Information processing apparatus and cause-and-effect model construction method

Abstract

This information processing apparatus constructs a cause-and-effect model for a communication network by using device nodes corresponding to random variables relating to the states of devices and observation nodes corresponding to random variables relating to log generation, and includes a calculating unit that: on the basis of observation data, extracts a plurality of devices that have generated logs in the communication network; and constructs the cause-and-effect model by using prior probabilities employing weights based on the number of generated logs for each device among the plurality of devices and conditional probabilities indicating degrees of influence from the device nodes to the observation nodes.

Description

Information processing device and method for constructing a causal model

[0001] This invention relates to a technique for estimating the location of anomalies in a communication network based on logs collected from the communication network.

[0002] For telecommunications carriers, understanding the nature of anomalies occurring within their networks and responding quickly are crucial. In this context, research is being conducted on early detection of anomalies within telecommunications networks and on estimating the location of these anomalies.

[0003] As a method for estimating anomalies, a method has been proposed that uses a Bayesian network to model the relationship between anomalies and the resulting changes in data within the communication network (called observed data) (called a causal model), and estimate the anomaly locations from the observed data during the anomaly (Non-Patent Literature 1).

[0004] For example, when a link is broken between routers, a log is generated indicating that communication with the opposing router is no longer possible. Therefore, the technology disclosed in Non-Patent Document 1, based on the assumption that a router malfunction only affects the observation data of the malfunctioning router and the observation data of routers physically adjacent to that router, constructs a causal model for devices in a communication network consisting of "device nodes" that represent the state of each device and "observation nodes" that indicate whether a log related to a link down was generated from that device, and uses this model to determine the location of the malfunction.

[0005] Furthermore, Non-Patent Document 2 describes the use of various logs in addition to link down logs to enable the estimation of the location of various anomalies within the communication network. For example, devices such as routers can input logs representing the status of devices such as the CPU, memory, and interface modules, as well as logs representing the status of protocols such as BGP and OSPF, into the causal model.

[0006] Srikanth Kandula, Dina Katabi, and Jean-philippe Vasseur. Shrink: A tool for failure diagnosis in IP networks. Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data, pages 173-178, 2005. H. Yan, L. Breslau, Z. Ge, D. Massey, D. Pei and J. Yates, "G-RCA: A Generic Root Cause Analysis Platform for Service Quality Management in Large IP Networks," in IEEE / ACM Transactions on Networking, vol. 20, no. 6, pp. 1734-1747, Dec. 2012, doi: 10.1109 / TNET.2012.2188837.

[0007] When a failure occurs, various logs are generated, including logs related to the router's package status, logs related to the router's interface status, and logs related to the status of protocols such as OSPF and BGP.

[0008] However, in the technologies disclosed in Non-Patent Documents 1 and 2, the observation node is binary, and only whether a log occurred or not can be considered. Here, by increasing the value range of the observation node, for example to k, it is possible to consider the number of log occurrences up to k.

[0009] However, this approach only considers up to k values, and has the drawback of not being able to account for cases where k+1 logs occur. Furthermore, increasing the range of observed nodes, for example to k values, increases the computational cost required to build the causal model.

[0010] As a result, there is a problem in that the circumstances under which logs are generated cannot be properly considered, leading to a decrease in the accuracy of fault location estimation.

[0011] The present invention has been made in view of the above points, and an object thereof is to provide a technique for constructing a causal model with improved estimation accuracy of a failure location in a communication network.

[0012] According to the disclosed technique, in a communication network, an information processing apparatus constructs a causal model using device nodes corresponding to random variables related to device states and observation nodes corresponding to random variables related to log occurrence, the information processing apparatus comprising an arithmetic unit that extracts a plurality of devices that generated logs in the communication network based on observation data, and constructs the causal model using a prior probability based on a weight derived from the number of generated logs for each of the plurality of devices, and a conditional probability indicating the degree of influence from the device nodes to the observation nodes.

[0013] According to the disclosed technique, a technique for constructing a causal model with improved estimation accuracy of a failure location in a communication network is provided.

[0014] This is a diagram illustrating a configuration example of an abnormal location estimation device 100. This is a diagram illustrating an example of a communication network that is a target for constructing a causal model. This is a diagram illustrating an example of a causal model. This is a diagram illustrating a functional configuration example of an information processing apparatus 200. This is a diagram illustrating a hardware configuration example of the apparatus.

[0015] Hereinafter, an embodiment (the present embodiment) of the present invention will be described with reference to the drawings. The embodiment described below is merely an example, and embodiments to which the present invention is applied are not limited to the following embodiment.

[0016] Hereinafter, a causal model construction technique that improves estimation accuracy by taking the amount of log generation into account in a method of estimating an abnormal location in a communication network using logs collected from the communication network will be described.

[0017] (Example of device configuration) Figure 1 shows an example of the configuration of the anomaly location estimation device 100 in this embodiment. As shown in Figure 1, the anomaly location estimation device 100 includes an observation data collection engine 160, an observation data DB 140, a connection relationship DB 170, a causal model construction engine 110, a prior probability correction engine 130, a causal model inference engine 120, and an output interface 150 to the user.

[0018] The observation data collection engine 160, the prior probability correction engine 130, the causal model construction engine 110, and the causal model inference engine 120 may also be referred to as the observation data collection unit 160, the prior probability correction unit 130, the causal model construction unit 110, and the causal model inference unit 120, respectively. Alternatively, the observation data collection engine 160, the prior probability correction engine 130, the causal model construction engine 110, and the causal model inference engine 120 may also be referred to as the observation data collection circuit 160, the prior probability correction circuit 130, the causal model construction circuit 110, and the causal model inference circuit 120, respectively.

[0019] The operation overview of the abnormal location estimation device 100 is as follows.

[0020] The observation data collection engine 160 collects observation data from the communication network and stores it in the observation data DB 140. The causal model construction engine 110 constructs a causal model based on the connection information stored in the connection relationship DB 170. The prior probability correction engine 130 corrects the prior probability based on the occurrence status of the logs stored in the observation data DB 140.

[0021] The causal model inference engine 120 uses a causal model to determine the values ​​of observation nodes based on the occurrence status of logs stored in the observation data DB 140, estimates the location of anomalies, and outputs the estimation results to the output interface 150.

[0022] The output interface 150 displays to the user the location of the anomaly within the system and the maximum posterior probability at that time. Furthermore, when a new machine is added to the operational system, the user can use the output interface 150 to modify the causal graph by adding nodes and the resulting changes in causal relationships.

[0023] The abnormal location estimation device 100 may be a single device (computer) or a system consisting of multiple devices.

[0024] The operation of the anomaly location estimation device 100 will be described in more detail below. While this embodiment assumes a communication network composed of routers, this is merely an example. The technology according to the present invention is applicable regardless of the type of equipment constituting the communication network.

[0025] (Regarding the causal model) Before describing the technology according to the present invention, we will first describe the operations related to the construction of a causal model based on the prior art described in Non-Patent Document 1, etc. In the description of the prior art, the causal model construction engine 110 and the causal model inference engine 120 shown in Figure 1 will be assumed to perform operations based on the prior art.

[0026] Figure 2 shows an example of a communication network for which a causal model will be constructed. This corresponds to the connectivity relationships at the physical layer. As shown in Figure 2, this communication network is a network in which routers 1 to 6 are connected as shown in the figure. For example, router 1 and router 2 are directly connected and are adjacent to each other. Router 1 and router 4 are not directly connected and are not adjacent to each other.

[0027] The causal model construction engine 110 constructs the causal model shown in Figure 3 for the communication network (physical layer network) shown in Figure 2. The causal model consists of device nodes representing the state of each device (router) in the communication network, and observation nodes indicating whether a log (e.g., a syslog related to link down) was generated from that device. In other words, the observation nodes represent the observation results for each device. The causal model may also be called a Bayesian network.

[0028] For example, in the causal model shown in Figure 3, Router 1 of the equipment node is connected to Routers 1 and 2 of the observation nodes. This indicates that if an anomaly occurs in Router 1, it may affect the observation data of Router 1 and Router 2.

[0029] Furthermore, for example, in the causal model shown in Figure 3, router 2 of the equipment node is connected to routers 1, 2, 3, and 6 of the observation nodes. This indicates that if an anomaly occurs in router 2, it may affect the observation data of routers 1, 2, 3, and 6. The causal model will be explained in more detail below.

[0030] When the number of devices in a communication network is N, both the number of device nodes and the number of observation nodes are N, and for a certain device i, the device node x ｉ and the observation node y corresponding to that instrument ｉ Each device node x exists. ｉ (i = 1, ..., N) is a binary random variable, where 0 represents a normal state and 1 represents an abnormal state. Let X represent the entire set of device nodes. Similarly, observation nodes are also binary random variables, where 0 represents no logs generated from the device and 1 represents logs generated. Let Y represent the entire set of observation nodes. Note that using binary random variables for both device nodes and observation nodes is just one example; other types of random variables may also be used.

[0031] Next, the device nodex ｉ The likelihood of taking a particular state is defined using prior probabilities by the following equation.

[0032] Here, δ is the Kronecker delta, a function that returns 1 if the input is true and 0 otherwise. α is a hyperparameter between 0 and 1. P(x) in equation (1) ｉ |α) represents the likelihood of equipment i becoming abnormal. For example, if α = 0.2, it means that equipment i will be in a normal state 80% of the time. This α is determined by the operator's knowledge and by preparing data for hyperparameter tuning.

[0033] Next, we check whether there is any influence from the instrument node to the observation node x ｉ and observation node y ｊ We will represent this using the edges in between, and define the set E as follows.

[0034] Here, neigh(i) is a function that returns adjacent devices of device i, and for each device node, it indicates that edges are drawn between the observation node corresponding to that device and the observation nodes corresponding to the adjacent nodes of that device. This represents the assumption that "a router anomaly only affects the observation data of the router that has entered an abnormal state and the observation data of routers physically adjacent to said router".

[0035] Then, for each edge, the degree of influence from the device node to the observation node is expressed by the conditional probability shown in the following formula (2), formula (3), or formula (4).

[0036] Here, φ ｉ，ｊ is a function that returns 0 or 1 depending on the presence or absence of an edge, β is a hyperparameter, and C is a normalization constant. β is determined by preparing operator knowledge and data for hyperparameter tuning, and is a hyperparameter independent of i and j, not a value set for each device node.

[0037] The expression inside Π on the right side of formula (2) indicates that when an edge exists between the device node and the observation node, and the state of the device node and the state of the observation node are the same, the value of β is taken. Formula (3) is obtained by swapping X and y using Bayes' theorem with respect to the left side of formula (2). ｊ

[0038] The causal model construction engine 110 constructs a causal model based on the prior probability of formula (1) and the conditional probability of formula (4).

[0039] During testing, the causal model inference engine 120 determines the state Y of all observation nodes based on the presence or absence of log occurrence, and the state of each device ～ X is estimated by calculating the following formula (5). That is, when Y, β, Φ, and the prior probability P(X|α) are given, "P(X|y ｊ , β, φ ｊ ) P(X|α)" to find x that maximizes the total product ｉ (i=1, ..., N). P(X|y ｊ , β, φ ｊ ) can be obtained from the above formula (2).​

[0040] In conventional technology, when the causal model building engine 110 builds a causal model, for example, "P(x １ , ..., x Ｎ | ｊ ,β,φ ｊ The task is to calculate P(X|α) for each state of each device.

[0041] To solve equation (5), P(X | y ｊ ,β,φ ｊ In the part of ), y ｊ For this, we need to calculate the joint probability for each state of all devices. Since there are N devices and 2 states, we need to calculate 2 to the power of N ways. However, φ ｉ，ｊ For parts where there are no edges, the probability becomes 0, and in that case, the expression inside π on the right side of equation (2) becomes 1. Therefore, in reality, we only need to calculate the joint probability for the parts where there are edges. This reduces the amount of computation.

[0042] (Regarding the issue) When a failure occurs, various logs are generated, such as logs regarding the status of the router's packages, logs regarding the status of the router's interfaces, and logs regarding the status of protocols such as OSPF and BGP.

[0043] However, in the technologies disclosed in Non-Patent Documents 1 and 2, the observation node is binary, and only whether a log occurred or not can be considered. Here, by increasing the value range of the observation node, for example to k, it is possible to consider the number of log occurrences up to k.

[0044] However, this approach has the drawback that it can only consider up to k values, and cannot account for cases where k+1 logs occur.

[0045] Furthermore, in equation (3), the conditional probability P(x) １ , ..., x Ｎ | ｊ ,β,φ ｊ ) needs to be calculated in advance, but y ｊWhen the range of k is k, the number of cases to be calculated becomes 2 to the power of N multiplied by k, and there is a problem in that making the value of k very large increases the computational complexity.

[0046] As a result, there is a problem in that the circumstances under which logs are generated cannot be properly considered, leading to a decrease in the accuracy of fault location estimation.

[0047] Furthermore, logs related to interfaces and protocols often contain information about the opposing device. For example, if device A fails, the opposing device B may have important information for identifying the fault location, such as that the interface of device A has gone down. However, existing methods have the problem of not being able to take this information into consideration.

[0048] (Technology related to this embodiment) In this embodiment, when a failure occurs in a communication network, logs are generated only from the faulty device and the devices connected to it, but by using the natural law that the faulty device generates a large number of logs, the accuracy of estimating the faulty device is improved without considering the type of log. Specifically, it is as follows.

[0049] In the technologies disclosed in Non-Patent Documents 1 and 2, the prior probability in equation (1) is defined solely by the hyperparameter α. In contrast, in this embodiment, after setting the prior probability with α, the causal model construction engine 110 constructs a causal model, and the prior probability correction engine 130 modifies the value of the prior probability in the causal model by referring to the observation data DB 140 and considering the amount of log occurrences. The causal model construction engine 110 then constructs the causal model using the modified prior probability. This solves the problem. Alternatively, the prior probability correction engine 130 may calculate a value of the prior probability that considers the amount of log occurrences from the beginning, and the causal model construction engine 110 may then construct the causal model using that prior probability. Details will be explained below.

[0050] First, in a communication network, when a device failure occurs, the device that generated the log is x ｋLet k = 1, ..., K, k ∈ Q. K is the number of devices that generated logs, and Q is the set of devices that generated logs. The devices that generated logs can be extracted from the observation data DB140. Note that the device that generates a log differs each time a failure occurs, so x ｋ The equipment represented by will be different each time a failure occurs. Let A be the total number of logs, and assume that the following equation is satisfied.

[0051] Here, L(•) is x ｋ This function returns the number of logs generated from [the source].

[0052] Next, the prior probability is calculated using the following formula. As shown below, formula (6) is used only for devices where logs were generated, and the original formula (1) is used for all others.

[0053] In equation (6) below, w ｋ δ for α is (w ｋ This relates to α), and (1-w ｋ δ for (1-α) is ((1-w ｋ This relates to (1-α).

[0054] Here, w is a weight calculated considering the number of log occurrences, and is calculated using the following formula.

[0055] As a result, for devices that generate a large amount of logs, x ｋ The probability of the case where = 1 is x ｋ The probability becomes larger compared to the case where the value is 0, resulting in improved estimation accuracy.

[0056] Also, weight lol ｋ This can also be determined using other methods. If there is a device with an extremely high number of logs among the devices that generated the logs, then the other devices will be checked. ｋ The number of logs is decreasing, and as a result, even though logs are being generated, x ｋ The probability of = 1 becomes small. Therefore, the threshold (α) is set as follows. δ（ｘ＿ｋ＝１） ) may be provided. According to the following formula, P(x ｋ = 1 | α) is α δ（ｘ＿ｋ＝１） The values ​​are as above.

[0057] Additionally, weights can be assigned using functions. For example, the sigmoid function can be used to calculate the weights as shown in the following equation.

[0058] Here, `sigmoid` is the sigmoid function, and as described above, weights are assigned based on the difference from the average number of log occurrences. By using the sigmoid function, it is possible to avoid excessively large weighting of devices that generate a large number of logs. Alternatively, as shown below, weighting may also be applied to deviations from the mean.

[0059]

[0060] As described above, the device x from which the log was generated ｋ When constructing a causal model using prior probabilities for (k=1, ..., K), the causal model construction engine 110 calculates "P(x １ , ..., x Ｎ | ｋ ,β,φ ｋ The causal model is constructed using )P(X|α) and the device x from which the log originated. ｋ The procedure is performed on (k=1, ..., K).

[0061] In other words, the causal model construction engine 110 extracts multiple devices that generated logs from the observation data DB 140, and constructs a causal model using multiple device nodes corresponding to those multiple devices and multiple observation nodes corresponding to those multiple devices, based on the connection relationships between those multiple devices.

[0062] Next, let's look at another example. x ｋ Regarding A, instead of using the devices that generated the logs and their total number, it may be used to include the opposing devices mentioned in the logs. When a device failure occurs, the device that generated the log or the device mentioned in the opposing information of the log should be x ｋ Let k = 1, ..., K'. Here, K' is the total number of devices that generated logs or were listed in the opposing information. Let A' be the total number of logs, and calculate A' using the following formula.

[0063] Here, L(•) is x ｋThis function returns the number of logs generated from, where L'(•) is the opposing device in the log, x ｋ This function returns the number of logs containing that item. This allows us to take into account whether or not a device was present as the opposing device.

[0064] Then, the prior probability is calculated as follows. In the formula below, w' ｋ δ for α is (w' ｋ This relates to α), and (1-w' ｋ δ for (1-α) is ((1-w') ｋ This relates to (1-α). As in the case described above, for calculating the prior probability, the following formula is used only for "the device that generated the log or the opposing device mentioned in the log," and formula (1) is used for all others.

[0065] Here, γ is a hyperparameter used for weighting and can be any non-negative real number. Also, as mentioned above, weighting can be done using the sigmoid function. That is, "w ｋ =sigmoid((L(x ｋ ) + γL'(x ｋ )) - A' / K') is used for calculation. Also, as in the case mentioned above, "w ｋ =sigmoid(ρ((L(x ｋ ) + γL'(x ｋ You can also calculate it as )) - A' / K'))

[0066] As described above, by modifying the prior probability by considering the number of log occurrences and whether or not they are recorded in the information of the opposing device, it becomes possible to input information beyond just whether or not a log occurred, and as a result, the estimated probability of the fault location can be improved.

[0067] As described above, x is "the device from which the log was generated or the opposing device mentioned in the log". ｋ When constructing a causal model using prior probabilities for (k=1, ..., K'), the causal model construction engine 110 calculates "P(X|y ｊ ,β,φ ｊ The construction of a causal model using )P(X|α) is x ｋThe procedure is performed on (k=1, ..., K').

[0068] In other words, the causal model construction engine 110 extracts multiple devices from the observation data DB 140 that consist of "devices where logs were generated or opposing devices mentioned in the logs," and constructs a causal model using multiple device nodes corresponding to those devices and multiple observation nodes corresponding to those devices, based on the connection relationships between those multiple devices.

[0069] (Example of device configuration) Figure 4 shows an example of the functional configuration of the information processing device 200. The information processing device 200 corresponds to an observation data collection engine 160, a causal model construction engine 110, a prior probability correction engine 130, or a causal model inference engine 120. The information processing device 200 may also be a device that corresponds to "causal model construction engine 110 + prior probability correction engine 130". The information processing device 200 may also be a device that corresponds to "causal model construction engine 110 + prior probability correction engine 130 + causal model inference engine 120".

[0070] As shown in Figure 4, the information processing device 200 includes an input unit 210, an arithmetic unit 220, an output unit 230, and a data storage unit 240. The information processing device 200 may also be called an information processing system 200. The information processing device 200 may also be a device (which may also be called a system) consisting of multiple computing devices (computers).

[0071] In the information processing device 200, data (e.g., observation data, connection relationships) is input from the input unit 210, and the calculation unit 220 performs calculations such as constructing a causal model. The output unit 230 outputs the data obtained by the calculation unit 120.

[0072] The data storage unit 240 stores, for example, predetermined parameters. The calculation unit 220 reads the parameters from the data storage unit 240 and uses them for calculations. The calculation unit 220 includes the function of receiving data via the input unit 210 and the function of transmitting data via the output unit 230.

[0073] (Example Hardware Configuration) Any of the devices described in this embodiment (anomaly location estimation device 100, information processing device 200) can be realized, for example, by having a computer execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0074] In other words, the device can be realized by using hardware resources such as the CPU and memory built into a computer to execute a program corresponding to the processing performed by the device. The program can be recorded on a computer-readable recording medium (such as portable memory), saved, and distributed. It can also be provided via a network, such as the Internet or email.

[0075] Figure 5 shows an example of the hardware configuration of the computer described above. The computer in Figure 5 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., all of which are interconnected by bus B. The computer may also be equipped with a GPU.

[0076] The program that enables processing on the computer is provided on a recording medium 1001, such as a CD-ROM or memory card. When the recording medium 1001 containing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001; it may also be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files and data.

[0077] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when a program startup command is received. The CPU 1004 implements the functions related to the memory device 1003 according to the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) etc., based on a program. The input device 1007 consists of a keyboard and mouse, buttons, or a touch panel, etc., and is used to input various operation commands. The output device 1008 outputs the calculation results.

[0078] Furthermore, the functions of the elements disclosed herein may be implemented using circuits or processing circuitry that include general-purpose processors, special-purpose processors, integrated circuits, ASICs (Application Specific Integrated Circuits), FPGAs (Field Programmable Gate Arrays), conventional circuits, and / or combinations thereof that are programmed using one or more programs stored in one or more memories, or otherwise configured to perform the disclosed functions. A processor is considered processing circuitry or circuitry because it includes transistors and other circuits. A processor may be a programmed processor that executes programs stored in memory. In this disclosure, a circuit, unit, or means is hardware that performs the enumerated functions, or hardware programmed to perform the enumerated functions. Hardware may be any hardware disclosed herein that is programmed or configured to perform the enumerated functions.

[0079] The system includes memory for storing a computer program containing computer instructions. These computer instructions provide logic and routines that enable hardware (e.g., processing circuitry or circuitry) to perform the methods disclosed herein. The computer program can be implemented in commonly known forms, such as computer-readable storage media, computer program products, memory devices, recording media such as CD-ROMs and DVDs, and / or memory in FPGAs and ASICs.

[0080] (Summary of Embodiments, Effects, etc.) As described above, the technology described in this embodiment makes it possible to construct a causal model that improves the accuracy of estimating fault locations in communication networks. As a result, operators can accurately estimate the locations of abnormalities within the communication network.

[0081] The following additional information is disclosed regarding the embodiments described above.

[0082] <Notes> (Note 1) An information processing device that constructs a causal model in a communication network using device nodes corresponding to random variables relating to the state of devices and observation nodes corresponding to random variables relating to log generation, comprising an information processing device that extracts a plurality of devices that have generated logs in the communication network based on observation data, and constructs the causal model using a prior probability based on weights based on the number of generated logs for each of the plurality of devices, and a conditional probability indicating the degree of influence from the device node to the observation node. (Note 2) An information processing device that constructs a causal model in a communication network using device nodes corresponding to random variables relating to the state of devices and observation nodes corresponding to random variables relating to log generation, comprising an information processing device that extracts a plurality of devices in the communication network consisting of devices that have generated logs or devices included as opposing devices in the logs, based on observation data, and constructs the causal model using a prior probability based on weights based on the number of generated logs for the devices that have generated the logs and the number of logs for the devices included as opposing devices in the logs, and a conditional probability indicating the degree of influence from the device node to the observation node. (Note 3) The information processing device according to Note 1 or 2, wherein the calculation unit calculates the weights in the prior probability using a sigmoid function. (Note 4) A method for constructing a causal model executed by an information processing device that constructs a causal model in a communication network using device nodes corresponding to random variables relating to the state of devices and observation nodes corresponding to random variables relating to the occurrence of logs, wherein the method extracts a plurality of devices that have generated logs in the communication network based on observation data, and constructs the causal model using a prior probability using weights based on the number of logs generated for each of the plurality of devices and a conditional probability indicating the degree of influence from the device node to the observation node.

[0083] Although this embodiment has been described above, the present invention is not limited to this specific embodiment, and various modifications and changes are possible within the scope of the gist of the invention as described in the claims.

[0084] 100 Anomaly Location Estimation Device 110 Causal Model Construction Engine 120 Causal Model Inference Engine 130 Prior Probability Correction Engine 140 Observation Data DB 150 Output Interface 160 Observation Data Collection Engine 170 Connection Relationship DB 200 Information Processing Device 210 Input Unit 220 Calculation Unit 230 Output Unit 240 Data Storage Unit 1000 Drive Device 1001 Recording Medium 1002 Auxiliary Storage Device 1003 Memory Device 1004 CPU 1005 Interface Device 1006 Display Device 1007 Input Device 1008 Output Device

Claims

1. An information processing device that constructs a causal model in a communication network using device nodes corresponding to random variables relating to the state of devices and observation nodes corresponding to random variables relating to log generation, the information processing device comprising: an information processing device that extracts a plurality of devices that generated logs in the communication network based on observation data, and constructs the causal model using prior probabilities based on weights based on the number of logs generated for each of the plurality of devices and conditional probabilities indicating the degree of influence from the device nodes to the observation nodes.

2. An information processing device for constructing a causal model in a communication network using device nodes corresponding to random variables relating to the state of devices and observation nodes corresponding to random variables relating to log generation, the information processing device comprising: an information processing device for constructing the causal model using a prior probability based on weights based on the number of logs generated by the device that generated the log and the number of logs for the devices included as opposing devices in the log, and a conditional probability indicating the degree of influence from the device node to the observation node.

3. The information processing apparatus according to claim 1 or 2, wherein the calculation unit calculates the weights in the prior probability using a sigmoid function.

4. A method for constructing a causal model executed by an information processing device that constructs a causal model in a communication network using device nodes corresponding to random variables relating to the state of devices and observation nodes corresponding to random variables relating to the generation of logs, the method comprising: extracting a plurality of devices that generated logs in the communication network based on observation data; and constructing the causal model using a prior probability based on the number of logs generated for each of the plurality of devices and a conditional probability indicating the degree of influence from the device node to the observation node.

Images