JP5421831B2 - Failure detection device - Google Patents

Description

  The present invention relates to a failure detection device that detects a failure of a network device.

  Among network devices belonging to various communication networks such as a wired network and a wireless network, those having a monitoring function for raising a failure of another network device in its own device or in the network as an alarm are known. This network device detects a failure of its own device or another network device at an early stage by a monitoring function such as polling, and recovers a deterioration in service quality at an early stage.

  By the way, the failure of the network device includes not only a hardware failure but also a failure in a part of processing due to a bug in software or firmware. In this case, although the monitoring function as described above can detect a hardware failure, it may be difficult to detect the failure by software or the like. For example, in a network device to be detected, when a failure occurs only in traffic processing due to a software bug, it is difficult to detect a failure because it responds normally to a monitoring function such as polling. It was.

  Conventionally, it has been studied to detect a failure by various methods including such a failure. For example, a failure is detected based on traffic self-similarity (Non-Patent Document 1), a prediction error of a plurality of traffic information is calculated, and a failure of a target network device is calculated using the calculated error. What to detect (nonpatent literature 2) etc. is examined.

MFRohani, MAMaarof, A. Selamat and H. Kettani, "Uncovering Anomaly Traffic Based on Loss of Self-Similarity Behavior Using Second Order Statistical Model," IJCSNS International Journal of Computer Science and Network Security, VOL.7, No.9 , Sep. 2007. J.D.Brutlag, “Abberant behavior detection in time series for network monitoring,” Proceedings of the 14th USENIX conference on System administration 2000.

However, the conventional failure detection method has the following problems. For example, in the case of a failure detection method based on traffic self-similarity, fine-grained data is required, and the amount of computation is enormous because failure detection is performed each time new traffic information is observed. In order to suppress the amount of calculation related to failure detection, the failure detection speed becomes slower when the failure detection timing is roughened, and the failure detection accuracy is lowered when the granularity of traffic information used for failure detection is coarsened. There was a problem.
In addition, since traffic information varies greatly in time depending on the wireless environment, when fault detection is performed using single traffic information or a threshold value for fault detection, the number of fault events that can be detected is limited. May not be detected or erroneously detected.

  The present invention has been made in view of the above points, and is capable of detecting a failure of a network device with high accuracy without suppressing an increase in the amount of calculation related to failure detection and reducing a failure detection speed. An object is to provide an apparatus.

The failure detection apparatus of the present invention includes a plurality of traffic information acquisition units that acquire a plurality of different traffic information for a network device, and an error variance of the traffic information from an error according to a normal distribution of each traffic information acquired by each traffic information acquisition unit and a plurality of failure determination value calculation portion for calculating a value, respectively, each weighting for each error variance value calculated by the failure determination value calculation unit, total failure to integrate the error distribution values weighted A failure determination value integration unit that generates a determination value; and a failure detection unit that detects a failure of the network device based on the total failure determination value generated by the failure integration determination value integration unit. And

  According to this configuration, since the failure is detected based on the total failure determination value obtained by integrating the failure determination values calculated from a plurality of different traffic information, the amount of calculation related to the failure detection is increased as compared with the conventional failure detection method. Thus, it is possible to accurately detect a failure of the network device without reducing the failure detection speed. In addition, since the presence / absence of failure is comprehensively detected from the total failure judgment value obtained by integrating the two failure judgment values, compared to the case where failure detection is performed using a single traffic information and a threshold for failure detection as in the past. As a result, the number of detectable failure events can be expanded, and failure detection or false detection can be prevented.

  According to the present invention, it is possible to accurately detect a failure of a network device without suppressing an increase in the amount of calculation related to failure detection and reducing the failure detection speed.

It is a figure which shows embodiment of the failure detection apparatus which concerns on this invention, and is explanatory drawing of the outline | summary of the radio | wireless communications system to which a failure detection apparatus belongs. It is a functional block diagram of a failure detection apparatus according to an embodiment of the present invention. It is a flowchart which shows an example of the operation | movement outline | summary of the failure detection apparatus which concerns on this Embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following embodiment, an example in which the failure detection device according to the present invention is arranged in a wireless communication system including a wireless section between a wireless terminal device and a wireless base station device will be described. It is not limited. Any communication system can be used as long as the failure detection device can be arranged. For example, it includes a wireless section such as the Internet or a public switched telephone network (PSTN) to which a fixed terminal device such as a personal computer or a fixed telephone is connected. It is good also as a structure which arrange | positions a failure detection apparatus in the no wire communication system.

  First, before explaining details of the failure detection apparatus, an example of an outline of a communication system to which the failure detection apparatus belongs will be described. FIG. 1 is a schematic diagram of a communication system to which a failure detection apparatus according to an embodiment of the present invention belongs.

  As shown in FIG. 1, in the wireless communication system 1, communication is performed by a wireless terminal device 2 such as a mobile phone wirelessly connected to the wireless base station device 3 via a relay device 6 such as a switch device 4 or a router device 5. Has been done. The router device 5 is connected to an external server device 7 that provides various services to the wireless terminal device 2 and a failure detection device 8 that detects a device failure in the wireless communication system 1.

  The failure detection apparatus 8 monitors the radio base station apparatus 3, the relay apparatus 6, and the external server apparatus 7, and traffic information generated when the radio base station apparatus 3, the relay apparatus 6, and the external server apparatus 7 are used. I get it regularly. Then, the failure detection device 8 uses a plurality of different traffic information acquired from the wireless base station device 3, the relay device 6, and the external server device 7, and Detect failure.

  The failure detection apparatus 8 according to the present embodiment is configured to be connected as an external apparatus to the detection target radio base station apparatus 3, the relay apparatus 6, and the external server apparatus 7, but the detection target radio base station The station device 3, the relay device 6, and the external server device 7 may be provided inside as a part. Moreover, the failure detection device 8 may be configured to detect all failures of the wireless base station device 3, the relay device 6, and the external server device 7 as a detection target network device, or may be configured to detect any one of them. Good. Furthermore, the failure detection device 8 may be configured to be provided in a part of a radio network controller (RNC: Radio Network Controller) (not shown) positioned above the relay device 6. It is good also as a structure provided in a part of core network. As described above, the failure detection device 8 can target any of the network devices constituting the wireless communication system 1.

  Next, the failure detection apparatus 8 will be described with reference to FIG. FIG. 2 is a functional block diagram of the failure detection apparatus 8 according to the present embodiment. In the following description, the radio base station device 3, the relay device 6, and the external server device 7 to be detected will be referred to as detected devices.

  The failure detection device 8 includes a plurality of individual failure detection units 11 (11a, 11b), a failure determination value integration unit 12, a failure detection unit 13, a detection condition storage unit 14, and a notification unit 15. This failure detection device 8 performs individual failure determination for each of a plurality of different traffic information by using statistical properties, and uses an overall failure determination value obtained by integrating individual failure determination values indicating individual failure determination results. This is a comprehensive judgment of the failure of the detection device. In the following, a case where the failure detection device 8 includes two individual failure detection units 11a and 11b will be described as an example. However, if individual failure determination processing is performed in parallel on different traffic information, The individual failure detection unit 11 can be configured with an arbitrary number.

  Each individual failure detection unit 11a, 11b acquires a plurality of different traffic information, and executes a failure determination operation in parallel using the statistical properties of each acquired traffic information. The traffic information acquisition unit 16 (16a, 16b), a traffic information storage unit 17 (17a, 17b), a failure judgment value calculation unit 18 (18a, 18b), and a statistical information update unit 19 (19a, 19b).

  The traffic information acquisition units 16a and 16b acquire different traffic information from the detected devices. Here, the traffic information is, for example, the number of accepted calls for traffic generated during communication of the wireless terminal device 2 and the number of calls that have been successfully processed (the number of successful calls) among the accepted traffic. As traffic information, not only the number of accepted calls and the number of successful calls but also the number of successful calls with respect to the number of accepted calls may be used as the success rate, or the number of failed calls obtained by subtracting the number of successful calls from the number of accepted calls. May be used. In this case, the number of accepted calls and the number of successful calls may be the number of calls per unit time. The unit time is not particularly limited, and may be, for example, 1 second unit, 1 minute unit, or 1 hour unit. The traffic information may be any information other than the above contents as long as the information indicates the communication processing amount that can be monitored for the detected device.

  In this case, the failure detection device 8 may acquire the traffic information directly from the detected device, or a server device for collecting traffic information may be provided in the wireless communication system 1 to receive the traffic information from this server device. You may make it acquire. The failure detection device 8 may be configured to periodically request traffic information from the detected device, or the traffic information may be periodically transmitted from the detected device to the failure detection device 8. Further, the traffic information acquisition unit 16 may acquire the traffic information for each device of the detected device, or may acquire the traffic information for each component part constituting the detected device. The constituent unit constituting the detected device is a partial unit constituting the detected device such as an interface unit such as a port, a module unit, or an interface card unit.

As described above, the traffic information acquired by the traffic information acquisition units 16a and 16b is different types (types) of traffic information, and the traffic information a (t) and b (t) acquired at a predetermined time t. , c (t), d (t). It is assumed that the traffic information a (t), b (t), c (t), and d (t) have a relationship as shown in Expression (1) and Expression (2).
a (t) = b (t) + e ₁ (t) (1)
c (t) = d (t) + e ₂ (t) (2)
Here, e ₁ (t) and e ₂ (t) are assumed to be errors according to a normal distribution. In the following description, it is assumed that the traffic information acquisition unit 16a acquires the traffic information a (t), b (t), and the traffic information acquisition unit 16b acquires the traffic information c (t), d (t). .

  The traffic information storage unit 17 stores the traffic information of the detected device acquired by the traffic information acquisition unit 16. In the present embodiment, the traffic information storage unit 17 stores the traffic information a (t) and b (t) acquired by the traffic information acquisition unit 16, and the traffic information storage unit 17 acquires the traffic information acquisition unit 16. The traffic information c (t), d (t) is stored.

The failure determination value calculation units 18a and 18b convert the traffic information stored in the traffic information storage units 17a and 17b into individual failure determination values for failure determination in each individual failure determination unit, and the individual failure determination values are predetermined. A failure determination is made in comparison with the threshold value, and an individual failure determination value is output to the failure determination value integration unit 12 as a failure determination result. Here, the individual failure judgment value, the traffic information a (t), b (t ) and c (t), the error variance value calculated from the error e ₁ and e ₂ of d (t) (variance value) Use σ ₁ and σ ₂ . In this case, the expected value is 0, but the expected value is subtracted in advance so that the expected value is 0 when the expected value is not 0. Specifically, as shown in Expression (3), the variance value σ ₁ is calculated by the mean square of the error e ₁ of the traffic information a (t) and b (t), and as shown in Expression (4). The variance value σ ₂ is calculated by the mean square of the error e ₂ of the traffic information c (t), d (t).
σ ₁ = E [| e ₁ (t) | ² ] (3)
σ ₂ = E [| e ₂ (t) | ² ] (4)

Then, the failure determination value calculation units 18a and 18b output individual failure determination values (dispersion values σ ₁ and σ ₂ ) to the failure determination value integration unit 12 as individual failure determination results.

The failure determination value integration unit 12 weights the individual failure determination values (dispersion values σ ₁ and σ ₂ ) received from the failure determination value calculation units 18a and 18b, respectively, and integrates the individual failure determination values. A comprehensive failure judgment value σ for comprehensively judging whether or not there is a failure is generated. The total failure judgment value σ is defined by the equations (5) and (6), and w ₁ and w ₂ are positive weights.
σ = w ₁ σ ₁ + w ₂ σ ₂ (5)
σ = w ₁ σ ₁ + w ₂ σ ₂ = w ₁ * E [| a (t) −b (t) | ² ] + w ₂ * E [| c (t) −d (t) | ² ]
(6)
Here, E [] represents an ensemble average, but a time average may be used instead of the ensemble average.

The statistical information update units 19a and 19b are periodically collected so that the individual failure determination values (dispersion values σ ₁ and σ ₂ ) calculated by the failure determination value calculation units 18a and 18b follow the time variation of traffic. It learns statistical information of traffic information a (t), b (t) and c (t), d (t), and uses the statistical information (statistical properties) of this traffic information to sequentially determine individual failure judgment values. Update to Here, for example, statistical information is calculated using exponential smoothing according to equations (7) and (8).
Update process:
σ ₁ (t) = ησ ₁ (t−1) + (1−η) | a (t) −b (t) | ²
σ ₁ (t) = 0 for t = 0 (7)
σ ₂ (t) = ζσ ₂ (t−1) + (1−ζ) | c (t) −d (t) | ²
σ ₂ (t) = 0 for t = 0 (8)

When the update processing by the statistical information update units 19a and 19b is performed, the failure determination value integration unit 12 uses the equation (9) to calculate the updated individual failure determination values (dispersion values σ ₁ (t) and σ ₂ (t) ) Are weighted and integrated to generate a comprehensive failure judgment value σ (t).
Integrated processing:
σ (t) = w ₁ σ ₁ (t) + w ₂ σ ₂ (t) (9)

Thereby, even when the traffic information largely fluctuates in time according to the wireless environment, it is possible to calculate an individual failure judgment value that follows this fluctuation. Note that the statistical information of the traffic information was updated from the formulas (7) and (8) before the integration (weighting) processing of the individual fault judgment values in the fault judgment value integration unit 12 shown in the formula (9). As shown in equation (10), each (instantaneous) variance value | a (t) −b (t) | ² and | c (t) −d (t) | ² are weighted by w _{1 and} w _2. It is also possible to update the traffic information statistical information shown in Expression (11) with respect to the integrated failure judgment value σ.
Integrated processing:
σ ′ (t) = w ₁ * | a (t) −b (t) | ² + w ₂ * | c (t) −d (t) | ² (10)
σ ′ (t) indicates an integration result of instantaneous errors at time t.
Update process:
σ (t) = λσ (t−1) + (1−λ) σ ′ (t) (11)

Here, since the detection probability of occurrence of a failure based on the traffic information and the traffic information varies according to the traffic amount and the time zone, the detection accuracy by the individual failure detection units 11a and 11b changes with time. In this case, the failure determination value integration unit 12 can appropriately integrate the individual failure determination values by changing the weighting according to the traffic amount and / or the time zone, and can improve the detection accuracy. In particular, when the individual failure detection accuracy of one individual failure detection unit 11 is improved according to the time zone or the traffic volume and the individual failure detection accuracy of the other individual failure detection unit 11 is deteriorated, each of these detection accuracy is set. The weighting value is increased or decreased accordingly. That is, it is preferable to adjust the values of the weights w ₁ and w ₂ quasi-statically according to the traffic amount and the time variation.

  The failure detection unit 13 detects a failure of the detected device based on the total failure determination value σ integrated by the failure determination value integration unit 12 and outputs a failure detection result to the notification unit 15. Specifically, the failure detection unit 13 compares the threshold TH stored as the detection condition in the detection condition storage unit 14 with the total failure determination value σ, and is normal when the total failure determination value σ is smaller than the threshold TH. If the total failure determination value σ is larger than the threshold value TH, it is determined that there is a failure. Also, the failure detection unit 13 resets (deletes) the traffic information stored in the traffic information storage units 17a and 17b when a failure is detected, and stores the traffic information in the traffic information storage units 17a and 17b when no failure is detected. Learning (updating) of the stored traffic information is continued.

  When the failure detection unit 13 detects a failure, the notification unit 15 notifies the system administrator to that effect. In this case, the alerting | reporting part 15 should just be the structure which can alert | report a failure of an apparatus with respect to a system administrator, may alert | report by audio | voices, such as an alarm, and may alert | report by an image display. Moreover, you may make it alert | report by an e-mail etc. with respect to a system administrator. Note that the radio communication system 1 may switch to the redundant configuration based on the notification from the notification unit 15.

  Each unit of the failure detection apparatus 8 described above is configured such that a CPU (Central Processing Unit) incorporated in the apparatus calculates data in a RAM (Random Access Memory) according to various programs in the ROM (Read Only Memory). The processing is executed in cooperation with each unit such as the wireless base station device 3, the relay device 6, and the external server device 7 constituting the wireless communication system 1.

  Next, an example of the operation outline of the failure detection apparatus 8 will be briefly described with reference to FIG. FIG. 3 is a flowchart showing an example of an operation outline of the failure detection apparatus 8 according to the present embodiment. In FIG. 3, the case where the statistical information of each traffic information is updated before the generation of the comprehensive failure judgment value is described as an example.

  First, the traffic information, failure judgment value, and statistical information of the detected devices in the individual failure detectors 11a and 11b are initialized (step S01). Next, the traffic information acquisition unit 16a acquires the traffic information a (t), b (t) (step S02), and the traffic information acquisition unit 16b acquires the traffic information c (t), d (t). (Step S03). The acquired traffic information a (t), b (t) is stored in the traffic information storage unit 17a, and the acquired traffic information c (t), d (t) is stored in the traffic information storage unit 17b.

Next, the failure judgment value calculation unit 18a calculates the variance value σ ₁ from the traffic information a (t) and b (t) stored in the traffic information storage unit 17a by the above equation (3) (step S04). The failure judgment value calculation unit 18a calculates the variance value σ ₂ from the traffic information c (t) and d (t) stored in the traffic information storage unit 17b by the above equation (4) (step S05). In the statistical information updating unit 19a, the individual failure judgment value (dispersion value σ ₁ ) calculated by the failure judgment value calculation unit 18a is sequentially updated so as to follow the time variation of traffic according to the above equation (5) ( Step S06). Similarly, the statistical information update unit 19a sequentially updates the individual failure determination value (variance value σ ₂ ) calculated by the failure determination value calculation unit 18a so as to follow the time variation of traffic by the above equation (6). (Step S07). The updated variance values σ ₁ and σ ₂ are sent to the failure judgment value integration unit 12. Here, the processes up to steps S02, S04 and S06 in the individual fault detection unit 11a and the processes up to steps S03, S05 and S07 in the individual fault detection unit 11b are executed in parallel.

Next, in the failure determination value integration unit 12, the individual failure determination values (dispersion values σ ₁ (t) and σ ₂ (t)) calculated by the failure determination value calculation units 18a and 18b by the above equation (9). Are weighted, and a total failure judgment value σ (t) is generated (step S08). The failure detection unit 13 compares the total failure determination value σ (t) generated by the failure determination value integration unit 12 with the threshold value TH stored in the detection condition storage unit 14 to determine whether there is a failure in the detected device. (Step S09). If the total failure determination value σ (t) is outside the normal range (greater than the threshold value TH) (step S09: Yes), it is determined that there is a failure in the detected device, and the notification unit 15 notifies the failure. (Step S10). On the other hand, when the total failure determination value σ (t) is within the normal range (smaller than the threshold value TH) (step S09: No), the operation returns to the operations of steps S02 and S03. Then, the traffic information, the failure judgment value, and the statistical information in the individual failure detection units 11a and 11b are reset (erased) (step S11).

  As described above, according to the present embodiment, since a failure is detected from an overall failure determination value obtained by integrating each failure determination value calculated from a plurality of different traffic information, failure detection can be performed compared to the conventional failure detection method. It is possible to accurately detect a failure of the network device without suppressing an increase in the calculation amount and reducing the failure detection speed. Further, the presence / absence of a failure is comprehensively detected from a comprehensive failure determination value obtained by integrating the failure determination value calculated by one failure determination value calculation unit 18a and the failure determination value calculated by the other failure determination value calculation unit 18b. Therefore, compared with the conventional case where failure detection is performed using single traffic information and failure detection thresholds, the number of detectable failure events is expanded, and failure detection or false detection is prevented. Can do.

In the above embodiment, the total failure judgment value σ (t) and the threshold value TH are compared to detect the presence or absence of a failure. However, each variance value σ ₁ calculated by the above equations (3) and (4) is used. And σ ₂ may be compared with the threshold values TH ₁ and TH ₂ for determining individual failures, respectively, to detect the presence or absence of failures, and perform individual failure detection. In this case, even if the failure determination value calculated by one failure determination value calculation unit 18a indicates normality and the failure determination value calculated by the other failure determination value calculation unit 18b indicates abnormality, each failure Since fault detection is comprehensively performed from the total fault judgment value obtained by integrating the judgment values, it is possible to improve the fault detection accuracy of the network device.

Further, in the failure detection of the detected device by the failure detection device 8, as shown in the equations (12) and (13), the traffic information a (t), b where the variances of the errors e ₁ and e ₂ are minimized. It is also possible to use (t) and c (t), d (t).
a (t) = αb (t) + e ₁ (t) (12)
c (t) = βd (t) + e ₂ (t) (13)
Here, it is assumed that e ₁ (t) and e ₂ (t) are errors according to a normal distribution. In addition, each expected value and dispersion value are μ ₁ , σ ₁ and μ ₂ , σ ₂ . Let α and β be unknown values.

Similarly to the above, the variance value σ ₁ is calculated by the mean square of the error e ₁ of the traffic information a (t), αb (t), and the variance value σ ₂ is the error of the traffic information c (t), βd (t). It is calculated by the mean square of e _2. Then, a variance value _{σ 1 E [| a (t} ) -αb (t) | 2] and the value of alpha _m that minimizes the variance value _{σ 1 E [| c (t} ) -βd (t ) | ² ] to minimize the value of β _m . The values of α _m and β _m are given by equations (14) and (15).
α _m = σ _c1 / σ ₁ (14)
β _m = σ _c2 / σ ₂ (15)
Here, σ _c1 = E [a (t) * b (t)] and σ _c2 = E [c (t) * d (t)] are defined.

Then, the total failure judgment value σ is calculated by weighting the minimized variance values σ ₁ and σ _{2 according} to the equation (16). In this case, first, the values α _m and β _m that minimize the variance value are sequentially updated, and then the individual failure determination values are sequentially updated. After the individual failure determination value update processing, the integration processing ( Weighting).
Integrated processing:
σ = w ₁ σ ₁ + w ₂ σ ₂
= W ₁ * E [| a (t) −α _m (t) b (t) | ² ] + w ₂ * E [| c (t) −β _m (t) d (t) | ² ]
... (16)

Further, as in the above-described embodiment, the individual failure judgment value can be sequentially updated in order to follow the time fluctuation of traffic. That is, it is necessary to sequentially update the calculations of σ ₁ , σ ₂ , σ _c1 , and σ _c2 . When integration (weighting) is performed before the individual failure judgment value update process, in addition to σ ₁ , σ ₂ , σ _c1 , σ _c2 , σ is calculated as shown in the following equations (17) and (18). Must be updated sequentially.
Integrated processing:
σ ′ (t) = w ₁ * | a (t) −α _m (t) b (t) | ² + w ₂ * | c (t) −β _m (t) d (t) | ²
... (17)
σ ′ (t) indicates an integration result of instantaneous errors at time t.
Update process:
σ (t) = λσ (t−1) + (1−λ) σ ′ (t) (18)

  Further, in the above-described embodiment, the failure detection apparatus is not limited to the configuration applied to a specific communication system, and may be applied to any communication system. For example, the present invention may be applied to communication systems such as NGN in addition to ISDN and ADSL fixed communication systems. The present invention may also be applied to mobile communication systems such as W-CDMA, HSDPA / HSUPA, LTE, LTE-Advanced, IMT-Advanced, WiMAX, and Wi-Fi.

  Although the present invention has been described above with reference to specific embodiments, the present invention is merely illustrative, and may be implemented with variations, modifications, alternatives, replacements, and the like that can be considered by those skilled in the art. Further, in the present embodiment, explanations have been made using specific numerical examples in order to promote understanding of the invention. However, unless otherwise specified, these numerical values are merely examples and have the same effect. Any numerical value may be used. Further, the division of the examples or items is not essential to the present invention, and the matters described in two or more examples or items may be used in combination as necessary. For convenience of explanation, the apparatus according to the present embodiment has been described using a functional block diagram, but the apparatus may be realized by hardware, software, or a combination thereof. The present invention is not limited to the above-described embodiments, and various modifications, corrections, alternatives, substitutions, and the like are included without departing from the technical idea of the present invention.

  The embodiment disclosed this time is illustrative in all respects and is not limited to this embodiment. The scope of the present invention is shown not by the above description of the embodiments but by the scope of the claims, and is intended to include all modifications within the meaning and scope equivalent to the scope of the claims.

  As described above, the present invention has an effect that a failure of a network device can be detected with high accuracy, and is particularly useful for a failure detection device that detects a failure of a network device in a wireless communication system.

1 wireless communication system 2 wireless terminal device 3 wireless base station device (network device)
4 Switch device (network device)
5 Router device (network device)
6 Relay device (network device)
7 External server device (network device)
8 Failure detection device 11 (11a, 11b) Individual failure detection unit 12 Failure judgment value integration unit 13 Failure detection unit 14 Detection condition storage unit 15 Notification unit 16 (16a, 16b) Traffic information acquisition unit 17 (17a, 17b) Traffic information Storage unit 18 (18a, 18b) Failure judgment value calculation unit 19 (19a, 19b) Statistical information update unit

Claims (4)

A plurality of traffic information acquisition units for acquiring a plurality of different traffic information for the network device;
A plurality of failure judgment value calculation units for calculating an error variance value of the traffic information from an error according to a normal distribution of each traffic information acquired in each traffic information acquisition unit ;
A failure determination value integration unit that weights each error variance value calculated by the failure determination value calculation unit and integrates the weighted error variance values to generate a total failure determination value;
A failure detection device comprising: a failure detection unit that detects a failure of the network device based on the total failure determination value generated by the failure integration determination value integration unit. Based on the new traffic information acquired by the traffic information acquisition unit, it has a failure judgment value update unit that sequentially updates the error variance value so as to follow the temporal variation of the traffic information,
The failure detection according to claim 1, wherein the failure determination value integration unit generates the comprehensive failure determination value by weighting the error variance value updated by the failure determination value update unit. apparatus. Based on the new traffic information acquired by the traffic information acquisition unit, it has a failure judgment value update unit that sequentially updates the error variance value so as to follow the temporal variation of the traffic information,
The failure determination value integrating section, a weighting to the error distribution values before updating by the failure determination value updating section, the total update the error distribution values weighted by the failure judgment value updating section The failure detection apparatus according to claim 1, wherein a failure determination value is generated. Failure detecting apparatus according to any one of claims 1 to 3, characterized in that the value of the weighting for weighting said failure judgment value is variable.

Images