US 12,001,271 B2
Network monitoring apparatus, method, and program
Naomi Murata, Musashino (JP); Satoshi Suzuki, Musashino (JP); Haruhisa Nozue, Musashino (JP); Shunsuke Kanai, Musashino (JP); Fumika Asai, Musashino (JP); and Kazuaki Akashi, Musashino (JP)
Assigned to Nippon Telegraph and Telephone Corporation, Tokyo (JP)
Appl. No. 17/778,448
Filed by Nippon Telegraph and Telephone Corporation, Tokyo (JP)
PCT Filed Nov. 20, 2019, PCT No. PCT/JP2019/045426
§ 371(c)(1), (2) Date May 20, 2022,
PCT Pub. No. WO2021/100140, PCT Pub. Date May 27, 2021.
Prior Publication US 2022/0398143 A1, Dec. 15, 2022
Int. Cl. G06F 11/07 (2006.01)
CPC G06F 11/0751 (2013.01) [G06F 11/0709 (2013.01)] 12 Claims
OG exemplary drawing
 
1. A network monitoring apparatus comprising:
a collection unit, including one or more processors, configured to collect, from network apparatuses of a network, a plurality of event information of events occurring in one or more of the network apparatuses;
a combination rule registration unit, including one or more processors, configured to process an input comprising the collected event information using a machine-learning model to determine a set of combination rules, wherein each combination rule specifies a respective occurrence sequence of events to be monitored, and the machine-learning model has been trained using training examples of past network events and causes or resolutions of the past network events;
an extraction unit, including one or more processors, configured to extract, from the collected event information, a combination of event information of a set of events occurring within a predetermined unit time;
a determination unit, including one or more processors, configured to, by comparing the extracted combination of event information with each of the combination rules, determine whether or not the extracted combination of event information and an occurrence sequence of the set of events match the occurrence sequence of the events specified to be monitored in the combination rule; and
a change unit, including one or more processors, configured to change, in accordance with a determination of the determination unit that the extracted combination of event information and the occurrence sequence of the set of events match the occurrence sequence of the events specified to be monitored in the combination rule, the extracted combination of event information to new event information;
wherein the set of combination rules comprise a first combination rule that specifies an occurrence sequence of repetitions of link down followed by link up events to be monitored, and the change unit is configured to change, in accordance with a determination that the extracted combination of event information and the occurrence sequence of the set of events match the occurrence sequence of the repetitions of link down followed by link up events to be monitored in the first combination rule, the extracted combination of event information to new event information of natural restoration.