{"created":"2025-05-14T01:00:42.813297+00:00","updated":"2025-06-03T07:02:13.333748+00:00","metadata":{"_oai":{"id":"oai:ipsj.ixsq.nii.ac.jp:02002154","sets":["1164:4088:11911:1747183907775"]},"path":["1747183907775"],"owner":"80578","recid":"2002154","title":["アラートスコアリングによるITシステム障害の被疑箇所分析－ストレージI/O通信経路を用いたネットワーク障害分析機能の強化－"],"pubdate":{"attribute_name":"PubDate","attribute_value":"2025-05-22"},"_buckets":{"deposit":"892498a9-dced-4c63-a202-7d7a9f9192d1"},"_deposit":{"id":"2002154","pid":{"type":"depid","value":"2002154","revision_id":0},"owners":[80578],"status":"published","created_by":80578},"item_title":"アラートスコアリングによるITシステム障害の被疑箇所分析－ストレージI/O通信経路を用いたネットワーク障害分析機能の強化－","author_link":[],"item_titles":{"attribute_name":"タイトル","attribute_value_mlt":[{"subitem_title":"アラートスコアリングによるITシステム障害の被疑箇所分析－ストレージI/O通信経路を用いたネットワーク障害分析機能の強化－","subitem_title_language":"ja"},{"subitem_title":"IT System Failure Point Localization Technique Based on Alert Scoring －Enhanced Network Failure Analysis using Storage I/O Path－","subitem_title_language":"en"}]},"item_keyword":{"attribute_name":"キーワード","attribute_value_mlt":[{"subitem_subject":"ICM","subitem_subject_scheme":"Other"}]},"item_type_id":"4","publish_date":"2025-05-22","item_4_text_3":{"attribute_name":"著者所属","attribute_value_mlt":[{"subitem_text_value":"エフサステクノロジーズ株式会社"},{"subitem_text_value":"エフサステクノロジーズ株式会社"},{"subitem_text_value":"エフサステクノロジーズ株式会社"},{"subitem_text_value":"エフサステクノロジーズ株式会社"},{"subitem_text_value":"富士通株式会社"}]},"item_4_text_4":{"attribute_name":"著者所属(英)","attribute_value_mlt":[{"subitem_text_value":"FSAS TECHNOLOGIES INC.","subitem_text_language":"en"},{"subitem_text_value":"FSAS TECHNOLOGIES INC.","subitem_text_language":"en"},{"subitem_text_value":"FSAS TECHNOLOGIES INC.","subitem_text_language":"en"},{"subitem_text_value":"FSAS TECHNOLOGIES INC.","subitem_text_language":"en"},{"subitem_text_value":"FUJITSU LIMITED","subitem_text_language":"en"}]},"item_language":{"attribute_name":"言語","attribute_value_mlt":[{"subitem_language":"jpn"}]},"item_publisher":{"attribute_name":"出版者","attribute_value_mlt":[{"subitem_publisher":"情報処理学会","subitem_publisher_language":"ja"}]},"publish_status":"0","weko_shared_id":-1,"item_file_price":{"attribute_name":"Billing file","attribute_type":"file","attribute_value_mlt":[{"url":{"url":"https://ipsj.ixsq.nii.ac.jp/record/2002154/files/IPSJ-IOT25069006.pdf","label":"IPSJ-IOT25069006.pdf"},"date":[{"dateType":"Available","dateValue":"2999-12-31"}],"format":"application/pdf","billing":["billing_file"],"filename":"IPSJ-IOT25069006.pdf","filesize":[{"value":"1.8 MB"}],"mimetype":"application/pdf","priceinfo":[{"tax":["include_tax"],"price":"0","billingrole":"43"},{"tax":["include_tax"],"price":"0","billingrole":"44"}],"accessrole":"open_date","version_id":"7e111701-4043-4c9a-b001-20cc379e23c3","displaytype":"detail","licensetype":"license_note","license_note":"Copyright (c) 2025 by the Institute of Electronics, Information and Communication Engineers This SIG report is only available to those in membership of the SIG."}]},"item_4_creator_5":{"attribute_name":"著者名","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"近藤,玲子"}]},{"creatorNames":[{"creatorName":"荻原,一隆"}]},{"creatorNames":[{"creatorName":"児玉,武司"}]},{"creatorNames":[{"creatorName":"上野,仁"}]},{"creatorNames":[{"creatorName":"白石,崇"}]}]},"item_4_creator_6":{"attribute_name":"著者名(英)","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"Reiko Kondo","creatorNameLang":"en"}]},{"creatorNames":[{"creatorName":"Kazutaka Ogihara","creatorNameLang":"en"}]},{"creatorNames":[{"creatorName":"Takeshi Kodama","creatorNameLang":"en"}]},{"creatorNames":[{"creatorName":"Hitoshi Ueno","creatorNameLang":"en"}]},{"creatorNames":[{"creatorName":"Takashi Shiraishi","creatorNameLang":"en"}]}]},"item_4_source_id_9":{"attribute_name":"書誌レコードID","attribute_value_mlt":[{"subitem_source_identifier":"AA12326962","subitem_source_identifier_type":"NCID"}]},"item_4_textarea_12":{"attribute_name":"Notice","attribute_value_mlt":[{"subitem_textarea_value":"SIG Technical Reports are nonrefereed and hence may later appear in any journals, conferences, symposia, etc."}]},"item_resource_type":{"attribute_name":"資源タイプ","attribute_value_mlt":[{"resourceuri":"http://purl.org/coar/resource_type/c_18gh","resourcetype":"technical report"}]},"item_4_source_id_11":{"attribute_name":"ISSN","attribute_value_mlt":[{"subitem_source_identifier":"2188-8787","subitem_source_identifier_type":"ISSN"}]},"item_4_description_7":{"attribute_name":"論文抄録","attribute_value_mlt":[{"subitem_description":"仮想化によりシステムが複雑化したことで，一度障害が発生すると仮想や物理の各機器間の依存関係から複数の機器にアラートが伝搬し，多数の機器で様々な種類のアラートが同時に発生することがある．このように多数のアラートが発生すると，そのアラートから障害の根本となった被疑箇所を推定することは難しく，障害対応が長時間化する傾向にある．これに対し我々は障害によって依存関係にある機器が影響を受けてアラートが伝搬することを利用し，アラートをスコアリングすることで被疑箇所を推定する技術を提案してきた．また前回の報告ではアラート情報としてアノマリ検知結果を用いて実験検証を行い，アノマリを検知した段階で障害の被疑箇所が推定できる可能性について評価した．本論文では，前回まで対象としていなかったネットワーク（NW）障害に着目し，CPUやメモリ，ストレージに加え，NWのアラートも統合した障害の被疑箇所推定技術を提案する．NW障害の推定ではVM間通信のようなワークロード通信経路の特定が困難な場合でも，ストレージI/Oの通信経路を用いることでNW障害の被疑箇所を推定する手法を提案し，実験を通してその有効性を検証した．本提案技術によって，運用者は多数のコンポーネントから複数種類のアラートが上がっても，機器やアラートの種類を区別することなく推定された最も可能性の高い障害箇所から優先順位に従って対処すればよいため，障害復旧時間の短縮を見込める．","subitem_description_type":"Other"}]},"item_4_description_8":{"attribute_name":"論文抄録(英)","attribute_value_mlt":[{"subitem_description":"As the system becomes complicated by virtualization, once a failure occurs, an alert propagates to multiple devices from the dependency between virtual and physical devices, and various kinds of alerts may occur simultaneously in many devices. When such a large number of alerts are generated, it is difficult to estimate the root failure location from the alerts, and the response time tends to be longer. On the other hand, we have proposed a technique to estimate the failure location by scoring the alert, using the fact that the failure affects dependent devices and propagates the alert. In the previous report, experimental verification was carried out using the result of the anomaly detection as the alert information, and the possibility of estimating the fault location at the stage of the anomaly detection was evaluated. In this paper, we focus on network (NW) failures, which were not targeted until the previous paper, and propose a failure location estimation technique that integrates not only CPU, memory, and storage but also NW alerts. In particular, when it is difficult to identify a workload communication path such as inter-VM communication, we proposed a method to estimate a failure location by using a communication path of storage I/O and verified its effectiveness through experiments. With the proposed technology, even when multiple kinds of alerts are issued from a large number of components, the operator can expect to reduce the time required to recover from a failure because the operator can take action in order of priority from the most probable failure location, without distinguishing between devices and types of alerts.","subitem_description_type":"Other"}]},"item_4_biblio_info_10":{"attribute_name":"書誌情報","attribute_value_mlt":[{"bibliographicPageEnd":"6","bibliographic_titles":[{"bibliographic_title":"研究報告インターネットと運用技術（IOT）"}],"bibliographicPageStart":"1","bibliographicIssueDates":{"bibliographicIssueDate":"2025-05-22","bibliographicIssueDateType":"Issued"},"bibliographicIssueNumber":"6","bibliographicVolumeNumber":"2025-IOT-69"}]},"relation_version_is_last":true,"weko_creator_id":"80578"},"id":2002154,"links":{}}