JP2009163474A - Time-series data search program, time-series data search device and time-series data search method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technique for searching time-series data of the other time similar to time-series data of a designated time, and presenting the searched similar time-series data in an easy-to-understand manner. <P>SOLUTION: In the search program, a time-series data storage part 20 stores time-series data. In a time-series data search processing part 10, a display processing part 11 displays time-series data on a display device 30, and receives selection of search object data by a user. A search object designation processing part 12 receives designation of conditions such as a threshold for determining similarity and importance of each numerical data, the setting and performs setting thereof. A search processing part 13 calculates a similarity by a similarity calculation processing part 14 based on a difference of each numerical data or a time difference between the search object data and each time-series data, and lists up time-series data the similarity of which satisfies the designated threshold condition. The display processing part 11 displays the time-series data while highlighting the listed similar data. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a technique for retrieving and displaying time-series data, and in particular, a time-series data retrieval program that retrieves and highlights time-series data at other times similar to the time-series data at a specified time. , A time-series data search device and a time-series data search method.

  The time series data is data managed every predetermined time. There are two types of time-series data: data at each time point is composed of one numerical data and data composed of a plurality of numerical data. An example of the former is stock price data in the financial field. An example of the latter is performance data in a computer system. Below, the example of the performance data in a computer system is demonstrated as an example of time series data.

  The performance data in the computer system includes various data such as an execution rate of a plurality of programs executed at a certain point in time, a CPU usage rate, and a memory usage rate. These performance data are collected and analyzed when a performance problem occurs during system operation, for performance improvement during system development, or for monitoring during system operation. When monitoring an operating system, performance data is always held at regular intervals, so the amount of data is enormous. In addition, performance data collected to improve performance during system operation or during system development requires data with a finer granularity than when monitoring the operating system to achieve that goal. As a result, the amount of data collected increases even in a short time.

  When a performance problem occurs, the performance data also has an effect, for example, the execution rate of a specific program is extremely high or low. If similar problems occur, the performance data is likely to show the same trend. Therefore, by searching for performance data similar to the performance data at a certain point in time from other points in time, it becomes possible to grasp the problem occurrence pattern and the system operation.

  Thus, there is a need for a technology that can search for similar data from a large amount of performance data and present the results in an easy-to-understand manner. However, at present, there is no technique for finding data similar to the data at a certain point of time from time-series data in which the data at each time is composed of a plurality of numerical data, and displaying the results in an easy-to-understand manner. Conventional time-series data search techniques are limited in application fields, are targeted at time-series data consisting of a single piece of numerical data, and are subject to time variations (patterns) of time-series data.

  As prior art documents describing techniques for searching and displaying similar data, for example, there are Patent Document 1, Patent Document 2, Patent Document 3, and the like. Japanese Patent Application Laid-Open No. 2004-228561 describes a technique for performing a similar image search by using an image as a search key. Patent Document 2 describes a technique for displaying original key image data and similar image data in a manner that can be visually distinguished by highlighting, blinking display, changing display color, or the like. Patent Document 3 describes a technique for highlighting an object according to a similar degree.

Further, as prior art documents in which similar data retrieval techniques for time series data are described, there are, for example, Patent Document 4 and Patent Document 5. Patent Document 4 describes a technique for performing a similarity search based on a specified range pattern for time-series data composed of one numerical data in the financial securities field. Patent Document 5 describes a technique in which time-series data including a plurality of numerical data related to plant operation is mapped to a tree structure, and a similarity search is performed from the distance between the mapped data.
JP 2003-150634 A JP 2005-352780 A Japanese Patent Laid-Open No. 11-338887 JP-A-5-204991 Japanese Patent No. 3951370

  It is not easy to search for similar data in time-series data composed of a plurality of numerical data, such as performance evaluation data of a computer system.

  First, it is necessary to specify the search target data, but it is difficult to express the characteristics of the data. Therefore, there is a need for a technique for easily specifying search target data.

  Next, since there is no means for retrieving similar data with respect to time series data, for example, it is necessary to use means such as creating a graph from the data and scrolling the graph on the screen so that the user can see the data in order. Absent. Even if there is a function to display a graph that shows an overview of all the data, if the amount of data becomes enormous, it is possible to grasp the part where the problem occurs or the part that moves similarly from the outline diagram. very difficult.

  In addition, a technique is required that presents the retrieved similar data in an easy-to-understand manner and displays the data so that the user can easily see similar data.

  The present invention is a technique for solving the above-described problems, searching for time-series data at other times similar to the specified time-series data, and presenting the retrieved similar time-series data in an easy-to-understand manner. The purpose is to provide.

  Similarities are calculated by calculating the similarity based on the difference between each numeric data of the specified time series data and each numeric data of other time series data and the temporal proximity between these time series data. Search for data. The retrieved similar time series data is highlighted so that the position in the whole data can be understood.

  Specifically, the time-series data search program reads a time-series data from a data storage section by using a computer having a data storage section for storing time-series data, and includes each time-series data Di included in a specified time Ti. From the difference between the numerical data and each numerical data included in the time series data Dj at the time Tj other than the designated time Ti, and the time difference between the time Ti and the time Tj, the time series data Di and the time series data Dj Is calculated for each of a plurality of times Tj, and a specified time is determined by comparing a plurality of similarities calculated for each of the plurality of times Tj with a predetermined threshold, or by comparing a plurality of similarities. Calculating means for extracting one or a plurality of time-series data Dj evaluated to be similar to the time-series data Di in Ti; The time series data Dj number, to function as a display means for displaying with emphasis in view of a series of time-series data.

  As a result, it is possible to perform a similar search for time series data including not only numerical elements but also temporal elements, and to display the data that are regarded as similar in an emphasized manner.

  Further, when the above calculation means evaluates that two time-series data are similar as the similarity is small, the similarity is weighted smaller as the time difference is smaller, and the two time-series data as the similarity is larger. May be weighted as the time difference is smaller. As a result, the similarity between time series data having a close relationship in time increases and the similarity between time series data in a distant relationship becomes low. It becomes easy to detect time-series data having a close relationship.

  Further, the calculation means may give a predetermined weight to each numerical data. Thereby, for example, it is possible to perform a similarity search with emphasis on numerical data having high importance among numerical data included in time-series data.

  Further, when the above calculation means is Xki for the numerical data at time Ti, Xkj for the numerical data at time Tj, Wk for the weighting of the numerical data, and m for the numerical data, the similarity is calculated from the following equation: You may make it do.

  As a result, time-series data having a small distance between the numerical data and a small time difference are detected as similar time-series data.

  Further, the time series data may be numerical data representing an execution ratio for each function. As a result, it is possible to perform similar retrieval of performance evaluation data of a computer system.

  Similarity is determined by determining the similarity based on the difference between each numeric data of time series data to be searched and each numeric data of other time series data and the temporal proximity between the time series data. It is possible to search time series data as data. By adding not only the similarity of each numerical data of time series data but also the temporal closeness between the time series data to the similarity determination, the similarity of each numerical data is high and the time series data closer in time is also obtained. You can search. In addition, by highlighting the retrieved similar data, it is possible to assist in grasping the position of the similar data.

  Hereinafter, the present embodiment will be described with reference to the drawings. In the present embodiment, the performance data of the computer system will be described as an example of time series data. There are various types of computer system performance data, but here we take the example of function execution ratios that are noticed when investigating the causes of system performance degradation and tuning performance. During performance data collection, the function being executed is sampled at regular intervals. Based on the number of sampled functions, the ratio of each function executed in an arbitrary unit time is aggregated.

  FIG. 1 is a diagram illustrating a configuration example of a time-series data search processing unit according to the present embodiment. The time-series data search processing unit 10 shown in FIG. 1 is realized by hardware such as a CPU and memory provided in a computer system (computer) and a software program. The time series data is collected on the computer system, aggregated, and stored in advance in a storage device such as a disk (in FIG. 1, the time series data storage unit 20).

FIG. 2 is a diagram illustrating an example of time-series data according to the present embodiment. The example of the time series data shown in FIG. 2 is an execution ratio x of each function f _k (k = 1, 2,..., M) at each time t _i (i = 1, 2,..., N). _ki is an example of time-series data when stored in a table format. Here, execution ratio x _ki function f _k at time t _i may be, for example, an execution rate of the function f _k running at the moment of time t _i, the time t _i from a predetermined time _{May be} the execution rate of the function f _k executed in step (b).

  In FIG. 1, the time-series data search processing unit 10 includes a display processing unit 11, a search target designation processing unit 12, and a search processing unit 13. In addition, the search processing unit 13 includes a similarity calculation processing unit 14.

  The display processing unit 11 displays the time series data stored in the time series data storage unit 20 on a display device 30 such as a display in the form of a graph. At this time, each time-series data displayed on the graph can be selected, and the user selects the search target data on the displayed graph. The search target data is time series data that serves as a reference when performing similar searches of time series data. In the similarity search of time series data, time series data at a specified time is used as search target data, and time series data at another time similar to the search target data is searched.

  FIG. 3 is a diagram illustrating an example of a graph display of time series data. In the example shown in FIG. 3, the execution ratios of the three functions of the function A, the function B, and the function C are graphed and displayed for each time. In the example shown in FIG. 3, the time-series data displayed in a graph on the screen is a part of the entire time-series data. For example, time-series data at other times can be displayed on the screen by a scroll operation or the like. it can. On the display screen as shown in FIG. 3, the user can designate time-series data of an arbitrary time displayed at that time as search target data. As a result, the user can easily select and specify search target data from a large amount of data.

  In FIG. 1, the display processing unit 11 identifies data selected by the user and notifies the search target designation processing unit 12 of the data. When the search target designation processing unit 12 receives notification of the search target data selected by the user from the display processing unit 11, the search target designation processing unit 12 inquires of the user whether or not to specify a search condition. Here, for example, the following two conditions can be considered as specifiable conditions.

・ Threshold for determining similarity between search target data and time-series data at each time For example, time-series data whose similarity to search target data is less than or equal to the threshold specified by the user Extract as data. Let the user specify the number of similar data, list the time-series data in the order of similarity values by comparing each similarity, and select the specified number of time-series data from the highest similarity in the search target data You may make it extract as similar data.

-Importance of each function executed at the specified time For example, several options indicating the importance of the function such as unnecessary / ordinary / important are prepared, and the user is made to select from these options. Based on the importance selected by the user, the weighting coefficient for the execution ratio of each function is set. As the weighting coefficient, a large value is assigned to an important function, and 0 is assigned to a function that is not required for retrieval. For example, in order not to increase the degree of similarity, the weighting coefficient is set to a value of 0 to 1 such as unnecessary → 0, normal → 0.5, and important → 1. The user may be made to input a weighting coefficient directly.

  When the user does not specify conditions, a default value defined in advance is set as a threshold for determining similarity, and the weighting coefficient of each function executed at the specified time is set to 1. To do. When the user specifies a condition, the function name and the execution ratio of each function executed at the specified time are presented, and the importance of each function is input by the user. In addition, the user is allowed to input a threshold value for determining the similarity.

  The search processing unit 13 calculates the similarity between the search target data and the time series data by the similarity calculation processing unit 14 for all the time series data, and obtains time series data whose similarity is equal to or less than a specified threshold (or less). Extract and list as similar data.

Various definitions of similarity can be considered. Below are some examples of similarity definitions. In the example shown below, it is assumed that the time series data at time t _i is the search target data, and the similarity d _ij with other time series data at time t _j is calculated. Time t each function in the _{i f k (k = 1,2,} ..., m) of the execution ratio of x _ki, each function at the time _{t j f k (k = 1,2} , ..., m) of It is expressed as an execution ratio x _kj . Further, the weighting coefficient set for each function f _k (k = 1, 2,..., M) is expressed as w _k .

For example, the similarity d _ij between the search target data and the time series data at time t _j is calculated by the following equation (1).

In the example of Expression (1), the difference between the execution ratios x _ki and x _kj of the function f _k in each time series data at times t _i and t _j is multiplied by the weighting coefficient w _k for each function f _k. Are integrated for each function f _k (k = 1, 2,..., M), and the absolute value of the difference between both times t _i and t _j is added.

Further, for example, the similarity d _ij between the search target data and the time series data at time t _j is calculated by the following equation (2).

In the example of Expression (2), the difference between the execution ratios x _ki and x _kj of the function f _k in each time series data at times t _i and t _j is multiplied by the weighting coefficient w _k for each function f _k. Are integrated for each function f _k (k = 1, 2,..., M) to obtain the square root, and the absolute value of the difference between both times t _i and t _j is added.

  In the above formulas (1) and (2), the temporal closeness of two time series data is expressed by the absolute value of the time difference, and by adding it, the similarity depends on the temporal proximity. Weighting is performed. As a result, it is easier to determine that time series data that is closer in time than time series data that is separated in time from the search target data is similar.

  For example, for time-series data related to the performance of a computer system, the data at the time when the problem occurred is used as the search target data, and this is very useful when you want to search for data that is similar to this data, i.e., that you suspect that a similar problem has occurred. It is considered more effective to examine data that is close in time to the data at the point of interest rather than the older data. In such a case, it is possible to perform a more effective search by adding an element that is close in time to the similarity.

  In addition to the method of adding the absolute value of the difference between two times as shown in the above example, the method of adding the absolute value of the difference between two times, for example, can be used as a method of adding an element of temporal similarity to the similarity. Various methods are conceivable, such as a method of multiplying by a logarithmic function. The appropriate method depends on how much you evaluate the closeness factor. For example, when it is desired to highly evaluate the temporal proximity factor, in the above formulas (1) and (2), multiplication may be performed instead of adding the absolute values of the differences between the two times.

When the temporal proximity of two time series data is not important, the temporal element may not be included in the formula for calculating the similarity. For example, the similarity d _ij between the search target data and the time series data at time t _j is calculated by the following equation (3).

In the example of Expression (3), the difference between the execution ratios x _ki and x _kj of the function f _k in each time series data at the times t _i and t _j is squared to _obtain the function f _k (k = 1, 2, ..., m) are integrated to obtain the square root. Equation (3) is called the Euclidean distance.

In addition, there are various methods for calculating the similarity d _ij between the search target data and the time-series data at time t _j such as the city distance shown in the following equation (4).

In addition, as an index indicating the degree of similarity, a smaller value, such as distance, indicates higher similarity, and a larger value, such as a correlation coefficient, indicates higher similarity. There is. Since the distance function is used as an index representing the degree of similarity, the similarity d _ij obtained by the above formulas (1) to (4) is determined to have a higher similarity as the value is smaller.

  In FIG. 1, the search processing unit 13 notifies the display processing unit 11 of a list of similarity data and requests presentation to the user. When receiving a search result presentation request to the user from the search processing unit 13, the display processing unit 11 checks the similar data list notified from the search processing unit 13. If there is no similar data, a message that similar data was not found is presented to the user. If similar data exists, it is checked whether similar data exists in the vicinity of the search target data. The presence of similar data in the vicinity of the search target data means that the similar data is also displayed in the screen on which the search target data is displayed, for example.

  FIG. 4 is a diagram (1) showing a display image of similar data according to the present embodiment. When similar data exists near the search target data, that is, in the screen on which the search target data is displayed, the similar data displayed on the graph in which the search target data is specified is highlighted. When a graph scroll instruction is received by a key or a scroll bar, the closest similar data in the specified direction from the search target data is displayed. In other words, the scroll width is changed, and scrolling is performed until similar data exists.

  FIG. 5 is a diagram (2) showing a display image of similar data according to the present embodiment. If there is no similar data near the search target data, a general view that gives an overview of the entire time-series data is displayed, and the search target is shown in this figure so that the user can see the position of the similar data in the entire data. Highlight data and similar data. When the highlighted similar data is selected by the user, the selected similar data and a detailed view of the time zone before and after the selected similar data are enlarged and displayed at a position close to the selected similar data in the overall diagram.

  As shown in the examples of FIGS. 4 and 5, similar data is displayed so that the user can easily grasp the position and details of the similar data. As shown in the examples of FIGS. 4 and 5, there are various methods for highlighting, such as enclosing similar data in a bold frame, blinking similar data, changing the color or pattern of similar data, and the like. Can be considered.

  FIG. 6 is a flowchart of a display process performed by the display processing unit according to this embodiment. The display processing unit 11 displays the time series data as a graph on the display device 30 (step S10). When the search target data is designated by the user (step S11), the data selected by the user is identified and notified to the search target designation processing unit 12 (step S12).

  A similar data list is received as a search result from the search processing unit 13 (step S13). If there is no similar data in the similar data list (step S14), the user is notified that there is no similar data (step S15).

  When similar data exists in the similar data list (step S14), if there is similar data in the vicinity of the search target data (step S16), the similar data in the vicinity of the search target data is highlighted (step S17). Whether or not similar data exists in the vicinity of the search target data is determined, for example, by whether or not similar data is displayed in one screen on which the search target data is displayed. If there is no similar data in the vicinity of the search target data (step S16), an overall view that allows an overview of the entire time series data is displayed, and the similar data is highlighted in the overall view (step S18).

  FIG. 7 is a flowchart of a search target designation process performed by the search target designation processing unit according to this embodiment. When receiving the notification of the search target data from the display processing unit 11 (step S20), the search target specification processing unit 12 inquires of the user whether or not to specify the search conditions. When the condition is not specified (step S21), the threshold value for similarity determination and the importance of each numerical data are set to default values (step S24). The set threshold value for similarity determination and the importance of each numerical data are stored.

  When the condition is set (step S21), the numerical data of the search target data is presented to the user (step S22), and the user specifies the similarity determination threshold and the numerical data importance (step S23). A threshold for similarity determination designated by the user and the importance of each numerical data are set (step S24). The set threshold value for similarity determination and the importance of each numerical data are stored.

  FIG. 8 is a flowchart of a search process performed by the search processing unit according to this embodiment. The search processing unit 13 extracts one time-series data at a time other than the search target data (step S30), and calculates the similarity between the extracted time-series data and the search target data using a predetermined calculation formula. (Step S31).

  If the calculated similarity is not more than the set threshold value (step S32), the extracted time-series data is added to the similar data list as similar data of the search target data (step S33).

  The processing from step S30 to step S33 is executed for all necessary time series data (step S34). Here, all necessary time series data may be all time series data, or may be time series data within a specified time range.

Although the present embodiment has been described above, the present invention is not limited to such an embodiment. For example, in the present embodiment, an example of the function execution ratio is given as the time series data, but naturally it can be realized with other time series data. In the case of the function execution ratio in the present embodiment, the value is limited to 0 to 100. However, when the similarity is determined by combining various data such as the CPU usage rate and the data communication amount. , Possible values can be quite different. Therefore, taking into account the size variation of each data, for example,
(Value-minimum value) / (maximum value-minimum value)
Thus, normalization can be considered. When normalized in this way, each value falls within the range of 0-1. Average or standard deviation may be used for normalization.

  In this embodiment, the distance between numerical values is used as an index representing the degree of similarity, and it is determined that the similarity is high when the calculated similarity is less than or less than a set threshold. When the similarity is calculated using an index indicating that the larger the value is like the correlation coefficient, the higher the similarity is, the judgment is made that the similarity is high when the set threshold value is exceeded or exceeded What should I do?

  Similarly, with regard to the weighting based on temporal proximity, since the distance between numerical values is used as an index indicating the degree of similarity in this embodiment, weighting is performed so that the degree of similarity decreases as the time difference decreases. When an index indicating that the similarity is higher when the value is larger, such as a correlation coefficient, weighting may be performed so that the similarity is increased as the time difference is decreased.

It is a figure which shows the structural example of the time series data search process part by this Embodiment. It is a figure which shows the example of the time series data by this Embodiment. It is a figure which shows the example of the graph display of time series data. It is a figure (1) which shows the display image of the similar data by this Embodiment. It is FIG. (2) which shows the display image of the similar data by this Embodiment. It is a display process flowchart by the display process part of this Embodiment. It is a search object designation | designated process flowchart by the search object designation | designated process part of this Embodiment. It is a search process flowchart by the search process part of this Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Time series data search process part 11 Display process part 12 Search object designation | designated process part 13 Search process part 14 Similarity calculation process part 20 Time series data storage part 30 Display apparatus

Claims (7)

A computer having a data storage unit for storing time-series data;
The time series data is read from the data storage unit, each numerical data included in the time series data Di at the specified time Ti, and each numerical value included in the time series data Dj at a time Tj other than the specified time Ti. A similarity between the time series data Di and the time series data Dj is calculated for each of a plurality of times Tj from the difference between the data and the time difference between the time Ti and the time Tj, and the plurality of times It is evaluated that it is similar to the time-series data Di at the designated time Ti by comparing a plurality of similarities calculated for the time Tj with a predetermined threshold value, or comparing the plurality of similarities, or 1 A calculation means for extracting a plurality of time series data Dj;
As display means for highlighting and displaying the extracted one or more time series data Dj in a series of time series data display,
Time series data search program to make it function. When the calculation means evaluates that the two time-series data are similar as the similarity is small, the similarity is weighted smaller as the time difference is smaller, and the two time-series data are larger as the similarity is larger. 2. The time-series data search program according to claim 1, wherein when the similarity is evaluated, the similarity is weighted more as the time difference is smaller. The time series data search program according to claim 1, wherein the calculation unit weights each numerical data with a predetermined weight. The calculation means calculates the similarity from the following equation when the numerical data at time Ti is Xki, the numerical data at time Tj is Xkj, the numerical data weight is Wk, and the number of numerical data is m. The time-series data search program according to any one of claims 1 to 3, wherein:

The time-series data search program according to any one of claims 1 to 4, wherein the time-series data is numerical data representing an execution ratio for each function. A data storage unit for storing time-series data;
The time series data is read from the data storage unit, each numerical data included in the time series data Di at the specified time Ti, and each numerical value included in the time series data Dj at a time Tj other than the specified time Ti. A similarity between the time series data Di and the time series data Dj is calculated for each of a plurality of times Tj from the difference between the data and the time difference between the time Ti and the time Tj, and the plurality of times It is evaluated that it is similar to the time-series data Di at the designated time Ti by comparing a plurality of similarities calculated for the time Tj with a predetermined threshold value, or comparing the plurality of similarities, or 1 A calculation means for extracting a plurality of time series data Dj;
A time-series data search device comprising: a display unit that highlights and displays the extracted one or more time-series data Dj in a series of time-series data displays. A computer having a data storage unit for storing time series data is
The time series data is read from the data storage unit, each numerical data included in the time series data Di at the specified time Ti, and each numerical value included in the time series data Dj at a time Tj other than the specified time Ti. A similarity between the time series data Di and the time series data Dj is calculated for each of a plurality of times Tj from the difference between the data and the time difference between the time Ti and the time Tj, and the plurality of times It is evaluated that it is similar to the time-series data Di at the designated time Ti by comparing a plurality of similarities calculated for the time Tj with a predetermined threshold value, or comparing the plurality of similarities, or 1 A calculation process of extracting a plurality of time series data Dj;
A time-series data search method comprising: a display step of highlighting and displaying the extracted one or more time-series data Dj in a series of time-series data displays.

Images