WO2025088768A1 - Anomaly detection device, anomaly detection method, and program - Google Patents

Abstract

An anomaly detection device 100 according to the present disclosure comprises: an acquisition unit 121 that acquires path group information representing a group which has been set such that a plurality of communication paths on an optical communication network belong thereto; a collection unit 122 that collects property data which represents communication properties in the communication paths; and a detection unit 123 that detects an anomaly in the group on the basis of the property data in the communication paths which belong to the group.

Description

Anomaly detection device, anomaly detection method, and program

This disclosure relates to an anomaly detection device, an anomaly detection method, and a program.

In optical communication networks such as WDM-NW (Wavelength Division Multiplexing-Network), it is known to measure indicators that indicate communication quality, such as optical intensity, and to detect abnormalities in communication paths based on such indicators. For example, in Patent Document 1, the transmission characteristics and signal quality are measured for each path in an optical transmission system, and faults are detected from fluctuations in signal quality.

JP 2018-7058 A

However, the technology described in Patent Document 1 measures the signal quality for each path to detect anomalies, which creates a problem in that the processing costs associated with the monitoring process for detecting anomalies are high.

The objective of this disclosure is to provide an anomaly detection device that can solve the above-mentioned problem of the high processing costs involved in detecting anomalies in communication paths in optical communication networks.

An anomaly detection device according to an embodiment of the present disclosure includes:
an acquisition unit that acquires path group information representing a group to which a plurality of communication paths on an optical communication network belong;
a collection unit that collects characteristic data representing communication characteristics in the communication path;
a detection unit that detects an abnormality in the group based on the characteristic data of the communication paths that belong to the group;
Equipped with
The structure is as follows.
In addition, an anomaly detection method according to an embodiment of the present disclosure includes:
Obtaining path group information representing a group to which a plurality of communication paths on an optical communication network belong;
Collecting characteristic data representative of communication characteristics in the communication path;
Detecting an abnormality in the group based on the characteristic data of the communication paths belonging to the group;
The structure is as follows.
In addition, a program according to an embodiment of the present disclosure includes:
Obtaining path group information representing a group to which a plurality of communication paths on an optical communication network belong;
Collecting characteristic data representative of communication characteristics in the communication path;
Detecting an abnormality in the group based on the characteristic data of the communication paths belonging to the group;
Have a computer carry out the process,
The structure is as follows.

By being configured as described above, this disclosure can reduce the processing costs of detecting anomalies in communication paths in optical communication networks.

1 is a diagram showing an overall configuration of an optical communication system according to the present disclosure. FIG. 1 is a diagram illustrating an example of a configuration of an optical communication network according to the present disclosure. 1 is a block diagram showing a configuration of an anomaly detection device according to the present disclosure. FIG. 2 is a diagram illustrating an example of information used in the anomaly detection device according to the present disclosure. FIG. 2 is a diagram illustrating an example of information used in the anomaly detection device according to the present disclosure. FIG. 2 is a diagram illustrating an example of information used in the anomaly detection device according to the present disclosure. FIG. 2 is a diagram illustrating an example of information used in the anomaly detection device according to the present disclosure. 4 is a flowchart showing a processing operation of the anomaly detection device according to the present disclosure. 1 is a block diagram showing a configuration of an anomaly detection device according to the present disclosure. 1 is a block diagram showing a hardware configuration of an anomaly detection device according to the present disclosure. 1 is a block diagram showing a configuration of an anomaly detection device according to the present disclosure.

First Embodiment
A first embodiment of the present disclosure will be described with reference to the drawings. Note that the drawings may be relevant to any embodiment.

[composition]
As shown in FIG. 1, the optical communication system of the present disclosure is configured by connecting an abnormality detection device 10 to an optical communication network N. Here, the optical communication network N is a network that performs optical communication such as WDM-NW (Wavelength Division Multiplexing-Network). In the optical communication network N, a plurality of nodes that are communication devices are installed, and each node is equipped with optical communication equipment D such as a transponder, an amplifier, and a switch. In addition, in the optical communication network N, a plurality of communication paths P that pass through the optical communication equipment D are set as shown by arrows in FIG. 1. Note that, on the communication path P, it is possible to communicate with each other while overlapping communications using a plurality of channels, that is, a case may occur where the paths of the plurality of communication paths P overlap each other.

Specifically, as shown in FIG. 2, the communication path P can be defined by a combination of optical communication devices D, such as transponders (TPND), amplifiers (CA), switches (XF), and amplifiers and switches (WA) mounted on nodes (1, 2, 3), and optical fiber cables. The optical fiber cables can be identified by specifying the output ports and input ports of each optical communication device D. Therefore, the route information of the communication path P can be expressed as a combination of optical communication devices D and ports. If the optical communication devices D in the route of the communication path P overlap and at least some of the ports of the overlapping optical communication devices D overlap, it can be determined that the communication path P overlaps. Note that the information representing the route configuration of the communication path P is stored in advance in the anomaly detection device 10, as described later.

Also, various sensors (not shown) are installed in the optical communication network N. For example, various sensors are installed in each optical communication device D and optical fiber cable of each node, and measure sensor data (characteristic data) representing communication characteristics in the communication path P passing through the optical communication device D and optical fiber cable. Here, the sensor data measured as the communication characteristics in the communication path P is data representing the quality of optical communication, such as the optical intensity of the optical signal and the S/N (signal/noise) ratio, or data representing the state of the optical communication device D, such as the load and temperature. Then, as described later, these sensor data are collected by the anomaly detection device 10. Note that the sensor data collected by the anomaly detection device 10 may be data representing any communication characteristics that can be measured from the optical signal and the optical communication device D in the communication path P on the optical communication network N, or may be data calculated from data measured by the sensor.

The anomaly detection device 10 is composed of one or more information processing devices each having a calculation device and a storage device. As shown in FIG. 3, the anomaly detection device 10 is composed of a data collection unit 11, a path group input unit 12, a group anomaly determination unit 13, a path anomaly determination unit 14, and an output unit 15. The functions of the data collection unit 11, the path group input unit 12, the group anomaly determination unit 13, the path anomaly determination unit 14, and the output unit 15 can be realized by the calculation device executing a program for realizing each function stored in the storage device. The anomaly detection device 10 is also composed of a data storage unit 16 and a path group storage unit 17. The data storage unit 16 and the path group storage unit 17 are composed of storage devices. Each component will be described in detail below.

The data storage unit 16 stores information about the optical communication network N. Specifically, the data storage unit 16 first stores communication path information that indicates the configuration of the route of a communication path P set in the optical communication network N. As an example, as shown in FIG. 4, the communication path information associates a path ID (identifier) with path configuration information. Here, the path ID indicates the identification information of the communication path, and the path configuration information indicates the combination of a pair of optical communication equipment D and a port that exists on the route of the communication path P, such as "(transponder 1, output port 1), (amplifier 1, input port 1, output port 1), ...." In other words, the path configuration information can be said to include the optical communication equipment D located on the route of the communication path P and the optical fiber cable identified by the port of the optical communication equipment D.

The data storage unit 16 also stores a sensor-path correspondence table representing the correspondence between sensors and communication paths P as information related to the optical communication network N. As an example, the sensor-path correspondence table associates sensor IDs with path IDs, as shown in FIG. 5. Here, the sensor ID represents identification information for identifying the above-mentioned sensor, and the path ID represents identification information for identifying the communication path P. As a result, sensor data measured by a sensor is treated as sensor data in the communication path P associated with that sensor.

The data storage unit 16 also stores a sensor time series, which is sensor data measured by the sensors, as information related to the optical communication network N. As an example, as shown in FIG. 6, the sensor time series stores measurement values measured by each sensor at each time (T ₀ , T ₁ , ...). Note that the measurement times are, for example, at regular time intervals, but may be any timing. The recorded sensor data may be values calculated from values measured by the sensors.

Here, the sensor time series data is collected and stored by the data collection unit 11, as described below. The sensor time series data stored includes data collected as learning data when the optical communication network N was in a normal state, and data collected as monitoring data for detecting abnormalities in the optical communication network N.

The data collection unit 11 (collection unit) collects sensor data measured by each sensor in the optical communication network N and stores it in the data storage unit 16 as the sensor time series shown in FIG. 6 described above. The data collection unit 11 may issue a measurement command to each sensor at each time preset as the measurement timing and collect the sensor data measured by each sensor in response to such command, or may collect the sensor data measured by each sensor at each time together with the measurement time.

The data collection unit 11 collects sensor data when the optical communication network N is in a normal state, and stores the collected sensor data, that is, the sensor time series, as learning data. The data collection unit 11 also collects sensor data during monitoring to monitor whether any abnormalities have occurred in the optical communication network N, and stores the collected sensor data, that is, the sensor time series, as monitoring data.

The path group input unit 12 (acquisition unit) accepts input of path group information that groups together multiple communication paths P set in the optical communication network N, and stores it in the path group storage unit 17. As shown in FIG. 7 as an example, the path group information associates a group ID with a path ID. Here, the group ID represents identification information of the group, and the path ID represents identification information of the communication path P. The example of FIG. 7 indicates that multiple communication paths P "Path_1, Path_3, ..." belong to the group ID "Group1". In this case, the path group information may include only one group, and all paths on the optical communication network N belong to one group. The path group information may also include multiple groups, and in this case, one or more communication paths P belong to each group, and the communication path P may belong to multiple groups.

The path group information in this embodiment is set by an administrator who manages the optical communication network N, software that generates groups, or the like, and is input to the path group input unit 12. At this time, each group in the path group information is set based on the characteristics of each communication path P. Specifically, as one example, multiple communication paths P that have a common route are grouped together and set. At this time, a common route means that part of the route of each communication path P is common, and examples of the case include the case where the same optical communication device D such as a transponder or its port, or the optical fiber cable is located on the route. As another example, multiple communication paths P that have common communication characteristics on the route of the communication path P are grouped together and set. At this time, examples of the case where communication characteristics are common include the case where sensor data collected in each communication path P is determined to be the same or similar according to a preset criterion, or is determined to have a correlation.

The group abnormality determination unit 13 (detection unit) detects abnormalities in a group based on the sensor data in the communication paths P that belong to the group. Specifically, the group abnormality determination unit 13 first identifies the communication paths P that belong to each group based on the path group information, and extracts sensor data in all communication paths P that belong to each group based on the sensor-path correspondence table and the sensor time series. For example, in the case of the path group information shown in FIG. 7, it first identifies that the communication paths P "Path_1, Path_3, ..." belong to the group "Group1", identifies the sensors corresponding to these communication paths P from the sensor-path correspondence table shown in FIG. 5, and further extracts the sensor data measured by the identified sensors from the sensor time series shown in FIG. 6. At this time, the group abnormality determination unit 13 extracts sensor data from the sensor time series stored as monitoring data as described above. In this way, in the example of FIG. 7, the sensor data of the group "Group1" and the sensor data of the group "Group2" are extracted.

Then, the group anomaly determination unit 13 inputs the sensor data extracted as described above for the corresponding group into a group anomaly detection model prepared in advance for each group, and detects whether the group is abnormal or not according to the output from the group anomaly detection model. At this time, the group anomaly detection model is generated by machine learning using the sensor time series for each group collected as learning data as described above. In other words, the group anomaly detection model is trained to output a normality score and a feature value according to the correlation of the values of each sensor data in the group under normal conditions by machine learning the sensor data for each group when the optical communication network N is normal as learning data. Therefore, by inputting the sensor data of the corresponding group into the group anomaly detection model, the normality score and the feature value of the group are output, and an abnormality of the group can be detected according to these values. For example, if correlation destruction occurs between each sensor data of the input groups, the normality score is output lower than the threshold value, or a feature value different from that in the normal case is output. In this case, the group anomaly determination unit 13 detects that the group is abnormal.

More specifically, in the example of FIG. 7, the group anomaly determination unit 13 prestores a group anomaly detection model corresponding to the group "Group1", a group detection model corresponding to the group "Group2", and the like. At this time, the group anomaly detection model corresponding to the group "Group1" is generated by machine learning using learning data, which is sensor data collected in the communication path P belonging to the group "Group1", when the optical communication network N is normal. Then, during monitoring, the group anomaly determination unit 13 inputs the monitoring data, which is sensor data collected in the communication path P belonging to the group "Group1", to the group anomaly detection model corresponding to the group "Group1", thereby obtaining an output such as a normality score during monitoring of the group "Group1", and determining whether or not the group "Group1" is abnormal.

However, the group anomaly determination unit 13 is not necessarily limited to detecting anomalies in the group using the above-mentioned method, and may detect anomalies in any other manner using the sensor data of the group. For example, the group anomaly determination unit 13 may detect anomalies in the group based on statistical values of the sensor data of the group. As one example, the group anomaly determination unit 13 may detect anomalies in the group by calculating statistical values such as the average, variance, and mode of the sensor data of the group, and comparing them with a preset threshold value or statistical values under normal conditions.

The path abnormality determination unit 14 (detection unit) detects an abnormality in a notification path P based on the sensor data in each communication path P from among the communication paths P belonging to the group detected as abnormal as described above. Specifically, the path abnormality determination unit 14 first identifies all communication paths P belonging to the group detected as abnormal based on the path group information, and extracts sensor data in the communication path P for each communication path P based on the sensor-path correspondence table and the sensor time series. For example, when the group "Group1" in the path group information shown in FIG. 7 is detected as abnormal, the sensor corresponding to each of the communication paths P "Path_1", "Path_3", "..." belonging to the group is identified from the sensor-path correspondence table shown in FIG. 5, and further, the sensor data measured by the identified sensor is extracted from the sensor time series shown in FIG. 6. At this time, the path abnormality determination unit 14 extracts sensor data from the sensor time series stored as monitoring data as described above.

The path abnormality determination unit 14 inputs the sensor data extracted as described above for the corresponding communication path P to a path abnormality detection model prepared in advance for each communication path P, and detects whether the communication path P is abnormal or not according to the output from the path abnormality detection model. At this time, the path abnormality detection model is generated by machine learning using the sensor time series for each communication path P collected as learning data as described above. In other words, the path abnormality detection model is trained to output a normality score and a feature value according to the correlation of the values of each sensor data in the communication path P in the normal state by machine learning the sensor data for each communication path P when the optical communication network N is normal as learning data. Therefore, by inputting the sensor data of the corresponding communication path P to the path abnormality detection model, the normality score and the feature value of the communication path P are output, and an abnormality in the communication path P can be detected according to these values. For example, when correlation destruction occurs between each sensor data of the input communication path P, the normality score is output lower than the threshold value, or a feature value different from that in the normal state is output. In this case, the path abnormality determination unit 14 detects that the communication path P is abnormal.

However, the path abnormality determination unit 14 is not necessarily limited to detecting an abnormality in the communication path P using the above-mentioned method, and may detect an abnormality in any other manner using the sensor data of the communication path P. For example, the path abnormality determination unit 14 may detect an abnormality in the communication path P based on statistical values of the sensor data of the communication path P. As one example, the path abnormality determination unit 14 may detect an abnormality in the communication path P by calculating statistical values such as the average, variance, and mode of the sensor data of the communication path P and comparing them with a preset threshold value or statistical values under normal conditions.

The output unit 15 outputs information identifying the communication path P detected as abnormal. For example, the output unit 15 may notify a preregistered information processing device of the administrator of the optical communication network N of the path ID of the communication path P detected as abnormal. The output unit 15 may further identify the cause of the abnormality among the optical communication devices D and optical fiber cables that constitute the communication path P detected as abnormal, and output the cause of the abnormality. For example, the output unit 15 may check the sensor data of the communication path P detected as abnormal, identify the optical communication devices D and optical fiber cables that have measured sensor data with a value that is determined to be abnormal based on a preset criterion as the cause of the abnormality, and notify the administrator's information processing device of the information on the cause of the abnormality. However, the output unit 15 may identify the cause of the abnormality using any existing method.

[Action]
Next, the operation of the above-mentioned anomaly detection device 10 will be described. The anomaly detection device 10 stores information about the optical communication network N, that is, communication path information as shown in Fig. 4 and a sensor-path correspondence table as shown in Fig. 5. The anomaly detection device 10 also stores a group anomaly detection model used to detect an anomaly in a group and a path anomaly detection model used to detect an anomaly in a communication path, which are generated by machine learning using sensor data measured from the optical communication network N under normal conditions as described above.

In the above situation, the anomaly detection device 10 acquires and stores path group information in which multiple communication paths P are grouped together, as shown in FIG. 7 (step S1 in FIG. 8). At this time, the groups included in the path group information are grouped and set based on the characteristics of the communication paths P. For example, multiple communication paths P that share a common route are grouped and set together in the same group, or multiple communication paths P that share common communication characteristics in the route of the communication paths P are grouped and set together in the same group.

Next, when monitoring the optical communication network N for abnormalities, the anomaly detection device 10 collects sensor data measured by each sensor in the optical communication network N and stores the sensor data for monitoring purposes as the sensor time series shown in FIG. 6 described above (step S2 in FIG. 8). Note that the collection of sensor data for monitoring purposes may be performed before the acquisition of the path group information described above.

Then, the anomaly detection device 10 detects an anomaly for each group based on the sensor data in the communication paths P that belong to that group (step S3 in FIG. 8). Specifically, the anomaly detection device 10 performs the following process for each group to detect an anomaly. First, the anomaly detection device 10 identifies the communication paths P that belong to the group based on the path group information, and extracts sensor data in all communication paths P that belong to the group based on the sensor-path correspondence table and the sensor time series. The anomaly detection device 10 then inputs the sensor data extracted for the group as described above into a group anomaly detection model that has been prepared in advance for the corresponding group, and detects whether the group is abnormal based on the output from the group anomaly detection model.

Then, the anomaly detection device 10 detects an anomaly in a notification path P based on the sensor data in each communication path P from among the communication paths P belonging to the group detected as an anomaly (step S4 in FIG. 8). Specifically, the anomaly detection device 10 identifies all communication paths P belonging to the group detected as an anomaly based on the path group information, and extracts sensor data in the communication path P for each communication path P based on the sensor-path correspondence table and the sensor time series. Then, the anomaly detection device 10 inputs the extracted sensor data for the corresponding communication path P into a path anomaly detection model prepared in advance for each communication path P, and detects whether or not the communication path P is abnormal based on the output from the path anomaly detection model.

Then, the anomaly detection device 10 may output information about the communication path P that was detected as being abnormal, and may further identify and output the location of the cause of the anomaly in the communication path P that was detected as being abnormal.

As described above, in this disclosure, anomaly detection is first performed on a group basis that groups together multiple communication paths P, and then anomaly detection is performed on the communication paths P in the group in which an anomaly has been detected. This eliminates the need to perform monitoring processing to detect anomalies for each of the communication paths P, thereby reducing the processing costs involved in the anomaly detection processing.

Here, an abnormality detected in the optical communication network N may be an abnormality or failure in the optical communication device D or the optical fiber cable. For this reason, as disclosed herein, by grouping together multiple communication paths P that include the same optical communication device D or optical fiber cable in their route or have the same communication characteristics, it is possible to efficiently detect abnormalities that may occur due to the above-mentioned circumstances.

Second Embodiment
Next, a second embodiment of the present disclosure will be described with reference to the drawings.

The anomaly detection device 10 in this embodiment has a configuration similar to that of the anomaly detection device 10 in the above-described first embodiment, and in addition, the configuration differs from that of the first embodiment in the following respects. Specifically, as shown in FIG. 9, the anomaly detection device 10 in this embodiment includes a path group determination unit 12' instead of the path group input unit 12 disclosed in FIG. 3. Note that each function of the path group determination unit 12' can be realized by a calculation unit included in the anomaly detection device 10 executing a program for realizing each function stored in a storage device.

The path group determination unit 12' (acquisition unit) has a function of generating path group information as shown in FIG. 7 based on information representing the characteristics of the communication path P. Specifically, the path group determination unit 12' generates a group by grouping multiple communication paths P having common characteristics into the same group based on communication path information representing the configuration of the route of the communication path P as shown in FIG. 4, and sensor data representing the communication characteristics in the route of the communication path P that can be acquired from the sensor-path correspondence table shown in FIG. 5 and the sensor time series shown in FIG. 6. Specifically, as one example, the path group determination unit 12' generates a group by grouping multiple communication paths P having a common route of the communication path P into the same group. At this time, a common route refers to a case where a part of the route of each communication path P is common, and examples of the case include a case where the same optical communication device D such as a transponder, its port, or an optical fiber cable is located on the route. As another example, the path group determination unit 12' generates a group by grouping multiple communication paths P having common communication characteristics in the route of the communication path P into the same group. In this case, the communication characteristics being common may mean that the sensor data collected on each communication path P is determined to be identical or similar based on preset criteria, or that it is determined to have a correlation.

Note that the path group determination unit 12' is not limited to generating groups based on the route configuration and communication characteristics of the communication path P, and may generate groups based on other characteristics of the communication path P.

Then, the path group path information consisting of the groups generated by the path group determination unit 12' is stored in the path group storage unit 17 as in the first embodiment. The anomaly detection device 10 uses the path group information generated and stored by the path group determination unit 12' to perform anomaly detection for the groups as described above, and can detect anomalies in the communication path P.

Third Embodiment
Next, a third embodiment of the present disclosure will be described with reference to the drawings. In this embodiment, an outline of the configuration of the anomaly detection device described in the above embodiment is shown. Note that Figs. 10 and 11 are diagrams for explaining the configuration, and these diagrams may be related to any of the embodiments.

First, the hardware configuration of the anomaly detection device 100 will be described with reference to Fig. 10. The anomaly detection device 100 is configured as a general information processing device, and is equipped with the following hardware configuration, as an example.
・CPU (Central Processing Unit) 101 (arithmetic unit)
ROM (Read Only Memory) 102 (storage device)
RAM (Random Access Memory) 103 (storage device)
Program group 104 loaded into RAM 103
A storage device 105 for storing the program group 104
A drive device 106 that reads and writes data from and to a storage medium 110 outside the information processing device.
A communication interface 107 that connects to a communication network 111 outside the information processing device
Input/output interface 108 for inputting and outputting data
A bus 109 that connects each component

Note that FIG. 10 shows an example of the hardware configuration of an information processing device that is the anomaly detection device 100, and the hardware configuration of the information processing device is not limited to the above-mentioned case. For example, the information processing device may be configured with a part of the above-mentioned configuration, such as not having the drive device 106. Furthermore, instead of the above-mentioned CPU, the information processing device may use a GPU (Graphic Processing Unit), a DSP (Digital Signal Processor), an MPU (Micro Processing Unit), an FPU (Floating point number Processing Unit), a PPU (Physics Processing Unit), a TPU (Tensor Processing Unit), a quantum processor, a microcontroller, or a combination of these.

The abnormality detection device 100 can be equipped with the acquisition unit 121, collection unit 122, and detection unit 123 shown in FIG. 11 by having the CPU 101 acquire and execute the program group 104. The program group 104 is stored in advance in the storage device 105 or ROM 102, for example, and is loaded into the RAM 103 and executed by the CPU 101 as necessary. The program group 104 may be supplied to the CPU 101 via the communication network 111, or may be stored in advance in the storage medium 110, and the drive device 106 may read out the programs and supply them to the CPU 101. However, the acquisition unit 121, collection unit 122, and detection unit 123 described above may be constructed with dedicated electronic circuits for realizing such means.

The acquisition unit 121 acquires path group information representing a group to which multiple communication paths on an optical communication network are set to belong. The collection unit 122 collects characteristic data representing communication characteristics of the communication paths. The detection unit 123 detects an abnormality in the group based on the characteristic data of the communication paths belonging to the group.

By configuring the present disclosure as described above, anomaly detection is performed on a group basis, which is a group of multiple communication paths. Therefore, after an anomaly is detected in a group, anomaly detection can be performed on each individual communication path in the group, thereby detecting anomalies in the communication paths. This eliminates the need to perform monitoring processing to detect anomalies in each of the communication paths, thereby reducing the processing costs involved in anomaly detection processing.

In addition, at least one or more of the functions of the acquisition unit 121, collection unit 122, and detection unit 123 described above may be executed by an information processing device installed and connected anywhere on the network, that is, they may be executed by so-called cloud computing.

The above-mentioned program may also be stored and supplied to a computer using various types of non-transitory computer readable medium. Non-transitory computer readable medium includes various types of tangible storage medium. Examples of non-transitory computer readable medium include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROM (Read Only Memory), CD-R, CD-R/W, and semiconductor memory (e.g., mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)). The program may also be supplied to a computer by various types of transitory computer readable medium. Examples of transitory computer readable medium include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can provide the program to the computer via a wired communication path, such as an electric wire or optical fiber, or via a wireless communication path.

The present disclosure has been described above with reference to the above-mentioned embodiments, but the present disclosure is not limited to the above-mentioned embodiments. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each of the above-mentioned embodiments can be combined with other embodiments as appropriate.

<Additional Notes>
A part or all of the above-described embodiments may be described as follows: Below, an overview of the configurations of an anomaly detection device, an anomaly detection method, and a program according to the present disclosure will be described. However, the present disclosure is not limited to the following configurations.
(Appendix 1)
an acquisition unit that acquires path group information representing a group to which a plurality of communication paths on an optical communication network belong;
a collection unit that collects characteristic data representing communication characteristics in the communication path;
a detection unit that detects an abnormality in the group based on the characteristic data of the communication paths that belong to the group;
An anomaly detection device equipped with the above.
(Appendix 2)
2. The anomaly detection device according to claim 1,
the detection unit detects an abnormality in the communication path based on the collected characteristic data in the communication path belonging to the group detected as having an abnormality;
Anomaly detection device.
(Appendix 3)
2. The anomaly detection device according to claim 1,
The group is set so that a plurality of the communication paths that have a part of a route in common in the communication paths belong to the group.
Anomaly detection device.
(Appendix 4)
2. The anomaly detection device according to claim 1,
The group is set so that a plurality of communication paths having a common communication characteristic in the communication paths belong to the group.
Anomaly detection device.
(Appendix 5)
2. The anomaly detection device according to claim 1,
the acquiring unit acquires the path group information by generating the group to which the plurality of communication paths belong based on information indicating characteristics of the communication paths.
Anomaly detection device.
(Appendix 6)
6. The anomaly detection device according to claim 5,
the acquiring unit acquires the path group information by generating the group to which the plurality of communication paths belong based on a commonality of routes of the communication paths.
Anomaly detection device.
(Appendix 7)
6. The anomaly detection device according to claim 5,
the acquiring unit acquires the path group information by generating the group to which the plurality of communication paths belong based on a commonality of communication characteristics of the communication paths.
Anomaly detection device.
(Appendix 8)
2. The anomaly detection device according to claim 1,
the detection unit detects, for each group, an abnormality in the group based on the characteristic data collected as monitoring data in the communication paths belonging to the group, using a model generated by machine learning the characteristic data collected as learning data in the communication paths belonging to the group.
Anomaly detection device.
(Appendix 9)
Obtaining path group information representing a group to which a plurality of communication paths on an optical communication network are set to belong;
Collecting characteristic data representative of communication characteristics in the communication path;
Detecting an abnormality in the group based on the characteristic data of the communication paths belonging to the group;
Anomaly detection methods.
(Appendix 10)
10. The anomaly detection method according to claim 9,
Detecting an abnormality in the communication path based on the collected characteristic data of the communication path belonging to the group detected as having an abnormality;
Anomaly detection methods.
(Appendix 11)
10. The anomaly detection method according to claim 9,
generating the group to which the plurality of communication paths belong based on information representing characteristics of the communication paths, and acquiring the path group information;
Anomaly detection methods.
(Appendix 12)
Obtaining path group information representing a group to which a plurality of communication paths on an optical communication network are set to belong;
Collecting characteristic data representative of communication characteristics in the communication path;
Detecting an abnormality in the group based on the characteristic data of the communication paths belonging to the group;
A computer-readable storage medium that stores a program for causing a computer to execute a process.

10 Abnormality detection device 11 Data collection unit 12 Path group input unit 12' Path group determination unit 13 Group abnormality determination unit 14 Path abnormality determination unit 15 Output unit 16 Data storage unit 17 Path group storage unit 100 Abnormality detection device 101 CPU
102 ROM
103 RAM
104 Program group 105 Storage device 106 Drive device 107 Communication interface 108 Input/output interface 109 Bus 110 Storage medium 111 Communication network 121 Acquisition unit 122 Collection unit 123 Detection unit

Claims (12)

an acquisition unit that acquires path group information representing a group to which a plurality of communication paths on an optical communication network belong;
a collection unit that collects characteristic data representing communication characteristics in the communication path;
a detection unit that detects an abnormality in the group based on the characteristic data of the communication paths that belong to the group;
An anomaly detection device equipped with the above. The anomaly detection device according to claim 1 ,
the detection unit detects an abnormality in the communication path based on the collected characteristic data in the communication path belonging to the group detected as having an abnormality;
Anomaly detection device. The anomaly detection device according to claim 1 ,
The group is set so that a plurality of the communication paths that have a part of a route in common in the communication paths belong to the group.
Anomaly detection device. The anomaly detection device according to claim 1 ,
The group is set so that a plurality of communication paths having a common communication characteristic in the communication paths belong to the group.
Anomaly detection device. The anomaly detection device according to claim 1 ,
the acquiring unit acquires the path group information by generating the group to which the plurality of communication paths belong based on information indicating characteristics of the communication paths.
Anomaly detection device. The anomaly detection device according to claim 5,
the acquiring unit acquires the path group information by generating the group to which the plurality of communication paths belong based on a commonality of routes of the communication paths.
Anomaly detection device. The anomaly detection device according to claim 5,
the acquiring unit acquires the path group information by generating the group to which the plurality of communication paths belong based on a commonality of communication characteristics of the communication paths.
Anomaly detection device. The anomaly detection device according to claim 1 ,
the detection unit detects, for each group, an abnormality in the group based on the characteristic data collected as monitoring data in the communication paths belonging to the group, using a model generated by machine learning the characteristic data collected as learning data in the communication paths belonging to the group.
Anomaly detection device. Obtaining path group information representing a group to which a plurality of communication paths on an optical communication network are set to belong;
Collecting characteristic data representative of communication characteristics in the communication path;
Detecting an abnormality in the group based on the characteristic data of the communication paths belonging to the group;
Anomaly detection methods. The anomaly detection method according to claim 9,
Detecting an abnormality in the communication path based on the collected characteristic data of the communication path belonging to the group detected as having an abnormality;
Anomaly detection methods. The anomaly detection method according to claim 9,
generating the group to which the plurality of communication paths belong based on information representing characteristics of the communication paths, and acquiring the path group information;
Anomaly detection methods. Obtaining path group information representing a group to which a plurality of communication paths on an optical communication network are set to belong;
Collecting characteristic data representative of communication characteristics in the communication path;
Detecting an abnormality in the group based on the characteristic data of the communication paths belonging to the group;
A computer-readable storage medium that stores a program for causing a computer to execute a process.