This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2016-007215, filed on Jan. 18, 2016, the entire contents of which are incorporated herein by reference.
The embodiments discussed herein are related to an abnormality detection method and an abnormality detection apparatus.
In a system configured to include a plurality of resources instanced by a server and a storage in a data center and other equivalent data facilities, such a method exists as to detect abnormality by comparing values collected with respect to an item in processes to be executed iteratively with normal patterns prepared beforehand. The normal patterns are generated by collecting the values of the item under a condition not affected by settings, states and other equivalent elements of other resources within the system, and defining an allowable value range from the plurality of collected values. The system periodically collects the values of the item, and determines the abnormality when there is an item deviating from the allowable value range in comparison with the normal patterns.
A method is known, which obtains an average value of the plurality of values collected with respect to the item, corresponding to the average value and an allowable range of deviation from the average value, on the occasion of defining the normal pattern.
According to one mode, there is provided an abnormality detection method. The abnormality detection method includes first acquiring, first classifying, first storing, second acquiring and first determining. First acquiring acquires data about a predetermined item of a processing apparatus per segment from the processing apparatus, the segment being obtained by segmenting one period into a plurality of segments, the processing apparatus iteratively executing processes. First classifying classifies the data acquired by the first acquiring into a plurality of groups by a predetermined classification criterion. First storing stores an occurrence frequency of the data in the one period per group. Second acquiring acquires data about the predetermined item per segment in a determination target period, the determination target period having a same length as a length of the one period. First determining determines existence of abnormality in the processing apparatus when occurrence frequency of data in the determination target period per group deviates from an allowable range based on the occurrence frequency of the data in the one period.
The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention.
When the normal pattern is defined based on the average value, for example, the abnormality is determined as the case may be because of deviating from the allowable value range in spite of a result of a normal operation with respect to the item taking discrete values from the average value. A phrase “taking the discrete values from the average value” connotes such an occurrence state of values that the plurality of collected values of the item takes values larger than the average value and values smaller than the average value, with the average value being interposed therebetween.
Embodiment of the present invention will hereinafter be described based on the drawings. Configurations of the following embodiments are exemplifications, and the present invention is not limited to the configurations of the embodiments.
<Abnormality Detection>
Note that each of the following embodiments will exemplify an abnormality detection apparatus to detect the abnormality of the abnormality detection target (the processing apparatus and other equivalent apparatuses) being active in processing periodic processes. Herein, the periodic processes are instanced by processes or services of an information system of the server and other equivalent apparatuses, these processes or services being provided for user's tasks that are iteratively performed as on a per time basis, per day basis, per week basis or per month basis.
An abnormality detection Process P2 generates a normal model (which will hereinafter be referred to as a state model) P32 with a fixed period (e.g., one-day period), based on the collected data P31 stored in a storage unit P3. The fixed period, during which the normal model P32 is generated, is also referred to as a state model update period or simply the period. The generated normal model P32 is stored in the storage unit P3. The abnormality detection Process P2 detects whether the abnormality occurs by comparing the collected data P31 collected by the data collecting Process P1 during the state model update period of an abnormality detection determining target (which will hereinafter also be termed a determining target period) with the normal model P32 stored in the storage unit P3. The abnormality detection Process P2 stores detected abnormality information P33 in the storage unit P3.
Herein, the abnormality connotes a state of deviating from the normal model P32. For example, the normal model P32 indicates that a value of the collected data instanced by a usage rate of a Central Processing Unit (CPU) falls within a predetermined range. In other words, the normal model P32 is defined as such a piece of information that “the CPU usage rate is equal to or smaller than 70%”. The normal model P32 may also be such a piece of information that “a frequency rate of occurrences of a segment with the CPU usage rate becoming equal to or larger than 50% in one period segmented into a plurality of segments”.
When detecting the abnormality with respect to a plurality of items instanced by the CPU usage rate and a memory usage rate, generation of the normal model and the abnormality detection are implemented per item. Upon detecting the abnormality, the user is notified of the occurrence of the abnormality per item.
<Normal Model Based on Average Value>
The normal model of the state model update periods T1 through T6 is generated based on the average values of the respective state model update periods T1 at the learning stage. In the state model update periods T1, T3, T5, a normal state range is to range from the average value “75%” to a predetermined threshold value. In the state model update periods Tz, T4, T6, the normal state range is to range from the average value “25%” to the predetermined threshold value.
A graph B2 depicted in
A graph B3 illustrated in
According to the normal model B1 based on the average values, the collected data in the graph B2 indicating the normal state are determined to be “abnormal”, while the collected data in the graph B3 indicating the abnormal state are determined to be “normal”. In other words, such a case arises that the normal state and the abnormal state are not correctly determined when using the normal model based on the average values.
In an embodiment 1, the data indicating the settings/states of the resources of the processing apparatuses and other equivalent apparatuses are collected from these processing apparatuses becoming the abnormality detection targets. The collected data in one state model update period are classified into a plurality of states, and there is generated the normal model (the state model) to which information on an occurrence frequency per state is added. A determination about whether the abnormality occurs is made based on whether the occurrence frequency per state of the collected data exceeds the allowable range from the state model. The following discussion will be made on the assumption that the data collection and the abnormality detection are targeted at the CPU usage rate, and, however, the embodiment is not limited to the CPU usage rate. For example, a memory usage rate, a Process count and a network usage may also be available.
<State Model Based on Occurrence Frequency>
In the embodiment 1, occurrence counts of the data belonging to the respective groups are counted in one state model update period. The occurrence count of the data belonging to each group is used as a threshold value for determining whether an operation of the processing apparatus in one period is abnormal.
In a determination target period, when the occurrence count of the data belonging to each group exceeds the threshold value of each group in the state model, the operation of the processing apparatus in the period concerned is determined abnormal. The abnormality determination is carried out per data collecting segment. To be specific, the occurrence count of the data belonging to each group in the determination target period is counted per data collecting segment, and the counted occurrence count is determined abnormal when exceeding the threshold value in the state model. Note that the abnormality determination may also be made based on a comparison between the occurrence count of each group in the determination target period and the threshold value in the state model after an elapse of one period.
In the example illustrated in
The CPU usage rate becomes 1% once in the data collecting segment t5, and the occurrence count of the state A in one state model update period is “1”. Similarly, the CPU usage rate becomes 14%-15% four times in the data collecting segments t1 and t7-t9, and the occurrence count of the state B is “4” The CPU usage rate becomes 20%-24% four times in the data collecting segments t2, t4, t6 and t10, and the occurrence count of the state C is “4”. The CPU usage rate becomes 75% once in the data collecting segment t3, and the occurrence count of the state D is “1”. The CPU usage rate not included in the states A-D is not observed, and hence the occurrence count of the state E is “0”. The states A-E generated from the state model update periods including the data collecting segments t1-t10 are the state models, of which the occurrence counts are set as the threshold values.
The abnormality determination based on the state models illustrated in
The CPU usage rate is 24% in the segment t21, and therefore the occurrence count of the state C becomes “1”. The occurrence count of the state C in the period concerned is equal to or smaller than the occurrence count “4” of the state C in the state model, and hence the determination result is normal. The CPU usage rate is 75% in the segment t22, and hence the occurrence count of the state D becomes “1”. The occurrence count of the state D in the period concerned is equal to or smaller than the occurrence count “1” of the state D in the state model, and therefore the determination result is normal. The CPU usage rate is 75% in the segment t23, and hence the occurrence count of the state D becomes “2”. The occurrence count of the state D in the period concerned is larger than the occurrence count “1” of the state D in the state model, and therefore the determination result is abnormal. In the example of
A normal model C2 illustrated in
Accordingly, in the state model C2, the range of the normal state is deemed to cover the data belonging to the group C21 falling within the range of the values larger than 50% of the average value and the data belonging to the group C22 falling within the range of the values smaller than 50% of the average value. Each of the occurrence frequencies of the groups C21 and C22 is 50%. In the embodiment 1, the collected data are classified into the plurality of groups, corresponding to the observed values, and the occurrence frequency based on a number of pieces of data belonging to each group is used as a condition for determining whether abnormal or not.
A graph C3 illustrated in
A graph C4 illustrated in
According to the state model C2 based on the occurrence frequency, the collected data in the graph C3 indicating the normal state are determined “normal”, while the collected data in the graph C4 indicating the abnormal state are determined “abnormal”. Namely, when using the state model based on the occurrence frequency, the normal state and the abnormal state are determined correctly even in such a case that the collected data take the discrete values.
<Configuration of Apparatus>
Described next is the abnormality detection apparatus to detect the abnormality of the processing apparatus by using the foregoing normality/abnormality detection method of determining the normality/abnormality of the operation of the processing apparatus.
The processor 11 executes a variety of processes by loading an Operating System (OS) and various categories of computer programs, which are retained in the auxiliary storage device 13, onto the main storage device 12 and running the OS and the programs. A hardware circuit may also, however, execute part of the processes based on the computer programs. The processor 11 is instanced by the CPU and a Digital Signal Processor (DSP).
The main storage device 12 provides the processor 11 with storage areas for loading the programs stored in the auxiliary storage device 13 and work areas for running the programs. The main storage device 12 is used as a buffer for retaining the data. The main storage device 12 is a semiconductor memory instanced by a Read Only Memory (ROM) and a Random Access Memory (RAM).
The auxiliary storage device 13 stores the various categories of programs and the data used for the processor 11 to run these programs. The auxiliary storage device 13 is a nonvolatile memory instanced by an Erasable Programmable ROM (EPROM), a Hard Disk Drive (HDD) or a Solid State Drive (SSD). The auxiliary storage device 13 retains, e.g., the OS, the abnormality detection program and other various categories of application programs.
The input device 14 accepts an operation input from a user. The input device 14 is instanced by a pointing device like a touch pad, a mouse and a touch panel, a keyboard, operation buttons, and a circuit for receiving a signal from a remote controller. The output device 15 outputs information about the abnormality detected by the abnormality detection apparatus 10. The output device 15 is instanced by a Liquid Crystal Display (LCD).
The network interface 16 is an interface for inputting and outputting the information from and to the network. The network interface 16 includes an interface for establishing a connection to a wired network and an interface for establishing the connection to a wireless network. The network interface 16 is instanced by a Network Interface Card (NIC) and a wireless Local Area Network (LAN) card. The data and other equivalent information received by the network interface 16 are outputted to the processor 11. The abnormality detection apparatus 10 collects the data of the various types of resources connected via the network interface 16.
In the abnormality detection apparatus 10, e.g., the processor 11 loads the abnormality detection program retained in the auxiliary storage device 13 onto the main storage device 12, and runs this program. Note that the hardware configuration of the abnormality detection apparatus 10 is one example but is not limited to the configuration given above, and the components thereof can be properly omitted, replaced and added corresponding to the embodiment.
Note that the abnormality detection apparatus 10 may also set the abnormality detection apparatus 10 itself as the abnormality detection target apparatus by collecting the data indicating the settings/states of the apparatus itself. In this case, the abnormality detection program may implement an abnormality determining process as an application program on a Personal Computer (PC) and other equivalent computers.
The data collection unit 1 collects the data indicating the settings/states of the respective resources on a segment-by-segment basis of the plurality of data collecting segments into which the state model update period is segmented, and stores the collected data in the data store 3. The collected data may also be transmitted per data collecting segment to the data collection unit 1 from the abnormality detection target processing apparatus 4.
The abnormality detection unit 2 generates the state model in a way that classifies the collected data in one state model update period, which are stored in the data store 3, into a plurality of groups, and stores the generated state model in the data store 3. The abnormality detection unit 2 compares the data collected by the data collection unit 1 with the state model stored in the data store 3, thus determining whether the abnormality exists. The data store 3 is generated in at least any one of the main storage device 12 and the auxiliary storage device 13.
The processor 11 runs the computer programs deployed in an executable manner on the main storage device 12, thereby performing and processing as the data collection unit 1 and the abnormality detection unit 2. The processor 11 performing as a data collection unit 1 collects the data from individual communication partner devices through the communications using the network interface 16.
Note that the hardware circuit may implement any of the data collection unit 1 and the abnormality detection unit 2 or part of processes thereof. The hardware circuit includes a Programmable Logic Device (PLD) instanced by a Field Programmable Gate Array (FPGA), and an Integrated Circuit (IC, Large Scale Integration (LSI), Application Specific Integrated Circuit (ASIC)).
The state model is one example of a “normal pattern”. The state model update period is one example of a “period”. The data collecting segment is one example of a “segment”. The data collection unit 1 is one example of an “acquiring unit”. The abnormality detection unit 2 is one example of a “determining unit”. The data store 3 is one example of a “storage unit”.
<Clustering>
Clustering is exemplified as a method of classifying a dataset, collected per plurality of segments obtained by segmenting the state model update period, into a plurality of datasets. The clustering is that the collected data are statistically classified into datasets (clusters) having close properties. The clustering method has some types, and, however, a method of classifying the collected data into a corresponding number of clusters to the properties of the collected data is more desirable than a method of classifying the collected data into a fixed number of clusters in the embodiment 1. In a processing example that follows, a determining subject such as the abnormality detection unit 2 quantitatively determines closeness of the property, and hence a distance value from a centroid is calculated.
An X-means is exemplified as a technique of properly determining a number of post-segmenting clusters. The X-means is the technique to which a K-means of classifying the collected data into a K-number of clusters is extended. The X-means recursively iterates the K-means till an indicator, instanced by Bayesian Information Criterion (BIC), for evaluating model selection satisfies a predetermined condition. The Bayesian Information Criterion is the indicator for indicating goodness-of-fit to measurement data of a generated model when generating the model for statistically describing the measurement data. The indicator for evaluating the model selection is defined by a number of parameters for generating the model, a size of samples, or a number of pieces of observed data and other equivalent numeric values.
In OP10, the abnormality detection unit 2 extracts a k0-number of data from the collected data in the determination target period, and classifies the extracted data into a k0-number of clusters. In OP11, the abnormality detection unit 2 classifies the remaining data into the respective clusters, based on distances from centroids of the clusters. The centroid of the cluster may also be set as an average value of the data contained in the cluster.
In OP12, the abnormality detection unit 2 obtains new centroids after classifying the remaining data. The abnormality detection unit 2 changes the cluster to which the data belong to, based on the distance from the new centroid. In OP13, the abnormality detection unit 2 determines whether the data migrate between the clusters in the process of OP12. When the data migrate between the clusters (OP13: Yes), the processing loops back to OP12. Whereas when the data do not migrate between the clusters (OP13: No), the processing advances to OP14.
In processes of OP14 through OP16, the abnormality detection unit 2 iterates the segmentation of the clusters generated by the segmentation till the Bayesian Information Criterion satisfies the predetermined condition. Note that the criterion for evaluating the model selection may also be other types of information criteria without being limited to the Bayesian Information Criterion.
In OP14, the abnormality detection unit 2 determines whether to further segment the clusters generated in the processes of OP10 through OP13, based on the values of the Bayesian Information Criterion. When further segmenting the clusters (OP14: Yes), the processing advances to OP15. Whereas when not further segmenting the clusters (OP14: No), the processing advances to OP16.
In OP15, the abnormality detection unit 2 segments the segmentation target cluster by 2 as given by k0=2 in the way of executing the processes in OP10 through OP13. In OP16, the abnormality detection unit 2 determines whether the Bayesian Information Criterion satisfies the predetermined condition. When the Bayesian Information Criterion satisfies the predetermined condition (OP16: Yes), the classification process in
The collected data collected in OP10 in the determination target period are one example of “data about the predetermined item per segment in a determination target period. The Bayesian Information Criterion is one example of an “indicator for evaluating a segmented state”.
The processes in OP10 and OP11 are one example of a process of “classifying the data acquired by the first acquiring into a predetermined number of groups. The processes in OP12 and OP13 are one example of a process of “changing group to which each piece of data belongs on the basis of a difference from an average value of data belonging to each of the groups. The process in OP14 is one example of “second determining whether to further segment each of the predetermined number of groups on the basis of a value of an indicator for evaluating a segmented state. The processes in OP15 and OP16 are one example of a process of “iterating segmentation till the value of the indicator for evaluating the segmented state fulfills a predetermined condition.
The X-means illustrated in
<Generation of State Model>
In the example of
<Abnormality Determination>
In
The determination about whether abnormal or not is not limited to the determination about whether in excess of the occurrence frequency of the corresponding state in the state model. The abnormality detection unit 2 may determine the abnormality, for instance, when becoming equal to or larger by ((occurrence frequency of corresponding state in state model)+x) % than a predetermined threshold value x. The abnormality detection unit 2 may also determine the abnormality when becoming equal to or larger by {(occurrence frequency of corresponding state in state model)×(1+y/100)}% than a predetermined threshold value y. The threshold values x, y can be set in a way that takes account of, e.g., the number of data collecting segments or the properties instanced by the dispersion of the collected data.
It is also determined whether the abnormality occurs when the state model update period expires. This is because the determination about whether the occurrence frequency is under the allowable range is made at the time when the state model update period expires. At the time point of the expiration of the state model update period, the abnormality detection unit 2 compares the occurrence frequency of each state with the occurrence frequency of each corresponding state in the state model. The abnormality detection unit 2 determines the abnormality when there are one or more such states that the occurrence frequency of each state at the time point of the expiration of the state model update period is lower than the occurrence frequency of each corresponding state in the state model.
The determination about whether the occurrence frequency of the state is lower than the occurrence frequency of the corresponding state in the state model may also be made based on whether equal to or smaller by ((occurrence frequency of corresponding state in state model)−x) % than, e.g., the predetermined threshold value x. The determination about whether the occurrence frequency of the state is lower than the occurrence frequency of the corresponding state in the state model may further be made based on whether equal to or smaller by {(occurrence frequency of corresponding state in state model)×(1−y/100)}% than the predetermined threshold value y. The threshold values x, y can be set by taking account of, e.g., the number of data collecting segments or the properties instanced by the dispersion of the collected data.
The following is a description of a specific example of how the abnormality is determined in
Pieces of data T3 and T8 are the data belonging to the state containing the data having the rate of “76%-100%” at the time after collecting the data T8, and it follows that these data occur at least twice in the data collecting segments T1-T120. Hence, the occurrence frequency at the time after collecting the data T8 is approximately 1.7% calculated such as (2/120)×100. In the state model of
After collecting the data T120, i.e., at the time after the state model update period expires, the occurrence frequency of the state containing the data having the rate of 51%-75% is assumed to be 6%. In the state model of
Information related to the detected abnormality is stored in the data store 3. The information related to the detected abnormality, which is stored in the data store 3, is outputted in a predetermined format to the output device 15 and notified to the user.
The example in
Note that the data structure of the information related to the detected abnormality is not limited to this structure. The data structure of the information related to the detected abnormality may contain such items of information as the CPU usage rate at the detection time of the abnormality, the occurrence frequency at the detection time of the abnormality and the occurrence frequency in the normal state.
<Processing Flow>
In OP20, the abnormality detection unit 2 determines whether the present time point is the time point when the state model update period expires. A length of the state model update period may be defined beforehand in the data store 3, and may also be designated by the user when starting the processes illustrated in
In OP21, the abnormality detection unit 2 extracts the collected data in the expired state model update period from the data store 3. The data collection unit 1 periodically collects, from the processing apparatus 4, the data representing the settings or the states of the resources per data collecting segment obtained by segmenting the state model update period into the plurality of segments, and stores the collected data in the data store 3. It may be sufficient that the abnormality detection unit 2 extracts, from the data store 3, the collected data of the processing apparatus 4 as the abnormality detection target apparatus in the expired state model update period. In OP22, the abnormality detection unit 2 generates a plurality of states by classifying the extracted data.
In OP23, the abnormality detection unit 2 calculates the occurrence frequency per state. In OP24, the abnormality detection unit 2 stores the plurality of states generated in OP22 as one state model in the data store 3. The abnormality detection unit 2 stores the occurrence frequency per state, which is calculated in OP23, together with the plurality of states in the data store 3. The abnormality detection unit 2 further stores the date/time information and the hour information about the start and the end of the state model update period in the data store 3. The processing loops back to OP20, and the state model generation process iterated in every state model update period. The generation of the state model is finished upon, e.g., the user's instruction.
The process in OP21 is one example of “first acquiring data about a predetermined item of a processing apparatus per segment from the processing apparatus, the segment being obtained by segmenting one period into a plurality of segments, the processing apparatus iteratively executing processes”. The process in OP22 is one example of a process of “first classifying the data acquired by the first acquiring into a plurality of groups by a predetermined classification criterion”. The processes in OP23 and OP24 are one example of a process of “storing an occurrence frequency of the data in the one period per group”.
In OP31, the abnormality detection unit 2 extracts the state model satisfying the predetermined condition as a state model becoming a criterion for determining the abnormality from the data store 3. The state model becoming the criterion is the state model of the normal pattern compared with the occurrence frequency per state of the data collected in the determination target period in the abnormality determination process in the determination target period. The abnormality detection unit 2 can extract the state model generated from, e.g., the data collected on the same day of week and at the same hour as those of the determination target period by way of the state model satisfying the predetermined condition.
In OP32, the abnormality detection unit 2 determines whether the present time point is a time point when the data collecting segment expires. The present time point is the time point when the data collecting segment expires (OP32: Yes), in which case the processing advances to OP33. The present time point is not the time point when the data collecting segment expires (OP32: No), in which case the processing advances to OP34.
In OP33, the abnormality detection unit 2 determines whether the occurrence frequency is excessive in comparison with the occurrence frequency of the corresponding state of the state model extracted in OP31. “The occurrence frequency being excessive” connotes a case of determining the abnormality because of being higher above the allowable range than the occurrence frequency of the state model. When the occurrence frequency is excessive (OP33: Yes), the processing advances to OP37. Whereas when the occurrence frequency is not excessive (OP33: No), the processing advances to OP34.
Note that the occurrence frequency is the occurrence frequency of the state containing the data of the expired data collecting segment, and is calculated by the abnormality detection unit 2. The calculated occurrence frequency is retained in the data store 3 as the occurrence frequency at the present time point of the state concerned. In the subsequent processes also, the abnormality detection unit 2 is to retain the calculated occurrence frequencies in the data store 3.
In OP34, the abnormality detection unit 2 determines whether the present time point is the time point of the expiration of the state model update period. When the present time point is the time point of the expiration of the state model update period (OP34: Yes), the processing advances to OP35. Whereas when the present time point is not the time point of the expiration of the state model update period (OP34: No), the processing advances to OP36.
In OP35, the abnormality detection unit 2, when not executing the process in OP33, collects the data in the data collecting segment at the time point of the expiration of the state model update period, and calculates the occurrence frequency of the state containing the collected data. The abnormality detection unit 2 compares the occurrence frequency of each state with the occurrence frequency of the corresponding state of the state model extracted in OP31, thereby determining whether the occurrence frequency is insufficient. “The occurrence frequency being insufficient” connotes a case of determining the abnormality because of being lower under the allowable range than the occurrence frequency of the state model. When there exist one or more states with the occurrence frequency being insufficient (OP35: Yes) the processing advances to OP37. Whereas when there is none of the state with the occurrence frequency being insufficient (OP35: No), the processing advances to OP36.
In OP36, the abnormality detection unit 2 determines the normality, and the processing loops back to OP30. In OP37, the abnormality detection unit 2 determines the abnormality, and the processing loops back to OP30. The determination results in OP36 and OP37 are retained in the data store 3. When the processing loops back to OP30, the abnormality determination process is iterated. The abnormality determination process illustrated in
The processes in OP33 and OP35 are one example of a process of “second acquiring data about the predetermined item per segment in a determination target period, the determination target period having a same length as a length of the one period and first determining existence of abnormality in the processing apparatus when occurrence frequency of data in the determination target period per group deviates from an allowable range based on the occurrence frequency of the data in the one period”.
<Operational Effect of Embodiment 1>
The abnormality detection apparatus 10 classifies the collected data in the state model update period into a proper number of groups corresponding to the properties of the data, and calculates the occurrence frequency of the data belonging to each group, thereby generating the state model based on the occurrence frequency. The calculated occurrence frequency is set as the threshold value for determining whether abnormal or not, whereby the state model adequate to the collected data taking the discrete values is generated. The abnormality detection apparatus 10 compares the occurrence frequency of each group in the determination target period with the occurrence frequency in the state model based on the occurrence frequency. The abnormality detection apparatus 10 is thereby enabled to detect the abnormality of the processing apparatus 4 by iteratively executing the processes more accurately than in the case of detecting the abnormality through the comparison with the normal mode based on the average value.
The abnormality detection apparatus 10 implements the abnormality determination in every determination target period as to whether the occurrence frequency of the data in the determination target period exceeds an upper limit value of the allowable range of the occurrence frequency in the state model. The abnormality detection apparatus 10 is thereby enabled to detect the abnormality in real time per segment.
When the determination target period expires, the abnormality detection apparatus 10 implements the abnormality determination about whether the occurrence frequency of the data in the determination target period of one or more groups in the plurality of groups decreases under a lower limit value of the allowable range of the occurrence frequency in the state model. The abnormality detection apparatus 10 is thereby enabled to detect the abnormality also when the occurrence frequency becomes insufficient.
The abnormality detection apparatus 10 classifies the data acquired in one period into a predetermined number of groups, and changes the groups to which the respective data belong, based on a difference from the average value of the data belonging to the respective groups. The abnormality detection apparatus 10 determines, based on a value of the indicator for evaluating the segmented state, whether to further segment each of the predetermined number of groups, and iterates the segmentation till the value of the indicator for evaluating the segmented state fulfills the predetermined condition with respect to the group determined to be segmented. The abnormality detection apparatus 10 is thereby enabled to generate the state model representing the properties instanced by the dispersion of the data by classifying the collected data into the corresponding number of groups to the properties of the data on the occasion of generating the state model.
In the abnormality detection process of the embodiment 1, the abnormality detection apparatus 10 sets the state model satisfying the predetermined condition as the state model becoming the criterion for determining the abnormality. On the other hand, according to an embodiment 2, the state model becoming the criterion is selected based on a degree of similarity between the state models, which are common in terms of a time zone, a day of week and other equivalent items, from the plurality of past state models in the abnormality determination process.
The degree of similarity (which is also termed the similarity degree) may be defined based on a total sum of absolute values of differences of the observed values between the state models by, e.g., rearranging the data collected in the state model update periods corresponding to the respective state models in an ascending sequence or descending sequence on the basis of the observed values of the collected data. In the following discussion, according to the embodiment 2, the total sum of the absolute values of the differences will be simply called the “total sum of the differences”. In this case, the similarity degree is higher as the total sum of the differences is smaller, and is lower as the total sum of the differences is larger. The similarity degree may also be defined based on the number of states classified by clustering and the difference between the state models with respect to the range of the data belonging to the respective states.
The hardware configuration and the components of the abnormality detection apparatus 10 in the embodiment 2 are the same as those in the embodiment 1, and hence their explanations are omitted. The method of generating the state mode in the embodiment 2 is the same as in the embodiment 1, and therefore its explanation is also omitted.
<Selection of State Model>
<Processing Flow>
The example of the process of generating the state model in the embodiment 2 is the same as in the embodiment 1, and hence its explanation is omitted.
In OP40, when reaching the time point of the expiration of the state model update period (OP40: Yes), the processing advances to OP411. Whereas when not reaching the time point of the expiration of the state model update period (OP40: No), the processing advances to OP42.
In OP411, the abnormality detection unit 2 extracts the plurality of state models from the data store 3, corresponding to the selection method of the state model. In OP412, the abnormality detection unit 2 selects the state model becoming the criterion for determining the abnormality. The processing advances to OP42. The subsequent processes are the same as in the embodiment 1.
OP412 is one example of a process of “selecting the normal pattern satisfying a predetermined condition from the plurality of stored normal patterns”. The processes in OP43 and OP45 are one example of a process of “determining the existence of the abnormality in the processing apparatus when the occurrence frequency of the data acquired by the second acquiring per group deviates from an allowable range based on the selected normal pattern”.
<Operational Effect of Embodiment 2>
The abnormality detection apparatus 10 classifies, similarly to the embodiment 1, the collected data in the state model update period into the corresponding number of groups to the properties of the data, and thus generates the state model. In the embodiment 2, the normal pattern satisfying the predetermined condition is selected as the state model becoming the criterion from the plurality of past state models. The proper state model corresponding to the properties of the data is thereby selected, and the abnormality detection apparatus 10 can detect the abnormality of the processing apparatus 4 iteratively executing the processes more accurately than in the case of detecting the abnormality through the comparison with the specified state model.
The abnormality detection apparatus 10 selects the state model becoming the criterion, based on the similarity degree between the state models, which are common in terms of the time zone, the day of week and other equivalent items as the predetermined conditions. In this case, the more proper state model for the collected data taking the periodic values is selected, and the abnormality detection apparatus 10 can detect further accurately the abnormality of the processing apparatus 4 iteratively executing the processes corresponding to the time zone, the day of week and other equivalent items.
For example, the abnormality detection apparatus 10 selects, as the state model becoming the criterion, the normal pattern of the period next to the normal pattern having the most similarity to the normal pattern of the immediate period from the normal patterns of the respective periods until a predetermined period of time ago including the plurality of periods. The abnormality detection apparatus 10 is thereby enabled to select the proper state model predicted from the immediate period.
The abnormality detection apparatus 10 compares the similarity degree (S2 in
The abnormality detection apparatus 10 rearranges the data acquired in the state model update period in the ascending sequence or descending sequence, and determines that the similarity degree is higher as the total sum of the differences of the data per data collecting segment is smaller. The abnormality detection apparatus 10 is thereby enabled to select the more proper state model by calculating the similarity degree corresponding to the properties instanced by the dispersion of the data in the state model update period.
In the embodiments 1 and 2, the abnormality detection apparatus 10 determines whether abnormal or not by comparing the occurrence frequency per state in the determination target period with the occurrence frequency in the state model. In an embodiment 3, the abnormality detection apparatus 10 determines whether abnormal or not by comparing, in addition the occurrence frequency, a transition rate between the states in the determination target period with an allowable range of the transition rate in the state model.
The hardware configuration and the processing configuration of the abnormality detection apparatus 10 in the embodiment 3 are the same as in the embodiment 1, and hence their explanations are omitted. A process of selecting the state model in the embodiment 3 is the same as in the embodiment 2, and therefore its explanation is omitted.
<Generation of State Model>
An example in
A data structure with respect to the transition rate between the states is expressed in a format given by “(p1-q1%,p2-q2%):(s %,t %)”. A value (p1-q1%,p2-q2%) given in first parentheses indicates a state transition from a state (p1-q1%) to a state (p2-q2%). A first element s % given in second parentheses is a transition rate from the state (p1-q1%) to the state (p2-q2%). A second element t % given in the second parentheses is a transition rate counter used when determining the abnormality. In the determination target period, the transition between the states before and after the segment is calculated per data collecting segment, and the calculated transition rate is set in the counter t %. The counter t % is initialized to 0% when generating the state model. Specifically, in
<Abnormality Determination>
In
The determination about whether abnormal or not is not limited to the determination about whether or not over the corresponding transition rate between the states in the state model. The abnormality detection unit 2 may determine the abnormality when equal to or larger by, e.g., (state model transition rate+x) % than a predetermined threshold value x. The abnormality detection unit 2 may also determine the abnormality when equal to or larger by {(transition rate between corresponding states in state model)×(1+y/100)}% than a predetermined threshold value y. The threshold values x, y can be set by taking account of the properties instanced by the number of data collecting segments or a degree of variation of the collected data.
The determination of whether the abnormality occurs is made also at the time point of the expiration of the state model update period. This is because the determination of whether the transition rate decreases under the allowable range is made at the time point of the expiration of the state model update period. At the time point of the expiration of the state model update period, the abnormality detection unit 2 compares the transition rate between the respective states with the transition rate between the corresponding states in the state model. The abnormality detection unit 2 can determine the abnormality when there exist one or more states in which the transition rate between the states at the time point of the expiration of the state model update period is lower than the transition rate between the corresponding states in the state model.
The determination about whether the transition rate between the states is lower than the transition rate between the corresponding states in the state model may also be made based on whether equal to or smaller by ((transition rate between corresponding states in state model)−x) % than, e.g., the predetermined threshold value x. The determination about whether the transition rate between the states is lower than the transition rate between the corresponding states in the state model may also be made based on whether equal to or smaller by {(transition rate between corresponding states in state model)×(1−y/100)}% than the predetermined threshold value y. The threshold values x, y can be set by taking account of, e.g., the number of data collecting segments or the properties instanced by the dispersion of the collected data.
A specific example of the abnormality determination in
It also follows that the transition from the state (0%-35%) to the state (71%-100%) occurs at least once at the time point when becoming the data collecting segment T3 from T2. Therefore, at the time point when becoming the data collecting segment T3 from T2, the transition rate is calculated at approximately 0.8% given by (1/120)×100. In the state model in
After collecting the data of the data collecting segment T120, i.e., at the time point of the expiration of the state model update period, the transition rate from the state (0%-35%) to the state (0%-35%) is assumed to be 15%. In the state model in
<Processing Flow>
In OP53, upon calculating the occurrence frequency per state, the processing advances to OP54. In OP54, the abnormality detection unit 2 calculates the transition rate between the states.
In OP55, the abnormality detection unit 2 saves the state models generated in the processes of OP51 through OP54 in the data store 3. The processing loops back to OP50, and the state model generation process is iterated. The generation of the state model is finished by, e.g., the user's instruction.
The process in OP51 is one example of “first acquiring data about a predetermined item of a processing apparatus per segment from the processing apparatus, the segment being obtained by segmenting one period into a plurality of segments, the processing apparatus iteratively executing processes”. The process in OP52 is one example of “first classifying the data acquired by the first acquiring into a plurality of groups by a predetermined classification criterion” The process in OP54 is one example of a process “storing transition rate between the plurality of groups in the data acquired in the one period”.
In OP60, the abnormality detection unit 2 determines whether the present time point is the time point of the expiration of the state model update period. When the present time point is the time point of the expiration of the state model update period (OP60: Yes), the processing advances to OP61. Whereas when the present time point is not the time point of the expiration of the state model update period (OP60: No), the processing advances to OP63.
In OP61, the abnormality detection unit 2 extracts the plurality of state models from the data store 3, corresponding to the method of selecting the state model. In OP62, the abnormality detection unit 2 selects the state model becoming the criterion for determining the abnormality.
In OP63, the abnormality detection unit 2 determines whether the present time point is the time point of an expiration of the data collecting segment. When the present time point is the time point of an expiration of the data collecting segment (OP63: Yes), the processing advances to OP64. Whereas when the present time point is not the time point of an expiration of the data collecting segment (OP63: No), the processing advances to OP66.
In OP64, the abnormality detection unit 2 collects the data in the expired data collecting segment, and calculates the occurrence frequency of the state containing the collected data. The abnormality detection unit 2 determines whether the calculated occurrence frequency is excessive by comparing the calculated occurrence frequency with the occurrence frequency of the corresponding state of the state model selected in OP62. When the calculated occurrence frequency is excessive (OP64: Yes), the processing advances to OP70. Whereas when the calculated occurrence frequency is not excessive (OP64: No), the processing advances to OP65.
In OP65, the abnormality detection unit 2 calculates the transition rate about the state-to-state transition that occurs after the data collecting segment in OP63. The calculated transition rate is stored as the state-to-state transition rate at the present time point in the data store 3. The abnormality detection unit 2 is to retain the calculated transition rate in the data store 3 also in the subsequent processes.
The abnormality detection unit 2 determines whether the calculated transition rate is excessive by comparing the calculated transition rate with the transition rate of the transition between the corresponding states in the state model selected in OP62. When the calculated transition rate is excessive (OP65: Yes), the processing advances to OP70. Whereas when the calculated transition rate is not excessive (OP65: No), the processing advances to OP66.
In OP66, the abnormality detection unit 2 determines whether the present time point is the time point of the expiration of the state model update period. When the present time point is the time point of the expiration of the state model update period (OP66: Yes), the processing advances to OP67. Whereas when the present time point is not the time point of the expiration of the state model update period (OP66: No), the processing advances to OP69.
In OP67, the abnormality detection unit 2 calculates the occurrence frequency of the state containing the data collected in the data collecting segment in OP63. The abnormality detection unit 2 determines whether the occurrence frequency of each state is insufficient by comparing the occurrence frequency of each state with the occurrence frequency of the corresponding state in the state model selected in OP62. When there are one or more states with the occurrence frequency being insufficient (OP67: Yes), the processing advances to OP70. Whereas when there is none of the state with the occurrence frequency being insufficient (OP67: No), the processing advances to OP68.
In OP68, the abnormality detection unit 2 calculates the transition rate about the state-to-state transition that occurs after the data collecting segment in OP63. The abnormality detection unit 2 determines whether the transition rate between the states is insufficient by comparing the transition rate between the states with the transition rate between the corresponding states in the state model selected in OP62. When there are one or more state-to-state transitions with the transition rate being insufficient (OP68: Yes), the processing advances to OP70. Whereas when there is none of the state-to-state transition with the transition rate being insufficient (OP68: No), the processing advances to OP69.
In OP69, the abnormality detection unit 2 determines the normality, and the processing loops back to OP60. In OP70, the abnormality detection unit 2 determines the abnormality, and the processing loops back to OP60. Upon looping back to OP60, the abnormality determination process is iterated. The abnormality determination process illustrated in
The processes in OP65 and OP68 are one example of a process of “determining the existence of the abnormality in the processing apparatus when the transition rate between the plurality of groups in the determination target period deviates from an allowable range based on a transition rate between corresponding groups in the data acquired in the one period”.
<Operational Effect of Embodiment 3>
The abnormality detection apparatus 10, similarly to the embodiments 1 and 2, determines the abnormality on the basis of the occurrence frequency, and implements the abnormality determination based on the transition rate between the states. The abnormality detection apparatus 10 is thereby enabled to further accurately detect the abnormality related to the state transition in addition to the abnormality related to the occurrence frequency. The abnormality related to the state transition is instanced by a pattern of variation or a degree of variation of the observed value of the collected data.
In the embodiment 3, the abnormality detection apparatus 10 determines whether abnormal or not on the basis of each of the occurrence frequency and the transition rate, but may also detect the abnormality by determining whether abnormal or not on the basis of the transition rate without implementing the abnormal determination related to the occurrence frequency.
In the case of implementing the abnormal determination based on the transition rate, the abnormality detection apparatus 10, similarly to the embodiment 3, generates the state model containing the transition rate between the states with the collected data being classified. The abnormality detection apparatus 10 can generate the state model containing the transition rate between the states in the processes of, e.g., OP50-OP52, OP54 and OP55 illustrated in
The abnormality detection apparatus 10 determines the abnormality by collecting the data about the predetermined item from the processing apparatus 4 in every data collecting segment of the determination target period, and making the comparison with the state model containing the transition rate between the states generated by classifying the collected data. The abnormality detection apparatus 10 can implement the abnormality determination in the determination target period in the processes of, e.g., OP60-OP63, OP65, OP66 and OP68-OP70 illustrated in
The abnormality detection apparatus 10 may also select the state model becoming the criterion for determining the abnormality from the plurality of normal patterns on the basis of the similarity degree of the transition rate between the states in the process of selecting the state model in OP62. The abnormality detection apparatus 10 can further accurately detect the abnormality related to the state transition by focusing on the transition rate between the states.
Note that the processing apparatus 4 becoming the abnormality detection target apparatus in the embodiment is described as the apparatus connected to the abnormality detection apparatus 10 via the network interface 16, and, however, the abnormality detection target apparatus may also be abnormality detection apparatus 10 itself. In this case, it may be sufficient that the abnormality detection apparatus 10 implements the abnormality determination by collecting the self data indicating the settings/states thereof. The configurations of the embodiments discussed above can be adequately combined.
According to one aspect, it is feasible to further accurately detect the abnormality in the processing apparatus and other equivalent apparatuses iteratively executing the processes.
<Non-Transitory Recording Medium>
A program making a computer, other machines and apparatuses (which will hereinafter be referred to as the computer and other equivalent apparatuses) attain any one of the functions, can be recorded on a non-transitory recording medium readable by the computer and other equivalent apparatuses. The computer and other equivalent apparatuses are made to read and run the program on this non-transitory recording medium, whereby the function thereof can be provided.
Herein, the non-transitory recording medium readable by the computer and other equivalent apparatuses connotes a non-transitory recording medium capable of accumulating information instanced by data, programs and other equivalent information electrically, magnetically, optically, mechanically or by chemical action, which can be read from the computer and other equivalent apparatuses. Among these non-transitory recording mediums, the mediums removable from the computer and other equivalent apparatuses are exemplified by a flexible disc, a magneto-optic disc, a CD-ROM, a CD-R/W, a DVD, a Blu-ray disc, a DAT, an 8 mm tape, and a memory card like a flash memory. A hard disc, a ROM (Read-Only Memory) and other equivalent recording mediums are given as the non-transitory recording mediums fixed within the computer and other equivalent apparatuses. Further, a solid state drive (SSD) is also available as the non-transitory recording medium removable from the computer and other equivalent apparatuses and also as the non-transitory recording medium fixed within the computer and other equivalent apparatuses.
All examples and conditional language provided herein are intended for the pedagogical purposes of aiding the reader in understanding the invention and the concepts contributed by the inventor to further the art, and are not to be construed as limitations to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although one or more embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.
Number | Date | Country | Kind |
---|---|---|---|
2016-007215 | Jan 2016 | JP | national |