JP2017204169A - Event determination device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an event determination device capable of determining the scarcity of an event.SOLUTION: An event determination device 1 comprises: a word acquisition part 2; a position information acquisition part 3; a time information acquisition part 4; a first group acquisition part 5 for acquiring a document of a first group on the basis of the occurrence position and occurrence time of an event; a second group acquisition part 6 for acquiring a document of a second group different from a document of the first group on the basis of the occurrence position of the event; a similarity calculation part 7 for calculating similarity indicating the similarity of the documents of the two groups; an appearance frequency calculation part 8 for calculating the appearance frequency of words indicating the event in the document of the first group; a determination part 9 for determining the scarcity of the event on the basis of the similarity and the appearance frequency; and an output part 10 for outputting a determination result of the determination part 9.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an event determination device.

  Conventionally, in a microblog service, there is a method of extracting a document included in an arbitrary category from posted documents by keyword matching with a dictionary prepared in advance. For example, Patent Document 1 describes an apparatus that refers to a place name database and extracts a document including place name information from posted documents.

JP 2014-137632 A

  It is desired to detect the occurrence of a rare event related to security, for example, from a document created by a user and posted to a microblog service. According to the above-described method, for example, a document indicating an event related to security can be extracted. However, the rarity of an event varies depending on where the event occurs.

  An object of this invention is to provide the event judgment apparatus which can judge the rarity of an event.

  In order to achieve the above object, an event determination apparatus according to the present invention is an event determination apparatus that determines the rarity of an event, a word acquisition unit that acquires a preset word indicating an event, and an event Based on position information acquisition means for acquiring position information indicating the position where it occurred, time information acquisition means for acquiring time information indicating the time when the event occurred, a position indicated by the position information, and a time indicated by the time information And a second group of documents different from the first group of documents based on the position indicated by the position information and the first group acquisition means for acquiring the first group of documents from the position and time set. A second group acquisition means for acquiring the similarity, a similarity calculation means for calculating a similarity indicating the similarity between the first group of documents and the second group of documents, and a first group of documents Comprising the occurrence frequency calculating means for calculating the frequency of occurrence of words, based on the appearance frequency and similarity determining means for determining the scarcity of events, and output means for outputting a determination result of the determination means.

  The event determination apparatus according to the present invention calculates the similarity between the first group of documents acquired based on the position and time at which the event occurred and the second group of documents acquired based on the same position, and The appearance frequency of a preset word indicating an event in a group of documents is calculated, and the rarity of the event is determined based on the similarity and the appearance frequency. When a rare event occurs, the frequency of occurrence of a word indicating the event in the document at the position where the event occurred may increase. It is also conceivable that the content of the document at the position where the event occurred changes between the period around the time when the event occurred and the other periods. According to the similarity, it is possible to grasp the change in the content of the document at the position where the event has occurred. Since the rarity of the event is determined based on such appearance frequency and similarity, the rarity of the event can be determined according to the position where the event has occurred.

  In the event determination device according to the present invention, the appearance frequency calculation means calculates and determines the appearance frequency of a preset reaction word in the first group of documents and the appearance frequency of the reaction word in the second group of documents. The means may further determine the rarity of the event by further using the appearance frequency of the reaction word in the first group and second group documents. If the rareness of an event is high, it is considered that many reaction words are used in the document at the time and position where the event occurred. Therefore, by further using the appearance frequency of the reaction word, it is possible to more reliably determine the rarity of the event.

  In the event determination apparatus according to the present invention, the second group acquisition unit may acquire the second group of documents based on the time indicated by the time information. In this case, for example, by setting a document in which the time immediately before the document of the first group is set as the document of the second group, it is easy to grasp the change of the document before and after the occurrence of the event based on the similarity. Thereby, the rarity of the event can be determined more reliably.

  In the present invention, the rarity of an event can be determined.

It is a block diagram of the event judgment device concerning an embodiment. It is a figure which shows the hardware constitutions of the event judgment apparatus of FIG. It is a figure which shows the example of the data which the contribution database has memorize | stored. It is a figure which shows the example of the data which the security related event database has memorize | stored. It is a figure which shows the example of the data which the reaction word database has memorize | stored. It is a figure which shows the example of the data which the rare security relevant event database has memorize | stored. It is a figure which shows the example of a 1st group document and a 2nd group document. It is a flowchart which shows operation | movement of an event judgment apparatus.

  Hereinafter, embodiments of an event determination apparatus according to the present invention will be described in detail with reference to the drawings. In the description of the drawings, the same elements are denoted by the same reference numerals, and redundant description is omitted.

  FIG. 1 is a block diagram of an event determination apparatus 1 according to the embodiment. The event determination device 1 is a device for determining (determining) whether or not an event is rare, that is, whether or not the event occurs with a very low probability. In order to be an event with high rarity, an event needs to occur in a place where the event does not normally occur. In the present embodiment, an event to be determined by the event determination device 1 is a document created by each user and posted to a microblog service such as Twitter (registered trademark), that is, an event extracted in advance from a microblog. Thus, it is a specific category related event related to a specific category. A microblog is a blog written in a short sentence of about 150 characters per line. In the following description, it is assumed that the specific category related event is a security related event that is an event related to security.

  As shown in FIG. 1, the event determination device 1 includes a word acquisition unit 2, a position information acquisition unit 3, a time information acquisition unit 4, a first group acquisition unit 5, a second group acquisition unit 6, and a similarity calculation unit 7. , An appearance frequency calculation unit 8, a determination unit 9, and an output unit 10. The event determination device 1 is connected to each of the posting database 21, the security related event database 22, the reaction word database 23, and the rare security related event database 24 via a network such as the Internet.

  FIG. 2 is a diagram illustrating a hardware configuration of the event determination apparatus. As shown in FIG. 2, the event determination device 1 communicates with one or more CPUs (Central Processing Units) 101, a main storage device such as a RAM (Random Access Memory) 102 and a ROM (Read Only Memory) 103. The communication module 104 and a computer including hardware 105 such as an auxiliary storage device such as a hard disk are included. When these components are operated by a program or the like, the functions of the functional elements of the event determination apparatus 1 of FIG. 1 are exhibited. Note that the event determination device 1 may be configured by a computer system including a plurality of computers. Hereinafter, each functional element and each database shown in FIG. 1 will be described.

  The posting database 21 is a document in which a position and a time are set, and is a device that stores a document created and posted by each user. As illustrated in FIG. 3, the posting database 21 includes a document ID indicating a document, a document, posting position information indicating a posting position where the document is posted, and a posting time that is a time when the document is posted. Is stored in association with post time information indicating. The posting position information may be, for example, a latitude / longitude indicating a point or a mesh ID indicating a mesh. A mesh is a section obtained by dividing an area on a map. When such posted position information is not attached to the posted document, the posted position may be set from the description in the document. For example, a dictionary in which place names are registered in advance is prepared, and if a place name is included in a document by keyword matching with the dictionary, the place name is set as a posting position. In this case, “Damon” is set as the posting position for the document “Awesome rain around Daimon!” In FIG.

  The security-related event database 22 is a device that stores information indicating security-related events to be determined by the event determination device 1. As shown in FIG. 4, the security-related event database 22 includes a security-related event ID indicating a security-related event, a security-related keyword that is a preset word indicating a security-related event, and a position where the security-related event has occurred. The occurrence position information indicating the occurrence position and the occurrence time information indicating the occurrence time, which is the time when the security related event occurred, are stored in association with each other. The generation position information may be, for example, a latitude / longitude or a mesh ID, similar to the posting position information.

  The method for extracting the security related events stored in the security related event database 22 from the microblog is not particularly limited. For example, security-related events may be extracted from a plurality of documents stored in the posting database 21 by keyword matching with security-related keywords. Examples of security-related keywords include explosions, fires, accidents, and terrorism. Such extraction processing is performed, for example, every hour, and security-related events are extracted in real time. The subject of extraction may be the event determination device 1 or another device. When security related events are extracted from a plurality of documents stored in the posting database 21, the posting position and posting time stored in the posting database 21 are treated as the generation position and the generation time, respectively. The contents stored in the security related event database 22 are updated, for example, at the timing when the security related events are extracted. As shown in FIG. 3, the document “Fire in cinema A?” Stored in the posting database 21 includes “fire” as a security related keyword. Therefore, based on this document, the security related event “fire” is extracted. The posting position and the posting time of this document are treated as the occurrence position and the occurrence time of the security related event. As shown in FIG. 4, these pieces of information are stored in the security related event database 22 together with the security related keyword “fire”. Remembered. The event determination device 1 starts processing for determining the rarity of security-related events at the timing when the contents of the security-related event database 22 are updated, for example. The event determination device 1 sequentially determines the rarity of security-related events one by one based on the information stored in the security-related event database 22.

  The reaction word database 23 is a device that stores a reaction word set including a plurality of reaction words set in advance. FIG. 5 is a diagram illustrating an example of data stored in the reaction word database 23. Reaction words are characters and symbols that are highly likely to be used in documents posted near the location of occurrence of highly rare security-related events. The reaction word can be set, for example, by analyzing a document posted in the vicinity of the occurrence position when an extremely rare security-related event actually occurs.

  The rare security-related event database 24 is a device that stores information indicating a rare security-related event that is a security-related event determined to be highly scarce by the event determination device 1. As shown in FIG. 6, the rare security-related event database 24 stores a rare security-related event ID indicating a rare security-related event, a security-related keyword, occurrence position information, and occurrence time information in association with each other. ing.

  The word acquisition unit 2 is a word acquisition unit that acquires a preset word indicating an event. The word acquisition unit 2 acquires from the security related event database 22 a security related keyword associated with a security related event ID indicating a security related event to be determined. The word acquisition unit 2 sends the acquired security-related keywords to the appearance frequency calculation unit 8.

  The position information acquisition unit 3 is position information acquisition means for acquiring position information indicating a position where an event has occurred. The location information acquisition unit 3 acquires the occurrence location information associated with the security related event ID indicating the security related event to be determined from the security related event database 22. The position information acquisition unit 3 sends the acquired occurrence position information to the first group acquisition unit 5 and the second group acquisition unit 6.

  The time information acquisition unit 4 is time information acquisition means for acquiring time information indicating the time at which an event has occurred. The time information acquisition unit 4 acquires the occurrence time information associated with the security related event ID indicating the security related event to be determined from the security related event database 22. The time information acquisition unit 4 sends the acquired occurrence time information to the first group acquisition unit 5 and the second group acquisition unit 6.

  The first group acquisition unit 5 is a first group acquisition unit that acquires a document of the first group from a document in which the position and time are set based on the position indicated by the position information and the time indicated by the time information. is there. The first group acquisition unit 5 inputs the generation position information from the position information acquisition unit 3 and the generation time information from the time information acquisition unit 4. When the first group acquisition unit 5 inputs the generation position information and the generation time information, the first group document is retrieved from the posting database 21 based on the generation position indicated by the generation position information and the generation time indicated by the generation time information. To get. The first group includes documents including security-related keywords that are the basis for extraction when security-related events are extracted from the posting database.

  The second group acquisition unit 6 is a second group acquisition unit that acquires a second group of documents different from the first group of documents based on the position indicated by the position information. The second group acquisition unit 6 further acquires documents of the second document group based on the occurrence time indicated by the occurrence time information. The second group acquisition unit 6 inputs the generation position information from the position information acquisition unit 3 and the generation time information from the time information acquisition unit 4. When the second group acquisition unit 6 inputs the generation position information and the generation time information, the second group document is retrieved from the posting database 21 based on the generation position indicated by the generation position information and the generation time indicated by the generation time information. To get.

  FIG. 7 is a diagram for explaining a method for acquiring the documents of the first group and the second group. The horizontal axis in FIG. 7 indicates time. The first group includes, for example, documents posted in a first period having a preset length around the occurrence time in the occurrence position range that is a position range based on the occurrence position. For example, when the generation position information is indicated by a mesh ID, the generation position range is a mesh indicated by the mesh ID. When the generation position information is indicated by a latitude and longitude, It is a predetermined range (for example, a range having a radius of 100 m) that is set in advance around the indicated point. The first period is, for example, 2 hours. That is, when the occurrence time of the security related event is 18:00, the first period is from 17:00 to 19:00, and the first group is composed of documents posted in the occurrence position range in the first period. The first group of documents is a document that is a target of determination as to whether or not the contents have changed due to a security-related event. Therefore, it can be said that the first period is a period (at the time of determination) that is a target for determining whether or not a highly rare security-related event has occurred. The first group of documents can be said to be a posting group at the time of determination.

  The second group includes, for example, documents posted in the second period before (the past) the first period in the generation position range. That is, when the occurrence time of the security related event is 18:00, the second period is a period before 17:00, and the second group is set in advance among the documents posted in the occurrence position range in the second period. A predetermined number of randomly selected documents or all documents. The second period can be said to be a period (when not determined) that is not subject to determination as to whether or not a highly rare security-related event has occurred. The second group of documents can be said to be a non-determination posting group. The documents of the first group and the second group are both documents (POI (Point of Interest) related posts) posted in the same position range.

  The similarity calculator 7 is a similarity calculator that calculates a similarity indicating the similarity between the first group of documents and the second group of documents. The similarity calculation unit 7 inputs a first group document from the first group acquisition unit 5, inputs a second group document from the second group acquisition unit 6, and inputs security-related keywords from the word acquisition unit 2. . The similarity calculation unit 7 calculates the similarity indicating the similarity between the acquired first group of documents and the second group of documents by a known method. The similarity calculation unit 7 sends the calculated similarity to the determination unit 9.

  The similarity calculation unit 7 converts, for example, the first group of documents into one feature vector, converts the second group of documents into one feature vector, and determines the cos similarity between the two feature vectors. You may calculate as a similarity degree of a document of 1 group, and a document of a 2nd group. The feature vector is a vector having the frequency of occurrence of words appearing in the document as an element. For example, each group of documents is represented by bag-of-words. Each word can be, for example, a morpheme extracted by morphological analysis. The element value of the feature vector, that is, the word appearance frequency may be the number of appearances (appearance frequency), or normalized to the number of word appearances (for example, the number of occurrences of each word is the number of occurrences of all words). It is good also as what gave (processing to divide) (appearance distribution). By performing the normalization process, the similarity can be calculated regardless of the number of simple words appearing. The closer the cos similarity is to 1, the more similar the documents in the first group and the second group, and the closer the cos similarity is to 0, the more similar the documents in the first group and the second group are. Absent. Further, the similarity calculation unit 7 calculates a Jaccard coefficient indicating the similarity between a word set composed of words appearing in the first group of documents and a word set composed of words appearing in the second group of documents. The similarity between the first group of documents and the second group of documents may be calculated. The closer the Jaccard coefficient is to 1, the more similar the documents of the first group and the second group, and the closer the Jaccard coefficient is to 0, the more similar the documents of the first group and the second group are.

  The appearance frequency calculation unit 8 is an appearance frequency calculation unit that calculates an appearance frequency of a preset word indicating an event in the document of the first group. Furthermore, the appearance frequency calculation unit 8 calculates the appearance frequency of the preset reaction word in the first group of documents and the appearance frequency of the reaction word in the second group of documents. The appearance frequency calculation unit 8 inputs a first group document from the first group acquisition unit 5, inputs a second group document from the second group acquisition unit 6, inputs a reaction word from the reaction word database 23, Security related keywords are input from the word acquisition unit 2.

  The appearance frequency calculation unit 8 calculates the appearance frequency of security-related keywords in the first group of documents, the appearance frequency of reaction words in the first group of documents, and the appearance frequency of reaction words in the second group of documents. For example, the appearance frequency calculation unit 8 divides a value obtained by dividing the number of appearances of security-related keywords in the first group of documents by the number of appearances of all words in the first group of documents into the appearance of security-related keywords in the first group of documents. Calculate as frequency. The appearance frequency calculation unit 8 also calculates a reaction word in the first group of documents by dividing the total number of appearances of the plurality of reaction words in the first group of documents by the number of occurrences of all the words in the first group of documents. Is calculated as the appearance frequency of Furthermore, the appearance frequency calculation unit 8 divides the total number of appearances of a plurality of reaction words in the second group of documents by the number of appearances of all the words in the second group of documents, into the reaction words in the second group of documents. Is calculated as the appearance frequency of Note that the number of occurrences of all words in the documents of each group can be, for example, the total number of morphemes extracted by morpheme analysis. The appearance frequency calculation unit 8 sends the calculated appearance frequencies to the determination unit 9.

The determination unit 9 is a determination unit that determines the rarity of an event based on the similarity and the appearance frequency. The determination unit 9 determines the rarity of the event by further using the appearance frequency of the reaction word in the first group and second group documents. The determination unit 9 inputs the similarity between the first group document and the second group document from the similarity calculation unit 7, the appearance frequency of security related keywords in the first group document, and the reaction in the first group document. The appearance frequency of the word and the appearance frequency of the reaction word in the second group of documents are input from the appearance frequency calculation unit 8. For example, the determination unit 9 obtains the rarity R by the following formula (1). Here, sim is the similarity between the first group of documents and the second group of documents, pk is the frequency of appearance of security-related keywords in the first group of documents, and p1 is the frequency of occurrence of reaction words in the first group of documents ( However, when the appearance frequency of the reaction word in the first group document is 0, p1 is 1), and p2 is the appearance frequency of the reaction word in the second group document (however, the appearance frequency of the reaction word in the second group document) When is 0, p2 is 1), and α, β, and γ are positive parameters. Note that pk> 0 since security related keywords always exist in the first group of documents.
R = α (1 / sim) · β (p1 / p2) · γpk (1)

  The determination unit 9 determines the rarity of the security related event based on the rarity R obtained by the above formula (1). For example, the determination unit 9 determines that the rarity of the security-related event is high if the rarity R is greater than a predetermined threshold, and if the rarity R is equal to or less than the predetermined threshold, the security-related event Is judged to be low. The determination unit 9 sends the determination result to the output unit 10.

  The output unit 10 is an output unit that outputs a determination result of the determination unit. The output unit 10 inputs a determination result from the determination unit 9. When the output unit 10 inputs a determination result indicating that the rarity is high, the output unit 10 acquires a security-related keyword from the word acquisition unit 2, acquires the occurrence position information from the position information acquisition unit 3, and the occurrence time information from the time information acquisition unit 4. To get. The output unit 10 stores the acquired security related keywords, occurrence position information, and occurrence time information in the rare security related event database 24. When the output unit 10 inputs the determination result that the rarity is low, the output unit 10 does not perform these processes. Note that the output unit 10 may output the determination result by means other than this, for example, by displaying a map displaying the occurrence time and the security-related keyword at a position corresponding to the occurrence position of the rare security-related event. Also good.

  FIG. 8 is a flowchart showing the operation of the event determination apparatus. As shown in FIG. 8, the event determination device 1 uses the word acquisition unit 2, the location information acquisition unit 3, and the time information acquisition unit 4 to obtain security related keywords, occurrence location information, and occurrence time information as security related events. Obtained from the database 22 (S11). Subsequently, the event determination apparatus 1 uses the first group acquisition unit 5 and the second group acquisition unit 6 to acquire the first group document and the second group document from the posting database 21 (S12). Subsequently, the event determination apparatus 1 uses the similarity calculation unit 7 to calculate the similarity between the first group of documents and the second group of documents (S13). Subsequently, the event determination apparatus 1 uses the appearance frequency calculation unit 8 to generate the security-related keyword appearance frequency in the first group document, the reaction word appearance frequency in the first group document, and the reaction word in the second group document. Is calculated (S14). Subsequently, the event determination device 1 determines the rarity of the security-related event by the determination unit 9 (S15). The event determination apparatus 1 outputs the determination result of the determination part 9 by the output part 10 (S16).

  As described above, the event determination apparatus 1 is configured so that documents posted in the first period, which is a period around the occurrence time, centered on the occurrence time in the occurrence position range of the security related event, The document is acquired as a document, and the document posted in the second period that is a period before the first period is acquired as a document of the second group. The event determination device 1 calculates the similarity between the first group of documents and the second group of documents, and calculates the appearance frequency of security related keywords in the first group of documents. When a security-related event with high rarity occurs, the frequency of appearance of security-related keywords in the document posted in the occurrence position range increases, and the contents of the document posted in the occurrence position range are the first period and the first It can be considered that the period changes in two periods. The similarity decreases as the content of the document changes greatly. Therefore, according to the similarity, it is possible to grasp the degree of change in the content of the document in the generation position range. Since the event determination device 1 determines the rarity of security related events based on such similarity and appearance frequency, it is possible to determine the rarity of security related events according to the occurrence position. In addition, by using two parameters of similarity and appearance frequency, the rarity of security related events can be determined more reliably than when any one of the parameters is used.

  Further, the event determination apparatus 1 calculates the appearance frequency of the reaction word in the first group of documents and the appearance frequency of the reaction word in the second group of documents, The rarity of security related events is determined by further using the ratio of appearance frequencies (= p1 / p2) of documents in the first group of reaction words. Specifically, the event determination apparatus 1 further determines the rarity of security related events by further using a reaction coefficient represented by β (p1 / p2). If the rareness of security related events is high, more reaction words are used for documents posted in the occurrence position range in the first period than in documents posted in the occurrence position range in the second period. It is conceivable that the reaction coefficient becomes larger than 1. Therefore, the event determination apparatus 1 can more reliably determine the scarcity of security related events by further using the reaction coefficient.

  As mentioned above, although embodiment of this invention was described, this invention is not limited to the said embodiment, It deform | transforms in the range which does not change the summary described in each claim, or applied to another thing. There may be.

For example, the determination unit 9 may determine the rarity of the event without using the reaction coefficient. In this case, the determination part 9 calculates | requires the rarity R by following formula (2).
R = α (1 / sim) · γpk (2)

  Further, the first period may be set so that the number of documents in the first group and the second group becomes a number necessary for maintaining the accuracy of similarity calculation. Further, the first group may be composed of only one document (that is, a document including security related keywords), and similarly, the second group may be composed of only one document. In addition, the first group document and the second group document are not limited to documents posted to the microblog service, and may be any document in which a position and a time are set. The document of the second group may be a document in which the position set in the document is included in the range of the occurrence position of the security-related event to be determined and is different from the document of the first group. For example, the document of the second group is not limited to the document posted before (past) the document of the first group, and may be a document posted after the document of the first group. In addition, the number of documents in the first group may not match the number of documents in the second group. Moreover, the event which becomes the judgment object of the event judgment apparatus 1 is not restricted to a security related event.

  DESCRIPTION OF SYMBOLS 1 ... Event judgment apparatus, 2 ... Word acquisition part, 3 ... Position information acquisition part, 4 ... Time information acquisition part, 5 ... 1st group acquisition part, 6 ... 2nd group acquisition part, 7 ... Similarity calculation part, 8 ... appearance frequency calculation part, 9 ... judgment part, 10 ... output part.

Claims (3)

An event judgment device for judging the rarity of an event,
Word acquisition means for acquiring a preset word indicating the event;
Position information acquisition means for acquiring position information indicating a position where the event has occurred;
Time information acquisition means for acquiring time information indicating the time when the event occurred;
First group acquisition means for acquiring a first group of documents from a document in which the position and time are set based on the position indicated by the position information and the time indicated by the time information;
Second group acquisition means for acquiring a second group of documents different from the first group of documents based on the position indicated by the position information;
Similarity calculation means for calculating a similarity indicating the similarity between the first group of documents and the second group of documents;
Appearance frequency calculating means for calculating the appearance frequency of the word in the first group of documents;
Determination means for determining the rarity of the event based on the similarity and the appearance frequency;
Output means for outputting a judgment result of the judgment means;
An event determination device comprising: The appearance frequency calculating means calculates an appearance frequency of a preset reaction word in the first group of documents and an appearance frequency of the reaction word in the second group of documents,
The event determination apparatus according to claim 1, wherein the determination unit determines the rarity of the event by further using the appearance frequency of the reaction word in the documents of the first group and the second group.   The event determination apparatus according to claim 1, wherein the second group acquisition unit acquires the second group of documents based on a time indicated by the time information.

Images