Information processing device and method

Abstract

An information processing device according to an embodiment comprises: an extraction unit that extracts alarm information that has already occurred within a first period, which is the time at which a failure occurred in a communication network and periods before and after the time, and alarm information that has already occurred within a second period not included in the first period; a learning unit that learns a rule for estimating a failure that has occurred in the communication network on the basis of the result of the extraction by the extraction unit; and an estimation unit that estimates a failure that has newly occurred in the communication network, using alarm information that has newly occurred in the communication network and the rule learned by the learning unit.

Description

Information processing apparatus and method

[0001] An embodiment of the present invention relates to an information processing apparatus and method.

[0002] In recent years, as the social importance of communication network services of communication carriers has increased, along with the advancement and complication of communication technologies and facilities due to service diversification, the number of serious accidents occurring is also on the rise, and network maintenance and management by communication carriers is becoming increasingly important.

[0003] When an abnormality occurs in a network, for example when a server or transmission apparatus on the network required to provide a service becomes unavailable due to a failure, alarms indicating the abnormality are issued from various locations such as network apparatuses or servers that provide services.

[0004] The generated alarms are collected by a monitoring system, and maintenance workers need to analyze where and what kind of failure has occurred using the collected alarms and network configuration, and perform failure recovery response.

[0005] However, various alarms are generated depending on the failure cause or the type of failed apparatus, and the number of apparatuses that generate alarms or the types of alarms also vary depending on the network configuration. A vast amount of know-how is required to grasp the characteristics of such alarm generation and identify the failure location or failure cause, and when a large number of alarms are generated, even a skilled person has difficulty in instantly identifying the failure cause and the like. For this reason, it is effective to formalize the alarms generated by a failure into rules, and instantly identify the failure cause or failure location when an alarm is generated.

[0006] For example, as disclosed in Patent Document 1 and Non-Patent Document 1, there is a technique for estimating a failure cause, failure cause location, and the like from messages such as alarms generated accompanying the occurrence of a failure on a network.

[0007] For example, based on alarms from the time period around when a malfunction occurred, rules are pre-learned for each malfunction case, with "type of alarm" and "positional relationship between the malfunction location and the alarm location" as the If condition. The operator is then presented with an evaluation value, such as the percentage of times the If condition of the rule is met for each suspected malfunction location, to help identify the malfunction location or cause.

[0008] In this technology, when generating rules to characterize a failure, combinations of alarms that occurred before and after the time of the failure are extracted, the estimated results when these combinations are actually used in the rules are obtained, and the combination pattern that is considered to best characterize the failure is adopted as the rule.

[0009] Japanese Patent No. 6637854

[0010] Fumika Asai, di. li, Norio Yamamoto, Haruhisa Nozue, Ken Tayama: Study and Applicability Evaluation of Automated Network Fault Estimation, IEICE Technical Report, vol. 122, no. 442, ICM2022-59, pp. 95-100 (2023).

[0011] In the aforementioned technology, when a failure occurs, a set of alarms that characterize the failure is adopted as a rule based on alarms from the time period surrounding the failure. However, in the steady operation of large-scale networks such as carrier networks, alarms that are not directly related to the failure in question, such as regularly occurring alarms or alarms due to frequent failures, may also occur. In particular, the initial rule generated when the first failure occurs does not adequately reflect the characteristics of the failure, and the accuracy of failure location estimation was not sufficient.

[0012] This invention was made in view of the above circumstances, and its purpose is to provide an information processing device and method that can appropriately estimate a failure occurring in a communication network.

[0013] An information processing device according to one aspect of the present invention includes: an extraction unit that extracts alarm information that has already occurred within a first period which is the time when a failure occurs in a communication network and the period before and after that time, and alarm information that has already occurred within a second period which is not included in the first period; a learning unit that learns rules for estimating failures that have occurred in the communication network based on the results of the extraction by the extraction unit; and an estimation unit that estimates newly occurring failures in the communication network using newly occurring alarm information in the communication network and the rules learned by the learning unit.

[0014] An information processing method according to one aspect of the present invention is a method performed by an information processing device, comprising: an extraction unit of the information processing device extracting alarm information that has already occurred within a first period which is the time at which a failure occurred in the communication network and the period before and after said time, and alarm information that has already occurred within a second period which is not included in the first period; a learning unit of the information processing device learning rules for estimating failures that have occurred in the communication network based on the results of the extraction by the extraction unit; and an estimation unit of the information processing device estimating newly occurring failures in the communication network using newly occurring alarm information in the communication network and the rules learned by the learning unit.

[0015] According to the present invention, it is possible to appropriately estimate failures occurring in a communication network.

[0016] Figure 1 shows an example of the application of an information processing device according to one embodiment of the present invention. Figure 2 shows an example of a first method of rule determination. Figure 3 shows an example of a failure time zone alarm and a failure time zone alarm. Figure 4 is a diagram illustrating a first example of an exclusion priority determination method. Figure 5 is a diagram illustrating a second example of an exclusion priority determination method. Figure 6 shows an example of an alarm occurring in a network. Figure 7 shows an example of a second method of rule determination. Figure 8A shows an example of an alarm occurring in a communication network. Figure 8B shows an example of an alarm occurring in a communication network. Figure 9 shows a first example of the estimation result of the evaluation value of a suspected failure candidate. Figure 10 shows a second example of the estimation result of the evaluation value of a suspected failure candidate. Figure 11 shows a third example of the estimation result of the evaluation value of a suspected failure candidate. Figure 12 shows an example of the estimation result of an evaluation value related to failure estimation in a known method. Figure 13 shows an example of the estimation result of an evaluation value related to failure estimation in this embodiment. Figure 14 shows a first example of the estimation result of an evaluation value in a normal state. Figure 15 shows a second example of the estimation result of an evaluation value in a normal state. Figure 16 shows a third example of the estimation result of the evaluation value under normal conditions. Figure 17 is a block diagram showing an example of the hardware configuration of an information processing device according to one embodiment of the present invention.

[0017] Embodiments relating to this invention will be described below. Figure 1 is a diagram showing an example of application of an information processing device according to one embodiment of the present invention. As shown in Figure 1, the information processing device 100 according to one embodiment of the present invention has a data acquisition unit 10, a rule learning unit 20, a fault location estimation unit 30, a storage unit 40, a countermeasure method management unit 50, a GUI (Graphical User Interface) unit 60, and an API (Application Programming Interface) unit 70.

[0018] The data acquisition unit 10 acquires alarm groups from external sources, including multiple alarms that occurred during normal operation, and also acquires network configuration information of the monitored network from external sources. The storage unit 40 has an alarm DB (Database) 41, a network configuration DB 42, a rule DB 43, and a response history DB 44.

[0019] Alarm DB 41 stores alarm groups acquired by the data acquisition unit 10, and network information DB 42 stores network configuration information acquired by the data acquisition unit 10. Alarm groups include the device or system that generated the alarm, the content of the alarm, and the time the alarm occurred. Network configuration information stored in network configuration DB 42 includes information such as adjacency, which is the adjacency relationship of each device that constitutes the communication network, and includes information for the logical layer and the physical layer.

[0020] When a network failure occurs, the rule learning unit 20 generates rules used to estimate the nature of the failure, in this case the nature of the malfunction, based on a group of alarms that characterize the nature of the failure, and stores these rules in the rule DB 43.

[0021] The fault location estimation unit 30 compares newly generated alarms with rules already stored in the rule DB 43. If at least one of the newly generated alarms matches any of the alarms in the group characterized by the rule, it performs estimation processing to determine the likelihood of the occurrence of the fault and the location of the fault.

[0022] The rule learning unit 20, based on the failure information to be used to generate rules, namely the failure cause and the failure time, treats alarms that occurred during a predetermined period before and after the failure time as failure time-based alarms, and alarms that occurred outside of this period as failure time-based alarms. Based on these alarms, it determines candidate alarms that are candidates to be adopted into the rule, and then generates the optimal learned rule used for failure estimation and stores it in the rule DB 43.

[0023] Since alarms occurring outside of normal failure hours are not considered to be alarms that characterize failures, in this embodiment, by avoiding treating such alarms as candidate alarms to be adopted into rules during rule generation, the characteristics of the failure can be captured more accurately, and the accuracy of failure location estimation based on rules can be improved. The countermeasure management unit 50 writes new countermeasures for the failure that has occurred to the countermeasure history DB 44 or reads existing countermeasure history recorded in the countermeasure history DB 44 according to input operations by the operator to the GUI unit 60. The API unit 70 has APIs that realize the functions of each part within the information processing device 100 and realize input and output with the outside.

[0024] As a specific first method for generating rules in this embodiment, the following rule determination method (1) can be mentioned. Rule determination method (1) Exclusion method for alarms occurring outside of fault hours Figure 2 is a diagram showing an example of the first method of rule determination. Figure 3 is a diagram showing an example of alarms occurring during fault hours and alarms occurring outside of fault hours. In rule determination method (1), the rule learning unit 20 collects alarm information from the alarm DB 41, including alarms that occurred under normal conditions (S11). From the alarms collected in S11, the rule learning unit 20 extracts alarms that occurred during the time period around the time of fault occurrence, for example, time t1 in Figure 3, i.e., alarms occurring during fault hours indicated by the symbol a in Figure 3, as candidate alarms (S12).

[0025] The rule learning unit 20 extracts alarms from the alarms collected in S11 that occurred during times unrelated to the failure, i.e., alarms that occurred outside of the failure period, indicated by the symbol b in Figure 3 (S13).

[0026] The rule learning unit 20 excludes the corresponding alarm from the candidate alarms (S14) if the candidate alarms extracted in S12 include the same alarm (indicated by c in Figure 3) as the after-hours failure alarm extracted in S13.

[0027] The rule learning unit 20 checks the number of candidate alarms after processing in S14 (S15). If the number of candidate alarms is not less than the lower limit (No in S16), the rule learning unit 20 determines the content of the rule to be learned based on the current candidate alarms (S17). If the number of candidate alarms is less than the lower limit (Yes in S16), the rule learning unit 20 adopts alarms with low exclusion priority from among the alarms that are not candidate alarms as candidate alarms and returns to S15. The determination of exclusion priority will be described later. The processing from S15 onward is intended to prevent the number of candidate alarms from becoming 0 due to exclusion in S14 and thus preventing the generation of a rule.

[0028] Next, we will explain an example of the exclusion priority determination method in rule determination method (1). Figure 4 is a diagram illustrating the first example of the exclusion priority determination method. The exclusion priority determination methods include the first determination method, which is determination based on the frequency of alarm occurrence, and the second determination method, which is determination based on the topological distance to the fault location. In the first determination method, the number of alarm occurrences is quantified, and the higher the alarm occurrence frequency indicated by this number, the lower the probability of an alarm being caused by that fault, and therefore the higher the exclusion priority is defined.

[0029] In the example shown in Figure 4, among the alarms that occur during the fault time period (indicated by symbol a in Figure 4) and alarms that occur outside the fault time period (indicated by symbol b in Figure 4), the number of occurrences of alarms Q, S, and T, which are at least outside the fault time period, are as follows: Q: Occurred 4 times S: Occurred 3 times T: Occurred 2 times

[0030] Of these occurrence counts, alarms with a high occurrence count have a relatively high priority for exclusion from the candidate alarms, while alarms with a relatively low occurrence count have a relatively low priority for exclusion from the candidate alarms. In other words, in the example shown in Figure 4, alarm Q has the highest exclusion priority, and alarm T has the lowest exclusion priority.

[0031] Figure 5 illustrates a second example of the exclusion priority determination method. Figure 6 shows an example of an alarm occurring in the network. In the second determination method for exclusion priority, the topological proximity to the fault location is quantified, and the greater the topological distance indicated by this number, the lower the probability of an alarm based on that fault, and therefore the higher the exclusion priority.

[0032] In the example shown in Figure 5, in a network as shown in Figure 6, the number of devices traversed from the failure location for at least the outside-of-failure-hour alarms (Audio T, Alarm S, and Alarm Q) that occur due to a failure of the device indicated by the symbol a in Figure 6 is as follows: T: Number of devices traversed from the failure location: 2 S: Number of devices traversed from the failure location: 1 Q: Number of devices traversed from the failure location: 0

[0033] Of these, alarms with a relatively large number of transits have a relatively high priority for exclusion from candidate alarms, while alarms with a relatively small number of transits have a relatively low priority for exclusion. In other words, in the example shown in Figure 5, alarm T has the highest exclusion priority, and alarm Q has the lowest exclusion priority. Alternatively, the exclusion priority may be determined by combining the first and second determination methods described above.

[0034] A specific second method for determining rules in this embodiment is the following rule determination method (2). Rule determination method (2) Method for incorporating the evaluation value outside of failure time into the score Figure 7 is a diagram showing an example of the second method of rule determination. In the second method, the rule learning unit 20 collects alarms, including normal conditions, from the alarm DB 41 (S21). From the alarms collected in S21, the rule learning unit 20 extracts candidate rules from combinations of alarms that occurred in the time period around the time of failure (S22).

[0035] The fault location estimation unit 30 uses all the candidate rules extracted in S22 to perform fault location estimation processing for the time period in question and calculates an evaluation value for each suspected fault location (S23).

[0036] In step S23, the first parameter c, the second parameter w, and the third parameter n are calculated as follows: c: evaluation value of correct answers w: highest evaluation value of incorrect answers n: number of incorrect answers

[0037] Furthermore, the fault location estimation unit 30 uses all the candidate rules extracted in S22 to perform fault location estimation processing for multiple locations outside of the fault occurrence time period, i.e., under normal conditions, and calculates an evaluation value (S24). In S24, the fourth parameter m is calculated as follows: m: the highest evaluation value of the incorrect location under normal conditions.

[0038] After S23 and S24, the rule learning unit 20 uses the parameters calculated in S23 and S24 to calculate a score as shown in equation (1) below, and adopts the rule with the highest calculated score from among the candidate rules extracted in S22 (S25).

[0039]

[0040] The meanings of r, s, t, and u shown in equation (1) are as follows: r: weight of the evaluation value of the correct answer s: weight of the highest evaluation value of the incorrect answer t: weight of the number of incorrect answers u: weight of the highest evaluation value of the incorrect answer under normal circumstances

[0041] In the present embodiment, by taking into account alarms that occurred in time periods unrelated to a failure, i.e., off-failure-time alarms, during rule generation, it is possible to create appropriate rules that capture the characteristics of this failure. This makes it possible to improve the accuracy of failure location estimation particularly for failures that have few learning opportunities, that is, low failure occurrence frequency, as well as for rules generated during initial learning.

[0042] Next, the advantages of the above-described first and second determination methods in the present embodiment will be described using a case in a communication network. FIGS. 8A and 8B are diagrams illustrating an example of alarms that occur in a communication network. In the networks shown in FIGS. 8A and 8B, the relationship between each device, which is for example an IP device, and the opposite device of the said device is as follows. Device K: Devices L, M Device L: Devices K, O Device M: Devices K, N, P Device N: Devices M, O Device O: Devices L, N, Q Device P: Devices M, Q, R Device Q: Devices O, P, R, T Device R: Devices P, Q, S Device S: Devices R, T Device T: Devices Q, S

[0043] Then, in the example shown in FIG. 8A, alarms y are generated from devices L and N in the first time period, which is the time period before the failure occurs.

[0044] Then, in the example shown in FIG. 8A, alarms are generated from devices L, M, N, and Q in the second time period following the first time period, which is the failure occurrence time period at device K. The failure occurrence time period at device K means a time period that includes the failure occurrence time at device K and a certain range of times before and after the said time. The relationship between the devices where these alarms occurred and the types of alarms generated for the said devices is as follows. Device L: Alarm y Device M: Alarm x, Alarm y Device N, Device Q: Alarm y

[0045] In this example, with the occurrence of a device failure (Cause A) in Device K, Alarm x is generated from Device M, which is one of the opposite devices of Device K. Further, during the failure occurrence time period of Device K, Alarm y, which is an alarm not caused by the device failure of Device K, is generated from a plurality of devices including Device M, Device L, Device N, and Device Q. This Alarm y is an alarm that also occurs in time periods other than the failure occurrence time period.

[0046] In the example shown in FIG. 8B, in the third time period following the second time period, which is the time period after failure recovery in Device K, Alarm y is generated from Device L. In the example shown in FIG. 8B, in the fourth time period following the third time period, which is the failure occurrence time period of Device T, alarms are generated from Devices L, N, and Q. The failure occurrence time period of Device T means a time period that includes the failure occurrence time of Device T and a certain range of times before and after that time. The relationship between the devices that generated these alarms and the types of alarms generated for the respective devices is as follows. Devices L, N: Alarm y Device Q: Alarm x In this example, with the occurrence of a device failure (Cause A) in Device T, Alarm x is generated from Device Q, which is one of the opposite devices of Device T. Further, during the failure occurrence time period of Device T, Alarm y, which is an alarm not caused by a device failure, is generated from Device L and Device N.

[0047] Here, an example of a procedure for generating failure estimation rule candidates based on a combination of alarms generated in a failure occurrence time period according to a known method will be described. In the example shown in FIG. 8A, the set of candidate alarms is Alarm x from the opposite device and Alarm y from the opposite device.

[0048] Then, the combinations of alarms in the set of candidate alarms are as follows. Combination (1): Alarm x from the opposite device, Alarm y from the opposite device Combination (2): Alarm x from the opposite device Combination (3): Alarm y from the opposite device

[0049] For all combinations, when device K fails, an evaluation value related to the estimation of the suspected fault location is calculated according to the following formula (2): Evaluation value = Number of nodes where an alarm satisfying the If condition occurred / Number of nodes where an alarm satisfying the If condition may occur ...Formula (2)

[0050] Figure 9 shows a first example of the estimated evaluation value for a suspected fault candidate. Figure 10 shows a second example of the estimated evaluation value for a suspected fault candidate. Figure 11 shows a third example of the estimated evaluation value for a suspected fault candidate. The calculated evaluation value for alarm combination (1) is the value shown in Figure 9, the calculated evaluation value for alarm combination (2) is the value shown in Figure 10, and the calculated evaluation value for alarm combination (3) is the value shown in Figure 11.

[0051] Next, the score is calculated according to the following formula (3), using the evaluation value of the correct answers, the highest evaluation value of the incorrect answers, and the number of incorrect answers as parameters, based on the evaluation values ​​mentioned above. Here, the weights r, s, and t are assumed to be r=0.5, s=0.4, and t=0.1.

[0052]

[0053] The scores calculated for the above-mentioned combinations (1) to (3) are as follows: Score for combination (1): 0.489 Score for combination (2): 0.275 Score for combination (3): 0.514 Of these calculated scores, combination (3), which corresponds to the highest score of "0.514", i.e., alarm y from the opposing device, is adopted into the fault estimation rule, and the fault estimation rule is learned. Then, when device T experiences a device failure (cause A), the fault location estimation process is performed using the learned fault estimation rule.

[0054] Figure 12 shows an example of the estimation results of evaluation values ​​related to failure estimation using a known method. In the estimation results shown in Figure 12, the device with the highest evaluation value is device O, but the evaluation value of device T, which actually experienced a failure, is 0 (indicated by the symbol a in Figure 12), so it does not show the correct failure estimation result.

[0055] This is because the alarm generated by device Q, which is the counterpart device to device T where the actual failure occurred, is alarm x, as shown in Figure 8B. The "alarm y from the counterpart device" that constitutes the above-mentioned alarm combination (3) is an alarm unrelated to the occurrence of the failure, and this combination does not include the "alarm x from the counterpart device" which is the cause of the failure.

[0056] Next, we will explain how the rule learning unit 20 according to this embodiment extracts alarms that occurred during times unrelated to the failure, i.e., alarms that occurred outside of the failure period. In the example shown in Figures 8A and 8B, the times unrelated to the failure are the time before the failure occurred and the time after the failure was resolved. Alarms that occurred during both of these time periods are alarm y, so the set of alarms that occurred outside of the failure period is extracted as alarm y from the opposing device.

[0057] In the rule determination method (1) described above according to this embodiment, if an alarm occurring outside the fault time period, which occurred during a time period unrelated to the fault, is included in the fault time period alarm, it is treated as an alarm for rule candidates as much as possible. This allows for a more accurate capture of the characteristics of the fault and improves the accuracy of the rules generated from the candidate alarms.

[0058] In the example shown in Figure 8A, the alarms generated by the opposing device to the faulty device during the time period surrounding the time of the failure at device K are alarm x and alarm y. Therefore, the candidate alarm set consists of alarm x and alarm y from the opposing device.

[0059] In the rule determination method (1) of this embodiment, if the extracted candidate alarm set includes the same alarm as the set of alarms occurring outside of fault hours, it is excluded from the candidate alarms. For example, as described above, if the candidate alarm set consists of alarm x and alarm y from the opposing device, and the set of alarms occurring outside of fault hours is alarm y from the opposing device, then alarm y from the opposing device, which is common to both the candidate alarm set and the set of alarms occurring outside of fault hours, is subject to duplicate exclusion, and the new candidate alarm set after exclusion becomes alarm x from the opposing device. Since this candidate alarm set has only one candidate alarm, this alarm x from the opposing device is adopted as the IF for the fault estimation rule.

[0060] Figure 13 shows an example of the estimation result of the evaluation value related to fault estimation in this embodiment. The estimation result shown in Figure 13 is the estimation result of the evaluation value based on the learned fault estimation rule when a fault occurs in device T, when alarm x from the opposing device is adopted as the IF of the fault estimation rule.

[0061] In the estimation results shown in Figure 13, the highest evaluation value is 0.5 (indicated by the symbol a in Figure 13). Since this evaluation value is for device T where the failure actually occurred, the estimation results shown in Figure 13 correctly identify the faulty location as the suspected location.

[0062] Furthermore, in the rule determination method (2) described above according to this embodiment, alarms to be adopted into the fault estimation rule are determined based on a score derived from evaluation values ​​during the fault occurrence period and evaluation values ​​outside the fault occurrence period, thereby improving the accuracy of the rules generated from candidate alarms.

[0063] In the example shown in Figure 8A, the alarms generated from the opposing device of the faulty device during the time period surrounding the time of the failure at device K are alarm x and alarm y. Therefore, the candidate alarm set is alarm x and alarm y from the opposing device, as described above.

[0064] The combinations of alarms generated from the opposing device to device K are as follows: Combination (1) Alarm x from the opposing device, Alarm y from the opposing device Combination (2) Alarm x from the opposing device Combination (3) Alarm y from the opposing device

[0065] Then, using all the candidate rules, i.e., all combinations of the alarms described above, an evaluation value related to the estimation of the fault location in the event of a failure of device K is calculated using the above-described formula (2), as shown in Figures 9, 10, and 11.

[0066] The parameters c, w, and n in the above-mentioned combinations (1) to (3), based on the evaluation values ​​shown in Figures 9, 10, and 11, are as follows: (Parameters c, w, and n in alarm combination (1)) Parameter c: 0.75 Parameter w: 0.5 Parameter n: 6

[0067] (Parameters c, w, and n in alarm combination (2)) Parameter c: 0.5 Parameter w: 0.5 Parameter n: 2

[0068] (Parameters c, w, and n in alarm combination (3)) Parameter c: 1 Parameter w: 1 Parameter n: 6

[0069] Then, evaluation values ​​related to fault estimation are obtained for multiple time periods under normal conditions, and the parameter m mentioned above, i.e., the highest evaluation value of the incorrect location under normal conditions, is determined. The example shown here is an example of calculation for the time period before the occurrence of the equipment failure (cause A). Figure 14 is a diagram showing the first example of the estimation result of the evaluation value under normal conditions. Figure 15 is a diagram showing the second example of the estimation result of the evaluation value under normal conditions. Figure 16 is a diagram showing the third example of the estimation result of the evaluation value under normal conditions. The calculation result of the evaluation value for the combination of alarms that occurred under normal conditions (1) is the value shown in Figure 14, the calculation result of the evaluation value for the combination of alarms that occurred under normal conditions (2) is the value shown in Figure 15, and the calculation result of the evaluation value for the combination of alarms that occurred under normal conditions (3) is the value shown in Figure 16.

[0070] Next, based on the evaluation values ​​shown in Figures 14, 15, and 16, the parameter m for the above-mentioned combinations (1) to (3) is as follows: (Parameter m for alarm combination (1)) Parameter m: 0.33 (Parameter m for alarm combination (2)) Parameter m: 0.0 (Parameter m for alarm combination (3)) Parameter m: 0.67

[0071] Then, using the parameters c, w, n, and m mentioned above—namely, the evaluation value of the correct answers, the highest evaluation value of the incorrect answers, the number of incorrect answers, and the highest evaluation value of the incorrect answers under normal conditions—the score is calculated according to equation (3) described above. Here, the weights r, s, and t are assumed to be r=0.3, s=0.2, t=0.1, and u=0.4.

[0072] The results of calculating the scores for the above-mentioned combinations (1) to (3) are as follows: Score for combination (1): 0.56 Score for combination (2): 0.58 Score for combination (3): 0.45 Of these calculated scores, combination (2), which corresponds to the highest score of "0.58", i.e., alarm x from the opposing device, is adopted as the fault estimation rule, and the fault estimation rule is learned.

[0073] Based on this learned rule, the estimated evaluation value when a failure occurs in device T, according to the learned failure estimation rule, will be the same as the estimated result shown in Figure 13. That is, the highest evaluation value in this estimation result is 0.5 (indicated by the symbol a in Figure 13), and since this evaluation value is the evaluation value for device T where the failure actually occurred, the estimation result when using the rule determination method (2) in this embodiment is the same as the estimation result when using the rule determination method (1) in this embodiment, in that the correct failure location is estimated as the suspected location.

[0074] Figure 17 is a block diagram showing an example of the hardware configuration of an information processing device according to one embodiment of the present invention. In the example shown in Figure 17, the information processing device 100 according to the above embodiment is composed of, for example, a server computer or a personal computer, and has a hardware processor 111A such as a CPU (Central Processing Unit). A program memory 111B, a data memory 112, an input / output interface 113, and a communication interface 114 are connected to this hardware processor 111A via a bus 115.

[0075] The communication interface 114 includes, for example, one or more wireless communication interface units, enabling the transmission and reception of information with the communication network. As the wireless interface, for example, an interface employing a low-power wireless data communication standard such as a wireless LAN (Local Area Network) is used.

[0076] The input / output interface 113 is connected to an input device 200 and an output device 300, which are attached to the information processing device 100 and used by users or the like.

[0077] The input / output interface 113 can capture operation data entered by a user or the like through an input device 200 such as a keyboard, touch panel, or touchpad, and can also output output data to an output device 300, including a display device using liquid crystal or organic EL (electroluminescence), for display. The input device 200 and output device 300 may be devices built into the information processing device 100, or they may be input devices and output devices of other information terminals that can communicate with the information processing device 100 via a network.

[0078] The program memory 111B is a non-temporary tangible storage medium in which a non-volatile memory that can be written to and read at any time, such as an HDD (Hard Disk Drive) or SSD (Solid State Drive), is used in combination with another non-volatile memory such as ROM (Read Only Memory), and can store programs necessary for executing various control processes, etc., according to one embodiment.

[0079] The data memory 112 is a tangible storage medium that, for example, uses a combination of the above-mentioned non-volatile memory and volatile memory such as RAM (Random Access Memory), and can be used to store various data or information acquired and created during the process of various operations.

[0080] An information processing device 100 according to one embodiment of the present invention may be configured as a data processing device having various parts of the information processing device 100, with the software-based processing function unit being the software-based processing unit.

[0081] The storage devices and storage unit 40 used as work memory by each part of the information processing device 100 may be configured using the data memory 112 shown in Figure 17. However, the storage areas configured by these storage devices are not essential to the information processing device 100, and may be areas provided in external storage media such as USB (Universal Serial Bus) memory, or in storage devices such as database servers located in the cloud.

[0082] All of the above processing functions can be implemented by having the hardware processor 111A read and execute a program stored in the program memory 111B. Some or all of these processing functions may be implemented in various other forms, including application-specific integrated circuits (ASICs) or field-programmable gate arrays (FPGAs).

[0083] Furthermore, the methods described in each embodiment can be stored as programs (software means) that can be executed by a computer on recording media such as magnetic disks (floppy disks, hard disks, etc.), optical disks (CD-ROMs, DVDs, MOs, etc.), and semiconductor memories (ROMs, RAMs, flash memories, etc.), and can also be transmitted and distributed via communication media. The programs stored on the media also include configuration programs that configure the computer to run software means (including not only the execution program but also tables or data structures). The computer implementing this device reads the program recorded on the recording media and, if necessary, constructs the software means using the configuration program, and executes the above-described processes by controlling the operation of this software means. Note that the recording media referred to in this specification are not limited to those for distribution, but also include storage media such as magnetic disks or semiconductor memories provided inside the computer or in devices connected via a network.

[0084] It should be noted that the present invention is not limited to the embodiments described above, and can be modified in various ways during implementation without departing from its essence. Furthermore, each embodiment may be combined as appropriate, and in that case, the combined effects can be obtained. Moreover, the above embodiments include various inventions, and various inventions can be extracted by selecting combinations from the multiple constituent elements disclosed. For example, if the problem can be solved and effects obtained even if some constituent elements are deleted from all the constituent elements shown in the embodiment, then the configuration with these deleted constituent elements can be extracted as an invention.

[0085] 100... Information processing unit 20... Rule learning unit 30... Fault location estimation unit 40... Memory unit 41... Alarm DB 42... Network configuration DB 43... Rule DB

Claims

1. An information processing device comprising: an extraction unit that extracts alarm information that has already occurred within a first period which is the time and the period before and after the time a failure occurred in the communication network, and alarm information that has already occurred within a second period which is not included in the first period; a learning unit that learns rules for estimating failures that have occurred in the communication network based on the results of the extraction by the extraction unit; and an estimation unit that estimates newly occurring failures in the communication network using newly occurring alarm information in the communication network and the rules learned by the learning unit.

2. The information processing apparatus according to claim 1, wherein the extraction unit extracts alarm information from the alarm information generated during the first period, excluding alarm information generated during both the first and second periods, and the learning unit learns the rule using the excluded alarm information.

3. The learning unit calculates a first evaluation value of the likelihood of a fault location based on alarms that have already occurred within the first period, and a second evaluation value of the likelihood of a fault location based on alarms that have already occurred within the second period, and determines which alarms from among the alarms that occurred within the first period will be used for learning the rules, according to claim 1.

4. An information processing method performed by an information processing device, comprising: an extraction unit of the information processing device extracting alarm information that has already occurred within a first period which is the time at which a failure occurred in the communication network and the period before and after said time, and alarm information that has already occurred within a second period which is not included in the first period; a learning unit of the information processing device learning rules for estimating failures that have occurred in the communication network based on the results of the extraction by the extraction unit; and an estimation unit of the information processing device estimating newly occurring failures in the communication network using newly occurring alarm information and the rules learned by the learning unit.

Images