Apparatus, method, and program product for calculating abnormality based on degree of correlation destruction
In the invariant analysis, a fault cause is judged correctly. A correlation model storing unit ( 112 ) of an operation management apparatus ( 100 ) stores a correlation model including one or more correlation functions each of which indicates a correlation between two metrics different each other among a plurality of metrics in a system. The correlation destruction detecting unit ( 103 ) detects correlation destruction of the correlation which is included in the correlation model by applying newly inputted values of the plurality of metrics to the correlation model. The abnormality calculation unit ( 104 ) calculates and outputs a centrality degree which indicates a degree to which a first metric is estimated to be center of distribution of correlation destruction on the basis of a correlation destruction degree of one or more correlations between each of one or more second metrics having a correlation with the first metric and each of one or more metrics other than the first metric among the plurality of metrics.
1. An operation management apparatus comprising:
a correlation model storing unit which stores a correlation model including one or more correlation functions each of which indicates a correlation between two metrics different each other among a plurality of metrics in a system;
a correlation destruction detecting unit which detects correlation destruction of the correlation which is included in the correlation model by applying newly inputted values of the plurality of metrics to the correlation model; and
an abnormality calculation unit which calculates and outputs a centrality degree which indicates a degree to which a first metric is estimated to be center of distribution of correlation destruction on the basis of a correlation destruction degree of one or more correlations between each of one or more second metrics having a correlation with the first metric and each of one or more metrics other than the first metric among the plurality of metrics.
2. The operation management apparatus according to claim 1 , wherein
the abnormality calculation unit calculates an abnormality degree of the first metric on the basis of a correlation destruction degree of one or more correlations between the first metric and each of the one or more second metrics, and the calculated centrality degree of the first metric.
3. The operation management apparatus according to claim 2 , wherein
the centrality degree is a value which becomes small according to the correlation destruction degree of one or more correlations between each of the one or more second metrics and each of the metrics other than the first metric, and
the abnormality degree of the first metric is calculated by adding or multiplying the correlation destruction degree of one or more correlations between the first metric and each of the one or more second metrics by the centrality degree.
4. The operation management apparatus according to claim 1 , wherein
the correlation destruction degree is calculated on the basis of any one among a ratio of correlations on which correlation destruction is detected to one or more correlations, number of correlations on which correlation destruction is detected among one or more correlations, and a transformation error caused by each of correlation functions corresponding to one or more correlations.
5. An operation management method comprising:
storing a correlation model including one or more correlation functions each of which indicates a correlation between two metrics different each other among a plurality of metrics in a system;
detecting correlation destruction of the correlation which is included in the correlation model by applying newly inputted values of the plurality of metrics to the correlation model; and
calculating and outputting a centrality degree which indicates a degree to which a first metric is estimated to be center of distribution of correlation destruction on the basis of a correlation destruction degree of one or more correlations between each of one or more second metrics having a correlation with the first metric and each of one or more metrics other than the first metric among the plurality of metrics.
6. The operation management method according to claim 5 , further comprising calculating an abnormality degree of the first metric on the basis of a correlation destruction degree of one or more correlations between the first metric and each of the one or more second metrics, and the calculated centrality degree of the first metric.
7. The operation management method according to claim 6 , wherein
the centrality degree is a value which becomes small according to the correlation destruction degree of one or more correlations between each of the one or more second metrics and each of the metrics other than the first metric, and
the abnormality degree of the first metric is calculated by adding or multiplying the correlation destruction degree of one or more correlations between the first metric and each of the one or more second metrics by the centrality degree.
8. The operation management method according to claim 5 , wherein
the correlation destruction degree is calculated on the basis of any one among a ratio of correlations on which correlation destruction is detected to one or more correlations, number of correlations on which correlation destruction is detected among one or more correlations, and a transformation error caused by each of correlation functions corresponding to one or more correlations.
9. A non-transitory computer readable storage medium recording thereon a program, causing a computer to perform a method comprising:
storing a correlation model including one or more correlation functions each of which indicates a correlation between two metrics different each other among a plurality of metrics in a system;
detecting correlation destruction of the correlation which is included in the correlation model by applying newly inputted values of the plurality of metrics to the correlation model; and
calculating and outputting a centrality degree which indicates a degree to which a first metric is estimated to be center of distribution of correlation destruction on the basis of a correlation destruction degree of one or more correlations between each of one or more second metrics having a correlation with the first metric and each of one or more metrics other than the first metric among the plurality of metrics.
10. The non-transitory computer readable storage medium according to claim 9 , further comprising calculating an abnormality degree of the first metric on the basis of a correlation destruction degree of one or more correlations between the first metric and each of the one or more second metrics, and the calculated centrality degree of the first metric.
11. The non-transitory computer readable storage medium according to claim 10 , wherein
the centrality degree is a value which becomes small according to the correlation destruction degree of one or more correlations between each of the one or more second metrics and each of the metrics other than the first metric, and
the abnormality degree of the first metric is calculated by adding or multiplying the correlation destruction degree of one or more correlations between the first metric and each of the one or more second metrics by the centrality degree.
12. The non-transitory computer readable storage medium according to claim 9 , wherein
the correlation destruction degree is calculated on the basis of any one among a ratio of correlations on which correlation destruction is detected to one or more correlations, number of correlations on which correlation destruction is detected among one or more correlations, and a transformation error caused by each of correlation functions corresponding to one or more correlations.
13. An operation management apparatus comprising:
a correlation model storing means for storing a correlation model including one or more correlation functions each of which indicates a correlation between two metrics different each other among a plurality of metrics in a system;
a correlation destruction detecting means for detecting correlation destruction of the correlation which is included in the correlation model by applying newly inputted values of the plurality of metrics to the correlation model; and
an abnormality calculation means for calculating and outputting a centrality degree which indicates a degree to which a first metric is estimated to be center of distribution of correlation destruction on the basis of a correlation destruction degree of one or more correlations between each of one or more second metrics having a correlation with the first metric and each of one or more metrics other than the first metric among the plurality of metrics.