Alarm analysis device, alarm analysis method, and alarm analysis program

Abstract

An alarm analysis device 1 is provided with: a first processing unit 12 that classifies a plurality of sets of alarm information into a plurality of groups, and reduces the number of sets of alarm information classified into at least one of the plurality of groups; an estimation unit 13 that calculates the degrees of association between the sets of alarm information among the plurality of groups; and a determination unit 14 that, on the basis of the degrees of association between the sets of alarm information, determines an event group into which alarm information in the groups is to be classified, and classifies the alarm information in the groups into the determined event group.

Description

Alarm analysis device, alarm analysis method, and alarm analysis program

[0001] The present disclosure relates to an alarm analysis device, an alarm analysis method, and an alarm analysis program.

[0002] When a fault occurs in the network, the alarm information output from devices within the network is classified into event groups for each identical event (cause / phenomenon), and analysis is performed on an event group basis.

[0003] In particular, in the case of large-scale failures, thousands of alarms may be generated from devices within a specific area within a few minutes. In such situations, a technology is needed to classify the alarms within a few minutes so that analysis can begin early.

[0004] Therefore, there is a technology for determining an event group of alarm information using a Bayesian network model (Patent Document 1). In Patent Document 1, the characteristic that alarm information caused by the same event occurs at similar times and locations is utilized, and whether or not the alarm information is caused by the same event is determined probabilistically based on the parent-child relationships of the nodes in the Bayesian network model and the time information and location information of the alarm information.

[0005] WO2022 / 259307A1

[0006] In Patent Document 1, the degree of association between the alarm information to be judged and each piece of already judged alarm information is estimated and calculated, and the degree of association is compared with a threshold value. The magnitudes of the degrees of association are then compared to determine the event group of the alarm information to be judged.

[0007] However, in the event of a large-scale failure, the number of correlation estimation calculations and correlation comparison calculations increases sharply, which results in the classification of alarm information not being completed within the target time, resulting in delays in the initial response and an increase in the impact of the failure.

[0008] The present disclosure has been made in consideration of the above circumstances, and an object of the present disclosure is to provide a technology that can improve the time required to classify alarm information.

[0009] An alarm analysis device according to one aspect of the present disclosure includes a first processing unit that classifies a plurality of pieces of alarm information into a plurality of groups and reduces the number of pieces of alarm information classified into at least one of the plurality of groups; an estimation unit that calculates the degree of association between pieces of alarm information among the plurality of groups; and a determination unit that determines an event group into which the alarm information within the group is classified based on the degree of association between the pieces of alarm information, and classifies the alarm information within the group into the determined event group.

[0010] An alarm analysis method according to one aspect of the present disclosure is an alarm analysis method performed by an alarm analysis device, which classifies a plurality of pieces of alarm information into a plurality of groups, reduces the number of pieces of alarm information classified into at least one of the plurality of groups, calculates the relevance between pieces of alarm information among the plurality of groups, determines an event group into which the alarm information within the group is classified based on the relevance between the pieces of alarm information, and classifies the alarm information within the group into the determined event group.

[0011] An alarm analysis program according to an aspect of the present disclosure causes a computer to function as the alarm analysis device.

[0012] According to the present disclosure, a technique can be provided that can reduce the time required to classify alarm information.

[0013] FIG. 1 is a diagram showing the functional block configuration of an alarm analysis device. FIG. 2A is a diagram showing an image of the overall operation (overview) of the alarm analysis device. FIG. 2B is a diagram showing an image of the overall operation (overview) of the alarm analysis device. FIG. 2C is a diagram showing an image of the overall operation (overview) of the alarm analysis device. FIG. 3 is a diagram showing an example of alarm information. FIG. 4 is a diagram showing an example of categorizing alarm information by alarm type and an example of sorting in chronological order. FIG. 5 is a diagram showing an example of categorizing alarm information into time groups. FIG. 6 is a diagram showing an example of categorizing alarm information into location groups and an example of selecting representative alarm information. FIG. 7 is a diagram showing an example of domain knowledge. FIG. 8 is a diagram showing an image of calculating the relevance using representative alarm information. FIG. 9 is a diagram showing an image of calculating the relevance using all alarm information. FIG. 10A is a diagram showing the processing flow of the alarm analysis device. FIG. 10B is a diagram showing the processing flow of the alarm analysis device. FIG. 11 is a diagram showing the hardware configuration of the alarm analysis device.

[0014] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the description of the drawings, the same parts are designated by the same reference numerals and the description thereof will be omitted.

[0015] [Summary of the present disclosure] In the event of a large-scale failure, multiple pieces of alarm information are output from multiple devices that make up a network. At this time, there are multiple pieces of alarm information that are similar in time and location (see FIG. 3 of Patent Document 1). These multiple pieces of alarm information are simply the results of observing the same event from devices other than the failed device, so they can be treated as the same alarm information.

[0016] Therefore, the present disclosure adds a process of selecting representative warning information from warning information with the same and / or similar time and / or location before performing the relevance degree estimation calculation and relevance degree comparison calculation described in Patent Document 1. Furthermore, the present disclosure adds a process of applying an event group determined using the representative warning information to warning information other than the representative warning information after performing the relevance degree estimation calculation and relevance degree comparison calculation.

[0017] In this way, representative warning information is selected from warning information with the same and / or similar time and / or location (i.e., the number of warning information is reduced), which makes it possible to reduce the amount of calculation required for the estimation calculation of relevance and the comparison calculation of relevance performed in Patent Document 1. As a result, it is possible to shorten the time required for classifying warning information.

[0018] [Configuration of Alarm Analysis Device] FIG. 1 is a diagram showing the functional block configuration of an alarm analysis device 1 according to this embodiment.

[0019] The alarm analysis device 1 includes an acquisition unit 11, a first processing unit 12, an estimation unit 13, a judgment unit 14, a second processing unit 15, an alarm information DB 16, a model memory unit 17, and a configuration information DB 18.

[0020] The acquisition unit 11 has a function of acquiring a plurality of pieces of alarm information output from a plurality of devices within the network, and storing the plurality of pieces of alarm information in the alarm information DB 16 .

[0021] The first processing unit 12 functions before the estimation unit 13 and the determination unit 14. The first processing unit 12 has a function of classifying a plurality of pieces of warning information into a plurality of groups and reducing the number of pieces of warning information classified into at least one of the plurality of groups.

[0022] Specifically, the first processing unit 12 has the function of grouping multiple pieces of alarm information that have the same or similar time and / or location, and selecting representative alarm information from the alarm information in each group.

[0023] The estimation unit 13 has the function of using a Bayesian network model to estimate and calculate the degree of association between representative alarm information pieces using probabilistic inference, further utilizing the characteristic that alarm information pieces caused by the same event occur at similar times and locations.

[0024] The determination unit 14 has the function of comparing the relevance of the representative alarm information with a threshold value, and further comparing the magnitude of the relevance of the representative alarm information with each other, and based on the comparison results, determining the event group into which each representative alarm information is classified, and classifying each representative alarm information into the determined event group.

[0025] The second processing unit 15 functions after the estimation unit 13 and the determination unit 14. The second processing unit 15 has a function of referring to the grouping information performed by the first processing unit 12, and applying the event group determined for the representative alarm information to other alarm information in the same group as the representative alarm information.

[0026] The alarm information DB 16 has a function of storing and storing a plurality of pieces of alarm information in an alarm list, which includes, for example, an alarm identifier, a date and time, an alarm type, a location, and an alarm content.

[0027] The model storage unit 17 has a function of storing a Bayesian network model in advance. A Bayesian network model is a probabilistic model with a graph structure in which different alarm types (events) are represented by nodes and the dependencies between the nodes are connected by unidirectional arrows. Each node is provided with a conditional probability table (CPT).

[0028] The configuration information DB 18 has a function of storing configuration information in advance. The configuration information DB 18 stores, for example, a division time threshold for dividing a plurality of pieces of alarm information into certain time intervals.

[0029] In the functional block configuration of the alarm analysis device 1, the acquisition unit 11, estimation unit 13, judgment unit 14, alarm information DB 16, model storage unit 17, and configuration information DB 18 also have the functions described in detail in Patent Document 1.

[0030] The Bayesian network model is an example of a graphical model that describes causal relationships using probability. Any model that meets this definition may be used. Furthermore, such a graphical model is used to efficiently understand the parent-child relationships between multiple different alarm types, and if this efficiency is considered unnecessary, then the graphical model does not need to be used.

[0031] [Overall Operation of Alarm Analysis Device (Outline)] In this embodiment, alarm information is grouped in two stages.

[0032] As explained in the overview of this disclosure, the first step is to temporarily group warning information that is the same and / or similar in time and / or location using a lightweight algorithm, and select representative warning information from the warning information within the group (preprocessing).

[0033] For example, as shown in Figure 2A, if the Bayesian network model has a structure of "alarm type A → alarm type B → alarm type C," the first processing unit 12 groups, for each alarm type, alarm information that has the same or similar time and location, and selects one alarm information from each group as representative alarm information.

[0034] However, in the first stage, since it is sufficient to reduce the number of pieces of warning information, multiple pieces of representative warning information may be selected from one group, or the warning information may be grouped only by time or only by location.Furthermore, the warning information with the oldest time may be selected, or the warning information with the second or third oldest time may be selected.

[0035] Alternatively, instead of "selecting" representative warning information, new warning information may be "generated" or "calculated" using multiple pieces of warning information within the same group. For example, an average of the multiple pieces of warning information may be used, or some of the multiple pieces of warning information, or some of the information within one piece of warning information may be used.

[0036] In the second stage, the alarm information is grouped (main calculation) using a Bayesian network model, as described in Patent Document 1. However, while Patent Document 1 targets all of the multiple alarm information items for grouping, in this embodiment, only representative alarm information items are targeted for grouping.

[0037] 2B , the estimation unit 13 estimates and calculates the degree of association between the representative alarm information of the judgment target and each of the judged parent and child representative alarm information by probabilistic inference. Thereafter, the determination unit 14 compares the degree of association with a threshold, and further compares the magnitudes of the degrees of association with each other, and determines and classifies the event group into which the representative alarm information of the judgment target is classified based on the comparison result.

[0038] Thereafter, as shown in Figure 2C, the second processing unit 15 refers to the first stage grouping information and applies the event group determined for the representative alarm information to the non-representative alarm information in the same group as the representative alarm information (post-processing).

[0039] Specifically, the second processing unit 15 classifies all of the alarm information in the same group into the same event group by combining the alarm information other than the representative alarm information with the representative alarm information. For example, if the alarm identifiers of multiple pieces of alarm information in the same group are 5, 31, and 59, and the alarm identifier of the representative alarm information is 31, the second processing unit 15 links (associates) each piece of alarm information with the alarm identifiers 5 and 59 to the representative alarm information with the alarm identifier 31 and outputs it.

[0040] [Example of the first stage (preprocessing)] First, the first processing unit 12 reads out an alarm list from the alarm information DB 16 (Figure 3), and sorts the multiple alarm information items included in the alarm list in chronological order for each alarm type A, B, or C (Figure 4).

[0041] Next, the first processing unit 12 reads out the division time threshold from the configuration information DB 18, and for each of the alarm types A, B, and C, organizes the alarm information within the division time threshold in order from the oldest alarm information into the same time group ( FIG. 5 ). For example, if the division time threshold is "2 minutes," the first processing unit 12 organizes the alarm information included within every 2 minutes from the oldest alarm information into the same time group.

[0042] Next, the first processing unit 12 groups together pieces of alarm information having the same or similar locations into the same location group for each alarm type A, B, or C (FIG. 6). At this time, when grouping pieces of alarm information having similar locations into the same location group, the first processing unit 12 uses domain knowledge related to the network (FIG. 7).

[0043] Domain knowledge includes, for example, connection information between devices within a network, the name of the regional block to which the device belongs, and device configuration information. For example, if the location of the alarm information being processed is "Ikebukuro," it is assumed that the alarm information will spread within the same block as Ikebukuro, and alarm information located in "Saitama" or "Kofu" is considered to be similar alarm information. It is also assumed that the alarm information will spread to other blocks connected to the device in "Ikebukuro," and alarm information located in "Niigata" is also considered to be similar alarm information.

[0044] In this way, since location groups are grouped based on domain knowledge, it is possible to efficiently group alarm information. Note that the similarity of locations may be determined not only based on physical connection relationships, but also based on logical connection relationships or group relationships that are thought to have an impact on alarm information.

[0045] Finally, the first processing unit 12 selects the alarm information with the oldest time as the representative alarm information for each location group (FIG. 6).

[0046] In the first stage (pre-processing) described above, a new alarm list consisting of only representative alarm information including all alarm types A, B, and C is generated.

[0047] [Specific Example of Second Stage (Main Calculation)] Here, a case will be described in which a plurality of representative event groups of alarm information have been determined and classified in advance, and an event group of representative alarm information of alarm type B is determined.

[0048] First, based on the Bayesian network model, the estimation unit 13 grasps the parent and child representative alarm information for the representative alarm information of alarm type B. Assume that the node of alarm type A is the parent and the node of alarm type C is the child. The estimation unit 13 estimates and calculates the degree of association between the representative alarm information of alarm type B and each of the representative alarm information of alarm type A (parent) and alarm type C (child) by probabilistic inference ( FIG. 8 ).

[0049] The above-mentioned estimation calculation of the relevance is performed for a set of parent representative alarm information and child representative alarm information. If the Bayesian network model has a structure of "alarm type A → alarm type B → alarm type C", the closest parent is alarm type A and the closest child is alarm type C. When the alarm type of the representative alarm information to be judged is alarm type B, the alarm information of alarm type A and alarm type C is compared with this representative alarm information.

[0050] The estimation unit 13 compares elements such as the alarm type, time difference, and location difference to determine the state S between the representative alarm information. For example, as shown in the first line of the list in Fig. 8 , the estimation unit 13 determines the state S1 between the representative parent 1 (alarm type A) and the representative alarm information to be determined (alarm type B), which is "alarm type: representative parent A, representative child B, time difference: less than 10 seconds, location difference: same device."

[0051] Similarly, the estimation unit 13 determines a state S2 between the representative child A (alarm type C) in the first row and the representative alarm information to be judged (alarm type B), which is "alarm type: representative parent B, representative child C, time difference: 10 seconds or more but less than -120 seconds, location difference: device match."

[0052] Thereafter, the estimation unit 13 calculates the degree of association f(S1, S2) between the state S1 and the state S2 as a numerical value based on the conditional probability table (CPT) of the Bayesian network model.

[0053] The conditions for the state S are determined in advance. The number of states is determined by "the number of alarm type conditions x the number of time difference conditions x the number of location difference conditions." For example, since there are three alarm types, A, B, and C, there are two states: "Parent A Child B" and "Parent B Child C." The time difference has four levels, for example, "less than 10 seconds," "10 seconds or more but less than -120 seconds," "120 seconds or more but less than -600 seconds," and "600 seconds or more." The location difference has three levels, for example, "no match," "area match," and "device match." In this case, one state S has 24 states (= 2 x 4 x 3). The time and location divisions can be arbitrarily determined.

[0054] Next, the determination unit 14 compares each relevance level with a predetermined threshold value. If the relevance level is equal to or greater than the threshold value, the determination unit 14 determines that the event group to which the representative warning information of the parent or child related to that relevance level is classified is the event group of the representative warning information of the warning type B being determined.

[0055] If there is no relevance degree equal to or greater than the threshold, the determination unit 14 generates a new event group and determines the new event group as the event group of the representative warning information of the target warning type B. The determination unit 14 may compare the magnitudes of the relevance degrees, and determine the event group into which the representative parent or child warning information with the greatest relevance degree is classified as the event group of the representative warning information of the target warning type B.

[0056] The method for determining the event group is not limited to the above example and may be any method.

[0057] As described above, in the example shown in Fig. 8, since there are two pieces of representative parent alarm information and two pieces of representative child alarm information, the number of possible estimation calculations of the relevance is four (= 2 x 2). On the other hand, in the same example, in the case of Patent Document 1, as shown in Fig. 9, since no representative alarm information is selected and there are three pieces of parent alarm information and four pieces of child alarm information, the number of possible estimation calculations of the relevance is 12 (= 3 x 4).

[0058] In this manner, in this embodiment, representative alarm information is selected (that is, the number of pieces of alarm information is reduced), so the amount of calculation required for the subsequent estimation calculation of the relevance degree and the comparison calculation of the relevance degree can be reduced.

[0059] [Overall Operation of Alarm Analysis Device (Details)] FIGS. 10A and 10B are diagrams showing the processing flow of the alarm analysis device 1. FIG.

[0060] First, the acquisition unit 11 acquires a plurality of pieces of alarm information output from a plurality of devices within the network (step S1).

[0061] Next, the first processing unit 12 acquires a Bayesian network model from the model storage unit 17, and regards the plurality of pieces of alarm information as nodes (alarm types) of the Bayesian network model (step S2).

[0062] Next, the first processing unit 12 classifies the plurality of pieces of alarm information for each alarm type of the Bayesian network model (step S3).

[0063] Next, the first processing unit 12 acquires the separation time threshold value from the configuration information DB 18 (step S4).

[0064] Next, the first processing unit 12 sorts the plurality of pieces of alarm information of the same alarm type in chronological order (step S5). Steps S5 to S9 are executed for each alarm type.

[0065] Next, the first processing unit 12 assigns the alarm information within the division time threshold from the oldest alarm information to the same time group (step S6). The first processing unit 12 repeats this process until all the alarm information belongs to any one of the time groups.

[0066] Next, the first processing unit 12 assigns, to the same location group, the alarm information with the oldest time in the same time group (step S7), and also assigns to the same location group the alarm information with connections between locations based on the domain knowledge (step S8). The first processing unit 12 repeats this process until all the alarm information belongs to any location group.

[0067] Next, the first processing unit 12 selects, for example, the oldest alarm information from the alarm information in the location group as representative alarm information (step S9). The first processing unit 12 repeats this process for each location group.

[0068] Next, the estimation unit 13 and the determination unit 14 use the representative warning information to perform an estimation calculation of the relevance and a comparison calculation of the relevance, determine the event group of the representative warning information, and classify the representative warning information into the determined event group (step S10).

[0069] Finally, the second processing unit 15 refers to the grouping information performed in step S3 and groups non-representative alarm information within the same location group as the representative alarm information into the same event group as the event group determined for the representative alarm information (step S11).

[0070] [Effect] As described above, according to this embodiment, a plurality of pieces of warning information are classified into a plurality of groups, and the number of pieces of warning information classified into at least one of the plurality of groups is reduced, so that it is possible to reduce the amount of calculation required for the estimation calculation of relevance and the comparison calculation of relevance, which were performed in Patent Document 1. As a result, it is possible to shorten the time required for classifying the warning information.

[0071] [Others] The present disclosure is not limited to the above-described embodiments, and various modifications are possible within the scope of the gist of the present disclosure.

[0072] The alarm analysis device 1 of the present embodiment described above can be realized, for example, by using a general-purpose computer system including a CPU 901, a memory 902, a storage 903, a communication device 904, an input device 905, and an output device 906, as shown in Fig. 11. The memory 902 and the storage 903 are storage devices. In this computer system, the CPU 901 executes a predetermined program loaded onto the memory 902, thereby realizing each function of the alarm analysis device 1.

[0073] The alarm analysis device 1 may be implemented by one computer. The alarm analysis device 1 may be implemented by multiple computers. The alarm analysis device 1 may be a virtual machine or a container implemented on a computer.

[0074] The program for the alarm analysis device 1 can be stored in a computer-readable recording medium such as a HDD, SSD, USB memory, CD (Compact Disc), DVD, etc. The computer-readable recording medium is, for example, a non-transitory recording medium. The program for the alarm analysis device 1 can also be distributed via a communication network.

[0075] REFERENCE SIGNS LIST 1 Alarm analysis device 11 Acquisition unit 12 First processing unit 13 Estimation unit 14 Determination unit 15 Second processing unit 16 Alarm information DB 17 Model storage unit 18 Configuration information DB 901 CPU 902 Memory 903 Storage 904 Communication device 905 Input device 906 Output device

Claims

1. An alarm analysis device comprising: a first processing unit that classifies a plurality of pieces of alarm information into a plurality of groups and reduces the number of pieces of alarm information classified into at least one of the plurality of groups; an estimation unit that calculates the degree of association between pieces of alarm information among the plurality of groups; and a determination unit that determines an event group into which the alarm information within the group is classified based on the degree of association between the pieces of alarm information, and classifies the alarm information within the group into the determined event group.

2. The alarm analysis device of claim 1, further comprising a second processing unit that applies the event group determined for the alarm information that was not deleted to the alarm information that was deleted in the same group as the alarm information that was not deleted.

3. An alarm analysis method performed by an alarm analysis device, which classifies a plurality of pieces of alarm information into a plurality of groups, reduces the number of pieces of alarm information classified into at least one of the plurality of groups, calculates the degree of association between the pieces of alarm information among the plurality of groups, determines an event group into which the alarm information within the group is classified based on the degree of association between the pieces of alarm information, and classifies the alarm information within the group into the determined event group.

4. An alarm analysis program that causes a computer to function as the alarm analysis device according to claim 1 or 2.

Images