Granted Patent B2

US 10,887,331 · App. 15/126,920 · Granted Jan 5, 2021

Inventors: Takashi Nomura (Tokyo, JP); Koji Kida (Tokyo, JP); Junpei Kamimura (Tokyo, JP); Yoshiaki Sakae (Tokyo, JP); Etsuko Katsuda (Tokyo, JP); Kazuhiko Isoyama (Tokyo, JP); Kentaro Yamasaki (Tokyo, JP); Yuji Kobayashi (Tokyo, JP)

Assignee: NEC Coporation

H04L63/1425G06F11/3447G06F11/3476H04L41/0631H04L41/0677H04L63/1416G06F2201/875H04L41/12

Abstract

Claims (58)

1. An information processing apparatus comprising:

a memory storing a program; and

at least one processor configured to run the program to execute:

extracting, with use of a relationship graph representing relationships between a plurality of elements included in a system and location information that indicates, on the relationship graph, a plurality of locations where anomalies have been detected in the system, paths reached from a plurality of the locations on the relationship graph, the locations where the anomalies have been detected by backtracing, that is tracing directed edges of the relationship graph in backward direction and forwardtracing, that is tracing directed edges of the relationship graph in forward direction, the paths including a set of the elements that are directly or indirectly related to each of the locations as a source; and

extracting a shared extent that is an element, an edge, or a set of elements or edges, the element, the edge or the set of elements or edges being shared by at least prescribed number of paths among the paths extracted, as an influence process of the anomalies.

2. The information processing apparatus according to claim 1 ,

wherein the location information includes a plurality of pieces of first location information indicating, on the relationship graph, locations in the system where occurrence of anomalies has been detected, and

the at least one processor is configured to run the program to execute extracting a reach extent from each of the locations indicated on the relationship graph by the plurality of pieces of first location information.

3. The information processing apparatus according to claim 1 ,

wherein the location information includes one or a plurality of pieces of first location information indicating, on the relationship graph, locations in the system where occurrence of anomalies has been detected and second location information indicating, on the relationship graph, one or a plurality of locations detected as being possible causes of anomalies,

wherein the at least one processor is configured to run the program to execute extracting, as a first reach extent, a path in the relationship graph including the set of elements that are directly or indirectly related to the location as a source indicated on the relationship graph by the first location information, and extracting, as a second reach extent, a path in the relationship graph including the set of elements that are directly or indirectly related to the location as a source indicated on the relationship graph by the second location information, and

extracting, as the influence process of the anomaly, a path between the location indicated on the relationship graph by the first location information and the location indicated on the relationship graph by the second location information.

4. The information processing apparatus according to claim 1 ,

wherein the relationship graph includes first time information as attributes of at least one of the elements and edges,

wherein the location information includes second time information indicating a time at which the anomaly has been detected, and

wherein the at least one processor is configured to run the program to execute extracting, as the reach extent, a path in the relationship graph reached from the location as a source indicated on the relationship graph by the location information that includes the second time information, based on the time at which the anomaly has been detected indicated by the second time information.

5. The information processing apparatus according to claim 4 ,

wherein, when the first time information refers to the attributes of the elements, the at least one processor is configured to run the program to execute extracting a path in the relationship graph reached from the location indicated on the relationship graph by the location information by performing at least one of (i) a first search for searching a time prior to the time at which the anomaly has been detected and (ii) a second search for searching a time posterior to the time at which the anomaly has been detected.

6. The information processing apparatus according to claim 5 ,

wherein the first time information includes, for each edge, a start time at which an element connected at one end of the edge has first influenced an element connected at another end and a finish time at which an element connected at one end of the edge has last influenced an element connected at another end, and

wherein the first search compares a currently-acquirable oldest time with the finish time and determines an older one as the oldest time, and, when the start time is a time prior to the oldest time, causes the element connected at the one end of the edge that includes the start time to be included in the reach extent, whereas when the start time is a time posterior to the oldest time, causes the element connected at the one end of the edge that includes the start time not to be included in the reach extent.

7. The information processing apparatus according to claim 5 ,

wherein the first time information includes, for each edge, a start time at which an element connected at one end of the edge has first influenced an element connected at another end and a finish time at which an element connected at one end of the edge has last influenced an element connected at another end, and

wherein the second search compares a currently-acquirable newest time with the start time and determines a newer one as the newest time, and, when the finish time is a time posterior to the newest time, causes the element connected at the other end of the edge that includes the finish time to be included in the reach extent, whereas when the finish time is a time prior to the newest time, causes the element connected at the other end of the edge that includes the finish time not to be included in the reach extent.

8. The information processing apparatus according to claim 1 ,

wherein the relationship graph includes vertices including first time information that are generated every time an element becomes a state of being able to influence another element,

wherein the location information includes second time information indicating a time at which the anomaly has been detected, and

wherein the at least one processor is configured to run the program to execute extracting, as the reach extent, a path in the relationship graph reached from the location as a source indicated on the relationship graph by the location information that includes the second time information, based on the time at which the anomaly has been detected indicated by the second time information.

9. The information processing apparatus according to claim 1 , wherein the at least one processor is configured to run the program to execute evaluating anomaly degrees of paths in the relationship graph and generate an evaluation result, and

extract the reach extent using the evaluation result.

10. The information processing apparatus according to claim 9 , wherein the at least one processor is configured to run the program to execute extracting the influence process of the anomaly using the evaluation result.

11. An information processing apparatus comprising:

a memory storing a program; and

at least one processor configured to run the program to execute:

acquiring a relationship graph representing relationships between a plurality of elements included in a system and location information that indicates, on the relationship graph, a plurality of locations where anomalies have been detected in the system;

extracting, with use of the relationship graph and the location information acquired, as an influence process of an anomaly, paths reached from a plurality of the locations on the relationship graph, the locations where the anomalies have been detected by backtracing, that is tracing directed edges of the relationship graph in backward direction and forwardtracing, that is tracing directed edges of the relationship graph in forward direction, the paths in the relationship graph including a set of elements that are directly or indirectly related to each of the locations as a source; and

extracting a shared extent that is an element, an edge, or a set of elements or edges, the element, the edge or the set of edges being shared by at least a prescribed number of paths among the paths extracted, as an influence process of the anomalies.

12. The information processing apparatus according to claim 11 ,

wherein the relationship graph includes first time information as attributes of at least one of the elements and edges,

wherein the location information includes second time information indicating a time at which the anomaly has been detected, and

wherein the at least one processor is configured to run the program to execute identifying, as an influence process of the anomaly, a path in the relationship graph reached from the location as a source indicated on the relationship graph by the location information that includes the second time information, based on the time at which the anomaly has been detected indicated by the second time information.

13. The information processing apparatus according to claim 12 ,

wherein, when the first time information refers to the attributes of the elements, the at least one processor is configured to run the program to execute extracting a path in the relationship graph reached from the location indicated on the relationship graph by the location information by performing at least one of (i) a first search for searching a time prior to the time at which the anomaly has been detected and (ii) a second search for searching a time posterior to the time at which the anomaly has been detected.

14. The information processing apparatus according to claim 13 ,

wherein the first time information includes, for each edge, a start time at which an element connected at one end of the edge has first influenced an element connected at another end and a finish time at which an element connected at one end of the edge has last influenced an element connected at another end, and

wherein the first search compares a currently-acquirable oldest time with the finish time and determines an older one as the oldest time, and, when the start time is a time prior to the oldest time, causes the element connected at the one end of the edge that includes the start time to be included in the influence process of the anomaly, whereas when the start time is a time posterior to the oldest time, causes the element connected at the one end of the edge that includes the start time not to be included in the influence process of the anomaly.

15. The information processing apparatus according to claim 13 ,

wherein the first time information includes, for each edge, a start time at which an element connected at one end of the edge has first influenced an element connected at another end and a finish time at which an element connected at one end of the edge has last influenced an element connected at another end, and

wherein the second search compares a currently-acquirable newest time with the start time and determines a newer one as the newest time, and, when the finish time is a time posterior to the newest time, causes the element connected at the other end of the edge that includes the finish time to be included in the influence process of the anomaly, whereas when the finish time is a time prior to the newest time, causes the element connected at the other end of the edge that includes the finish time not to be included in the influence process of the anomaly.

16. The information processing apparatus according to claim 11 ,

wherein the relationship graph includes vertices including first time information that are generated every time an element becomes a state of being able to influence another element,

wherein the location information includes second time information indicating a time at which the anomaly has been detected, and

wherein the at least one processor is configured to run the program to execute extracting, as the influence process of the anomaly, a path in the relationship graph reached from the location as a source indicated on the relationship graph by the location information that includes the second time information, based on the time at which the anomaly has been detected indicated by the second time information.

17. The information processing apparatus according to claim 11 , wherein the at least one processor is configured to run the program to execute evaluating anomaly degrees of paths in the relationship graph and generate an evaluation result, and

extracting the influence process of the anomaly using the evaluation result.

18. An influence-process extraction method for an information processing apparatus, comprising:

extracting, with use of a relationship graph representing relationships between a plurality of elements included in a system and location information that indicates, on the relationship graph, a plurality of locations where anomalies have been detected in the system, paths reached from a plurality of the locations on the relationship graph, the locations where the anomalies have been detected by backtracing, that is tracing directed edges of the relationship graph in backward direction and forwardtracing, that is tracing directed edges of the relationship graph in forward direction, the paths including a set of elements that are directly or indirectly related to each of the locations as a source; and

extracting a shared extent that is an element, an edge, or a set of elements or edges, the element, the edge or the set of elements or edges being shared by at least a prescribed number of paths among the paths extracted, as an influence process of the anomalies.

Assignments (1)

Priority Claims (1)

Continuity (1)

Cited By (11)

US 12,204,870 US 12,206,708 US 12,265,526 US 12,277,029 US 12,287,700 US 12,354,043 US 12,361,358 US 12,511,180 US 12,526,289 US 12,536,280 US 12,652,299