# US 12,216,531 B2 · Early abnormality detection based on frequency-inverse document frequency vectors created using event logs > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,216,531 B2 - Document ID: US12216531B2 - Status: Granted - Kind: B2 - Application number: 18/103,891 - Filed: 2023-01-31 - Published: 2023-08-24 - Granted: 2025-02-04 - Earliest claimed: 2022-02-21 - Assignees: NEC Platforms, Ltd. - Applicants: NEC Platforms, Ltd. - Inventors: Ryo Suzuki; Ken Tonari - Web page: https://patentgrep.com/patent/US12216531B2 ## CPC - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0721: {within a central processing unit [CPU]} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A learning unit of an operation management system extracts, according to performance information and event logs of a device to be managed, a first abnormality occurrence period using the performance information, calculates a first TF-IDF vector created using event logs in the first abnormality occurrence period, and stores at least the first TF-IDF vector as a learning model. A recommendation section calculates, using the performance information and event logs newly acquired by the device, a second abnormality occurrence period and a second TF-IDF vector, calculates a first degree of similarity between the first TF-IDF vector in the learning model and the second TF-IDF vector, and outputs recommendation information regarding the calculated second abnormality occurrence period when the first degree of similarity is equal to or less than a predetermined value. ## Claims ### Claim 1 An operation management system comprising: one or more memories storing instructions; and one or more processors configured to execute the instructions to: successively receive, from a device to be managed, performance information and event logs of the device to be managed; extract, according to the performance information and the event logs of the device to be managed, a first abnormality occurrence period using the performance information, calculate a first term frequency-inverse document frequency vector created using event logs in the first abnormality occurrence period, and store at least the first term frequency-inverse document frequency vector as a learning model; calculate, using the performance information and event logs newly acquired by the device, a second abnormality occurrence period and a second term frequency-inverse document frequency vector, calculate a first degree of similarity between the first term frequency-inverse document frequency vector in the learning model and the second term frequency-inverse document frequency vector, and transmit, to a terminal of an operation manager of the device, recommendation information regarding the calculated second abnormality occurrence period when the first degree of similarity is equal to or less than a predetermined value; acquire, for the performance information and the event logs of the device, predicted data of performance information using the performance information as learning data, extract an abnormality occurrence period of the predicted data to set the abnormality occurrence period of the predicted data as a third abnormality occurrence period, and store the third abnormality occurrence period and event logs corresponding to the third abnormality occurrence period; and calculate, when there is a predetermined difference in comparison of the second abnormality occurrence period and the third abnormality occurrence period, a third term frequency-inverse document frequency vector according to the event logs corresponding to the third abnormality occurrence period, calculate a second degree of similarity between the second term frequency-inverse document frequency vector and the third term frequency-inverse document frequency vector, and transmit, to the terminal of the operation manager of the device, recommendation information regarding the second abnormality occurrence period when the second degree of similarity is equal to or greater than a predetermined value. ### Claim 2 (depends on 1) The operation management system according to claim 1, wherein the one or more processors are configured to execute the instructions to extract, according to the stored performance information and the event logs of the device, a fourth abnormality occurrence period in which a degree of similarity in abnormality is equal to or greater than a predetermined value, and when there is a disturbance of regularity in the fourth third abnormality occurrence period, output recommendation information regarding an abnormality occurrence period corresponding to the disturbance of regularity. ### Claim 3 (depends on 1) The operation management system according to claim 1, wherein the one or more processors are configured to execute the instructions to output the recommendation information regarding the second abnormality occurrence period when the second degree of similarity is equal to or less than a predetermined value. ### Claim 4 (depends on 1) The operation management system according to claim 1, wherein the one or more processors are configured to execute the instructions to receive feedback information on whether there is a problem or abnormality with respect to the recommendation information, and store the feedback information in the learning model. ### Claim 5 (depends on 1) The operation management system according to claim 1, wherein the one or more processors are configured to execute the instructions to output the recommendation information regarding the second abnormality occurrence period only when the second degree of similarity is equal to or greater than a predetermined value and there is an abnormality registered in a feedback information. ### Claim 6 (depends on 1) The operation management system according to claim 1, wherein the one or more processors are configured to execute the instructions to: acquire an abnormality index by applying a time-series data abnormality detection algorithm to the performance information of the device; extract an abnormality occurrence period when the abnormality index is equal to or greater than a predetermined value; provide a morphological analysis with respect to event logs of the abnormality occurrence period to divide the event logs into divisions; and calculate a term frequency-inverse document frequency vector using the divisions to obtain the term frequency-inverse document frequency vector. ### Claim 7 (depends on 6) The operation management system according to claim 6, wherein the abnormality occurrence period is set to a period including a period in which the abnormality index is equal to or greater than a predetermined value. ### Claim 8 (depends on 1) The operation management system according to claim 1, wherein the one or more processors are configured to execute the instructions to collect the performance information and the event logs of the device. ### Claim 9 An operation management method comprising: successively receiving, from a device to be managed, performance information and event logs of the device to be managed; extracting, according to the performance information and the event logs of the device to be managed, a first abnormality occurrence period using the performance information, calculating a first term frequency-inverse document frequency vector created using event logs in the first abnormality occurrence period, and storing at least the first term frequency-inverse document frequency vector as a learning model; calculating, using the performance information and event logs newly acquired by the device, a second abnormality occurrence period and a second term frequency-inverse document frequency vector, calculating a first degree of similarity between the first term frequency-inverse document frequency vector in the learning model and the second term frequency-inverse document frequency vector, and transmitting, to a terminal of an operation manager of the device, recommendation information regarding the calculated second abnormality occurrence period when the first degree of similarity is equal to or less than a predetermined value; acquiring, for the performance information and the event logs of the device, predicted data of performance information using the performance information as learning data, extracting an abnormality occurrence period of the predicted data to set the abnormality occurrence period of the predicted data as a third abnormality occurrence period, and storing the third abnormality occurrence period and event logs corresponding to the third abnormality occurrence period; and calculating, when there is a predetermined difference in comparison of the second abnormality occurrence period and the third abnormality occurrence period, a third term frequency-inverse document frequency vector according to the event logs corresponding to the third abnormality occurrence period, calculating a second degree of similarity between the second term frequency-inverse document frequency vector and the third term frequency-inverse document frequency vector, and transmitting, to the terminal of the operation manager of the device, recommendation information regarding the second abnormality occurrence period when the second degree of similarity is equal to or greater than a predetermined value. ### Claim 10 A non-transitory computer-readable storage medium that has recorded an operation management computer program for causing a computer to execute: successively receiving, from a device to be managed, performance information and event logs of the device to be managed; extracting, according to the performance information and the event logs of the device to be managed, a first abnormality occurrence period using the performance information, calculating a first term frequency-inverse document frequency vector created using event logs in the first abnormality occurrence period, and storing at least the first term frequency-inverse document frequency vector as a learning model; calculating, using the performance information and event logs newly acquired by the device, a second abnormality occurrence period and a second term frequency-inverse document frequency vector, calculating a first degree of similarity between the first term frequency-inverse document frequency vector in the learning model and the second term frequency-inverse document frequency vector, and transmitting, to a terminal of an operation manager of the device, recommendation information regarding the calculated second abnormality occurrence period when the first degree of similarity is equal to or less than a predetermined value; acquiring, for the performance information and the event logs of the device, predicted data of performance information using the performance information as learning data, extracting an abnormality occurrence period of the predicted data to set the abnormality occurrence period of the predicted data as a third abnormality occurrence period, and storing the third abnormality occurrence period and event logs corresponding to the third abnormality occurrence period; and calculating, when there is a predetermined difference in comparison of the second abnormality occurrence period and the third abnormality occurrence period, a third term frequency-inverse document frequency vector according to the event logs corresponding to the third abnormality occurrence period, calculating a second degree of similarity between the second term frequency-inverse document frequency vector and the third term frequency-inverse document frequency vector, and transmitting, to the terminal of the operation manager of the device, recommendation information regarding the second abnormality occurrence period when the second degree of similarity is equal to or greater than a predetermined value.