Control system, information processing device, and anomaly factor estimation program

An information processing apparatus connected to a controller that controls a control target, wherein:

• the controller is connected to one or more devices through a network, and maintains an event log containing an event which occurred during a control operation and network statistical information containing statistical information associated with data transmission on the network;
• the information processing apparatus performs a factor estimation process that provides an interactive user interface in accordance with selection of an anomaly phenomenon registered in the event log;
• and
• the factor estimation process comprises:
• accessing the event log and the network statistical information in the controller;
• identifying, based on contents of the anomaly phenomenon registered in the event log, a factor having caused the target anomaly phenomenon from among one or more factor candidates associated with the target anomaly phenomenon;
• in response to the factor having caused the target anomaly phenomenon not being identifiable based on the contents of the anomaly phenomenon registered in the event log, presenting to a user, based on an association between the anomaly phenomenon and one or more factors that cause the anomaly phenomenon, an action for identifying the factor having caused the target anomaly phenomenon from among the one or more factor candidates associated with the target anomaly phenomenon;
• in response to the factor having caused the target anomaly phenomenon being identifiable based on the contents of the anomaly phenomenon registered in the event log, presenting to the user the identified factor;
• and
• after execution of the action presented to the user, determining, based on the network statistical information, whether the target anomaly phenomenon is recovered by an action taken by the user, wherein
• the factor estimation process further comprises presenting to the user a plurality of factor candidates that are similar to each other and associated with the target anomaly phenomenon, and sequentially presenting to the user actions for the plurality of the factor candidates.

An anomaly factor estimation program executed by an information processing apparatus connected to a controller that controls a control target, wherein:

• the controller is connected to one or more devices through a network, and maintains an event log containing an event which occurred during a control operation and network statistical information containing statistical information associated with data transmission on the network;
• the anomaly factor estimation program causes the information processing apparatus to perform a factor estimation process that provides an interactive user interface in accordance with selection of an anomaly phenomenon registered in the event log;
• the factor estimation process comprises:
• accessing the event log and the network statistical information in the controller;
• identifying, based on contents of the anomaly phenomenon registered in the event log, a factor having caused the target anomaly phenomenon from among one or more factor candidates associated with the target anomaly phenomenon;
• in response to the factor having caused the target anomaly phenomenon not being identifiable based on the contents of the anomaly phenomenon registered in the event log, presenting to a user, based on an association between the anomaly phenomenon and one or more factors that cause the anomaly phenomenon, an action for identifying the factor having caused the target anomaly phenomenon from among the one or more factor candidates associated with the target anomaly phenomenon;
• in response to the factor having caused the target anomaly phenomenon being identifiable based on the contents of the anomaly phenomenon registered in the event log, presenting to the user the identified factor;
• and
• after execution of the action presented to the user, determining, based on the network statistical information, whether the target anomaly phenomenon is recovered by an action taken by the user, wherein
• the factor estimation process further comprises presenting to the user a plurality of factor candidates that are similar to each other and associated with the target anomaly phenomenon, and sequentially presenting to the user actions for the plurality of the factor candidates.