Nippon Telegraph and Telephone Corporation

Naomi Murata

Satoshi Suzuki

Shunsuke Kanai

Fumika Asai

Haruhisa Nozue

Kazuaki Akashi

Kenichi Tayama

Taisuke Yakawa

An aspect of the present disclosure acquires topology information representing a connection configuration between a plurality of apparatuses constituting a communication network and event information representing occurrence statuses of an event by the plurality of apparatuses, estimates, based on the topology information and the event information, a first apparatus corresponding to a failure factor location from among the plurality of apparatuses, estimates, based on an occurrence status of the event by a second apparatus whose connection relationship with the first apparatus estimated is defined by the topology information, whether an occurrence of the event by the second apparatus is caused by the failure factor location or by another anomaly, and estimates, based on a relationship between an occurrence status of the event by the first apparatus and an occurrence status of the event by a third apparatus whose connection relationship with the first apparatus is not defined by the topology information, whether an occurrence of the event by the third apparatus is caused by the failure factor location or by another anomaly.

Anomaly location estimating apparatus, method, and program

According to one aspect of the present invention, when a combination rule of event information to be monitored is created by aggregating a plurality of pieces of event information generated in a network, an information processing device executes: collecting the plurality of pieces of event information; calculating a correlation value for a plurality of combinations of event information including m (m≥3) pieces of event information generated from the plurality of pieces of event information collected; selecting a combination of the pieces of event information for which the calculated correlation value is equal to or higher than a predetermined value, wherein the correlation value increases as the number of times or frequency that the event information included in a combination appears according to the combination increases and also increases as a time interval between the pieces of event information included in the combination decreases; and generating the combination rule on the basis of the event information included in the selected combination.

Combination rules creation device, method and program

To enable more accurate determination of a failure cause event, an event mapping acquiring unit acquires an event mapping file defining a normalized alarm message indicating a normalized alarm content, a resource type indicating an event failure location, an alarm type, and an event type indicating event classification of the alarm in association with one another. An event type conversion unit determines whether input alarm information matches the definition of the event mapping file acquired, when the input alarm information matches the definition, sets the event type to a value defined in the event mapping file, when the input alarm information does not match the definition, sets the event type to the alarm type of alarm information, and registers the event type and the alarm information in association with each other as a failure event in the database.

Rule generation apparatus, rule generation method, and program

As an embodiment of the present invention, a network monitoring apparatus includes a combination rule storage section where a combination rule is registered; and the combination rule includes a combination of a plurality of failure event information to be monitored, and new event information to which the combination of the plurality of failure event information is to be changed. In this state, the network monitoring apparatus collects a plurality of failure event information from network apparatuses; extracts, from the plurality of failure event information collected, a combination of a plurality of failure event information detected to occur within a unit time; and collates the combination of the plurality of failure event information extracted with the combination of the plurality of failure event information defined to be monitored in the combination rule. Then, when the combination of the plurality of failure event information extracted matches in content and occurrence sequence with the combination of the plurality of failure event information defined to be monitored in the combination rule, the network monitoring apparatus adds the new event information included in the combination rule to the combination of the plurality of failure event information extracted, or alternatively, replaces the combination of the plurality of failure event information extracted with the new event information.

Network monitoring apparatus, method, and program

In a failure location identification apparatus according to one embodiment, a facility information management unit records therein facility information including positional information of a physical resource, an external factor information management unit records therein external factor information concerning an external factor that possibly becomes a factor that causes a failure in the physical resource, the external factor information including positional information of the external factor, and a facility influence definition management unit records therein information concerning a possible influence of the external factor on the physical resource. A facility influence determination process unit identifies a failure occurrence location at which the failure is estimated to occur in the physical resource, from the facility information that is recorded in the facility information management unit and has positional information corresponding to the positional information of the external factor information, and outputs failure location information including information indicating the identified failure occurrence location, when it is determined that the external factor information recorded in the external factor information management unit influences the physical resource, on a basis of the information recorded in the facility influence definition management unit.

Damaged part identifying apparatus, method and program

An information analysis apparatus according to an embodiment includes an input unit that inputs information indicating an apparatus that is a fault occurrence location in a communication network and a factor of a fault, a storage unit that stores a restoration handling method rule in which the apparatus that is the fault occurrence location, the factor of the fault, and an appropriate restoration handling method for the fault are associated, and an analyzer that analyzes an appropriate restoration handling method for the apparatus and the factor indicated by the information that is input, based on information related to a past fault for the apparatus that is the fault occurrence location, or a condition inherent in the apparatus that is the fault occurrence location, from the restoration handling method rule.

Information analyzing apparatus, method, and program

In an embodiment of the present invention, a memory stores case performances on anomaly handling of a plurality of apparatuses. A hardware processor performs: identification processing of identifying an anomaly cause of an abnormal apparatus in the plurality of apparatuses; selection processing of selecting an estimation model for estimating a handling method suitable for the anomaly cause from a plurality of estimation models based on the case performance of the abnormal apparatus; estimation processing of estimating a handling method suitable for the anomaly cause among a plurality of handling methods based on the selected estimation model; and output processing of outputting information indicating the estimated handling method.

Abnormality handling support apparatus, method, and program

In an embodiment of the present disclosure, a prior probability is used by an approach of Bayesian statistics, for all nodes stored in fault handling history data or for a target node for which a fault cause has been identified and all nodes of the same type as the target node, restoration probabilities of handling methods for an identical fault cause are calculated, priorities are set for the handling methods based on the calculated restoration probabilities, and a handling method to be presented is determined in accordance with the priorities.

Growing community of inventors

Musashino, Japan

Naomi Murata