Network Event Correlation with Physical Logical Topology
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In networking and multi-functionalized control systems, it is challenging to easily specify the factor of malfunctions or abnormalities generated, as numerous event logs are simultaneously produced from identical causes, making it difficult to identify the root cause without advanced knowledge of the system configuration.
Innovation Solution
An information processing device and method that detects events in control systems, visually expresses physical and logical network connections, and outputs event logs correlated with these connections, allowing users to select and drill down into specific events to identify common factors across multiple logs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If multiple event logs are collected from networked control devices, then the quantity of information increases, but the difficulty of identifying root cause increases
Solution Approach 1:
The patent segments event logs by their generation locations (different control devices and network components) and visually displays them on a network configuration screen. This segmentation allows operators to identify which specific device or network segment generated each event, making it easier to locate the root cause among multiple simultaneous events without having to manually analyze each log entry.
Solution Approach 2:
The patent introduces a network configuration screen as an intermediary visual interface between the raw event logs and the operator. This intermediary displays event generation locations using visual indicators (such as highlighting or markers) on the network topology, serving as a mediator that translates complex log data into intuitive visual information that helps operators quickly identify the root cause.
2Loss of information
If comprehensive network topology and data relationships are displayed, then the completeness of system understanding improves, but the complexity of the display increases
Solution Approach 1:
The patent applies local quality by displaying network connections and data relationships only in the relevant areas where events are generated. When an event occurs at a specific control device, the display highlights or emphasizes the local network configuration and data flows around that device, rather than showing the entire network topology uniformly. This reduces display complexity while maintaining completeness of understanding for the affected area.
3Measurement precision
If event logs are correlated with physical and logical network connections, then the accuracy of fault localization improves, but the processing complexity increases
Solution Approach 1:
The patent performs preliminary action by pre-establishing and storing the correspondence relationships between control devices, physical network connections, and logical data relationships before events occur. The system maintains a database of network topology and data flow relationships, so when events are generated, the correlation with physical and logical connections can be quickly performed by querying pre-stored information, reducing processing complexity while maintaining high fault localization accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is a demand for easily specifying a factor of a malfunction or an abnormality, which is generated in a control system including a network. An information processing device includes: a detection unit configured to detect an event generated in a control system including at least one network; a connection configuration expression unit configured to visually express a physical connection and a logical connection of the network included in the control system; and an event output unit configured to output the event detected by the detection unit while correlating the event with the physical connection and the logical connection of the network, the physical connection and the logical connection being visually expressed according to a place where the event is generated.