US 12,032,435 B2
Rule generation apparatus, rule generation method, and program
Satoshi Suzuki, Musashino (JP); Haruhisa Nozue, Musashino (JP); Shunsuke Kanai, Musashino (JP); Kazuaki Akashi, Musashino (JP); Fumika Asai, Musashino (JP); Naomi Murata, Musashino (JP); and Kenichi Tayama, Musashino (JP)
Assigned to Nippon Telegraph and Telephone Corporation, Tokyo (JP)
Appl. No. 18/009,042
Filed by Nippon Telegraph and Telephone Corporation, Tokyo (JP)
PCT Filed Jun. 12, 2020, PCT No. PCT/JP2020/023122
§ 371(c)(1), (2) Date Dec. 8, 2022,
PCT Pub. No. WO2021/250873, PCT Pub. Date Dec. 16, 2021.
Prior Publication US 2023/0273850 A1, Aug. 31, 2023
Int. Cl. G06F 11/07 (2006.01)
CPC G06F 11/079 (2013.01) [G06F 11/0709 (2013.01); G06F 11/0793 (2013.01)] 7 Claims
OG exemplary drawing
 
1. A rule generation apparatus comprising:
a database in which, for an individual failure, failure factor information including a failure location and a failure factor, a failure event caused by the individual failure, and a rule name associated with a rule including a condition part and a conclusion part are registered in association with each other;
a unique determination unit, implemented using one or more computing devices, configured to:
generate at least one possible combination between a plurality of failure events associated with a new failure which is a newly generated failure, and
based on the new failure having occurred, extract a unique pattern determined to be a combination with a lowest occurrence rate from the combination of the plurality of failure events associated with the new failure and a failure event associated with at least one past failure that has occurred;
a rule generation and correction unit, implemented using one or more computing devices, configured to generate or correct the rule according to the unique pattern corresponding to each failure;
an event mapping file acquiring unit, implemented using one or more computing devices, configured to acquire an event mapping file defining a normalized alarm message indicating a normalized alarm content, a resource type indicating an event failure location, an alarm type, and an event type indicating event classification of the alarm in association with each other; and
an event type conversion unit, implemented using one or more computing devices, configured to:
determine whether input alarm information matches a definition of the event mapping file acquired by the event mapping file acquiring unit,
based on the input alarm information matching the definition, set the event type to a value defined in the event mapping file,
based on the input alarm information not matching the definition, set the event type to the alarm type of alarm information, and
cause the rule generation and correction unit to register the event type and the alarm information in association with each other as a failure event in the database.