Failure location estimation device and failure location estimation method

Abstract

A failure location estimation device according to the present invention has a rule learning control unit that defines a rule that indicates the relationship between alarms that characterize failures at a network and failure locations and a failure location estimation function unit that estimates failure locations using an alarm set that has been generated at the network and the rule. When the rule is defined, the rule learning control unit extracts a plurality of rule candidates, the failure location estimation function unit estimates failure locations using all of the plurality of rule candidates and calculates evaluation values for correct locations and evaluation values for incorrect locations, and the rule learning control unit calculates scores that include the evaluation values for correct locations and the evaluation values for incorrect locations calculated by the failure location estimation function unit and numbers of incorrect locations as parameters and uses the rule candidate that has the highest score to define the rule to be used for estimation of failure locations by the failure location estimation function unit.

Description

Fault Location Estimation Device and Fault Location Estimation Method

[0001] The present invention relates to a fault location estimation device and a fault location estimation method.

[0002] Various IT services are provided, and the maintenance and management of the network by telecommunications carriers are important.

[0003] When servers, transmission devices, etc. on the network necessary for providing services become unavailable due to failures or the like, alarms indicating abnormalities are generated from various locations such as network devices and servers providing services.

[0004] There is a technique for estimating the fault location from the alarms generated due to the occurrence of a fault on the network. A typical one is the technique using If-then rules. This is, for example, to define in advance If-then rules with "type of alarm" and "positional relationship between the fault location and the alarm generation location" as If conditions for each case of failure, and for each suspected fault location, present the operator with the evaluation value such as the ratio of satisfying the If conditions of the If-then rules, etc., to assist in specifying the fault location.

[0005] Also, for creating such If-then rules, experience and skills are required. Therefore, there is a technique for automatically generating rules by extracting unique combinations of the types of alarms that occur as If conditions for each case of failure (see, for example, Patent Document 1).

[0006] Japanese Patent No. 6637854

[0007] Conventionally, in estimating the fault location, there are cases where estimation results that make it difficult to specify the fault location, such as results where incorrect locations have an evaluation value as high as that of the correct location or results where the number of suspected locations of incorrect locations is large, are presented.

[0008] The reason for presenting such estimation results is that when defining rules to characterize failures, the system calculates the evaluation value of each suspected failure location when setting alarm sets that have many common elements with alarms occurring in the current failure case and few common elements with alarms occurring in different failure cases as the If conditions of the rule, and adopts the first alarm set that can be estimated as the correct location with the highest evaluation value as the If condition of the rule. In other words, only the evaluation value of the correct location is used as the evaluation value.

[0009] This invention has been made in view of the above circumstances, and its purpose is to provide a fault location estimation device and a fault location estimation method that present estimation results that facilitate the identification of fault locations.

[0010] One aspect of the present invention is a fault location estimation device for estimating the location of a fault in a network. The fault location estimation device comprises a rule learning control unit that defines rules indicating the relationship between alarms that characterize network faults and the location of the fault, and a fault location estimation function unit that estimates the location of the fault using a set of alarms generated from the network and the rules. When defining the rules, the rule learning control unit extracts a plurality of rule candidates, the fault location estimation function unit uses all of the plurality of rule candidates to estimate the location of the fault and calculates evaluation values ​​for correct locations and incorrect locations, the rule learning control unit calculates a score that includes the evaluation values ​​for correct locations and incorrect locations calculated by the fault location estimation function unit as parameters, and defines the rule used by the fault location estimation function unit to estimate the location of the fault using the rule candidate with the maximum score.

[0011] One aspect of the present invention is a fault location estimation method for estimating the location of a network failure. The fault location estimation method defines rules that show the relationship between alarms that characterize network failures and the location of the failure, and estimates the location of the failure using a set of alarms generated from the network and these rules. When defining the rules, multiple rule candidates are extracted, fault locations are estimated using all of the multiple rule candidates, evaluation values ​​for correct locations and incorrect locations are calculated, a score is calculated that includes the evaluation values ​​for correct locations and incorrect locations, and the number of incorrect locations as parameters, and the rule candidate with the highest score is used to define the rule to be used for estimating the location of the failure.

[0012] According to the present invention, a fault location estimation device and a fault location estimation method are provided that present estimation results that facilitate the identification of fault locations.

[0013] Figure 1 is a block diagram showing an example of a fault location estimation system according to an embodiment and a communication network NW to be monitored. Figure 2 is a block diagram showing an example of the hardware configuration of a fault location estimation device according to an embodiment. Figure 3 is a block diagram showing an example of the functional configuration of a fault location estimation device according to an embodiment. Figure 4 is a flowchart showing the flow of determining rules in the fault location estimation device according to an embodiment. Figure 5 is a diagram showing a first fault example of the network. Figure 6 is a diagram showing a second fault example of the network.

[0014] Embodiments of the present invention will be described below with reference to the drawings.

[0015] (Fault Location Estimation System) First, with reference to Figure 1, the fault location estimation system 1 according to the embodiment will be described. Figure 1 is a block diagram showing the fault location estimation system 1 according to the embodiment and an example of a communication network NW that is the target of monitoring.

[0016] The fault location estimation system 1 estimates the location of a fault that occurred in a communication network NW, for example. The fault location estimation system 1 includes a monitoring device 2 and a fault location estimation device 3.

[0017] A communication network (NW) has multiple physical devices (PDs). A physical device (PD) generates an alarm if a failure occurs in its own device or a counterpart device.

[0018] Monitoring device 2 consists of a computer, for example, a server computer. Monitoring device 2 monitors the status of the communication network NW. If a failure occurs in the communication network NW, monitoring device 2 collects alarms generated in the communication network NW. Monitoring device 2 passes the collected alarms to the failure location estimation device 3.

[0019] The fault location estimation device 3 is comprised of a computer, such as a server computer. The fault location estimation device 3 performs rule learning and fault location estimation for the communication network NW.

[0020] (Hardware configuration of the fault location estimation device) Next, the hardware configuration of the fault location estimation device according to the embodiment will be described with reference to Figure 2. Figure 2 is a block diagram showing an example of the hardware configuration of the fault location estimation device according to the embodiment.

[0021] As shown in Figure 2, the fault location estimation device 3 includes a control circuit 11, a communication module 12, a user interface 13, a storage device 14, a drive 15, and a storage medium 16.

[0022] The control circuit 11 is a circuit that controls all components of the fault location estimation device 3 as a whole. The control circuit 11 includes a CPU (Central Processing Unit), RAM (Random Access Memory), and ROM (Read Only Memory), etc. The ROM of the control circuit 11 stores programs used for various processes in the fault location estimation device 3. The CPU of the control circuit 11 controls the entire fault location estimation device 3 according to the programs stored in the ROM of the control circuit 11. The RAM of the control circuit 11 is used as a work area for the CPU of the control circuit 11.

[0023] The communication module 12 is a circuit used for communication with, for example, the monitoring device 2. The user interface 13 is an interface that manages communication between the user and the control circuit 11. The user interface 13 includes input devices and output devices. The input devices include, for example, a keyboard, a touch panel, and operation buttons. The output devices include, for example, an LCD (Liquid Crystal Display) or an EL (Electroluminescence) display. The user interface 13 converts input from the user into an electrical signal and then transmits it to the control circuit 11. The user interface 13 outputs the execution result based on the input from the user to the user.

[0024] The storage device 14 includes, for example, an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The storage device 14 stores programs, information, etc., used in various processes in the fault location estimation device 3.

[0025] Drive 15 is a device for reading software stored on the storage medium 16. Drive 15 includes, for example, a CD (Compact Disk) drive and a DVD (Digital Versatile Disk) drive.

[0026] The storage medium 16 is a medium for storing software by electrical, magnetic, optical, mechanical, or chemical means. The storage medium 16 may also store programs for executing various processes in the fault location estimation device 3.

[0027] For example, the storage medium 16 stores a fault location estimation program that causes the control circuit 11 to execute the functions of the fault location estimation device 3. The control circuit 11 non-temporarily stores the fault location estimation program stored in the storage medium 16 in the storage 14. The control circuit 11 also loads the fault location estimation program stored in the storage 14 into RAM and executes it. In this way, the control circuit 11 works in cooperation with other elements to execute the functions of the fault location estimation device 3.

[0028] (Functional Configuration of the Fault Location Estimation Device) Next, the functional configuration of the fault location estimation device 3 according to the embodiment will be described with reference to Figure 3. Figure 3 is a block diagram showing an example of the functional configuration of the fault location estimation device 3 according to the embodiment. The fault location estimation device 3 is a device that performs rule learning and fault location estimation for a communication network NW.

[0029] The fault location estimation device 3 includes a data acquisition unit 31, a rule learning control unit 32, a fault location estimation function unit 33, a countermeasure management function unit 34, an alarm information database 36, a network configuration information database 37, a rule database 38, a fault history and countermeasure history database 39, a GUI unit 35, and an API unit 40.

[0030] The data acquisition unit 31 acquires network configuration information of the communication network NW to be monitored from the monitoring device 2 or other equipment. The data acquisition unit 31 also acquires a collection of alarms, which are multiple alarm information generated from the communication network NW to be monitored, from the monitoring device 2.

[0031] The network configuration information database 37 manages the network configuration information acquired by the data acquisition unit 31. The network configuration information database 37 also manages all resource information contained in each resource as attributes.

[0032] The alarm information database 36 manages the alarm information acquired by the data acquisition unit 31.

[0033] The rule learning control unit 32 defines rules during rule learning that show the relationship between alarms that characterize failures in the communication network NW and the location of the failure. For example, the rules defined by the rule learning control unit 32 are If-then rules with "type of alarm" and "positional relationship between the failure location and the alarm location" as If conditions. An If-then rule consists of an If section (If condition) that represents a premise or condition, and a Then section that represents a conclusion or action when the If section is true. Hereafter, If-then rules may also be simply referred to as rules. That is, the term "rule" in this specification means an If-then rule.

[0034] The rule database 38 manages the rules defined by the rule learning control unit 32. For example, the rule database 38 manages If-then rules with "type of alarm" and "positional relationship between the fault location and the alarm occurrence location" as If conditions.

[0035] The fault location estimation function unit 33 estimates the fault location using a set of alarms generated from the communication network NW and rules defined by the rule learning control unit 32.

[0036] The troubleshooting method management function unit 34 writes new troubleshooting methods for a malfunction to the malfunction history troubleshooting history database 39, or reads existing troubleshooting history from the malfunction history troubleshooting history database 39, according to the operator's input operations.

[0037] The failure history and troubleshooting database 39 manages the troubleshooting methods written by the failure history and troubleshooting database 39. The failure history and troubleshooting database 39 also manages the failure history. The failure history may be, for example, the estimation results by the failure location estimation function unit 33 or the input information by the operator via the troubleshooting method management function unit 34.

[0038] The GUI unit 35 has the function of creating and controlling the GUI, and receives information and instructions from the operator via the GUI, and presents the operator with information, such as the estimated location of a fault.

[0039] The API unit 40 has a function to control APIs and can communicate information and instructions with external devices via APIs.

[0040] (Definition of Rules) The definition of rules in the fault location estimation device 3 according to the embodiment will be explained below with reference to Figure 4. The definition of rules is performed in cooperation with the rule learning control unit 32 and the fault location estimation function unit 33.

[0041] First, in step S11, the rule learning control unit 32 refers to the alarm information database 36 and extracts candidate alarm combinations that can become rule candidates.

[0042] Next, in step S12, the failure location estimation function unit 33 estimates the failure location using all the rule candidates extracted by the rule learning control unit 32, and calculates the evaluation value of the correct location and the evaluation value of the incorrect location.

[0043] Subsequently, in step S13, the rule learning control unit 32 calculates a score including the evaluation value of the correct location and the evaluation value of the incorrect location calculated by the failure location estimation function unit 33, and further the number of incorrect locations as parameters.

[0044] Next, in step S14, the rule learning control unit 32 defines the rule used by the failure location estimation function unit 33 for failure location estimation using the rule candidate with the maximum score calculated in step S13. For example, the rule candidate with the maximum score is adopted in the If part (If condition) of the If-then rule.

[0045] The rule learning control unit 32 stores the defined rule in the rule database 38.

[0046] (Estimation of failure location) The failure location estimation function unit 33 estimates the failure location using the set of alarms generated from the network NW captured by the data capture unit 31 and the rule defined by the rule learning control unit 32 under the cooperation of the rule learning control unit 32 and the failure location estimation function unit 33 as described above.

[0047] (Definition of rule in the first failure case) Next, referring to FIG. 5, the definition of the rule for the first failure case in the communication network NW will be described.

[0048] There are devices K to T on the communication network NW in the first failure case, and device O is the failure-occurring device. With the occurrence of a failure in device O, alarm z is generated from device O, and alarms y are issued from devices L, N, and Q, which are the opposing devices of device O.

[0049] (1) Extraction of rule candidates In the rule learning control unit 32, combinations of alarms are obtained as rule candidates from the set of alarms generated by device failures of device O. The set of alarms includes alarm y from the opposing device and alarm z from the own device. The combinations of alarms are shown in Table 1.

[0050]

[0051] As shown in Table 1, alarm combination 1A includes alarm y from the opposing device and alarm z from the local device, alarm combination 1B includes only alarm y from the opposing device, and alarm combination 1C includes only alarm z from the local device.

[0052] (2) In the fault location estimation function unit 33, the evaluation value is calculated for all suspected faults when all alarm combinations are used in the If part (If condition) of the If-then rule.

[0053] Possible formulas for calculating the evaluation value include the percentage of items that satisfy the rule's If condition. An example of an evaluation value calculation formula is shown in the following formula (1). Formula (1) is just one example of an evaluation value calculation formula, and the formula for calculating the evaluation value is not limited to formula (1).

[0054]

[0055] Table 2 shows the calculation results of the evaluation value for alarm combination 1A. In Table 2, the numerator and denominator are the values ​​of the numerator and denominator in the evaluation value calculation formula (1). This is also the case in Tables 3 and 4, which will be shown later.

[0056]

[0057] Table 3 shows the calculation results of the evaluation value for alarm combination 1B.

[0058]

[0059] Table 4 shows the calculation results of the evaluation value for alarm combination 1C.

[0060]

[0061] (3) Calculation of score A score is calculated based on the evaluation value of the correct answers, the highest evaluation value of the incorrect answers, and the number of incorrect answers among the suspected fault candidates. The number of incorrect answers is the number of incorrect answers with an evaluation value greater than 0.

[0062] An example of a score calculation formula is shown in equation (2) below. Equation (2) is merely an example of a score calculation formula, and the score calculation formula is not limited to equation (2).

[0063]

[0064] Regarding the first term in the numerator of equation (2), a higher evaluation value (c) for the correct location indicates a more reliable estimation result. Furthermore, regarding the second term in the numerator of equation (2), a larger difference (c-w) between the evaluation value of the correct location and the highest evaluation value of the incorrect location makes it easier to find the correct location. Finally, regarding the third term in the numerator of equation (2), a smaller number of incorrect locations (n) makes it easier to find the correct location.

[0065] Here, as an example, in equation (2), the weights of the evaluation values ​​of the correct answers (r), the weight of the highest evaluation value of the incorrect answers (s), and the weight of the number of incorrect answers (t) are set to 0.5, 0.4, and 0.1, respectively.

[0066] In alarm combination 1A, Table 2 shows that the evaluation value for correct answers is 1.00 for device O, the highest evaluation value for incorrect answers is 0.40 for device M, and the number of incorrect answers is 7. In addition, the number of incorrect answers is 7 for devices K, P, M, R, T, Q, and N, which have an evaluation value greater than 0 among the devices excluding device O. The calculation result of the score for alarm combination 1A is shown in the following formula (3).

[0067]

[0068] In alarm combination 1B, Table 3 shows that the evaluation value for correct answers is 1.00 for device O, the highest evaluation value for incorrect answers is 0.50 for devices K, M, and T, and the number of incorrect answers is 7. In addition, the number of incorrect answers is 7 for devices K, P, M, R, T, Q, and N, which have an evaluation value greater than 0 among the devices excluding device O. The calculation result of the score in alarm combination 1B is shown in the following formula (4).

[0069]

[0070] In alarm combination 1C, Table 4 shows that the evaluation value for correct answers is 1.00 for device O, the highest evaluation value for incorrect answers is 0.0 for all devices except device O, and the number of incorrect answers is 0. Furthermore, the number of incorrect answers is 0 because, among the devices excluding device O, there are no devices with an evaluation value greater than 0. The calculation result of the score for alarm combination 1C is shown in the following equation (5).

[0071]

[0072] Thus, the score for alarm combination 1A is 0.7525, the score for alarm combination 1B is 0.7125, and the score for alarm combination 1C is 1.0000.

[0073] Of these scores, the combination of alarms with the highest score will be adopted as the rule's If condition. That is, the combination of alarms 1C with a score of 1.0000 will be adopted as the rule's If condition.

[0074] In alarm combination 1C, the number of incorrect answers is smaller compared to alarm combinations 1A and 1B. Specifically, while alarm combinations 1A and 1B each have 7 incorrect answers, alarm combination 1C has 0 incorrect answers.

[0075] Furthermore, in alarm combination 1C, the difference between the evaluation values ​​of the correct and incorrect answers is larger compared to alarm combinations 1A and 1B. Specifically, in alarm combination 1A, the highest evaluation value for an incorrect answer is 0.40, and the difference between the evaluation values ​​of the correct and incorrect answers is 0.60. In alarm combination 1B, the highest evaluation value for an incorrect answer is 0.50, and the difference between the evaluation values ​​of the correct and incorrect answers is 0.50. In contrast, in alarm combination 1C, the highest evaluation value for an incorrect answer is 0.00, and the difference between the evaluation values ​​of the correct and incorrect answers is 1.00.

[0076] As mentioned earlier in relation to the score calculation formula, a smaller number of incorrect answers makes it easier to find the correct answers. Also, a larger difference between the evaluation value of the correct answers and the highest evaluation value of the incorrect answers makes it easier to find the correct answers.

[0077] Therefore, the fault location estimation results using the rule with alarm combination 1C as the If condition are easier for the operator to identify compared to the fault location estimation results using the other alarm combinations 1A and 1B as If conditions.

[0078] (Definition of rules for the second failure scenario) Next, referring to Figure 6, we will explain the definition of rules for the second failure scenario in the communication network NW.

[0079] In the second failure scenario, the communication network NW is a multilayer network consisting of multiple logical layers stacked on top of the physical layer. The physical layer includes IP (Internet Protocol) devices A and E, and transmission devices B, C, and D. Communication services are provided connecting the service layer communication endpoints X and Y via devices A, B, C, D, and E. In other words, devices A, B, C, D, and E support the communication services between the service layer communication endpoints X and Y.

[0080] In this case, device B is the faulty device, and when device B fails, alarm a is generated from devices A and C, which are the physical counterparts to device B. Additionally, the communication service between communication endpoints X and Y in the service layer supported by device B becomes unavailable, resulting in alarm b being generated from communication endpoints X and Y.

[0081] (1) Extraction of rule candidates In the rule learning control unit 32, combinations of alarms that could be adopted as rules are obtained from the set of alarms that occurred when device B failed. The set of alarms includes alarm a from devices A and C, which are the opposing devices of the failed device B, and alarm b from the communication endpoints X and Y of the service layer supported by the failed device B. The combinations of alarms are shown in Table 5.

[0082]

[0083] As shown in Table 5, alarm combination 2A includes alarm a from the opposing device and alarm b from the communication endpoint of the service layer supported by the faulty device; alarm combination 2B includes only alarm a from the opposing device; and alarm combination 2C includes only alarm b from the communication endpoint of the service layer supported by the faulty device.

[0084] (2) In the fault location estimation function unit 33, the evaluation value is calculated for all suspected faults when all alarm combinations are used in the If part (If condition) of the If-then rule.

[0085] Possible formulas for calculating the evaluation value include the percentage of cases where the rule's If condition is met. The formula for calculating the evaluation value is, for example, the same as formula (1) in the first failure case. The formula for calculating the evaluation value in formula (1) is reproduced here as formula (6). Note that the formula for calculating the evaluation value is not limited to formula (1) or formula (6).

[0086]

[0087] Table 6 shows the calculation results of the evaluation value for alarm combination 2A. In Table 6, the numerator and denominator are the values ​​of the numerator and denominator in the evaluation value calculation formula (6). This is also the case in Tables 7 and 8, which will be shown later.

[0088]

[0089] Table 7 shows the calculation results of the evaluation value for alarm combination 2B.

[0090]

[0091] Table 8 shows the calculation results of the evaluation value for alarm combination 2C.

[0092]

[0093] (3) Calculation of score A score is calculated based on the evaluation value of the correct answers, the highest evaluation value of the incorrect answers, and the number of incorrect answers among the suspected fault candidates. The number of incorrect answers is the number of incorrect answers with an evaluation value greater than 0.

[0094] The formula for calculating the score is the same as, for example, formula (2) in the first failure case. The formula for calculating the score in formula (2) is reproduced here as formula (7). Note that the formula for calculating the score is not limited to formula (2) or formula (7).

[0095]

[0096] Regarding the first term in the numerator of equation (7), a higher evaluation value (c) for the correct location indicates a more reliable estimation result. Furthermore, regarding the second term in the numerator of equation (7), a larger difference (c-w) between the evaluation value of the correct location and the highest evaluation value of the incorrect location makes it easier to find the correct location. Finally, regarding the third term in the numerator of equation (7), a smaller number of incorrect locations (n) makes it easier to find the correct location.

[0097] Here, as an example, in equation (7), the weights of the evaluation values ​​of the correct answers (r), the weight of the highest evaluation value of the incorrect answers (s), and the weight of the number of incorrect answers (t) are set to 0.5, 0.4, and 0.1, respectively.

[0098] In alarm combination 2A, Table 6 shows that the evaluation value for correct answers is 1.00 for device B, the highest evaluation value for incorrect answers is 0.75 for device D, and the number of incorrect answers is 4. In addition, the number of incorrect answers is 4 for devices D, A, C, and E, which have evaluation values ​​greater than 0 among the devices excluding device B. The calculation result of the score in alarm combination 2A is shown in the following formula (8).

[0099]

[0100] In alarm combination 2B, Table 7 shows that the evaluation value for correct answers is 1.00 for device B, the highest evaluation value for incorrect answers is 0.50 for device D, and the number of incorrect answers is 1. Furthermore, the number of incorrect answers is 1 for device D, as the evaluation values ​​for devices A, C, and E (excluding device B) are all 0. The calculation result of the score in alarm combination 2B is shown in the following equation (9).

[0101]

[0102] In alarm combination 2C, Table 8 shows that the evaluation value for correct answers is 1.00 for device B, the highest evaluation value for incorrect answers is 1.00 for devices D, A, C, and E, and the number of incorrect answers is 4 for devices D, A, C, and E. The calculation result of the score in alarm combination 2C is shown in the following formula (10).

[0103]

[0104] Thus, the score for alarm combination 2A is 0.62, the score for alarm combination 2B is 0.75, and the score for alarm combination 2C is 0.52.

[0105] Of these scores, the combination of alarms with the highest score will be adopted as the rule's If condition. That is, the combination of alarms 2B with a score of 0.75 will be adopted as the rule's If condition.

[0106] In alarm combination 2B, the number of incorrect answers is smaller compared to alarm combinations 2A and 2C. Specifically, while alarm combinations 2A and 2C each have 4 incorrect answers, alarm combination 2B has only 1 incorrect answer.

[0107] Furthermore, in alarm combination 2B, the difference between the evaluation values ​​of the correct and incorrect locations is larger compared to alarm combinations 2A and 2C. Specifically, in alarm combination 2C, the highest evaluation value of the incorrect locations is the same as the evaluation value of the correct locations at 1.00, and the difference between the evaluation values ​​of the correct locations and the highest evaluation values ​​of the incorrect locations is 0.00. In alarm combination 2A, the highest evaluation value of the incorrect locations is 0.75, and the difference between the evaluation values ​​of the correct locations and the highest evaluation values ​​of the incorrect locations is 0.25. In contrast, in alarm combination 2B, the highest evaluation value of the incorrect locations is 0.50, and the difference between the evaluation values ​​of the correct locations and the highest evaluation values ​​of the incorrect locations is 0.50.

[0108] As mentioned earlier in relation to the score calculation formula, a smaller number of incorrect answers makes it easier to find the correct answers. Also, a larger difference between the evaluation value of the correct answers and the highest evaluation value of the incorrect answers makes it easier to find the correct answers.

[0109] Therefore, the fault location estimation results using the rule with alarm combination 2B as the If condition are easier for the operator to identify compared to the fault location estimation results using the other alarm combinations 2A and 2C as If conditions.

[0110] (Effects) In the fault location estimation device and fault location estimation method according to the embodiment, a score is calculated that includes not only the evaluation value of the correct location but also the evaluation value of the incorrect location and the number of incorrect locations as parameters, and the rules used to estimate the fault location are defined using this calculated value.

[0111] This avoids presenting estimation results that make it difficult to identify the faulty parts, such as incorrect answers receiving high evaluation values ​​similar to correct answers, or a large number of suspected incorrect answers being shown.

[0112] In other words, according to this embodiment, it is possible to present estimation results that make it easy to distinguish between correct and incorrect locations. This makes it possible to quickly identify the location of the fault.

[0113] In other words, according to the embodiment, a fault location estimation device and fault location estimation method are provided that present estimation results that allow an operator to easily identify the fault location.

[0114] Embodiments of the present invention have been described above with reference to the drawings. However, the above embodiments are merely examples of configurations that embody the present invention. In other words, it is clear that the present invention is not limited to the above embodiments. Therefore, additions, omissions, substitutions, and other modifications of components are permitted without departing from the technical spirit of the present invention.

[0115] In short, the present invention is not limited to the embodiments described above, and can be modified in various ways during implementation without departing from its essence. Furthermore, each embodiment may be combined as appropriate, and in that case, the combined effects can be obtained. Moreover, the above embodiments include various inventions, and various inventions can be extracted by selecting combinations from the multiple constituent elements disclosed. For example, if the problem can be solved and effects obtained even if some constituent elements are deleted from all the constituent elements shown in the embodiment, then the configuration with these deleted constituent elements can be extracted as an invention.

[0116] 1...Fault location estimation system 2...Monitoring device 3...Fault location estimation device 11...Control circuit 12...Communication module 13...User interface 14...Storage 15...Drive 16...Storage medium 31...Data acquisition unit 32...Rule learning control unit 33...Fault location estimation function unit 34...Handling method management function unit 35...GUI unit 36...Alarm information database 37...Network configuration information database 38...Rule database 39...Fault history handling history database 40...API unit

Claims

1. A fault location estimation device for estimating fault locations in a network, comprising: a rule learning control unit that defines rules indicating the relationship between alarms characterizing network faults and the fault locations; and a fault location estimation function unit that estimates the fault locations using a set of alarms generated from the network and the rules defined by the rule learning control unit, wherein when defining the rules, the rule learning control unit extracts a plurality of rule candidates; the fault location estimation function unit estimates the fault locations using all of the plurality of rule candidates and calculates evaluation values ​​for correct locations and incorrect locations; the rule learning control unit calculates a score that includes the evaluation values ​​for correct locations and incorrect locations calculated by the fault location estimation function unit, and the number of incorrect locations as parameters, and defines the rule used by the fault location estimation function unit to estimate the fault locations using the rule candidate that maximizes the score.

2. The fault location estimation device according to claim 1, wherein the rule is an If-then rule, the fault location estimation function unit calculates an evaluation value for all suspected faults when all alarm combinations are adopted as the If condition of the If-then rule, and the rule learning control unit adopts the alarm combination with the highest score as the If condition of the If-then rule.

3. A fault location estimation method for estimating the location of a fault in a network, comprising: defining a rule that shows the relationship between an alarm that characterizes a network fault and the fault location; estimating the fault location using a set of alarms generated from the network and the rule; extracting multiple rule candidates when defining the rule; estimating the fault location using all of the multiple rule candidates; calculating evaluation values ​​for correct locations and incorrect locations; calculating a score that includes the evaluation values ​​for correct locations and incorrect locations as parameters, and defining the rule to be used for estimating the fault location using the rule candidate that maximizes the score.

Images