Abstract: A rule generation device according to an embodiment includes: a database in which, for each fault, fault factor information including a fault factor part and a fault factor, fault events that occur due to this fault, a rule ID associated with a rule including a condition part and a result part are registered in association with one another; an importance degree determination unit determining, when fault events of a new fault that is a newly occurred fault are registered with the database, degrees of importance of the fault events of the new fault based on at least one of values calculated through statistical processing or analytical processing for information other than the fault events or overall information about the fault events, which are registered with the database; and a rule generation unit generating a rule for the new fault based on the degrees of importance.

Abstract: An information analysis apparatus according to an embodiment includes an input unit that inputs information indicating an apparatus that is a fault occurrence location in a communication network and a factor of a fault, a storage unit that stores a restoration handling method rule in which the apparatus that is the fault occurrence location, the factor of the fault, and an appropriate restoration handling method for the fault are associated, and an analyzer that analyzes an appropriate restoration handling method for the apparatus and the factor indicated by the information that is input, based on information related to a past fault for the apparatus that is the fault occurrence location, or a condition inherent in the apparatus that is the fault occurrence location, from the restoration handling method rule.

Abstract: In an embodiment of the present invention, a memory stores case performances on anomaly handling of a plurality of apparatuses. A hardware processor performs: identification processing of identifying an anomaly cause of an abnormal apparatus in the plurality of apparatuses; selection processing of selecting an estimation model for estimating a handling method suitable for the anomaly cause from a plurality of estimation models based on the case performance of the abnormal apparatus; estimation processing of estimating a handling method suitable for the anomaly cause among a plurality of handling methods based on the selected estimation model; and output processing of outputting information indicating the estimated handling method.

Abstract: According to one aspect of the present invention, when a combination rule of event information to be monitored is created by aggregating a plurality of pieces of event information generated in a network, an information processing device executes: collecting the plurality of pieces of event information; calculating a correlation value for a plurality of combinations of event information including m (m?3) pieces of event information generated from the plurality of pieces of event information collected; selecting a combination of the pieces of event information for which the calculated correlation value is equal to or higher than a predetermined value, wherein the correlation value increases as the number of times or frequency that the event information included in a combination appears according to the combination increases and also increases as a time interval between the pieces of event information included in the combination decreases; and generating the combination rule on the basis of the event information

Abstract: A network management apparatus acquires a given information object related to a plurality of occurrence paths of a failure in a logical layer of a network configuration; and retrieves, as a candidate of a facility to be a failure cause, information objects related to the facility layer and the physical layer commonly associated with the given information object; calculates, for each of the retrieved information objects, the number of information objects which are associated with the object and which are related to the plurality of occurrence paths of the failure as a multiplicity; and calculates, for each of the retrieved information objects, a proportion of the multiplicity with respect to the number of information objects in the logical layer which are affected when the failure occurs in the object.

Abstract: Provided is an event mapping acquiring unit (11) and an event type conversion unit (12). The event mapping acquiring unit (11) acquires an event mapping file defining a normalized alarm message indicating a normalized alarm content, a resource type indicating an event failure location, an alarm type, and an event type indicating event classification of the alarm in association with one another. The event type conversion unit (12) determines whether input alarm information matches the definition of the event mapping file acquired, when the input alarm information matches the definition, sets the event type to a value defined in the event mapping file, when the input alarm information does not match the definition, sets the event type to the alarm type of alarm information, and registers the event type and the alarm information in association with each other as a failure event in the database.

Abstract: In an embodiment of the present disclosure, a prior probability is used by an approach of Bayesian statistics, for all nodes stored in fault handling history data or for a target node for which a fault cause has been identified and all nodes of the same type as the target node, restoration probabilities of handling methods for an identical fault cause are calculated, priorities are set for the handling methods based on the calculated restoration probabilities, and a handling method to be presented is determined in accordance with the priorities.

Abstract: A network management apparatus according to an embodiment includes: an acquiring unit which acquires an information object related to a plurality of occurrence paths of a failure in a logical layer of a network configuration; and a retrieving unit which: retrieves, as a candidate of a facility to be a failure cause, information objects related to the facility layer and the physical layer commonly associated with the information object related to the plurality of occurrence paths of the failure having been acquired by the acquiring unit among information objects related to the facility layer; calculates, for each of the retrieved information objects related to the candidate of a facility to be the failure cause, the number of information objects which are associated with the object and which are related to the plurality of occurrence paths of the failure as a multiplicity; and calculates, for each of the retrieved information objects related to the candidate of a facility to be the failure cause, a proportion

Abstract: In a failure location identification apparatus according to one embodiment, a facility information management unit records therein facility information including positional information of a physical resource, an external factor information management unit records therein external factor information concerning an external factor that possibly becomes a factor that causes a failure in the physical resource, the external factor information including positional information of the external factor, and a facility influence definition management unit records therein information concerning a possible influence of the external factor on the physical resource.

Abstract: As an embodiment of the present invention, a network monitoring apparatus includes a combination rule storage section where a combination rule is registered; and the combination rule includes a combination of a plurality of failure event information to be monitored, and new event information to which the combination of the plurality of failure event information is to be changed. In this state, the network monitoring apparatus collects a plurality of failure event information from network apparatuses; extracts, from the plurality of failure event information collected, a combination of a plurality of failure event information detected to occur within a unit time; and collates the combination of the plurality of failure event information extracted with the combination of the plurality of failure event information defined to be monitored in the combination rule.

Abstract: In an embodiment of the present invention, a memory stores case performances on anomaly handling of a plurality of apparatuses. A hardware processor performs: identification processing of identifying an anomaly cause of an abnormal apparatus in the plurality of apparatuses; selection processing of selecting an estimation model for estimating a handling method suitable for the anomaly cause from a plurality of estimation models based on the case performance of the abnormal apparatus; estimation processing of estimating a handling method suitable for the anomaly cause among a plurality of handling methods based on the selected estimation model; and output processing of outputting information indicating the estimated handling method.

Abstract: An aspect of the present disclosure acquires topology information representing a connection configuration between a plurality of apparatuses constituting a communication network and event information representing occurrence statuses of an event by the plurality of apparatuses, estimates, based on the topology information and the event information, a first apparatus corresponding to a failure factor location from among the plurality of apparatuses, estimates, based on an occurrence status of the event by a second apparatus whose connection relationship with the first apparatus estimated is defined by the topology information, whether an occurrence of the event by the second apparatus is caused by the failure factor location or by another anomaly, and estimates, based on a relationship between an occurrence status of the event by the first apparatus and an occurrence status of the event by a third apparatus whose connection relationship with the first apparatus is not defined by the topology information, whethe

Abstract: In an embodiment of the present disclosure, a prior probability is used by an approach of Bayesian statistics, for all nodes stored in fault handling history data or for a target node for which a fault cause has been identified and all nodes of the same type as the target node, restoration probabilities of handling methods for an identical fault cause are calculated, priorities are set for the handling methods based on the calculated restoration probabilities, and a handling method to be presented is determined in accordance with the priorities.

Abstract: A pattern extraction and rule generation device according to one embodiment includes a database where failure factor information including a failure factor location and a failure factor, an occurring failure event that is a failure event occurring due to a failure and a non-occurring failure event that is a failure event not occurring due to the failure, and a rule ID associated with a rule including condition parts and conclusion parts are registered, by a failure type, in association with each other, a unique determination unit that generates, by the failure type, all of one or more possible combinations of the occurring failure event and the non-occurring failure event included in a failure event group including the occurring failure event and the non-occurring failure event associated with a new failure, and extracts, from combinations of failure events of a new failure and combinations of failure events of one or more past failures, by the failure type, a unique pattern that is determined to be a combina

Abstract: An information analysis apparatus according to an embodiment includes an input unit that inputs information indicating an apparatus that is a fault occurrence location in a communication network and a factor of a fault, a storage unit that stores a restoration handling method rule in which the apparatus that is the fault occurrence location, the factor of the fault, and an appropriate restoration handling method for the fault are associated, and an analyzer that analyzes an appropriate restoration handling method for the apparatus and the factor indicated by the information that is input, based on information related to a past fault for the apparatus that is the fault occurrence location, or a condition inherent in the apparatus that is the fault occurrence location, from the restoration handling method rule.