Rule generation device, rule generation method, and program

Abstract

A rule generation device according to an embodiment of the present invention comprises: a calculation unit that calculates the maximum value of the number of event information items that constitute a combination pattern such that the total number of combination patterns of the event information items extracted from a plurality of the event information items related to a topology does not exceed a threshold value; an extraction unit that extracts a list of the combination patterns from the plurality of event information items on the basis of the maximum value; and a generation unit that generates a rule related to detection of the state of the topology from the extracted list.

Description

Rule generation device, rule generation method, and program

[0001] The embodiments relate to a rule generation device, a rule generation method, and a program.

[0002] Fault detection technology is known for detecting the cause and location of faults that occur on a network. In fault detection technology, an alarm generated when a fault occurs is used to detect the fault.

[0003] For example, a technique has been proposed that automatically generates a combination of alarms to be generated as a fault detection rule based on a rule that takes into account the adjacency relationships of communication devices on a network.

[0004] JP 2018-28778 A

[0005] Shunsuke Kanai, Fumika Asai, Naomi Murata, Kazuaki Akashi, Satoshi Suzuki, Kenichi Tayama, Hiroyuki Nakamura, “Network Fault Location Learning Process Using Machine Learning,” IEICE Transactions on Information and Communication Engineers, Vol. J104-B, No. 3, pp. 163-174, 2021, doi: 10.14923 / transcomj.2020AIP0002

[0006] However, when generating fault detection rules from all alarms in the vicinity of a communication device where a fault has occurred, the number of alarm combination patterns that must be considered increases explosively, raising concerns that generating fault detection rules would require a massive amount of calculation.

[0007] The present invention has been made in light of the above circumstances, and its object is to provide a means for generating rules for detecting faults while suppressing an increase in the amount of calculation.

[0008] One aspect of the rule generation device includes a calculation unit that calculates the maximum number of event information items constituting a combination pattern so that the total number of combination patterns of event information extracted from a plurality of event information items related to a topology does not exceed a threshold value; an extraction unit that extracts a list of the combination patterns from the plurality of event information items based on the maximum value; and a generation unit that generates rules for detecting the state of the topology from the extracted list.

[0009] According to the embodiment, it is possible to provide a means for generating rules for detecting a fault while suppressing an increase in the amount of calculation.

[0010] Fig. 1 is a block diagram showing an example of a fault detection system and a network according to an embodiment. Fig. 2 is a block diagram showing an example of a hardware configuration of a rule generation device according to an embodiment. Fig. 3 is a block diagram showing an example of a functional configuration of a rule generation device according to an embodiment. Fig. 4 is a flowchart showing an example of a rule generation process in the rule generation device according to an embodiment.

[0011] Hereinafter, embodiments will be described with reference to the drawings. In the following description, components having the same functions and configurations will be denoted by the same reference numerals.

[0012] 1. Configuration 1.1 Fault Detection System FIG. 1 is a block diagram showing an example of a fault detection system and a network according to an embodiment.

[0013] The fault detection system 1 is, for example, a system that monitors a network NW. The fault detection system 1 has a function of detecting alarms that occur in the network NW. The network NW is composed of multiple communication devices SW that have arbitrary connection relationships with each other. The fault detection system 1 stores an alarm DB 2. The fault detection system 1 includes a rule generation device 3 and a fault detection device 4.

[0014] The alarm DB2 is a past history of information (alarm information) including alerts generated in the network NW in the past. The alarm information includes information indicating the type of alarm, the time the alarm occurred, and the communication device SW that generated the alarm. In other words, the alarm DB2 comprehensively stores, for example, what alarm was generated in the network NW, when, and by which communication device SW as alarm information. The alarm DB2 further includes information indicating what type of failure occurred in which communication device SW. Hereinafter, alarm information may also be simply referred to as an "alarm."

[0015] The rule generation device 3 is, for example, a computer such as a server. The rule generation device 3 is configured to generate fault detection rules used to detect the location (source) and cause of a fault that has occurred in the network NW, based on the alarm DB 2. The fault detection rules are, for example, information that associates the type of fault with the source of the fault and a combination of multiple types of alarms that are generated in surrounding communication devices SW. In other words, the rule generation device 3 uses the alarm DB 2 to estimate, for each type of fault, the combination of multiple types of alarms that will be generated in response to the fault, and inputs the estimated results to the fault detection device 4 as a fault detection rule.

[0016] The fault detection device 4 is, for example, a computer such as a server. When a fault occurs in the network NW, alarm information generated in response to the fault is input to the fault detection device 4. When the alarm information is input, the fault detection device 4 is configured to detect the location (source) and cause of the fault that occurred in the network NW based on the fault detection rule input from the rule generation device 3. The fault detection device 4 outputs the detection result to the user as fault information.

[0017] 1.2 Hardware Configuration of the Rule Generation Device FIG. 2 is a block diagram showing an example of the hardware configuration of the rule generation device according to the embodiment.

[0018] As shown in FIG. 2, the rule generation device 3 includes a control circuit 11 , a communication module 12 , a user interface 13 , a storage 14 , a drive 15 , and a storage medium 16 .

[0019] The control circuit 11 is a circuit that provides overall control of the components of the rule generation device 3. The control circuit 11 includes a CPU (Central Processing Unit), RAM (Random Access Memory), and ROM (Read Only Memory). The ROM of the control circuit 11 stores programs and the like used in various processes in the rule generation device 3. The CPU of the control circuit 11 controls the entire rule generation device 3 in accordance with the programs stored in the ROM of the control circuit 11. The RAM of the control circuit 11 is used as a work area for the CPU of the control circuit 11.

[0020] The communication module 12 is a circuit used for communicating data within the failure detection system 1 .

[0021] The user interface 13 is an interface that manages communication between a user and the control circuit 11. The user interface 13 includes input devices and output devices. The input devices include, for example, a keyboard, a touch panel, and operation buttons. The output devices include, for example, an LCD (Liquid Crystal Display) or an EL (Electroluminescence) display. The user interface 13 converts input from the user into an electrical signal and then transmits it to the control circuit 11. The user interface 13 outputs the execution result based on the user input to the user.

[0022] The storage 14 includes, for example, a hard disk drive (HDD) or a solid state drive (SSD). The storage 14 stores information used in various processes in the rule generation device 3.

[0023] The drive 15 is a device for reading software stored in the storage medium 16. The drive 15 includes, for example, a CD (Compact Disk) drive and a DVD (Digital Versatile Disk) drive.

[0024] The storage medium 16 is a medium that stores software electrically, magnetically, optically, mechanically, or chemically. The storage medium 16 may store programs for executing various processes in the rule generation device 3.

[0025] 3 is a block diagram showing an example of the functional configuration of the rule generation device according to the embodiment. The CPU of the control circuit 11 loads a program stored in the ROM of the control circuit 11 or the storage medium 16 into the RAM of the control circuit 11. The CPU of the control circuit 11 then interprets and executes the program loaded into the RAM of the control circuit 11. As a result, the rule generation device 3 functions as a computer including a pattern count upper limit acquisition unit 21, a candidate alarm acquisition unit 22, a pattern list generation unit 23, and a rule generation unit 24.

[0026] The pattern number upper limit value acquisition unit 21 acquires the pattern number upper limit value Z based on, for example, constraint conditions input by the user. The pattern number upper limit value Z is a constant used in the process of generating fault detection rules (hereinafter referred to as the "rule generation process"). The pattern number upper limit value Z is, for example, the upper limit of the number of alarm combination patterns that are taken into consideration when the rule generation device 3 generates fault detection rules. Possible constraint conditions include, for example, the upper limit of the time required to generate fault detection rules and the processing speed of the rule generation device 3. The pattern number upper limit value acquisition unit 21 inputs the acquired pattern number upper limit value Z to the pattern list generation unit 23.

[0027] The candidate alarm acquisition unit 22 acquires n candidate alarms to be used in the rule generation process from the alarm DB 2. The candidate alarms are candidates for alarm information that constitute combinations in the fault detection rule. Therefore, the n candidate alarms include alarm information that is highly relevant to the fault and alarm information that is less relevant to the fault. The candidate alarm acquisition unit 22 selects a certain fault and acquires, from the alarm DB 2, a group of alarm information that occurred in the source of the fault and in the surrounding communication equipment SW when the fault occurred, as candidate alarms related to the fault. The candidate alarm acquisition unit 22 inputs the acquired candidate alarms to the pattern list generation unit 23.

[0028] The pattern list generation unit 23 generates a list of alarm combination patterns (pattern list L) to be considered when generating fault detection rules, based on the upper limit value Z of the number of patterns and the n candidate alarms. Specifically, the pattern list generation unit 23 extracts X combination patterns from the n candidate alarms so that the total number X of extracted combination patterns does not exceed the upper limit value Z of the number of patterns. The pattern list generation unit 23 inputs the generated pattern list L to the rule generation unit 24.

[0029] More specifically, the pattern list generation unit 23 includes a combination element number calculation unit 23 a and a combination pattern extraction unit 23 b. When extracting combination patterns, the combination element number calculation unit 23 a determines the maximum value kmax of the number k of alarms constituting a combination. Then, the combination pattern extraction unit 23 b extracts X combination patterns from the n candidate alarms within a range that does not exceed the maximum value kmax of the number k.

[0030] The rule generation unit 24 extracts, as a fault detection rule, a combination pattern that is most highly relevant to the associated fault from among the X combination patterns based on the pattern list L input from the pattern list generation unit 23. The rule generation unit 24 inputs the extracted fault detection rule to the fault detection device 4.

[0031] 2. Operation Next, the operation of the rule generation device according to the embodiment will be described.

[0032] 2.1 Flowchart FIG. 4 is a flowchart showing an example of a rule generation process in the rule generation device according to the embodiment.

[0033] When the rule generation process is started (START), the pattern number upper limit acquisition unit 21 acquires the pattern number upper limit Z based on the constraints input by the user (S11).

[0034] The candidate alarm acquisition unit 22 acquires, as candidate alarms, alarms that occurred in the communication device SW at the source of a certain fault and in the surrounding area when the fault occurred, from the alarm DB 2 (S12). The number of candidate alarms is assumed to be n.

[0035] When the upper limit value Z of the number of patterns obtained in the process of S11 and the n candidate alarms obtained in the process of S12 are input, the combination element number calculation unit 23a initializes the variable k to a set value m (S13). The set value m is the minimum value set for the variable k and is an integer equal to or greater than 1.

[0036] The combination pattern extraction unit 23b selects k (=m) alarms from the n candidate alarms acquired in the process of S12. ｎ C ｋ A pattern list L is initialized with these combination patterns (S14).

[0037] The combination element number calculation unit 23a calculates the total number of patterns X in the pattern list L and the number of combinations ｎ C （ｋ＋１） It is determined whether the sum of these exceeds the upper limit Z of the number of patterns acquired in the process of S11 (S15).

[0038] The total number of patterns X in the pattern list L and the number of combinations ｎ C （ｋ＋１） If the sum of (k+1) and (k+1) is equal to or smaller than the upper limit Z of the number of patterns (S15; no), the combination pattern extraction unit 23b selects (k+1) alarms from the n candidate alarms acquired in the process of S11. ｎ C （ｋ＋１） combination patterns are extracted (S16).

[0039] The combination pattern extraction unit 23b extracts the combination pattern extracted in the process of S16. ｎ C （ｋ＋１） These combination patterns are added to the pattern list L (S17). As a result, the total number of patterns X in the pattern list L becomes ｎ C （ｋ＋１） The number increases.

[0040] After the process of S17, the combination element number calculation unit 23a increments the variable k (S18).

[0041] The combination element number calculation unit 23a determines whether the variable k incremented in the process of S18 exceeds a set value M (S19). The set value M is the maximum value set for the variable k and is an integer greater than the set value m.

[0042] The total number of patterns X in the pattern list L and the number of combinations ｎ C （ｋ＋１） If the sum of k and m exceeds the upper limit value Z of the number of patterns (S15; yes), or if the variable k exceeds the set value M (S19; yes), the combination element number calculation unit 23a applies the variable k as the maximum value kmax of the number of alarms constituting the combination pattern (S20). Then, the combination pattern extraction unit 23b inputs the pattern list L generated by the processes of S11 to S20 to the rule generation unit 24.

[0043] If the variable k is equal to or smaller than the set value M (S19; no), the combination element number calculation unit 23a calculates the total number of patterns X in the pattern list L and the number of combinations ｎ C （ｋ＋１） In this way, it is determined whether the sum of the total number of patterns X and the number of combinations of the pattern list L exceeds the upper limit value Z of the number of patterns acquired in the process of S11 (S15). ｎ C （ｋ＋１） The processes of S15 to S19 are executed until the sum of exceeds the upper limit value Z of the number of patterns (S15; yes) or the variable k exceeds the set value M (S19; yes).

[0044] After the process of S20, the rule generating unit 24 extracts a fault detection rule based on the input pattern list L (S21).

[0045] When the process of S21 is completed, the rule generation process is completed (END).

[0046] 2.2 Specific Example Next, a specific example of extraction of the pattern list L by the rule generation process will be described.

[0047] In this specific example, as a specific example of a constraint, it is assumed that the rule generation unit 24 requires a maximum of 0.12 seconds to evaluate the association between one combination pattern and a fault. Also, it is assumed that the user requests that the rule generation unit 24 complete the process of extracting fault detection rules from the pattern list L within 10 minutes. In this case, the pattern count upper limit value acquisition unit 21 calculates the pattern count upper limit value Z as Z = 10 × 60 ÷ 0.12 = 5000.

[0048] Also, it is assumed that the candidate alarm acquisition unit 22 acquires n=30 alarms from the alarm DB 2 as candidate alarms that may be related to a certain fault.

[0049] When the initial value of the variable k is m=1, the combination pattern extraction unit 23b selects one alarm from 30 alarms. ３０ C １ The pattern list L is initialized with X=30 combination patterns. At this point, the total number of patterns X in the pattern list L is 30.

[0050] Next, the combination element number calculation unit 23a calculates the number of combinations in the first loop processing. ３０ C ２ Then, the combination element number calculation unit 23a calculates the total number of patterns X and the number of combinations ３０ C ２ The sum of (=435+30=465) is determined to be equal to or less than the upper limit value Z of the number of patterns. Therefore, the combination pattern extraction unit 23b selects two alarms from the 30 alarms. ３０ C ２ = 435 combination patterns are extracted and added to the pattern list L. As a result, the total number of patterns X in the pattern list L becomes 465. Then, the variable k is incremented to 2.

[0051] Next, the combination element number calculation unit 23a calculates the number of combinations in the second loop processing. ３０ C ３ Then, the combination element number calculation unit 23a calculates the total number of patterns X and the number of combinations ３０ C ３ The sum of (=465+4060=4525) is determined to be equal to or less than the upper limit value Z of the number of patterns. Therefore, the combination pattern extraction unit 23b selects three alarms from the 30 alarms. ３０ C ３ = 4060 combination patterns are extracted and added to the pattern list L. As a result, the total number of patterns X in the pattern list L becomes 4525. Thereafter, the variable k is incremented to 3.

[0052] Next, the combination element number calculation unit 23a calculates the number of combinations in the third loop processing. ３０ C４ Then, the combination element number calculation unit 23a calculates the total number of patterns X and the number of combinations ３０ C ４ The combination pattern extraction unit 23b determines that the sum (=4525+27405=31930) exceeds the upper limit value Z of the number of patterns. Therefore, the combination pattern extraction unit 23b applies the variable k (=3) to the maximum value kmax of the number of alarms constituting a combination pattern, and exits from the loop processing.

[0053] Thereafter, the pattern list generating unit 23 inputs the pattern list L including 4525 patterns to the rule generating unit 24 .

[0054] The rule generating unit 24 extracts the most appropriate pattern as a fault detection rule from the 4525 patterns included in the pattern list L as the fault detection rule.

[0055] By operating as described above, the rule generation unit 24 can extract fault detection rules from patterns whose number is equal to or less than the upper limit Z of the number of patterns = 5000. Therefore, fault detection rules can be extracted while satisfying the constraints imposed by the user.

[0056] 3. Effects of the Embodiment The processing time required to enumerate combination patterns of alarm information that are candidates for fault detection rules and to extract the optimal combination from among them increases in correlation with the total number of candidate alarm patterns. For example, if the processing time for each pattern is estimated as a constant time, the total processing time will be linearly related to the total number of patterns. Therefore, in order to keep the calculation amount of the rule generation process to a realistic level, it is considered effective to limit the total number of candidate alarm patterns.

[0057] Here, the number of candidate alarms is the total number of alarms that were occurring at the source of the failure and in the surrounding communication devices SW when the failure occurred. For this reason, it is difficult to reduce the processing time for rule generation processing by controlling the number of candidate alarms.

[0058] According to the embodiment, the combination element number calculation unit 23a calculates a maximum value kmax of the number of alarm information items constituting a combination pattern so that the total number X of combination patterns of alarm information items extracted from a plurality of alarm information items related to the network NW (i.e., candidate alarms) does not exceed the upper limit value Z of the number of patterns. The combination pattern extraction unit 23b extracts a pattern list L from the candidate alarms based on the calculated maximum value kmax. This allows the rule generation unit 24 to generate fault detection rules within a range that does not exceed the upper limit value Z of the number of patterns. Therefore, the rule generation unit 24 can generate fault detection rules within the time planned by the user. Therefore, it is possible to generate rules for detecting faults while suppressing an increase in the amount of calculation in the rule generation process.

[0059] Furthermore, the pattern list L includes all combination patterns in which the number of pieces of alarm information that make up the combination pattern is equal to or less than the maximum value kmax. This allows fault detection rules to be generated from as many combination patterns as possible within a range in which the processing time for the rule generation process satisfies the constraints. This allows the accuracy of fault detection rules to be further improved within a range in which the processing time for the rule generation process satisfies the constraints.

[0060] The alarm information also includes information about the type of alarm, the time of occurrence, and the communication device SW that caused the alarm. This allows the candidate alarm acquisition unit 22 to acquire, from the alarm DB 2, multiple alarms that were occurring when the failure occurred, as candidate alarms.

[0061] 4. Modifications, etc. Various modifications can be applied to the above-described embodiment.

[0062] In the above-described embodiment, a case has been described in which rules regarding faults in a network NW are generated from multiple pieces of alarm information related to the network NW, but this is not limited to this. For example, the rules may be rules for detecting any state, not limited to faults. In this case, the information used to generate the pattern list L from which the rules are extracted is not limited to alarm information, but may be any event information. Furthermore, the monitoring target that is the source of the event information is not limited to a network NW configured by multiple communication devices SW, but may be any topology configured by multiple nodes.

[0063] In the above-described embodiment, the case where the program that executes the overall processing including the rule generation processing is executed by the rule generation device 3 has been described, but this is not limiting. For example, the program that executes the overall processing including the rule generation processing may be executed by computational resources on the cloud.

[0064] The present invention is not limited to the above-described embodiments, and various modifications can be made in the implementation stage without departing from the spirit of the invention. Furthermore, the embodiments may be implemented in appropriate combinations, in which case the combined effects can be obtained. Furthermore, the above-described embodiments include various inventions, and various inventions can be extracted by combining selected elements from the disclosed elements. For example, if the problem can be solved and the desired effect can be obtained even if some elements are deleted from all elements shown in the embodiments, the configuration from which these elements are deleted can be extracted as an invention.

[0065] REFERENCE SIGNS LIST 1... Fault detection system 2... Alarm DB 3... Rule generation device 4... Fault detection device 11... Control circuit 12... Communication module 13... User interface 14... Storage 15... Drive 16... Storage medium 21... Pattern number upper limit value acquisition unit 22... Candidate alarm acquisition unit 23... Pattern list generation unit 23a... Combination element number calculation unit 23b... Combination pattern extraction unit 24... Rule generation unit

Claims

1. A rule generation device comprising: a calculation unit that calculates a maximum value of the number of event information constituting a combination pattern extracted from a plurality of event information related to a topology so that the total number of combination patterns of event information does not exceed a threshold; an extraction unit that extracts a list of the combination patterns from the plurality of event information based on the maximum value; and a generation unit that generates rules for detecting the state of the topology from the extracted list.

2. The rule generating device according to claim 1, wherein the list includes all combination patterns in which the number of pieces of event information constituting the combination pattern is equal to or less than the maximum value.

3. The rule generating device according to claim 1, further comprising an acquisition unit that acquires, as the plurality of event information, event information that has occurred in the topology when the state has occurred, from a history of event information related to the topology.

4. The rule generating device according to claim 1, wherein the event information includes information on the type of event, the time of occurrence, and the source of the event.

5. The rule generation device according to claim 1, wherein the topology includes a network made up of a plurality of communication devices, each of the plurality of event information includes alarm information occurring in the plurality of communication devices, and the state includes a state in which a fault has occurred in the plurality of communication devices.

6. A rule generation method comprising: calculating a maximum value of the number of event information constituting a combination pattern, so that a total number of combination patterns of event information extracted from a plurality of event information related to a topology does not exceed a threshold; extracting a list of the combination patterns from the plurality of event information based on the maximum value; and generating rules for detecting the state of the topology from the extracted list.

7. A program for causing a computer to function as each unit of the rule generating device according to any one of claims 1 to 5.

Images