Nippon Telegraph and Telephone Corporation

Shotaro Tora

Machiko Toyoda

Yoshitaka Nakamura

Masashi Toyama

An anomaly detection apparatus () includes a storage unit () that stores dictionary information () in which a partial character string of a message representing a type of a message included in a text log output from a system and an ID set for the type of the message are associated with each other. The anomaly detection apparatus (), when the message included in the text log output from the system is acquired, refers to the dictionary information () stored in the storage unit (), classifies the message included in the text log by the type, and assigns the ID to the message that has been classified; and detects an anomaly based on the ID assigned to the message.

Anomaly detection device, anomaly detection method, and anomaly detection program

A classification unit classifies messages included in a text log depending on types, and gives an ID set for each type to each of the classified messages. A creation unit creates, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID. A pattern extraction unit extracts a plurality of patterns, which are combinations of the IDs, from the matrix created by the creation unit. A removal unit removes a part or whole of the patterns from the matrix. A determination unit calculates a degree of importance for each element included in each of the patterns, and determines whether the degree of importance is equal to or higher than a predetermined threshold. A sequence extraction unit extracts a sequence.

Analysis device, analysis method, and analysis program

A text log feature vector generator generates a text log feature vector on the basis of a text log. A numerical log feature vector generator generates a numerical log feature vector on the basis of a numerical log. A system feature vector generator generates a system feature vector on the basis of the text log feature vector and the numerical log feature vector. A learning unit learns a plurality of appearance values of the system feature vector to generate a system state model as a model indicating a state of the system. A determination unit determines the state of the system at determination target time on the basis of the system feature vector at the determination target time and the system state model.

Growing community of inventors

Musashino, Japan

Shotaro Tora