Log Analysis Device Automating Abnormality Detection via Correlation Models

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing log analysis techniques require significant user effort to identify the cause of failures in systems, as they rely on manual analysis of log information, leading to a high load on analysts and operators.

Innovation Solution

A log analysis device that generates a correlation model between log patterns and operating status over time, allowing for automated determination of abnormalities in monitored targets, thereby reducing user load.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If manual log analysis is performed by users based on know-how, then the analysis can be conducted with existing tools, but the load on the user is large and the process is inefficient

Engineering Contradiction:

Improveuser loadVSAvoidanalysis efficiency

Core Design Contradiction:

Ease of operationVSProductivity

Solution Approach 1:

The system performs self-service by automatically analyzing logs and determining abnormalities without requiring user know-how. The log analysis device independently executes correlation model generation, log pattern recognition, and abnormality determination, freeing users from manual analysis tasks while maintaining high productivity through automated processing

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces the mechanical manual analysis process with an automated information processing system. Instead of users manually examining logs based on experience, the system uses correlation models and automated algorithms to detect abnormalities, substituting human cognitive work with computational processes

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Ease of operation

If automated analysis is implemented, then user load is reduced, but the device complexity increases due to correlation model generation and abnormality determination mechanisms

Engineering Contradiction:

Improveuser loadVSAvoidsystem complexity

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The system performs preliminary action by pre-generating correlation models between log patterns and operating status before actual log analysis. This preparation phase creates reusable models that simplify subsequent analysis operations, reducing the complexity of real-time processing while maintaining automation benefits

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent segments the analysis process into distinct functional modules: correlation model generation, log pattern extraction, and abnormality determination. This modular segmentation manages system complexity by organizing functions into separate, manageable components that can be developed and maintained independently

Inventive Principle:

Principle #1Segmentation

3Measurement precision

If detailed log analysis is performed to accurately identify failure causes, then measurement precision is improved, but the time required for analysis increases

Engineering Contradiction:

Improvefailure cause identification accuracyVSAvoidanalysis time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent replaces time-consuming manual detailed analysis with automated pattern recognition and correlation-based determination. The system efficiently identifies failure causes by comparing log patterns against pre-generated correlation models, achieving both high precision in cause identification and rapid analysis speed simultaneously

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11106563B2Log analysis device, log analysis method, and recording medium storing program

Publication Date: 2021.08.31 NEC CORP

AI summary

A log analysis device includes a correlation model generation unit that generates a correlation model between a pattern of a log output from a monitored target in a prescribed period and the monitored target, based on time series of the pattern and an operating status of the monitored target, and a determination unit that determines existence of an abnormality in the monitored target based on the correlation model.