US 12,216,531 B2
Early abnormality detection based on frequency-inverse document frequency vectors created using event logs
Ryo Suzuki, Kanagawa (JP); and Ken Tonari, Kanagawa (JP)
Assigned to NEC Platforms, Ltd., Kanagawa (JP)
Filed by NEC Platforms, Ltd., Kawasaki (JP)
Filed on Jan. 31, 2023, as Appl. No. 18/103,891.
Claims priority of application No. 2022-024449 (JP), filed on Feb. 21, 2022.
Prior Publication US 2023/0267029 A1, Aug. 24, 2023
Int. Cl. G06F 11/34 (2006.01); G06F 11/07 (2006.01)
CPC G06F 11/079 (2013.01) [G06F 11/0721 (2013.01)] 10 Claims
OG exemplary drawing
 
1. An operation management system comprising:
one or more memories storing instructions; and
one or more processors configured to execute the instructions to:
successively receive, from a device to be managed, performance information and event logs of the device to be managed;
extract, according to the performance information and the event logs of the device to be managed, a first abnormality occurrence period using the performance information, calculate a first term frequency-inverse document frequency vector created using event logs in the first abnormality occurrence period, and store at least the first term frequency-inverse document frequency vector as a learning model;
calculate, using the performance information and event logs newly acquired by the device, a second abnormality occurrence period and a second term frequency-inverse document frequency vector, calculate a first degree of similarity between the first term frequency-inverse document frequency vector in the learning model and the second term frequency-inverse document frequency vector, and transmit, to a terminal of an operation manager of the device, recommendation information regarding the calculated second abnormality occurrence period when the first degree of similarity is equal to or less than a predetermined value;
acquire, for the performance information and the event logs of the device, predicted data of performance information using the performance information as learning data, extract an abnormality occurrence period of the predicted data to set the abnormality occurrence period of the predicted data as a third abnormality occurrence period, and store the third abnormality occurrence period and event logs corresponding to the third abnormality occurrence period; and
calculate, when there is a predetermined difference in comparison of the second abnormality occurrence period and the third abnormality occurrence period, a third term frequency-inverse document frequency vector according to the event logs corresponding to the third abnormality occurrence period, calculate a second degree of similarity between the second term frequency-inverse document frequency vector and the third term frequency-inverse document frequency vector, and transmit, to the terminal of the operation manager of the device, recommendation information regarding the second abnormality occurrence period when the second degree of similarity is equal to or greater than a predetermined value.