Nippon Telegraph and Telephone Corporation

Osaka University

Keisuke Ishibashi

Ryoichi Kawahara

Yasuhiro Ikeda

Keishiro Watanabe

Yusuke Nakano

Kohei Shiomoto

Masayuki Murata

Yousuke Takahashi

Noriaki Kamiyama

Tatsuya Mori

Takeru Inoue

Shigeaki Harada

Kazumichi Sato

Yuichi Ohsita

Akihiro Shimoda

Shigeki Goto

Masahiro Kobayashi

Daisuke Ikegami

Tatsuaki Kimura

Yuka Komai

Toshiyuki Kanazawa

Masaki Aida

Yoko Hoshiai

Kengo Tajiri

Rie Tagyo

Yuichi Ohshita

A feature value generation device includes a generator configured to generate vectors whose elements are feature values of data items collected at a plurality of timings from a target of anomaly detection, so as to normalize or standardize the vectors based on a set of predetermined vectors; a learning unit configured to learn the predetermined vectors so as to output a learning result; and a detector configured to detect, for each of the vectors normalized or standardized by the generator, an anomaly based on said each of the vectors and the learning result. The set of predetermined vectors is a set of vectors with which no anomaly is detected by the detector, and the set of vectors is updated in accordance with no anomaly being detected by the detector.

Anomaly detection method using an autoencoder learning from data items collected by measuring devices

A control device of the present invention is for calculating allocation information regarding the allocation of wireless resources of a plurality of base stations to a plurality of user devices. The control device includes: information managing means for storing request data amounts of the user devices; calculating means for calculating an estimated waiting time for each of the user devices by dividing the request data amount by an available bandwidth, and, using the maximum transmission power of the base stations as a constraint, calculating the allocation information regarding the allocation of the wireless resources of the base stations to the user devices so as to minimize the estimated waiting time of the user device having the highest estimated waiting time; and outputting means for outputting the allocation information that was calculated by the calculating means.

Control apparatus, resource allocation method and program

An anomaly factor estimation apparatus includes a memory and a processor configured to execute training an anomaly detection model for performing anomaly detection based on an error of output data with respect to input data represented by a multidimensional numerical vector; inputting test data into the anomaly detection model, to determine whether the test data corresponds to an anomaly based on output data output from the anomaly detection model and the test data; and calculating a degree of contribution to the anomaly for each dimension of the test data based on a likelihood of said each dimension, in response to determining that the test data corresponds to the anomaly.

Anomaly factor estimation apparatus, anomaly factor estimation method and program

A feature value generation device includes a generator configured to digitize non-numerical text data items collected at a plurality of timings from a target of anomaly detection, to generate vectors whose elements are feature values corresponding to the digitized data items; a learning unit configured to learn the vectors during a learning period so as to output a learning result; and a detector configured to detect, during a test period, for each of the vectors generated by the generator, an anomaly based on said each of the vectors and the learning result.

Feature value generation device, feature value generation method, and program

A resource allocation calculation device includes: a demand prediction unit that for each of a plurality of virtual networks sharing a physical network, predicts demands in units of communications sharing common origin and destination nodes; and an allocation calculation unit that based on the demands predicted by the demand prediction unit, observed past demands in the units of communications and past allocated bandwidths in the units of communications, calculates allocated bandwidths and allocated routes at a current time for the respective units of communications in such a manner that fairness between utilities of the respective virtual networks is maximized, which enhances fairness and efficiency of allocation of resources to a plurality of virtual networks sharing resources of a physical network.

Resource allocation calculation apparatus and resource allocation calculation method to enhance fairness and efficiency in allocation of resources among multiple virtual networks within a physical network

An anomaly detection apparatus having a function of an autoencoder that includes an input layer, hidden layers, and an output layer, and that learns parameters such that data of the input layer is reproduced in the output layer, the anomaly detection apparatus including: input means that input normal data of a plurality of types; learning means that learn parameters such that normal data of the input layer is reproduced in the output layer by learning a feature across data types using data of a dimension which is smaller than a dimension of the normal data; and anomaly degree calculation means that input test data to the autoencoder using the parameters learned by the learning means, and calculate anomaly degree of the test data based on output data of the autoencoder and the test data.

Anomaly detection apparatus, anomaly detection method, and program

A device for estimating a cause of an anomaly comprises: a detection unit to detect an anomaly in a detection target based on a learner trained on first numerical vectors obtained from a detection target when the detection target is under a normal condition and second numerical vectors to be obtained from the detection target at multiple time; and a first computing unit to compute, for each metric of a second numerical vector from which an anomaly has been detected, as information for estimating a metric of cause of the anomaly, a value obtained by subtracting, from a value of the metric, an average of the metric in the first numerical vectors, and dividing a result of the subtracting by standard deviation of the metric in the first numerical vectors. This device supports estimation of the cause of an anomaly detected in a target object for detecting an anomaly.

Anomaly factor estimation device, anomaly factor estimation method, and storage medium

An apparatus for estimating anomaly information includes an input unit configured to input anomaly data detected as anomaly by an anomaly detecting algorithm that outputs an anomaly degree of input data for vectors, using learning of the vectors in a normal state, and an estimate unit configured to search for one or more vectors that decrease the degree of anomaly when added to the anomaly data, taking into account a likelihood, for each dimension, of a given dimension being a cause of the anomaly, and estimate the cause of the anomaly based on the searched vectors whereby it is possible to estimate detailed information on a detected anomaly.

Apparatus and method for estimating anomaly information, and program

An access source classification apparatus has: a first calculation unit that calculates a statistic related to access to each service by each access source based on a set of access logs indicating access to any service of a plurality of services by any access source of a plurality of access sources; an extraction unit that, for each of the services, calculates an index value indicating distribution of access status to the service for each of the access sources based on the access logs related to the service, and extracts some services based on the index value; a second calculation unit that calculates relevance between each access source and each service extracted by the extraction unit by applying a clustering approach to the statistic; and a classification unit that classifies an access source to any service extracted by the extraction unit into any of groups each including one or more access sources based on the relevance, thereby assisting improvement of efficiency in identifying the terminal type of an access source to a service.

Access origin classification apparatus, access origin classification method and program

A first time series of traffic volume and a first time series of communication quality that are observed in a first communication line in which traffic demand is equal to or greater than a line bandwidth and a second time series of traffic volume and a second time series of communication quality that are observed in a second communication line in which traffic demand is less than a line bandwidth are input to a state space model to estimate values of a parameter group of the state space model, the traffic demand is calculated based on the values of the parameter group, and the state space model is a state space model in which the first time series of traffic volume and the second time series of traffic volume are generated from a third time series indicating cyclicity of traffic common to the first communication line and the second communication line under influence of the first time series of communication quality and the second time series of communication quality on the traffic demand, thereby supporting appropriate band design of an overload line in which traffic demand is equal to or greater than a line bandwidth.

Traffic estimation apparatus, traffic estimation method and program

A name identification device includes a generation unit configured to generate graph information in which each node represents one of names and IP addresses included in A records and CNAME records included in a DNS response observed in a network, and each edge represents a correspondence relationship between one and another of the names and the IP addresses in the A records and the CNAME records, and to associate the generated graph information with a client corresponding to the DNS response; and an identifying unit configured to identify a name related to a leaf node that is reachable from a node corresponding to the IP address of a server by tracing the edges in the graph information having been associated with the client, for a packet between the client and the server that is observed in the network.

Name identification device, name identification method, and recording medium

A virtual network control apparatus configured to perform assignment of physical resources under management for a virtual network embedding request, including: a physical network resource management agent configured to manage use state of resources on a physical network at each future time; and a virtual network control agent, the virtual network control agent including: demand prediction means configured to perform prediction of future demand for a virtual network; and use resource determination means configured to calculate physical resources to be used at each future time by the virtual network based on a prediction result of the demand obtained by the demand prediction means and information of future use state of resources on the physical network obtained from the physical network resource management agent, and to notify the physical network resource management agent of information of physical resources of the calculation result.

Virtual network control apparatus, virtual network control method, and program

A design apparatus is provided for designing a probability that a delivery server or a delivery route is selected for content delivery in response to a delivery request from a user. The design apparatus receives, as input parameter values, a parameter related to a network and an estimated amount of demand for delivery requests generated by users for content, and designs a selection probability that a cache server is selected as a delivery server for content delivery or a selection probability that a delivery route is selected, using model predictive control. The model predictive control uses an objective function for reducing the number of excessive delivery requests, each of which is a delivery request generated by a user for a content item and then rejected, and said delivery route is a combination of the delivery server and a delivery path on which the content is delivered by the delivery server.

Apparatus, design method, and recording medium

An estimation device is provided that measures a number of DNS requests for each of a plurality of domain names and for each IP address in observed flows. The device measures a total number of the flows, and total amounts of data, estimates a relationship between the amount of data for each IP address corresponding to a node, and the number of DNS requests for each domain name corresponding to a non-intermediate node; and based on a value obtained by multiplying the number of requests for each domain name by the amount of data for each flow of each domain name, obtains the amount of data for each flow of each domain name, multiplies the amount of data by the number of the DNS requests for each domain name, so as to calculate an estimate of the amount of data for each domain name.

Estimation device, estimation method, and recording medium

An evaluation device includes a first evaluator configured, for each record used for transmission control of data circulating in a network, to evaluate extent of variation of an amount of the data, based on a history of the amounts of the data matching a condition of the record; a second evaluator configured, for each of the records, to evaluate a size of a space represented by the record, based on the condition of the record; and a calculator configured, for each of the records, to calculate an index value representing a possibility that a predetermined or a greater amount of the data matches the condition of the record within a fixed period of time, based on an evaluation result by the first evaluator, and an evaluation result by the second evaluator. Therefore, it is possible to evaluate a possibility of a sudden occurrence of a flow whose traffic volume is large.

Growing community of inventors

Musashino, Japan

Keisuke Ishibashi