JP2020009333A - Information processing device, information processing method, and information processing program - Google Patents

Abstract

To appropriately extract information related to a similarity event.SOLUTION: According to the present application, an information processing device includes an acquisition unit and an extraction unit. The acquisition unit acquires graph information obtained by connecting a plurality of vectors respectively corresponding to a plurality of events in accordance with similarity, event related information being information associated with each of the plurality of events and being information related to the associated event, and information related to one event. The extraction unit retrieves graph information with a starting point vector to be a starting point of retrieving graph information determined on the basis of prescribed reference among a plurality of vectors of the graph information as a starting point, and extracts event related information associated with a similarity event by extracting the similarity event being an event similar to one event among a plurality of events.SELECTED DRAWING: Figure 3

Description

  The present invention relates to an information processing device, an information processing method, and an information processing program.

  Conventionally, techniques for extracting various information have been provided. For example, there has been provided a technique for estimating similarity between concepts in consideration of a relative relationship between concepts belonging to other categories.

JP 2007-213151 A

Masajiro Iwasaki, "Neighborhood Search Using Approximate k-Nearest Neighbor Graph Using Tree Structure Index", Transactions of Information Processing Society of Japan, 2011/2, Vol. 52, No. 2. pp.817-828.

  However, in the above-described related art, it may be difficult to appropriately extract information related to a similar event. For example, merely estimating the similarity between concepts belonging to other categories can only specify the similarity between concepts belonging to other categories. Therefore, for example, the similarity of information belonging to the same category cannot be estimated, and it is difficult to appropriately extract information related to a similar event.

  The present application has been made in view of the above, and has as its object to provide an information processing apparatus, an information processing method, and an information processing program for appropriately extracting information related to a similar event.

  The information processing apparatus according to the present application is a graph information in which a plurality of vectors corresponding to each of a plurality of events are connected according to similarity, and information associated with each of the plurality of events. Event-related information that is information related to the event that has been obtained, an acquisition unit that obtains information about one event, and among the plurality of vectors of the graph information, of the graph information determined based on a predetermined criterion. The graph information is searched using the starting point vector serving as the starting point of the search as a starting point, and among the plurality of events, a similar event that is an event similar to the one event is extracted, thereby being associated with the similar event. An extractor for extracting the event-related information.

  According to an aspect of the embodiment, there is an effect that information related to a similar event can be appropriately extracted.

FIG. 1 is a diagram illustrating an example of information processing according to the embodiment. FIG. 2 is a diagram illustrating a configuration example of the information processing system according to the embodiment. FIG. 3 is a diagram illustrating a configuration example of the information processing apparatus according to the embodiment. FIG. 4 is a diagram illustrating an example of an event information storage unit according to the embodiment. FIG. 5 is a diagram illustrating an example of the index information storage unit according to the embodiment. FIG. 6 is a diagram illustrating an example of the graph information storage unit according to the embodiment. FIG. 7 is a diagram illustrating an example of the model information storage unit according to the embodiment. FIG. 8 is a flowchart illustrating an example of information processing according to the embodiment. FIG. 9 is a flowchart illustrating an example of the generation process according to the embodiment. FIG. 10 is a diagram illustrating an example of feature amount extraction according to the embodiment. FIG. 11 is a flowchart illustrating an example of a search process using graph information. FIG. 12 is a diagram illustrating another example of the information processing according to the embodiment. FIG. 13 is a hardware configuration diagram illustrating an example of a computer that realizes the functions of the information processing device.

  Hereinafter, an information processing apparatus, an information processing method, and an embodiment (hereinafter, referred to as “embodiment”) for implementing an information processing program according to the present application will be described in detail with reference to the drawings. The information processing apparatus, the information processing method, and the information processing program according to the present application are not limited by the embodiment. In the following embodiments, the same portions are denoted by the same reference numerals, and redundant description will be omitted.

(Embodiment)
[1. Information processing)
An example of information processing according to the embodiment will be described with reference to FIG. FIG. 1 is a diagram illustrating an example of information processing according to the embodiment. FIG. 1 illustrates a case where the information processing apparatus 100 extracts similar events (hereinafter, also referred to as “similar events”) by searching graph data (graph information) obtained by graphing events that have occurred in the past in a graph structure. . In FIG. 1, the information processing apparatus 100 uses graph information in which an event is graph-structured using vector data (also simply referred to as “vector”) corresponding to each event. For example, the information processing apparatus 100 uses graph information in which events are graph-structured using a vector obtained by vectorizing log data (also simply referred to as “log”) of each event. In the example of FIG. 1, a case in which an event that occurs in the server system (hereinafter, also referred to as a “server event”) as an event is shown as an example, but the event is not limited to a server event, and any event There may be. For example, there may be various events such as an event relating to railway traffic and an event relating to user behavior such as a user's purchase, but details on this point will be described later. That is, the target event (object) may be any event (information) as long as it can be expressed as a vector.

  The information used by the information processing apparatus 100 is not limited to a vector, and may be any type of information as long as the information can express the similarity of each event. For example, the information processing apparatus 100 may use graph information in which events are graph-structured using predetermined data and values corresponding to each event. For example, the information processing apparatus 100 may use graph information obtained by graphing an event using a predetermined numerical value (for example, a binary value or a hexadecimal value) generated from each event. For example, data of any form may be used as long as a distance (similarity) between data is defined instead of a vector.

[1-1. About graph information)
The information processing apparatus 100 performs information processing on graph data in which each vector (node) is connected by a directed edge, as indicated by the graph information GR11 in FIG. Note that the graph information such as the graph information GR11 in FIG. 1 may be generated by the information processing apparatus 100, or the information processing apparatus 100 may provide the graph information such as the graph information GR11 in FIG. It may be obtained from another external device such as the providing device 50 (see FIG. 2).

  In addition, the directional edge herein refers to an edge that can trace data only in one direction. In the following, a source tracing by an edge, that is, a node serving as a start point is set as a reference source, and a destination tracing by an edge, that is, a node serving as an end point is set as a reference destination. For example, a directed edge connected from a predetermined node “A” to a predetermined node “B” indicates that the reference source is the node “A” and the reference destination is the node “B”. The edge connecting the nodes is not limited to the directed edge, and may be various edges. For example, the edge connecting the nodes may be an edge having no direction connecting the nodes. For example, the edges connecting the nodes may be edges that can be referred to each other. For example, all edges connecting the nodes may be bidirectional edges.

  For example, such an edge having the node “A” as a reference source is called an output edge of the node “A”. Further, for example, an edge having the node “B” as a reference destination is referred to as an input edge of the node “B”. In other words, the output edge and the input edge referred to here are the difference between which one of the two nodes connecting the one directed edge is connected to the other, and which one of the two nodes is the center. Are the output edge and the input edge. In other words, the output edge and the input edge are relative concepts, and when one directed edge is captured with the reference source node as the center, the output edge and the input edge are captured with the reference destination node as the center. In this case, it becomes an input edge. Note that, in the present embodiment, directed edges such as an output edge and an input edge are targeted for the edges, and hence, the directed edges may be simply described as “edges” below.

  For example, the information processing apparatus 100 performs processing on nodes corresponding to millions to hundreds of millions of events, but only a part thereof is illustrated in the drawings. In the example of FIG. 1, for the sake of simplicity, the outline of the process will be described with eight nodes illustrated. For example, as illustrated in the graph information GR11 in FIG. 1, the information processing apparatus 100 acquires graph information including a plurality of nodes (vectors) such as nodes N1, N2, and N3. Further, in the example of FIG. 1, each node in the graph information GR11 is connected to edges (output edges) of a predetermined number of nodes starting from a node having a shorter distance to the node. For example, the predetermined number may be various values such as 2, 5, 10, or 100, depending on the purpose, use, and the like. For example, when the predetermined number is 2, the output edges from the node N1 are connected to a node closest to the node N1 and two nodes closest to the node N1. Note that the distance as an index indicating the similarity may be any distance as long as it can be applied as a distance between vectors (N-dimensional vectors). For example, a distance such as a Euclidean distance, a Mahalanobis distance, or a cosine distance may be used. Various distances may be used.

  Further, when described as “node N * (* is an arbitrary numerical value)”, it indicates that the node is a node identified by the node ID “N *”. For example, when "node N1" is described, the node is a node identified by the node ID "N1".

  In the graph information GR11 in FIG. 1, the node N10 is connected to the edge E7, which is a directed edge toward the node N7. That is, the node N10 is connected to the node N7 by the edge E7. In this way, the description “edge E * (* is an arbitrary numerical value)” indicates that the edge is an edge identified by the edge ID “E *”. For example, when "edge E11" is described, the edge is an edge identified by the edge ID "E11". For example, it is possible to trace from the node N10 to the node N7 by the edge E7 connected with the node N10 as a reference source and the node N7 as a reference destination. In this case, the edge E7, which is a directed edge, becomes an output edge when identified around the node N10, and becomes an input edge when identified around the node N7. Further, the double-headed arrow in the graph information GR11 in FIG. 1 indicates that a directed edge from both nodes to the other node is connected. For example, a two-way arrow between the node N2 and the node N451 in the graph information GR11 indicates that two edges of a directed edge from the node N2 to the node N451 and a directed edge from the node N451 to the node N2 are connected. Indicates that

  Further, the graph information GR11 in FIG. 1 may be a Euclidean space. Further, the graph information GR11 shown in FIG. 1 is a conceptual diagram for explaining the distance between the respective vectors and the like, and the graph information GR11 is a multidimensional space. For example, although the graph information GR11 shown in FIG. 1 is illustrated in a two-dimensional manner to be illustrated on a plane, it is assumed that the graph information GR11 is a multidimensional space such as 100 dimensions or 1000 dimensions.

  Here, the distance between vector data indicates the similarity of events, and the closer the distance, the more similar. In the present embodiment, the distance between the nodes in the graph information GR11 is defined as the similarity between the corresponding objects. For example, it is assumed that the similarity of an object (event) corresponding to each node is mapped as a distance between nodes in the graph information GR11. For example, it is assumed that the similarity between concepts corresponding to each node is mapped to the distance between each node. Here, in the example shown in FIG. 1, the similarity between objects having a short distance between nodes in the graph information GR11 is high, and the similarity between objects having a long distance between nodes in the graph information GR11 is low. For example, in the graph information GR11 in FIG. 1, the node identified by the node ID “N35” is close to the node identified by the node ID “N693”, that is, the distance is short. Therefore, the object corresponding to the node identified by the node ID “N35” and the object corresponding to the node identified by the node ID “N693” have a high degree of similarity.

  Also, for example, in the graph information GR11 in FIG. 1, the node identified by the node ID “N7” and the node identified by the node ID “N2” are remote, that is, the distance is long. Therefore, the degree of similarity between the object corresponding to the node identified by the node ID “N7” and the object corresponding to the node identified by the node ID “N2” is low.

[1-2. Vector generation)
Further, each node (vector) here corresponds to each object (event). If the system log is numerical data indicating various system states, it can be used as it is as vector data. However, if the log data of the system is information that cannot be directly handled as vector data such as numerical data, conversion to vector data is required. For example, if the log data output by the service providing apparatus 50 is character information (text message), conversion to vector data is required. Here, in the example of FIG. 1, a description will be given below assuming that the log data is log data (character information) described using a predetermined natural language (for example, English). In this case, the information processing apparatus 100 may vectorize the log data using various conventional techniques related to natural language processing. For example, the information processing apparatus 100 may generate a vector from log data using an algorithm such as Word2Vec, Sentence2Vec, or Doc2Vec. For example, the information processing apparatus 100 generates a vector from the log data of an event that has occurred in the past using Sentence2Vec. For example, the information processing apparatus 100 generates a vector from the log data LG1, LG2, LG451, etc., which are character information, using Sentence2Vec.

  In the example of FIG. 1, an example in which the information processing apparatus 100 generates an N-dimensional vector from log data of each event using a model of Sentence2Vec will be described. In the example of FIG. 1, the information processing apparatus 100 uses the model (model M1) identified by the model ID “M1” as shown in the model information storage unit 124 (see FIG. 7) to log data of each event. Generate a vector from. As described above, when “model M * (* is an arbitrary numerical value)” is described, it indicates that the model is a model identified by the model ID “M *”. For example, when "model M1" is described, the model is a model identified by a model ID "M1". In addition, as shown in the model information storage unit 124, the model M1 is a model used for vectorizing information in a predetermined system, that is, a model “1” (application), that is, a specific model data is “ Model data MDT1. "

  For example, the information processing apparatus 100 outputs event vector data (vector data) from the model M1 by inputting log data of an event to the model M1 that is Sencence2Vec. Note that the information processing apparatus 100 may use various models according to the type of log data, but details on this point will be described later.

[1-3. Processing example)
From this, the information processing apparatus 100 acquires log data of one event (hereinafter, also referred to as a “query”) from the service providing apparatus 50 and manages the service providing apparatus 50 to provide information on an event similar to the one event. A case where the operation is performed by a person will be described as an example. In the example of FIG. 1, the service providing apparatus 50 is a server that provides a predetermined service and outputs a log, and is a computer managed by the administrator MG1. In the example of FIG. 1, the service providing apparatus 50 generates (outputs) a log according to processing in a predetermined service or the like. The administrator MG1 uses the terminal device 10 to manage and maintain the service providing device 50. The information processing apparatus 100 acquires a log output from the service providing apparatus 50 and, when the log satisfies a predetermined condition, performs a search process of searching for a similar event of an event corresponding to the log.

  In the example of FIG. 1, one event occurs in the service providing apparatus 50 (step S10). For example, in the service providing apparatus 50, an event X, which is one event, occurs. Then, in response to the occurrence of the event X that is the predetermined alert X, the service providing apparatus 50 outputs log data LGX of the event X. The service providing device 50 outputs log data LGX described in a natural language indicating the content of the event X. Then, the service providing apparatus 50 transmits the log data LGX to the information processing apparatus 100. Note that the service providing apparatus 50 may transmit only logs that satisfy a predetermined condition to the information processing apparatus 100. The service providing apparatus 50 may transmit a log indicating the occurrence of an unusual event such as an alert or an error to the information processing apparatus 100.

  Then, the information processing apparatus 100 acquires event information (log data) related to one event (step S11). In the example of FIG. 1, the information processing apparatus 100 acquires log data LGX related to the event X from the terminal device 10. Then, the information processing apparatus 100 determines whether one event satisfies a predetermined condition. The information processing apparatus 100 determines whether one event is an event different from a normal event. In the example of FIG. 1, since the event X is the predetermined alert X, the information processing apparatus 100 determines that the event X is a different event from the normal event. That is, the information processing apparatus 100 determines that the event X satisfies the predetermined condition. Then, the information processing apparatus 100 performs a process of extracting event-related information associated with a similar event of the following event X. That is, the information processing apparatus 100 performs a process of extracting event-related information associated with a similar event of the event X based on the timing at which one event has occurred.

  In the case where the service providing apparatus 50 transmits only the log that satisfies the predetermined condition to the information processing apparatus 100, the information processing apparatus 100 does not perform the condition determination, and the similar event corresponding to the log acquired from the service providing apparatus 50 is performed. May be extracted.

  The information processing apparatus 100 that determines that the event X satisfies the predetermined condition generates a vector used for searching for graph information from the log data LGX corresponding to the event X. In the example of FIG. 1, the information processing apparatus 100 generates a vector corresponding to the event X by a process as shown in a process group PS11. The information processing apparatus 100 inputs the log data LGX relating to the event X to the model M1 (Step S12). Specifically, the information processing apparatus 100 inputs the log data LGX output from the server device of the predetermined server system when the event X occurs to the model M1. As described above, the information processing apparatus 100 generates a vector from the log data LGX using the model M1 by inputting the log data LGX to the model M1 (step S13). That is, the information processing apparatus 100 converts the log data LGX into a vector by inputting the log data LGX to the model M1.

  As described above, the information processing apparatus 100 generates the vector data VDX (also simply referred to as “vector VDX”) from the log data LGX by using the model M1 that is Sencence2Vec. In the example of FIG. 1, the information processing apparatus 100 uses the model M1 that is the Sentence2Vec, such that the first-dimensional element is “0.6” and the second-dimensional element is “0.3”. Generate the vector VDX. Each element (value) of the vector may have various values. For example, each element (value) of the vector may be a real number including a numerical value below a decimal point, or may be an integer.

  Then, the information processing apparatus 100 searches for an event similar to the event X (similar event) (step S14). For example, the information processing apparatus 100 may search for a similar event of the event X by appropriately using various conventional techniques such as a neighborhood search technique disclosed in Non-Patent Document 1.

  In the example of FIG. 1, the information processing apparatus 100 searches for a similar event to the event X using the graph information GR11 and the index information IND11 as shown in the information group INF11. For example, the information processing device 100 acquires the graph information GR11 regarding the event from the graph information storage unit 123 (see FIG. 6). In addition, for example, the information processing apparatus 100 stores, from the index information storage unit 122 (see FIG. 5), the index information IND11 used for determining a node (hereinafter, also referred to as an “origin vector”) serving as a search starting point in the graph information GR11. get. The information processing device 100 may generate the index information IND11, or the information processing device 100 may acquire the index information IND11 from another external device such as the service providing device 50 or an information providing device (not shown). You may.

  Then, the information processing apparatus 100 uses the index information IND11 to determine (identify) a starting vector corresponding to one event (query). In the example of FIG. 1, the information processing apparatus 100 uses the index information IND11 to determine (specify) a starting vector corresponding to the vector VDX of the event X. That is, the information processing device 100 determines a starting point vector in the graph information GR11 using the vector VDX and the index information IND11.

  The index information IND11 in FIG. 1 has a hierarchical structure shown in the index information storage unit 122 in FIG. For example, the index information IND11 indicates that the nodes (vectors) of the first hierarchy located immediately below the root RT are the nodes VT1, VT2, and the like. Also, for example, the index information IND11 indicates that the nodes of the second hierarchy immediately below the node VT2 are the nodes VT2-1 to VT2-4 (not shown). Further, for example, the index information IND11 indicates that the nodes of the third hierarchy immediately below the node VT2-2 are the nodes N35, N451, and N693, that is, the nodes (vectors) in the graph information GR11.

  For example, the information processing apparatus 100 determines a starting point vector in the graph information GR11 using tree-structured index information as indicated by the index information IND11 in FIG. 1 (step S15). In the example of FIG. 1, after generating the vector VDX, the information processing apparatus 100 efficiently traces the index information IND11 from the top to the bottom to identify a starting point vector that is a neighbor candidate of the index information IND11. An origin vector corresponding to the search query (one event) can be determined.

  For example, the information processing apparatus 100 may determine a starting vector corresponding to the vector VDX by tracing the index information IND11 from the root RT to a leaf node (a node (vector) in the graph information GR11). In the example of FIG. 1, for example, the information processing apparatus 100 determines the node N451 as a starting vector by tracing the index information IND11 from the root RT to the node N451. Although the example of FIG. 1 illustrates a case where one starting vector is determined for the sake of simplicity, the information processing apparatus 100 may determine a plurality of starting vectors. For example, the information processing apparatus 100 may determine a plurality of vectors (nodes) such as the nodes N451, N35, N693, and N2 as the starting vector. It is to be noted that, without using the index information IND11, one or more nodes may be randomly selected from the graph information GR11 at the start of the search, and may be used as a starting vector, or one or more nodes specified in advance may be used as starting points. It may be a vector.

  For example, the information processing apparatus 100 may determine the leaf node that has been reached as a starting vector by tracing the index information IND11 from the root RT to the leaf nodes by appropriately using various conventional techniques regarding a tree structure. For example, the information processing apparatus 100 may determine the starting point vector by tracing the index information IND11 downward based on the degree of similarity with the vector VDX. For example, the information processing apparatus 100 may determine which node such as the nodes VT1 and VT2 to follow from the route RT based on the similarity between the vector VDX and the nodes VT1 and VT2. For example, the information processing apparatus 100 may determine to follow from the root RT to the node VT2 having the highest similarity with the vector VDX among the nodes VT1, VT2, and the like. Further, for example, the information processing apparatus 100 may determine to follow the node VT2-2 to the node VT2-2 having the highest similarity with the vector VDX among the nodes VT2-1 to VT2-4. Further, for example, the information processing apparatus 100 may determine to follow from the node VT2-2 to the node N451 having the highest similarity with the vector VDX among the nodes N35, N451, N693, and the like.

  Then, the information processing apparatus 100 extracts a similar event of the event X by searching the graph information GR11 (step S16). For example, the information processing apparatus 100 extracts a node located near the node N451 as a similar event. For example, the information processing apparatus 100 extracts a node whose distance from the node N451 is short as a similar event. For example, the information processing apparatus 100 extracts a node reachable from the node N451 as a similar event by tracing an edge with the node N451 as a starting point. For example, the information processing apparatus 100 extracts a predetermined number (for example, two or ten) of nodes as similar events. For example, the information processing apparatus 100 may extract a similar event to the event X by a search process as shown in FIG. 11, but the details will be described later. In the example of FIG. 1, the information processing apparatus 100 extracts the node N451, the node N35, the node N256, and the like as a similar event by searching for the graph information GR11 with the node N451 as a starting point. For example, the information processing apparatus 100 extracts the nodes N451, N35, N256, and the like in descending order of similarity to the event X.

  Then, the information processing apparatus 100 extracts event-related information associated with the extracted similar event (step S16-1). In the example of FIG. 1, the information processing apparatus 100 extracts event-related information associated with the extracted similar event, as indicated by the similar event list information SEL. For example, the information processing apparatus 100 extracts event-related information associated with each similar event from information stored in the event information storage unit 121 (see FIG. 4). The information processing apparatus 100 extracts information such as a comment, an automatic execution flag, and a score as event-related information. The information processing apparatus 100 extracts event-related information associated with each of event # 451 (node N451), event # 35 (node N35), event # 256 (node N256), and the like, which are extracted as similar events.

  The “automatic execution flag” shown in the similar event list information SEL in FIG. 1 indicates whether or not the information processing apparatus is automatically executed based on the comment. When the “automatic execution flag” is “0”, that is, when there is no automatic execution, it is assumed that the “comment” includes information indicating the content of handling the corresponding event. For example, when the “automatic execution flag” is “0”, it is assumed that the “comment” includes character information indicating the content of handling the corresponding event in a natural language. For example, the comment CM451 indicating the content of handling the event may be information indicating specific content of the handling such as "system restart".

  When the “automatic execution flag” is “1”, that is, when there is automatic execution, the “comment” is command information that is information in a format in which processing can be automatically executed. For example, the comment CM256, which is information in a format in which processing can be automatically executed, may be information (a program, a command, or the like) used for automatic execution.

  “Score” shown in the similar event list information SEL in FIG. 1 indicates the score of the corresponding event. For example, “score” indicates an evaluation of a corresponding event. The “score” may be information indicating evaluation such as a comment indicating a correspondence in a corresponding event. For example, the score SC451 may be a specific numerical value such as “0.5”. For example, the score SC35 may be a specific numerical value such as “3.5”.

  The “similarity” shown in the similar event list information SEL in FIG. 1 indicates the similarity between the corresponding event and the event that has become the search query (hereinafter, also referred to as “target event”). For example, the information processing apparatus 100 may use the similarity calculated in the search processing. For example, the “similarity” may be a value between “0” and “1”. A larger value of “similarity” indicates that the corresponding event is more similar to the target event. For example, the similarity DS451 may be a specific numerical value such as “0.8”. For example, the similarity DS35 may be a specific numerical value such as “0.65”. For example, the information processing apparatus 100 may use the similarity between each similar event and the target event calculated in the search processing.

  Then, the information processing apparatus 100 ranks similar events (step S17). In the example of FIG. 1, the information processing apparatus 100 generates a ranking score for each similar event based on the score, the degree of similarity, and the like of each similar event. For example, the information processing apparatus 100 calculates the ranking score of each similar event by multiplying the score of each similar event by the similarity. In addition, the information processing apparatus 100 may calculate the ranking score of each similar event using not only the above but also various information and calculation formulas.

  In the example of FIG. 1, the information processing apparatus 100 calculates the ranking score of each similar event as indicated by the ranking list information RKL. The information processing apparatus 100 calculates the ranking score of the event # 451 as the ranking score RS451. Further, the information processing apparatus 100 calculates the ranking score of the event # 35 as the ranking score RS35. Then, the information processing apparatus 100 ranks each similar event based on the ranking score of each similar event. The information processing apparatus 100 ranks similar events in descending order of similarity score. In the example of FIG. 1, the information processing apparatus 100 ranks the first place “event # 35”, the second place “event # 2”, the third place “event # 451”, and the like in descending order of the ranking score. The information processing apparatus 100 may rank the similar events using not only the ranking score but also various information as appropriate.

  Then, the information processing apparatus 100 determines a provision target event (step S18). In the example of FIG. 1, the information processing apparatus 100 determines the event # 35 having the first rank as the provision target event. Note that the information processing apparatus 100 may determine not only one event but a plurality of events to be provided events.

  Then, the information processing apparatus 100 provides information on the determined provision target event (step S19). In the example of FIG. 1, the information processing apparatus 100 uses the information indicating the event # 35 to be provided and the comment CM35 of the event # 35 as an event similar to the event X and the content of handling the event X by the administrator MG1. It is provided to the terminal device 10 to be used. In addition, the information processing apparatus 100 may provide the log data LGX of the event X to the terminal device 10 used by the administrator MG1, together with the information on the event # 35, which is the provision target event. The administrator MG1 that has received the comment CM 35 from the information processing device 100 responds to the event X that has occurred in the service providing device 50 based on the comment CM 35 (step S20).

  As described above, the information processing apparatus 100 uses the graph information GR11 and the index information IND11 to extract a similar event to the event X obtained from the administrator MG1. For example, the information processing apparatus 100 determines a starting point vector in the graph information GR11 when extracting a similar event of the event X using the index information IND11. Then, the information processing apparatus 100 extracts a similar event of the event X by searching the graph information GR11 using the determined starting vector as a starting point. Thereby, the information processing apparatus 100 can appropriately extract information related to the similar event. The information processing apparatus 100 can extract information related to the similar event at high speed. For example, the information processing apparatus 100 can extract information related to a similar event at a higher speed than when the administrator MG1 or the like manually extracts a similar event.

  For example, there is a method of identifying events by a method such as deep learning, but when there are various types of events, it is difficult to improve the identification accuracy without learning because there are few cases of each event There is a problem. For example, there is a method of using a model generated by a learning method such as deep learning, inputting event information into the model, and identifying the event from the output score.However, in the case where there is a wide variety of events, Since the number of cases of each event is small, it is difficult to improve the accuracy of the model, and it is difficult to improve the accuracy of identifying the event. On the other hand, the information processing apparatus 100 appropriately searches for similar events similar to the occurred event by performing a search using graph information obtained by graphing a plurality of vectors generated based on features extracted from each event. Can be extracted. Therefore, the information processing apparatus 100 can accurately identify what kind of event the generated event corresponds to.

  Then, the information processing apparatus 100 extracts the event-related information associated with the similar event, and provides the event-related information. For example, when the comment of the event-related information is described in a natural language, the information processing apparatus 100 provides the comment to a system administrator such as the administrator MG1 of the service providing apparatus 50. Thereby, the administrator of the system that has received the event-related information from the information processing apparatus 100 can take appropriate action based on the event-related information. Further, for example, when the comment of the event-related information is command information that can be automatically executed by the information processing device, the information processing device 100 provides the comment to an information processing device such as the service providing device 50. Accordingly, the information processing device that has received the event-related information from the information processing device 100 can automatically execute appropriate processing based on the event-related information. The event-related information is not limited to the above and may include various information. The event-related information may store information indicating an analysis result of the event. The event-related information may store information indicating the reason or importance (severity level) based on the analysis result of the event.

  For example, in an operation at the time of occurrence of an event (server event) in a server system such as a system failure, if an attempt is made to perform a search with an exact match of an alert message, there is a problem that the message is extremely vulnerable to a change or shaking of the message. Further, if distance calculation is simply performed on registered data, fluctuations are increased, but there is a problem that a processing load increases with an increase in the data amount. Therefore, in the information processing system 1, a log such as an alert message or a comment such as trouble countermeasure comment information is vectorized to form a graph structure. Then, the information processing system 1 searches the graph-structured data at a high speed, and makes it possible to cope with a system failure or the like based on the search result information, thereby promptly coping with an event occurring in the system. It can be carried out.

  Further, in the information processing system 1, a log such as an alert message is used as a key, and a comment such as a corresponding treatment method is associated with the log to form a database. When a new event such as an alert occurs, a similar past event is generated. The information is extracted, the corresponding treatment method information is also added to the information indicating the event, and the information is notified to an administrator (operator) such as the administrator MG1. As described above, in the information processing system 1, not only an event such as a failure, but also a countermeasure for the event is notified to the operator, so that the failure can be quickly dealt with. In the information processing system 1, by associating each event with an automatic execution flag, it is possible to realize automated execution of a corresponding measure. In addition, regarding the automatic execution of the corresponding measures, whether or not the automatic execution is possible may be registered as a master for each trouble event and the content of the measures, and the execution processing may be performed based on the master information. Further, in the information processing system 1, when there is no automatic execution flag, the system operator is notified and the corresponding action can be executed manually by the operator. Thus, for example, in the information processing system 1, after the occurrence of an event, the past log master (graph information) is searched, the search result is notified to the operator, the automatic execution of the correction is confirmed, and the correction is executed. Can be realized.

[1-3-1. Automatic execution)
Also, in the example of FIG. 1, when the order of the event # 256 whose automatic execution flag is “1” is the first place, the information processing apparatus 100 provides the comment CM 256 of the event # 256 to the service providing apparatus 50. Is also good. The information processing apparatus 100 may provide the service providing apparatus 50 with a comment CM256 that is command information for automatically executing the process. In this case, the service providing apparatus 50 that has received the comment CM 256 from the information processing apparatus 100 may automatically execute a process based on the comment CM 256. When the content of the automatic processing of the comment CM 256 is “restart”, the service providing apparatus 50 may automatically execute the restart processing based on the comment CM 256. Note that the information processing apparatus 100 may provide a comment on the automatic execution of the process to the terminal device 10 used by the administrator MG1. For example, even if the event # 256 in which the automatic execution flag is “1” is ranked first, the information processing apparatus 100 may provide the comment CM256 to the terminal device 10 used by the administrator MG1. Good. In this case, the administrator MG1 determines whether or not the service providing apparatus 50 should execute the processing based on the comment CM 256, and if the administrator MG1 determines that the service providing apparatus 50 should execute the processing, the comment CM 256 may be provided to the service providing apparatus 50. .

[1-3-2. Other information provision modes]
Note that the information processing apparatus 100 may provide event-related information associated with each extracted similar event. In this case, the information processing apparatus 100 may provide the event-related information associated with each extracted similar event without performing the processing of steps S17 and S18. For example, the information processing apparatus 100 may provide event-related information in which the automatic execution flag is “0”. For example, the information processing apparatus 100 uses the comment CM 451 of the event # 451 and the comment CM 35 of the event # 35 whose automatic execution flag is "0" as information indicating the response to the event X, and the terminal apparatus 10 used by the administrator MG1. May be provided. In this case, the information processing apparatus 100 does not need to provide the comment CM256 of the event # 256 in which the automatic execution flag is “1” to the terminal device 10 used by the administrator MG1.

[1-4. Event)
In the example of FIG. 1, an event (server event) in the server system is shown as an example of the event, but the event is not limited to the server event, and may be various events. In other words, the information processing apparatus 100 may target various events such as events in a predetermined society. For example, the information processing apparatus 100 may target various events such as events in disasters and economic activities such as natural disasters, wars and accidents. For example, the information processing apparatus 100 may extract a similar event as an event, such as an event related to various traffics such as a road, a railroad, aviation, and a ship, or an event related to user behavior such as a user's purchase.

[1-4-1. Railway)
For example, the information processing apparatus 100 may extract a similar event for an event related to public transportation as an event. For example, the information processing apparatus 100 may extract a similar event and extract event-related information for an event that occurs in a railway. For example, the information processing apparatus 100 may extract similar events and extract event-related information for events such as delays and operation suspensions occurring in railways. In this case, the information processing apparatus 100 may generate the graph information by vectorizing character information indicating an event such as a delay or operation suspension. For example, the information processing apparatus 100 may generate graph information by vectorizing logs indicating events such as a delay pattern and an operation stop pattern. For example, the information processing apparatus 100 may log events indicating events such as a delay pattern such as “AA line X delay → BB line Y minute delay →. Graph information may be generated by vectorizing (character information).

  In addition, the information processing apparatus 100 may associate the reason (cause) of delay or operation suspension with each event as event-related information. In addition, the information processing apparatus 100 may associate details of measures to be taken for delays and operation suspensions with each event as event-related information. The information processing apparatus 100 may associate, as event-related information, information indicating a guiding action performed at the time of delay or operation suspension with each event. In addition, the information processing apparatus 100 may associate, as event-related information, information indicating an alternative that can be provided to a user (user) with respect to delay or operation suspension, for each event.

  Then, when the log at the time of occurrence of the delay is acquired, the information processing apparatus 100 performs a similarity search using the log, extracts a similar event, and extracts event-related information associated with the similar event. May be. Then, the information processing apparatus 100 may provide information indicating the guidance action included in the extracted event-related information to a railway manager or the like. Then, the railroad administrator who receives the information indicating the guidance action performs a measure based on the guidance action. As a result, the railroad administrator can quickly take appropriate measures for an event such as a delay.

[1-4-2. User behavior)
Further, the information processing apparatus 100 may extract a similar event as an event, for example, an event related to a user action. The information processing apparatus 100 may extract a similar event for an event related to a user's purchase. For example, the information processing apparatus 100 may extract a similar event of the user's purchase behavior based on the acquired user behavior by using a technology related to IoT (Internet of Things) or the like.

  For example, the information processing apparatus 100 may extract a similar event and extract event-related information for an event that the user has purchased a product or service (hereinafter, also referred to as “product etc.”). In this case, the information processing apparatus 100 may generate the graph information by vectorizing character information indicating a product or the like purchased by the user or a context (time, place, or the like) at the time of purchase. For example, the information processing apparatus 100 may generate graph information by vectorizing a log indicating a user's purchase event.

  Further, the information processing apparatus 100 may associate, as the event-related information, the reason why the user who performed the purchasing action purchased the product or the like with each event. In addition, the information processing apparatus 100 may associate, as the event-related information, the details of the action performed on the user who has performed the purchasing behavior with each event. The information processing apparatus 100 may associate, as event-related information, information indicating a response that has been effective for a user who has performed a purchasing action, with each event. For example, the information processing apparatus 100 recommends, as event-related information, a user who has performed a purchasing action, and uses information indicating a product or the like purchased by the user as information indicating an effective response for each event. It may be associated.

  Then, when the log at the time of occurrence of the user's purchasing behavior is acquired, the information processing apparatus 100 performs a similarity search using the log to extract a similar event, and associates the event with the similar event. Information may be extracted. Then, the information processing apparatus 100 may provide, to a predetermined manager or the like, information indicating a response that has been effective for the user who has performed the purchasing behavior included in the extracted event-related information. For example, the information processing apparatus 100 may provide a marketer, a service manager, and the like with information on a similar event such as information indicating a response that has been effective for a user who has performed a purchasing action. Then, the administrator who receives the information performs a countermeasure based on the information. As a result, the administrator can take an approach such as recommending an appropriate product to the user who has performed the purchasing action.

[1-5. Index information)
The index information (index data) illustrated in the example of FIG. 1 is an example, and the information processing apparatus 100 may search for graph information using various types of index information. Further, for example, the information processing apparatus 100 may generate index data used at the time of a search. For example, the information processing apparatus 100 generates a search index for searching for a high-dimensional vector as index data. Here, the high-dimensional vector may be, for example, a vector of several hundred to several thousand dimensions, or a vector of higher dimensions.

  For example, the information processing apparatus 100 may generate a search index for a tree structure (tree structure) as shown in FIG. 1 as index data. For example, the information processing apparatus 100 may generate a search index for a kd tree (k-dimensional tree) as index data. For example, the information processing apparatus 100 may generate a search index for a VP tree (Vantage-Point tree) as index data.

  Further, for example, the information processing apparatus 100 may generate index data having another tree structure. For example, the information processing apparatus 100 may generate various index data in which the leaves of the tree-structured index data are connected to the graph data. For example, the information processing apparatus 100 may generate various index data in which the leaves of the tree-structured index data correspond to the nodes in the graph data. When performing a search using such index data, the information processing apparatus 100 may search for graph data from a leaf (node) reached by following the index data.

  The above-described index data is an example, and the information processing apparatus 100 may generate index data having any data structure as long as a query in the graph data can be specified at high speed. . For example, if the information processing apparatus 100 can quickly identify a node in graph information corresponding to a query, the information processing apparatus 100 generates index data by appropriately using various conventional techniques such as a technique related to binary space division. You may. For example, the information processing apparatus 100 may generate index data having any data structure as long as the index can support a search for a high-dimensional vector. For example, the information processing apparatus 100 may use information on a graph-type search index as described in Non-Patent Document 1 as index information. The information processing apparatus 100 can enable a more efficient search for a predetermined target by using the index data and the graph data as described above.

[1-6. Example of vector generation)
Note that, in the example of FIG. 1, a case has been described as an example where the information processing apparatus 100 generates a vector from log data using the model M1 that is Sentence2Vec. However, the information processing apparatus 100 uses various models as appropriate. The log data may be vectorized. For example, when the log data of the system is character information (text message), an image, a voice, or the like including a case where the log data is described in a language other than a natural language, the information processing apparatus 100 performs the following processing. , The log data may be vectorized.

  For example, the information processing apparatus 100 may generate an N-dimensional vector from the log data of each event using a model that extracts the characteristics of the log data. In the example of FIG. 10, the information processing apparatus 100 may generate a vector from log data of each event using a model identified by the model ID “M21” (model M21).

  For example, the information processing apparatus 100 calculates the value of each element (neuron) in the model M21 by inputting log data of an event to the model M21, and outputs information similar to the input log data. For example, the information processing apparatus 100 may extract the value of each element (neuron) of the intermediate layer as a feature amount and generate N-dimensional vector data corresponding to each event.

  Here, an example of generation of vector data corresponding to each event will be described with reference to FIG. FIG. 10 is a diagram illustrating an example of feature amount extraction according to the embodiment. FIG. 10 is a conceptual diagram of the model M21. Note that, in FIG. 10, illustration of a line indicating each connection relationship of each element (neuron) is omitted. As shown in FIG. 10, the model M21 includes an input layer IL, an intermediate layer CL, and an output layer OL. For example, the input layer IL of the model M21 is a layer to which log data of an event is input. The output layer OL is a layer from which information similar to the input log data is output according to an input to the input layer IL.

  Further, for example, the most compressed compression layer RP at the center of the intermediate layer CL is a layer that expresses the characteristics of the input log data. For example, in the intermediate layer CL of the model M21, a portion from the input layer IL to the compression layer RP corresponds to a portion where the encoding process is performed. In the intermediate layer CL of the model M21, a portion from the input layer IL to the compression layer RP corresponds to a part for performing a process of compressing the characteristics of the input log data. For example, in the intermediate layer CL of the model M21, a portion from the compression layer RP to the output layer OL corresponds to a portion for performing a decoding process. In the intermediate layer CL of the model M21, a portion from the compression layer RP to the output layer OL corresponds to a portion for performing processing for restoring compressed log data.

  For example, the information processing device 100 may use information on the neurons NL1 and NL2 included in the compression layer RP as a vector. For example, when event log data is input, the information processing apparatus 100 extracts a value VE1 corresponding to the calculated neuron NL1 or a value VE2 corresponding to the neuron NL2 as a vector element (one-dimensional value). May be. For example, when log data of an event is input, the information processing apparatus 100 may extract the value VE1 corresponding to the calculated neuron NL1 as a first-dimensional element of the vector of the event. Further, for example, when log data of an event is input, the information processing apparatus 100 may extract the value VE2 corresponding to the calculated neuron NL2 as a second-dimensional element of the vector of the event. As described above, the information processing apparatus 100 may generate a vector corresponding to each event by inputting log data of each event to the model M21. Note that the information processing device 100 may acquire a vector corresponding to each event from another external device such as the service providing device 50. Note that the information processing apparatus 100 may use, as each element of the vector, a value itself corresponding to each neuron, or a value obtained by multiplying a value corresponding to each neuron by a predetermined coefficient.

  Note that the information processing apparatus 100 may use not only the elements (neurons) of the compression layer RP but also information of other elements (neurons) in the intermediate layer CL as the vector. For example, the information processing apparatus 100 may use information such as the neuron NL3 of the encoding part and the neuron NL4 of the decoding part as the vector. For example, when log data of an event is input, the information processing apparatus 100 extracts a value VE3 corresponding to the calculated neuron NL3 and a value VE4 corresponding to the neuron NL4 as vector elements (one-dimensional values). May be. Note that the above is an example, and the information processing apparatus 100 may extract features from log data using various models without being limited to the auto encoder. For example, a model trained to identify a normal event and an event different from normal may be generated, and the intermediate layer may be extracted as vector data. Further, for example, a model may be generated by a method of learning similarity such as triplet loss. Further, the information processing apparatus 100 may perform feature extraction without using a model. For example, the information processing apparatus 100 may generate a vector by extracting information corresponding to a feature (feature) from log data set by an administrator or the like of the information processing apparatus 100. For example, the information processing apparatus 100 may extract information corresponding to a feature (feature) such as an error code or an error occurrence location from log data, and generate a vector.

  Further, for example, the information processing apparatus 100 may acquire the model M21 from another external device such as the service providing device 50. The information processing apparatus 100 may generate the model M21 by using the log data LG1, LG2, LG451, and the like of each event stored in the event information storage unit 121 (see FIG. 4). For example, the terminal device 10 may generate the model M21 by using the log data LG1, LG2, LG451, and the like output by the server device of the predetermined server system when each event occurs as an input. For example, the log data LG1, LG2, LG451, etc. may be logs (alert logs, error logs, etc.) output by the server device. For example, the log data LG1, LG2, LG451, etc. may be error messages output by the server device.

  The information processing apparatus 100 includes an input layer to which log information (log data) of an event is input, an output layer, and a first element belonging to any of the layers from the input layer to the output layer and belonging to a layer other than the output layer. And a second element whose value is calculated based on the first element and the weight of the first element. For each piece of log information input to the input layer, each element belonging to each layer other than the output layer is By performing an operation based on the first element and the weight of the first element as one element, a model M21 that outputs the same information as the information input to the input layer from the output layer may be generated. Note that the information processing device 100 may acquire a model used for vector generation from another external device such as the service providing device 50.

[1-7. Node (object)]
In the example of FIG. 1, each event is defined as a node (object), and the graph information GR11 in which the event corresponds to the node (object) on a one-to-one basis has been described as an example. 1 does not have to be used. The information processing apparatus 100 may use graph information in which each event is set as one node based on a predetermined similarity relationship.

  For example, the information processing apparatus 100 may use graph information in which an event group whose similarity is equal to or larger than a predetermined threshold is set as one node. For example, the information processing apparatus 100 may use graph information in which an event group corresponding to a similar network connection error is set as one node. For example, the information processing apparatus 100 may use graph information in which an event group corresponding to a similar database timeout is set as one node. In this case, the information processing apparatus 100 may store information indicating the number of events corresponding to each node in the storage unit 120 (see FIG. 3). For example, the information processing apparatus 100 may store the number of events corresponding to each node in the storage unit 120 as information indicating the actual number of events corresponding to the event. In this case, the information processing apparatus 100 may use information (value) indicating the number of achievements of each node for calculating the ranking score. For example, the information processing apparatus 100 uses, as a ranking score, a value obtained by multiplying a value indicating the similarity between the query and each node (vector), a score of each node (vector), and a value indicating the actual number of each node. Is also good.

[1-8. Other usage examples)
Note that the information processing apparatus 100 may be variously used by various administrators such as the administrator MG1. For example, the information processing apparatus 100 may be capable of providing various services to various administrators such as the administrator MG1. This will be described with reference to FIG. FIG. 12 is a diagram illustrating another example of the information processing according to the embodiment. Note that, in FIG. 12, a case in which the information is provided to the administrator MG1 among various administrators is described as an example, and description of the same points as in FIG. 1 will be omitted as appropriate.

  The information processing device 100 may provide a search service to the administrator MG1. The information processing device 100 may perform a similarity search in response to a request from the administrator MG1. The administrator MG1 requests the information processing apparatus 100 to perform a similarity search (step S21). For example, the administrator MG1 requests the information processing apparatus 100 to perform a similarity search of the event Y by transmitting the log data LGY of the event Y. The information processing apparatus 100 that has acquired the log data LGY of the event Y from the administrator MG1 extracts a similar event of the event Y using the log data LGY. Then, the information processing apparatus 100 provides the extracted information on the similar event (similar event information) as a search result to the administrator MG1 (step S22). For example, the information processing apparatus 100 provides information indicating a similar event of the event Y and event-related information associated with the similar event to the terminal device 10 used by the administrator MG1.

  The information processing device 100 may provide an analysis service to the administrator MG1. The information processing apparatus 100 may provide information on logs collected in the past in response to a request from the administrator MG1 (Step S31). The information processing device 100 provides the log data of each event stored in the event information storage unit 121 (see FIG. 4) to the terminal device 10 used by the administrator MG1 as information for analysis.

  The information processing device 100 may provide an information update service to the administrator MG1. The information processing apparatus 100 may provide an information update service such as adding a comment in response to a request from the administrator MG1 (Step S41). The information processing apparatus 100 may update the event-related information such as the comment of each event stored in the event information storage unit 121 (see FIG. 4) based on the information such as the comment acquired from the administrator MG1.

[2. Configuration of information processing system]
As shown in FIG. 2, the information processing system 1 includes a terminal device 10, a service providing device 50, and an information processing device 100. The terminal device 10, the service providing device 50, and the information processing device 100 are communicably connected via a predetermined network N by wire or wirelessly. FIG. 2 is a diagram illustrating a configuration example of the information processing system according to the embodiment. Note that the information processing system 1 illustrated in FIG. 2 may include a plurality of terminal devices 10, a plurality of service providing devices 50, and a plurality of information processing devices 100.

  The terminal device 10 is an information processing device used by a user such as a system administrator. The terminal device 10 receives various operations by an administrator or the like. In the following, the terminal device 10 may be referred to as an administrator. That is, in the following, the administrator can be read as the terminal device 10. The terminal device 10 described above is realized by, for example, a smartphone, a tablet terminal, a notebook PC (Personal Computer), a desktop PC, a mobile phone, a PDA (Personal Digital Assistant), or the like. For example, the terminal device 10 may be an information processing device in which a predetermined server system is used by an administrator. The terminal device 10 receives information indicating a similar event of one event and event-related information of the similar event from the information processing device 100. For example, the terminal device 10 performs a predetermined process on the service providing device 50 in which one event has occurred, based on the event-related information received from the information processing device 100.

  The service providing device 50 is an information processing device that provides a predetermined service. The service providing device 50 may be a server device that provides a predetermined service in the information processing system 1. The service providing device 50 may be an information processing device that provides various services to a user. The service providing apparatus 50 is an information processing apparatus that generates (outputs) a log according to processing. The service providing apparatus 50 may output a log for each process. The service providing device 50 outputs a log when a predetermined event occurs. When a predetermined event such as an error or a failure occurs, the service providing apparatus 50 outputs an alert message or an error message as a log. When there are a plurality of service providing apparatuses 50, the plurality of service providing apparatuses 50 provide various services.

  The information processing apparatus 100 is a computer that extracts a similar event, which is an event similar to one event, from a plurality of events by searching graph information using the starting vector as a starting point. For example, the information processing apparatus 100 acquires event information on one event, and determines an origin vector based on the event information and information on an origin vector serving as a starting point of a search for graph information.

  The information processing apparatus 100 stores information for providing various information to an administrator or the like. For example, when acquiring the log data of one event from the terminal device 10, the information processing device 100 searches for an event (vector data or the like) similar to the query, and provides the search result to the terminal device 10. In the example of FIG. 1, when the information processing apparatus 100 acquires log data of one event from the terminal device 10, the information processing apparatus 100 searches for an event similar to the one event, and searches for an event-related event associated with a similar event that is a search result. The information is provided to the terminal device 10. Further, the information processing apparatus 100 provides the terminal device 10 with information indicating a similar event as a search result. For example, the data provided by the information processing device 100 to the terminal device 10 may be the name of an event or the log data of the event itself, or information for referencing corresponding data such as a URL (Uniform Resource Locator). May be included.

  The information processing system 1 may include an information providing device (not shown) for providing various information. The information providing device is an information processing device in which information for providing various information to the information processing device 100 is stored. For example, the information providing device may store event information collected from various external devices such as a web server. For example, the information providing apparatus is an information processing apparatus that provides various information such as graph information, index information, and model to the information processing apparatus 100.

[3. Configuration of information processing device]
Next, the configuration of the information processing apparatus 100 according to the embodiment will be described with reference to FIG. FIG. 3 is a diagram illustrating a configuration example of the information processing apparatus according to the embodiment. As shown in FIG. 3, the information processing device 100 includes a communication unit 110, a storage unit 120, and a control unit 130. The information processing apparatus 100 includes an input unit (for example, a keyboard and a mouse) for receiving various operations from an administrator or the like of the information processing apparatus 100, and a display unit (for example, a liquid crystal display) for displaying various information. May have.

(Communication unit 110)
The communication unit 110 is realized by, for example, a NIC (Network Interface Card) or the like. The communication unit 110 is connected to a network (for example, the network N in FIG. 2) by wire or wirelessly, and transmits and receives information to and from the terminal device 10 and the service providing device 50.

(Storage unit 120)
The storage unit 120 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 120 according to the embodiment includes an event information storage unit 121, an index information storage unit 122, a graph information storage unit 123, and a model information storage unit 124, as shown in FIG.

(Event information storage unit 121)
The event information storage unit 121 according to the embodiment stores various information related to an event (object). For example, the event information storage unit 121 stores an event ID and vector data. FIG. 4 is a diagram illustrating an example of an event information storage unit according to the embodiment. The event information storage unit 121 illustrated in FIG. 4 includes items such as “event ID”, “event”, “log data”, “vector data”, and “event-related information”.

  “Event ID” indicates identification information for identifying an event (object). Further, “event” indicates a specific name or content of the event identified by the event ID. In the example of FIG. 4, the event is indicated by an abstract code such as “event # 1”. However, information indicating specific error contents such as “network error # 1” and “database error # 1” and the error type May be included.

  “Log data” indicates a log acquired when the event identified by the event ID occurs. In the example of FIG. 4, the log data is represented by an abstract code such as “LG1”, but each log data is a log (alert log, error log, or the like) output by a server or the like, or each element extracted from the log. May be included. The log data may be character information using a natural language. For example, the log data may be character information (character string) such as “Failed to do something”, “Network connection error”, and “DB timeout error”.

  “Vector data” indicates vector data (vector information) corresponding to the event (object) identified by the event ID. That is, in the example of FIG. 4, vector data corresponding to an object is registered in association with an event ID for identifying an event (object). “Vector data” may be information obtained by vectorizing log data. For example, “vector data” may be information in which log data described in a natural language is vectorized by Word2Vec, Sentence2Vec, Doc2Vec, or the like.

  “Event-related information” indicates information related to the corresponding event. The “event-related information” includes items such as “comment”, “automatic execution flag”, and “score”. “Comment” indicates information on the corresponding event. In the example of FIG. 4, the comment is indicated by an abstract code such as “CM1”, but information indicating specific measures such as “confirm an execution plan” and information used for automatic execution (programs, commands, etc.) Etc. may be included.

  The “comment” may include information indicating the analysis result of the corresponding event. Further, the “comment” may include information indicating the reason for the occurrence of the corresponding event. Further, the “comment” may include information indicating an action after the occurrence of the corresponding event. Further, the “comment” may include information indicating the content of handling the corresponding event.

  The “automatic execution flag” indicates whether or not the information processing apparatus is automatically executed based on the comment. When the “automatic execution flag” is “1”, that is, when there is automatic execution, the “comment” may be command information that is information in a format in which processing can be automatically executed. When automatic execution is performed, the “comment” may be a file path name indicating a storage location of information in a format in which a predetermined process can be automatically executed.

  “Score” indicates the score of the corresponding event. For example, “score” indicates an evaluation of a corresponding event. Further, the “score” may be information indicating an evaluation such as a comment indicating a correspondence in a corresponding event. For example, “score” may indicate that the larger the value, the higher the value of the event-related information corresponding to the event. For example, “score” may indicate that the larger the value, the more accurate the comment corresponding to the event. In the example of FIG. 4, the score is indicated by an abstract code such as “SC1”, but is assumed to be a specific numerical value such as “0.5” or “10”.

  For example, in the example of FIG. 4, the event (object) identified by the event ID “EV1” is multi-dimensional (N-dimensional) vector data of “0.1, 0.3, 0.25,. Are associated with each other. For example, with respect to event # 1, multi-dimensional (N-dimensional) vector data of “0.1, 0.3, 0.25,. It indicates that it was extracted from LG1. Event # 1 indicates that the comment is comment CM1. The comment CM1 indicates that the information is “confirm the execution plan” and prompts the administrator to perform a predetermined action. Event # 1 indicates that the automatic execution flag is “0”, indicating that there is no automatic execution. The event # 1 indicates that the score is the score SC1.

  The event information storage unit 121 is not limited to the above, and may store various types of information according to purposes. For example, the event information storage unit 121 may store information on the date and time of occurrence of each event.

(Index information storage unit 122)
The index information storage unit 122 according to the embodiment stores various information related to the index. FIG. 5 is a diagram illustrating an example of the index information storage unit according to the embodiment. Specifically, in the example of FIG. 5, the index information storage unit 122 indicates the tree-structured index information. In the example of FIG. 5, the index information storage unit 122 includes items such as “root hierarchy”, “first hierarchy”, “second hierarchy”, “third hierarchy”, and the like. It should be noted that the present invention is not limited to “first tier” to “third tier”, and may include “fourth tier”, “fifth tier”, “sixth tier”, and the like according to the number of index tiers.

  The “root hierarchy” indicates the hierarchy of the root (the highest level) which is the starting point of the determination of the starting node using the index. The “first layer” stores information for identifying (specifying) a node (a node or a vector in graph information) belonging to the first layer of the index. The node stored in the “first hierarchy” is a node corresponding to the hierarchy directly connected to the root of the index.

  The “second hierarchy” stores information for identifying (specifying) a node (a node or a vector in graph information) belonging to the second hierarchy of the index. The node stored in the “second hierarchy” is a node corresponding to the immediately lower hierarchy connected to the first hierarchy node. The “third hierarchy” stores information for identifying (specifying) nodes (nodes or vectors in graph information) belonging to the third hierarchy of the index. The node stored in the “third hierarchy” is a node corresponding to the immediately lower hierarchy connected to the node of the second hierarchy.

  For example, in the example illustrated in FIG. 5, information corresponding to the index information IND11 in FIG. 1 is stored in the index information storage unit 122. For example, the index information storage unit 122 indicates that the nodes of the first hierarchy are the nodes VT1 to VT3 and the like. The numerical value in parentheses below each node indicates the value of the vector corresponding to each node.

  Further, for example, the index information storage unit 122 indicates that the nodes of the second hierarchy immediately below the node VT2 are the nodes VT2-1 to VT2-4. Further, for example, the index information storage unit 122 indicates that the node of the third hierarchy immediately below the node VT2-2 is a node (vector) in the graph information GR11 of the node N35, the node N451, and the node N693.

  The index information storage unit 122 is not limited to the above, and may store various types of information according to purposes.

(Graph information storage unit 123)
The graph information storage unit 123 according to the embodiment stores various information related to graph information. FIG. 6 is a diagram illustrating an example of the graph information storage unit according to the embodiment. In the example of FIG. 6, the graph information storage unit 123 has items such as “node ID”, “event ID”, and “edge information”. The “edge information” includes information such as “edge ID” and “reference destination”.

  “Node ID” indicates identification information for identifying each node (object) in the graph data. “Event ID” indicates identification information for identifying an event (object).

  “Edge information” indicates information on an edge connected to the corresponding node. In the example of FIG. 6, “edge information” indicates a case where the edge is a directed edge, and indicates information on an output edge output from a corresponding node. “Edge ID” indicates identification information for identifying an edge connecting nodes. The “reference destination” indicates information indicating a reference destination (node) connected by an edge. That is, in the example of FIG. 6, information for identifying an object (object) corresponding to the node and a reference destination (directed edge (output edge)) from the node are connected to the node ID for identifying the node. Nodes) are registered in association with each other.

  For example, in the example of FIG. 6, the node (vector) identified by the node ID “N1” corresponds to the event (object) identified by the event ID “EV1”. Further, from the node identified by the node ID “N1”, the edge identified by the edge ID “E11” is connected to the node (vector) identified by the node ID “N25”. That is, the example in FIG. 6 indicates that a node (vector) identified by the node ID “N1” can be traced to a node (vector) identified by the node ID “N25”.

  The graph information storage unit 123 is not limited to the above, and may store various types of information according to purposes. For example, the graph information storage unit 123 may store the length of an edge connecting between nodes (vectors). That is, the graph information storage unit 123 may store information indicating the distance between each node (vector).

(Model information storage unit 124)
The model information storage unit 124 according to the embodiment stores information on a model. For example, the model information storage unit 124 stores model information (model data) generated by the generation processing. FIG. 7 is a diagram illustrating an example of the model information storage unit according to the embodiment. The model information storage unit 124 illustrated in FIG. 7 includes items such as “model ID”, “use”, and “model data”.

  “Model ID” indicates identification information for identifying a model. For example, the model identified by the model ID “M1” corresponds to the model M1 shown in the example of FIG. "Use" indicates the use of the corresponding model. Further, “model data” indicates data of the associated corresponding model. For example, the “model data” includes information including nodes in each layer, a function adopted by each node, a connection relationship between nodes, and a connection coefficient set for connection between nodes.

  For example, in the example shown in FIG. 7, the model (model M1) identified by the model ID “M1” is used for “vectorization (system)” and is used to vectorize the input system log. Indicates that That is, the model M1 is used to generate a vector from the input system log information. For example, the model M1 is a Sentence2Vec model. The model data of the model M1 indicates that the model data is MDT1.

  Although FIG. 7 shows only the models M1 and M2, a large number of model information such as the model M21 (see FIG. 10) and the model M22 may be stored according to each use (target of prediction). For example, the model M21 (model data MDT21) includes an input layer to which log information (log data) of an event is input, an output layer, and any layer from the input layer to the output layer, other than the output layer. , And a second element whose value is calculated based on the first element and the weight of the first element. The log information input to the input layer is transmitted to each layer other than the output layer. The computer is caused to function such that information similar to the information input to the input layer is output from the output layer by performing an operation based on the first element and the weight of the first element using each element as the first element. Model may be used.

  Further, it is assumed that the models M21 and M22 are realized by a neural network having one or a plurality of intermediate layers such as a DNN (Deep Neural Network). In this case, for example, the first element included in the models M21 and M22 corresponds to any node of the input layer or the intermediate layer. The second element corresponds to a next-stage node that is a node to which a value is transmitted from a node corresponding to the first element. Further, the weight of the first element corresponds to a connection coefficient which is a weight considered for a value transmitted from a node corresponding to the first element to a node corresponding to the second element.

  Here, it is assumed that the models M21 and M22 are realized by a regression model represented by “y = a1 * x1 + a2 * x2 +... + Ai * xi”. In this case, for example, the first element included in the models M21 and M22 corresponds to input data (xi) such as x1 and x2. Further, the weight of the first element corresponds to the coefficient ai corresponding to xi. Here, the regression model can be regarded as a simple perceptron having an input layer and an output layer. When each model is regarded as a simple perceptron, the first element corresponds to any node of the input layer, and the second element can be regarded as a node of the output layer.

  The model information storage unit 124 is not limited to the above, and may store various model information according to the purpose.

(Control unit 130)
Returning to the description of FIG. 3, the control unit 130 is a controller, and is stored in a storage device inside the information processing apparatus 100 by, for example, a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). Are realized by executing various programs (corresponding to an example of an information processing program) using a RAM as a work area. The control unit 130 is a controller, and is realized by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 130 generates vector data from event log information (log data) by information processing according to the models M1, M2, and the like stored in the model information storage unit 124. The control unit 130 performs information processing in accordance with the model M21 and the like stored in the model information storage unit 124 to input an event log information (log data), an output layer, and an input layer to an output layer. And a second element whose value is calculated based on the first element and the weight of the first element. By performing an operation on the input log information based on the first element and the weight of the first element with each element belonging to each layer other than the output layer as the first element, the same as the information input to the input layer Is output from the output layer.

  As illustrated in FIG. 3, the control unit 130 includes an acquisition unit 131, a generation unit 132, a determination unit 133, an extraction unit 134, and a provision unit 135, and functions and functions of information processing described below. Realize or execute. Note that the internal configuration of the control unit 130 is not limited to the configuration illustrated in FIG. 3, and may be another configuration as long as it performs information processing to be described later.

(Acquisition unit 131)
The acquisition unit 131 acquires various information. The acquisition unit 131 acquires various information from the storage unit 120. The acquisition unit 131 acquires various types of information from the event information storage unit 121, the index information storage unit 122, the graph information storage unit 123, the model information storage unit 124, and the like. The acquisition unit 131 acquires various information from an external information processing device. The acquisition unit 131 acquires various types of information from the terminal device 10 or the service providing device 50.

  Acquisition unit 131 is a graph information in which a plurality of vectors corresponding to each of a plurality of events are connected according to similarity, and information associated with each of the plurality of events. Event related information, which is related information, and information on one event are acquired. The acquiring unit 131 acquires graph information in which a plurality of vectors obtained by vectorizing a plurality of information corresponding to each of a plurality of events are connected. The acquisition unit 131 acquires graph information in which a plurality of vectors in which character information corresponding to each of a plurality of events is vectorized are connected.

  The acquisition unit 131 acquires event-related information including analysis results of each of a plurality of events. The acquisition unit 131 acquires event-related information including the reason for each of the plurality of events. The acquisition unit 131 acquires event-related information including information indicating an action after each of a plurality of events has occurred. The acquisition unit 131 acquires event-related information including information indicating the content of handling each of a plurality of events. The acquisition unit 131 is an event that includes command information, which is information based on a process executed by a predetermined information processing device as a response to each of a plurality of events, and is information in a format in which the information processing device can automatically execute the process. Get related information.

  The acquisition unit 131 acquires event-related information including information indicating the evaluation of each of a plurality of events. The acquisition unit 131 acquires event-related information including a score indicating each evaluation of a plurality of events.

  The acquisition unit 131 acquires graph information in which a plurality of vectors corresponding to each of a plurality of events for which a log is output in a predetermined system are connected according to similarity. The acquisition unit 131 acquires graph information in which a plurality of vectors corresponding to each of a plurality of events for which a log is output in a predetermined system are connected according to similarity. The acquisition unit 131 acquires graph information in which a plurality of vectors corresponding to each of a plurality of events related to an alert in a predetermined system are linked according to similarity. The acquisition unit 131 acquires graph information in which a plurality of vectors obtained by vectorizing information regarding logs corresponding to each of a plurality of events are connected.

  The acquisition unit 131 acquires a plurality of nodes (vectors) to be searched. The acquisition unit 131 acquires a plurality of nodes and a directed edge group including a plurality of directed edges connecting each of the plurality of nodes.

  The acquisition unit 131 acquires graph information (graph data) from an external information processing device. The acquisition unit 131 acquires graph information from the graph information storage unit 123. The acquisition unit 131 acquires graph information. In the example of FIG. 1, the acquisition unit 131 acquires the graph information GR11.

  The acquisition unit 131 acquires index information (index data) from an external information processing device. The acquisition unit 131 acquires index information from the index information storage unit 122. The obtaining unit 131 obtains tree structure type index information. In the example of FIG. 1, the acquisition unit 131 acquires the index information IND11.

  The acquisition unit 131 acquires event information on one event from the terminal device 10 used by the administrator or the like. The acquiring unit 131 acquires log data of one event as a search query. The acquisition unit 131 acquires a search query for an event. The acquiring unit 131 acquires log data LGX relating to the event X from the terminal device 10 used by the administrator MG1.

  In the example of FIG. 1, the acquisition unit 131 acquires event information (log data) related to one event. The acquisition unit 131 acquires log data LGX relating to event X from the terminal device 10.

(Generation unit 132)
The generation unit 132 generates various information. The generation unit 132 generates various information based on various information stored in the storage unit 120. The generation unit 132 generates various types of information based on the event information storage unit 121, the index information storage unit 122, the graph information storage unit 123, the model information storage unit 124, and the like. The generation unit 132 generates various types of information based on the various types of information acquired by the acquisition unit 131. The generation unit 132 calculates various information.

  In the example of FIG. 1, the generation unit 132 generates an N-dimensional vector from log data of each event using a model of Sentence2Vec. The generation unit 132 generates a vector from log data of each event using the model M1 shown in the model information storage unit 124 (FIG. 7).

  Further, the generation unit 132 generates a vector used for searching for graph information from log data corresponding to one event. In the example of FIG. 1, the generation unit 132 generates a vector corresponding to the event X by a process as illustrated in the process group PS11. The generation unit 132 inputs the log data LGX relating to the event X to the model M1. Specifically, the generation unit 132 inputs the log data LGX output by the server device of the predetermined server system when the event X occurs to the model M1. Then, the generation unit 132 generates a vector using the information output by the model M1 to which the log data LGX has been input. The generation unit 132 uses the vector data output by the model M1 to which the log data LGX has been input as the vector VDX of the log data LGX. In the example of FIG. 1, the generation unit 132 generates a vector VDX in which the first-dimensional element is “0.6” and the second-dimensional element is “0.3” using the model M1. I do.

  The generation unit 132 may generate a model using the learning data (log information) stored in the event information storage unit 121. The generation unit 132 may generate a model (auto encoder) that outputs information similar to the input log information based on the learning data acquired by the acquisition unit 131. The generation unit 132 may generate a model (auto encoder) that outputs the same information as the input log information, using the input log information itself as the correct answer information.

  The generation unit 132 generates the model M21 and the like, and stores the generated model M21 and the like in the model information storage unit 124. Note that the generation unit 132 may generate the model M21 using any learning algorithm. The generation unit 132 generates the model M21 using a learning algorithm such as a neural network. As an example, when the generation unit 132 generates a model M21 or the like using a neural network, the model M21 or the like generates an input layer including one or more neurons, an intermediate layer including one or more neurons, and one or more neurons. Including an output layer.

  The generation unit 132 includes an input layer to which log information (log data) of an event is input, an output layer, and a first element belonging to any of the layers from the input layer to the output layer and belonging to a layer other than the output layer. , A first element and a second element whose value is calculated based on the weight of the first element, and for each piece of log information input to the input layer, each element belonging to each layer other than the output layer By performing an operation based on the first element and the weight of the first element as the element, a model that outputs the same information as the information input to the input layer from the output layer is generated.

  The generation unit 132 generates a model based on the learning data. The generation unit 132 generates a model based on the learning data. The generation unit 132 generates a model by performing learning using the log data LG1, LG2, and the like in the event information storage unit 121 as learning data (teacher data).

  The generation unit 132 performs a learning process such that when the log data LG1 is input, the model M21 outputs the same information as the log data LG1. The generation unit 132 performs a learning process so that when the log data LG2 is input, the model M21 outputs the same information as the log data LG2.

  The generation unit 132 is not limited to M21 as an auto-encoder, and may generate M22 corresponding to traffic such as railway, M23 corresponding to user behavior such as user purchase, and the like. The generation unit 132 generates the models M22, M23, and the like using a neural network, a support vector machine (SVM), a learning algorithm such as clustering, and reinforcement learning. As an example, when the generation unit 132 generates the models M22, M23, and the like using a neural network, the models M22, M23, and the like include an input layer including one or more neurons, an intermediate layer including one or more neurons, And an output layer including the above neurons.

  The generation unit 132 generates a model, and stores the generated model in the model information storage unit 124. Specifically, the generation unit 132 outputs the log information (log data) of the event to the input layer, the output layer, and any one of the layers from the input layer to the output layer other than the output layer. The log information input to the input layer includes a first element to which the first element belongs and a second element whose value is calculated based on the first element and the weight of the first element. A model that outputs a score value used for predicting occurrence of an event from an output layer is generated by performing an operation based on the first element and the weight of the first element using each element as a first element. The generation unit 132 includes an input layer to which log information (log data) of an event is input, an output layer, and a first element belonging to any of the layers from the input layer to the output layer and belonging to a layer other than the output layer. , A first element and a second element whose value is calculated based on the weight of the first element, and for each piece of log information input to the input layer, each element belonging to each layer other than the output layer By performing an operation based on the first element and the weight of the first element as the element, a model M21 that outputs a score value used for predicting occurrence of an event from the output layer is generated. The generation unit 132 generates the model M21 so as to output a score “1” when log information when an event occurs is input. The generation unit 132 generates the model M21 so as to output a score “0” when log information when an event has not occurred is input. The generation unit 132 may generate an N-dimensional vector from log data of each event using the model M21.

  In the example of FIG. 1, the generation unit 132 generates a ranking score of each similar event based on a score, a degree of similarity, and the like of each similar event. For example, the generation unit 132 calculates the ranking score of each similar event by multiplying the score of each similar event by the similarity. The generation unit 132 calculates the ranking score of each similar event as shown in the ranking list information RKL. The generating unit 132 calculates the ranking score of the event # 451 as the ranking score RS451. Further, the generation unit 132 calculates the ranking score of the event # 35 as the ranking score RS35.

(Determining unit 133)
The determining unit 133 determines various information. The determining unit 133 determines various information. The determining unit 133 determines various information based on the various information stored in the storage unit 120. The determining unit 133 determines various information based on the various information stored in the storage unit 120. The determining unit 133 determines various types of information based on the event information storage unit 121, the index information storage unit 122, the graph information storage unit 123, the model information storage unit 124, and the like. The determining unit 133 determines various types of information based on the event information storage unit 121, the index information storage unit 122, the graph information storage unit 123, the model information storage unit 124, and the like. The determining unit 133 determines various information based on the various information acquired by the acquiring unit 131. The determining unit 133 determines various types of information based on the various types of information acquired by the acquiring unit 131. The deciding unit 133 decides a starting vector based on the event information acquired by the acquiring unit 131 and information on a starting vector which is a starting point of a search for graph information. Further, the determining unit 133 determines a starting vector based on the index information used for determining the starting vector. In addition, the determination unit 133 determines an origin vector based on the tree structure type index information.

  In the example of FIG. 1, the determination unit 133 uses the index information IND11 to determine (identify) a starting vector corresponding to one event (query). The determining unit 133 uses the index information IND11 to determine (specify) a starting vector corresponding to the vector VDX of the event X. The determining unit 133 determines a starting point vector in the graph information GR11 using the vector VDX and the index information IND11.

  The determining unit 133 determines a starting point vector in the graph information GR11 by using tree-structured index information as indicated by the index information IND11 in FIG. In the example of FIG. 1, after determining the vector VDX, the determining unit 133 traces the index information IND11 from the top to the bottom to identify a starting point vector that is a neighborhood candidate of the index information IND11, thereby enabling efficient search. Determine an origin vector corresponding to the query (one event).

  The determination unit 133 determines an origin vector corresponding to the vector VDX by tracing the index information IND11 from the root RT to a leaf node (a node (vector) in the graph information GR11). In the example of FIG. 1, the determination unit 133 determines the node N451 as the starting vector by tracing the index information IND11 from the root RT to the node N451.

  The determination unit 133 determines a provision target event. In the example of FIG. 1, the determination unit 133 determines the event # 35 having the first rank as the provision target event.

(Extraction unit 134)
The extraction unit 134 extracts various information. The extracting unit 134 extracts various information based on the various information stored in the storage unit 120. The extraction unit 134 extracts various information based on the event information storage unit 121, the index information storage unit 122, the graph information storage unit 123, the model information storage unit 124, and the like. The extraction unit 134 extracts various information based on the various information acquired by the acquisition unit 131. The extraction unit 134 extracts various information based on the various information generated by the generation unit 133. The extracting unit 134 extracts various information based on the various information determined by the determining unit 133. The extraction unit 134 performs an extraction process in the search process.

  The extraction unit 134 searches the graph information by using, as a starting point, a starting vector which is a starting point of the search for the graph information determined based on a predetermined criterion among the plurality of vectors of the graph information acquired by the acquiring unit 131. Of the plurality of events, a similar event that is an event similar to one event is extracted. The extraction unit 134 extracts a similar event, which is an event similar to one event, from a plurality of events by searching graph information using the origin vector determined by the determination unit 132 as a starting point. The extraction unit 134 may use information on the length (distance) of the edge connecting the nodes (vectors) stored in the graph information storage unit 123, or may use the vector data (vector information) of each node to Information on the length (distance) of the edge connecting the nodes (vectors) may be calculated, and the information on the calculated length (distance) may be used.

  The extraction unit 134 searches the graph information from the starting vector which is the starting point of the search for the graph information determined based on the predetermined criterion among the plurality of vectors of the graph information. By extracting a similar event that is an event similar to the event, event-related information associated with the similar event is extracted. When one event satisfies a predetermined condition, the extraction unit 134 searches the graph information and extracts event-related information associated with the similar event. When one event is different from a normal event, the extraction unit 134 searches the graph information and extracts event-related information associated with a similar event. The extraction unit 134 searches the graph information at a predetermined timing, and extracts event-related information associated with a similar event. The extraction unit 134 ranks the event-related information of similar events based on the extracted scores of similar events.

  In the example of FIG. 1, the extraction unit 134 extracts a similar event of the event X by searching the graph information GR11. For example, the extraction unit 134 extracts a node located near the node N451 as a similar event. For example, the extraction unit 134 extracts a node whose distance from the node N451 is short as a similar event. For example, the extraction unit 134 extracts a node that can be reached from the node N451 as a similar event by following the edge with the node N451 as a starting point. For example, the extraction unit 134 extracts a predetermined number (for example, two or ten) of nodes as similar events. For example, the extraction unit 134 may extract a similar event of the event X by a search process as shown in FIG. 11, but the details will be described later. In the example of FIG. 1, the extraction unit 134 extracts the node N451, the node N35, the node N256, and the like as a similar event by searching for the graph information GR11 starting from the node N451. For example, the extraction unit 134 extracts the node N451, the node N35, the node N256, and the like in order from the one having the highest similarity to the event X.

  In the example of FIG. 1, the extracting unit 134 extracts event-related information associated with the extracted similar event. The extraction unit 134 extracts the event-related information associated with the extracted similar event, as indicated by the similar event list information SEL. For example, the extracting unit 134 extracts event-related information associated with each similar event from the information stored in the event information storage unit 121 (see FIG. 4). The extraction unit 134 extracts information such as a comment, an automatic execution flag, and a score as event-related information. The extraction unit 134 extracts event-related information associated with each of the event # 451 (node N451), event # 35 (node N35), event # 256 (node N256), and the like, which are extracted as similar events.

  The extraction unit 134 ranks each similar event based on the ranking score of each similar event. The extraction unit 134 ranks similar events in descending order of similarity score. In the example of FIG. 1, the extraction unit 134 ranks the first place “event # 35”, the second place “event # 2”, the third place “event # 451”, and the like in descending order of the ranking score.

(Provider 135)
The providing unit 135 provides various information. The providing unit 135 provides various types of information to external information processing devices such as the terminal device 10 and the service providing device 50. The providing unit 135 transmits various types of information to the terminal device 10 and the service providing device 50. The providing unit 135 distributes various types of information to the terminal device 10. The providing unit 135 provides various information based on the various information acquired by the acquiring unit 131. The providing unit 135 provides various information based on the various information generated by the generating unit 132. The providing unit 135 provides various information based on the various information extracted by the extracting unit 134. The providing unit 135 provides the event-related information of the similar event extracted by the extracting unit 134. The providing unit 135 provides a predetermined service based on the similar event extracted by the extracting unit 134. Further, the providing unit 135 provides an information providing service regarding a similar event. The providing unit 135 provides the terminal device 10 with information on the similar event. The providing unit 135 provides an information providing service related to event-related information associated with a similar event.

  The providing unit 135 provides an event ID (object ID) corresponding to the query as a search result. The providing unit 135 provides the event ID extracted by the extracting unit 134 to the service providing device 50. The providing unit 135 provides the event ID extracted by the extracting unit 134 to the service providing apparatus 50 as information indicating a vector corresponding to the query. The providing unit 135 provides an information providing service related to the event-related information associated with the similar event specified by the event ID extracted by the extracting unit 134. Further, the providing unit 135 may provide the model generated by the generating unit 132 to an external information processing device.

  In the example of FIG. 1, the providing unit 135 provides information on the providing target event determined by the determining unit 133. The providing unit 135 provides the information indicating the event # 35, which is a providing target event, and the comment CM35 of the event # 35 to the terminal device 10 used by the administrator MG1 as an event similar to the event X and the content of handling the event X. I do.

[4. Information processing flow)
Next, a procedure of information processing by the information processing system 1 according to the embodiment will be described with reference to FIG. FIG. 8 is a flowchart illustrating an example of information processing according to the embodiment.

  As shown in FIG. 8, the information processing apparatus 100 acquires event information (log data) related to one event (step S101). In the example of FIG. 1, the information processing apparatus 100 acquires log data LGX related to the event X from the terminal device 10.

  The information processing apparatus 100 acquires graph information on the event (step S102). For example, the information processing apparatus 100 acquires the graph information GR11 regarding the event from the graph information storage unit 123.

  Then, the information processing apparatus 100 generates a vector from log data relating to one event using the model (step S103). In the example of FIG. 1, the information processing apparatus 100 generates a vector VDX from the log data LGX using the model M1 stored in the model information storage unit 124.

  Then, the information processing device 100 determines a starting point vector using the generated vector and the index information (Step S104). In the example of FIG. 1, the information processing apparatus 100 determines a starting vector at the node N451 using the vector VDX and the index information IND11 stored in the index information storage unit 122.

  Then, the information processing apparatus 100 retrieves the graph information and extracts a similar event of one event, thereby extracting event-related information associated with the similar event (step S105). In the example of FIG. 1, the information processing apparatus 100 searches the graph information GR11 starting from the node N451, and extracts the node N451 or the node N35 as a similar event, thereby obtaining a comment CM451 or an event # corresponding to the event # 451. The comment CM35 corresponding to the comment 35 is extracted.

  Then, the information processing apparatus 100 provides information on event-related information corresponding to the extracted similar event (step S106). In the example of FIG. 1, the information processing apparatus 100 provides the comment CM35 corresponding to the highest ranked node N35 (event # 35) to the terminal apparatus 10 used by the administrator MG1 as information indicating the correspondence to the event X. .

[5. Generation processing flow)
Next, a procedure of a generation process by the information processing system 1 according to the embodiment will be described using FIG. FIG. 9 is a flowchart illustrating an example of the generation process according to the embodiment.

  As shown in FIG. 9, the information processing device 100 acquires learning data (step S201). For example, the information processing device 100 acquires learning data from the event information storage unit 121. For example, the information processing apparatus 100 acquires log data LG1, LG2, and the like from the event information storage unit 121 as learning data.

  After that, the information processing apparatus 100 generates a model based on the learning data (Step S202). For example, the information processing apparatus 100 generates a model M21 using the learning data from the event information storage unit 121. For example, the information processing apparatus 100 generates the model M1 such that information (log data) similar to the information (log data) input to the input layer is output from the output layer. For example, the information processing apparatus 100 generates a model M21 as an auto-encoder that receives event log data as input.

[6. Search example)
Here, an example of a search using the above-described graph information will be described. The search using the graph information (graph data) is not limited to the following, and may be performed by various procedures. This will be described with reference to FIG. 11 as an example. FIG. 11 is a flowchart illustrating an example of a search process using graph data (graph information). Further, the objects described below may be read as vectors and nodes. In the following, the description will be given on the assumption that the information processing apparatus 100 performs the search processing. For example, the information processing apparatus 100 uses vector data generated from log data of one event as a search query. For example, the information processing apparatus 100 searches for graph data starting from a starting vector determined based on vector data generated from log data of one event and index information. In the example of FIG. 1, the information processing apparatus 100 searches the graph information GR11 with the node N451, which is the starting vector determined based on the vector VDX of the event X and the index information IND11, as the starting point.

  Here, the nearby object set N (G, y) is a set of nearby objects associated by the edge given to the node y. “G” may be predetermined graph data (for example, graph information GR11 or the like). For example, the information processing apparatus 100 executes a k-neighbor search process.

  For example, the information processing apparatus 100 sets the radius r of the hypersphere to ∞ (infinity) (step S300), and extracts a subset S from the existing object set (step S301). For example, the information processing apparatus 100 may extract the object (node) selected as the root node (origin vector) as the subset S. In the example of FIG. 1, the information processing apparatus 100 may extract the node N451 or the like that is the starting point vector as the subset S. Also, for example, a super sphere is a virtual sphere indicating a search range. Note that the objects included in the object set S extracted in step S301 are also included in the initial set of the object set R of the search result at the same time.

  Next, assuming that the search query object is y from among the objects included in the object set S, the information processing apparatus 100 extracts an object having the shortest distance from the object y and sets it as an object s (step S302). In the example of FIG. 1, the information processing apparatus 100 extracts an object having the shortest distance from the search query object vector VDX among the objects included in the object set S, and sets the extracted object as the object s. For example, the information processing apparatus 100 extracts a node N451 having the shortest distance from the vector VDX among the objects included in the object set S, and sets the extracted node N451 as the object s. For example, when only the object (node) selected as the root node (origin vector) is an element of the object set S, the information processing apparatus 100 eventually extracts the root node (origin vector) as the object s. . Next, the information processing apparatus 100 excludes the object s from the object set S (Step S303).

  Next, the information processing apparatus 100 determines whether or not the distance d (s, y) between the object s and the object y exceeds r (1 + ε) (Step S304). Here, ε is an extension element, and r (1 + ε) is a value indicating a radius of a search range (only nodes within this range are searched. Accuracy can be increased by making the search range larger than the search range). is there. When the distance d (s, y) between the object s and the object y exceeds r (1 + ε) (Step S304: Yes), the information processing apparatus 100 outputs the object set R as a set of neighboring objects of the object y (Step S304). (S305), the process ends.

  When the distance d (s, y) between the object s and the search query object y does not exceed r (1 + ε) (Step S304: No), the information processing apparatus 100 sets the nearby object set N (G, s) of the object s. One object that is not included in the object set C is selected from among the objects that are the elements of, and the selected object u is stored in the object set C (step S306). The object set C is provided for convenience in order to avoid duplicate search, and is set to an empty set at the start of processing.

  Next, the information processing apparatus 100 determines whether or not the distance d (u, y) between the object u and the object y is equal to or less than r (1 + ε) (Step S307). When the distance d (u, y) between the object u and the object y is equal to or smaller than r (1 + ε) (Step S307: Yes), the information processing apparatus 100 adds the object u to the object set S (Step S308).

  Next, the information processing apparatus 100 determines whether or not the distance d (u, y) between the object u and the object y is equal to or less than r (Step S309). When the distance d (u, y) between the object u and the object y exceeds r (Step S309: No), the information processing apparatus 100 performs the determination (process) in Step S315.

  When the distance d (u, y) between the object u and the object y is equal to or smaller than r (Step S309: Yes), the information processing apparatus 100 adds the object u to the object set R (Step S310). Then, the information processing apparatus 100 determines whether or not the number of objects included in the object set R exceeds ks (Step S311). The predetermined number ks is a natural number arbitrarily determined. For example, various settings such as ks = 2 and ks = 10 may be used.

  When the number of objects included in the object set R exceeds ks (step S311: Yes), the information processing apparatus 100 determines an object having the longest distance (far) from the object y among the objects included in the object set R, It is excluded from the object set R (step S312).

  Next, the information processing apparatus 100 determines whether or not the number of objects included in the object set R matches ks (Step S313). If the number of objects included in the object set R matches ks (Step S313: Yes), the information processing apparatus 100 determines that the object y has the longest (far) distance to the object y among the objects included in the object set R. , The distance to the object y is set to a new r (step S314).

  Then, the information processing apparatus 100 determines whether all objects have been selected from the objects that are the elements of the neighboring object set N (G, s) of the object s and have been stored in the object set C (step S315). . If not all objects have been selected from the objects that are elements of the neighboring object set N (G, s) of the object s and stored in the object set C (step S315: No), the information processing apparatus 100 proceeds to step S306. Return to and repeat the process.

  When all objects have been selected from the objects that are elements of the neighboring object set N (G, s) of the object s and stored in the object set C (step S315: Yes), the information processing apparatus 100 sets the object set S Is an empty set (step S316). If the object set S is not an empty set (step S316: No), the information processing apparatus 100 returns to step S302 and repeats the processing. If the object set S is an empty set (step S316: Yes), the information processing apparatus 100 outputs the object set R and ends the process (step S317). For example, the information processing apparatus 100 may provide an object (node) included in the object set R as a search result corresponding to the search query (input object y) to the terminal device 10 or the like that has performed the search. In the example of FIG. 1, the information processing apparatus 100 extracts the nodes N451 and N35 included in the object set R as information indicating a similar event of the search query (the vector VDX of the event X). Then, the information processing apparatus 100 extracts the comment CM 451 corresponding to the event # 451 (node N451) and the comment CM 35 corresponding to the event # 35 (node N35) extracted as the similar event of the event X. Then, in the example of FIG. 1, the information processing apparatus 100 transmits the comment CM35 corresponding to the highest-ranked node N35 (event # 35) to the terminal device 10 used by the administrator MG1 as information indicating the correspondence to the event X. provide.

[7. effect〕
As described above, the information processing apparatus 100 according to the embodiment includes the acquisition unit 131 and the extraction unit 134. Acquisition unit 131 is a graph information in which a plurality of vectors corresponding to each of a plurality of events are connected according to similarity, and information associated with each of the plurality of events. Event related information, which is related information, and information on one event are acquired. The extraction unit 134 searches the graph information from the starting vector which is the starting point of the search for the graph information determined based on the predetermined criterion among the plurality of vectors of the graph information. By extracting a similar event that is an event similar to the event, event-related information associated with the similar event is extracted.

  As described above, the information processing apparatus 100 according to the embodiment searches for graph information with the starting point vector as a starting point, and extracts a similar event that is a similar event to one event from among a plurality of events. Can be appropriately extracted.

  Further, the information processing apparatus 100 according to the embodiment includes a determining unit 133. The determining unit 133 determines a starting vector based on the index information used for determining the starting vector. The extraction unit 134 extracts a similar event from the starting point vector determined by the determining unit 133 as a starting point.

  As described above, the information processing apparatus 100 according to the embodiment can appropriately extract information related to a similar event by determining the starting vector based on the index information used for determining the starting vector.

  In the information processing apparatus 100 according to the embodiment, the determining unit 133 determines a starting point vector based on tree-structured index information.

  As described above, the information processing apparatus 100 according to the embodiment can appropriately extract information related to the similar event by determining the starting point vector based on the tree structure type index information.

  In the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires graph information in which a plurality of vectors obtained by vectorizing a plurality of information corresponding to each of a plurality of events are connected.

  As described above, the information processing apparatus 100 according to the embodiment obtains graph information in which a plurality of vectors obtained by vectorizing a plurality of pieces of information corresponding to each of a plurality of events are related to a similar event. Information can be appropriately extracted.

  In the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires graph information in which a plurality of vectors in which character information corresponding to each of a plurality of events is vectorized are connected.

  As described above, the information processing apparatus 100 according to the embodiment acquires information related to a similar event by acquiring graph information in which a plurality of vectors in which character information corresponding to each of a plurality of events is vectorized are connected. Can be appropriately extracted.

  Further, in the information processing apparatus 100 according to the embodiment, when one event satisfies a predetermined condition, the extracting unit 134 searches graph information and extracts event-related information associated with a similar event.

  As described above, when one event satisfies a predetermined condition, the information processing apparatus 100 according to the embodiment searches for graph information and extracts event-related information associated with the similar event, thereby Related information can be appropriately extracted.

  Further, in the information processing apparatus 100 according to the embodiment, when one event is an event different from a normal event, the extraction unit 134 searches graph information and extracts event-related information associated with a similar event. .

  As described above, when one event is an event different from a normal event, the information processing apparatus 100 according to the embodiment searches for graph information and extracts event-related information associated with a similar event, Information related to the similar event can be appropriately extracted.

  In addition, in the information processing apparatus 100 according to the embodiment, the extraction unit 134 searches the graph information at a predetermined timing, and extracts the event-related information associated with the similar event.

  As described above, the information processing apparatus 100 according to the embodiment retrieves the graph information at a predetermined timing and extracts the event-related information associated with the similar event, so that the information related to the similar event can be appropriately processed. Can be extracted.

  In the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires event-related information including analysis results of each of a plurality of events.

  As described above, the information processing apparatus 100 according to the embodiment can appropriately extract information related to the similar event by acquiring the event-related information including the analysis result of each of the plurality of events.

  In the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires event-related information including the reason for each of the plurality of events.

  As described above, the information processing apparatus 100 according to the embodiment can appropriately extract the information related to the similar event by acquiring the event-related information including the reason for each occurrence of the plurality of events.

  In the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires event-related information including information indicating an action after each of a plurality of events has occurred.

  As described above, the information processing apparatus 100 according to the embodiment appropriately extracts information related to a similar event by acquiring event-related information including information indicating an action after each of a plurality of events has occurred. Can be.

  In addition, in the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires event-related information including information indicating the content of handling each of a plurality of events.

  As described above, the information processing apparatus 100 according to the embodiment can appropriately extract the information related to the similar event by acquiring the event related information including the information indicating the coping content of each of the plurality of events. it can.

  In addition, in the information processing apparatus 100 according to the embodiment, the acquisition unit 131 is information based on processing performed by a predetermined information processing apparatus as a measure against each of a plurality of events, and the information processing apparatus automatically executes the processing. Acquire event-related information including command information, which is information in a possible format.

  As described above, the information processing apparatus 100 according to the embodiment is information based on processing executed by a predetermined information processing apparatus as a measure for each of a plurality of events, and is a format in which the information processing apparatus can automatically execute the processing. By acquiring the event-related information including the command information which is the information of the similar event, the information related to the similar event can be appropriately extracted.

  Further, in the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires event-related information including information indicating each evaluation of a plurality of events.

  As described above, the information processing apparatus 100 according to the embodiment can appropriately extract the information related to the similar event by acquiring the event-related information including the information indicating the evaluation of each of the plurality of events.

  Further, in the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires event-related information including a score indicating each evaluation of a plurality of events.

  As described above, the information processing apparatus 100 according to the embodiment can appropriately extract information related to the similar event by acquiring the event-related information including the score indicating the evaluation of each of the plurality of events.

  Further, in the information processing apparatus 100 according to the embodiment, the extraction unit 134 ranks event-related information of similar events based on the extracted scores of similar events.

  As described above, the information processing apparatus 100 according to the embodiment ranks the event-related information of the similar events based on the extracted scores of the similar events, thereby appropriately extracting the information related to the similar events. it can.

  The information processing apparatus 100 according to the embodiment includes a providing unit 135. The providing unit 135 provides a predetermined service based on the similar event extracted by the extracting unit 134.

  As described above, the information processing apparatus 100 according to the embodiment can appropriately provide a service using information on a similar event by providing a predetermined service based on the extracted similar event.

  In addition, in the information processing apparatus 100 according to the embodiment, the providing unit 135 provides an information providing service related to event-related information associated with a similar event.

  As described above, the information processing apparatus 100 according to the embodiment appropriately provides the service using the information on the similar event by providing the information providing service on the event-related information associated with the extracted similar event. be able to.

  In the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires graph information in which a plurality of vectors corresponding to each of a plurality of events for which a log is output in a predetermined system are connected according to similarity. I do.

  As described above, the information processing apparatus 100 according to the embodiment acquires graph information in which a plurality of vectors corresponding to each of a plurality of events for which a log is output in a predetermined system is connected according to similarity. , Information related to similar events can be appropriately extracted.

  In the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires graph information in which a plurality of vectors corresponding to each of a plurality of events for which a log is output in a predetermined system are connected according to similarity. I do.

  As described above, the information processing apparatus 100 according to the embodiment acquires graph information in which a plurality of vectors corresponding to each of a plurality of events for which a log is output in a predetermined system is connected according to similarity. , Information related to similar events can be appropriately extracted.

  In the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires graph information in which a plurality of vectors corresponding to each of a plurality of events related to an alert in a predetermined system are connected according to similarity.

  As described above, the information processing apparatus 100 according to the embodiment obtains graph information in which a plurality of vectors corresponding to each of a plurality of events relating to an alert in a predetermined system are connected according to similarity, thereby obtaining a similar event Can be appropriately extracted.

  In the information processing apparatus 100 according to the embodiment, the acquisition unit 131 acquires graph information in which a plurality of vectors obtained by vectorizing information on logs corresponding to each of a plurality of events are connected.

  As described above, the information processing apparatus 100 according to the embodiment acquires graph information in which a plurality of vectors obtained by vectorizing information regarding logs corresponding to each of a plurality of events is connected, and thereby the information related to the similar event is obtained. Information to be extracted can be appropriately extracted.

[8. Hardware configuration)
The information processing apparatus 100 according to the embodiment described above is realized by, for example, a computer 1000 having a configuration as shown in FIG. FIG. 13 is a hardware configuration diagram illustrating an example of a computer that realizes the functions of the information processing device. The computer 1000 includes a CPU 1100, a RAM 1200, a read only memory (ROM) 1300, a hard disk drive (HDD) 1400, a communication interface (I / F) 1500, an input / output interface (I / F) 1600, and a media interface (I / F). ) 1700.

  The CPU 1100 operates based on a program stored in the ROM 1300 or the HDD 1400, and controls each unit. The ROM 1300 stores a boot program executed by the CPU 1100 when the computer 1000 starts up, a program that depends on hardware of the computer 1000, and the like.

  The HDD 1400 stores a program executed by the CPU 1100, data used by the program, and the like. The communication interface 1500 receives data from another device via the network N, sends the data to the CPU 1100, and transmits the data generated by the CPU 1100 to the other device via the network N.

  The CPU 1100 controls output devices such as a display and a printer and input devices such as a keyboard and a mouse via the input / output interface 1600. The CPU 1100 obtains data from an input device via the input / output interface 1600. Further, CPU 1100 outputs the generated data to an output device via input / output interface 1600.

  The media interface 1700 reads a program or data stored in the recording medium 1800 and provides the program or data to the CPU 1100 via the RAM 1200. The CPU 1100 loads the program from the recording medium 1800 onto the RAM 1200 via the media interface 1700, and executes the loaded program. The recording medium 1800 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc), a PD (Phase Change Rewritable Disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory. And so on.

  For example, when the computer 1000 functions as the information processing apparatus 100 according to the embodiment, the CPU 1100 of the computer 1000 executes a program or data (for example, a model M1 (model data MDT1)) loaded on the RAM 1200, The function of the control unit 130 is realized. The CPU 1100 of the computer 1000 reads and executes these programs or data (for example, the model M1 (model data MDT1)) from the recording medium 1800. As another example, these programs or data are transmitted from another device via the network N. May be obtained.

  As described above, some of the embodiments of the present application have been described in detail with reference to the drawings. However, these are exemplifications, and various modifications based on the knowledge of those skilled in the art, including the aspects described in the disclosure row of the invention, The invention can be implemented in other modified forms.

[9. Others)
Further, of the processes described in the above embodiment, all or a part of the processes described as being performed automatically can be manually performed, or the processes described as being performed manually can be performed. All or part can be performed automatically by a known method. In addition, the processing procedures, specific names, and information including various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified. For example, the various information shown in each drawing is not limited to the information shown.

  Each component of each device illustrated is a functional concept, and does not necessarily need to be physically configured as illustrated. That is, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed / arbitrarily divided into arbitrary units according to various loads and usage conditions. Can be integrated and configured.

  Further, the processes described in the above-described embodiments can be appropriately combined within a range that does not contradict the processing contents.

  Further, the “section (section, module, unit)” described above can be read as “means”, “circuit”, or the like. For example, the acquiring unit can be replaced with an acquiring unit or an acquiring circuit.

Reference Signs List 1 information processing system 100 information processing device 121 event information storage unit 122 index information storage unit 123 graph information storage unit 124 model information storage unit 130 control unit 131 acquisition unit 132 generation unit 133 determination unit 134 extraction unit 135 providing unit 10 terminal device 50 Information Provision Device N Network

Claims (23)

Graph information in which a plurality of vectors corresponding to each of the plurality of events are connected according to the similarity, and information associated with each of the plurality of events, and information related to the associated event. An event-related information, an acquisition unit that acquires information about one event,
Among the plurality of vectors of the graph information, the graph information is searched with a starting point vector serving as a starting point of the search for the graph information determined based on a predetermined criterion. By extracting a similar event that is an event similar to the event of, the extraction unit that extracts the event related information associated with the similar event,
An information processing apparatus comprising: A determining unit that determines the origin vector based on the index information used to determine the origin vector;
Further comprising
The extraction unit includes:
The information processing apparatus according to claim 1, wherein the similar event is extracted using the starting point vector determined by the determining unit as a starting point. The determining unit includes:
The information processing apparatus according to claim 2, wherein the starting point vector is determined based on the tree-structured index information. The acquisition unit,
The information according to any one of claims 1 to 3, wherein the graph information in which the plurality of vectors obtained by vectorizing a plurality of information corresponding to each of the plurality of events is connected is obtained. Processing equipment. The acquisition unit,
The information processing according to any one of claims 1 to 4, wherein the graph information in which the plurality of vectors in which character information corresponding to each of the plurality of events is vectorized is connected is acquired. apparatus. The extraction unit includes:
The said one event satisfies a predetermined condition, the said graph information is searched, and the said event related information matched with the said similar event is extracted. The Claim 1 characterized by the above-mentioned. An information processing apparatus according to claim 1. The extraction unit includes:
If the one event is different from a normal event, the graph information is searched, and the event-related information associated with the similar event is extracted. The information processing device according to claim 1. The extraction unit includes:
The information processing apparatus according to claim 1, wherein the graph information is retrieved at a predetermined timing, and the event-related information associated with the similar event is extracted. The acquisition unit,
The information processing apparatus according to any one of claims 1 to 8, wherein the event-related information including an analysis result of each of the plurality of events is acquired. The acquisition unit,
The information processing apparatus according to any one of claims 1 to 9, wherein the event-related information including a reason for occurrence of each of the plurality of events is acquired. The acquisition unit,
The information processing apparatus according to any one of claims 1 to 10, wherein the event-related information including information indicating an action after the occurrence of each of the plurality of events is acquired. The acquisition unit,
The information processing apparatus according to any one of claims 1 to 11, wherein the event-related information including information indicating a content of coping with each of the plurality of events is acquired. The acquisition unit,
The event-related information including command information that is information based on a process executed by a predetermined information processing device as a response to each of the plurality of events, and is information in a format in which the information processing device can automatically execute the process. The information processing apparatus according to claim 1, wherein the information is acquired. The acquisition unit,
The information processing apparatus according to any one of claims 1 to 13, wherein the event-related information including information indicating evaluation of each of the plurality of events is acquired. The acquisition unit,
The information processing device according to any one of claims 1 to 14, wherein the event-related information including a score indicating an evaluation of each of the plurality of events is acquired. The extraction unit includes:
The information processing apparatus according to claim 15, wherein the event related information of the similar event is ranked based on the extracted score of the similar event. A providing unit that provides a predetermined service based on the similar event extracted by the extracting unit;
The information processing apparatus according to claim 1, further comprising: The providing unit,
The information processing apparatus according to claim 17, wherein an information providing service related to the event-related information associated with the similar event is provided. The acquisition unit,
19. The graph information in which a plurality of vectors corresponding to each of the plurality of events for which a log is output in a predetermined system is obtained in accordance with similarity. The information processing device according to item. The acquisition unit,
20. The information processing apparatus according to claim 19, wherein the graph information in which a plurality of vectors corresponding to each of the plurality of events related to an alert in the predetermined system is connected according to similarity. The acquisition unit,
21. The information processing apparatus according to claim 19, wherein the graph information in which the plurality of vectors obtained by vectorizing information regarding the log corresponding to each of the plurality of events is obtained. . An information processing method executed by a computer,
Graph information in which a plurality of vectors corresponding to each of the plurality of events are connected according to the similarity, and information associated with each of the plurality of events, and information related to the associated event. An event-related information, an acquisition step of acquiring information on one event,
Among the plurality of vectors of the graph information, the graph information is searched with a starting point vector serving as a starting point of the search for the graph information determined based on a predetermined criterion. An extraction step of extracting the event-related information associated with the similar event by extracting a similar event that is an event similar to the event,
An information processing method comprising: Graph information in which a plurality of vectors corresponding to each of the plurality of events are connected according to the similarity, and information associated with each of the plurality of events, and information related to the associated event. An event-related information, an acquisition procedure for acquiring information about one event,
Among the plurality of vectors of the graph information, the graph information is searched with a starting point vector serving as a starting point of the search for the graph information determined based on a predetermined criterion. An extraction procedure for extracting the event-related information associated with the similar event by extracting a similar event that is an event similar to the event,
An information processing program for causing a computer to execute the following.

Images