Abstract: Provided is an information processing system, and the like, with which even if target information that relates to a target of interest has been disguised, such disguising can be more accurately detected, and the appropriate information intended for presentation to a user can be presented according to the detection results. An information processing system is equipped with: a server apparatus which determines whether or not target information is authentic, on the basis of a determination condition and information from which target information relating to a target of interest has been created and which indicates at least a time/date and a first location and a client which controls a presentation unit such that presentation information intended for presentation to a user is presented according to the result of the determination made by the server apparatus.

Abstract: Monitoring of a state of a system can be accurately performed even when a timing at which a relation changes is different for each set of the metrics. A monitoring apparatus 100 includes a model storage unit 122 and a determination unit 115. The model storage unit 122 stores, for each of a plurality of metric sets in a system, a model representing a relation among metrics included in the corresponding metric set. The determination unit 115 determines and outputs whether the system is in one state, by comparing a combination of models to which the plurality of metric sets conform respectively when the system is in the one state and a combination of models to which the plurality of metric sets conform respectively when the system is in a state to be determined.

Abstract: Fast classification of data can be performed according to characteristics. In a clustering device (100), a data storage unit (300) stores a plurality of data sets. A cluster generation unit (400) generates an approximate line that approximates as many data sets as possible within a predetermined margin of error among the plurality of data sets in a space in which the plurality of data sets are arranged in accordance with data values. The cluster generation unit (400) generates a cluster by classifying the plurality of data sets based on the generated approximate line and outputs the generated cluster.

Abstract: Accuracy of risks defined for abnormalities that might occur in a system is improved. The risk determination device 100 includes a classification unit 114 and a determination unit 115. The classification unit 114 classifies abnormal patterns 133, each representing a relationship among metrics at a time of abnormality detection in a system, into groups 134 based on a similarity between the abnormal patterns. The determination unit 115 determines, based on the number of abnormal patterns 133 classified into each of the groups 134, likelihood of an abnormality of the corresponding group 134.

Abstract: Provided is an information processing system, and the like, with which even if target information that relates to a target of interest has been disguised, such disguising can be more accurately detected, and the appropriate information intended for presentation to a user can be presented according to the detection results. An information processing system is equipped with: a server apparatus which determines whether or not target information is authentic, on the basis of a determination condition and information from which target information relating to a target of interest has been created and which indicates at least a time/date and a first location and a client which controls a presentation unit such that presentation information intended for presentation to a user is presented according to the result of the determination made by the server apparatus.

Abstract: Accuracy of risks defined for abnormalities that might occur in a system is improved. The risk determination device 100 includes a classification unit 114 and a determination unit 115. The classification unit 114 classifies abnormal patterns 133, each representing a relationship among metrics at a time of abnormality detection in a system, into groups 134 based on a similarity between the abnormal patterns. The determination unit 115 determines, based on the number of abnormal patterns 133 classified into each of the groups 134, likelihood of an abnormality of the corresponding group 134.

Abstract: Monitoring of a state of a system can be accurately performed even when a timing at which a relation changes is different for each set of the metrics. A monitoring apparatus 100 includes a model storage unit 122 and a determination unit 115. The model storage unit 122 stores, for each of a plurality of metric sets in a system, a model representing a relation among metrics included in the corresponding metric set. The determination unit 115 determines and outputs whether the system is in one state, by comparing a combination of models to which the plurality of metric sets conform respectively when the system is in the one state and a combination of models to which the plurality of metric sets conform respectively when the system is in a state to be determined.

Abstract: Fast classification of data can be performed according to characteristics. In a clustering device (100), a data storage unit (300) stores a plurality of data sets. A cluster generation unit (400) generates an approximate line that approximates as many data sets as possible within a predetermined margin of error among the plurality of data sets in a space in which the plurality of data sets are arranged in accordance with data values. The cluster generation unit (400) generates a cluster by classifying the plurality of data sets based on the generated approximate line and outputs the generated cluster.

Abstract: A fault cause extraction apparatus including a storage unit which stores a model including one or more correlation functions between pieces of performance information acquired from a plurality of elements and a correlation-destruction-propagation detecting unit which calculates a degree of influence for each of the elements based on correlation destruction information. The correlation destruction information is calculated based on whether pieces of performance information newly acquired from the elements satisfy a relationship represented by the correlation functions.

Abstract: In state detection of a system using a correlation destruction pattern, the versatility of the correlation destruction pattern is improved. A system analysis device (100) includes a correlation destruction pattern storage unit (113), an aggregated destruction pattern generation unit (104), and a similarity calculation unit (105). The correlation destruction pattern storage unit (113) stores a plurality of correlation destruction patterns (123) each of which is a set of correlations in which correlation destruction has been detected among correlations of pairs of metrics in a system. The aggregated destruction pattern generation unit (104) generates an aggregated destruction pattern (124) which is obtained by aggregating correlation destruction patterns (123) of the same type among the plurality of correlation destruction patterns (123).

Abstract: An operations management apparatus, includes a correlation model storing unit which stores a correlation model including one or more correlation functions each of which indicates a correlation between pieces of sequence information out of a plural types of sequence information, for each of plural monitored objects and a correlation destruction detecting unit which detects correlation destruction related to a correlation which is included in said correlation model by applying inputted said sequence information of said monitored object to said correlation model of said monitored object which said correlation model storing unit stores; and a fault analyzing unit which determines and outputs said monitored object through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in said monitored objects which have said correlation models including said common correlation.

Abstract: A fault cause extraction apparatus including a storage unit which stores a model including one or more correlation functions between pieces of performance information acquired from a plurality of elements and a correlation-destruction-propagation detecting unit which calculates a degree of influence for each of the elements based on correlation destruction information. The correlation destruction information is calculated based on whether pieces of performance information newly acquired from the elements satisfy a relationship represented by the correlation functions.

Abstract: A candidate to cause a fault is identified, in case that correlation destruction is detected in some processing apparatuses or the like due to spread of the fault within a system. A correlation destruction detecting unit 104 detects correlation destruction related to a correlation which is included in a correlation model 122 by applying inputted performance value of a monitored object to the correlation model 122 of the monitored object which a correlation model storing unit 112 stores. The fault analyzing unit 105 determines and outputs the monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting the correlation destruction related to a common correlation in a plurality of the monitored objects which are connected directly or indirectly with a common apparatus or common the monitored object and which have the correlation models 122 including the common correlation.

Abstract: Performance information which is a possible generation cause of a fault is extracted accurately. A fault cause extraction apparatus 10 includes a storage unit 12 and a correlation-destruction-propagation detecting unit 25. Here, the storage unit 12 stores a correlation model including one or more correlation functions, each of which is generated based on a time series of performance information including a plurality of types of performance values in a system and transforms a performance value for one of the types being an input to a performance value for another one of the types being an output.

Abstract: A candidate to cause a fault is identified, in case that correlation destruction is detected in some processing apparatuses or the like due to spread of the fault within a system. A correlation destruction detecting unit 104 detects correlation destruction related to a correlation which is included in a correlation model 122 by applying inputted performance value of a monitored object to the correlation model 122 of the monitored object which a correlation model storing unit 112 stores. The fault analyzing unit 105 determines and outputs the monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting the correlation destruction related to a common correlation in a plurality of the monitored objects which are connected directly or indirectly with a common apparatus or common the monitored object and which have the correlation models 122 including the common correlation.

Abstract: Performance information which is a possible generation cause of a fault is extracted accurately. A fault cause extraction apparatus 10 includes a storage unit 12 and a correlation-destruction-propagation detecting unit 25. Here, the storage unit 12 stores a correlation model including one or more correlation functions, each of which is generated based on a time series of performance information including a plurality of types of performance values in a system and transforms a performance value for one of the types being an input to a performance value for another one of the types being an output.