JP2016162291A - Process extraction device, process extraction method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to acquire a branch point at which a process changes from an event log in which different subprocesses coexist and a subprocess after branching.SOLUTION: A process extraction device for extracting a process from a set of event log sequences has: an acquisition unit for acquiring one or more branch point candidates which could be a branch point of the process on the basis of the set of event log sequences; and a selection unit for extracting, for each branch point candidate, a set of partial event log sequences at branch destination in each of the event log sequences, acquiring a subprocess at branch destination from the set of extracted partial event log sequences, and solving an optimization problem for a condition required as to the process in relation to each of the branch point candidates and a subprocess acquired for each of the branch point candidates, thereby selecting a branch point of the process from among the branch point candidates.SELECTED DRAWING: Figure 6

Description

  The present invention relates to a process extraction device, a process extraction method, and a program.

  In IT network systems, which are becoming larger and diversifying component devices, failure cases that occur on the system are diversified, making it more difficult to investigate the cause of the anomaly that has occurred and determine how to deal with it. On the other hand, the number of operators called experts who can solve all failure cases is overwhelmingly smaller than the number of systems to be managed. Further, in recent years, the system that is subject to operation management has become particularly large-scale and the operation period has been extended, so that it is difficult to operate a system that depends on the activities of only a specific individual expert. Therefore, there is a need for means for sharing failure recovery procedures by highly skilled experts to the entire operations team. Here, a series of failure recovery procedures from problem determination to completion of countermeasures by operators including experts is defined as a process.

  In general, processes are often tacit as the problem becomes more complex. Therefore, in order to acquire a process, a means for obtaining information that is not grasped by the operator is required. On the other hand, it is called process mining, which accumulates operator actions as data called event logs, and extracts a series of routine procedures that are not understood by the operator from a set of event logs in a specific model format. There are methods (for example, see Non-Patent Document 1), and there are mining applications (for example, see Non-Patent Document 2).

  The process mining method shown in Non-Patent Document 2 is based on the premise that only a single process is extracted from the event log, and includes an operation history at the time of failure handling that includes a record of problem solving for multiple different events. It is difficult to apply to such event logs. For example, let us consider a countermeasure when a certain Web server cannot be connected. If the connection to the Web server is not possible, the operator first checks whether communication from the external terminal to the Web server is possible using a ping command or the like. If communication is impossible, the operator visits the location of the Web server and checks the cause. If communication is possible, the operator identifies the application causing the problem by confirming a log or the like. If the cause is an application, the operator takes measures to reduce the load corresponding to the application.

  In the case of the above example, there are a plurality of causes even when the same abnormality occurs that the Web server cannot be connected, and the actions to be taken differ depending on the cause. It is difficult to classify event logs in advance in consideration of the difference between these multiple causes and countermeasures for each cause because there is no means for identifying the cause. For this reason, a plurality of cause cases and countermeasure cases are mixed in the database for accumulating event logs.

  On the other hand, even in the case of failure recovery procedures for different applications, the same work may be included. For example, when the cause of the inability to connect to the Web server is a runaway application, the countermeasure for preventing the recurrence differs for each application, but in any case, the operation of “system restart” can be included. In actual system operation, there are many operations that need to be performed regardless of the cause of failure, such as “confirmation of lighting state of the device start lamp”.

  Further, the actual event log includes work that results in event log loss and noise. For example, whether or not the status of an application that is not the cause at the time of identifying the cause of the failure differs depending on whether or not the operation is performed.

  FIG. 2 shows the result of configuring the process by the method described in Non-Patent Document 3 using the set of event logs exemplified in FIG. 1 without considering the above circumstances. In FIG. 2, a process in which two different countermeasures for an abnormal factor are intertwined is generated, and the operator is required to make a determination twice regarding a countermeasure to be performed in the middle of the process.

  When the conventional method is applied to an event log in which different countermeasures are mixed as shown in FIG. 1, different sub-processes are mixed, making it difficult to intuitively understand the difference in cause. The method described in Non-Patent Document 3 is a method of inputting a set of event logs and outputting a state transition graph that can output a given event log and has the smallest number of states and transitions. .

W.M.P.van der Aalst, "Process Mining: Discovery, Conformance and Enhancement of Business Processes". Springer, Berlin (2011), pp.125-156 Process Mining, http://www.processmining.org/prom/start W.M.P.van der Aalst; T. Weijters; L. Maruster, "Workflow mining: discovering process models from event logs," IEEE Transactions on Knowledge and Data Engineering, vol.16, no.9, pp.1128-1142, September 2004 A.J.M.M.Weijters; J.T.S.Ribeiro, "Flexible Heuristics Miner (FHM)," 2011 IEEE Symposium on Computational Intelligence and Data Mining (CIDM), pp.310-317, 11-15 April 2011 Ulrike Luxburg, A tutorial on spectral clustering, Statistics and Computing, vol. 17, Issue 4, pp. 395-416, December 2007 W.M.P.van der Aalst; Christian Stahl, "Modeling Business Processes: A Petri Net-Oriented Approach", MIT Press, 2011, pp.91-127 Watanabe, Tatsuaki Kimura, Go Toyono, Keisuke Ishibashi, "Structured Procedures for Trouble Tickets", IEICE Society Conference, 2014 Dan Pelleg; Andrew W. Moore, X-means: Extending K-means with Efficient Estimation of the Number of Clusters.In Proceedings of the Seventeenth International Conference on Machine Learning (ICML '00), pp. 727-734., 2000

  In the case of a task that identifies the cause and takes measures according to each cause, such as a failure handling job, the branch point to the sub-process is the branch where the expert has identified the cause as shown in FIG. It is desirable to acquire a process that includes points explicitly and does not join sub-processes for coping after the cause is identified. However, it has been difficult for the conventional technique to extract a branch point to a sub-process in such a process.

  The present invention has been made in view of the above points, and an object of the present invention is to make it possible to acquire a branch point where a process changes and a sub-process after branching from an event log in which different sub-processes are mixed.

  Therefore, in order to solve the above-described problem, a process extraction apparatus that extracts a process from a set of event log sequences has one or more branch point candidates that may become a branch point of the process based on the set of event log sequences. And a branch destination partial event log sequence set in each event log sequence is extracted for each branch point candidate, and a branch destination subprocess is acquired from the extracted partial event log sequence set. Solving the optimization problem for the conditions required for the process with respect to each of the branch point candidates and the sub-process acquired for each of the branch point candidates, the branch point of the process is determined from among the branch point candidates. And a selection unit for selecting.

  It is possible to acquire a branch point where a process changes and a sub-process after branching from an event log in which different sub-processes are mixed.

It is a figure which shows an example of an event log set. It is a figure which shows an example of the result of having comprised the process by the method of the nonpatent literature 3. FIG. It is a figure which shows an example of the process which the subprocess which concerns on the countermeasure after the cause specification does not merge. It is a figure which shows an example of the acquisition result of the sub process and branching point which are enabled by this Embodiment. It is a figure which shows the hardware structural example of the process extraction apparatus in embodiment of this invention. It is a figure which shows the function structural example of the process extraction apparatus in embodiment of this invention. It is a flowchart for demonstrating an example of the process sequence which a process extraction apparatus performs. It is a flowchart for demonstrating an example of the determination method of a branch destination subprocess.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the present embodiment, the process refers to a series of failure recovery procedures from determination of a problem to completion of handling when a failure of a computer system such as a network system is performed by operators including experts. An expert is an operator called an expert who can solve any failure case.

  In the present embodiment, the process extraction device 10 shown in FIGS. 5 and 6 uses an optimization problem as a problem to obtain a process branch point where the behavior has changed from an event log in which the behavior of an expert or the like is recorded. To obtain the optimum branch point set and sub-process set. A sub-process refers to a partial process that is a component of a process formed by dividing a process into branch points.

  First, the problem to be solved in the present embodiment is formulated.

Assume that an event log string set L is given as an input to the process extraction apparatus 10. At this time, the event log string set L is data as shown below.
L = {Tr ⁽¹⁾ , Tr ⁽²⁾ ,..., Tr ^{(| L |)} }
However, Tr ⁽ⁱ⁾ is the i-th input event log sequence. | · | Represents the number of elements in the set. The input event log string Tr ⁽ⁱ⁾ is the following data in which event logs are arranged, and corresponds to, for example, a certain failure recovery procedure.
_{^{Tr (i) = e (i}} ) 1 e (i) 2 ... e (i) | Tri |
e ⁽ⁱ⁾ _j ∈ A indicates the j-th event log of the i-th input event log sequence, and the number of event logs of Tr ⁽ⁱ⁾ is | Tr _i |. A = {a ₁ ,..., _{A | A |} } is a set of event logs that can be included in the input event log sequence, and the number of types of event logs, that is, the number of elements of A is | A | is there.

Next, a subprocess set P, which is a sequence of event logs, is defined below.
_{^{P (k) = e (k}} ) 1 e (k) 2 ... e (k) | Pk |
e ^(k) _x ∈ A indicates the x-th event log in the k-th sub-process set P ^(k) . | P _k | indicates the number of event logs of P ^(k) . Here, the subprocess is the event log series data, but the actual subprocess set P may be a state transition represented by a finite automaton, Petri-net, or the like (non-patent document). Reference 1 and Non-Patent Document 6).

One of the objects of this embodiment is to acquire a sub-process set P = {P ⁽¹⁾ ,..., P ^{(| P |)} } that can generate the event log string set L. However, | P | represents the number of sub-processes.

For the input event log sequence Tri _i εL, a branch point set B ⁽ⁱ⁾ corresponding to the i-th input event log sequence indicating which sub-process is executed after which sub-process is set. And is defined as follows:
B ⁽ⁱ⁾ = {(b ⁽ⁱ⁾ ₁ , f ⁽ⁱ⁾ ₁ , t ⁽ⁱ⁾ ₁ ), ..., (b ⁽ⁱ⁾ _{| Bi |} , f ⁽ⁱ⁾ _{| Bi |} , t ^{(i )} _{| Bi |} )}
Where b ⁽ⁱ⁾ _j ∈ {1,..., T _i } is the number of the event log immediately before the branch point, f ⁽ⁱ⁾ _j ∈ P is the subprocess before the branch, t ^{(i )} _j ∈P shows subprocess after branching. Note that the number of the event log, the position of the event log from the beginning of the input event log sequence Tr _i (i.e., what number of events in which whether the log) is a numerical value indicating the.

| B _i | is the number of branch points for the i-th input event log sequence. In this embodiment, a subprocess set P is acquired from an input event log string set L, and a set of branch point sets B = {B ⁽¹⁾ ,..., B ^{(| L | )} }.

  An example of input information to the process extraction apparatus 10 and output information from the process extraction apparatus 10 is shown below.

Assume that an event log string set L = {Tr ⁽¹⁾ = uvwxy, Tr ⁽²⁾ = uvyz} is given as an input. At this time,
| L | = 2
e ⁽¹⁾ ₂ = v, e ⁽¹⁾ ₃ = w, e ⁽²⁾ ₄ = z,
A = {u, v, w, x, y, z}, | A | = 6
It is. Although encoded here, each event log actually has some work such as u = “check CPU load status”, v = “check web server log”, etc. And show system log.

Here, among the subprocess sets that can be taken from the event log sequence set L, a subprocess set having the smallest number of event logs Σ ^K _{k = 1} w _k in the sub process set is considered, and the sub process set P = {P ^{(1 )} = Uv, P ⁽²⁾ = wxy, P ⁽³⁾ = yz} At this time,
| P | = 3
B = {B ⁽¹⁾ , B ⁽²⁾ },
B ⁽¹⁾ = {(2, P ⁽¹⁾ , P ⁽²⁾ )},
B ⁽²⁾ = {(2, P ⁽¹⁾ , P ⁽³⁾ )},
| B ₁ | = | B ₂ | = 1,
Can be written.

  When the event log string set L, the sub process set P, and the branch point set B are used, the process indicating the event log string can be expressed as shown in FIG. Compared with the process of FIG. 2 generated by the method of Non-Patent Document 3 called α-algorithm using only the event log string set L, the process shown in FIG. 4 clearly shows the transition to different sub-processes. Expressed on the process.

As described above, the process extraction apparatus 10 according to the present embodiment is a computer that obtains the branch point set B and the sub-process set P for the input event log sequence L ⁽ⁱ⁾ εL as in the above example. . This problem can be generalized as an optimization problem.
(B, P) = argmax _{(B *, P *)} S (L, B *, P *) (1)
In the above description, the subprocess set P and the branch point set B are acquired on the condition that the subprocess set having the smallest number of event logs Σ ^K _{k = 1} | P _k | is obtained. The feature is that in the input event log string set L, a branch point set B and a sub-process set P with respect to the conditions required for the extracted process can be automatically obtained. Any method can be used to obtain subprocesses and branch points that meet the conditions. According to the definition of the score function S in the equation (1), the acquired branch point set B and subprocess set P can be freely changed. For example, the score function S can be expressed as follows by defining it as a problem that maximizes the information entropy from the event log p ^(k) _x in any subprocess to all event logs.
S (L, B, P) = _{Σp (k1) x1εP Σp (k2) x2εPE} (p ^(k1) _x1 , p ^(k2) _x2 )
E (p ^(k1) _x1 , p ^(k1) _x1 ) =-Pr (p ^(k2) _x2 | p ^(k1) _x1 ) logPr (p ^(k2) _x2 | p ^(k1) _x1 )
Pr (p ^(k2) _x2 | p ^(k1) _x1 ) = count (p ^(k2) _x2 , p ^(k1) _x1 ) / count (p ^(k1) _x1 )
However, count (p ^(k1) _x1 ) is the number of appearances of p ^(k1) _x1 in the event log string set L, and count (p ^(k2) _x2 , p ^(k1) _x1 ) is p ^(k2) _x2 p ^(k1) Let _x1 ^denote the number of event log sequences that appear together. For simplification, a set of all event logs in an arbitrary subprocess included in the subprocess set P is expressed as p ^(k) _x εP.

  Hereinafter, the process extraction apparatus 10 will be described in detail. FIG. 5 is a diagram illustrating a hardware configuration example of the process extraction apparatus according to the embodiment of the present invention. The process extraction device 10 in FIG. 5 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, and the like that are mutually connected by a bus B.

  A program for realizing processing in the process extraction apparatus 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not be installed from the recording medium 101 and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 executes a function related to the process extraction device 10 according to a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

  FIG. 6 is a diagram illustrating a functional configuration example of the process extraction apparatus according to the embodiment of the present invention. In FIG. 6, the process extraction apparatus 10 includes an initialization unit 11, a branch point existence determination unit 12, a branch point candidate acquisition unit 13, a branch point selection unit 14, an end condition determination unit 15, an output unit 16, and the like. Each of these units is realized by processing that one or more programs installed in the process extraction device 10 cause the CPU 104 to execute. The process extraction device 10 also uses the event log string set storage unit 17. The event log string set storage unit 17 can be realized by using, for example, a storage device that can be connected to the auxiliary storage device 102 or the process extraction device 10 via a network.

  The event log string set storage unit 17 stores a set of event log strings (event log string set) that are input to the process extraction process. Any event log string may be used as long as it is series data of an ID log corresponding to the work. For example, series data of an operator's input command recorded for a certain failure in the IT management system may be an event log string. Further, an event log based on natural language data may be used by using the data output by Non-Patent Document 7 in which each work in the work history is converted into an ID. Furthermore, information other than a record of human behavior, such as a syslog in which system operations are recorded, may be used as the event log sequence. However, the event log string set is a set of event logs in which different sub-processes are mixed. The process extraction process substantially corresponds to the process branch point and the extraction process of sub-processes constituting the process.

  The initialization unit 11 executes an initialization process in the process extraction process. For example, the initialization unit 11 reads an event log sequence set stored in the event log sequence set storage unit 17.

  The branch point presence determination unit 12 determines the presence or absence of a branch point in the search target of the branch point. The event log string set read by the initialization unit 11 is first searched for a branch point.

  The branch point candidate acquisition unit 13 acquires one or more branch point candidates that are process branch point candidates based on the event log string set.

  The branch point selection unit 14 extracts a set of branch destination partial event log sequences in each event log column for each branch point candidate, acquires a branch destination sub-process from the extracted set of partial event log sequences, and extracts A branch point of the process is selected from among the branch point candidates by solving an optimization problem with respect to a condition required for the process to be performed with respect to each branch point candidate and the subprocess acquired for each branch point candidate. A subprocess is also acquired by selecting a branch point. That is, the subprocess acquired for the branch point candidate selected as the branch point is the target subprocess.

  The end condition determination unit 15 determines whether or not the end condition is satisfied for the recursive processing by the branch point existence determination unit 12, the branch point candidate acquisition unit 13, and the branch point selection unit 14.

  The output unit 16 outputs information indicating the acquired branch point and subprocess.

  Hereinafter, a processing procedure executed by the process extraction apparatus 10 will be described. FIG. 7 is a flowchart for explaining an example of a processing procedure executed by the process extraction apparatus. In the above problem, since the combinations that can be taken by the sub-process set P increase exponentially, the amount of calculation for obtaining the optimum solution becomes enormous. Therefore, as an example of an approximate solution calculation method, a method of recursively searching for branch points from the branched event log string and sequentially obtaining the branch point set B will be described in detail based on FIG.

  In step S101, the initialization unit 11 executes an initialization process. In the initialization process, the event log string set is read from the event log string set storage unit 17, and the read event log string set is set to L. Further, the branch point search target L * = L. Further, the branch point set B = {} and the sub-process set P = {}. Further, the end condition parameter θ and the like are read.

  Subsequently, the branch point presence determination unit 12 determines whether or not a branch point may exist in the branch point search target L * (step S102). For example, if the number of event log strings of the branch point search target L * is | L * | ≦ θ, it may be determined that there is no branch point.

  When it is determined that there is no possibility that a branch point exists (No in step S102), the branch point selection unit 14 acquires a subprocess from the branch point search target L *, and the acquired subprocess is a subprocess set. It adds to P (step S108). The acquisition method of the subprocess set P is not limited to a predetermined method. For example, a sub-process may be acquired by applying a process mining technique such as Non-Patent Document 3 or Non-Patent Document 4.

When it is determined that there is a possibility that a branch point exists (Yes in step S102), the branch point candidate acquisition unit 13 is a branch that is a set of branch point candidates (hereinafter referred to as “branch point candidate c”). A point candidate set C is acquired (step S103). The method for acquiring branch point candidates is not limited to a predetermined method. For example, all the elements eεA of the event log set may be the branch point candidate c. The value of each branch point candidate c constituting the branch point candidate set C is a log number. For example, when event log sequence set L = {Tr ⁽¹⁾ = uvwxy, Tr ⁽²⁾ = uvyz} is given, all elements e∈A of the event log set are set as branch point candidates c. , Branch point candidate set C = {1, 2, 3, 4}.

  In subsequent steps S104 and S105, the branch point selection unit 14 executes a process for selecting the optimal branch point from among the branch point candidates c in the branch point candidate set C acquired in step S103. The optimum branch point is a branch point candidate c that is determined as a branch point.

  The method of selecting the optimum branch point depends on the conditions required for the extracted process. The condition may be input as a parameter at the start of FIG. Here, a branch point candidate that minimizes information entropy based on the assumption that if the transition probability entropy to each event log after branching is minimized, the subprocess after branching becomes a set of coherent event logs. An example in which c is selected as the optimum branch point will be described.

  In step S104, the branch point selection unit 14 executes a process for determining a branch destination subprocess in each branch point candidate c. An example of a branch destination subprocess determination method for each branch point candidate c will be described with reference to FIG.

  FIG. 8 is a flowchart for explaining an example of a branch destination sub-process determination method. In FIG. 8, steps S201 to S206 are executed for each branch point candidate c. Hereinafter, the branch point candidate c to be processed is referred to as “target candidate”.

In step S201, the branch point selection unit 14 extracts a partial event log sequence before the target candidate from each input event log sequence Tr ⁽ⁱ⁾ . A set of the extracted partial event log sequences is expressed as Tr ⁽ⁱ⁾ _pre ∈ L * _pre . For example, the number of partial event log sequences extracted from five input event log sequences Tr ⁽ⁱ⁾ is 5 (that is, the number of elements of Tr ⁽ⁱ⁾ _pre is 5).

Subsequently, the branch point selection unit 14 extracts a partial event log sequence immediately after the target candidate from each input event log sequence Tr ⁽ⁱ⁾ . A set of the extracted partial event log strings is expressed as Tr ⁽ⁱ⁾ _pos ∈ L * _pos . For example, the number of partial event log sequences extracted from five input event log sequences Tr ⁽ⁱ⁾ is 5 (the number of elements of Tr ⁽ⁱ⁾ _pos is 5).

Subsequently, the branch point selection unit 14 clusters L * _pos elements (Tr ⁽ⁱ⁾ _pos ) into κ (step S203). Each cluster is an event log string corresponding to a transition destination subprocess of each event log string after branching. Here, the clustering result of Tr ⁽ⁱ⁾ _pos ∈ L * _pos at the branch point candidate c ^(m) is expressed as CL ^(m) = {L ^(m) ₁ ,..., L ^(m) _κ }.

  Note that the number of clusters κ may be set as a prior parameter, or may be automatically determined using the method described in Non-Patent Document 8. Further, the clustering method is not limited to a predetermined method. For example, Spectral Clustering (see Non-Patent Document 5) or the like may be used as a clustering method for minimizing the graph cut.

Subsequently, the branch point selection unit 14 acquires one subprocess P ^(m) _κ for each cluster L ^(m) _κ εCL ^(m) (step S204). The sub-process acquisition method is not limited to a predetermined method. For example, a process mining technique described in Non-Patent Document 3, Non-Patent Document 4, or the like may be used.

Subsequently, the branch point selection unit 14 acquires one sub-process P ^(m) _pre for the event log string set L * _{pre in} the same manner as in step S204 (step S205). That is, for L * _pre , clustering is not performed (or L * _pre is treated as one class), and subprocess P ^(m) _pre is acquired.

Subsequently, the branch point selection unit 14 converts the branch point candidate set when the target candidate is branched into, for example, the branch point candidate set B ^{(i) (m)} for all branch point candidates c ^(m) by the following calculation. By adding, the branch point candidate set B ^{(i) (m)} is updated (step S206).
B ^{(i) (m)} = B ^{(i) (m)} ∪ {(c ^(m) , _Ppre , P ^{(i) (m)} _κ )}.
However, P ^{(i) (m) (} _kappa ⁾ shows the sub process applicable to partial event log sequence Tr ⁽ⁱ⁾ after a branch point.

Therefore, for example, if the number of sub-processes P ^(m) _pre acquired in step S204 is 3, three elements are added to B ^{(i) (m)} . For these three elements, the value of P _pre is common.

By executing the above-described steps S201 to S206, information at the time of branching at each branch point candidate c is registered in the branch point candidate set B ^{(i) (m)} .

Returning to FIG. Following step S104, the branch point selection unit 14, the score in the case where the branch at each branch point candidates belonging to the branch point candidate set B ^{(i) (m)} is calculated, branch point candidate set B ^{(i) (m )} To select the optimum branch point (step S105). That is, for the subprocess set P ^(m) = {P ^(m) _pre } ｛{P ^(m) ₁ ,..., P ^(m) _κ } when branching, the following score function S is minimized. An optimal branch point B ^* and subprocess P ^* are obtained.
(B ^* , P ^* ) = argmax _(B ^(m) _{, P} ^(m) ₎ S (L, B ^(m) , P ^(m) )
Subsequently, the end condition determination unit 15 determines whether or not the optimum branch point B ^* selected in step S105 satisfies the end condition (step S106). The termination condition is not limited to a predetermined one. For example, the termination condition may be satisfied if S (L, B ^* , P ^* ) does not exceed the threshold value γ. Further, the termination condition may be satisfied if the number of clusters after branching κ = 1.

If the end condition is not satisfied (No in step S106), the end condition determining unit 15 adds the optimum branch point B ^* selected in step S105 to the branch point set B, and further sets the subprocess set P to P = P Update as {P ^* _pre } ∪ {P ^* ₁ ,..., P ^* _κ } (step S107). _Then, ^{L *} κ ∈CL ^* all respect, recursively step S102 and subsequent steps are executed. That is, each cluster obtained for the branch point candidate selected as the optimal branch point B ^{* is set} as a new search target L *, and step S102 and subsequent steps are recursively executed.

  On the other hand, when the termination condition is satisfied (Yes in step S106), the branch point set B and the subprocess set P are not updated. If the process is a recursively called process, control of the caller process is returned. When the process is not a recursively called process (when it is an original process), the output unit 16 may output the contents of the branch point set B and the subprocess set P.

  For example, the branch point set B and the subprocess set P for each event log sequence may be presented to the user. The user can see the subprocess existing in the event log and the branch condition for executing the subprocess, and the presented information can be used, for example, to generate a flowchart for handling a failure. .

  Note that the input of the event log sequence set L and the presentation of the branch point set B and the sub-process set P may not be performed synchronously.

  As described above, according to the present embodiment, it is possible to realize process mining for an event log including a plurality of different sub-processes by extracting process branch points and sub-processes in the event log. it can. That is, it is possible to acquire a branch point where a process changes and a subprocess after branching from an event log in which different subprocesses are mixed.

  In the present embodiment, the branch point candidate acquisition unit 13 is an example of an acquisition unit. The branch point selection unit 14 is an example of a selection unit.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

DESCRIPTION OF SYMBOLS 10 Process extraction apparatus 11 Initialization part 12 Branch point presence determination part 13 Branch point candidate acquisition part 14 Branch point selection part 15 End condition determination part 16 Output part 17 Event log sequence set storage part 100 Drive apparatus 101 Recording medium 102 Auxiliary storage apparatus 103 memory device 104 CPU
105 Interface device B bus

Claims (7)

A process extraction device that extracts processes from a set of event log columns,
An acquisition unit that acquires one or more branch point candidates that may become a branch point of the process based on the set of event log sequences;
For each branch point candidate, a set of branch destination partial event log strings in each event log string is extracted, a branch destination subprocess is obtained from the extracted set of partial event log strings, and is requested for the process A selection unit that selects a branch point of the process from the branch point candidates by solving an optimization problem for a condition with respect to each branch point candidate and the subprocess acquired for each branch point candidate;
A process extraction apparatus comprising: Recursively searching for branch points for the set of partial event log sequences extracted for the branch point candidates selected as the branch points by the selection unit;
The process extraction apparatus according to claim 1, wherein: The selection unit acquires the sub-process for each cluster obtained by clustering the partial event log sequence.
The process extraction apparatus according to claim 1 or 2, characterized in that A process extraction method for extracting a process from a set of event log columns,
Computer
An acquisition procedure for acquiring one or more branch point candidates that are branch point candidates of the process based on the set of event log sequences;
For each branch point candidate, a set of branch destination partial event log strings in each event log string is extracted, a branch destination subprocess is obtained from the extracted set of partial event log strings, and is requested for the process A selection procedure for selecting a branch point of the process from among the branch point candidates by solving an optimization problem for a condition with respect to each branch point candidate and the sub-process obtained for each branch point candidate;
The process extraction method characterized by performing. Recursively searching for branch points for the set of partial event log sequences extracted for the branch point candidates selected as the branch points in the selection procedure;
The process extraction method according to claim 4, wherein: The selection procedure acquires the sub-process for each cluster obtained by clustering the partial event log sequence.
6. The process extraction method according to claim 4, wherein the process is extracted.   A program for causing a computer to execute the process extraction method according to any one of claims 4 to 6.

Images