Abstract: To reduce a risk of detecting an access within a range of temporarily elevated access authority as an unauthorized access, an unauthorized access detection device stores elevated access management data related to an elevated access operation (an operation within a range of temporarily elevated access authority) performed on a system. An operation log source that is a source of an operation log is configured to accumulate operation logs of operations as the elevated access operation on the system, as well as operation logs of operations other than the elevated access operation. The unauthorized access detection device acquires an operation history (one or more operation logs) from the operation log source, and performs determination on whether a response is required that is a determination on whether an operation identified from the operation history is an operation as an unauthorized access not matching an operation identified from the elevated access management data.

Abstract: A management computer 100 which assists in identifying a cause of failure concerning execution of an application includes a CPU 101 and an HDD 103. The HDD 103 stores configuration information (configuration information, configuration change history) concerning configurations at a plurality of time points regarding a given target configuration object concerning execution of the application. The CPU 101 calculates a viewpoint-based difference score that is a difference score in each of a plurality of viewpoints between a current configuration and a past configuration regarding the given target configuration object concerning execution of the application.

Abstract: Provided is a simple method for performing control so that a measurement load caused by detailed measurement does not degrade performance of an application in accordance with a situation in which the detailed measurement is requested. A control system is connected to a computer system in which one or more hosts that execute processes constituting an application run, and manages a control policy for controlling, according to a load state of the host, execution of measurement processing for acquiring internal information on the host. The control system determines a control policy to be applied when a measurement request is received, and controls, based on the determined control policy and the load state of the host to be measured, execution of the measurement processing for the host to be measured.

Abstract: An event monitoring system includes a processor and a storage unit. The storage unit holds an event message including a character string related to an event occurring in an information system and guide information including one or more guides. The guide includes a guide message including a predetermined character string, notified in response to the event, and information regarding a coping method for the event. The processor compares the event message and the guide, associates the guide with the event in a case where the guide further includes information for identifying a variable portion of the guide message and a portion other than the variable portion of the guide message coincides with a portion other than a portion corresponding to the variable portion in the event message, and receives an input of information indicating a correct answer of a guide to be associated with the event in a case where the guide does not include the information for identifying the variable portion.

Abstract: An automation support device includes a processor and a storage unit. In this automation support device, the storage unit stores a man-hour estimation rule that is a rule for estimating man-hours for automation of a work procedure manual related to a procedure of work. Then, the processor calculates man-hours required for automation of the work procedure manual by using the man-hour estimation rule stored in the storage unit with the work procedure manual and a work execution record which is a record of execution according to the work procedure manual as inputs.

Abstract: An anomaly detection apparatus executes prediction processing to predict fluctuations of a normal range for a value of a parameter in a specified period, correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted normal range, correct the upper limit values of the normal range, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected normal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified, and anomaly detection processing to acquire a value of the parameter in the specified period, determine whether the value of the parameter acquired falls within the corrected normal range, and output predetermined information when determining that the value of the parameter acquired does not fall within the corrected normal range.

Abstract: A personnel management system includes: a storage device that stores management information and a software program; and a processor that refers to the management information and executes the software program. The management information includes job information, for each job, indicating a date and time when the job is to be executed and a skill required for the job, job performance information, for each job, recording a date and time when the job is actually executed and an execution result of the job, skill information indicating the number of necessary personnel having the skill for each skill, and personnel information indicating a skill possessed by the personnel for each skill. The processor specifies a skill in which personnel is insufficient, creates an OJT plan for the insufficient skill, and compares the execution result of the number of personnel having the insufficient skill before and after the OJT is executed.

Abstract: To improve promptness of anomaly detection after occurrence of an event, provided is an anomaly detection apparatus including a processor that executes a program and a storage device that stores the program. The processor executes a correction process of applying a scale transformation to correct second predicted data in time-series first predicted data of a monitoring target, the second predicted data including data after occurrence time of a specific event, and a detection process of detecting an anomaly of the monitoring target based on the second predicted data corrected in the correction process and based on second measured data in time-series first measured data of the monitoring target, the second measured data including data after the occurrence time of the specific event.

Abstract: The present invention aims to specify a bottlenecked resource more accurately in an IT system. In a performance analysis apparatus which includes a processing device, a storage device and an input/output interface and analyzes a performance of an IT system, the processing device creates an overall performance prediction model by using a nonlinear regression algorithm with a first overall performance value being set as an objective variable and with a first resource performance value being set as an explanatory variable, creates an explanatory model by inputting the overall performance prediction model and using an XAI technology and calculates a degree of per-resource influence on the overall performance value which is output by inputting a second resource performance value into the explanatory model.

Abstract: Execution end timing of a jobnet is predicted with stable accuracy. An information processing apparatus executes jobnet execution time prediction model generation processing for generating an execution time prediction model for predicting execution time of a jobnet to be executed on the basis of information associated with execution time of each of previously executed jobnets, a prediction model accuracy determination processing for calculating prediction accuracy for the execution time of each of jobnets by the generated execution time prediction model, and delay determination processing for determining whether to predict execution end timing of a designated jobnet among a jobnet group that is a set of a plurality of jobnets currently being executed or to be subsequently executed on the basis of the execution time prediction model, on the basis of the calculated prediction accuracy for the execution time of each of the jobnets.

Abstract: An outlier detection apparatus creates a first processing window having a designated window length and a second processing window having a designated window length, and performs sliding alignment for sliding the second processing window relative to the first processing window by a designated sliding alignment length. The apparatus performs one or more types of outlier sub-detections. The outlier sub-detection includes comparing, by a method corresponding to the type of outlier sub-detection, a real time series dataset which is a data portion corresponding to the first processing window from among real time series data which is a time series of real values, with a forecasted time series dataset which is a data portion corresponding to the second processing window after the sliding alignment from among forecasted time series data which is a time series of forecasted values. The apparatus decides whether an outlier candidate is an outlier.

Abstract: Aspects relate to determining the presence or absence of concept drift in seasonal time series data. A concept drift detection device including a data input unit for receiving a time series data set that includes a set of past time series data and a set of current time series data, a baseline model generation unit for generating a baseline model based on a subset of the set of past time series data, a feature extraction unit for extracting a set of past data features, a set of baseline data features, and a set of current data features, a distance calculation unit for calculating a baseline distance and a current distance, and a concept drift detection unit for determining, based on a baseline statistic and the current distance, presence or absence of concept drift between the set of current time series data and the set of past time series data.

Abstract: An inter-volume copy time is to be accurately predicted. An operation management system is configured to perform operation management on a storage device including a plurality of resources and a plurality of volumes. In the storage device, IO processing and copy processing are performed between a plurality of volume groups in which the plurality of volumes are collected. The operation management system includes a processor, and the processor is configured to predict an inter-pool copy speed between the plurality of volume groups belonging to a same resource pool in the storage device, and predict an inter-volume copy time based on the predicted inter-pool copy speed.

Abstract: To improve promptness of anomaly detection after occurrence of an event, provided is an anomaly detection apparatus including a processor that executes a program and a storage device that stores the program. The processor executes a correction process of applying a scale transformation to correct second predicted data in time-series first predicted data of a monitoring target, the second predicted data including data after occurrence time of a specific event, and a detection process of detecting an anomaly of the monitoring target based on the second predicted data corrected in the correction process and based on second measured data in time-series first measured data of the monitoring target, the second measured data including data after the occurrence time of the specific event.

Abstract: Provided are an event monitoring apparatus and an event monitoring method that make it possible to set a proper threshold without handling monitoring target systems on an individual basis. There are included: a threshold determination program calculating degree of similarity between a ledger guide message and an event message, regarding a maximum value of the calculated degree of similarity as a first threshold, and setting a second threshold that is greater than the first threshold by a predetermined value; a ledger allocation program associating a ledger guide message having the degree of similarity intermediate between the first threshold and the second threshold with the event message; and a threshold evaluation program reporting the degree of similarity to a manager of a monitoring target system when the degree of similarity is higher than the first threshold.

Abstract: An event monitoring system includes a processor and a storage unit. The storage unit holds an event message including a character string related to an event occurring in an information system and guide information including one or more guides. The guide includes a guide message including a predetermined character string, notified in response to the event, and information regarding a coping method for the event. The processor compares the event message and the guide, associates the guide with the event in a case where the guide further includes information for identifying a variable portion of the guide message and a portion other than the variable portion of the guide message coincides with a portion other than a portion corresponding to the variable portion in the event message, and receives an input of information indicating a correct answer of a guide to be associated with the event in a case where the guide does not include the information for identifying the variable portion.

Abstract: Provided are an event monitoring apparatus and an event monitoring method that make it possible to set a proper threshold without handling monitoring target systems on an individual basis. There are included: a threshold determination program calculating degree of similarity between a ledger guide message and an event message, regarding a maximum value of the calculated degree of similarity as a first threshold, and setting a second threshold that is greater than the first threshold by a predetermined value; a ledger allocation program associating a ledger guide message having the degree of similarity intermediate between the first threshold and the second threshold with the event message; and a threshold evaluation program reporting the degree of similarity to a manager of a monitoring target system when the degree of similarity is higher than the first threshold.

Abstract: A log labeling apparatus is configured to include a label importance DB and a similarity DB configured to store importance information between a plurality of labels and an action set and action set information identifying a first action set for calculating a second similarity with each label of a first log unit, a similarity calculation unit configured to calculate the second similarity with each label of the first log unit on the basis of the importance information, an action set of the first log unit, and the action set of the action set information, a post processor configured to detect label candidates, and an accumulation determination unit configured to determine a second action set for calculating a second similarity of a second log unit and to store action set information on the second action set in the similarity DB.

Abstract: An inter-volume copy time is to be accurately predicted. An operation management system is configured to perform operation management on a storage device including a plurality of resources and a plurality of volumes. In the storage device, IO processing and copy processing are performed between a plurality of volume groups in which the plurality of volumes are collected. The operation management system includes a processor, and the processor is configured to predict an inter-pool copy speed between the plurality of volume groups belonging to a same resource pool in the storage device, and predict an inter-volume copy time based on the predicted inter-pool copy speed.

Abstract: Execution end timing of a jobnet is predicted with stable accuracy. An information processing apparatus executes jobnet execution time prediction model generation processing for generating an execution time prediction model for predicting execution time of a jobnet to be executed on the basis of information associated with execution time of each of previously executed jobnets, a prediction model accuracy determination processing for calculating prediction accuracy for the execution time of each of jobnets by the generated execution time prediction model, and delay determination processing for determining whether to predict execution end timing of a designated jobnet among a jobnet group that is a set of a plurality of jobnets currently being executed or to be subsequently executed on the basis of the execution time prediction model, on the basis of the calculated prediction accuracy for the execution time of each of the jobnets.