Model construction apparatus, estimation apparatus, model construction method, estimation method and program

1. A model construction apparatus comprising:

a memory; and

a processor configured to execute

collecting pieces of first observed data related to a communication network system that is a target for estimation of a location or a cause of an abnormality, wherein the pieces of first observed data comprise network traffic information of communication network system;

collecting pieces of second observed data related to a plurality of services provided by the communication network system, wherein the pieces of second observed data comprise information on states of services provided by the communication network system; and

constructing a causal model for estimating the location or the cause of the abnormality and an abnormal service among the plurality of services, using the pieces of first observed data and the pieces of second observed data, wherein the causal model is represented by a direct graph comprising:

(i) a set of equipment nodes in a first layer in a Bayesian network, each equipment node representing a respective state of a respective apparatus of the communication network system;

(ii) a set of service nodes in a second layer in the Bayesian network, each service node representing a respective state of a respective service provided by the communication network system; and

(iii) a set of observation nodes in a third layer in the Bayesian network, each observation node representing a piece of observed data;

using the constructed causal model to (i) estimate the location or the cause of the abnormality upon identifying a first service being abnormal, the first service being represented by a first service node in the second layer, (ii) generate, in response to the first service being identified as abnormal, a posterior probability of occurrence of abnormality for each of the services provided by the communication network system, and (iii) identify a second service node in the second layer, which associates with a second service different from the first service, based on the posterior probability of occurrence of abnormality; and

outputting, via a user interface, (i) the estimated location or the cause of the abnormality and (ii) the identified second service associated with the second service node.

2. The model construction apparatus according to claim 1 , wherein the constructing includes constructing as the causal model a probability model by modeling, with a Bayesian network,

a relationship between a state of a location or a cause of an abnormality in the communication network system and a state of one of the pieces of first observed data,

a relationship between a state of the service and one of the pieces of second observed data,

a relationship between the state of the service and a state of a location or a cause related to the service, and

a relationship between the state of the service and a state of one of the pieces of first observed data.

3. The model construction apparatus according to claim 2 , wherein the causal model is a probability model capable of calculating a posterior probability using a Bayes' theorem, the posterior probability representing the state of the location or the cause and the state of the service when the state of one of the pieces of first observed data and the state of one of the pieces of second observed data are obtained.

4. An estimation apparatus comprising:

a memory; and

a processor configured to execute

collecting pieces of first observed data related to a communication network system that is a target for estimation of a location or a cause of an abnormality, wherein the pieces of first observed data comprise network traffic information of communication network system;

collecting pieces of second observed data related to a plurality of services provided by the communication network system, wherein the pieces of second observed data comprises information of states of services provided by the communication network system;

constructing a causal model for estimating the location or the cause of the abnormality and an abnormal service among the plurality of services, using the pieces of first observed data and the pieces of second observed data, wherein the causal model is represented by a direct graph comprising:

(i) a set of equipment nodes in a first layer in a Bayesian network, each equipment node representing a respective state of a respective apparatus of the communication network system;

(ii) a set of service nodes in a second layer in the Bayesian network, each service node representing a respective state of a respective service provided by the communication network system; and

(iii) a set of observation nodes in a third layer in the Bayesian network, each observation node representing a piece of observed data;

using the constructed causal model to (i) estimate the location or the cause of the abnormality upon identifying a first service being abnormal, the first service being represented by a first service node in the second layer, (ii) generate, in response to the first service being identified as abnormal, a posterior probability of occurrence of abnormality for each of the services provided by the communication network system, and (iii) identify a second service node in the second layer, which associates with a second service different from the first service, based on the posterior probability of occurrence of abnormality; and

outputting, via a user interface, (i) the estimated location or the cause of the abnormality and (ii) the identified second service associated with the second service node.

5. A model construction method executed by a computer including a memory and processor, the method comprising:

collecting pieces of first observed data related to a communication network system that is a target for estimation of a location or a cause of an abnormality, wherein the pieces of first observed data comprise network traffic information of communication network system;

collecting pieces of second observed data related to a plurality of services provided by the communication network system, wherein the pieces of second observed data comprises information of states of services provided by the communication network system;

constructing a causal model for estimating the location or the cause of the abnormality and an abnormal service among the plurality of services, using the pieces of first observed data and the pieces of second observed data, wherein the causal model is represented by a direct graph comprising:

(i) a set of equipment nodes in a first layer in a Bayesian network, each equipment node representing a respective state of a respective apparatus of the communication network system;

(ii) a set of service nodes in a second layer in the Bayesian network, each service node representing a respective state of a respective service provided by the communication network system; and

(iii) a set of observation nodes in a third layer in the Bayesian network, each observation node representing a piece of observed data;

using the constructed causal model to (i) estimate the location or the cause of the abnormality upon identifying a first service being abnormal, the first service being represented by a first service node in the second layer, (ii) generate, in response to the first service being identified as abnormal, a posterior probability of occurrence of abnormality for each of the services provided by the communication network system, and (iii) identify a second service node in the second layer, which associates with a second service different from the first service, based on the posterior probability of occurrence of abnormality; and

outputting, via a user interface, (i) the estimated location or the cause of the abnormality and (ii) the identified second service associated with the second service node.

6. A non-transitory computer-readable recording medium having computer-readable instructions stored thereon, which when executed, cause a computer including a memory and a processor to execute the model construction method according to claim 5 .