JP7745478B2 - Analytical device and analytical method - Google Patents

Description

This disclosure relates to an analytical device and an analytical method.

The log analysis system described in Patent Document 1 aims to shorten the time required to extract combinations of log messages output consecutively within a certain period of time when analyzing log messages output from an information processing system. To achieve this goal, the log analysis system generates a reference pattern for each combination of log messages that appear synchronously based on the log message appearance information, and integrates the reference patterns based on the results of comparing the appearance information of the log messages included in the reference patterns between the reference patterns.

International Publication No. 2016-075915

However, because the format of the logs output and the time intervals at which the logs are output differ for each of the above-mentioned information processing systems, it has been difficult to detect concurrent occurrence patterns among multiple logs with different formats and other characteristics output from multiple information processing systems.

The objective of this disclosure is to provide an analysis device and analysis method that reduces the difficulty of detecting co-occurrence patterns between data with different granularities.

To solve the above-mentioned problems, the analysis device disclosed herein includes a data acquisition unit that acquires data from multiple devices; an individual analysis unit that extracts multiple simultaneous occurrence patterns and the number of occurrences of the multiple simultaneous occurrence patterns from the acquired data for each device, and creates an integrated log by integrating the extracted simultaneous occurrence patterns based on the extracted number of occurrences; an integration unit that combines the integrated logs between multiple devices; and an integrated analysis unit that extracts simultaneous occurrence patterns from the combined log.

The analysis device disclosed herein reduces the difficulty of detecting co-occurrence patterns between data of different granularity.

FIG. 2 is a functional block diagram of an analysis apparatus BS according to an embodiment. FIG. 2 is a functional block diagram of a log individual analysis unit 2 according to the embodiment. FIG. 2 is a functional block diagram of an integrated log analysis unit 4 according to the embodiment. 2 shows a hardware configuration of an analysis apparatus BS according to an embodiment. 10 is a flowchart showing the operation of the analyzer BS of the embodiment. 1 illustrates the extraction and integration of event patterns according to an embodiment. 10 illustrates an integrated log (first half) according to an embodiment. 10 shows an integrated log (second half) according to an embodiment. 10 illustrates an integrated log (first half) for multiple devices according to an embodiment. 10 shows the integrated log (second half) of a plurality of devices according to an embodiment. 10 illustrates the deletion of an event according to an embodiment. The effects of the analysis device BS of the embodiment are shown.

This section describes an embodiment of an analytical device according to the present disclosure.

In the following, to facilitate explanation and understanding, multiple names may be collectively referred to by a single reference symbol; for example, the reference symbol "1" may be used to collectively refer to "data acquisition unit 1A,""data acquisition unit 1B," etc.
Embodiment.
<Embodiment>
<Functions of the embodiment>
The analysis device BS of the embodiment extracts co-occurrence patterns from the same data. In the analysis device BS of the embodiment, the processing is not divided into a learning phase and an inference phase.

A "co-occurrence pattern" refers to a combination of data that causes the same phenomenon. Hereinafter, "co-occurrence pattern" and "event pattern" are synonymous and may be abbreviated to "pattern."

Figure 1 is a functional block diagram of the analysis device BS of this embodiment.

As shown in FIG. 1, the analysis device BS includes data acquisition units 1A-1D, individual log analysis units 2A-2D, integrated log creation units 3A-3D, integrated log analysis units 4A-4D, pattern display unit 5, and pattern storage unit 6.

<Configuration of data acquisition unit 1>
The data acquisition unit 1 acquires at least one piece of data (e.g., log data, metrics data) that is the analysis target BT from the system that is the target of analysis. The data acquisition unit 1 passes the acquired data to the log individual analysis unit 2.

<Configuration of individual log analysis unit 2>
FIG. 2 is a functional block diagram of the individual log analysis unit 2 according to the embodiment.

As shown in FIG. 2, the individual log analysis unit 2 includes a first pattern extraction unit 20, a first pattern integration unit 21, a log integration unit 22, and an event pattern definition unit 23.

The first pattern extraction unit 20 classifies data with overlapping index ranges acquired from the data acquisition unit 1 and the log integration unit 22 into rows and converts them into classification values. The first pattern extraction unit 20 performs frequent pattern mining on classification values that occur in close time periods to extract combinations of events that form simultaneous occurrence patterns.

Events can be extracted using methods such as association analysis, a machine learning technique, or by matching them with an external file that stores event patterns.

The first pattern integration unit 21 integrates patterns based on the occurrence frequency of events or event patterns extracted by the first pattern extraction unit 20.

As a method for integrating patterns, for example, methods can be used in which matching subsets of event patterns are extracted as integration candidates, the occurrence frequency of each event is calculated and tallied using time-series data acquired from the data acquisition unit 1 or the log integration unit 22, and the common parts of the event patterns are merged based on the results of the calculation and aggregation.

The log integration unit 22 integrates the extracted pattern sequences into a single log row and sorts them in index order or chronological order. The log integration unit 22 assigns names to the extracted patterns to classify the logs, and compresses the pattern definitions and pattern classification results. The log integration unit 22 saves the extracted patterns in the event pattern definition unit.

The event pattern definition unit 23 stores pattern definitions, etc. in any location, such as memory or a database.

The log storage unit 24 stores a log consisting of a collection of events from which no patterns were extracted. The stored log may be used by the first pattern extraction unit 20 as an element for specifying the analysis range, etc., or may be discarded before further analysis.

<Configuration of Integrated Log Creation Unit 3>
The integrated log creator 3 integrates the series of integrated logs created by the individual log analyzer 2 into a single log line.

<Configuration of Integrated Log Analysis Unit 4>
FIG. 3 is a functional block diagram of the integrated log analysis unit 4 according to the embodiment.

As shown in FIG. 3, the integrated log analysis unit 4 has an event extraction unit 40 and a second pattern integration unit 41.

The event extraction unit 40 extracts events by performing frequent pattern mining on the data acquired by the integrated log creation unit 3.

Event extraction methods may include association analysis, a machine learning technique, or matching with an external file that contains event patterns.

The second pattern integration unit 41 deletes unnecessary events from the extracted event pattern.

Event deletion is performed by extracting matching event pattern subsets as integration candidates, calculating and aggregating the temporal occurrence frequency of each event from the time-series data obtained from the integrated log creation unit 3, and deleting event patterns with significantly different occurrence frequencies. This allows only appropriate patterns to be output.

<Configuration of pattern display unit 5 and pattern storage unit 6>
The pattern display unit 5 displays the extracted event pattern, and the pattern storage unit 6 stores the extracted event pattern.

Hardware Configuration of the Embodiment
FIG. 4 shows the hardware configuration of the analysis apparatus BS according to the embodiment.

To perform the above-described functions, the analytical device BS of this embodiment includes a processor PR, memory ME, and storage medium KI, as shown in FIG. 2, and may further include an input unit NY and an output unit SY as needed.

The processor PR is the well-known core of a computer, operating the hardware according to software. The memory ME is composed of, for example, dynamic random access memory (DRAM) and static random access memory (SRAM). The storage medium KI is composed of, for example, a hard disk drive (HDD), a solid state drive (SSD), and read-only memory (ROM). The storage medium KI stores a program PRG. The program PRG is a set of instructions that defines the processing to be executed by the processor PR.

The input unit NY is composed of, for example, a camera, microphone, keyboard, mouse, and touch panel. The output unit SY is composed of, for example, an LCD monitor, printer, and touch panel.

Regarding the relationship between the functions and hardware configuration of the analytical device BS, the processor PR executes the program PRG stored in the storage medium KI using the memory ME on the hardware, and controls the operation of the input unit NY and output unit SY as necessary, thereby realizing the functions of each unit from the data acquisition unit 1 to the pattern display unit 5.

<Operation of the embodiment>
FIG. 5 is a flowchart showing the operation of the analyzer BS according to the embodiment.

Step ST1: The data acquisition unit 1 acquires data (e.g., string sequence data or numeric sequence data) as the analysis target BT from the information system to be analyzed.

Step ST2: Perform frequent pattern mining on the acquired data, for example, time-series data, to extract co-occurrence patterns and their occurrence counts.

Step ST3: Event patterns with matching subsets are extracted as integration candidates, and the common parts of the patterns are merged based on the extracted number of occurrences.

Figure 6 shows the extraction and integration of event patterns in an embodiment.

As shown in Figure 6, simultaneous event patterns and the number of times the events occur are extracted from the log output from device X (step ST2).

The extracted occurrence counts are tallied using a tree structure. Specifically, one path from the top node to the terminal leaf node corresponds to one combination pattern, and the number of occurrences of an event at a leaf node also represents the number of occurrences of that event combination pattern.

In Figure 6, "phenomenon" and "event" are the same. For example, phenomenon A output in the log data and event A represented as a leaf node of the tree are the same.

For example, the pattern of the number of occurrences of (D, E) in the extracted event pattern (A, D, E) matches the pattern of the number of occurrences of (D, E) in the event pattern (D, E, F). Therefore, the two event patterns are combined to create an event pattern (A, D, E, F) (step ST3).

Step ST4: Name the extracted patterns, classify the logs, and create an integrated log that condenses the pattern definitions and pattern classification results.

The definitions of the extracted patterns are stored in the event pattern definition unit 23. Events that are not extracted as patterns are stored in the log storage unit 24.

Figure 7 shows the integrated log (first half) of an embodiment.

Figure 8 shows the integrated log (second half) of the embodiment.

Eight event patterns are extracted from the log data of device X (shown in FIG. 6), more specifically, the event patterns (phenomenon A, phenomenon B, phenomenon C), (phenomenon A, phenomenon B), (phenomenon A), (phenomenon A, phenomenon D), (phenomenon A, phenomenon D, phenomenon E), (phenomenon A, phenomenon D, phenomenon E, phenomenon F), (phenomenon D), and (phenomenon D, phenomenon F). The extracted patterns are given names (e.g., pattern P1, pattern P2), and the pattern definitions "Pattern P1: (phenomenon A, phenomenon B, phenomenon C), pattern P2: (phenomenon A, phenomenon B), pattern P3: (phenomenon A), pattern P4: (phenomenon A, phenomenon D), pattern P5: (phenomenon A, phenomenon D, phenomenon E), pattern P6: (phenomenon A, phenomenon D, phenomenon E, phenomenon F), pattern P7: (phenomenon D), pattern P8: (phenomenon D, phenomenon F)" are saved in the event pattern definition unit 23.

The pattern classification results are: {2021/1/100:00:01, 2021/1/100:00:03} Pattern P1; {2021/1/100:00:04, 2021/1/100:00:05} Pattern P2; {2021/1/100:00:06, 2021/1/100:00:06} Pattern P3; {2021/1/100:00:07, 2021/1/100:00:08} Pattern P4; {2021/1/10 Define "{2021/1/100:00:07, 2021/1/100:00:09} Pattern P5; {2021/1/100:00:07, 2021/1/100:00:10} Pattern P6; {2021/1/100:00:11, 2021/1/100:00:11} Pattern P7; {2021/1/100:00:13, 2021/1/100:00:14} Pattern P8" as an integrated log and sort by index order or chronological order.

The event "2021/1/100:00:15 Phenomenon G" that was not extracted as an event pattern is stored in the log storage unit 24, which holds a log consisting of a collection of events for which patterns were not extracted.

Step ST5: The same processing as in step ST2 is performed on the created integrated log.

Step ST6: Repeat steps ST2 to ST5 until there are no more unclassified events or until frequent patterns can no longer be extracted. The series of processes in steps ST2 to ST6 are independent for each log, and the processing of any log may precede or run in parallel.

Step ST7: The integrated logs generated up to step ST6 are integrated in chronological order, i.e., a combined log is generated.

If there is only one log to be analyzed, processing from step ST7 onwards may be omitted.

Figure 9 shows the first half of the integrated log for multiple devices in this embodiment.

Figure 10 shows the second half of the integrated log for multiple devices in this embodiment.

It is assumed that by repeating steps ST2 to ST6 for device Y, the integrated log "{2021/1/100:00:02, 2021/1/100:00:03} Pattern Q1; {2021/1/100:00:03, 2021/1/100:00:03} Pattern Q2" is output.

In step ST7, the integrated logs generated from the data of device X and device Y are merged, and the integrated log of device X and the integrated log of device Y are combined. This generates an integrated log sorted in index order and chronological order, i.e., a combined log "{2021/1/100:00:01, 2021/1/100:00:03} Pattern P1; {2021/1/100:00:02, 2021/1/100:00:03} Pattern Q1; {2021/1/100:00:03, 2021/1/100:00:03} Pattern Q2; {2021/1/100:00:04, 2021/1/100:00:05} Pattern P2; {2021/1/100:00:06, 2021/1 /100:00:06} Pattern P3; {2021/1/100:00:07, 2021/1/100:00:08} Pattern P4; {2021/1/100:00:07, 2021/1/100:00:09} Pattern P5; {2021/1/100:00:07, 2021/1/100:00:10} Pattern P6; {2021/1/100:00:11, 2021/1/100:00:11} Pattern P7; {2021/1/100:00:13, 2021/1/100:00:14} Pattern P8" are defined.

Step ST8: Frequent pattern mining is performed on the generated integrated log, i.e., the combined log, to extract co-occurrence patterns and the temporal occurrence frequency of each event.

Here, matching subsets of event patterns are extracted as integration candidates, and based on the temporal occurrence frequency of each extracted event, event patterns with a low probability of occurring simultaneously are removed, and frequent pattern mining at a higher level is performed to extract event patterns.

Step ST9: Determine whether the event patterns have a discrepancy in their occurrence frequency over time.

Figure 11 shows an embodiment of deleting an event.

As shown in Figure 11, if the extracted event patterns are (A, B, C) = (9 times/10 seconds, 5 times/10 seconds, 1 time/10 seconds), (α, ε) = (80 times/100 seconds, 40 times/100 seconds), the temporal occurrence frequencies of the event patterns can be expressed as (A, B, C) = 1 time/10 seconds, (A, B) = 4 times/10 seconds, (A) = 4 times/10 seconds, (α, ε) = 4 times/10 seconds, (α) = 4 times/10 seconds. Patterns that have a low probability of co-occurring with event pattern α can be considered to have temporal occurrence frequencies that are significantly different from the occurrence pattern of event pattern α, so event patterns (A, B, C) with large deviations in temporal occurrence frequencies are deleted.

The threshold for the temporal frequency of events to be deleted may be set arbitrarily.

If there are no candidates for deleting an event pattern, proceed to step ST10 without deleting the event.

Here, for example, (A), (A, B) and (α) are calculated as follows.
Event A is called A, event B is called B, and event C is called C, and (A, B) is the unit of combination, and A and B are a combination.

If (A) = frequency of occurrence of only A, (A, B) = frequency of occurrence of only A and B, and (A, B, C) = frequency of occurrence of only A, B, and C,

(A)
= Frequency of occurrence of A - Frequency of occurrence of A and B
= 9 times/10 seconds - 5 times/10 seconds
= 4 times/10 seconds

(A, B)
= Frequency of occurrence of A and B - (A, B, C)
= 5 times/10 seconds - 1 time/10 seconds
= 4 times/10 seconds

(α)
= Frequency of occurrence of α - Frequency of occurrence of α and ε
= 80 times/100 seconds - 40 times/100 seconds
= 40 times/100 seconds
= 4 times/10 seconds

Step ST11: The extracted event pattern is displayed by the pattern display unit 5 or stored in the pattern storage unit 6.

Effects of the embodiment
FIG. 12 shows the effect of the analyzer BS of the embodiment.

As shown in Figure 12, conventional pattern extraction uses frequent pattern mining after integrating different data, i.e., the log data of device X and the log data of device Y. Therefore, there is a high possibility that only disconnected co-occurrence patterns will be extracted.

As described above and shown in FIG. 12, the analysis device BS of the embodiment classifies data separately for each series, i.e., for each device X and each device Y, and then integrates the data. The analysis device BS of the embodiment uses frequent pattern mining on the integrated data. This makes it possible to extract co-occurrence patterns, for example, between character data and numeric data, in other words, between data of different granularity.

The analysis device BS of this embodiment also repeats the processes of event extraction, pattern integration, and log integration based on conditions. This eliminates the need for a person to specify the number of times to extract simultaneous patterns, and also prevents patterns from being missed during extraction.

Generally, as log sizes tend to increase, concurrent patterns tend to be extracted in a fragmented state. However, the analysis device BS of this embodiment can efficiently extract concurrent patterns and improve analysis accuracy by merging the common parts of fragmented event patterns. Furthermore, by deleting patterns with divergent event pattern occurrence frequencies, analysis time can be shortened, allowing concurrent patterns to be extracted more efficiently. Furthermore, analysis time can be shortened by compressing the log while performing analysis.

<Variation 1>
When the use is limited (for example, when there is only one log to be analyzed), the analysis device BS may be configured without the integrated log creation unit 3 and the integrated log analysis unit 4.

<Variation 2>
Unlike the embodiment that uses a general machine learning method (for example, association analysis) as a frequent pattern mining method, the event patterns may be extracted by, for example, comparing them with an external file that holds the event patterns.

<Variation 3>
Regarding the occurrence frequencies described above, it is also possible to use the occurrence frequencies calculated by the first pattern extraction unit 20 as they are, and delete patterns with deviations in occurrence frequencies. Therefore, the process of step ST8 may be omitted, and combination candidates may be listed. Furthermore, it is also possible to reduce the amount of calculation by performing the process of step ST8 after eliminating combination candidates through the analysis of steps ST9 and ST10.

The above-described embodiments may be combined, and components within each embodiment may be deleted or modified, or other components may be added, as appropriate, without departing from the spirit of this disclosure.

1 Data acquisition unit, 2 Individual log analysis unit, 3 Integrated log creation unit, 4 Integrated log analysis unit, 5 Pattern display unit, 6 Pattern storage unit, 20 First pattern extraction unit, 21 First pattern integration unit, 22 Log integration unit, 23 Event pattern definition unit, 24 Log storage unit, 40 Event extraction unit, 41 Second pattern integration unit, BS Analysis device, BT Analysis target, KI Storage medium, ME Memory, NY Input unit, P Pattern, PR Processor, PRG Program, Q Pattern, SY Output unit, X Device, Y Device.

Claims (7)

a data acquisition unit that acquires data from a plurality of devices;
an individual analysis unit that extracts, for each of the devices, a plurality of simultaneous occurrence patterns and the number of times the simultaneous occurrence patterns occur in the acquired data, and creates an integrated log by integrating the extracted simultaneous occurrence patterns based on the extracted number of times the patterns occur;
an integration unit that combines the integrated logs between the plurality of devices;
an integrated analysis unit that extracts the co-occurrence patterns from the combined logs;
An analytical device comprising: the individual analysis unit has a first pattern extraction unit, a first pattern integration unit, and a log integration unit, and repeats processing by the first pattern extraction unit, processing by the first pattern integration unit, and processing by the log integration unit until there are no unclassified events or until frequent patterns can no longer be extracted.
The analytical device of claim 1 . the integration unit merges common similar parts among the extracted multiple co-occurrence patterns;
The analytical device of claim 1 . the individual analysis unit extracts the temporal occurrence frequency of the simultaneous occurrence pattern;
the integrated analysis unit excludes simultaneous occurrence patterns that cannot occur simultaneously based on the extracted temporal occurrence frequencies;
The analytical device of claim 1 . the integration unit names and classifies the co-occurrence patterns, and compresses the definitions of the co-occurrence patterns and the results of the classification.
The analytical device of claim 1 . the individual analysis unit has a log storage unit that stores a log consisting of a set of events from which the simultaneous occurrence pattern is not extracted,
The stored log is treated as a series of combination patterns with one event in the same manner as other combination patterns in subsequent processing, and is used to specify the range of analysis, or is discarded and then analyzed.
The analytical device according to claim 5 . The data acquisition unit acquires a plurality of pieces of data,
an individual analysis unit extracting a plurality of simultaneous occurrence patterns from the plurality of acquired data and the number of occurrences of the simultaneous occurrence patterns;
an integration unit that integrates the extracted simultaneous occurrence patterns based on the extracted occurrence counts to create an integrated log;
an integrated analysis unit extracting the coincidence patterns from the integrated logs;
Analysis method.