Information processing device and causal model construction method
Patent Information
- Application Number
- PCT/JP2025/015319
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2025-04-18
- Publication Date
- 2026-10-22
Smart Images
Figure JP2025015319_22102026_PF_FP_ABST
Abstract
Description
Information processing device and method for constructing a causal model
[0001] This invention relates to a technique for estimating the location of anomalies in a communication network based on logs collected from the communication network.
[0002] For telecommunications carriers, understanding the nature of anomalies occurring within their networks and responding quickly are crucial. In this context, research is being conducted on early detection of anomalies within telecommunications networks and on estimating the location of these anomalies.
[0003] As a method for estimating anomalies, a method has been proposed that uses a Bayesian network to model the relationship between anomalies and the resulting changes in data within the communication network (called observed data) (called a causal model), and estimate the anomaly locations from the observed data during the anomaly (Non-Patent Literature 1).
[0004] For example, when a link is broken between routers, a log is generated indicating that communication with the opposing router is no longer possible. Therefore, the technology disclosed in Non-Patent Document 1, based on the assumption that a router malfunction only affects the observation data of the malfunctioning router and the observation data of routers physically adjacent to that router, constructs a causal model for devices in a communication network consisting of "device nodes" that represent the state of each device and "observation nodes" that indicate whether a log related to a link down was generated from that device, and uses this model to determine the location of the malfunction.
[0005] Furthermore, Non-Patent Document 2 describes the use of various logs in addition to link down logs to enable the estimation of the location of various anomalies within the communication network. For example, devices such as routers can input logs representing the status of devices such as the CPU, memory, and interface modules, as well as logs representing the status of protocols such as BGP and OSPF, into the causal model.
[0006] Srikanth Kandula, Dina Katabi, and Jean-philippe Vasseur. Shrink: A tool for failure diagnosis in IP networks. Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data, pages 173-178, 2005. H. Yan, L. Breslau, Z. Ge, D. Massey, D. Pei and J. Yates, "G-RCA: A Generic Root Cause Analysis Platform for Service Quality Management in Large IP Networks," in IEEE / ACM Transactions on Networking, vol. 20, no. 6, pp. 1734-1747, Dec. 2012, doi: 10.1109 / TNET.2012.2188837.
[0007] Non-patent documents 1 and 2 both assume that a router malfunction only affects the observation data of the malfunctioning router and the observation data of routers physically adjacent to it. Using this assumption, calculations for constructing causal models can be performed without problems for small-scale communication networks with few adjacent devices. On the other hand, calculations become impossible for large-scale communication networks with many adjacent devices.
[0008] This invention has been made in view of the above points, and aims to provide a technology that enables the construction of a causal model for a large-scale communication network with a large number of devices.
[0009] According to the disclosed technology, an information processing device is provided that constructs a causal model in a communication network using device nodes corresponding to random variables relating to the state of devices and observation nodes corresponding to random variables relating to the generation of logs, the information processing device comprising a calculation unit that constructs the causal model using prior probabilities indicating the likelihood of abnormal states occurring in a plurality of devices in the communication network and conditional probabilities indicating the degree of influence from device nodes to observation nodes in the plurality of devices, the conditional probabilities being divided by the product.
[0010] The disclosed technology provides a mechanism for constructing causal models for large-scale communication networks with a large number of devices.
[0011] This figure shows an example configuration of the anomaly location estimation device 100. This figure shows an example of a communication network to which a causal model is to be constructed. This figure shows an example of a causal model. This figure shows an example of conditional probability. This figure shows an example of conditional probability. This figure shows an example of the functional configuration of the information processing device 200. This figure shows an example of the hardware configuration of the device.
[0012] Hereinafter, embodiments of the present invention (this embodiment) will be described with reference to the drawings. The embodiments described below are merely examples, and the embodiments to which the present invention is applied are not limited to the embodiments described below.
[0013] The following describes a causal model construction technique that considers scalability for application to large-scale communication networks with a large number of devices, in a method for estimating anomalies in communication networks using logs collected from the communication network.
[0014] (Example of device configuration) Figure 1 shows an example of the configuration of the anomaly location estimation device 100 in this embodiment. As shown in Figure 1, the anomaly location estimation device 100 includes an observation data collection engine 160, an observation data DB 140, a connection relationship DB 170, a causal model construction engine 110, a causal model partitioning engine 130, a causal model inference engine 120, and an output interface 150 to the user.
[0015] The observation data acquisition engine 160, causal model splitting engine 130, causal model construction engine 110, and causal model inference engine 120 may also be referred to as the observation data acquisition unit 160, causal model splitting unit 130, causal model construction unit 110, and causal model inference unit 120, respectively. Alternatively, the observation data acquisition engine 160, causal model splitting engine 130, causal model construction engine 110, and causal model inference engine 120 may also be referred to as the observation data acquisition circuit 160, causal model splitting circuit 130, causal model construction circuit 110, and causal model inference circuit 120, respectively.
[0016] The operation overview of the abnormal location estimation device 100 is as follows.
[0017] The observation data collection engine 160 collects observation data from the communication network and stores it in the observation data DB 140. The causal model partitioning engine 130 performs partitioning of conditional probabilities if the order of the conditional probabilities in the constructed causal model exceeds a threshold. Details of the partitioning will be described later. Note that partitioning of conditional probabilities may be performed without performing a threshold judgment.
[0018] The causal model construction engine 110 constructs a causal model using conditional probabilities obtained through partitioning, based on connection information received from the connection relationship DB 170.
[0019] The causal model inference engine 120 uses the constructed causal model to determine the values of observation nodes based on the occurrence status of logs stored in the observation data DB 140, estimates the location of anomalies, and outputs the estimation results to the output interface 150.
[0020] The output interface 150 displays to the user the location of the anomaly within the system and the maximum posterior probability at that time. Furthermore, when a new machine is added to the operational system, the user can use the output interface 150 to modify the causal graph by adding nodes and the resulting changes in causal relationships.
[0021] The abnormal location estimation device 100 may be a single device (computer) or a system consisting of multiple devices.
[0022] The operation of the anomaly location estimation device 100 will be described in more detail below. While this embodiment assumes a communication network composed of routers, this is merely an example. The technology according to the present invention is applicable regardless of the type of equipment constituting the communication network.
[0023] (Regarding the causal model) Before describing the technology according to the present invention, we will first describe the operations related to the construction of a causal model based on the prior art described in Non-Patent Document 1, etc. In the description of the prior art, the causal model construction engine 110 and the causal model inference engine 120 shown in Figure 1 will be assumed to perform operations based on the prior art.
[0024] Figure 2 shows an example of a communication network for which a causal model will be constructed. This corresponds to the connectivity relationships at the physical layer. As shown in Figure 2, this communication network is a network in which routers 1 to 6 are connected as shown in the figure. For example, router 1 and router 2 are directly connected and are adjacent to each other. Router 1 and router 4 are not directly connected and are not adjacent to each other.
[0025] The causal model construction engine 110 constructs the causal model shown in Figure 3 for the communication network (physical layer network) shown in Figure 2. The causal model consists of device nodes representing the state of each device (router) in the communication network, and observation nodes indicating whether a log (e.g., a syslog related to link down) was generated from that device. In other words, the observation nodes represent the observation results for each device. The causal model may also be called a Bayesian network.
[0026] For example, in the causal model shown in Figure 3, Router 1 of the equipment node is connected to Routers 1 and 2 of the observation nodes. This indicates that if an anomaly occurs in Router 1, it may affect the observation data of Router 1 and Router 2.
[0027] Furthermore, for example, in the causal model shown in Figure 3, router 2 of the equipment node is connected to routers 1, 2, 3, and 6 of the observation nodes. This indicates that if an anomaly occurs in router 2, it may affect the observation data of routers 1, 2, 3, and 6. The causal model will be explained in more detail below.
[0028] When the number of devices in a communication network is N, both the number of device nodes and the number of observation nodes are N, and for a certain device i, the device node x ｉ and the observation node y corresponding to that instrument ｉ Each device node x exists. ｉ (i = 1, ..., N) is a binary random variable, where 0 represents a normal state and 1 represents an abnormal state. Let X represent the entire set of device nodes. Similarly, observation nodes are also binary random variables, where 0 represents no logs generated from the device and 1 represents logs generated. Let Y represent the entire set of observation nodes. Note that using binary random variables for both device nodes and observation nodes is just one example; other types of random variables may also be used.
[0029] Next, the device nodex ｉ The ease with which a state can be reached is defined using prior probabilities by the following equation.
[0030] Here, δ is the Kronecker delta, a function that returns 1 if the input is true and 0 otherwise. α is a hyperparameter between 0 and 1. P(x) in equation (1) ｉ |α) represents the likelihood of equipment i becoming abnormal. For example, if α = 0.2, it means that equipment i will be in a normal state 80% of the time. This α is determined by the operator's knowledge and by preparing data for hyperparameter tuning.
[0031] Next, we check whether there is any influence from the instrument node to the observation node x ｉ and observation node y ｊ We will represent this using the edges in between, and define the set E as follows.
[0032] Here, neig(i) is a function that returns the neighboring devices of device i, and for each device node, it indicates that edges are drawn between the observation node corresponding to that device and the observation nodes corresponding to the neighboring nodes of that device. This represents the assumption that "a router anomaly only affects the observation data of the router that has entered an abnormal state and the observation data of routers physically adjacent to said router".
[0033] Then, for each edge, the degree of influence from the device node to the observation node is expressed by the conditional probability shown in the following formula (2), formula (3), or formula (4).
[0034] Here, φ ｉ，ｊ is a function that returns 0 or 1 depending on the presence or absence of an edge, β is a hyperparameter, and C is a normalization constant. β is determined by preparing operator knowledge and data for hyperparameter tuning, and is a hyperparameter independent of i and j, not a value set for each device node.
[0035] The expression inside Π on the right side of formula (2) indicates that when an edge exists between the device node and the observation node, and the state of the device node and the state of the observation node are the same, the value of β is taken. Formula (3) is obtained by swapping X and y on the left side of formula (2) using Bayes' theorem ｊ .
[0036] The causal model construction engine 110 constructs a causal model based on the prior probability of formula (1) and the conditional probability of formula (4).
[0037] During testing, the causal model inference engine 120 determines the state Y of all observation nodes based on the presence or absence of log occurrence, and the state of each device ～ X is estimated by calculating the following formula (5). That is, when Y, β, Φ, and the prior probability P(X|α) are given, "P(X|y ｊ , β, φ ｊ )P(X|α)" to find x that maximizes the total product ｉ (i=1, ..., N). P(X|y ｊ , β, φ ｊ ) can be obtained from the above formula (2).
[0038] In conventional technology, when the causal model building engine 110 builds a causal model, for example, "P(x １ , ..., x Ｎ | ｊ ,β,φ ｊ The task is to calculate P(X|α) for each state of each device.
[0039] To solve equation (5), P(X | y ｊ ,β,φ ｉ，ｊ In the part of ), y ｊ For this, we need to calculate the joint probability for each state of all devices. Since there are N devices and 2 states, we need to calculate 2 to the power of N ways. However, φ ｉ，ｊ For parts where there are no edges, the probability becomes 0, and in that case, the expression inside π on the right side of equation (2) becomes 1. Therefore, in reality, we only need to calculate the joint probability for the parts where there are edges.
[0040] (Regarding the problem) Non-patent documents 1 and 2 both assume that a router malfunction only affects the observed data of the malfunctioning router and the observed data of routers physically adjacent to it. Using this assumption, equation (3) only requires calculating the conditional probability of a certain part of the edge, so it works without problems for small communication networks with few adjacent devices. On the other hand, it becomes impossible to perform calculations for large communication networks with many adjacent devices.
[0041] For example, if the adjacent device to device j is x １ , ..., x ２９ If that is the case, then equation (3) is P(x １ , ..., x ２９ | ｊ ,β,φ ｊ Therefore, in constructing a causal model, it is necessary to set the joint probability of the values in the case of 2 to the power of 30. That is, y ｊ For each case where the value is 0 or 1, there are 29 device nodes, each of which can be either 0 or 1, so the result is 2 to the power of 30.
[0042] Calculating 2 to the power of 30 values may be impossible depending on the server's processing power. Core routers used in large-scale networks may have more than 100 interfaces, but since 2 to the power of 100 is generally impossible to calculate, there is a problem in that calculations cannot be performed for communication networks using such routers.
[0043] (Technology related to this embodiment) In this embodiment, the causal model partitioning engine 130 partitions the conditional probability in equation (3) and replaces the conditional probability with an approximate value, thereby reducing the computational complexity of the joint probability.
[0044] Let's explain a specific example of partitioning a conditional probability. For example, the conditional probability P(x) shown in Figure 4. １ , x ２ , x ３ | １ Consider P(x). １ , x ２ , x ３ | １ ) in x １ , x ２ , x ３ , y １ Each of these is a binary value, either 0 or 1, and P(x １ , x ２ , x ３ | １ ) is x １ = value and x ２ = value and x ３ = value and y １ = The probability that the value occurs, i.e., x １ , x ２ , x ３ , y １ This represents the joint probability for each variable. Since each random variable is binary, if there are no constraints on the values it can take, there are 2 to the power of 4 possible joint probabilities.
[0045] Here, P(x １ , x ２ , x ３ | １ As shown in Figure 5, P(x １ | １ )P(x ２ , x ３ | １), the 2⁴ possible joint probabilities can be reduced to at most 2³ or less possible joint probabilities, and the calculation for setting the joint probabilities can be reduced.
[0046] The reason why the number can be reduced to 2³ or less is as follows. P(x １ , x ２ , x ３ |y １ ) results in 2⁴ possible joint probabilities, P(x １ |y １ ) results in 2² possible joint probabilities, and P(x ２ , x ３ |y １ ) results in 2³ possible joint probabilities. However, since β in Equation (2) is a value independent of subscripts, to calculate P(x ２ , x ３ |y １ ), it is sufficient to calculate 2² possible joint probabilities by reusing the calculation results. Therefore, P(x １ , x ２ , x ３ |y １ ) is set as P(x １ |y １ ) P(x ２ , x ３ |y １ ), the number of joint probabilities to be calculated can be reduced to 2³ or less.
[0047] However, in general, P(x １ , x ２ , x ３ |y １ ) ≠ P(x １ |y １ ) P(x ２ , x ３ |y １ ), the result of Equation (2) differs between the case of performing division and the case of not performing division.
[0048] Accordingly, in the present embodiment, a division method is used that takes into account the natural law that the number of faulty devices occurring simultaneously in a communication network is at most a small positive number k or less. This solves the problem by reducing the amount of calculation without lowering the estimation accuracy of the faulty location. The specific processing content is as follows.
[0049] In a communication network, device failures do not occur frequently, so when estimating a failure location, the number of failed devices is one or two, and from Equation (5), the target value is not the probability value itself, but x obtained by argmax ｉ We focus on the fact that it is the value of .
[0050] Therefore, x ｉ With regard to, for example, P(x １ =1, x ２ =1, x ３ =1)=0, the equation (3) is transformed so that the value obtained by argmax does not change even if division is performed by adding the constraint of =0. Note that P(x １ =1, x ２ =1, x ３ =1)=0 means "the probability that x １ =1 and x ２ =1 and x ３ =1 is 0". Specifically, the causal model division engine 130 divides the conditional probability P(x １ , ..., x Ｎ |y ｊ , β, φ ｊ ) as shown in the following Equation (6).
[0051] Here, k is a hyperparameter that specifies the maximum dimension of the joint probability distribution for x.
[0052] Assuming that k=2 and N=4, P(x １ , ..., x ４ |y ｊ , β, φ ｊ ) becomes "P(x １ , x ２ |y ｊ , β, φ ｊ ) P(x ３ , x ４ |y ｊ , β, φ ｊ ) P(x １ , x ２ ) P(x ３ , x ４ )".
[0053] That is, "y ｊ,β,φ ｊ The condition is x １ , ..., x N The conditional probability about "y" is given by ｊ ,β,φ ｊ The result is divided into multiple conditional probabilities for k x that satisfy the condition ", and the product of multiple joint probabilities for k x.
[0054] Note that P(x １ , ..., x Ｍ ) is shown in equation (1) as "α δ（ｘ＿ｉ＝１） (1-α) δ（ｘ＿ｉ＝０） It can be calculated by the product of i to M.
[0055] h, P(x １ , ..., x ｋ ), P(x ｋ＋１ , ..., x ２ｋ ), ..., P(x Ｎ－ｋ＋１ , ..., x Ｎ In each of the following, x ｉ x = 1 ｉ This hyperparameter specifies the maximum number of elements. That is, P(x １ , ..., x ｋ ), P(x ｋ＋１ , ..., x ２ｋ ), ..., P(x Ｎ－ｋ＋１ , ..., x Ｎ In each of the following, x ｉ x = 1 ｉ Let the number of elements be up to h, where h is less than k.
[0056] k can be specified arbitrarily, but the larger k is, the fewer divisions there will be, and the closer it will be to the original equation (3). For this reason, one possible method is to calculate the dimension of the largest possible joint probability distribution that can be calculated in advance and set k to a value 3 less than that value. h represents the number of simultaneously failing devices to be considered, and is determined, for example, based on the number of devices that failed simultaneously in past failure cases.
[0057] This partition results in a required number of joint probability distributions being raised to the power of k+1. Therefore, that number is:
[0058] This value becomes smaller than the given value, and by appropriately setting k, calculations for constructing a causal model become possible. Note that neig(i) is a function that returns the number of devices adjacent to device i.
[0059] For example, the causal model building engine 110 uses equation (5) "P(X|y ｊ ,β,φ ｊ A causal model is constructed by calculating "P(X|α)" for each state of each device. However, "P(X|y ｊ ,β,φ ｊ ) (that is, "P(x １ , ..., x Ｎ | ｊ ,β,φ ｊ )) is divided by product according to equation (6). As mentioned above, this division reduces the amount of computation. Also, for each state of each device, x which is 1 at the same time ｉ There is a constraint that the number of elements must be less than or equal to h. This constraint also reduces the computational complexity.
[0060] (Example of device configuration) Figure 6 shows an example of the functional configuration of the information processing device 200. The information processing device 200 corresponds to an observation data collection engine 160, a causal model construction engine 110, a causal model partitioning engine 130, or a causal model inference engine 120. The information processing device 200 may also be a device that corresponds to "causal model construction engine 110 + causal model partitioning engine 130". The information processing device 200 may also be a device that corresponds to "causal model construction engine 110 + causal model partitioning engine 130 + causal model inference engine 120".
[0061] As shown in Figure 6, the information processing device 200 includes an input unit 210, an arithmetic unit 220, an output unit 230, and a data storage unit 240. The information processing device 200 may also be called an information processing system 200. The information processing device 200 may also be a device (which may also be called a system) consisting of multiple computing devices (computers).
[0062] In the information processing device 200, data (e.g., observation data, connection relationships) is input from the input unit 210, and the calculation unit 220 performs calculations such as conditional probability partitioning and causal model construction. The output unit 230 outputs the data obtained by the calculation unit 120.
[0063] The data storage unit 240 stores, for example, predetermined parameters. The calculation unit 220 reads the parameters from the data storage unit 240 and uses them for calculations. The calculation unit 220 includes the function of receiving data via the input unit 210 and the function of transmitting data via the output unit 230.
[0064] (Example Hardware Configuration) Any of the devices described in this embodiment (anomaly location estimation device 100, information processing device 200) can be realized, for example, by having a computer execute a program. This computer may be a physical computer or a virtual machine on the cloud.
[0065] In other words, the device can be realized by using hardware resources such as the CPU and memory built into a computer to execute a program corresponding to the processing performed by the device. The program can be recorded on a computer-readable recording medium (such as portable memory), saved, and distributed. It can also be provided via a network, such as the Internet or email.
[0066] Figure 7 shows an example of the hardware configuration of the computer described above. The computer in Figure 7 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., all of which are interconnected by bus B. The computer may also be equipped with a GPU.
[0067] The program that enables processing on the computer is provided on a recording medium 1001, such as a CD-ROM or memory card. When the recording medium 1001 containing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001; it may also be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files and data.
[0068] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when a program startup command is received. The CPU 1004 implements the functions related to the memory device 1003 according to the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) etc., based on a program. The input device 1007 consists of a keyboard and mouse, buttons, or a touch panel, etc., and is used to input various operation commands. The output device 1008 outputs the calculation results.
[0069] Furthermore, the functions of the elements disclosed herein may be implemented using circuits or processing circuitry that include general-purpose processors, special-purpose processors, integrated circuits, ASICs (Application Specific Integrated Circuits), FPGAs (Field Programmable Gate Arrays), conventional circuits, and / or combinations thereof that are programmed using one or more programs stored in one or more memories, or otherwise configured to perform the disclosed functions. A processor is considered processing circuitry or circuitry because it includes transistors and other circuits. A processor may be a programmed processor that executes programs stored in memory. In this disclosure, a circuit, unit, or means is hardware that performs the enumerated functions, or hardware programmed to perform the enumerated functions. Hardware may be any hardware disclosed herein that is programmed or configured to perform the enumerated functions.
[0070] The system includes memory for storing a computer program containing computer instructions. These computer instructions provide logic and routines that enable hardware (e.g., processing circuitry or circuitry) to perform the methods disclosed herein. The computer program can be implemented in commonly known forms, such as computer-readable storage media, computer program products, memory devices, recording media such as CD-ROMs and DVDs, and / or memory in FPGAs and ASICs.
[0071] (Summary of Embodiments, Effects, etc.) As described above, the technology described in this embodiment makes it possible to construct a causal model for large-scale communication networks with a large number of devices. Therefore, even in large-scale communication networks with a large number of devices, operators can estimate the location of abnormalities within the communication network.
[0072] The following additional information is disclosed regarding the embodiments described above.
[0073] <Notes> (Note 1) An information processing device that constructs a causal model in a communication network using device nodes corresponding to random variables relating to the state of devices and observation nodes corresponding to random variables relating to the generation of logs, the information processing device comprising a calculation unit that constructs the causal model using prior probabilities indicating the likelihood of abnormal states occurring in a plurality of devices in the communication network and conditional probabilities indicating the degree of influence from device nodes to observation nodes in the plurality of devices, the conditional probabilities being divided by a product. (Note 2) The information processing device according to Note 1, wherein the divided conditional probabilities are the product of a conditional probability for a predetermined number of device nodes and a simultaneous probability for the predetermined number of device nodes. (Note 3) The information processing device according to Note 1, wherein the calculation unit constructs the causal model by imposing a constraint on the number of device nodes that simultaneously enter an abnormal state. (Appendix 4) A method for constructing a causal model that is executed by an information processing device that constructs a causal model in a communication network using device nodes corresponding to random variables relating to the state of the devices and observation nodes corresponding to random variables relating to the generation of logs, the method for constructing the causal model using prior probabilities indicating the likelihood of abnormal states occurring in a plurality of devices in the communication network and conditional probabilities indicating the degree of influence from the device nodes to the observation nodes in the plurality of devices, the conditional probabilities being divided by the product.
[0074] Although this embodiment has been described above, the present invention is not limited to this specific embodiment, and various modifications and changes are possible within the scope of the gist of the invention as described in the claims.
[0075] 100 Anomaly Location Estimation Device 110 Causal Model Construction Engine 120 Causal Model Inference Engine 130 Causal Model Segmentation Engine 140 Observation Data DB 150 Output Interface 160 Observation Data Acquisition Engine 170 Connection Relationship DB 200 Information Processing Device 210 Input Unit 220 Calculation Unit 230 Output Unit 240 Data Storage Unit 1000 Drive Device 1001 Recording Medium 1002 Auxiliary Storage Device 1003 Memory Device 1004 CPU 1005 Interface Device 1006 Display Device 1007 Input Device 1008 Output Device
Claims
1. An information processing device that constructs a causal model in a communication network using device nodes corresponding to random variables relating to the state of devices and observation nodes corresponding to random variables relating to log generation, the information processing device comprising a calculation unit that constructs the causal model using prior probabilities indicating the likelihood of abnormal states occurring in a plurality of devices in the communication network and conditional probabilities indicating the degree of influence from device nodes to observation nodes in the plurality of devices, the conditional probabilities being divided by a product.
2. The information processing apparatus according to claim 1, wherein the divided conditional probability is the product of the conditional probability for a predetermined number of device nodes and the joint probability for the predetermined number of device nodes.
3. The information processing apparatus according to claim 1, wherein the calculation unit constructs the causal model by imposing a constraint on the number of device nodes that simultaneously enter an abnormal state.
4. A method for constructing a causal model that is executed by an information processing device that constructs a causal model in a communication network using device nodes corresponding to random variables relating to the state of devices and observation nodes corresponding to random variables relating to the generation of logs, the method for constructing the causal model using prior probabilities indicating the likelihood of abnormal states occurring in a plurality of devices in the communication network, and conditional probabilities indicating the degree of influence from device nodes to observation nodes in the plurality of devices, the conditional probabilities being divided by the product, the method for constructing the causal model.