JP2012194806A - Event processing method, event processing apparatus and event processing program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable correction of the result of realtime event processing as necessary.SOLUTION: An event reception section 330 transfers an event arriving from an information source to a real time determination section 340 and an event alignment section 350. The real time determination section 340 refers to a rule table 310 stored in a hard disk 300C and, when the event follows a rule, requests a notification section 380 to transmit an alert notification. The event alignment section 350 accumulates events for a predetermined period of time and transfers the events to a batch determination section 360 in the order of occurrence. The batch determination section 360 refers to the rule table 310 and notifies a correctness/incorrectness determination section 370 of a determination result showing whether an event follows a rule. When the determination result by the real time determination section 340 is different from the determination result by the batch determination section 360, the correctness/incorrectness determination section 370 requests the notification section 380 to transmit an incorrectness correction notification.

Description

  The present invention relates to an event processing technique for applying a rule to events generated from various information sources and executing a predetermined process.

  In recent years, an event processing technique has been considered in which rules are applied to events generated from information sources such as various devices and sensors, and predetermined processing is executed in real time. As an example of a service that applies event processing technology, for example, an alarm system that notifies a security company when a human sensor detects the location of a person while the user is out, or the like.

  However, if it takes a long time to communicate between the information source that generates the event and the server that processes the event, the arrival order at the server is reversed between multiple events that occur in time series, which causes incorrect processing. May be executed. As an example of the wrong processing, for example, when the user returns home, the human sensor detects the location of the user before the location information for determining whether or not the user is out of the office and is guarded. A report to the company is expected.

  For this reason, the delay time when an event arrives at the server is measured, and the difference between the maximum delay time and the minimum delay time is used as a waiting time, and the events are accumulated and sorted (sorted) during that time. Techniques for handling events have been proposed.

JP-A-9-244984

  In the prior art, it is possible to process events in the order of occurrence, but there is a problem that events are not processed in real time because the events are accumulated during the waiting time. If the event is not processed in real time, for example, even if the human sensor detects the presence of a person and reports it to the security company while the user is out, the time it takes for the security company to run to the user's home is delayed, etc. Will occur.

  Therefore, in view of the problems of the prior art, the present invention provides an event processing method, an event processing apparatus, and an event processing program that can correct the result of processing events arriving from an information source in the order of arrival as necessary. For the purpose.

  The computer refers to the storage unit storing the rules for processing the event, processes the events arriving from the information source in the order of arrival, and processes the events accumulated for a predetermined time in the order of occurrence. Then, the computer transmits the results of processing the events in the order of arrival and stores them in the storage unit. When the stored results are different from the results of processing the events in the order of occurrence, the results of processing the events in the order of occurrence are transmitted. To do.

  The result of processing the events arriving from the information source in the order of arrival can be corrected as necessary.

It is a schematic diagram which shows an example of an information system. It is a structural diagram which shows an example of the internal structure of a server. It is a functional block diagram which shows an example of a server. It is a data structure figure which shows an example of a rule table. It is a data structure figure which shows an example of an alert table. It is a flowchart which shows an example of an event reception process. It is explanatory drawing which shows an example of an event. It is a flowchart which shows an example of a real-time determination process. It is explanatory drawing which shows an example of an alert notification request. It is explanatory drawing which shows an example of an alert information registration request. It is a flowchart which shows an example of an event alignment process. It is a flowchart which shows an example of an event alignment process. It is a flowchart which shows an example of a batch determination process. It is explanatory drawing which shows an example of the determination result notification. It is a flowchart which shows an example of a correctness determination process. It is a flowchart which shows an example of a notification process. It is explanatory drawing which shows an example of the alert notification transmitted to a user. It is a data structure figure which shows the other example of an alert table. It is a flowchart which shows the other example of real-time determination processing. It is explanatory drawing which shows the other example of an alert notification request. It is a flowchart which shows the other example of a correctness determination process. It is explanatory drawing which shows the other example of the alert notification transmitted to a user. It is explanatory drawing which shows an example of ID information registration request. It is explanatory drawing which shows an example of an ID information deletion request. It is a flowchart which shows the other example of a batch determination process. It is a flowchart which shows the other example of a correctness determination process. It is a processing sequence diagram for demonstrating the effect | action of embodiment.

Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the accompanying drawings.
[First Embodiment]
FIG. 1 shows an example of an information system according to the first embodiment.

The event generation source 100 as various information sources is connected to a server 300 of a service provider that provides various services via a network 200 such as the Internet. Here, as the event generation source 100, for example, there are a human sensor that detects the location of a human, a GPS (Global Positioning System) receiver that measures human position information, a locking sensor that detects a locked state of a house, and the like. Examples of service providers that provide various services include a security company that guards a user's house. In addition, as an example of a device for receiving various notifications from the server 300, for example, a user's mobile phone 400 is connected to the network 200.

As shown in FIG. 2, the server 300 is a computer including a memory 300A, a processor 300B such as a CPU (Central Processing Unit), a hard disk 300C, a drive device 300D, and a communication device 300E. The memory 300A, the processor 300B, the hard disk 300C, the drive device 300D, and the communication device 300E are connected to each other by a bus 300F such as serial ATA (AT Attachment). Hard disk 30
0C functions as a storage unit. The drive device 300D is, for example, a CD-ROM (Comp
Data is read from a removable disk 300G such as act disk read only memory (DVD) or DVD-ROM (digital versatile disk read only memory). Instead of the removable disk 300G, a USB (Universal Serial Bus) memory with a built-in flash memory may be used. The communication device 300E is, for example, a NIC (Network Interface Card) that connects the bus 300F and the network 200.

The hard disk 300C of the server 300 stores a rule table 310 and an alert table 320, respectively, as shown in FIG. The rule table 310 is a table for defining a rule to be applied to an event arriving at the server 300 from the event generation source 100. As shown in FIG. 4, a rule ID (Identifier) for identifying the rule, and a specific rule are provided. Hold the rule information that associates the correct rule. Here, the rules are described in a dedicated language such as SQL (Structured Query Language). In FIG.
In the rule with the rule ID “rule001”, when the human sensor detects the location of a person (motionsensor.event = true) while the user is out (location! = Home), the information of “id” is “ An event of notifying the user specified by “id” is defined. The alert table 320 is a table for storing alerts notified from the server 300 to the mobile phone 400, and as shown in FIG. 5, an event ID for identifying an event, a rule ID for identifying a rule, and a processed event Event information indicating the order of the event information and alert information in association with each other.

  As shown in FIG. 3, the processor 300B of the server 300 executes the event processing program expanded in the memory 300A, so that the event reception unit 330, the real-time determination unit 340, the event alignment unit 350, and the batch determination unit 360, the correctness determination unit 370, and the notification unit 380 are embodied.

  The event reception unit 330 transfers the arrived event to the real-time determination unit 340 and the event alignment unit 350, respectively, triggered by the arrival of the event from the event generation source 100.

  The real-time determination unit 340 refers to the rule table 310 stored in the hard disk 300C when the event is transferred from the event reception unit 330, and determines whether the event conforms to the rule. In addition, if the real-time determination unit 340 determines that the event conforms to the rule, the real-time determination unit 340 requests the correctness determination unit 370 to register the alert information and also requests the notification unit 380 to notify the alert. Note that the real-time determination unit 340 may read the rule table 310 from the hard disk 300C into the memory 300A at the time of startup or the like in order to improve the processing speed (the same applies hereinafter). In this case, the memory 300A is an example of a storage unit.

  The event aligning unit 350 stores (buffers) the events in the memory 300A for a predetermined time when the events are transferred from the event receiving unit 330, and then arranges the events in the order of occurrence. Then, the event alignment unit 350 sequentially transfers the events aligned in the order of occurrence to the batch determination unit 360. Here, the predetermined time for accumulating events may be appropriately determined using a known technique such as the technique proposed in Japanese Patent Laid-Open No. 9-244984 cited in the background art.

  The batch determination unit 360 refers to the rule table 310 stored in the hard disk 300C when the event is transferred from the event alignment unit 350, and determines whether the event conforms to the rule. Further, the batch determination unit 360 notifies the correctness determination unit 370 of the determination result.

  The correctness determination unit 370 registers alert information in the alert table 320 stored in the hard disk 300 </ b> C, triggered by a request for registration of alert information from the real time determination unit 340. Further, the correctness / incorrectness determination unit 370 triggers the notification of the determination result from the batch determination unit 370, deletes the alert information from the alert table 320, or requests the notification unit 380 for alert notification or error report correction notification.

  The real time determination unit 340 corresponds to a first processing unit. The event alignment unit 350 and the batch determination unit 360 correspond to a second processing unit. Furthermore, the correctness determination unit 370 and the notification unit 380 correspond to a transmission unit.

  FIG. 6 illustrates an example of an event reception process executed by the event reception unit 330 of the server 300 when an event arrives at the server 300 from the event generation source 100. Here, the event includes a message type, an event ID, an event type, and data, as shown in FIG. The message type stores information for identifying the message type. The event type stores the type of information stored in the data. The data stores information corresponding to the event type.

In step 1 (abbreviated as “S1” in the figure, the same applies hereinafter), the event reception unit 330 transfers the event to the real-time determination unit 340.
In step 2, the event receiving unit 330 transfers the event to the event arranging unit 350.

  According to such event reception processing, the event reception unit 330 of the server 300 transfers the events arriving from the event generation source 100 to the real-time determination unit 340 and the event alignment unit 350, respectively.

FIG. 8 shows an example of real-time determination processing executed by the real-time determination unit 340 of the server 300 when an event is transferred from the event reception unit 330.
In step 11, the real-time determination unit 340 refers to the rule table 310 stored in the hard disk 300 </ b> C to determine whether the event conforms to the rule. The real-time determination unit 340 advances the process to step 12 if it determines that the event conforms to the rule (Yes), and terminates the process if it determines that the event does not conform to the rule (No). ).

  In step 12, the real-time determination unit 340 requests the notification unit 380 for alert notification in order to transmit the alert to the user's mobile phone 400. Here, the alert notification request includes a message type, a notification destination, a notification method, and notification contents, as shown in FIG. Note that the notification destination and the notification method are specified in advance by the user, for example (the same applies hereinafter).

  In step 13, the real-time determination unit 340 requests the correctness determination unit 370 to register alert information in order to update the alert table 320 stored in the hard disk 300C. Here, the alert information registration request includes a message type, an event ID of the event, a rule ID of the matched rule, and an event string indicating the order of the matched event, as shown in FIG.

  According to such real-time determination processing, the real-time determination unit 340 of the server 300 requests an alert notification to the notification unit 380 and also requests the correctness determination unit 370 to register alert information if the event conforms to the rule. .

FIG. 11 shows an example of event alignment processing executed by the event alignment unit 350 of the server 300 when an event is transferred from the event reception unit 330.
In step 21, the event alignment unit 350 accumulates events in the memory 300A.

  In step 22, the event alignment unit 350 determines whether or not the timer has started, for example, using a timer function. If the event alignment unit 350 determines that the timer has started, it ends the process (Yes), and if it determines that the timer has not started, it advances the process to Step 23 (No).

In step 23, the event alignment unit 350 starts a timer.
FIG. 12 shows an example of an event alignment process executed by the event alignment unit 350 of the server 300 in parallel with the event alignment process shown in FIG. 11 when an event is transferred from the event reception unit 330.

  In step 31, the event alignment unit 350 determines whether or not a predetermined time has elapsed since the start of event accumulation. If the event alignment unit 350 determines that a predetermined time has elapsed since the start of event accumulation, the event alignment unit 350 proceeds to step 32 (Yes), but the predetermined time has not elapsed since the event accumulation started. If it is determined, the process is terminated (No).

In step 32, the event sorting unit 350 sorts the events stored in the memory 300A in the order of occurrence.
In step 33, the event alignment unit 350 sequentially transfers the aligned events to the batch determination unit 360, that is, sequentially transfers the events to the batch determination unit 360 in the order of occurrence.

In step 34, the event alignment unit 350 deletes all events from the memory 300A.
In step 35, the event alignment unit 350 stops and resets the timer.

  According to such an event alignment process, the event alignment unit 350 of the server 300 accumulates events arriving from the event generation source 100 for a predetermined time, and sequentially transfers the events to the batch determination unit 360 in the order of occurrence. Therefore, the batch determination unit 360 can receive events arranged in the order of occurrence.

FIG. 13 shows an example of batch determination processing executed by the batch determination unit 360 of the server 300 when an event is transferred from the event alignment unit 350.
In step 41, the batch determination unit 360 refers to the rule table 310 stored in the hard disk 300C to determine whether the event conforms to the rule. If the batch determination unit 360 determines that the event conforms to the rule, the process proceeds to step 42 (Yes), whereas if the event determines that the event does not conform to the rule, the process proceeds to step 43. Advance (No).

  In step 42, the batch determination unit 360 notifies the correctness determination unit 370 of a determination result that informs that the event conforms to the rule. Here, as shown in FIG. 14, the determination result notification includes a message type, a notification destination, a notification method, a determination result, an event ID, a rule ID, an event string, and a notification content. The determination result stores the determination result in step 41, specifically, whether the rule is met or not. The notification content stores the content notified to the user or the like (empty if no notification is required).

In step 43, the batch determination unit 360 notifies the correctness determination unit 370 of a determination result that informs that the event does not conform to the rule. The determination result notification is the same as the message shown in FIG.

  According to such a batch determination process, the batch determination unit 360 of the server 300 determines whether or not the event conforms to the rule for each event arranged in the order of occurrence based on the same rule table 310 as the real-time determination process. judge. Then, the batch determination unit 360 notifies the correctness determination unit 370 of the determination result.

  FIG. 15 illustrates an example of a correct / incorrect determination process executed by the correct / incorrect determination unit 370 of the server 300 in response to a request for registration of alert information from the real-time determination unit 340 or a notification of a determination result from the batch determination unit 360. Show.

  In step 51, the correctness determination unit 370 determines whether or not the request is a registration request for alert information by referring to, for example, a message type of a registration request or a determination result notification. If the correctness determination unit 370 determines that the request is a registration request for alert information, the process proceeds to step 52 (Yes), whereas if the determination is not a request for registration of alert information, the process proceeds to step 53 (No). ).

  In step 52, the correctness determination unit 370 generates alert information that associates the event ID, rule ID, and event string included in the alert information registration request, and registers the alert information in the alert table 320 stored in the hard disk 300C. To do. When alert information specified by an event ID and rule ID is registered in the alert table 320, an event may be added to the event sequence (the same applies hereinafter).

  In step 53, the correctness determination unit 370 refers to the determination result included in the determination result notification to determine whether the event related to the determination result notification conforms to the rule. Then, the correctness determination unit 370 proceeds to step 54 if it is determined that the event conforms to the rule (Yes), but proceeds to step 57 if it determines that the event does not conform to the rule. Advance (No).

  In step 54, the correctness determination unit 370 refers to the alert table 320 stored in the hard disk 300C, and determines whether or not the alert information specified by the event ID and rule ID included in the determination result notification is registered. . If correctness determination unit 370 determines that alert information is registered, the process proceeds to step 55 (Yes), whereas if it is determined that alert information is not registered, the process proceeds to step 56 ( No).

  In step 55, the correctness determination unit 370 deletes the alert information specified by the event ID and the rule ID included in the determination result notification from the alert table 320 stored in the hard disk 300C.

In step 56, the correctness determination unit 370 requests the notification unit 380 for alert notification.
In step 57, the correctness determination unit 370 refers to the alert table 320 stored in the hard disk 300C and determines whether or not the alert information specified by the event ID and rule ID included in the determination result notification is registered. . Then, the correctness determination unit 370 advances the process to step 58 if it is determined that the alert information is registered (Yes), and ends the process if it is determined that the alert information is not registered (No).

In step 58, the correctness / incorrectness determination unit 370 requests the notification unit 380 for a false alarm correction notification for correcting that the transmitted alert notification is incorrect.
According to this correctness determination process, the correctness determination unit 370 of the server 300 registers alert information in the alert table 320 when there is a request for registration of alert information. Further, the correctness determination unit 370 determines that the determination by the real time determination unit 340 is correct if the event related to the determination result notification conforms to the rule and the alert information of the event is registered in the alert table 320, The alert information is deleted from the alert table 320. The correctness determination unit 370 determines that the alert notification has not been made if the event related to the determination result notification conforms to the rule and the alert information of the event is not registered in the alert table 320, and the notification unit 380 Request alert notification. The correctness determination unit 370 determines that the determination by the real time determination unit 340 is wrong if the event related to the determination result notification does not conform to the rule and the alert information of the event is registered in the alert table 320. Requesting the notification unit 380 to correct the erroneous report.

  FIG. 16 illustrates an example of notification processing executed by the notification unit 380 of the server 300 when an alert notification request is received from the real-time determination unit 340 or an alert notification or a false alarm correction notification request is received from the correctness determination unit 370. Indicates.

  In step 61, the notification unit 380 generates a message as shown in FIG. 17 corresponding to the notification destination, notification method, and notification content included in the alert notification request or the misinformation correction notification request. Here, the message includes a transmission destination (To), a transmission source (From), a time (Date), and a main body (Body), as shown in FIG.

In step 62, the notification unit 380 transmits the message generated in step 61 to the user's mobile phone 400 using means corresponding to the notification method included in the notification request.
According to such notification processing, the notification unit 380 of the server 300 transmits a message corresponding to the request for alert notification or false alarm correction notification to the user's mobile phone 400.

  Therefore, according to such an event processing apparatus, events that arrive at the server 300 from the event generation source 100 are processed in real time (in order of arrival) and accumulated for a predetermined time. Also, events accumulated for a predetermined time are arranged in the order of occurrence and processed in the correct order. Then, the result processed in real time is compared with the result processed in the order of occurrence, and if they are different, a false alarm correction notice for correcting that the result processed in real time is wrong is transmitted. For this reason, for example, even if the security company is mistakenly notified to the security company in real-time processing, a false correction correction notification is transmitted after that, so there is no need for the user to notify that the report is wrong. No need to rush to home.

[Second Embodiment]
In the second embodiment, in the information system according to the first embodiment, the accuracy of the alert notification (probability that the alert notification is correct) obtained from the past performance in the message (alert notification) transmitted to the mobile phone 400 of the user. Is added. Note that the information system according to the second embodiment is mostly in common with the information system according to the first embodiment, and therefore only the parts different from the first embodiment will be described (the same applies hereinafter).

Here, the correctness determination unit 370 calculates the probability that the alert notification is correct, and the real-time determination unit 340 requests the alert notification with reference to the probability.
As shown in FIG. 18, the alert table 320 stored in the hard disk 300 </ b> C of the server 300 holds alert information that associates an event ID, a rule ID, and an event string with a probability that an alert notification is correct and a notification flag. To do. The notification flag stores “1” when the alert notification is transmitted, and stores “0” when the alert notification is not transmitted.

FIG. 19 shows another example of real-time determination processing executed by the real-time determination unit 340 of the server 300 when an event is transferred from the event reception unit 330.
In step 71, the real time determination unit 340 refers to the rule table 310 stored in the hard disk 300C to determine whether the event conforms to the rule. The real time determination unit 340 advances the process to step 72 if it is determined that the event conforms to the rule (Yes), and terminates the process if it determines that the event does not conform to the rule (No). ).

  In step 72, the real-time determination unit 340 refers to the alert table 340 stored in the hard disk 300C, and extracts the probability from the alert information specified by the event ID included in the event and the rule ID of the matched rule. When the probability of alert information is not calculated, this probability may be set to 100%.

  In step 73, the real time determination unit 340 requests the notification unit 380 for alert notification. Here, as shown in FIG. 20, the alert notification request includes a message type, a notification destination, a notification method, notification contents, and a probability.

In step 74, the real-time processing unit 340 requests the correctness determination unit 370 to register alert information.
According to such a real-time determination process, in addition to the operation of the first embodiment, the real-time determination unit 340 of the server 300 adds a probability to the alert notification requested to the notification unit 380 if the event conforms to the rule. can do.

  FIG. 21 shows another example of correctness determination processing executed by the correctness determination unit 370 of the server 300 when triggered by the alert information registration request from the real time determination unit 340 or the notification of the determination result from the batch determination unit 360. An example is shown.

  In step 81, the correctness determination unit 370 determines whether or not the request is a registration request for alert information. If the correctness determination unit 370 determines that the request is for alert information registration, the process proceeds to step 82 (Yes), whereas if it is determined that the request is not an alert information registration request, the process proceeds to step 83 (No). ).

  In step 82, the correctness / incorrectness determination unit 370 generates alert information that associates the event ID, rule ID, probability, event string, and notification flag included in the alert information registration request, and the alert information is stored in the hard disk 300C. Register in the alert table 320. Here, in the alert information, the probability is blank and the notification flag is “0”.

  In step 83, the correctness determination unit 370 refers to the determination result included in the determination result notification to determine whether the event related to the determination result notification conforms to the rule. If correct / incorrect determination unit 370 determines that the event conforms to the rule, the process proceeds to step 84 (Yes), whereas if it determines that the event does not conform to the rule, the process proceeds to step 88. Advance (No).

  In step 84, the correctness determination unit 370 refers to the alert table 320 stored in the hard disk 300C and determines whether or not the alert information specified by the event ID and the rule ID included in the determination result notification is registered. . The correctness determination unit 370 advances the process to step 86 if it is determined that the alert information is registered (Yes), and advances the process to step 85 if it is determined that the alert information is not registered (Yes). No).

In step 85, the correctness determination unit 370 requests the notification unit 380 for alert notification.
In step 86, the correctness / incorrectness determination unit 370 calculates the probability that the alert notification is correct for the event related to the determination result notification from the following arithmetic expression.

Probability = (Number of times that the false alarm correction notification was not notified by the correctness / incorrectness determination unit 370) /
(Number of times alert notification is notified by real-time determination unit 340) × 100
In step 87, the correctness determination unit 370 updates the probability of the alert table 320 stored in the hard disk 300C for the alert information of the event related to the determination result notification.

  In step 88, the correctness determination unit 370 refers to the alert table 320 stored in the hard disk 300C and determines whether or not the alert information specified by the event ID and rule ID included in the determination result notification is registered. . Then, the correctness determination unit 370 advances the process to step 89 if it is determined that the event alert information is registered (Yes), and terminates the process if it is determined that the event alert information is not registered. (No).

In step 89, the correctness / incorrectness determination unit 370 requests the notification unit 380 to make a false alarm correction notification, and then returns to step 86.
According to this correctness determination process, the correctness determination unit 370 of the server 300 registers alert information in the alert table 320 when there is a request for registration of alert information. In addition, the correctness determination unit 370 determines that the alert notification is not made unless the event related to the determination result notification conforms to the rule and the alert information of the event is registered in the alert table 320, and the notification unit Request alert notification to 380. The correctness determination unit 370 determines that the determination by the real-time determination unit 340 is wrong if the event related to the determination result does not conform to the rule and the alert information of the event is registered in the alert table 320. Then, the notification unit 380 is requested to notify the correction of the false alarm. Further, the correctness determination unit 370 calculates the probability that the alert notification is correct for the alert information of the event related to the determination result notification, and updates the probability of the alert table 320.

  Therefore, according to the event processing apparatus, the probability that the alert notification is correct is calculated according to the past results, and this is added to the alert notification to the user. For this reason, the user can grasp how accurate the alert notification is by referring to the probability added to the alert notification as shown in FIG.

  The real time determination unit 340 refers to the alert table 320 stored in the hard disk 300C, and may not request the alert notification to the notification unit 380 when the probability of the alert information related to the event is equal to or less than a predetermined threshold. Good. If it does in this way, it can control that an alert notice with low accuracy is notified to a user.

[Third Embodiment]
In the third embodiment, in the information system according to the first embodiment or the second embodiment, whether or not events arriving at the server 300 from the event generation source 100 are accumulated for a predetermined time and then arranged in the order of occurrence to meet the rules. Improve the efficiency of determining whether or not. In the following description, the information system according to the first embodiment is assumed, but the information system according to the second embodiment may be assumed.

  Here, the batch determination unit 360 registers or deletes the ID information in the memory 300A in response to the ID registration request or the ID deletion request from the correctness determination unit 370. As shown in FIGS. 23 and 24, the ID registration request and the ID deletion request include a message type, an event ID, and a rule ID. The batch determination unit 360 notifies the correctness determination unit 370 of the determination result only when the event ID information is registered in the memory 300A. On the other hand, the correctness determination unit 370 requests the batch determination unit 360 to register or delete ID information.

  FIG. 25 illustrates a batch determination process executed by the batch determination unit 360 of the server 300 when an event is transferred from the event alignment unit 350 or an ID registration or ID deletion request is received from the correctness determination unit 370. Another example is shown.

  In step 91, the batch determination unit 360 determines whether the request is an ID registration request by referring to, for example, an event or a message type of an ID registration request or an ID deletion request. If the batch determination unit 360 determines that the request is an ID registration request, the process proceeds to step 92 (Yes). If the batch determination unit 360 determines that the request is not an ID registration request, the process proceeds to step 93 (No).

  In step 92, the batch determination unit 360 generates ID information in which the event ID and the rule ID included in the ID registration request are associated with each other by the same method as in step 91, and registers this ID information in the memory 300A.

  In step 93, the batch determination unit 360 determines whether it is an ID deletion request by analyzing a message, for example. If the batch determination unit 360 determines that the request is an ID deletion request, the process proceeds to step 94 (Yes), whereas if the batch determination unit 360 determines that the request is not an ID deletion request, the process proceeds to step 95 (No).

  In step 94, the batch determination unit 360 extracts the event ID and the rule ID from the ID deletion request, and deletes the ID information specified by the event ID and the rule ID from the memory 300.

  In step 95, the batch determination unit 360 refers to the rule table 310 stored in the hard disk 300C and determines whether the event conforms to the rule. If the batch determination unit 360 determines that the event conforms to the rule, the batch determination unit 360 proceeds to step 96 (Yes), while if it determines that the event does not conform to the rule, the process proceeds to step 99. Advance (No).

  In step 96, the batch determination unit 360 determines whether or not the ID information specified by the event ID included in the event and the rule ID of the matched rule is registered in the memory 300A. If the batch determination unit 360 determines that the ID information is registered in the memory 300A, the process proceeds to step 97 (Yes), whereas if the ID determination unit determines that the ID information is not registered in the memory 300A, the process is performed. Proceed to step 98 (No).

In step 97, the batch determination unit 360 notifies the correctness determination unit 370 of a determination result informing that the event conforms to the rule.
In step 98, the batch determination unit 360 requests the notification unit 380 for alert notification.

  In step 99, the batch determination unit 360 determines whether or not the ID information specified by the event ID included in the event and the rule ID related to the alert notification is registered in the memory 300A. If the batch determination unit 360 determines that the ID information is registered in the memory 300A, the process proceeds to step 100 (Yes), while if the ID determination unit determines that the ID information is not registered in the memory 300A, the process is performed. End (No).

In step 100, the batch determination unit 360 notifies the correctness determination unit 370 of a determination result that informs that the event does not conform to the rule.
According to such a batch determination process, when there is an ID registration request or an ID deletion request from the correctness / incorrectness determination unit 370, the batch determination unit 360 of the server 300 registers or deletes ID information in the memory 300A. In addition, the batch determination unit 360 determines, for each event arranged in the order of occurrence, whether or not the event conforms to the rule based on the same rule table 310 as in the real-time determination process. Then, regardless of whether the event conforms to the rule, the batch determination unit 360 notifies the correctness determination unit 370 of the determination result, the event conforms to the rule, and the ID information is registered in the memory 300A. If so, the notification unit 380 is requested to notify the correction of a false alarm.

  FIG. 26 shows another example of correctness determination processing executed by the correctness determination unit 370 of the server 300 in response to the alert information registration request from the real time determination unit 340 or the notification of the determination result from the batch determination unit 360. An example is shown.

  In step 101, the correctness determination unit 370 determines whether the request is a registration request for alert information, for example, by referring to a message type of a registration request or a determination result notification. If the correctness determination unit 370 determines that the request is for alert information registration, the process proceeds to step 102 (Yes), whereas if it is determined that the request is not an alert information registration request, the process proceeds to step 104 (No). ).

  In step 102, the correctness determination unit 370 generates alert information that associates the event ID, rule ID, and event sequence included in the alert information registration request, and registers the alert information in the alert table 320 stored in the hard disk 300C. To do.

In step 103, the correctness determination unit 370 requests the batch determination unit 360 to register ID information for the event ID and the rule ID included in the alert information registration request.
In step 104, the correctness determination unit 370 refers to the determination result included in the determination result notification to determine whether the event related to the determination result notification conforms to the rule. If correct / incorrect determination unit 370 determines that the event conforms to the rule, it proceeds to step 105 (Yes). If it determines that the event does not conform to the rule, it proceeds to step 109. Advance (No).

  In step 105, the correctness determination unit 370 refers to the alert table 320 stored in the hard disk 300C and determines whether or not the alert information specified by the event ID and rule ID included in the determination result notification is registered. . The correctness determination unit 370 advances the process to step 106 if it is determined that the alert information is registered (Yes), and advances the process to step 108 if it is determined that the alert information is not registered (Yes). No).

In step 106, the correctness determination unit 370 deletes the alert information of the event related to the determination result notification from the alert table 320 stored in the hard disk 300C.
In step 107, the correctness determination unit 370 requests the batch determination unit 360 to delete the ID information for the event ID and the rule ID included in the determination result notification.

In step 108, the correctness determination unit 370 requests the notification unit 380 for alert notification.
In step 109, the correctness determination unit 370 refers to the alert table 320 stored in the hard disk 300C and determines whether or not the alert information specified by the event ID and the rule ID included in the determination result notification is registered. . Then, the correctness determination unit 370 advances the process to step 110 if it is determined that the alert information is registered (Yes), and ends the process if it is determined that the alert information is not registered (No).

In step 110, the correctness / incorrectness determination unit 370 requests the notification unit 380 to make a false alarm correction notification.
In step 111, the correctness determination unit 370 requests the batch determination unit 360 to delete the ID information for the event ID and the rule ID included in the determination result notification.

  According to this correctness determination process, when there is a request for registration of alert information, the correctness determination section 370 of the server 300 registers the alert information in the alert table 320 and requests the batch determination section 360 to register ID information. In addition, the correctness determination unit 370 deletes the alert information from the alert table 320 and the batch determination unit 360 if the event related to the determination result notification conforms to the rule and the alert information is registered in the alert table 320. Request deletion of ID information. The correctness determination unit 370 requests an alert notification to the notification unit 380 if the event related to the determination result notification conforms to the rule and the alert information is not registered in the alert table 320. If the event related to the determination result notification does not conform to the rule and the alert information is registered in the alert table 320, the correctness / incorrectness determination unit 370 requests the notification unit 380 for a false alarm correction notification and performs batch determination. Requests deletion of ID information to unit 360.

  Accordingly, the batch determination unit 360 notifies the correctness determination unit 370 of the determination result when the ID information is registered in the memory 300A. For this reason, the correctness determination unit 370 does not need to reconfirm all the determination results in the real-time determination process, and can improve the determination efficiency.

Here, in order to facilitate understanding of the action and effect of the event processing apparatus, an embodiment assuming specific examples will be described.
As a premise of the embodiment, the following conditions are assumed.

(1) A rule applied to an event is “when a human sensor detects the presence of a person while the user is out, the security company is notified of a suspicious person intrusion”.
(2) The human sensor detects the location of a human and simultaneously notifies the server 300 of the event.
(3) The mobile phone 400 with a built-in GPS receiver notifies the server 300 of the user's location information periodically (for example, every minute).
When the user returns home from outside, it is considered that the location of the user is detected by the human sensor before the location information is notified from the mobile phone 400. In this case, as shown in FIG. 27, when an event is notified from the human sensor to the server 300 (procedure 1), the event receiving unit 330 transfers the event to the real-time determination unit 340 and the event alignment unit 350, respectively. (Procedures 2 and 3). The real-time determination unit 340 to which the event has been transferred refers to the rule table 310 of the hard disk 300C, and determines that it matches the rule that the human sensor has detected the presence of a person while the user is out. Then, the real-time determination unit 340 requests the notification unit 380 for alert notification (procedure 4), and requests the correctness determination unit 370 to register alert information (procedure 5). In addition, the event sorting unit 350 to which the event has been transferred accumulates the event in the memory 300A. Upon receiving the alert notification request, the notification unit 380 notifies the security company of an alert (suspicious person intrusion) (procedure 6). The correctness determination unit 370 that has received the alert information registration request registers the alert information in the alert table 320 of the hard disk 300C.

In this state, when an event is notified from the user's mobile phone 400 to the server 300 (procedure 7), the event receiving unit 330 transfers the event to the real-time determination unit 340 and the event alignment unit 350, respectively (procedure 8, 9). The event arranging unit 350 to which the events have been transferred arranges the events in the order of occurrence and sequentially transfers them to the batch determination unit 360 when a predetermined time has elapsed since the start of event accumulation (procedure 10). The batch determination unit 360 to which the event has been transferred refers to the rule table 310 of the hard disk 300C, and determines that it does not conform to the rule that the human sensor has detected the presence of a person while the user is out. Then, the batch determination unit 360 notifies the determination result to the correctness determination unit 370 (procedure 11). The correct / incorrect determination unit 370 that has received the determination result determines that the previously notified alert is incorrect because the event does not conform to the rule and the alert information is registered in the alert table 320, and the notification unit Request for notification of correction of misinformation to 380 (procedure 12). The notification unit 380 that has received the notification of correction of misinformation notifies the security company of correction of misinformation (procedure 13).

  Therefore, even if an alert is erroneously notified from the server 300 to the security company, a false alarm correction notification indicating that the alert is wrong is notified, so the security company does not need to rush to the user's house. In addition, the user does not need to notify the security company that the alert notification is wrong, and the labor can be reduced.

DESCRIPTION OF SYMBOLS 100 Event generation source 300 Server 300A Memory 300B Processor 300C Hard disk 310 Rule table 340 Real-time determination part 350 Event alignment part 360 Batch determination part 370 Correct / error determination part 380 Notification part

Claims (7)

A computer having a storage unit storing rules for processing an event,
Based on the rules stored in the storage unit, the events arriving from the information source are processed in the order of arrival, the events accumulated for a predetermined time are processed in the order of occurrence,
Send the results of processing the events in the order of arrival,
Storing the transmitted result in the storage unit;
When the stored result and the result of processing the event in the order of occurrence are different, the result of processing the event in the order of occurrence is transmitted.
Event processing method. The rule notifies an alert when a predetermined condition is satisfied,
The computer calculates a probability that the result of processing the events in the order of arrival is correct based on a comparison result between the result of processing the events in the order of arrival and the result of processing the events in the order of occurrence. Include
The event processing method according to claim 1. The computer notifies the alert when the probability is greater than a predetermined value;
The event processing method according to claim 2. The storage unit further stores event information processed in the order of arrival,
For the events stored in the storage unit, the computer compares the results of processing the events in the order of arrival with the results of processing the events in the order of occurrence, while the events not stored in the storage unit Process based on rules,
The event processing method as described in any one of Claims 1-3. The computer sends a correction notification of the results of processing the events in the arrival order when the stored results and the results of processing the events in the order of occurrence are different;
The event processing method as described in any one of Claims 1-4. A storage unit storing rules for processing events;
First processing means for processing events arriving from the information source in the order of arrival based on the rules stored in the storage unit;
A second processing means for storing events arriving from the information source for a predetermined time, and processing the events in the order of occurrence based on the rules stored in the storage unit;
The processing result by the first processing means is stored in the storage unit, and when the stored processing result and the processing result by the second processing means are different, the processing result by the second processing means is A transmission means for transmitting;
An event processing apparatus. In a processor of a computer having a storage unit storing rules for processing an event,
Based on the rules stored in the storage unit, the events arriving from the information source are processed in the order of arrival,
Store the event arriving from the information source for a predetermined time, process the events in the order of occurrence based on the rules stored in the storage unit,
Send the results of processing the events in the order of arrival,
Storing the transmitted result in the storage unit;
When the stored result and the result of processing the event in the order of occurrence are different, the result of processing the event in the order of occurrence is transmitted.
An event processing program for executing processing.

Images