JP2015022429A - Analyzing device, analysis method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform high-accuracy burst detection.SOLUTION: An analyzing apparatus includes: receiving means which receives stream data; storage means which stores the received stream data; input means which receives burst detection of predetermined data from a burst detector which detects a burst where the predetermined data appears highly frequently in the stream data; factor analysis means which analyzes a factor for appearance of the data by referring to stream data obtained a predetermined period before the burst detection, from among the stored stream data; and output means which outputs control information on a criterion for the burst detector to detect a burst, to the burst detector, on the basis of the analyzed factor.

Description

  The present invention relates to an analysis apparatus, an analysis method, and a program.

  In recent years, with the development of network services, CGM (Consumer Generated Media) in which many users post opinions and comments has become widespread, and a large amount of post data can be obtained in real time. For this reason, efforts are being actively made to analyze the stream data (hereinafter referred to as stream data), which is a set of data entered as post data, and to capture trends and trends in the world. Specifically, when the public reacts to an event due to the occurrence of an event, a phenomenon (burst) occurs in which the number of posts increases rapidly within a certain period of time. There is burst detection in stream data.

JP 2007-267151 A JP 2008-311719 A JP 2012-164242 A

  However, the above-described conventional burst detection is performed according to the feature amount or pattern from the value that changes in the stream data, and considers the semantics of the stream data itself or analyzes the factor determined to be a burst point. The cycle is not included in the burst detection cycle, and it is difficult to perform highly accurate burst detection. For example, as an example where it is difficult to perform high-precision burst detection, a set of noises unrelated to the original event occurrence may be erroneously determined as a burst. Moreover, since the threshold value regarded as a burst is not appropriate, a burst may be erroneously determined every time with a small reaction. In addition, a periodic phenomenon may be regarded as a burst.

  In burst detection on social media, the transition information that is the basis of burst determination is calculated for each keyword (term) to be detected, and burst determination is performed. However, since the characteristics differ for each set keyword, it is accurate. In order to detect a burst, it is necessary to analyze and consider factors such as the threshold value, frequency, and periodicity for determining a burst. In the above-described conventional technology, it is necessary to manually perform this analysis and condition setting, which requires human costs.

  The present invention has been made in view of the above, and relates to an analysis apparatus, an analysis method, and a program capable of performing burst detection with high accuracy.

  In order to solve the above-described problems and achieve the object, an analyzer according to an embodiment includes a receiving unit that receives stream data, a storage unit that stores the received stream data, and predetermined data in the stream data. From the burst detection device that detects a burst in which the frequency of occurrence of the burst is increased, and an input unit that receives burst detection of the predetermined data, and the burst detection from the stored stream data based on the received burst detection Factor analysis means for analyzing a factor related to the appearance of the predetermined data with reference to stream data before a predetermined period from the time point, and a criterion for the burst detection device to perform burst detection based on the analyzed factor Output means for outputting control information relating to the burst detection device. The features.

  The analyzer according to the embodiment has an effect of enabling highly accurate burst detection.

FIG. 1 is a conceptual diagram illustrating factor analysis of burst occurrence. FIG. 2 is a block diagram illustrating a functional configuration of the analyzer according to the embodiment. FIG. 3 is a diagram for explaining the contents of the functional configuration of the analyzer according to the embodiment. FIG. 4 is a ladder chart showing an example of the operation of the analyzer. FIG. 5A is a schematic diagram illustrating a data structure related to processing performed by the analysis apparatus. FIG. 5B is a schematic diagram illustrating a data structure related to processing performed by the analysis apparatus. FIG. 5C is a diagram for explaining a data structure related to processing of the analysis apparatus. FIG. 5-4 is a diagram for explaining a data structure related to the processing of the analysis apparatus. FIG. 5-5 is a diagram for explaining a data structure related to processing of the analysis apparatus. FIG. 6 is a flowchart illustrating an example of the operation of the analyzer. FIG. 7 is a flowchart illustrating an example of the operation of the analyzer. FIG. 8 is a flowchart showing an example of the operation of the analyzer. FIG. 9A is a diagram of an example of config data. FIG. 9-2 is a diagram of an example of config data. FIG. 9C is a diagram of an example of config data. FIG. 10 is a conceptual diagram illustrating an example of an information processing system using the analysis apparatus according to the embodiment. FIG. 11 is a diagram illustrating that the processing in the analysis apparatus according to the embodiment is specifically realized using a computer.

  Hereinafter, an analysis apparatus, an analysis method, and a program according to embodiments will be described in detail with reference to the accompanying drawings. In the following description, common constituent elements are given common reference numerals, and redundant description is omitted.

  FIG. 1 is a conceptual diagram illustrating factor analysis of burst occurrence. Specifically, FIG. 1 is a graph showing the relationship between the time and the number of appearances of a specific keyword in stream data, which is a set of data in which a large amount of post data is entered in time series. In FIG. 1, the point (time) at which the number of occurrences of a specific keyword suddenly increases is the burst point at which the burst phenomenon occurs.

  An analysis apparatus according to an embodiment described below analyzes a factor of burst occurrence in the stream data. Specifically, as a trigger for detecting a burst of keywords included in the stream data, the cause and characteristics of the occurrence of the burst event going back to the past of the stream data are analyzed as shown in FIG. The analysis result of the burst generation factor obtained by the analyzer is fed back to the burst detection, thereby enabling high-precision burst detection.

  FIG. 2 is a block diagram illustrating a functional configuration of the analysis apparatus 100 according to the embodiment. FIG. 3 is a diagram for explaining the contents of the functional configuration of the analyzer according to the embodiment.

  As shown in FIG. 2, the analysis device 100 has a functional configuration realized by using a computer (details will be described later), and includes a posting data input IF1, a burst information input IF2, a data storage linkage IF3, a factor analysis external The system includes a linkage IF 4, an event factor output IF 5, a control information providing IF 6, a processing control unit 7, a data storage unit 8, a factor analysis unit 9, a feature amount calculation unit 10, and a statistic calculation unit 11. As shown in FIG. 3, the posting data input IF1, burst information input IF2, data storage linkage IF3, factor analysis external linkage IF4, event factor output IF5, and control information providing IF6 are interfaces (IF) for communicating with external devices. . Moreover, the process control part 7, the data storage part 8, the factor analysis part 9, the feature-value calculation part 10, and the statistic calculation part 11 are core modules.

  The post data input IF1 is an interface for receiving post data that is sequentially entered. The burst information input IF2 is an interface for receiving burst information (keyword, burst time) from the burst detection device 25 (see FIG. 10). The burst detection device 25 is a device that detects a burst in which the appearance frequency of a predetermined keyword is equal to or higher than a predetermined threshold in post data that is sequentially entered. In response to the burst detection, the burst detection device 25 notifies the analysis device 100 of the keyword in which the burst has occurred and the occurrence time (burst time).

  The data storage cooperation IF3 is an interface for storing the posted data in the storage system by outputting the posted data received by the posted data input IF1 to an external storage system. The factor analysis external linkage IF4 is an interface for receiving the burst information by the burst information input IF2 and using a real-time machine learning tool when analyzing the event factor of the burst.

  The event factor output IF5 is an interface for outputting an analysis result of an event factor that causes a burst occurrence to a GUI (Graphical User Interface) or the like and notifying the user. The control information providing IF 6 is an interface for outputting setting information and control information for improving the accuracy of burst detection to the burst detection device 25. The burst detection device 25 uses the information output from the control information providing IF 6 as a criterion for performing burst detection.

  The processing control unit 7 is a program (core module) for controlling each module (functional configuration) of the analysis apparatus 100. The data storage unit 8 is a program for storing post data received by the post data input IF1 in a memory. Further, under the control of the processing control unit 7, the data storage unit 8 reads the posted data stored in the memory and erases past data after a predetermined period.

  The factor analysis unit 9 analyzes the event factor of the burst based on the burst information received from the burst information input IF2. Specifically, the factor analysis unit 9 acquires the data semantics based on the burst information based on the post data acquired from the post data input IF1 and stored in the data storage unit 8, and the event factor of the burst Analyze.

  The feature amount calculation unit 10 is a program that calculates a feature amount (a feature word (keyword), an appearance frequency of the word, and the like) from post data that has become an event factor of a burst. The statistic calculation unit 11 is a program for calculating the statistic of input post data (amount of change in the number of posts for each aggregation window, the amount of posts, etc.).

  Here, the details of the operation in the above-described functional configuration will be described. FIG. 4 is a ladder chart showing an example of the operation of the analyzer 100. FIGS. 5-1 to 5-5 are diagrams for explaining a data structure related to the processing of the analysis apparatus 100. FIG.

  As shown in FIG. 4, the posting data input IF1 receives input of posting data, morphologically analyzes the posting data, and assigns a tag (keyword) (S1). Next, the data accumulating unit 8 saves the post data to which the tag is attached in the memory (database) and sequentially accumulates it (S2). In S1 and S2, as shown in FIG. 5A, the keyword included in the posted data is tagged and the posted data is stored in the database. Accordingly, the factor analysis unit 9 can read the posted data using the tag, time, and the like as the acquisition range.

  FIG. 6 is a flowchart showing an example of the operation of the analysis apparatus 100. More specifically, FIG. 6 shows an example of the operation related to storing post data. As shown in FIG. 6, when the process is started by the input of post data, the data storage unit 8 extracts a tag (keyword) from the post data (S21) and determines whether one or more tags are attached. (S22). When one or more tags are attached (S22: YES), the data storage unit 8 stores the posted data in the memory and registers the tag and counter value in the statistic calculation unit 11 (S23). When one or more tags are not attached (S22: NO) and after S23, the data storage unit 8 reads the next post data (S24), and returns the process to S21.

  Here, the data storage unit 8 performs a process of deleting an old post from post data stored in the database (S3). By this storage process, post data to be analyzed is temporarily stored in the memory in order to analyze the event factors in real time, and the factor analysis unit 9 stores posts that are accumulated while shifting time at an arbitrary timing. Data can be acquired. Also, old post data after a certain time is deleted. This is close to a cache-like position in a computer system.

  In general, the deep analysis that takes the semantics into account and the requirement to ensure the real-time property of a large amount of posted data are trade-offs. The analysis apparatus 100 according to this embodiment is intended to process a large amount of data of several thousand data per second in real time. For this reason, the interface portion for inputting post data is provided with a queue reception function and a queue reception buffer for receiving a large amount of data, and the data is stored in a high-speed memory.

  Further, the post-data is not stored in the memory of the data storage unit 8 for a long time, but is classified by performing machine learning-based classification processing (for example, application of a classification algorithm) in real time via the factor analysis external cooperation IF4. Post data may be stored in the data storage unit 8. And the factor analysis part 9 may acquire the classification result preserve | saved in the data storage part 8 by the burst information of a burst detection.

  In this case, the keyword, time, and classification result are stored in the memory of the data storage unit 8. For example, this method is used to classify by machine learning via the factor analysis external linkage IF4 when you want to analyze emotions whether the cause of the burst is positive or negative when bursting. It is done. Sentiment analysis is effective for keywords and events (for example, new product announcements, press releases, key comments, etc.) that change the way they are captured by the context even with the same keyword. The reason for accumulating the classification results in real time is that it is desired to extract the classification results within a short time after the occurrence of the burst. If no burst occurs, the data storage unit 8 erases the classification results from the old ones in a fixed time. Since the classification result is updated to the latest in time series, a more accurate event factor reflecting the trend can be acquired.

  In addition, when it is difficult to apply real-time machine learning techniques (for example, in association rule extraction that finds a combination of events that are highly synchronized and related, such as when one post occurs, another post occurs, (When it is necessary to acquire the data to be analyzed collectively), the data to be analyzed is acquired retroactively, but since the data to be analyzed can be retrieved at high speed, it is faster than when batch processing is performed. Can be processed.

  In the analysis apparatus 100, when burst information is received by the burst information input IF2 (S4), the factor analysis unit 9 searches for a tag of post data stored in the data storage unit 8 from the keyword and time of the burst (S5). The burst factor is acquired (S6). Specifically, as illustrated in FIG. 5B, the factor analysis unit 9 acquires post data estimated to be a factor of the burst based on the keyword and time of the burst. The acquisition of the burst factor may be from an external tool (real-time machine learning tool) via the factor analysis external cooperation IF4 as described above.

  Next, the factor analysis unit 9 creates an adjacency matrix for each post estimated to be a cause of the burst from the tag of each post, and constructs a graph indicating the connection between the posts. Then, the factor analysis unit 9 analyzes the constructed graph structure to acquire an event factor (for example, a post having the most connections is set as the first event factor).

  FIG. 7 is a flowchart showing an example of the operation of the analysis apparatus 100. More specifically, FIG. 7 shows an example of the operation related to the analysis of the common factor. As shown in FIG. 7, the factor analysis unit 9 determines whether or not the burst information (keyword) matches the tag stored in the memory (S31). If there is no match (S31: NO), the process is terminated.

  When there is a match (S31: YES), the factor analysis unit 9 collects the matched posts and analyzes the event factor due to the connection between the posts described above (S32). Next, the factor analysis unit 9 determines whether or not the event factor has been acquired by the analysis in S32 (S33). If the event factor cannot be acquired (S33: NO), the process ends. When the event factor can be acquired (S33: YES), the factor analysis unit 9 registers the acquired event factor in the feature amount calculation unit 10, passes the acquired event factor to the event factor output IF5 (S34), and performs processing. Exit.

  Returning to FIG. 4, the feature amount calculation unit 10 calculates the feature amount of each post estimated to be a burst factor (S <b> 7). The factor analysis unit 9 outputs the event factor to the GUI through the event factor output IF5 (S8). The output of the event factor is a push type that is spontaneously distributed from the analysis apparatus 100 to an external system such as a GUI, or a pull type that receives a request from an external system such as a GUI and outputs it as a response to the request. Either may be sufficient.

  Next, the control information provision IF 6 acquires the feature amount calculated by the feature amount calculation unit 10 and the statistic amount calculated by the statistic calculation unit 11 (S9). Next, the control information providing IF 6 uses the event factor analyzed by the factor analysis unit 9 and the control information to be a determination criterion when the burst detection device 25 performs the burst detection based on the acquired feature amount and statistic amount. (Config) is generated (S10), and the generated control information is output to the burst detection device 25 in a push type / pull type (S11).

  FIG. 8 is a flowchart illustrating an example of the operation of the analysis apparatus 100. More specifically, FIG. 8 illustrates an example of an operation related to output of control information (config). FIG. 9A to FIG. 9C are diagrams illustrating an example of config data.

  As shown in FIG. 8, the control information providing IF 6 acquires from the factor analysis unit 9 an event factor within X minutes from the reference time (for example, the time when the burst included in the burst information occurs) (S41). An arbitrary value may be set in advance for the X minutes. Next, the control information providing IF 6 determines whether or not a plurality of event factors have been acquired (S42). Here, when a plurality cannot be acquired (S42: NO), the process is terminated.

  When a plurality of event factors can be acquired (S42: YES), the feature amount calculation unit 10 calculates the similarity and occurrence frequency of the event factors (S43). Specifically, as illustrated in FIG. 5C, the feature amount calculation unit 10 analyzes post data analyzed as an event factor by the factor analysis unit 9, and has similar keywords (feature words), The appearance frequency (frequency of appearance) for each keyword is calculated.

  Next, the statistic calculation unit 11 calculates the statistic of the input post data (the amount of change in the number of posts for each aggregation window, the post amount, etc.), and calculates a threshold for performing burst detection for each keyword. (S44). Specifically, as illustrated in FIG. 5-4, the statistic calculation unit 11 obtains a statistic such as the amount of change in the number of posts and the amount of posts for each counting window. And the statistic calculation part 11 calculates the threshold value according to the calculated statistic. For example, when the amount of change in the number of posts and the amount of posts are large, the threshold for each keyword is calculated such that the threshold for performing burst detection for the keyword is increased.

  Next, the control information provision IF 6 controls the control information based on the event factor analyzed by the factor analysis unit 9, the feature amount calculated by the feature amount calculation unit 10, and the statistic / threshold value calculated by the statistic calculation unit 11. To the burst detection device 25 (S45). Specifically, as shown in FIG. 5-5, the control information providing IF 6 generates control information (config) based on the information acquired from the feature amount calculation unit 10 and the statistic amount calculation unit 11, and bursts it. Output to the detection device 25.

  For example, the control information providing IF 6 stores a history of received burst notifications, and when the burst notification interval for the same keyword is shorter than a predetermined value, a command to suppress notification to the burst detection device 25, Control information including a threshold value for further strengthening the criterion for determining the burst is transmitted.

  In addition, for keywords that burst in a similar pattern, determine whether the factors are the same based on the feature amount of the post data that caused the factors, and provide control information so that burst detection can be performed for similar keywords together. You can also. Specifically, the feature amount is calculated after analyzing the burst factor, but a certain amount of feature amount obtained from the latest burst factor is stored as a history, and the similarity between the burst factors is determined. Then, control information (config) in which keywords having high similarity are collected is output to the burst detection device 25. Specifically, when keywords having high similarity are collectively set as a burst detection condition, config data as shown in FIG. 9-1 is sent via a control information providing IF 6 that is an API (Application Programming Interface). Provide in.

  Thereby, the burst detection device 25 can perform more accurate burst detection. For example, if a burst factor is always the same for a keyword in which a burst appears periodically, information for suppressing burst notification for the same factor can be provided to the burst detection device 25. .

  Further, the control information providing IF 6 may acquire the statistics of the posted data and provide the information to the burst detection device 25, thereby finely setting adjustments such as a burst judgment criterion and a threshold for each keyword. Specifically, a burst determination rule, a posting amount, and an acceleration threshold are input as set values to the burst detection device 25 for each keyword. For example, when setting a rule that acceleration increases three times in the time window to be determined and the number of posts is 1000 or more, config data as shown in FIG. 9-2 is provided as control information that is an API. Provide via IF6.

  Further, as shown in FIG. 9C, the control information providing IF 6 may set a time limit (TTL: Time To Live) during which the config is valid and output it to the burst detection device 25. This is because when bursting once, it may burst again due to the same factor for a short period of time, and control information (config) is issued to suppress the second and subsequent bursts, but after a certain period of time has elapsed Used when you want to detect a burst under the same conditions as the previous time. For example, the TTL is specified in seconds, and when the time set in the TTL elapses, the config issued with the TTL becomes invalid and returns to the original burst condition.

  Further, regarding the posted data, the above-described statistics can be acquired from the statistics calculation unit 11. Therefore, the increase / decrease rate (acceleration) of the keyword with respect to the unit time for each keyword may be calculated by the statistic calculation unit 11, and the data storage unit 8 may store the post data only at a location exceeding the threshold. Conversely, when the acceleration is less than the threshold value, the analysis apparatus 100 can grasp whether or not a burst is likely to occur before the burst information is input (in the first place, the burst information is received when there is little posting amount or no change). Therefore, it is possible to skip accumulation of data that does not need to be accumulated in advance. As a result, the system can be realized with a small amount of memory. Also, as an option, if you want to save the data, post data that is likely to be required for event factor analysis is stored in memory, and other post data is stored in inexpensive storage (disk storage via the data storage linkage IF3). Or NAS).

  FIG. 10 is a conceptual diagram illustrating an example of an information processing system 200 using the analysis apparatus 100 according to the embodiment. As shown in FIG. 10, in the information processing system 200, stream data (post data) is input to the analysis device 100 and the burst detection device 25 via the receiver 21, Queues 22 and 24, and the keyword counter 23. The burst information detected by the burst detection device 25 is notified to the analysis device 100 and recorded in the burst detection information database 26. In the stock price prediction system 27, by referring to the burst information recorded in the burst detection information database 26, the stock price prediction is performed in consideration of the burst generated by the reaction of the public to the event. In the GUI 28, the result of the stock price prediction by the stock price prediction system 27 is displayed together with the cause of the burst analyzed by the analysis apparatus 100 and notified to the user.

  In the information processing system 200 that performs stock price prediction and stock trading, immediacy is required. For example, an event factor is analyzed with burst information as a trigger, and a relationship with a stock name is automatically estimated from the event factor. This makes it possible to forecast and buy and sell stocks that are likely to be affected at the same time as the event occurs.

  FIG. 11 is a diagram illustrating that the processing in the analysis apparatus 100 according to the embodiment is specifically realized using a computer. As illustrated in FIG. 11, the computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, for example. The video adapter 1060 is connected to the display 1061, for example.

  The hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above program is stored in, for example, the hard disk drive 1031 as a program module 1093 in which a command to be executed by the computer 1000 is described. For example, a program module 1093 for executing information processing similar to the functional configuration illustrated in FIGS. 2 and 3 is stored in the hard disk drive 1031.

  In addition, setting data necessary for processing in the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1031 to the RAM 1012 as necessary, and executes them.

  The program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1031, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive or the like. Alternatively, the program module 1093 and the program data 1094 are stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.) and read by the CPU 1020 via the network interface 1070. May be issued.

DESCRIPTION OF SYMBOLS 100 ... Analysis apparatus, 1 ... Posting data input IF, 2 ... Burst information input IF, 3 ... Data storage cooperation IF, 4 ... Factor analysis external cooperation IF, 5 ... Event factor output IF, 6 ... Control information provision IF, 7 ... Processing control unit, 8 ... Data storage unit, 9 ... Factor analysis unit, 10 ... Feature quantity calculation unit, 11 ... Statistics quantity calculation unit, 21 ... Receiver, 22, 24 ... Queue, 23 ... Keyword counter, 25 ... Burst detection device 26 ... Burst detection information database, 27 ... Stock price prediction system, 28 ... GUI, 200 ... Information processing system, 1000 ... Computer, 1010 ... Memory, 1011 ... ROM, 1012 ... RAM, 1020 ... CPU, 1030 ... Hard disk drive interface, 1031: Hard disk drive, 1040: Disk drive interface 1041 ... Disk drive, 1050 ... Serial port interface, 1051 ... Mouse, 1052 ... Keyboard, 1060 ... Video adapter, 1061 ... Display, 1070 ... Network interface, 1080 ... Bus, 1091 ... OS, 1092 ... Application program, 1093 ... Program module 1094: Program data.

Claims (7)

Receiving means for receiving stream data;
Storage means for storing the received stream data;
Input means for receiving burst detection of the predetermined data from a burst detection device that detects a burst in which the appearance frequency of the predetermined data is high in the stream data;
Factor analysis means for referring to stream data of a predetermined period before the burst detection time from the stored stream data based on the received burst detection and analyzing a factor related to the appearance of the predetermined data; ,
Based on the analyzed factor, output means for outputting control information to the burst detection device according to a determination criterion when the burst detection device performs burst detection;
An analysis apparatus comprising: The factor analysis means extracts post data that causes the predetermined data to appear from post data included in the stream data,
The output means outputs a term having a high similarity included in the extracted post data to the burst detection device as a keyword for performing the burst detection.
The analyzer according to claim 1. The output means outputs a threshold value for the burst detection based on a statistic obtained by counting the extracted post data to the burst detection device,
The analyzer according to claim 2. The output means makes the control information valid in the control information, sets a period for suppressing burst detection of the predetermined data, and outputs to the burst detection device,
The analyzer according to any one of claims 1 to 3. The storage means stores data obtained by classifying the received stream data by machine learning.
The analyzer according to any one of claims 1 to 4. An analysis method executed by an analyzer,
A receiving step for receiving stream data;
A storage step of storing the received stream data;
An input step of receiving burst detection of the predetermined data from a burst detection device that detects a burst in which the appearance frequency of the predetermined data is high in the stream data;
Based on the received burst detection, a factor analysis step of referring to the stream data before a predetermined period from the time of the burst detection from the stored stream data and analyzing the factor related to the appearance of the predetermined data;
Based on the analyzed factor, an output step of outputting control information to the burst detection device according to a determination criterion when the burst detection device performs burst detection;
The analysis method characterized by including. On the computer,
A receiving step for receiving stream data;
A storage step of storing the received stream data;
An input step of receiving burst detection of the predetermined data from a burst detection device that detects a burst in which the appearance frequency of the predetermined data is high in the stream data;
A factor analysis step of referring to the stream data before a predetermined period from the time of the burst detection from the stored stream data and analyzing the factor relating to the appearance of the predetermined data based on the received burst detection; ,
Based on the analyzed factor, an output step of outputting control information to the burst detection device according to a determination criterion when the burst detection device performs burst detection;
A program for running

Images