Analysis apparatus, analysis method, and analysis program

1. An analysis apparatus comprising:

processing circuitry programmed to execute a process comprising:

generating a first feature vector on the basis of a text log output from a system and being a log expressed by text;

generating a second feature vector on the basis of a numerical log output from the system and being a log expressed by a numerical value;

generating a third feature vector on the basis of the first feature vector and the second feature vector;

learning a plurality of appearance values of the third feature vector and generating a model indicating a state of the system; and

determining the state of the system at determination target time on the basis of the third feature vector at the determination target time and the model.

2. The analysis apparatus according to claim 1 , wherein the generating the first feature vector puts, in the first feature vector, a value indicating whether predetermined messages appear in a predetermined order in the text log.

3. The analysis apparatus according to claim 1 , wherein the generating the second feature vector calculates an estimation value for a predetermined item included in the numerical log on the basis of a correlation between the predetermined item and an item other than the predetermined item that is included in the numerical log, and puts, in the second feature vector, a value indicating a divergence degree of an actual value for the predetermined item included in the numerical log from the estimation value.

4. The analysis apparatus according to claim 1 , wherein

the generating the first feature vector puts, in the first feature vector, a value indicating whether predetermined messages appear in a predetermined order in the text log; and

the generating the second feature vector calculates an estimation value for a predetermined item included in the numerical log on the basis of a correlation between the predetermined item and an item other than the predetermined item that is included in the numerical log, and puts, in the second feature vector, a value indicating a divergence degree of an actual value for the predetermined item included in the numerical log from the estimation value.

5. The analysis apparatus according to claim 1 , wherein

the learning learns, for a plurality of different states, the third feature vectors when the state of the system is known and the states of the system in a correlated manner and generates a model indicating a relation between the different states and the third feature vectors, and

the determining determines, using the model, the state at the determination target time by calculating the state close to the third feature vector at the determination target time among the different states of the system.

6. The analysis apparatus according to claim 1 , wherein

the learning learns the third feature vectors for a predetermined period of time to generate the model indicating a time-series tendency of the third feature vectors, and

the determining calculates an estimation value of the third feature vector at the determination target time on the basis of the model representing the time-series tendency and values of the third feature vectors before the determination target time and determines the state of the system at the determination target time on the basis of a divergence degree of actual values of the third feature vector at the determination target time from the estimation value.

7. The analysis apparatus according to claim, 1 , wherein

the learning learns the third feature vectors when the state of the system is normal to generate the model, and

the determining determines the state of the system at the determination target time on the basis of a divergence degree of the third feature vector at the determination target time from the third feature vectors when the state of the system is normal that is represented by the model.

8. An analysis method that is executed by an analysis apparatus, the analysis method comprising:

a text log feature vector generating step of generating a first feature vector on the basis of a text log output from a system and being a log expressed by text;

a numerical log feature vector generating step of generating a second feature vector on the basis of a numerical log output from the system and being a log expressed by a numerical value;

a system feature vector generating step of generating a third feature vector on the basis of the first feature vector and the second feature vector;

a learning step of learning a plurality of appearance values of the third feature vector and generating a model indicating a state of the system; and

a determining step of determining the state of the system at determination target time on the basis of the third feature vector at the determination target time and the model.

9. A non-transitory computer-readable recording medium having stored a program for analysis that causes a computer to execute a process comprising:

generating a first feature vector on the basis of a text log output from a system and being a log expressed by text;

generating a second feature vector on the basis of a numerical log output from the system and being a log expressed by a numerical value;

generating a third feature vector on the basis of the first feature vector and the second feature vector;

learning a plurality of appearance values of the third feature vector and generates a model indicating a state of the system; and

determining the state of the system at determination target time on the basis of the third feature vector at the determination target time and the model.