximity of communication devices on a network to extract unique event combinations for each failure as characteristic patterns, and then automatically generates failure estimation rules based on these characteristic patterns.The rules include information about topology, such as the relative position from the communication device where the failure occurred (i.e., whether it is the communication device where the failure occurred or a communication device connected to the communication device where the failure occurred).

[0004] JP 2018-28778 A

[0005] Depending on the fault, there may be events that are highly likely not to occur from a specific communication device. Also, depending on the fault, there may be events that are highly likely to occur from a specific communication device. However, information about the topology cannot take into account the conditions under which events that depend on the communication device, as described above, occur. For this reason, there is a concern that rule-based early detection of faults may not be possible.

[0006] The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a means for early estimation of a fault.

[0007] A fault estimation device according to one aspect includes a generation unit, a calculation unit, an adjustment unit, and an estimation unit. The generation unit generates rules based on a history of events that have occurred in a topology configured by a plurality of nodes, the rules including a combination of a plurality of conditions in a condition part and an occurrence of a fault in the topology in a conclusion part. The calculation unit calculates an occurrence rate of each of the plurality of conditions for each node type of the plurality of nodes. The adjustment unit adjusts the condition part of the rules based on the occurrence rate so as to specify a restriction on the node types in which each of the plurality of conditions occurs. The estimation unit estimates the occurrence of the fault from a group of events that have newly occurred in the topology based on the adjusted rules.

[0008] According to the embodiment, it is possible to provide a means for early estimation of a failure.

[0009] FIG. 1 is a block diagram showing an example of a fault estimation system and a network according to an embodiment. FIG. 2 is a block diagram showing an example of a hardware configuration of a fault estimation device according to an embodiment. FIG. 3 is a block diagram showing an example of a functional configuration of the fault estimation device according to an embodiment. FIG. 4 is a diagram showing an example of a data structure of a topology DB stored in the fault estimation device according to an embodiment. FIG. 5 is a diagram showing an example of a data structure of a fault case DB stored in the fault estimation device according to an embodiment. FIG. 6 is a block diagram showing an example of a configuration related to a rule generation function of the fault estimation device according to an embodiment. FIG. 7 is a diagram showing an example of a data structure of a primary rule generated by the fault estimation device according to an embodiment. FIG. 8 is a diagram showing an example of a data structure of a rule generated by the fault estimation device according to an embodiment. FIG. 9 is a block diagram showing an example of a configuration related to the fault estimation function of the fault estimation device according to an embodiment. FIG. 10 is a flowchart showing an example of a rule generation process in the fault estimation device according to an embodiment. FIG. 11 is a flowchart showing an example of a certainty factor calculation process in the fault estimation device according to an embodiment.

[0010] Hereinafter, embodiments will be described with reference to the drawings. In the following description, components having the same functions and configurations will be given the same reference numerals.

[0011] 1. Configuration 1.1 Fault Estimation System FIG. 1 is a block diagram showing an example of a fault estimation system and a network according to an embodiment.

[0012] The failure estimation system 1 is a system that estimates, for example, a failure that occurs in a network NW. The failure estimation system 1 includes a monitoring device 2 and a failure estimation device 3.

[0013] The network NW is an example of a topology to be monitored by the fault estimation system 1. The network NW is composed of multiple communication devices SW having connection relationships. The communication devices SW are nodes that make up the network. The example of FIG. 1 shows a case where the network NW is composed of seven communication devices SW1, SW2, SW3, SW4, SW5, SW6, and SW7.

[0014] The monitoring device 2 is, for example, a computer such as a server. The monitoring device 2 monitors the state of the network NW. When a failure occurs in the network NW, the monitoring device 2 collects failure events (hereinafter simply referred to as "events") generated in the network NW. The events include, for example, information indicating the type of alarm (event type) issued from the communication equipment SW and the communication equipment SW that issued the alarm (event-generating equipment). The monitoring device 2 inputs the collected event group to the failure estimation device 3.

[0015] The failure estimation device 3 is, for example, a computer such as a server, etc. Based on the input event group, the failure estimation device 3 estimates what kind of failure has occurred in which communication device SW within the network NW.

[0016] 1.2 Hardware Configuration of the Fault Estimation Device Next, the hardware configuration of the fault estimation device according to the embodiment will be described.

[0017] 2 is a block diagram showing an example of the hardware configuration of the fault estimation device 3 according to the embodiment. As shown in FIG. 2, the fault estimation device 3 includes a control circuit 11, a communication module 12, a user interface 13, a storage 14, a drive 15, and a storage medium 16.

[0018] The control circuit 11 is a circuit that controls the overall components of the fault estimation device 3. The control circuit 11 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), etc. The ROM of the control circuit 11 stores programs and the like used in various processes in the fault estimation device 3. The CPU of the control circuit 11 controls the entire fault estimation device 3 in accordance with the programs stored in the ROM of the control circuit 11. The RAM of the control circuit 11 is used as a work area for the CPU of the control circuit 11.

[0019] The communication module 12 is, for example, a circuit used for communicating data with the monitoring device 2 .

[0020] The user interface 13 is an interface that manages communication between a user and the control circuit 11. The user interface 13 includes input devices and output devices. The input devices include, for example, a keyboard, a touch panel, and operation buttons. The output devices include, for example, an LCD (Liquid Crystal Display) or an EL (Electroluminescence) display. The user interface 13 converts input from the user into an electrical signal and then transmits it to the control circuit 11. The user interface 13 outputs the execution result based on the user input to the user.

[0021] The storage 14 includes, for example, a hard disk drive (HDD) or a solid state drive (SSD). The storage 14 stores information used in various processes in the failure estimation device 3.

[0022] The drive 15 is a device for reading software stored in the storage medium 16. The drive 15 includes, for example, a CD (Compact Disk) drive and a DVD (Digital Versatile Disk) drive.

[0023] The storage medium 16 is a medium that stores software electrically, magnetically, optically, mechanically, or chemically. The storage medium 16 may store programs for executing various processes in the fault estimation device 3.

[0024] 1.3 Functional Configuration of the Fault Estimation Device Next, the functional configuration of the fault estimation device according to the embodiment will be described.

[0025] 1.3.1 Overview of Functional Configuration Fig. 3 is a block diagram showing an example of the functional configuration of a fault estimation device according to an embodiment. A topology DB 21 and a fault case DB 22 are stored in the storage 14 of the fault estimation device 3. Furthermore, the CPU of the control circuit 11 of the fault estimation device 3 loads a program stored in the ROM of the control circuit 11 or the storage medium 16 into the RAM of the control circuit 11. The CPU of the control circuit 11 then interprets and executes the program loaded into the RAM of the control circuit 11. As a result, the fault estimation device 3 functions as a computer equipped with a rule generation function 23 and a fault cause estimation function 24.

[0026] The topology DB 21 is a database of information that defines the connection relationships of a plurality of communication devices SW that make up the network NW.

[0027] Fig. 4 is a diagram showing an example of the data structure of a topology DB stored in the fault estimation device according to the embodiment. The example of Fig. 4 shows a case in which information corresponding to the connection relationships of the communication devices SW1 to SW7 shown in Fig. 1 is stored. As shown in Fig. 4, the topology DB 21 stores, for each of the communication devices SW1 to SW7 that make up the network NW, a set of device IDs, device types, and information related to the connected devices.

[0028] The device ID is an identifier that uniquely identifies the communication device SW.

[0029] The device type is an identifier that identifies multiple communication devices SW according to the difference in the type of event that occurs due to the function or role of the communication devices SW. The device type can be classified according to, for example, the routing protocol used between the communication devices SW, that is, the type of event that occurs.

[0030] The connected device is a device ID indicating a communication device SW connected to the target communication device SW. If there are multiple connected devices, the identifiers of the multiple communication devices SW are stored.

[0031] In the example of FIG. 4 , communication device SW1 has a device ID of “SW1” and a device type of “Y”, and is connected to communication devices SW3 and SW4. Communication device SW2 has a device ID of “SW2” and a device type of “Y”, and is connected to communication devices SW3 and SW4. Communication device SW3 has a device ID of “SW3” and a device type of “X”, and is connected to communication devices SW1, SW2, SW4, SW5, and SW6. Communication device SW4 has a device ID of “SW4” and a device type of “X”, and is connected to communication devices SW1, SW2, SW3, SW5, and SW6. Communication device SW5 has a device ID of “SW5” and a device type of “Z”, and is connected to communication devices SW3, SW4, and SW7. The communication device SW6 has a device ID of "SW6" and a device type of "no type", and is shown to be connected to the communication devices SW3 and SW4. The communication device SW7 has a device ID of "SW7" and a device type of "no type", and is shown to be connected to the communication device SW5.

[0032] The failure case DB 22 is a database in which information relating to failures that have occurred in the network NW and events that have been generated by the communication equipment SW at the time of the failures is stored in association with all past cases.

[0033] 5 is a diagram showing an example of the data structure of a fault case DB stored in the fault estimation device according to the embodiment. As shown in Fig. 5, the fault case DB 22 stores a fault ID, a fault name, a faulty device, a case ID, an event type, and an event occurrence device in association with each other.

[0034] The fault ID is an identifier that uniquely identifies a fault.

[0035] The fault name is a name given to a fault, and has a one-to-one correspondence with the fault ID.

[0036] The faulty device is a device ID that identifies the communication device SW in which a fault has occurred. At least one faulty device is associated with each fault ID.

[0037] The case ID is an identifier that uniquely identifies a group of events collected in response to the same fault that occurred at different locations or different time periods within the network NW. At least one case ID is associated with each fault ID.

[0038] The event type is an identifier for identifying a plurality of events in a group of events collected according to a certain case, and corresponds to the type of event issued by the communication device SW, for example.

[0039] The event occurrence device is a device ID that identifies the communication device SW where the event occurred.

[0040] In the example of FIG. 5, the fault corresponding to fault ID1 is a "node down" that occurred in communication equipment SW4, and it is shown that case ID1 and case ID2 are stored as specific cases of fault ID1.

[0041] In case ID 1, it is shown that an event of event type A occurred on communication device SW4, an event of event type B occurred on communication devices SW1, SW2, SW3, and SW5, an event of event type C occurred on communication devices SW5 and SW6, and an event of event type D occurred on communication devices SW1, SW2, SW5, and SW6.

[0042] In case ID 2, it is shown that no event of event type A occurred, an event of event type B occurred in communication devices SW1, SW2, SW3, and SW5, an event of event type C occurred in communication devices SW5 and SW6, and an event of event type D occurred in communication devices SW1 and SW2.

[0043] Referring again to FIG. 3, the functional configuration of the fault estimation device 3 will be described.

[0044] The rule generation function 23 generates a rule R used to infer a fault, based on the topology information acquired from the topology DB 21 and the fault case information acquired from the fault case DB 22. The rule generation function 23 inputs the generated rule R to the fault cause inference function 24.

[0045] Rule R is, for example, information that associates a fault with multiple conditions that are highly relevant to the fault. Rule R is expressed in an IF-THEN format. Rule R is composed of an IF part (condition part) that represents a premise or condition, and a THEN part (conclusion part) that represents a conclusion or action when the condition part is true. That is, multiple conditions that are highly relevant to the fault are set in the condition part of rule R. Fault IDs corresponding to the multiple conditions are set in the conclusion part of rule R. Details of rule R generated by the rule generation function 23 will be described later.

[0046] The failure cause estimation function 24 uses the rule R input from the rule generation function 23 to estimate the cause of a failure that has occurred in the network NW (i.e., the name of the failure and the faulty device) from the group of events input from the monitoring device 2. The failure cause estimation function 24 outputs the estimation result to the maintenance operator OP.

[0047] The maintenance person OP analyzes the estimation result and determines whether the estimation result is correct. If the estimation result is correct, the maintenance person OP registers the estimation result as it is as the analysis result in the failure case DB 22. If the estimation result is incorrect, the maintenance person OP corrects the content of the estimation result and registers it as the analysis result in the failure case DB 22.

[0048] 1.3.2 Rule Generation Function Next, the rule generation function of the fault estimation device according to the embodiment will be described in detail.

[0049] 6 is a block diagram showing an example of the configuration of the rule generation function of the fault estimation device according to the embodiment. As shown in FIG. 6, the rule generation function 23 includes an acquisition unit 31, a primary rule generation unit 32, an occurrence rate calculation unit 33, and a rule condition adjustment unit 34.

[0050] The acquisition unit 31 acquires topology information from the topology DB 21 and failure case information from the failure case DB 22. The acquisition unit 31 inputs the acquired topology information and failure case information to the primary rule generation unit 32.

[0051] The primary rule generating unit 32 extracts a feature pattern for each fault ID based on the topology information and the fault case information.

[0052] A feature pattern is a combination pattern of multiple pieces of information, each of which indicates "which event type and where the event occurred," and is a combination pattern unique to each fault. In other words, a feature pattern is associated one-to-one with a fault ID.

[0053] When two cases corresponding to the same failure ID occur at different locations within the network NW, it is desirable that these two cases match the same characteristic pattern. Therefore, the information about "where it occurred" included in the characteristic pattern is not a device ID, but information that distinguishes between the communication device SW where the failure occurred (the failed device) and the communication device SW located around the failed device (the adjacent device).

[0054] The primary rule generation unit 32 generates a primary rule Rt based on the extracted feature pattern. The primary rule Rt is an intermediate product for generating a rule R used to estimate the cause of a failure. The primary rule generation unit 32 inputs the generated primary rule Rt to the incidence rate calculation unit 33.

[0055] 7 is a diagram showing an example of the data structure of a primary rule generated by the fault estimation device according to the embodiment. In the example of FIG. 7, a primary rule Rt generated based on a characteristic pattern specific to fault ID 1 in FIG. 5 is shown.

[0056] 7, the primary rule Rt is expressed in the IF-THEN format, similar to the rule R. That is, the primary rule Rt is composed of an IF part (condition part) that represents a premise or condition, and a THEN part (conclusion part) that represents a conclusion or action when the condition part is true. A characteristic pattern is set in the condition part of the primary rule Rt. For example, a fault ID corresponding to the characteristic pattern is set in the conclusion part of the primary rule Rt.

[0057] In the example of FIG. 7, the primary rule Rt includes four conditions IF_1, IF_2, IF_3, and IF_4.

[0058] The condition IF_1 is "an event of event type A occurs in the faulty device."

[0059] The condition IF_2 is "an event of event type B occurs in an adjacent device."

[0060] The condition IF_3 is "an event of event type C occurs in the adjacent device."

[0061] The condition IF_4 is "an event of event type D occurs in an adjacent device."

[0062] If all of the above four conditions IF_1, IF_2, IF_3, and IF_4 are satisfied, the primary rule Rt indicates that "fault ID=1" indicated in the conclusion is true.

[0063] Returning to FIG. 6, the configuration of the rule generation function 23 will be described.

[0064] The occurrence rate calculation unit 33 calculates the occurrence rate of the conditions constituting the primary rule Rt for each device type for all cases of the fault ID corresponding to the generated primary rule Rt. The occurrence rate calculation unit 33 inputs the calculated occurrence rates to the rule condition adjustment unit 34.

[0065] The rule condition adjustment unit 34 adjusts the condition part of the primary rule Rt based on the occurrence rate of the condition for each device type. The rule condition adjustment unit 34 inputs the adjusted primary rule Rt as a rule R to the failure cause estimation function 24.

[0066] Specifically, the rule condition adjustment unit 34 determines whether to limit the device type in which the condition occurs. More specifically, if there is both a device type in which the occurrence rate of the condition is equal to or greater than a threshold and a device type in which the occurrence rate of the condition is less than the threshold, the rule condition adjustment unit 34 determines to limit the device type in which the condition occurs. On the other hand, if there is only one of a device type in which the occurrence rate of the condition is equal to or greater than a threshold and a device type in which the occurrence rate of the condition is less than the threshold, the rule condition adjustment unit 34 determines not to limit the device type in which the condition occurs, and sets the condition as it is as one of the conditions included in the condition part of rule R.

[0067] Furthermore, the rule condition adjustment unit 34 determines a device type in which the condition occurs based on the magnitude relationship between the number of device types whose occurrence rate of the condition is equal to or greater than a threshold and the number of device types whose occurrence rate of the condition is less than the threshold. Specifically, if the number of device types whose occurrence rate of the condition is equal to or greater than the threshold is smaller than the number of device types whose occurrence rate of the condition is less than the threshold, the rule condition adjustment unit 34 defines the device type whose occurrence rate of the condition is equal to or greater than the threshold as a specific device type. Then, the rule condition adjustment unit 34 sets "the condition occurs in a specific device type" as one of the conditions included in the condition part of rule R. On the other hand, if the number of device types whose occurrence rate of the condition is equal to or greater than the number of device types whose occurrence rate of the condition is less than the threshold, the rule condition adjustment unit 34 defines the device type whose occurrence rate of the condition is less than the threshold as a specific device type. Then, the rule condition adjustment unit 34 sets "the condition occurs in a device type other than the specific device type" as one of the conditions included in the condition part of rule R.

[0068] 8 is a diagram illustrating an example of the data structure of rules generated by the fault estimation device according to the embodiment. In the example of FIG. 8, a rule R generated based on a primary rule Rt corresponding to fault ID 1 in FIG. 7 is illustrated.

[0069] 8, each of the multiple conditions set in the condition part of rule R is configured by adding, to the conditions set in the primary rule Rt, occurrence conditions related to a specific device type set by the rule condition adjustment unit 34. The occurrence conditions related to a specific device type are classified into "occurrence in a specific device type" and "occurrence in a device type other than the specific device type." In the conclusion part of rule R, for example, a fault ID corresponding to a feature pattern is set, as in the primary rule Rt.

[0070] In the example of FIG. 8, rule R includes four conditions IF_1', IF_2', IF_3', and IF_4'.

[0071] The condition IF_1′ is equivalent to the condition IF_1 of the primary rule Rt, and is “an event of event type A occurs in a faulty device.” In other words, no occurrence condition related to a specific device type is added to the condition IF_1′.

[0072] Condition IF_2' is set to "condition IF_2 of primary rule Rt occurs in a device type other than the specific device type." Note that a display using "|" alone in FIG. 8 means that the specific device type is "none." In other words, condition IF_2' is "an event of event type B occurs in an adjacent device of a device type other than the device type "none."

[0073] Condition IF_3' is set to "condition IF_3 of primary rule Rt occurs in a device type other than the specific device type." Note that the notation "X|Y" in FIG. 8 means that the specific device types are "X" and "Y." In other words, condition IF_3' is "an event of event type C occurs in an adjacent device of a device type other than device types "X" and "Y."

[0074] The condition IF_4′ is set to “the condition IF_4 of the primary rule Rt occurs in a specific device type.” In other words, the condition IF_4′ is “an event of event type D occurs in an adjacent device of device type “Y.”

[0075] If all of the above four conditions IF_1', IF_2', IF_3', and IF_4' are satisfied, rule R indicates that "fault ID=1" shown in the conclusion is true.

[0076] 1.3.3 Failure Cause Estimation Function Next, the failure cause estimation function of the failure estimation device according to the embodiment will be described in detail.

[0077] 9 is a block diagram showing an example of the configuration of a failure factor estimation function of the failure estimation device according to the embodiment. As shown in FIG. 9, the failure factor estimation function 24 stores a rule DB 41. The failure factor estimation function 24 also includes a rule determination unit 42 and a certainty factor calculation unit 43.

[0078] When the rule R is input from the rule generation function 23, the failure cause estimation function 24 stores the rule R in the rule DB 41. The rule DB 41 is a database in which the rules R generated by the rule generation function 23 are collectively stored for all past failures.

[0079] The rule determination unit 42 determines a rule R to be applied to a group of events from the monitoring device 2. For example, the rule determination unit 42 extracts a rule R having a feature pattern that is closest to a combination pattern obtained from the group of events from the rule DB 41. The rule determination unit 42 inputs the extracted rule R to the certainty factor calculation unit 43.

[0080] The certainty factor calculation unit 43 uses the input rule R to calculate a certainty factor for each of the multiple communication devices SW that are the source of the event group. The certainty factor is an index that indicates the likelihood that the communication devices SW that are the source of the event group are faulty devices. In other words, the certainty factor calculation unit 43 determines that the communication device SW for which the highest certainty factor is calculated is the communication device SW that is most likely to be the faulty device. The certainty factor calculation unit 43 outputs the calculated certainty factor, along with the device ID of the communication device SW that is determined to be the most likely to be the faulty device and the fault ID of the occurred fault, as an estimation result to the maintenance person OP.

[0081] 2. Operation Next, the operation of the fault estimation device according to the embodiment will be described.

[0082] 2.1 Rule Generation Process First, the rule generation process in the fault estimation device according to the embodiment will be described.

[0083] 2.1.1 Flowchart FIG. 9 is a flowchart showing an example of a rule generation process in the fault estimation device according to the embodiment.

[0084] When the maintenance person OP stores the analysis results in the failure case DB 22 (start), the acquisition unit 31 acquires topology information from the topology DB 21 and failure case information from the failure case DB 22 (S11).

[0085] The primary rule generation unit 32 extracts a feature pattern for each fault based on the topology information and fault case information acquired in the process of S11. The primary rule generation unit 32 generates a primary rule Rt based on the feature pattern (S12).

[0086] The incidence rate calculation unit 33 selects one condition from the multiple conditions constituting the primary rule Rt generated in the process of S12 (S13).

[0087] The occurrence rate calculation unit 33 calculates the occurrence rate of the condition selected in the process of S13 for each device type (S14).

[0088] The rule condition adjustment unit 34 determines whether there is any device type whose incidence rate calculated in the processing of S14 is equal to or greater than the threshold value, and whether there is any device type whose incidence rate calculated in the processing of S14 is less than the threshold value (S15).

[0089] If there is only one of the device types whose occurrence rate is equal to or greater than the threshold value or the device type whose occurrence rate is less than the threshold value (S15; no), the rule condition adjustment unit 34 sets the condition selected in the processing of S13 as it is in the condition part of rule R (S16).

[0090] If there are both device types whose incidence rates are equal to or greater than the threshold and device types whose incidence rates are less than the threshold (S15; yes), the rule condition adjustment unit 34 determines whether the number of device types whose incidence rates are equal to or greater than the threshold is less than the number of device types whose incidence rates are less than the threshold (S17).

[0091] If the number of device types whose incidence rate is equal to or greater than the threshold is smaller than the number of device types whose incidence rate is less than the threshold (S17; yes), the rule condition adjusting unit 34 defines the device types whose incidence rate is equal to or greater than the threshold as specific device types (S18).

[0092] After processing in S18, the rule condition adjustment unit 34 sets "the condition selected in processing in S13 occurs in a specific device type (i.e., a device type whose occurrence rate is equal to or greater than a threshold)" in the condition part of rule R (S19).

[0093] If the number of device types with an incidence rate equal to or greater than the threshold is greater than or equal to the number of device types with an incidence rate less than the threshold (S17; no), the rule condition adjustment unit 34 defines the device types with an incidence rate less than the threshold as specific device types (S20).

[0094] After processing S20, the rule condition adjustment unit 34 sets the condition part of rule R as follows: "The condition selected in processing S13 occurs in a device type other than a specific device type (i.e., a device type whose occurrence rate is less than a threshold value)" (S21).

[0095] After the process of S16, S19, or S21, the rule condition adjustment unit 34 determines whether all conditions have been selected (S22).

[0096] If there is an unselected condition (S22; no), the incidence rate calculation unit 33 selects one unselected condition from the multiple conditions constituting the primary rule Rt generated in the process of S12 (S13). Then, the subsequent processes of S14 to S22 are executed. In this way, the processes of S13 to S22 are repeatedly executed until all conditions are selected.

[0097] If all conditions have been selected (S22; yes), the rule condition adjustment unit 34 determines that setting of the rule R in the condition part is complete, and outputs the rule R to the failure cause estimation function 24. This ends the rule generation process (END).

[0098] 2.1.2 Specific Example of Incidence Rate Calculation Processing Next, a specific example of the incidence rate calculation processing performed by the incidence rate calculation unit 33 will be described.

[0099] In this specific example, it is assumed that the primary rule Rt shown in Fig. 7 is generated as the primary rule Rt for fault ID 1 based on the topology DB shown in Fig. 4 and the fault case DB shown in Fig. 5. Next, the operation of the incidence rate calculation unit 33 when the incidence rate is calculated based on the primary rule Rt will be described. For convenience of explanation, it is assumed that the threshold value used in the determination process by the rule condition adjustment unit 34 is 60%.

[0100] (Condition IF_1) The occurrence rate calculation unit 33 selects the condition IF_1 (="an event of event type A occurs in the faulty device"). Then, the occurrence rate calculation unit 33 calculates, for each device type, whether an event of event type A has occurred in the faulty device in case 1 and case 2 corresponding to fault ID 1. Here, in case 1 and case 2, the only faulty device is communication device SW4 of device type X. Therefore, the occurrence rate calculation unit 33 calculates the occurrence rate of condition IF_1 related to device type X.

[0101] In communication device SW4, which is a device type X and a faulty device, an event of event type A did not occur in case 1 but occurred in case 2. Therefore, the occurrence rate calculation unit 33 calculates 1 / 2=50% as the occurrence rate of condition IF_1 related to device type X.

[0102] (Condition IF_2) The occurrence rate calculation unit 33 selects condition IF_2 (="an event of event type B occurs in an adjacent device"). Then, the occurrence rate calculation unit 33 calculates, for each device type, whether an event of event type B has occurred in an adjacent device in case 1 and case 2 corresponding to fault ID 1. Here, in case 1 and case 2, the adjacent devices are communication device SW3 of device type X, communication devices SW1 and SW2 of device type Y, communication device SW5 of device type Z, and communication device SW6 with no listening type. Therefore, the occurrence rate calculation unit 33 calculates the occurrence rate of condition IF_2 for each of device types X, Y, Z, and no type.

[0103] In communication device SW3, which is a device type X and an adjacent device, an event of event type B occurs in both case 1 and case 2. Therefore, the occurrence rate calculation unit 33 calculates the occurrence rate of condition IF_2 related to device type X as 2 / 2 = 100%.

[0104] In each of communication devices SW1 and SW2, which are adjacent devices of device type Y, an event of event type B occurs in both case 1 and case 2. Therefore, the occurrence rate calculation unit 33 calculates the occurrence rate of condition IF_2 related to device type Y as 4 / 4=100%.

[0105] In communication device SW5, which is a neighboring device of device type Z, an event of event type B occurs in both case 1 and case 2. Therefore, the occurrence rate calculation unit 33 calculates the occurrence rate of condition IF_2 related to device type Z as 2 / 2 = 100%.

[0106] In communication device SW6, which is an adjacent device with no device type, an event of event type B does not occur in either case 1 or case 2. Therefore, the occurrence rate calculation unit 33 calculates 0 / 2 = 0% as the occurrence rate of condition IF_2 related to no device type.

[0107] (Condition IF_3) The occurrence rate calculation unit 33 selects condition IF_3 (="an event of event type C occurs in an adjacent device"). Then, the occurrence rate calculation unit 33 calculates, for each device type, whether an event of event type C has occurred in an adjacent device in case 1 and case 2 corresponding to fault ID 1. That is, the occurrence rate calculation unit 33 calculates the occurrence rate of condition IF_3 for each of device types X, Y, Z, and no type.

[0108] In communication device SW3, which is an adjacent device of device type X, an event of event type C does not occur in either case 1 or case 2. Therefore, the occurrence rate calculation unit 33 calculates 0 / 2 = 0% as the occurrence rate of condition IF_3 related to device type X.

[0109] In each of the communication devices SW1 and SW2, which are adjacent devices of device type Y, an event of event type C does not occur in either case 1 or case 2. Therefore, the occurrence rate calculation unit 33 calculates 0 / 4 = 0% as the occurrence rate of condition IF_3 related to device type Y.

[0110] In communication device SW5, which is a neighboring device of device type Z, an event of event type C occurs in both case 1 and case 2. Therefore, the occurrence rate calculation unit 33 calculates the occurrence rate of condition IF_3 related to device type Z as 2 / 2=100%.

[0111] In communication device SW6, which is an adjacent device with no device type, an event of event type C occurs in both case 1 and case 2. Therefore, the occurrence rate calculation unit 33 calculates 2 / 2=100% as the occurrence rate of condition IF_3 related to no device type.

[0112] (Condition IF_4) The occurrence rate calculation unit 33 selects condition IF_4 (="an event of event type D occurs in an adjacent device"). Then, the occurrence rate calculation unit 33 calculates, for each device type, whether an event of event type D has occurred in an adjacent device in case 1 and case 2 corresponding to failure ID 1. That is, the occurrence rate calculation unit 33 calculates the occurrence rate of condition IF_4 for each of device types X, Y, Z, and no type.

[0113] In communication device SW3, which is an adjacent device of device type X, an event of event type D does not occur in either case 1 or case 2. Therefore, the occurrence rate calculation unit 33 calculates 0 / 2 = 0% as the occurrence rate of condition IF_4 related to device type X.

[0114] In each of communication devices SW1 and SW2, which are adjacent devices of device type Y, an event of event type D occurs in both case 1 and case 2. Therefore, the occurrence rate calculation unit 33 calculates the occurrence rate of condition IF_4 related to device type Y as 4 / 4=100%.

[0115] In communication device SW5, which is a neighboring device of device type Z, an event of event type D occurs in case 1 but does not occur in case 2. Therefore, the occurrence rate calculation unit 33 calculates ½=50% as the occurrence rate of condition IF_4 related to device type Z.

[0116] In communication device SW6, which is an adjacent device with no device type, an event of event type D occurs in case 1 but does not occur in case 2. Therefore, the occurrence rate calculation unit 33 calculates 1 / 2=50% as the occurrence rate of condition IF_4 related to no device type.

[0117] By operating as described above, the occurrence rate calculation unit 33 can calculate the occurrence rate for each device type for each condition.

[0118] 2.1.3 Specific Example of Rule Condition Adjustment Processing Next, a specific example of the rule condition adjustment processing performed by the rule condition adjustment unit 34 will be described.

[0119] In this specific example, the operation of the rule condition adjustment unit 34 when the rule R shown in Fig. 8 is generated based on the occurrence rate calculated in the above specific example will be described. For convenience of explanation, the threshold value used in the determination process by the rule condition adjustment unit 34 is assumed to be 60%.

[0120] (Condition IF_1') As described above, the only device type for which the occurrence rate for condition IF_1 has been calculated is device type X. The occurrence rate for condition IF_1 for device type X is 50%, which is less than the threshold. As a result, the rule condition adjustment unit 34 determines that there is only one device type for which the occurrence rate for condition IF_1 is less than the threshold. Therefore, the rule condition adjustment unit 34 sets condition IF_1', which is equivalent to condition IF_1, in the condition part of rule R.

[0121] (Condition IF_2') As described above, there are four device types for which the incidence rate for condition IF_2 is calculated: device types X, Y, Z, and no device type. The incidence rate for condition IF_2 for the three device types, device types X, Y, and Z, is 100%, which is greater than or equal to the threshold. On the other hand, the incidence rate for condition IF_2 for the one device type, no device type, is 0%, which is less than the threshold. As a result, the rule condition adjustment unit 34 determines that, for condition IF_2, there are more device types whose incidence rate is greater than or equal to the threshold than device types whose incidence rate is less than the threshold. Therefore, the rule condition adjustment unit 34 sets the absence of a device type whose incidence rate is less than the threshold as a specific device type, and sets "condition IF_2 occurs in device types other than the specific device type (i.e., device types X, Y, and Z)" as condition IF_2' in the condition part of rule R.

[0122] (Condition IF_3') As described above, there are four device types for which the incidence rate for condition IF_3 is calculated: device types X, Y, Z, and no type. The incidence rate for condition IF_3 for the two device types, device types X and Y, is 100%, which is greater than or equal to the threshold. On the other hand, the incidence rate for condition IF_3 for the two device types, device type Z and no type, is 0%, which is less than the threshold. As a result, the rule condition adjustment unit 34 determines that, for condition IF_3, the number of device types whose incidence rate is greater than or equal to the threshold is the same as the number of device types whose incidence rate is less than the threshold. Therefore, the rule condition adjustment unit 34 sets device types X and Y whose incidence rate is greater than or equal to the threshold as specific device types, and sets "condition IF_3 occurs in specific device types (i.e., device types X and Y)" as condition IF_3' in the condition part of rule R.

[0123] (Condition IF_4') As described above, there are four device types for which the incidence rate for condition IF_4 is calculated: device types X, Y, Z, and no type. The incidence rate for condition IF_4 for one device type, device type Y, is 100%, which is greater than or equal to the threshold. On the other hand, the incidence rates for condition IF_4 for three device types, device types X, Z, and no type, are 0%, 50%, and 50%, respectively, which are less than the threshold. As a result, the rule condition adjustment unit 34 determines that there are fewer device types for which the incidence rate for condition IF_4 is greater than or equal to the threshold than the device types for which the incidence rate is less than the threshold. Therefore, the rule condition adjustment unit 34 sets the device type Y for which the incidence rate is greater than or equal to the threshold as a specific device type, and sets "condition IF_4 occurs in a specific device type (i.e., device type Y)" as condition IF_4' in the condition part of rule R.

[0124] By operating as described above, the rule condition adjustment unit 34 can generate the rule R shown in FIG.

[0125] 2.2 Certainty Factor Calculation Process Next, the certainty factor calculation process in the fault estimation device according to the embodiment will be described.

[0126] 2.2.1 Flowchart Fig. 11 is a flowchart showing an example of a certainty factor calculation process in the fault estimation device according to the embodiment. The example in Fig. 11 shows an example of a process for calculating a certainty factor for each of a plurality of communication devices SW associated with one case out of a plurality of cases corresponding to a certain fault ID.

[0127] When the rule determination unit 42 determines the rule R to be applied (start), the certainty calculation unit 43 selects a communication device SW for which the certainty is to be calculated (S31). In the subsequent processing, the certainty is calculated assuming that the communication device SW selected in the processing of S31 is a faulty device.

[0128] After the process of S31, the certainty factor calculation unit 43 initializes the numerator value and the denominator value to, for example, 0 (S32). The numerator value and the denominator value are parameters used in calculating the certainty factor.

[0129] After the process of S32, the certainty factor calculation unit 43 selects the conditions that constitute the rule R to be applied (S33).

[0130] The certainty factor calculation unit 43 calculates the number of communication devices SW that may cause the condition selected in the process of S33, and adds the calculation result to the denominator value (S34).

[0131] The certainty factor calculation unit 43 calculates the number of events that match the condition selected in the process of S33, and adds the calculation result to the numerator value (S35).

[0132] The certainty factor calculation unit 43 determines whether or not all conditions have been selected (S36).

[0133] If there is a condition that has not been selected (S36; no), the certainty calculation unit 43 selects a condition that has not yet been selected from the conditions that make up the rule R to be applied (S33). Then, the subsequent processes of S34 to S36 are executed. In this way, the processes of S33 to S36 are repeatedly executed until all conditions have been selected.

[0134] If all conditions have been selected (S36; yes), the certainty calculation unit 43 calculates the certainty as the ratio of the numerator value calculated in the processing of S35 to the denominator value calculated in the processing of S34 (numerator value / denominator value) (S37).

[0135] The certainty factor calculation unit 43 determines whether or not all communication devices SW have been selected as calculation targets (S38).

[0136] If there is a communication device SW that has not been selected (S38; no), the certainty factor calculation unit 43 selects the communication device SW that has not yet been selected as a target for certainty factor calculation (S31). Then, the subsequent processes of S32 to S38 are executed. In this way, the processes of S31 to S38 are repeatedly executed until certainty factors are calculated for all communication devices SW related to the target case.

[0137] If all communication devices SW have been selected (S38; yes), the certainty factor calculation unit 43 estimates that the communication device SW with the highest certainty factor is the faulty device (S39).

[0138] After S39, the certainty factor and the device ID of the communication device SW that is estimated to be the faulty device are output as the estimation results, thereby completing the certainty factor calculation process (END).

[0139] 2.2.2 Specific Example of Certainty Factor Calculation Processing Next, a specific example of the certainty factor calculation processing performed by the certainty factor calculation unit 43 will be described.

[0140] 8 is applied to Case 1 and Case 2. For simplicity, the following description will be given for the cases where communication devices SW3, SW4, and SW7 are selected.

[0141] (Case 1) <When Communication Device SW3 is Selected> When communication device SW3 is selected, it is assumed that the faulty device is communication device SW3. In this case, the adjacent devices are communication devices SW1, SW2, SW4, SW5, and SW6.

[0142] The number of communication devices SW in which condition IF_1' can occur is one, which is the same as the number of failed devices (i.e., communication device SW3). Therefore, the certainty calculation unit 43 calculates 1 as the denominator value corresponding to condition IF_1'. Furthermore, no event of event type A has occurred in communication device SW3. Therefore, the certainty calculation unit 43 calculates 0 as the numerator value corresponding to condition IF_1'.

[0143] The number of communication devices SW in which condition IF_2' can occur is four out of the five neighboring devices, excluding communication device SW6 with no device type. Therefore, the certainty calculation unit 43 calculates 4 as the denominator value corresponding to condition IF_2'. Furthermore, among the neighboring devices, there are three communication devices SW in which an event of event type B has occurred and which are other than communication devices with no device type: communication devices SW1, SW2, and SW5. Therefore, the certainty calculation unit 43 calculates 3 as the numerator value corresponding to condition IF_2'.

[0144] The number of communication devices SW where condition IF_3' can occur is two out of the five neighboring devices, excluding communication device SW4 of device type X and communication devices SW1 and SW2 of device type Y. Therefore, the certainty calculation unit 43 calculates 2 as the denominator value corresponding to condition IF_3'. Furthermore, among the neighboring devices, there are two communication devices SW where an event of event type C has occurred and which are other than device types X and Y: communication devices SW5 and SW6. Therefore, the certainty calculation unit 43 calculates 2 as the numerator value corresponding to condition IF_3'.

[0145] The number of communication devices SW where condition IF_4' can occur is two, communication devices SW1 and SW2 of device type Y, out of the five neighboring devices. Therefore, the certainty calculation unit 43 calculates 2 as the denominator value corresponding to condition IF_4'. Furthermore, among the neighboring devices, there are two communication devices SW where an event of event type D has occurred and which are of device type Y, communication devices SW1 and SW2. Therefore, the certainty calculation unit 43 calculates 2 as the numerator value corresponding to condition IF_4'.

[0146] As a result, the sum of the denominator values ​​is 1 + 4 + 2 + 2 = 9. The sum of the numerator values ​​is 0 + 3 + 2 + 2 = 7. As a result, the certainty factor calculation unit 43 calculates 7 / 9 as the certainty factor when communication device SW3 is selected.

[0147] <When Communication Device SW4 is Selected> When communication device SW4 is selected, it is assumed that the faulty device is communication device SW4. In this case, the adjacent devices are communication devices SW1, SW2, SW3, SW5, and SW6.

[0148] The number of communication devices SW in which condition IF_1' can occur is one, which is the same as the number of failed devices (i.e., communication device SW4). Therefore, the certainty calculation unit 43 calculates 1 as the denominator value corresponding to condition IF_1'. Furthermore, an event of event type A has occurred in communication device SW4. Therefore, the certainty calculation unit 43 calculates 1 as the numerator value corresponding to condition IF_1'.

[0149] The number of communication devices SW in which condition IF_2' can occur is four out of the five neighboring devices, excluding communication device SW6 with no device type. Therefore, the certainty calculation unit 43 calculates 4 as the denominator value corresponding to condition IF_2'. Furthermore, among the neighboring devices, there are four communication devices SW in which an event of event type B has occurred and which are other than communication devices with no device type: communication devices SW1, SW2, SW3, and SW5. Therefore, the certainty calculation unit 43 calculates 4 as the numerator value corresponding to condition IF_2'.

[0150] The number of communication devices SW where condition IF_3' can occur is two out of the five neighboring devices, excluding communication device SW3 of device type X and communication devices SW1 and SW2 of device type Y. Therefore, the certainty calculation unit 43 calculates 2 as the denominator value corresponding to condition IF_3'. Furthermore, among the neighboring devices, there are two communication devices SW where an event of event type C has occurred and which are other than device types X and Y: communication devices SW5 and SW6. Therefore, the certainty calculation unit 43 calculates 2 as the numerator value corresponding to condition IF_3'.

[0151] The number of communication devices SW where condition IF_4' can occur is two, communication devices SW1 and SW2 of device type Y, out of the five neighboring devices. Therefore, the certainty calculation unit 43 calculates 2 as the denominator value corresponding to condition IF_4'. Furthermore, among the neighboring devices, there are two communication devices SW where an event of event type D has occurred and which are of device type Y, communication devices SW1 and SW2. Therefore, the certainty calculation unit 43 calculates 2 as the numerator value corresponding to condition IF_4'.

[0152] As a result, the sum of the denominator values ​​is 1 + 4 + 2 + 2 = 9. The sum of the numerator values ​​is 1 + 4 + 2 + 2 = 9. As a result, the certainty factor calculation unit 43 calculates the certainty factor when communication device SW4 is selected as 9 / 9 = 1.

[0153] <When Communication Device SW7 is Selected> When communication device SW7 is selected, it is assumed that the faulty device is communication device SW7. In this case, the adjacent device is communication device SW6.

[0154] The number of communication devices SW in which condition IF_1' can occur is one, which is the same as the number of failed devices (i.e., communication devices SW7). Therefore, the certainty calculation unit 43 calculates 1 as the denominator value corresponding to condition IF_1'. Furthermore, no event of event type A has occurred in communication device SW7. Therefore, the certainty calculation unit 43 calculates 0 as the numerator value corresponding to condition IF_1'.

[0155] Since the adjacent communication device SW5 is of device type Z, the condition IF_2' can occur. Therefore, the certainty factor calculation unit 43 calculates 1 as the denominator value corresponding to the condition IF_2'. Furthermore, an event of event type B has occurred in the adjacent communication device SW5. Therefore, the certainty factor calculation unit 43 calculates 1 as the numerator value corresponding to the condition IF_2'.

[0156] Since the adjacent communication device SW5 is of device type Z, the condition IF_3' can occur. Therefore, the certainty factor calculation unit 43 calculates 1 as the denominator value corresponding to the condition IF_3'. Furthermore, an event of event type C has occurred in the adjacent communication device SW5. Therefore, the certainty factor calculation unit 43 calculates 1 as the numerator value corresponding to the condition IF_3'.

[0157] The adjacent communication device SW5 is of device type Z, and therefore the condition IF_4' cannot occur. Therefore, the certainty factor calculation unit 43 calculates 0 as the denominator and numerator values ​​corresponding to the condition IF_4'.

[0158] As a result, the sum of the denominator values ​​is 1 + 1 + 1 + 0 = 3. The sum of the numerator values ​​is 0 + 1 + 1 + 0 = 2. As a result, the certainty factor calculation unit 43 calculates 2 / 3 as the certainty factor when communication device SW7 is selected.

[0159] From the above, it can be seen that the certainty factor is highest when communication device SW4 is selected in case 1. Therefore, the certainty factor calculation unit 43 estimates that the faulty device in case 1 is communication device SW4.

[0160] (Case 2) <When Communication Device SW3 is Selected> When communication device SW3 is selected, it is assumed that the faulty device is communication device SW3. In this case, the adjacent devices are communication devices SW1, SW2, SW4, SW5, and SW6.

[0161] The number of communication devices SW in which condition IF_1' can occur is one, which is the same as the number of failed devices (i.e., communication device SW3). Therefore, the certainty calculation unit 43 calculates 1 as the denominator value corresponding to condition IF_1'. Furthermore, no event of event type A has occurred in communication device SW3. Therefore, the certainty calculation unit 43 calculates 0 as the numerator value corresponding to condition IF_1'.

[0162] The number of communication devices SW in which condition IF_2' can occur is four out of the five neighboring devices, excluding communication device SW6 with no device type. Therefore, the certainty calculation unit 43 calculates 4 as the denominator value corresponding to condition IF_2'. Furthermore, among the neighboring devices, there are three communication devices SW in which an event of event type B has occurred and which are other than communication devices with no device type: communication devices SW1, SW2, and SW5. Therefore, the certainty calculation unit 43 calculates 3 as the numerator value corresponding to condition IF_2'.

[0163] The number of communication devices SW where condition IF_3' can occur is two out of the five neighboring devices, excluding communication device SW4 of device type X and communication devices SW1 and SW2 of device type Y. Therefore, the certainty calculation unit 43 calculates 2 as the denominator value corresponding to condition IF_3'. Furthermore, among the neighboring devices, there are two communication devices SW where an event of event type C has occurred and which are other than device types X and Y: communication devices SW5 and SW6. Therefore, the certainty calculation unit 43 calculates 2 as the numerator value corresponding to condition IF_3'.

[0164] The number of communication devices SW where condition IF_4' can occur is two, communication devices SW1 and SW2 of device type Y, out of the five neighboring devices. Therefore, the certainty calculation unit 43 calculates 2 as the denominator value corresponding to condition IF_4'. Furthermore, among the neighboring devices, there are two communication devices SW where an event of event type D has occurred and which are of device type Y, communication devices SW1 and SW2. Therefore, the certainty calculation unit 43 calculates 2 as the numerator value corresponding to condition IF_4'.

[0165] As a result, the sum of the denominator values ​​is 1 + 4 + 2 + 2 = 9. The sum of the numerator values ​​is 0 + 3 + 2 + 2 = 7. As a result, the certainty factor calculation unit 43 calculates 7 / 9 as the certainty factor when communication device SW3 is selected.

[0166] <When Communication Device SW4 is Selected> When communication device SW4 is selected, it is assumed that the faulty device is communication device SW4. In this case, the adjacent devices are communication devices SW1, SW2, SW3, SW5, and SW6.

[0167] The number of communication devices SW in which condition IF_1' can occur is one, which is the same as the number of failed devices (i.e., communication device SW4). Therefore, the certainty calculation unit 43 calculates 1 as the denominator value corresponding to condition IF_1'. Furthermore, no event of event type A has occurred in communication device SW4. Therefore, the certainty calculation unit 43 calculates 0 as the numerator value corresponding to condition IF_1'.

[0168] The number of communication devices SW in which condition IF_2' can occur is four out of the five neighboring devices, excluding communication device SW6 with no device type. Therefore, the certainty calculation unit 43 calculates 4 as the denominator value corresponding to condition IF_2'. Furthermore, among the neighboring devices, there are four communication devices SW in which an event of event type B has occurred and which are other than communication devices with no device type: communication devices SW1, SW2, SW3, and SW5. Therefore, the certainty calculation unit 43 calculates 4 as the numerator value corresponding to condition IF_2'.

[0169] The number of communication devices SW where condition IF_3' can occur is two out of the five neighboring devices, excluding communication device SW3 of device type X and communication devices SW1 and SW2 of device type Y. Therefore, the certainty calculation unit 43 calculates 2 as the denominator value corresponding to condition IF_3'. Furthermore, among the neighboring devices, there are two communication devices SW where an event of event type C has occurred and which are other than device types X and Y: communication devices SW5 and SW6. Therefore, the certainty calculation unit 43 calculates 2 as the numerator value corresponding to condition IF_3'.

[0170] The number of communication devices SW where condition IF_4' can occur is two, communication devices SW1 and SW2 of device type Y, out of the five neighboring devices. Therefore, the certainty calculation unit 43 calculates 2 as the denominator value corresponding to condition IF_4'. Furthermore, among the neighboring devices, there are two communication devices SW where an event of event type D has occurred and which are of device type Y, communication devices SW1 and SW2. Therefore, the certainty calculation unit 43 calculates 2 as the numerator value corresponding to condition IF_4'.

[0171] As a result, the sum of the denominator values ​​is 1 + 4 + 2 + 2 = 9. The sum of the numerator values ​​is 0 + 4 + 2 + 2 = 8. As a result, the certainty factor calculation unit 43 calculates 8 / 9 as the certainty factor when communication device SW4 is selected.

[0172] <When Communication Device SW7 is Selected> When communication device SW7 is selected, it is assumed that the faulty device is communication device SW7. In this case, the adjacent device is communication device SW6.

[0173] The number of communication devices SW in which condition IF_1' can occur is one, which is the same as the number of failed devices (i.e., communication devices SW7). Therefore, the certainty calculation unit 43 calculates 1 as the denominator value corresponding to condition IF_1'. Furthermore, no event of event type A has occurred in communication device SW7. Therefore, the certainty calculation unit 43 calculates 0 as the numerator value corresponding to condition IF_1'.

[0174] Since the adjacent communication device SW5 is of device type Z, the condition IF_2' can occur. Therefore, the certainty factor calculation unit 43 calculates 1 as the denominator value corresponding to the condition IF_2'. Furthermore, an event of event type B has occurred in the adjacent communication device SW5. Therefore, the certainty factor calculation unit 43 calculates 1 as the numerator value corresponding to the condition IF_2'.

[0175] Since the adjacent communication device SW5 is of device type Z, the condition IF_3' can occur. Therefore, the certainty factor calculation unit 43 calculates 1 as the denominator value corresponding to the condition IF_3'. Furthermore, an event of event type C has occurred in the adjacent communication device SW5. Therefore, the certainty factor calculation unit 43 calculates 1 as the numerator value corresponding to the condition IF_3'.

[0176] The adjacent communication device SW5 is of device type Z, and therefore the condition IF_4' cannot occur. Therefore, the certainty factor calculation unit 43 calculates 0 as the denominator and numerator values ​​corresponding to the condition IF_4'.

[0177] As a result, the sum of the denominator values ​​is 1 + 1 + 1 + 0 = 3. The sum of the numerator values ​​is 0 + 1 + 1 + 0 = 2. As a result, the certainty factor calculation unit 43 calculates 2 / 3 as the certainty factor when communication device SW7 is selected.

[0178] From the above, it can be seen that the certainty factor is highest when communication device SW4 is selected in case 2. Therefore, the certainty factor calculation unit 43 estimates that the faulty device in case 2 is communication device SW4.

[0179] 3. Effects of the Embodiment According to the embodiment, the primary rule generation unit 32 generates a primary rule Rt based on the failure case DB 22, which contains a history of events occurring in a network NW composed of multiple communication devices SW. The primary rule Rt is an IF-THEN rule whose condition part includes a combination of multiple conditions and whose conclusion part includes the occurrence of a failure in the network. Each of the multiple conditions included in the primary rule Rt specifies an event type and whether the event occurred at the node where the failure occurred. The occurrence rate calculation unit 33 calculates the occurrence rate of each of the multiple conditions included in the condition part of the primary rule Rt for each device type of the multiple communication devices SW. The rule condition adjustment unit 34 generates a rule R by adjusting the condition part of the primary rule Rt based on the occurrence rate so that it specifies a restriction on the device type in which each of the multiple conditions occurs. This makes it possible to impose restrictions on the device type for the event-occurring device specified in the condition, in addition to information on whether the device is a faulty device or an adjacent device. Therefore, when calculating the certainty factor from a group of events, it is possible to exclude cases in which the event is unlikely to occur due to the characteristics of the device type. Therefore, the accuracy of estimating the faulty device can be improved, and the time required to correctly estimate the fault can be reduced.

[0180] Furthermore, the certainty factor calculation unit 43 calculates, for each of the plurality of communication devices SW, a certainty factor, which is the rate at which the plurality of conditions included in the rule R occur due to the group of events. The certainty factor calculation unit 43 estimates the communication device SW with the highest calculated certainty factor as the source of the failure. This makes it possible to improve the accuracy of estimating the faulty device and shorten the time required to correctly estimate the failure.

[0181] Furthermore, when there is both a first device type whose occurrence rate of the first condition among the multiple conditions included in the primary rule Rt is equal to or greater than a threshold and a second device type whose occurrence rate of the first condition is less than the threshold, the rule condition adjustment unit 34 adjusts the condition part of the primary rule Rt so as to specify that the device types in which the first condition occurs are restricted. When the number of first device types is smaller than the number of second device types, the rule condition adjustment unit 34 adjusts the condition part of the rule so as to specify that the first condition occurs in the first device type, and generates a rule R. When the number of first device types is greater than or equal to the number of second device types, the rule condition adjustment unit 34 adjusts the condition part of the rule so as to specify that the first condition occurs in device types other than the second device type. This makes it possible to generate a rule R in which the condition part is adjusted so as to exclude cases in which the event is likely not to occur due to the characteristics of the device type when calculating a certainty factor from a group of events. This improves the accuracy of the certainty factor calculation by the certainty factor calculation unit 43.

[0182] 4. Modifications, etc. Various modifications can be applied to the above-described embodiment.

[0183] In the above-described embodiment, when the number of device types whose incidence rate is equal to or greater than the threshold is smaller than the number of device types whose incidence rate is less than the threshold, the device types whose incidence rate is equal to or greater than the threshold are defined as specific device types. However, this is not limited to this. For example, when the number of device types whose incidence rate is equal to or greater than the threshold is equal to or less than the number of device types whose incidence rate is less than the threshold, the device types whose incidence rate is less than the threshold may be defined as specific device types. In this case, when the number of device types whose incidence rate is equal to or greater than the threshold is greater than the number of device types whose incidence rate is less than the threshold, the device types whose incidence rate is less than the threshold are defined as specific device types.

[0184] In the above-described embodiment, the case has been described in which the program that executes the overall processing including the rule generation processing and the certainty factor calculation processing is executed by the fault estimation device 3, but this is not limiting. For example, the program that executes the overall processing including the rule generation processing and the certainty factor calculation processing may be executed by computational resources on the cloud.

[0185] The present invention is not limited to the above-described embodiments, and various modifications can be made in the implementation stage without departing from the spirit of the invention. Furthermore, the embodiments may be implemented in appropriate combinations, in which case the combined effects can be obtained. Furthermore, the above-described embodiments include various inventions, and various inventions can be extracted by combining selected elements from the disclosed elements. For example, if the problem can be solved and the desired effect can be obtained even if some elements are deleted from all elements shown in the embodiments, the configuration from which these elements are deleted can be extracted as an invention.

[0186] DESCRIPTION OF SYMBOLS 1... Fault inference system 2... Monitoring device 3... Fault inference device 11... Control circuit 12... Communication module 13... User interface 14... Storage 15... Drive 16... Storage medium 21... Topology DB 22... Fault case DB 23... Rule generation function 24... Fault cause inference function 31... Acquisition unit 32... Primary rule generation unit 33... Occurrence rate calculation unit 34... Rule condition adjustment unit 41... Rule DB 42... Rule determination unit 43... Certainty factor calculation unit

Claims

1. A fault estimation device comprising: a generation unit that generates rules based on a history of events occurring in a topology consisting of a plurality of nodes, the rules including a combination of a plurality of conditions in a condition part and including the occurrence of a fault in the topology in a conclusion part; a calculation unit that calculates the occurrence rate of each of the plurality of conditions for each node type of the plurality of nodes; an adjustment unit that adjusts the condition part of the rules based on the occurrence rate so that a restriction is specified on the node type in which each of the plurality of conditions occurs; and an estimation unit that estimates the occurrence of the fault from a group of new events that have occurred in the topology based on the adjusted rules.

2. The fault estimation device according to claim 1, wherein the estimation unit calculates the rate at which a plurality of conditions included in the rule adjusted by the group of events occur for each of the plurality of nodes, and estimates the node with the highest calculated rate as the source of the fault.

3. The fault estimation device according to claim 1, wherein each of said plurality of conditions specifies an event type of said event and whether or not said event has occurred at a node where said fault has occurred.

4. The fault estimation device of claim 1, wherein the adjustment unit adjusts the condition portion of the rule so that, when there is both a first node type in which the occurrence rate of a first condition among the plurality of conditions is equal to or greater than a threshold value, and a second node type in which the occurrence rate of the first condition is less than the threshold value, the condition portion adjusts the condition portion of the rule so as to specify that the node types in which the first condition occurs are restricted.

5. The fault estimation device of claim 4, wherein the adjustment unit adjusts the condition part of the rule so as to specify that the first condition occurs in the first node type when the number of the first node types is smaller than the number of the second node types, and adjusts the condition part of the rule so as to specify that the first condition occurs in a node type other than the second node type when the number of the first node types is greater than or equal to the number of the second node types.

6. The fault estimating device according to claim 1, wherein the plurality of nodes are a plurality of communication devices, and the topology is a network formed by the plurality of communication devices.

7. A fault estimation method comprising: generating a rule including a combination of a plurality of conditions in a condition part and including the occurrence of a fault in the topology in a conclusion part based on a history of events occurring in a topology consisting of a plurality of nodes; calculating the occurrence rate of each of the plurality of conditions for each node type of the plurality of nodes; adjusting the condition part of the rule so that a restriction is specified for the node type in which each of the plurality of conditions occurs based on the occurrence rate; and estimating the occurrence of the fault from a group of new events occurring in the topology based on the adjusted rule.

8. A program for causing a computer to function as each unit of the fault estimation device according to any one of claims 1 to 6.