JP7648331B2 - Apparatus, method and program for determining log dependency relationships in a mobile core network - Google Patents

Description

The present invention relates to an apparatus, method, and program for analyzing and determining log dependencies in a mobile core network, and in particular to an apparatus, method, and program for determining log dependencies in a mobile core network that can reduce the amount of calculation required to build an AI/ML learning model by analyzing the dependencies between each syslog before applying it to AI/ML in a network environment in which many syslogs for the same event are generated simultaneously from different nodes.

A system log (hereafter referred to as syslog) is text data that indicates when a computer system has processed some event, and is used daily for many purposes in network operations.

In recent years, attempts have been made to use syslog data to automate network operations such as anomaly detection in networks using AI (artificial intelligence)/ML (machine learning) technology. Non-Patent Document 1 discloses a technology that classifies the degree of correlation between failures based on the syslog that has occurred.

JP 2002-432100 A

Identifying linked incidents in large-scale online service systems https://dl.acm.org/doi/10.1145/3368089.3409768

The core network (5GC for 5G) that handles user authentication, billing, and packet forwarding in mobile networks employs a cloud-native architecture internally. As a result, functions such as authentication and mobility management are separated into separate functions, and multiple node functions may generate multiple system logs in response to the same event.

For example, if five nodes generate a total of 100 system logs for a certain event, each of the 100 system logs will need to be trained, judged, and classified one by one using AI/ML, which can result in unnecessary calculation costs and reduced accuracy.

The object of the present invention is to provide a device, method, and program for determining log dependency relationships in a mobile core network that solves the above technical problems and realizes efficient AI/ML calculations and highly accurate network operation by analyzing the dependencies between each syslog before applying it to AI/ML in a network environment where many syslogs are generated simultaneously from different nodes in response to the same event.

To achieve the above objective, the present invention is characterized in that a log dependency determination device that determines the dependencies of syslogs output by each network function (NF) that constitutes a mobile core network has the following configuration.

(1) The system includes a means for determining the connection relationships between network functions, a means for determining the dependency relationships between events in each syslog, and a means for determining the dependency relationships between each syslog based on the connection relationships and the dependency relationships between events.

(2) A means for managing history information of inquiries made to the NRF when each network function connects to another network function is provided, and the means for determining the connection relationship determines the connection relationship between each network function based on the history information.

(3) The system is provided with a means for statically storing the dependencies between events in each syslog based on the flow of communication between network functions within the mobile core network as defined by 3GPP, and the means for determining the dependencies between the events determines the dependencies between the events in each syslog based on the dependencies between the statically stored events.

(4) The means for determining the dependency between each syslog focuses on a pair of the syslog with the oldest event occurrence time and the next oldest syslog among the syslogs output by the mobile core network within a specified period, analyzes whether or not there is the connection relationship between the network function that output the oldest syslog and the network function that output the next oldest syslog, and whether or not there is the dependency relationship between the event of the oldest syslog and the event of the next oldest syslog, and determines that there is a dependency relationship between the pair of syslogs with the connection relationship and the dependency relationship between events, while switching the pair of syslogs of interest to the pair of the next oldest syslog and the next oldest syslog determined to have the dependency relationship between the syslogs, and assigns a common ID to a series of syslogs with a chain of syslog dependencies.

The present invention achieves the following effects:

(1) By dynamically determining the dependencies between the numerous system logs generated by the numerous NFs in the mobile core network, it is expected that the amount of calculation required to build AI/ML learning models used to automate network operations can be reduced.

(2) By dynamically determining the dependencies between the numerous system logs generated by the numerous NFs in the mobile core network, it becomes possible for human operators to visualize the dependencies between logs, making it easier to analyze problems and check their status.

1 is a functional block diagram showing a configuration of a log dependency relationship determination system according to an embodiment of the present invention. This is a sequence flow showing the procedure in which each component of the log analysis node works in cooperation with each other to analyze each syslog and determine the dependency relationships. This is a sequence flow showing the procedure by which NRF saves search history. FIG. 13 is a diagram showing an example of managing connectivity information based on a search history of an NRF. This figure shows an example of how the system logs of other NFs change when an AMF node goes down in 5GC. FIG. 13 shows an example of how the AUSF system log changes when an AMF node goes down. This figure shows an example of changes in the NRF system log triggered by an AMF node down. This figure shows an example of how the SMF system log changes when an AMF node goes down. 13 is a diagram showing an example of a syslog (before determining syslog dependency) stored in a log management DB. FIG. 13 is a diagram illustrating an example of dependencies between events in a syslog. 11 is a flowchart showing a procedure in which a log analysis unit determines a dependency relationship between syslogs. 13 is a diagram showing an example of a syslog (after determining syslog dependency) stored in a log management DB.

The following describes in detail an embodiment of the present invention with reference to the drawings. Figure 1 is a functional block diagram showing the configuration of the main parts of a log dependency determination system according to one embodiment of the present invention, and is configured by connecting a 5G core network 10 (5GC), which is a mobile network to be monitored, a log analysis node 20 to which the present invention is applied, and an AI/ML implementation node 30, with each node connected to the other via a network.

As specified in TS 23.501, 5GC is composed of multiple nodes, each of which is called a network function (NF). 5GC is composed of a combination of multiple physical servers, and in this embodiment, it is composed of server SV1 including the NFs of NRF, AUSF, NSSF, and NEF, server SV2 including the NFs of AMF and SMF, and server SV3 including the NFs of PCF and UDM.

The log analysis node 20 analyzes the many syslogs output by each NF to determine dependencies between the syslogs, and provides the determination results to the AI/ML implementation node 30. The AI/ML implementation node 30 uses the dependencies between the provided syslogs to make various decisions and future predictions regarding the automation of network operations.

The log analysis node 20 mainly comprises a log acquisition unit 201, a connectivity management unit 202, a log analysis unit 203, an NF connection management DB 204, a log management DB 205, and an event management DB 206.

The log acquisition unit 201 receives syslogs output by each NF from the 5GC. The connectivity management unit 202 receives connection relationships between NFs from the 5GC. The log analysis unit 203 analyzes the dependencies between the received syslogs. The NF connection management DB 204 stores the connection relationships between NFs received by the connectivity management unit 202 from the 5GC. The log management DB 205 stores the syslogs received by the log acquisition unit 201 from the 5GC. The event management DB 206 stores the dependencies of events that are chained between NFs.

Such a log analysis node 20 can be configured by implementing applications (programs) that realize each function on at least one general-purpose computer or server equipped with a CPU, ROM, RAM, bus, interface, etc. Alternatively, it can be configured as a dedicated machine or single-function machine in which part of the application is implemented as hardware or software.

Figure 2 is a sequence flow showing the procedure for each component of the log analysis node 20 working together to analyze each syslog and determine their dependencies. At time t1, the 5GC in normal operation sends the connection relationship between NFs to the connectivity management unit 202 of the log analysis node 20.

As shown in the sequence diagram in Figure 3, when an NF1 (ID=a) wants to connect to another NF2 (ID=b), 5GC has a mechanism that queries the NRF (Network function Repository Function) once and searches for an appropriate node as NF2.

In this embodiment, the NRF uses this mechanism to store a search history in order to grasp the connection relationships between NFs, and the connectivity management unit 202 grasps the connection relationships between NFs by transmitting this search history to the log analysis node 20. In the example of FIG. 3, a connection relationship indicating that a connection exists from NF1 (ID=a) to NF2 (ID=b) is transmitted to the connectivity management unit 202.

At time t2, the connectivity management unit 202 registers the connection relationships between NFs received from the NRF of the 5GC as connectivity information in the NF connectivity management DB 204. Figure 4 is a diagram showing an example of connectivity information between NFs managed by the connectivity management unit 202 based on the search history of the NRF.

Since 5GC employs a cloud-native architecture and NFs are constructed using multiple VMs and containers, there are multiple NFs of the same type. Therefore, in this embodiment, each NF is uniquely identified by its type and ID, and combinations of NFs in a connected relationship are registered in the connectivity management unit 202.

After that, when a failure such as a node down occurs in the 5GC at time t3 and the syslog of the affected NF changes, the syslog is sent from the 5GC to the log acquisition unit 201 of the log analysis node 20. For example, when the AMF node goes down in the example of the 5GC shown in Figure 5, the syslog changes in many NFs including the AUSF, NRF and SMF. Figures 6, 7 and 8 respectively show examples in which the syslogs of the AUSF, NRF and SMF change as a result of the AMF node down.

At time t4, the log acquisition unit 201 stores the syslogs generated in each NF received from the 5GC in the log management DB 205. FIG. 9 is a diagram showing an example of a syslog stored in the log management DB 205, and each syslog is composed of (1) the date and time of occurrence, (2) the NF type, (3) the NF ID, and (4) event information.

In this embodiment, the records of (5) event label and (6) event ID, which are assigned after determining the dependency between syslogs, are also effectively secured. However, since the determination is not complete when the syslog is received from 5GC at time t3, the records of (5) event label and (6) event ID for each syslog are still empty.

At time t5, the log analysis unit 203 acquires from the log management DB 205 syslogs for which dependency analysis has not been performed. Here, all syslogs for which the (5) event label and (6) event ID fields are blank are acquired.

At time t6, the log analysis unit 203 acquires the connectivity information between the NFs (FIG. 4) from the NF connection management DB 204. At time t7, the log analysis unit 203 acquires the dependency relationships between the syslog events from the event management DB 206.

Figure 10 shows an example of dependencies between syslog events. The communication flow between NFs in a mobile core network is specified in detail by 3GPP (TS23.502). In this embodiment, dependencies between syslog events, i.e., dependencies such as the occurrence of an event in a certain NF after the occurrence of an event in a certain NF, are constructed in advance in accordance with the 3GPP standard.

Figure 10 shows an example of a dependency relationship between events in a UE connection (an action in which a user equipment (UE) requests permission for Internet communication from a carrier), where Event 1 occurs in the AMF, followed by Event 2 in the AUSF, and then Event 3 in the UDM, and an example of a dependency relationship between events in a PDU connection (an action in which equipment such as a server or rack is connected to a power distribution unit (PDU)), where Event 4 occurs in the AMF, followed by Event 5 in the SMF, then Event 6 in the PCF, and then Event 7 in the SMF. Note that in this embodiment, an event label (UE connection, PDU connection, etc.) is assigned in advance to each dependency relationship between events to identify each event.

At time t8, the log analysis unit 203 determines the dependencies between syslogs based on the acquired information. In this embodiment, the dependencies between syslogs are determined by analyzing the syslogs acquired at times t5 to t7, the connection relationships between NFs, and the dependencies between events.

Figure 11 is a flowchart showing the procedure by which the log analysis unit 203 analyzes and determines dependencies between syslogs. In step S1, a temporary storage array that temporarily stores the dependencies between syslogs is initialized. In step S2, it is determined whether or not there is a syslog in which the (5) event label and (6) event ID are blank. If such a syslog exists, the process proceeds to step S3.

In step S3, the system logs with blank "event label" and "event ID" are sorted in order of the oldest occurrence time, and the oldest system log is extracted and saved in the temporary storage array. In step S4, the next oldest system log is extracted.

In step S5, the pair of the oldest and second oldest syslogs is considered, and it is determined based on the connectivity information whether the NF of the oldest syslog and the NF of the second oldest syslog are in a connected relationship.

If the NFs are connected, the process proceeds to step S6, where a determination is made as to whether or not there is a dependency between the oldest syslog event and the next oldest syslog event based on the dependency between the events.

If there is a dependency between the events, it is determined that there is a dependency between the oldest syslog and the next oldest syslog, and the process proceeds to step S7, where the next oldest syslog is added and saved to the temporary storage array. In step S8, it is determined whether the next oldest syslog among the pair of syslogs determined to have a dependency between them is the last syslog in the dependency relationship of the corresponding event.

If it is not the last syslog, the process returns to step S4, and the pair of syslogs of interest is switched to the pair of the next oldest syslog and the next oldest syslog determined to have a dependency between the syslogs, while repeatedly determining the dependency between the syslogs based on the connection relationship and the dependency between events.

On the other hand, if it is determined that the next oldest syslog is the last syslog in the dependency relationship of the corresponding event, the process proceeds to step S9. In step S9, as shown in FIG. 12, a common event ID is assigned to the series of syslogs that are stored in the temporary storage array and are linked by the dependency relationship of the syslogs, and a unique event label is further assigned to each syslog. The temporary storage array is saved in the log management DB 205 at time t9.

In this embodiment, the same event ID is assigned to syslogs for which the connection relationships between the NFs and the dependencies between events are established, so in the illustrated example, it can be seen that the syslogs at times T1, T3, and T6 are in a dependent relationship in that order, and the syslogs at times T2, T4, T5, and T7 are in a dependent relationship in that order.

The above embodiment not only reduces the amount of calculation required to build an AI/ML learning model used to automate network operations, but also makes it easier to analyze faults and check status when network operations are automated, making it possible to provide the benefits of automated network operations to many people regardless of geographic or economic disparities. As a result, it is possible to contribute to Goal 9 "Build resilient infrastructure and promote inclusive and sustainable industrialization" and Goal 11 "Make cities inclusive, safe, resilient and sustainable" of the United Nations-led Sustainable Development Goals (SDGs).

10...5G core network (5GC), 20...log analysis node, 30...AI/ML implementation node, 201...log acquisition unit, 202...connectivity management unit, 203...log analysis unit, 204...NF connection management DB, 205...log management DB, 206...event management DB

Claims (9)

A log dependency determination device that determines the dependency of syslogs output by each network function (NF) that constitutes a mobile core network,
A means for managing history information of inquiries made to the NRF when each network function connects to another network function;
A means for determining a connection relationship between each network function based on the history information ;
A means of determining dependencies between events in each syslog;
and means for determining the dependency relationship of each syslog based on the connection relationship and the dependency relationship between events. A log dependency determination device that determines the dependency of syslogs output by each network function (NF) that constitutes a mobile core network,
A means for determining a connection relationship between each network function;
A means of determining dependencies between events in each syslog;
means for determining a dependency relationship between each syslog based on the connection relationship and the dependency relationship between events ;
The means for determining the dependency relationship of each system log includes:
Among the syslogs output by the mobile core network within a given period, a pair of syslogs with the oldest and second oldest event occurrence times is considered;
analyzing whether or not there is a connection relationship between the network function that output the oldest syslog and the network function that output the second oldest syslog, and whether or not there is a dependency relationship between an event of the oldest syslog and an event of the second oldest syslog;
Repeating the process of determining that a pair of syslogs having the connection relationship and the dependency relationship between events has a dependency relationship between the syslogs while switching the pair of syslogs of interest to the pair of the next oldest syslog and the syslog that is determined to have a dependency relationship between the syslogs, and
A log dependency determination device for a mobile core network, characterized in that a common ID is assigned to a series of syslogs that are linked by syslog dependencies. A means for managing history information of an inquiry made to the NRF when each network function connects to another network function is provided;
3. The log dependency determination device for a mobile core network according to claim 2 , wherein said means for determining the connection relationship determines the connection relationship between each network function based on said history information. A means for statically storing dependencies between events in each system log based on the flow of communication between network functions in a mobile core network defined by 3GPP is provided;
The log dependency determination device for a mobile core network as described in claim 1 or 3 , characterized in that the means for determining the dependency between the events determines the dependency between the events of each syslog based on the dependency between the statically stored events. The means for determining the dependency relationship of each system log includes:
Among the syslogs output by the mobile core network within a given period, a pair of syslogs with the oldest and second oldest event occurrence times is considered;
analyzing whether or not there is a connection relationship between the network function that output the oldest syslog and the network function that output the second oldest syslog, and whether or not there is a dependency relationship between an event of the oldest syslog and an event of the second oldest syslog;
Repeating the process of determining that a pair of syslogs having the connection relationship and the dependency relationship between events has a dependency relationship between the syslogs while switching the pair of syslogs of interest to the pair of the next oldest syslog and the syslog that is determined to have a dependency relationship between the syslogs, and
2. The mobile core network log dependency determination device according to claim 1 , further comprising a common ID for assigning a common ID to a series of syslogs in which the dependency of syslogs is linked. A method for determining log dependency in which a computer determines the dependency of syslogs output by each network function (NF) constituting a mobile core network, comprising:
Manages the history information of inquiries made to the NRF when each network function connects to another network function,
determining a connection relationship between each network function based on the history information;
Determine dependencies between events in each syslog,
A method for determining log dependency relationships in a mobile core network, characterized in that the method determines the dependency relationships of each syslog based on the connection relationships and the dependency relationships between events. A method for determining log dependency in which a computer determines the dependency of syslogs output by each network function (NF) constituting a mobile core network, comprising:
Determine the connections between each network function,
Determine dependencies between events in each syslog,
determining a dependency relationship between each syslog based on the connection relationship and the dependency relationship between events;
When determining the dependencies of each of the above system logs,
Among the syslogs output by the mobile core network within a given period, a pair of syslogs with the oldest and second oldest event occurrence times is considered;
analyzing whether or not there is a connection relationship between the network function that output the oldest syslog and the network function that output the second oldest syslog, and whether or not there is a dependency relationship between an event of the oldest syslog and an event of the second oldest syslog;
The step of determining that the pair of syslogs having the connection relationship and the dependency relationship between events has a dependency relationship between the syslogs is repeated while switching the pair of syslogs of interest to the pair of the next oldest syslog and the syslog that is determined to have a dependency relationship between the syslogs, and
A method for determining log dependency relationships in a mobile core network, characterized in that a common ID is assigned to a series of syslogs in which syslog dependencies are linked. In a log dependency determination program that determines the dependency of system logs output by each network function (NF) that constitutes a mobile core network,
A procedure for managing history information of inquiries made to the NRF when each network function connects to another network function;
determining a connection relationship between each of the network functions based on the history information ;
Procedures for determining dependencies between events in each syslog;
and determining the dependency relationship of each syslog based on the connection relationship and the dependency relationship between events. In a log dependency determination program that determines the dependency of system logs output by each network function (NF) that constitutes a mobile core network,
A procedure for determining the connection relationships between each network function;
Procedures for determining dependencies between events in each syslog;
determining a dependency relationship between each syslog based on the connection relationship and the dependency relationship between events;
In the step of determining the dependency relationship between each of the system logs,
Among the syslogs output by the mobile core network within a given period, a pair of syslogs with the oldest and second oldest event occurrence times is considered;
analyzing whether or not there is a connection relationship between the network function that output the oldest syslog and the network function that output the second oldest syslog, and whether or not there is a dependency relationship between an event of the oldest syslog and an event of the second oldest syslog;
Repeating the process of determining that a pair of syslogs having the connection relationship and the dependency relationship between events has a dependency relationship between the syslogs while switching the pair of syslogs of interest to the pair of the next oldest syslog and the syslog that is determined to have a dependency relationship between the syslogs, and
A program for determining log dependency relationships in a mobile core network, characterized in that a common ID is assigned to a series of syslogs that are linked by syslog dependencies.

Images