Information processing device and information processing method

Abstract

In one embodiment, an information processing device (100) has a detection unit (121), a setting unit (122), a collection unit (123), a conversion unit (125), an aggregation unit (126), and a transmission unit (127). The detection unit (121) detects abnormalities at a target device. The setting unit (122) uses a machine learning model to set categories for information about the target device related to abnormalities detected by the detection unit (121). The collection unit (123) collects information about the state of the target device for the categories set by the setting unit (122). The conversion unit (125) converts the data format of the information collected by the collection unit (123) to a predetermined data format. The aggregation unit (126) aggregates the information converted by the conversion unit (125) at a predetermined time interval set when an abnormality at the target device has been detected. The transmission unit (127) transmits the information aggregated by the aggregation unit (126).

Description

Information processing device and information processing method

[0001] The present invention relates to an information processing device and an information processing method.

[0002] In carrier networks that provide a variety of communication services, the main network equipment required to deliver main signals from one point to another consists of devices at different layers, such as "transfer equipment" and "transmission equipment." Carrier networks are sometimes constructed using equipment from multiple vendors to reduce equipment procurement costs and ensure system redundancy.

[0003] When an incident occurs that affects communication services, it is necessary to quickly isolate the suspected section, including transfer equipment and transmission equipment. Also, even if a malfunction occurs that is not caused by the carrier network, users may request proof that the carrier network is normal.

[0004] Furthermore, in order to quickly isolate problems in carrier networks, provide evidence of normality, and manage connection configurations, it is important to collect device status information and performance information from multi-layer and multi-vendor network facilities.

[0005] Conventionally, Streaming Telemetry technology is known, which enables the transmission and reception of information at short time intervals, particularly of a few seconds to a few tens of seconds. This technology allows device status and performance information to be transmitted and stored in an external database or the like at short time intervals.

[0006] RFC9232 “Network Telemetry Framework”

[0007] However, the above-mentioned conventional technology may not be able to transmit device information at appropriate intervals depending on the external conditions. For example, the above-mentioned conventional technology transmits the same items of information at regular intervals regardless of the external conditions, such as whether or not a malfunction has occurred, so a large amount of data is transmitted even during normal operation, even when a malfunction has not occurred. As a result, the database capacity of the storage device that stores the transmitted data becomes strained.

[0008] In order to solve the above-mentioned problems and achieve the object, the information processing device of the present invention is characterized by having a detection unit that detects abnormalities in a target device, a setting unit that sets items of information about the target device related to the abnormality detected by the detection unit using a machine learning model, a collection unit that collects information about the state of the target device for the items set by the setting unit, a conversion unit that converts the data format of the information collected by the collection unit into a predetermined data format, an aggregation unit that aggregates the information converted by the conversion unit at a predetermined time interval that is set when an abnormality in the target device is detected, and a transmission unit that transmits the information aggregated by the aggregation unit.

[0009] According to the present invention, it is possible to transmit device information at appropriate time intervals in accordance with the external situation.

[0010] FIG. 1 is a diagram illustrating a problem associated with the prior art. FIG. 2 is a diagram illustrating an information processing system according to an embodiment. FIG. 3 is a diagram illustrating an example of the configuration of an information processing device according to an embodiment. FIG. 4 is a diagram illustrating an example of data stored in the information processing device according to an embodiment. FIG. 5 is a diagram illustrating a specific example of processing when an abnormality occurs in the information processing device according to an embodiment. FIG. 6 is a diagram illustrating a specific example of processing related to data format conversion according to an embodiment. FIG. 7 is a flowchart illustrating an example of the flow of information processing according to an embodiment. FIG. 8 is a diagram illustrating an example of a computer that executes an information processing program.

[0011] Hereinafter, embodiments of an information processing device and an information processing method according to the present application will be described in detail with reference to the accompanying drawings. However, the information processing device and the information processing method according to the present application are not limited to these embodiments.

[0012] [1. Introduction] (1-1. Overview of Prior Art) First, an overview of prior art in the technology for collecting device status and performance information of target devices according to this embodiment will be described. In carrier networks that provide a variety of communication services, it is important to collect device status information and performance information from multi-layer and multi-vendor network facilities in order to quickly isolate malfunctions, present evidence of normality, and manage connection configurations.

[0013] Therefore, a technique is known in which device status and performance information is acquired from various network elements (NE) and operation systems (OpS) and transmitted to an external database having an analysis APL that analyzes the acquired information. Here, an overview of the conventional technique and two problems will be described with reference to Fig. 1. Fig. 1 is a diagram illustrating the problems associated with the conventional technique.

[0014] As shown in Figure 1, the conventional technology transmits the device status and performance information of each of multiple NEs and OpSs to an external database called a "collector." This transmission process uses streaming telemetry technology, transmitting information at intervals of several seconds to several tens of seconds. However, because collected data is always transmitted at short intervals, the amount of data transmitted becomes enormous, posing a problem of straining the database capacity of the "collector," the transmission destination.

[0015] Furthermore, when collecting information using the aforementioned telemetry technology, three pieces of information are specified: "Data Model," "Encoding," and "Transport." "Data Model" indicates the data format of the output data, and examples include "RFC" and "Openconfig." "Encoding" indicates the format of the data to be sent, and examples include "xml" and "json." "Transport" indicates the protocol used to send data, and examples include "UDP" and "TCP."

[0016] As mentioned above, there are various types of information for "Data Model," "Encoding," and "Transport," and therefore each device often has a different information acquisition method. Therefore, the various information acquisition methods of each device must be made compatible with the analysis APL of the "collector," but this poses a problem of high compatibility costs.

[0017] (1-2. Overview of the information processing device according to this embodiment) The information processing device according to this embodiment was invented with the aim of solving the above-mentioned problems, and has the effect of being able to transmit device information according to the external situation at appropriate time intervals.

[0018] Next, an information processing system according to the present embodiment will be described. Fig. 1 is a diagram showing the information processing system according to the embodiment. The system shown in Fig. 1 includes an information processing device 100, a target device 200, and an external DB 300, and the information processing device 100 is connected to the target device 200 or the external DB 300 via a wired or wireless connection, and information is transmitted and received. Note that the system shown in Fig. 1 is an example, and the number of target devices 200 and external DBs 300 is not particularly limited.

[0019] The information processing device 100 is an information processing device that, for example, collects data related to device status and performance information from the target device 200, converts the data, aggregates it, and transmits the converted and aggregated data to the external DB 300, and is realized by a computer or the like. The information processing device 100 converts the data format of the collected data using a machine learning model, for example, and sets the data collection and aggregation interval, thereby transmitting data in an appropriate data format to the external DB 300 at appropriate time intervals.

[0020] The target device 200 is, for example, an information processing device such as a multi-layered network facility or an operation system that constitutes a carrier network, and is realized by a computer, etc. The target device 200 transmits, for example, data related to the device status and performance information to the information processing device 100 in an information acquisition format that the target device 200 has.

[0021] The external DB 300 is a storage device that stores data related to the device status and performance information of the target device 200 transmitted from the information processing device 100, and is realized by a server device or a cloud system. The external DB 300 has, for example, an analysis APL that analyzes data related to the device status and performance information, and performs analysis using data stored for a certain period of time.

[0022] The process performed by the information processing device 100 according to this embodiment will be described below. The information processing device 100 detects an abnormality in the target device 200 and sets information items related to the detected abnormality related to the target device 200 using a machine learning model. The information processing device 100 then collects information related to the state of the target device 200 for the set items and converts the data format of the collected information into a predetermined data format. The information processing device 100 then aggregates the converted information at a predetermined time interval that is set when an abnormality is detected, and transmits the aggregated information.

[0023] For example, the information processing device 100 detects an abnormality (fault) that has occurred in the target device 200 by acquiring an alarm from the target device 200 and analyzing collected data related to the device status and performance information of the target device 200. Then, the information processing device 100 uses a machine learning model that has been trained on the degree of association between the content of the abnormality in the target device 200 and the data related to the device status and performance information, and sets data items related to the device status and performance information of the target device 200 that are highly relevant to the content of the detected abnormality in a functional unit that collects and aggregates data.

[0024] The information processing device 100 then collects, for example, information on the device status and performance information for the set items from the target device 200. The information processing device 100 then converts the data format of the collected information into a preset openconfig format. The information processing device 100 then aggregates the information in the converted data format at a time interval that is preset as the processing content to be performed when an abnormality is detected, and transmits the aggregated data to the external DB 300.

[0025] This allows the information processing device 100 to transmit data on items related to the content of the abnormality at the time interval set for the abnormality when an abnormality is detected in the target device 200, thereby enabling the information processing device 100 to transmit device information at appropriate time intervals according to the external situation. As a result, the information processing device 100 can transmit data so that the amount of data transmitted during normal times is less than during abnormal times, thereby preventing the DB capacity of the external DB from becoming congested.

[0026] In addition, the information processing device 100 can convert the collected data format into a specified data format and send it to an external DB, so the data format of the data to be sent is unified, and the cost of processing to make it compatible with the data format of the analysis APL after transmission can be reduced.

[0027] 2. Configuration of Information Processing Device 100 Next, the configuration of the information processing device 100 shown in Fig. 2 will be described with reference to Fig. 3. Fig. 3 is a block diagram showing an example configuration of the information processing device according to the embodiment. The information processing device 100 has a communication unit 110, a control unit 120, and a storage unit 130, and the information processing device 100 is connected to each device via wire or wirelessly so that they can communicate with each other.

[0028] The communication unit 110 is realized by, for example, a network interface card (NIC), etc. The communication unit 110 is connected to the target device 200 and the external DB 300 by wired or wireless connection, and mediates the collection process of device status and performance information from the target device 200, and mediates the transmission process of converted and aggregated data to the external DB 300.

[0029] The storage unit 130 is realized by a storage device such as a RAM (Random Access Memory) or a hard disk, for example. The storage unit 130 stores data and programs necessary for various processes performed by the control unit 120. The storage unit 130 includes a collected information storage unit 131 and a machine learning model storage unit 132, which are closely related to the present invention.

[0030] The collected information storage unit 131 stores data indicating the device status and performance information of the target device 200, collected by the collection unit 123 described below. Here, the report information stored in the collected information storage unit 131 will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of data stored in the information processing device according to the embodiment.

[0031] As shown in FIG. 4, the collected information storage unit 131 stores, for example, "target device," "collection time," "IF_stat," "CPU_util," and "Memory_util." "Target device" stores the identification ID of the target device 200 from which data is collected, and "collection time" stores the time when the data was collected. "IF_stat" stores statistical information of the network interface of the target device 200. "CPU_util" stores the CPU usage rate of the target device 200, and "Memory_util" stores the memory usage rate of the target device 200.

[0032] It should be noted that "IF_stat", "CPU_util", and "Memory_util" shown in FIG. 4 are examples of data items indicating the device status and performance information of the target device 200, and the collected data is not limited to these data.

[0033] The machine learning model storage unit 132 stores machine learning models used by the setting unit 122 and the identification unit 124, which will be described later. For example, the machine learning model storage unit 132 stores a machine learning model that learns the details of an abnormality in the target device 200 and data indicating the device state and performance information when the abnormality occurs, and outputs data items related to the input of the details of the abnormality. Note that an algorithm such as random forest can be used for learning.

[0034] In addition, the machine learning model storage unit 132 stores a large-scale language model that learns, for example, an openconfig conversion source data model such as SNMP and an openconfig data model yang as natural languages, and outputs, in response to input of collected data such as SNMP (openconfig conversion source data), information to assist in setting conversion target keys and conversion destination keys used when converting fields in the data model of the input data into fields in the openconfig data model.

[0035] Returning to the explanation of Fig. 3, the control unit 120 is realized by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like executing various programs stored in a storage device within the device using RAM as a work area. The control unit 120 is also realized by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 120 includes a detection unit 121, a setting unit 122, a collection unit 123, an identification unit 124, a conversion unit 125, a counting unit 126, and a transmission unit 127.

[0036] The detection unit 121 detects an abnormality in the target device. For example, the detection unit 121 detects an abnormality and its details in the target device 200 by receiving an alarm from the target device 200, which is the target of data collection. Note that the method of abnormality detection by the detection unit 121 is not limited to receiving an alarm. For example, the detection unit 121 may detect an abnormality in the target device 200 by receiving information about the occurrence of an abnormality and its details directly input from outside by an operator or the like, or may detect an abnormality in the target device 200 by using a machine learning model to calculate the similarity between collected data and normal data.

[0037] The setting unit 122 uses a machine learning model to set information items about the target device 200 that are related to the abnormality detected by the detection unit 121. For example, the setting unit 122 uses a trained machine learning model stored in the machine learning model storage unit 132 to identify, as collection priority items, data items that indicate device status or performance information that are highly relevant to the content of the detected abnormality. Then, the setting unit 122 sets the identified collection priority items in the collection unit 123, which will be described later.

[0038] Furthermore, the setting unit 122 sets the collection interval of the collection unit 123 and the tallying interval of the calculation unit 126 depending on whether or not an abnormality has been detected by the detection unit 121. For example, when an abnormality has been detected by the detection unit 121, the setting unit 122 sets a collection interval and a tallying interval for the abnormality, which have been set in advance, to the collection unit 123 or the calculation unit 126, which will be described later. Note that, for example, when no abnormality has been detected, the setting unit 122 sets a collection interval and a tallying interval for the normality, which have been set in advance, to the collection unit 123 or the calculation unit 126, which will be described later, respectively, thereby enabling switching between the settings for the abnormality and the normality.

[0039] The collection unit 123 collects information on the status of the target device 200 for the items set by the setting unit 122. For example, the collection unit 123 collects data indicating the device status and performance information of the target device 200 for the collection priority items set by the setting unit 122, and stores the data in the collected information storage unit 131.

[0040] Furthermore, the collection unit 123 collects information at the collection interval set by the setting unit 122. For example, when an abnormality occurs in the target device 200, the collection unit 123 collects data indicating the device status and performance information of the target device 200 at the collection interval for abnormality set by the setting unit 122.

[0041] The processing of the collection unit 123 described above is the processing content when an abnormality occurs in the target device 200. However, when no abnormality occurs, the collection unit 123 collects data indicating the device status and performance information of the target device 200 using the collection items and collection intervals for normal times.

[0042] The identification unit 124 identifies the correspondence between each item in the data format of the information collected by the collection unit and each item in the openconfig format by using a large-scale language model. For example, the identification unit 124 uses a trained large-scale language model stored in the machine learning model storage unit 132 to acquire mapping information indicating the correspondence between each field in the collected data format, such as SNMP, and each field in the openconfig format to which the information is converted.

[0043] The converter 125 converts the data format of the information collected by the collector 123 into a predetermined data format. For example, the converter 125 converts the data format of the information collected by the collector 123 into the openconfig format based on the correspondence relationship identified by the identifier 124. For example, the converter 125 converts the data format of the data collected from the target device 200 into the openconfig format by referring to the mapping information acquired by the identifier 124 and specifying a conversion target key and a conversion destination key used for data format conversion. Note that the conversion destination data format of the converter 125 is not limited to openconfig, and the converter 125 can convert the data into any set data format.

[0044] The tallying unit 126 tally the information converted by the conversion unit 125 at a predetermined time interval that is set when an abnormality is detected in the target device 200. For example, the tallying unit 126 calculates a statistical representative value for the data whose data format has been converted by the conversion unit 125, or tally collected data at the tallying interval when an abnormality occurs. Note that the tallying unit 126 can function as a data buffer before tallying the converted data by storing the data before tallying in the collected information storage unit 131.

[0045] Furthermore, the tallying unit 126 tally information at the tallying interval set by the setting unit 122. For example, when an abnormality occurs in the target device 200, the tallying unit 126 tally data indicating the device status and performance information of the target device 200 at the tallying interval for abnormality set by the setting unit 122.

[0046] The transmitting unit 127 transmits the information collected by the aggregating unit 126. For example, the transmitting unit 127 transmits data indicating the device status and performance information of the target device 200, which has been collected at an abnormality collection interval, to the external DB 300. Note that, for example, when an abnormality occurs and more detailed information is required at short time intervals, the transmitting unit 127 can transmit the data, the data format of which has been converted, directly to the external DB 300 without going through the processing of the aggregating unit 126.

[0047] 3. Specific Example Here, referring to Fig. 5, a description will be given of changes in the process contents of the collection process and the aggregation process of device information by the information processing device 100 when an abnormality occurs. Fig. 5 is a diagram showing a specific example of the process when an abnormality occurs in the information processing device according to the embodiment. Fig. 5 shows an example in which each process is performed at a predetermined collection item, collection interval, and aggregation interval when normal or abnormal, and the aggregated data is sent to the external DB 300.

[0048] First, the processing performed before an abnormality occurs will be described. Before an abnormality occurs, the setting unit 122 sets the collection items "IF_stat", "CPU_util", and "Memory_util" for normal times, as well as the collection interval "1 min", the aggregation interval "15 min", and the aggregation method "mean" for normal times in the collection unit 123 or the aggregation unit 126. As a result, before an abnormality occurs, a series of processing steps are performed using the settings for normal times, and data from the target device 200 is sent to the external DB 300.

[0049] In addition, the information processing device 100 performs supervised machine learning using learning data that links the abnormality content with the data items to be collected for the machine learning model used to set the collection priority items corresponding to the abnormality content in the setting unit 122.

[0050] Next, a process performed when an abnormality occurs will be described. First, the detection unit 121 detects an abnormality by receiving an alarm from the target device 200. Then, the setting unit 122 uses a machine learning model to identify data items associated with the abnormality, and sets the identified data items and abnormality settings in the collection unit 123 or the aggregation unit 126, respectively.

[0051] Next, the collection unit 123 reads the set information and applies the data items "CPU_util" and "Memory_util" related to the abnormality details and the collection interval for abnormality times of "1 min." The aggregation unit 126 also reads the set information and applies the aggregation interval "1 min" and aggregation method "mean." As a result, the aggregation unit 126 aggregates the collection priority items related to the abnormality details at the aggregation interval for abnormality times. Thereafter, the transmission unit 127 transmits the aggregated data to the external DB 300. As a result, the external DB 300 stores device status data at 15-minute intervals during normal times and data at 1-minute intervals during abnormal times.

[0052] Through the series of processes described above, the information processing device 100 can change the information aggregation interval, such as every 15 minutes during normal operation and every 1 minute during abnormal operation, thereby changing the amount of data sent to the external DB 300. As a result, the amount of data sent during normal operation is reduced, preventing DB capacity from becoming overwhelmed. Furthermore, by narrowing down the data items to be collected to data items related to the abnormality, the information processing device 100 can reduce the amount of data sent and prevent DB capacity from becoming overwhelmed.

[0053] Next, a data format conversion process of collected data performed by the information processing device 100 will be described with reference to Fig. 6. Fig. 6 is a diagram showing a specific example of a process related to data format conversion according to an embodiment. Fig. 6 shows an example in which the data format of data collected from the target device 200 is converted to the openconfig format and transmitted to the external DB 300.

[0054] First, before the information processing device 100 performs the data collection process from the target device 200, it performs supervised machine learning using learning data that links data in the data format before conversion with data in the data format after conversion.

[0055] The collection unit 123 collects data indicating device status and performance information in a data format such as "SNMP" or "MIB" from the target device 200. Next, the identification unit 124 uses a machine learning model to obtain mapping information indicating the correspondence between fields in the data format of the collected data and fields in the openconfig format, which is the conversion destination, and notifies the conversion unit 125 of the mapping information.

[0056] Next, the conversion unit 125 refers to the notified mapping information and specifies the conversion target key and conversion destination key by config, thereby converting the data format of the collected data to openconfig format. The aggregation unit 126 then aggregates the data converted to openconfig format, and the transmission unit 127 transmits the aggregated data to the external DB 300. As a result, the external DB 300 can store data standardized in openconfig format.

[0057] Through the series of processes described above, the information processing device 100 can unify the data format sent to the external DB to the openconfig format, thereby reducing the cost of processing to make it compatible with the data format of the analysis APL after transmission.

[0058] 4. Example of Information Processing Next, the flow of processing by the information processing device 100 will be described with reference to FIG. 7. FIG. 7 is a flowchart showing an example of the flow of information processing according to the embodiment. Note that the steps in the flowchart shown in FIG. 7 may be executed in a different order, and some processing may be omitted. Note that the processing shown in FIG. 7 is processing content that is performed when an abnormality is detected in the target device 200. If no abnormality is detected, a series of processing from data collection to transmission is performed using settings for normal times.

[0059] The detection unit 121 detects an abnormality in the target device 200 (S101). If an abnormality in the target device 200 is detected (S101; Yes), the setting unit 122 sets a collection priority item corresponding to the detected abnormality in the collection unit 123 (S102). Note that if an abnormality in the target device 200 is not detected (S101; No), the information processing device 100 waits until an abnormality in the target device 200 is detected.

[0060] After the process of S102, the setting unit 122 sets the collection interval and tallying interval for abnormal situations in the collection unit 123 and the tallying unit 126, respectively (S103). Next, the collection unit 123 collects data of the target device for the collection priority items at the collection interval for abnormal situations (S104). Then, the identification unit 124 identifies mapping information indicating the correspondence between each item in the data format of the collected data and each item in the openconfig format (S105).

[0061] Next, the conversion unit 125 converts the data format of the collected data into the openconfig format by referring to the identified mapping information (S106). The aggregation unit 126 then aggregates the converted data at the aggregation interval for abnormal situations (S107). The transmission unit 127 then transmits the aggregated data to the external DB 300 (S108), and the information processing apparatus 100 ends the process.

[0062] 5. Effects of the embodiment As described above, the information processing device 100 according to the present embodiment includes the detection unit 121, the setting unit 122, the collection unit 123, the conversion unit 125, the aggregation unit 126, and the transmission unit 127. The detection unit 121 detects an abnormality in the target device 200. The setting unit 122 sets, using a machine learning model, information items about the target device 200 that are related to the abnormality detected by the detection unit 121.

[0063] The collection unit 123 collects information related to the state of the target device 200 for the items set by the setting unit 122. The conversion unit 125 converts the data format of the information collected by the collection unit 123 into a predetermined data format. The aggregation unit 126 aggregates the information converted by the conversion unit 125 at predetermined time intervals that are set when an abnormality in the target device 200 is detected. The transmission unit 127 transmits the information aggregated by the aggregation unit 126.

[0064] This allows the information processing device 100 to collect and aggregate data items corresponding to the detected abnormality using the abnormality settings, and therefore transmit device information according to the external situation at appropriate time intervals. As a result, the amount of data transmitted during normal times can be reduced compared to when an abnormality occurs, preventing the database capacity of the transmission destination from becoming congested.

[0065] The information processing device 100 also includes an identification unit 124. The identification unit 124 identifies, using a large-scale language model, a correspondence between each item of the data format of the information collected by the collection unit 123 and each item of the openconfig format. In this case, the conversion unit 125 converts the data format of the information collected by the collection unit 123 into the openconfig format based on the correspondence identified by the identification unit 124.

[0066] This allows the information processing device 100 to unify the data format of a wide variety of data formats acquired from various multi-layer and multi-vendor target devices 200 into the openconfig format and transmit it, thereby reducing the cost of converting the data format again on the destination device.

[0067] Furthermore, the setting unit 122 sets the collection interval of the collection unit 123 and the counting interval of the counting unit 126 depending on whether or not an abnormality has been detected by the detection unit 121. In this case, the collection unit 123 collects information at the collection interval set by the setting unit 122, and the counting unit 126 counts the information at the counting interval set by the setting unit 122.

[0068] This allows the information processing device 100 to set the data collection interval and aggregation interval depending on whether the state is normal or abnormal, so that the data transmission interval can be changed depending on whether an abnormality exists, such as by setting the data collection interval and aggregation interval longer during normal times to reduce the amount of data transmission, and by setting the data collection interval and aggregation interval shorter during abnormal times to transmit data in more detail.

[0069] [6. System Configuration, etc.] Of the processes described in the above embodiments, some of the processes described as being performed automatically can also be performed manually. Alternatively, all or some of the processes described as being performed manually can be performed automatically using known methods. In addition, the information including the processing procedures, specific names, various data, and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified. For example, the various information shown in each drawing is not limited to the information shown in the drawings.

[0070] Furthermore, the components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of the devices can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0071] 3 may be held in a storage server or the like, rather than being held by the information processing device 100. In this case, the information processing device 100 acquires various pieces of information by accessing the storage server.

[0072] 7. Hardware Configuration Fig. 8 is a diagram showing an example of a hardware configuration. The information processing apparatus 100 according to the embodiment described above is realized by a computer 1000 having a configuration as shown in Fig. 8, for example.

[0073] 8 is a diagram showing an example of a computer that executes an information processing program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0074] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0075] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define each process of the information processing device 100 are implemented as program modules 1093 in which code that can be executed by the computer 1000 is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configuration of the information processing device 100 are stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0076] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0077] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may instead be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN, WAN, etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0078] REFERENCE SIGNS LIST 100 Information processing device 110 Communication unit 120 Control unit 121 Detection unit 122 Setting unit 123 Collection unit 124 Identification unit 125 Conversion unit 126 Aggregation unit 127 Transmission unit 130 Storage unit 131 Collected information storage unit 132 Machine learning model storage unit 200 Target device 300 External DB

Claims

1. An information processing device comprising: a detection unit that detects an abnormality in a target device; a setting unit that sets information items about the target device related to the abnormality detected by the detection unit using a machine learning model; a collection unit that collects information about the state of the target device for the items set by the setting unit; a conversion unit that converts the data format of the information collected by the collection unit into a predetermined data format; an aggregation unit that aggregates the information converted by the conversion unit at a predetermined time interval that is set when an abnormality in the target device is detected; and a transmission unit that transmits the information aggregated by the aggregation unit.

2. An information processing device as described in claim 1, further comprising an identification unit that identifies the correspondence between each item of the data format of the information collected by the collection unit and each item of the openconfig format using a large-scale language model, and the conversion unit converts the data format of the information collected by the collection unit into the openconfig format based on the correspondence identified by the identification unit.

3. The information processing device described in claim 1, characterized in that the setting unit sets the collection interval of the collection unit and the aggregation interval of the aggregation unit depending on whether or not the detection unit detects an abnormality, the collection unit collects the information at the collection interval set by the setting unit, and the aggregation unit aggregates the information at the aggregation interval set by the setting unit.

4. An information processing method executed by an information processing device, comprising: a detection step of detecting an abnormality in a target device; a setting step of setting items of information about the target device related to the abnormality detected by the detection step using a machine learning model; a collection step of collecting information about the state of the target device for the items set by the setting step; a conversion step of converting the data format of the information collected by the collection step into a predetermined data format; an aggregation step of aggregating the information converted by the conversion step at a predetermined time interval set when an abnormality in the target device is detected; and a transmission step of transmitting the information aggregated by the aggregation step.

Images