Log processing device, log processing method, and program

Abstract

This log processing device comprises: a log collection unit that collects logs from a communication network; and a log processing unit that determines occurrence factors of the respective logs collected by the log collection unit, and inputs a plurality of logs having the same occurrence factor to an anomal location estimation unit.

Description

Log processing device, log processing method, and program

[0001] The present invention relates to a technique for estimating an abnormality in a communication network based on logs collected from the communication network.

[0002] For telecommunications carriers, it is important to understand the abnormal conditions and respond quickly to abnormalities that occur in communication networks. In this context, research is being conducted on early detection of abnormalities in communication networks and on estimating the location of abnormalities (Non-Patent Documents 1 and 2).

[0003] As a method for estimating the location of an anomaly, a method has been proposed in which a Bayesian network is used to model (called a causal model) the relationship between the location of an anomaly and the changes in data (called observed data) within the communication network that are caused by the anomaly, and the location of the anomaly is estimated from the observed data at the time of the anomaly (Non-Patent Document 3).

[0004] In Non-Patent Document 3, the normality / abnormality of a router is determined using up / down data of network links. Based on the expert knowledge, the normality / abnormality of a router is assumed to only affect the observation data of adjacent links, and a causal model is constructed using the adjacent relationships of the network topology.

[0005] Furthermore, Non-Patent Document 4 uses various logs in addition to those for link-down of physical counterpart devices to estimate the location of an anomaly in a communication network. For example, a device such as a router outputs different logs for each layer where an anomaly has occurred, such as a log indicating the status of the device (referred to as the device layer) including the CPU, memory, and interface module, a log indicating the status of the interface connection with the physically connected counterpart device (referred to as the physical layer), and a log indicating the status of the logically connected device (referred to as the logical layer). Using these logs, a causal model is created using the operator's knowledge for each event that could be the cause of the anomaly pattern or the generated log, and the location of the anomaly is estimated.

[0006] K. Tajiri, T. Iwata, Y. Matsuo and K. Watanabe, "Fault Detection of ICT systems with Deep Learning Model for Missing Data," 2021 IFIP / IEEE International Symposium on Integrated Network Management (IM), 2021, pp. 445-451. Y. Matsuo, Y. Nakano, A. Watanabe, K. Watanabe, K. Ishibashi, and K. Kawahara, "Root-cause diagnosis for rare failures using Bayesian network with dynamic modification," Proc. IEEE, ICC, 2018.Srikanth Kandula, Dina Katabi, and Jean-philippe Vasseur. Shrink: A tool for failure diagnosis in IP networks. Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data, pages 173-178, 2005.He Yan, Lee Breslau, Zihui Ge, Dan Massey, Dan Pei, and Jennifer Yates. G-RCA: A Generic Root Cause Analysis Platform for Service Quality Management in Large IP Networks. IEEE / ACM Transactions on Networking, 20(6):1734-1747, 2012.

[0007] Both Non-Patent Documents 3 and 4 estimate the location of an anomaly using a log at the time of failure occurrence. However, they do not assume that multiple failures will occur simultaneously, and are based on the assumption that when a failure occurs, only a log related to that failure will be generated.

[0008] However, in actual communication networks, multiple failures can occur simultaneously. Also, logs unrelated to the current failure may appear, such as logs periodically appearing in relation to past failures, logs generated by operations performed by customers who provide communication services, and logs generated by construction work being carried out at the same time.

[0009] As a result, the assumptions of the anomaly location estimation method do not hold true, which leads to issues such as an inability to estimate the location of simultaneous anomalies, or the estimated location being incorrect due to the influence of logs of past failures, resulting in a decrease in estimation accuracy.

[0010] The present invention has been made in view of the above points, and has an object to provide a technique for improving the accuracy of estimating an abnormality location in a communication network.

[0011] According to the disclosed technology, there is provided a log processing device including: a log collection unit that collects logs from a communication network; and a log processing unit that determines the cause of each log collected by the log collection unit and inputs multiple logs with the same cause to an abnormality location estimation unit.

[0012] The disclosed technology provides a technology for improving the accuracy of estimating an abnormality location in a communication network.

[0013] 5 is a diagram illustrating an example of the configuration of an abnormality location estimation device 100. FIG. 6 is a flowchart illustrating a processing procedure of the abnormality location estimation device 100. FIG. 7 is a diagram illustrating an example of the configuration of a log processing device 200. FIG. 8 is a diagram illustrating an example of the hardware configuration of the device. FIG. 9 is a diagram illustrating an example of a communication network. FIG. 10 is a diagram illustrating an example of a causal model based on FIG. 5.

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0015] (Outline of the embodiment) In this embodiment, it is assumed that when a failure occurs in a communication network, logs unrelated to the failure also appear. In such a situation, an anomaly point estimation device 100 (described later) labels each generated log to indicate which failure the log is related to, thereby improving the accuracy of estimating the anomaly point. Note that the "anomaly point" may also be called a "failure point" or "fault point," etc.

[0016] That is, in this embodiment, attention is paid to the natural law that logs are generated in a communication network due to some factor such as a failure, construction work, or user operation, and the anomaly point estimating device 100 assigns a label to each log indicating the factor that generated the log, and for each log having the same assigned label value, it estimates the anomaly point using an anomaly point estimating method. The device configuration and device operation in this embodiment will be described in detail below.

[0017] 1 shows an example of the configuration of an abnormality location estimation device 100 according to this embodiment. As shown in Fig. 1, the abnormality location estimation device 100 includes an observation data collection engine 160, an observation data DB 140, an observation data preprocessing engine 130, a causal model construction engine 110, a causal model inference engine 120, and an output interface 150 for users.

[0018] The observation data collection engine 160, the observation data preprocessing engine 130, the causal model construction engine 110, and the causal model inference engine 120 may also be referred to as the observation data collection unit 160, the observation data preprocessing unit 130, the causal model construction unit 110, and the causal model inference unit 120, respectively. Furthermore, the observation data collection engine 160, the observation data preprocessing engine 130, the causal model construction engine 110, and the causal model inference engine 120 may also be referred to as the observation data collection circuit 160, the observation data preprocessing circuit 130, the causal model construction circuit 110, and the causal model inference circuit 120, respectively.

[0019] The abnormality location estimation device 100 may also be called a log processing device. The observation data collection engine 160 and the observation data pre-processing engine 130 may also be called a log collection unit and a log processing unit, respectively. An overview of the operation of the abnormality location estimation device 100 will be described following the steps of the flow in FIG. 2.

[0020] In S101, the observation data collection engine 160 collects observation data (such as logs generated by devices) from a communication network. In S102, the observation data preprocessing engine 130 calculates the label y to which the generated log belongs. ｉ and find the set of logs with the same label (z ｊ ) for each event, a log is stored in the observation data DB 140. That is, a log is stored in the observation data DB 140 for each event that has the same cause of occurrence.

[0021] In this embodiment, there are three methods for the observation data collection engine 160 to determine labels, which will be described later, and the operator selects one of them in advance. Alternatively, two or three of the three methods may be selected, and the operator may check the labels assigned by each method and select the appropriate one.

[0022] The causal model construction engine 110 constructs a causal model using existing methods (such as those described in Non-Patent Documents 2, 3, and 4). In S103, the causal model inference engine 120 determines the value of the observation node based on the occurrence status of the log stored in the observation data DB 140, estimates the abnormality location, and outputs the estimated abnormality location to the output interface 150.

[0023] The output interface 150 displays to the user the location of an anomaly in the communication network, the maximum a posteriori probability at that time, etc. Furthermore, when a new machine is added to the operational system, the output interface 150 can add a node to the causal graph and also allow the user to correct any changes in the causal relationships that result from this.

[0024] The abnormality location estimating device 100 may be a single device (computer) or may be made up of multiple devices.

[0025] Furthermore, the functional unit that estimates an abnormality location using the log processed by the observation data preprocessing engine 130 may be called an "abnormality location estimation unit."

[0026] In the configuration of FIG. 1, the parts "observation data DB 140, observation data preprocessing engine 130, causal model construction engine 110, causal model inference engine 120, and output interface 150 to the user" correspond to the "anomaly location estimation unit."

[0027] In this embodiment, the abnormality location estimation unit uses a functional unit based on a method of estimating an abnormality location from observation data at the time of an abnormality using a causal model (Non-Patent Document 3), but the abnormality location estimation unit is not limited to one that uses this method.

[0028] Furthermore, the observation data collection engine 160 and the observation data pre-processing engine 130 may be configured as a single device, which may be called a log processing device.

[0029] Fig. 3 shows an example of the configuration of the log processing device 200. As shown in Fig. 3, the log collection device 200 includes a log collection unit 210 and a log processing unit 220. Fig. 3 also shows an abnormality location estimation unit 300.

[0030] The log collection unit 210 and the log processing unit 220 correspond to the observation data collection engine 160 and the observation data pre-processing engine 130, respectively. In FIG. 3 , the abnormality location estimation unit 300 is located outside the log collection device 200, but the abnormality location estimation unit 300 may be located inside the log collection device 200.

[0031] The log collection unit 210 collects logs from a communication network. The log processing unit 220 determines the cause of each log collected by the log collection unit 210 and inputs multiple logs with the same cause to the abnormality point estimation unit 300.

[0032] (Hardware Configuration Example) Any of the devices described in this specification (the anomaly location estimation device 100 and the log processing device 200) can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0033] That is, the device can be realized by executing a program corresponding to the processing performed by the device using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0034] Fig. 4 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 4 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected by a bus BS.

[0035] The program that realizes the processing on the computer is provided by a recording medium 1001, such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0036] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes functions related to the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like according to the program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0037] (Operation Example) The operation of the anomaly location estimation device 100 will be described in more detail below. Note that, although this embodiment is assumed to target a communication network configured with routers, this is merely an example. The technology according to the present invention is applicable regardless of the type of nodes that configure the communication network.

[0038] <Regarding the Causal Model> Before describing the preprocessing according to the technology of the present invention, first, the construction of the causal model based on Non-Patent Document 3 will be described.

[0039] 5 shows an example of a communication network from which the observation data collection engine 160 collects observation data. As shown in FIG. 5, this communication network is a network in which routers 1 to 6 are connected as shown. For example, routers 1 and 2 are directly connected and are adjacent to each other. Routers 1 and 4 are not directly connected and are not adjacent to each other.

[0040] The causal model construction engine 110 constructs the causal model shown in Fig. 6 for the communication network (physical layer network) shown in Fig. 5 based on the knowledge of an expert operator, etc. The causal model consists of device nodes representing the status of each device (router) in the communication network, and observation nodes representing whether a log (e.g., syslog related to link down) has been generated from that device. In other words, the observation nodes represent the observation results of each device. The causal model may also be called a Bayesian network.

[0041] For example, in the causal model of Fig. 6, Router 1, which is an equipment node, is connected to Routers 1 and 2, which are observation nodes. This indicates that if an abnormality occurs in Router 1, it may affect the observation data of Router 1 and the observation data of Router 2.

[0042] 6, for example, router 2, which is an equipment node, is connected to routers 1, 2, 3, and 6, which are observation nodes. This indicates that if an abnormality occurs in router 2, it may affect the observation data of routers 1, 2, 3, and 6.

[0043] <Detailed Description of the Observation Data Preprocessing Engine 130> As described above, this embodiment focuses on the natural law that logs are generated in communication networks due to some cause, such as a failure, construction work, or user operation. Therefore, the observation data preprocessing engine 130 assigns a label indicating the cause of the log to each log collected by the observation data collection engine 160, and stores the labeled logs in the observation data DB 140. The causal model inference engine 120 infers an anomaly location for each log with the same assigned label value. The operation of the observation data preprocessing engine 130 will be described in more detail below.

[0044] First, the logs generated between time t and t+τ are expressed as x １ , ..., x ＮHere, τ is the time width for executing the abnormality location estimation process, which is determined in advance by any method. If it is desired to obtain estimation results within one minute after the occurrence of a failure, τ is set to 30 seconds, for example. N is the number of logs that have occurred.

[0045] In the prior art, x １ , ..., x Ｎ was input to the abnormality location estimation unit and abnormality location processing was performed. １ , ..., x Ｎ If used as is, the estimation accuracy will decrease due to the problems described above.

[0046] Therefore, the observation data preprocessing engine 130 performs the following steps: ｉ For (i∈{1, ..., N}), a label y ｉ (i∈{1,...N}), and ｉ , y ｉ} Ｎ ｉ＝１ where y ｉ The value of is a positive integer between 1 and M, where M is given arbitrarily. ｉ represents the cause of the log occurrence, such as a failure occurring in the communication network, construction work, or a user-caused event, and M is the total number of types of such causes.

[0047] In the following, the label y ｉ Explain how to solve the problem if you can calculate the value of x ｉ for y ｉ We will explain how to calculate the value of and how to give M.

[0048] For example, y ｉ In the value of , 1 represents a log generated due to failure A, and 2 represents a log generated due to failure B. In this case, the log x generated from a certain time t to t+τ １ , ..., x ５ The observed data preprocessing engine 130 analyzes these logs and finds that the failure A has caused x １ , x ２ , x ４ occurs, and x occurs due to failure B ３ , x ５ If it is found that y has occurred, １, y ２ , y ４ are set to 1, and y ３ , y ５ Let each be 2.

[0049] Next, the observation data preprocessing engine 130 calculates z ｊ = {x ｉ |y ｉ =j, i∈1,...,N}. That is, y ｉ A set of logs z for which =j ｊ Ask for.

[0050] The observation data pre-processing engine 130 ｊ If is not an empty set, then z ｊ is input to the abnormality location estimation unit. ｉ The key is to input logs with the same value of , that is, logs with the same cause of the failure that generated the log, to the anomaly location estimation unit. This makes it possible to satisfy the assumption that the anomaly location estimation unit is premised on, that "only logs related to a certain failure are generated, and the failure location is estimated using that log as input," thereby improving the accuracy of estimating the anomaly location.

[0051] More specifically, the observation data pre-processing engine 130 calculates z ｊ If is not an empty set, then z ｊ are stored in the observation data DB 140. This means that the logs are stored in the observation data DB 140 for each log that has the same cause of failure that has occurred.

[0052] The observation data preprocessing engine 130 repeats the above process from j=1 to j=M, incrementing j by 1. For example, if z is a non-empty set, ｊ If the number of j for which log x is obtained is k, ｉ For a set of (iε1, . . . , N), the log is divided into k parts for each factor, and the abnormality location estimation method is performed for each of the k parts.

[0053] Next, the label y ｉThe method for determining the label is not limited to a specific method, but in this embodiment, the following three examples, determination method example 1 to 3, will be described. Note that the cause of the log generation may be determined by combining any two of determination method example 1 to 3, or by combining all of determination method example 1 to 3.

[0054] Determination Method Example 1: In Determination Method Example 1, it is assumed that the events that cause problems in a communication network and the resulting log generation patterns are known. In this case, the observation data preprocessing engine 130 sequentially creates rules (e.g., cause 1 causes log B to be generated by device A) using the known factors and the resulting log generation patterns, and assigns each rule a number from 1 to M.

[0055] Then, the observation data preprocessing engine 130 processes the generated log x ｉ When you get a log, check which rule it applies to and ｉ The value of M is determined to be a value representing the rule that applies. In this case, M may be set to the total number of rules.

[0056] Determination Method Example 2: In the determination method example 2, the observation data preprocessing engine 130 heuristically determines the log generation factor using external information that determines the log generation factor. ｉ Here, the observation data pre-processing engine 130 determines the value of y ｉ It is assumed that the external information required to determine the value of is available, for example periodically or as needed.

[0057] For example, if the observation data preprocessing engine 130 determines that construction work was being carried out within the communication network from time t to time t+τ, the log x ｉ It is highly likely that construction work is the cause, ｉ In addition, when the observation data preprocessing engine 130 determines that logs due to a fault C are constantly being generated, it sets a value representing the construction work in ｉ Label y for ｉ Let be a value representing the fault C.

[0058] The observation data preprocessing engine 130 also processes the log x ｉ When it is detected that ｉ The value of t is set to a value indicating a user-caused event. The other logs are determined to be logs caused by a failure that occurred between time t and time t+τ, and the label y ｉ The value of represents the fault.

[0059] As above, each log x ｉ For label y ｉ In this case, values ​​starting from 1 are assigned to the factors of construction, failure, and user operation that occurred in the past, and the value of M is increased as the number of factors increases.

[0060] Example Determination Method 3: In example determination method 3, the observation data pre-processing engine 130 uses an algorithm to determine label values ​​from the data.

[0061] The method (algorithm) for determining label values ​​from data is not limited to a specific method, but for example, a known method disclosed in Reference 1 (WO2022 / 259307A1) can be used. This method clusters alarms by their causes.

[0062] Based on this technique, the observation data preprocessing engine 130 clusters the logs generated between time t and t+τ, finds a cluster value indicating which cluster each log belongs to, and calculates the found cluster value as the y ｉ This allows a label to be assigned to the log for each factor. In this case, the maximum value of the cluster value can be used as the value of M. Note that a method other than the method disclosed in Reference 1 may be used as a method for classifying the factors of the log by clustering.

[0063] <Detailed Description of Causal Model Construction Engine 110 and Causal Model Inference Engine 120> In this embodiment, the processing itself by the causal model construction engine 110 and the causal model inference engine 120 is an existing technology. The method of constructing a causal model by the causal model construction engine 110 is as described with reference to Figures 5 and 6, and for example, a causal model is constructed from the physical (or logical) connection relationships of devices.

[0064] By the above-described process, the observed data DB 140 stores logs for each log in which the cause of a failure occurs. The causal model inference engine 120 stores the logs (y ｉ For each log (log with the same value of ), the abnormal location is inferred using a causal model. Specifically, the node values ​​are defined as follows:

[0065] The device node in the causal model of the system (communication network) that is the target of anomaly location estimation is a ｉ , the observation node is b ｉ , i∈(1,...N), where N is the number of devices.

[0066] each a ｉ takes on a value of 0 (normal state) or 1 (abnormal state). It is possible for it to take on multiple values ​​of three or more instead of just 0 or 1, in which case the minimum value is the normal state, the maximum value is the abnormal state, and a value c between them is defined as a value that indicates abnormality at the rate of "c / (maximum value - minimum value)".

[0067] each b ｉ takes on a value of 0 or 1, where 1 indicates that a log occurred at the i-th router. Note that instead of the binary values ​​of 0 or 1, it can also take on three or more values, in which case the value is defined as the number of log occurrences at the i-th router.

[0068] The input values ​​to the above causal model can be determined (calculated) by the causal model inference engine 120 from the logs read from the observation data DB 140 .

[0069] The inference using the causal model itself is the same as the method in Non-Patent Document 3, and the prior probability P(a ｉ) and the conditional probability P(b ｊ |a ｉ ) and make inferences.

[0070] (Effects of the Technology Relating to the Embodiments) As described above, the observation data preprocessing engine 130 assigns a label to each log indicating the cause of the log's occurrence, and the anomaly location estimation unit estimates the anomaly location for each log that has the same assigned label value. This can improve the accuracy of estimating anomalies within a communication network.

[0071] The following additional notes are provided regarding the above-described embodiments.

[0072] <Additional Notes> (Additional Item 1) A log processing device including a memory and at least one processor connected to the memory, wherein the processor collects logs from a communication network, determines a cause of occurrence of each collected log, and inputs multiple logs with the same cause of occurrence to an abnormality location estimation unit. (Additional Item 2) The log processing device according to Additional Item 1, wherein the processor assigns a label indicating the cause of occurrence to each collected log, and inputs multiple logs with the same value of the assigned label to the abnormality location estimation unit. (Additional Item 3) The log processing device according to Additional Item 1 or 2, wherein the processor determines the cause of occurrence of each log using rules based on an event that causes the log to occur and a pattern of log occurrence due to the event. (Additional Item 4) The log processing device according to Additional Item 1 or 2, wherein the processor determines the cause of occurrence of each log using external information related to the cause of the log. (Additional Item 5) The log processing device according to Additional Item 1 or 2, wherein the processor clusters the logs, finds a cluster value indicating to which cluster each log belongs, and finds the cause of occurrence of each log based on the found cluster value. (Supplementary Item 6) A log processing method executed by a log processing device, comprising: a log collection step of collecting logs from a communication network, and a log processing step of determining a cause of occurrence of each log collected by the log collection step and inputting multiple logs having the same cause of occurrence to an abnormality location estimation unit. (Supplementary Item 7) A non-transitory storage medium storing a program for causing a computer to function as the log collection unit and the log processing unit in the log processing device according to any one of Supplementary Items 1 to 5.

[0073] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0074] REFERENCE SIGNS LIST 100 Abnormality location estimation device 110 Causal model construction engine 120 Causal model inference engine 130 Observation data preprocessing engine 140 Observation data DB 150 Output interface 160 Observation data collection engine 200 Log collection device 210 Log collection unit 220 Log processing unit 300 Abnormality location estimation unit 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims

1. A log processing device comprising: a log collection unit that collects logs from a communication network; and a log processing unit that determines the cause of each log collected by the log collection unit and inputs multiple logs having the same cause to an abnormality location estimation unit.

2. The log processing device according to claim 1, wherein the log processing unit assigns a label indicating a cause of occurrence to each log collected by the log collection unit, and inputs multiple logs with the same assigned label value to the abnormality location estimation unit.

3. The log processing device according to claim 1, wherein the log processing section determines the cause of each log by using rules based on the event that causes the log to be generated and the pattern of the log generated by that event.

4. The log processing device according to claim 1, wherein the log processing unit determines the cause of each log by using external information related to the cause of the log.

5. The log processing device according to claim 1, wherein the log processing section clusters the logs, obtains a cluster value indicating which cluster each log belongs to, and determines the cause of each log based on the obtained cluster value.

6. A log processing method executed by a log processing device, comprising: a log collection step of collecting logs from a communication network; and a log processing step of determining the cause of each log collected by the log collection step, and inputting multiple logs with the same cause to an abnormality location estimation unit.

7. A program for causing a computer to function as a log collection unit and a log processing unit in the log processing device according to any one of claims 1 to 5.