JP6997668B2 - Related Events Integration Programs, Devices and Methods - Google Patents

Description

The present invention relates to a technique for investigating relevance in various events that occur.

In recent years, with the spread of ICT (Information and Communication Technologies) systems, a phenomenon in which various types of events occur in large numbers due to one cause often occurs. For example, in a communication system, when a communication failure occurs at one location, a large number of events related to the failure are generated from a plurality of different devices such as a server and a router.

In this case, if many of these events can be associated at high speed, the cause of the failure can be estimated relatively easily. However, in reality, it is very difficult to clarify the relationship between the events that have occurred, and in many cases, it is not possible to determine the cause of the event.

For such a problem, for example, Patent Document 1 extracts features from a plurality of events that occur at the time of a system failure, clusters the failures based on the features, and determines the cause of the failure based on the events included in the same failure cluster. We are proposing a technology to generate rules. Further, for example, Patent Document 2 acquires event data including information on a sender, a receiver, and a transmission time of a message in a communication event performed by a plurality of communication tools of different types, and obtains constant event data. It discloses the technology to handle the communication event log in an integrated manner by converting it to the data in the data format of.

Further, Patent Document 3 discloses a technique invented by the inventor of the present application to extract events related to each other from different types of event streams. Specifically, this technique acquires "first event" and "second event" from each of the first event stream and the second event stream, and obtains the first event identifier and its start time information. Using the buffer that stores the "first event pair" that contains, a "second event pair" that includes the "first event" and "second event" that are related to each other is generated. ing.

Here, when the first end event is acquired, the event pair related to this "first event" stored in the buffer is deleted, so that the "first event" and "first event" that may be related are deleted. It is possible to reliably extract only the "second event". Further, when generating a "second event pair" indicating a related event, the event pair is generated in a form that can guarantee the time inclusion relationship. That is, it is possible to extract events related to each other without being bound by the simple proximity of the time related to the event.

Japanese Unexamined Patent Publication No. 2011-209908 Japanese Unexamined Patent Publication No. 2012-141720 JP-A-2017-58915

However, in the prior art as described in Patent Documents 1 and 2, among a plurality of events that have occurred, the events that have occurred within a predetermined time range are only associated with each other, and the occurrence times are not necessarily close to each other. It was very difficult to extract events that are related to each other.

For example, the technique described in Patent Document 1 associates synchronous events by using a time window in a predetermined time range and including events whose occurrence time difference is within this time window in the same event block. .. Therefore, the judgment of the relationship between the events is bound by the time of occurrence within this time window. On the other hand, the technique described in Patent Document 2 also associates synchronous events by including the attributes of events that occurred within a predetermined time range before and after the event occurrence time as the base point in the event data. Only.

In this regard, in the technique described in Patent Document 3, it is possible to make an association based on a time inclusion relationship, such as associating another event included in the time range from the start time to the end time of the event. .. However, even in the technique described in Patent Document 3, for example, when one event and a plurality of other events are related, it is not assumed that such a one-to-many association is performed. ..

By the way, such a one-to-many relationship is similar to the time inclusion relationship, for example, it receives a request from a terminal, and front-end and back-end systems such as servers and network devices cooperate to reply to the terminal. It occurs not a little in the communication system. However, in the past, it has been very difficult to find such a relationship and extract events related to each other in a one-to-many manner.

Therefore, it is an object of the present invention to provide a program, an apparatus and a method capable of extracting events related to each other in a one-to-many manner.

According to the present invention, it is a program for operating a computer mounted on a device for extracting events related to each other from each of different types of first event group and second event group.
Each event has an identifier of the event and time information related to the time of the event.
At least one event included in the first event set, which is a set of events having the identifier of the related investigation target in the first event group, and is a set of events having the same identifier in the second event group. At least one event having a time information having a small time difference with respect to the time information in each event included in a certain second event set is selected, and the selected at least one event is used for each second event set. ID matching means for generating the first event subset to be
Event integration is a combination of the first event subsets generated for each second event set, and as a result of the combination, the events included in the first event set belong to each other without duplication. The set of identifiers related to the second event set corresponding to the first event subset included in the determined event integration combination is determined to be the identifier set related to the identifier of the related investigation target. A related event integration program is provided, which is characterized by operating a computer as a means for determining related events.

In the related event integration program according to the present invention, the related event determining means integrates the combinations in which the events of a predetermined ratio or more included in the first event set belong to each other without duplication. It is also preferable to determine the combination for use.

Further, as an embodiment of the related event integration program according to the present invention, the present program reduces the time difference of the time information of the events included in the first event subset for each generated first event subset. Based on this, the computer is further made to function as a similarity calculation means for calculating the similarity of the first event subset.
It is also preferable that the related event determining means determines the combination for event integration that has the maximum total similarity in the first event subset included in the combination.

Further, in the embodiment related to the similarity calculation described above, in each generated first event subset, the program includes the number of events belonging to the first event subset and all the events included in the first event subset. Further functioning the computer as a coverage calculation means for calculating the coverage of the first event subset based on the ratio to the number of events belonging to the first event subset.
The related event determining means is the first event subset included in the maximum similarity combination among the maximum similarity combinations when there are a plurality of maximum similarity combinations having the maximum total similarity. It is also preferable to determine the combination for event integration that has the maximum total coverage.

Further, as another embodiment of the related event integration program according to the present invention, the present program includes, for each generated first event subset, the number of events belonging to the first event subset and the first event set. Further functioning the computer as a coverage calculation means for calculating the coverage of the first event subset based on the ratio to the number of events belonging to all the first event subsets.
It is also preferable that the related event determining means determines the combination having the maximum total coverage in the first event subset included in the combination as the event integration combination.

Further, in the embodiment related to the above-mentioned coverage calculation, the present program is based on the small time difference of the time information of the events included in the first event subset for each generated first event subset. Then, the computer is further functioned as a similarity calculation means for calculating the similarity of the first event subset.
When there are a plurality of maximum coverage combinations having the maximum total coverage, the related event determining means is the first event subset included in the maximum coverage combination among the maximum coverage combinations. It is also preferable to determine the combination for event integration that has the maximum total similarity.

Further, in the related event integration program according to the present invention, the related event determination means is used.
The combination for event integration is determined as the solution of the set cover problem that selects the first event subset that minimizes the sum of the weights from the family of the first event subsets to which the weights are given.
The weight given to each first event subset is included in the dissimilarity calculated based on the magnitude of the time difference of the time information of the events included in the first event subset, and / or the family. It is also preferable to make a determination based on the ratio of the number of events belonging to all the first event subsets to the number of events belonging to the first event subset.

Further, in the related event integration program according to the present invention, the ID matching means is a union of the first event set and the second event set, and the event to which it belongs is given an order related to time based on its own time information. It is also preferable to generate the union and, based on the union, generate the first event subset having time information having a small time difference with respect to the time information in each event included in the second event set. ..

Further, in the related event integration program according to the present invention, the ID matching means has the identifier of the related investigation target and the identifier related to the corresponding second event set for the first event subset generated for each second event set. Give a subset identifier that includes and
The related event determination means targets the related investigation target for a set of identifiers related to the second event set included in the subset identifier given to the first event subset included in the determined event integration combination. It is also preferable to determine the set of identifiers related to the identifier.

Further, as a further other embodiment of the related event integration program according to the present invention, each event has an identifier of the event, time information related to the time of the event, and attribute information related to the event.
The ID matching means is said to be the case when the attribute information of the at least one event included in the first event set matches or is similar to the attribute information of the event of the second event set associated with the small time difference. It is also preferred to generate the first event subset with at least one event.

According to the present invention, there is also a related event integration device that extracts events related to each other from each of the different types of first event group and second event group.
Each event has an identifier of the event and time information related to the time of the event.
At least one event included in the first event set, which is a set of events having the identifier of the related investigation target in the first event group, and is a set of events having the same identifier in the second event group. At least one event having a time information having a small time difference with respect to the time information in each event included in a certain second event set is selected, and the selected at least one event is used for each second event set. ID matching means for generating the first event subset to be
Event integration is a combination of the first event subsets generated for each second event set, and as a result of the combination, the events included in the first event set belong to each other without duplication. The set of identifiers related to the second event set corresponding to the first event subset included in the determined event integration combination is determined to be the identifier set related to the identifier of the related investigation target. A related event integration device is provided, which comprises a related event determining means.

According to the present invention, there is a related event integration method executed by a computer mounted on a device for extracting events related to each other from each of different types of first event group and second event group.
Each event has an identifier of the event and time information related to the time of the event.
At least one event included in the first event set, which is a set of events having the identifier of the related investigation target in the first event group, and is a set of events having the same identifier in the second event group. At least one event having a small time difference with respect to the time information in each event included in a certain second event set is selected, and the selected at least one event is used for each second event set. And the steps to generate the first event subset
Event integration is a combination of the first event subsets generated for each second event set, and as a result of the combination, the events included in the first event set belong to each other without duplication. The set of identifiers related to the second event set corresponding to the first event subset included in the determined event integration combination is determined to be the identifier set related to the identifier of the related investigation target. A method of integrating related events is provided, which comprises having a step.

According to the related event integration program, apparatus and method of the present invention, events related to each other can be extracted in a one-to-many manner.

It is a functional block diagram which shows the functional structure in one Embodiment of the related event integration apparatus by this invention. It is a schematic diagram for demonstrating an embodiment of the process in the related event determination part which concerns on this invention. It is a table which shows one Example of the related event integration method by this invention. It is a table which shows one Example of the related event integration method by this invention. It is a table which shows one Example of the related event integration method by this invention. It is a table which shows one Example of the related event integration method by this invention. It is a table which shows one Example of the related event integration method by this invention. It is a table which shows one Example of the related event integration method by this invention. It is a table which shows one Example of the related event integration method by this invention. It is a schematic diagram schematically showing the related event determination process in one embodiment of the related event integration method according to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a functional block diagram showing a functional configuration in one embodiment of the related event integration device according to the present invention.

The related event integration device 1 of the present embodiment shown in FIG. 1 is an event "related to each other in a one-to-many manner" from each of the different types of first event group and second event group acquired via the communication interface 101. It is a device to extract.

Here, as the first event group, a time series of various events generated by processing in a back-end system (for example, a server of a communication network connected to a mobile phone network) in a communication network is adopted, while a second event group is adopted. As an event group, a time series of various events generated by processing in a front-end system (for example, a base station constituting a mobile phone network) in the same communication network can be adopted. Of course, on the contrary, the event time series related to the front-end system and the back-end system may be adopted for each of the first event group and the second event group. Of course, as the first and second event groups, it is also possible to adopt two series of event streams in which the events can be related to each other in other systems.

Specifically, as an event, for example, an event that occurs in connection with acquisition of various addresses by a user, acquisition of a URL (Uniform Resource Locator), acquisition of user's location information, etc., and further, for example, a device / device. Events that appear in the logs generated by various processes in the above and the logs generated by the occurrence of alerts, failures, etc. are applicable. In addition, various events can be adopted as events if the time information related to the occurrence / end of the event can be specified. Specifically, each event handled by this device 1 is basically
<Event identifier (event ID), information related to event time (time information)>
The data is in the form of.

Further, in the present embodiment, "related to each other in a one-to-many manner" means that one event in the first event group is related to a plurality of events in the second event group. be.

For example, a situation where the back-end server sets a permanent identifier (ID), while the front authentication server sets a valid period such as a session timeout to change the identifier (ID), or DHCP (Dynamic). Host Configuration Protocol) A "one-to-many related" event occurs when a server dynamically assigns or periodically changes its IP (Internet Protocol) address (as an ID) to a client. Not a few. Furthermore, even when a user or the like accesses using an ID such as a cookie that may disappear in a short period of time and may be attached with another one, it is "related to each other in a one-to-many manner". Events can occur.

The event ID that identifies the event may be a communication device-specific number related to the event, for example, a serial number, a MAC (Media Access Control) address, or the like. It can also be a network address such as an IP address or a domain name. Further, it may be an ID generated by the application program, for example, an application ID, a user ID, a cookie ID, or the like. Further, as the event ID, it is also possible to adopt an anonymous number obtained as a result of subjecting these information to non-identification processing.

Here, the notations and terms used in the following description will be described.
(A) For the first event belonging to the first event group, their event IDs are collectively represented as "ID1". In addition, each event ID is expressed in the form of "ID1- *".
(B) Similarly, for the second event belonging to the second event group, their event IDs are collectively represented as "ID2". In addition, each event ID is also expressed in the form of "ID2- *".

(C) Among the first event group, a set of events having an event ID (for example, ID1-1) to be investigated is referred to as a "first event set". Here, the ID of the "first event set" is also the event ID (for example, ID1-1).
(D) Further, in the second event group, a set of events having the same event ID (specifically, one ID2- *) is referred to as a "second event set". Here, the ID of the "second event set" is also the event ID (ID2- *).

Similarly, in FIG. 1, the related event integration device 1 is characterized by its feature.
(A) Among the first event group, "at least one event" included in the "first event set" related to the ID of the related investigation target, and the time in each event included in the "second event set". Select "at least one event" having time information with a small time difference with respect to the information, and with the selected "at least one event", the corresponding "first event subset" for each "second event set". ID matching unit 112 that generates
(B) It is a combination of the "first event subset" (generated for each second event set), and as a result of the combination, the events included in the "first event set" belong to each other without duplication. The combination to be different is determined as the "event integration combination", and the set of IDs related to the "second event set" corresponding to the "first event subset" included in the determined "event integration combination" is set. It has a related event determination unit 115 that determines a set of identifiers related to the ID to be investigated.

For example, although it is an embodiment of FIG. 2 which will be described in detail later, in the figure, when the ID of the related investigation target is ID1-1, three “first event portions” are set as “event integration combinations”. "Set" ID1-1-2-1, ID1-1-2-2 and ID1-1-2-3 are determined, and the ID set ID2-1, related to the three "second event sets" corresponding to them, respectively. ID2-2 and ID2-3 have been determined to be related to ID1-1, which is the related investigation target ID.

As described above, the related event integration device 1 can be a part of "one" by utilizing the temporal proximity of the related events from the second event group side which can be "many" of "one-to-many" first. The "first event subset" is listed as a candidate, then the set of "first event subsets" ("event integration combination") that becomes "one" of "one-to-many" is determined, and then the corresponding "second event subset" is determined. Perform related event integration processing that makes full use of the skillful method of determining "event set" as (a set of) related events.

This makes it possible to extract and integrate events related to each other in a one-to-many manner, which was difficult to grasp in the past.

Further, as described above, the related event integration device 1 first approaches from the second event group side to the first event group side using temporal proximity, and then wraps around without executing complicated calculations. Since the related "second event set" is determined in, it is possible to search for the related event in a shorter time using less storage area.

Furthermore, a group of events characterized by temporal proximity between events can generally occur, for example, in a form in which front-end and back-end systems operate in cooperation, and also in a one-to-many manner with each other. Related events often occur in various cases as described above. Therefore, it is understood that the scope of application of the related event integration process by the related event integration device 1 is considerably wide.

[Functional configuration of the device]
Similarly, according to the functional block diagram shown in FIG. 1, the related event integration device 1 includes a communication interface 101, a first event buffer 102, a second event buffer 103, an event set storage unit 104, and an event union. It has a storage unit 105, a first event subset storage unit 106, a coverage / similarity storage unit 107, an event integrated information storage unit 108, a display (DP) 109, and a processor memory.

Here, the processor memory stores an embodiment of the related event integration program according to the present invention, and also has a computer function, and by executing the related event integration program, the related event integration is performed. Carry out the process. For this reason, the related event integration device 1 may be a dedicated device or unit, but is equipped with a related event integration program according to the present invention, for example, a personal computer (PC), a notebook computer or a tablet computer, or a computer. It can also be a smartphone or the like. Further, it is also preferable that the storage destination of each storage unit is appropriately selected from any of cache memory, main memory, swap memory, and storage according to the capacity.

Further, this processor memory has an event acquisition unit 111, an ID matching unit 112 including a time difference determination unit 112a, a coverage calculation unit 113, a similarity calculation unit 114, and a total coverage / similarity as functional configuration units. It has a related event determination unit 115 including a degree determination unit 115a, and an application 121. Note that these functional components can be regarded as the functions of the related event integration program stored in the processor memory. Further, the processing flow shown by connecting the functional components of the related event integration device 1 in FIG. 1 with arrows is also understood as an embodiment of the related event integration method according to the present invention.

Similarly, in FIG. 1, the first event buffer 102 and the second event buffer 103 accumulate the first event group and the second event group received via the communication interface 101, respectively, and receive or receive them in the order of reception. The first event and the second event are sequentially output to the event acquisition unit 111 according to the request contents.

The event acquisition unit 111 has the ID matching unit 112, the coverage calculation unit 113, the similarity calculation unit 114, and the similarity calculation unit 114 according to the received request contents or the acquisition order of the input first event and second event. Output to the related event determination unit 115. Further, it is also preferable to appropriately store the input first event and second event in the event set storage unit 104, and to read them out from the same storage unit 104 as necessary. Here, in the present embodiment, the events handled are each.
<Event ID, occurrence time>
The data is in the form of. Of these, the data of the occurrence time may be a date type or a character string type such as 2014/01/01 11:22:33, or may be an integer type representing the elapsed time based on a predetermined date and time. can. The unit of elapsed time can be any time width.

Here, in the present embodiment, the first event group stored in the first event buffer 102 is on the “one” side of the “one-to-many form relationship” and is stored in the second event buffer 103. The second event group is on the "many" side. That is, hereinafter, the case where one event in the first event group is related to another plurality of events in the second event group is searched.

As a matter of course, one event in the second event group is associated with a plurality of other events in the first event group by exchanging the processes described below for the first event group and the second event group. It is also possible to search if it is. Incidentally, in the present embodiment, it is premised that the "many" on the second event group side are mutually exclusive with respect to the occurrence time.

Similarly, in FIG. 1, the time difference determination unit 112a of the ID matching unit 112 is
(A) With each of the first events having the event ID (for example, ID1-1) to be investigated in relation to each of the second event sets, which is a set of events having the same event ID in the second event group. Calculate the "time difference" of the occurrence time between
(B) For each second event set, the first event (ID1-1) with the smallest "time difference" for each of the second events (ID2- *) included in the second event set (ID2- *). ) Is determined.

Next, the ID matching unit 112 has the first event (ID1-1) of the above (b) determined for each second event set, and the first event subset corresponding to the second event set (ID2- *). Is generated. The generated first event subset may be appropriately stored in the first event subset storage unit 106, and may be appropriately read from the storage unit 106 as required.

Here, as a modification mode, each event handled is
<Event ID, occurrence time, attribute information>
Consider the case where the data is in the form of. Of these, the attribute information is information representing the attributes of the event, and various information can be adopted, but for example, it may be ID information of the domain in which the event is occurring.

In this case, in the ID matching unit 112, the attribute information possessed by the first event (ID1-1) of the above (b) determined for each second event set ID2 is the second destination to which the "time difference" is the minimum. When the attribute information of the event contained in the event set (ID2- *) matches or is similar, the first event subset (ID1-1) of the above (b) determined above is used to generate the first event subset. Is also preferable.

As a result, for example, events that are matched in time but have different attributes, for example, events related to different domains can be excluded from related events. That is, it is possible to further narrow down the events that are matched in time according to the attribute information, preferentially extract the related event of a desired shape, or extract only the related event.

Next, the calculation of the degree of coverage and the degree of similarity used in the subsequent related event determination process will be described. Incidentally, as will be described later, this related event determination process may be carried out using either one of the calculated coverage and the similarity, or it is also preferable that the related event determination process is carried out in consideration of both.

Similarly, in FIG. 1, the coverage calculation unit 113 has the number of events belonging to the first event subset and the first event set (ID1-1) for each first event subset generated by the ID matching unit 112. The coverage of the first event subset is calculated based on the ratio to the number of events belonging to all the first event subsets included in. Specifically, the ratio may be used as the coverage.

Further, the similarity calculation unit 114 sets (corresponding destination first) in the occurrence time (time information) of the first event included in the first event subset for each first event subset generated by the ID matching unit 112. 2 The degree of similarity of the first event subset is calculated based on the smallness of the above "time difference" (which is the difference from the event occurrence time (time information)).

Specifically, the similarity calculation unit 114
(A) The sum of the "time differences" of all the first events included in the first event subset is the dissimilarity D of the first event subset, and (1-D) or 1 / D is the similarity. As good as
(B) If the "time difference" of each first event included in the first event subset is within the predetermined threshold value TH, 1 is counted, and if not, 0 is counted, and the total count and the total number of counts are counted. The ratio with and may be used as the degree of similarity.

Incidentally, the degree of similarity is a scale that increases as the "time difference" becomes smaller, and various monotonic decreasing functions of the "time difference" can be adopted. Further, the coverage and similarity calculated as described above may be appropriately stored by the coverage / similarity storage unit 107, and may be appropriately read out in response to a request from the related event determination unit 115 or the like.

Next, the related event determination unit 115
(A) A combination of the first event subsets generated for each second event set ID2, and as a result of the combination, events of a predetermined ratio (for example, 100% or 95%) or more included in the first event set are included. The combination that will belong to each other without duplication is determined as "event integration combination".
(B) The set of IDs related to the second event set (ID2- *) corresponding to the first event subset included in the determined "event integration combination" is related to the ID (ID1-1) to be investigated. Determine the ID set to be used.

Here, regarding the process (a) above, among all the first event subset families, the "combination of the first event subsets generated for each second event set ID 2" is set as the first event subset family. It is also possible to regard one of them as a process of selecting as an "event integration combination".

Further, in the determination of the "event integration combination" of the above (a), the determination is made in further consideration of the determination result described below in the total coverage / similarity determination unit 115a of the related event determination unit 115. Is more preferable. This makes it possible to integrate events that have a more reliable relationship with each other.

Specifically, the total coverage / similarity determination unit 115a is
(A1) Among the combinations of the first event subsets generated for each second event set ID2, the maximum similarity combination in which the total degree of similarity in the first event subset included in the combination is the maximum is "event integration". It is also preferable to decide on "combination", and further,
(A2) When there are a plurality of maximum similarity combinations, among these maximum similarity combinations, the one having the maximum total coverage in the first event subset included in the maximum similarity combination is "event". It may be decided as "combination for integration".

Further, as a modification mode, the total coverage / similarity determination unit 115a is
(A3) Among the combinations of the first event subsets generated for each second event set ID2, the maximum coverage combination in which the total coverage in the first event subset included in the combination is the maximum is "event integration". It is also possible to decide on a "combination", at which time
(A4) When there are a plurality of maximum coverage combinations, among these maximum coverage combinations, the one having the maximum total similarity in the first event subset included in the maximum coverage combination is "event". It may be decided as "combination for integration".

Further, the total coverage / similarity determination unit 115a is further modified as a further modification.
(A5) Using the weight w (0 ≦ w ≦ 1) as the degree to which the degree of similarity is emphasized, the following equation
(Comprehensive evaluation) = w * (similarity) + (1-w) * (coverage)
Of the combinations of the first event subsets generated for each second event set ID2, the combination having the maximum total evaluation degree in the first event subset included in the combination is selected. It is also possible to decide on an "event integration combination".

FIG. 2 is a schematic diagram for explaining an embodiment of processing in the related event determination unit 115. In the embodiment of the figure, the event integration combination is determined by the similarity determination in (a1) above.

According to the embodiment of FIG. 2, when the first event ID of the related investigation target is ID1-1, the five second event sets ID2-1, ID2-2, ID2-3, ID2-4 and Five first event subsets ID1-1-2-1, ID1-1-2-2, ID1-1-2-3, ID1-1-2-4 and ID1 associated with ID2-5, respectively. -1-2-5 has been decided. In addition, the similarity is calculated for each of these first event subsets. The assignment of IDs of these first event subsets will be described later with reference to another more specific embodiment.

Here, in the present embodiment, the related event determination unit 115 (FIG. 1) includes all the events included in the first event set ID 1-1 (that is, “predetermined ratio” = 100%) without duplication. And the total of the similarity is maximum (2.6 in total), the three first event subsets ID1-1-2-1, ID1-1-2-2 and ID1-1-2-3 are integrated into the event. The combination has been decided.

Next, the related event determination unit 115 determines the ID sets {ID2-1, ID2-2, related to the three second event sets ID2-1, ID2-2, and ID2-3 corresponding to these three first event sets, respectively. ID2-3} is determined as the related event ID set related to ID1-1, which is the related investigation target ID.

By the way, as understood in this embodiment, the related event integration device 1 approaches from the second event group side to the first event group side by using the temporal proximity, and then executes a complicated calculation. Since the event integration combination is determined in a form that wraps around without any problem, related events (in this embodiment, ID1-1 and ID2-1, ID2-2, and ID2-3 are related events) have less storage space. Below, it is possible to search in a shorter time.

Returning to FIG. 1, the related event determination unit 115 appropriately stores the event integration information including the determined related event in the event integration information storage unit 108, reads it out in response to a request from the application 121 or the like, and reads the application 121 or the like. It is also preferable to output to. Further, for example, information on related events may be displayed on the display 109, or may be transmitted to an external information processing device via the communication interface 101.

It is also preferable that the application 121 performs predetermined processing by using the acquired related event information, for example, displaying the processing result on the display 109 or transmitting the processing result to an external information processing device via the communication interface 101. ..

[Example]
3 to 9 are tables showing an embodiment of the related event integration method according to the present invention. Further, FIG. 10 is a schematic diagram schematically showing the related event determination process in this embodiment.

In this embodiment, first, the two first event sets ID1-1 and ID1-2 shown in FIG. 3A and the five second event sets ID2-1 and ID2 shown in FIG. 3B are shown. -2, ID2-3, ID2-4 and ID2-5 are stored in the event set storage unit 104 as related investigation targets. Here, each event is data in which the ID of the event and the time of occurrence of the event are associated with each other.

Next, as shown in FIG. 4, the ID matching unit 112 (FIG. 1) has the first event set ID1-1 and ID1-2 and the second event set ID2-1, ID2-2, ID2-3, ID2-4. And ID2-5, which is an event union with an order related to time based on the time information (event date and time) possessed by the event to which it belongs.

Specifically, each event included in the first event set and the second event set is sorted in the order of the event date and time of the event, and the convenient event numbers 1 to 29 are assigned in that order. The event sum set table is generated and stored in the event sum set storage unit 105 (FIG. 1). This event union table is a table that stores intermediate data required for calculating the time difference and performing ID matching, and the order of the events arriving at the event acquisition unit may be the order of the event date and time. If guaranteed, its generation is unnecessary. If it is guaranteed that the time width between the event date and time and the date and time of the subsequent event arrival is less than or equal to the predetermined time width, the retention period of the event union table shall be within the predetermined time width. Can be limited to.

By the way, in the following description of this embodiment, the event number is not often referred to directly, but in the actual processing, each event included in the event set and the event subset uses the event number assigned at this stage. It will be recognized and treated as an identifier.

Further, the ID matching unit 112 (FIG. 1) is based on the event sum set generated as described above, and as shown in FIG. 5, with respect to the event date time (time information) in each event included in the second event set. The first event having the event date and time (time information) having the minimum time difference is determined, and the first event subset summarizing the first event is generated.

Here, since the event sum set sorted in order of day and time is generated in advance, the event number of each second event included in one second event set is compared with the first event included in the first event set. Of the event numbers in the above, the process of specifying the nearest event number in terms of the day time difference is facilitated.

In this embodiment, when there are a plurality of event numbers having the same day and time difference, the event number with the lowest number is selected. In this respect, of course, it is also possible to determine one event number by referring to, for example, a day time of seconds or less, and finding a more accurate nearest neighbor. Furthermore, another criterion can be set and an event number that meets the criterion can be selected.

Further, in this embodiment, "one-to-many" in which event numbers having the same day and time difference correspond to a plurality of event numbers is not allowed. For example, in the table of FIG. 5, for event 20, among the event numbers of the first event included in the first event set, the event number closest to the point of the day time difference is the event 21 which is another event number. It has already been associated. Therefore, for the event 20, "-" indicating that the first event of the corresponding destination does not exist is attached. As a matter of course, an embodiment that allows the above-mentioned "one-to-many" is also possible.

Further, as shown in FIG. 5, the ID matching unit 112 (FIG. 1) further, as shown in FIG. 5, has the ID of the first event to be the related investigation target for the first event subset generated for each second event set (this embodiment). Then, a subset ID in the form of including ID1-1 and ID1-2) and the ID of the corresponding second event set is assigned.

Specifically, for example, 3 associated with each of the three second events (event numbers 2, 3 and 5) included in the second event set ID 2-1 (included in the first event set ID 1-1) 3. An ID of "ID1-1-2-1" including ID1-1 and ID2-1 is assigned to the first event subset consisting of one first event (event numbers 1, 4 and 6). Has been done.

Next, in this embodiment, the similarity calculation unit 114 (FIG. 1), as shown in FIG. 6, for each generated first event subset, the day of the first event included in the first event subset. The day time difference (from the day time of the corresponding second event) at the time is calculated. Here, the day time difference in the table of FIG. 6 represents the absolute value of the difference between the two day times in minutes.

The similarity calculation unit 114 (FIG. 1) then calculates the similarity in the first event subset generated for each second event set based on the previously calculated day-time difference, as shown in FIG. 7. is doing. Specifically, in this embodiment, the average value of the day-time difference of the first event included in the first event subset is obtained, and the reciprocal of the average value is calculated as the degree of similarity.

For example, in the first event subset ID 1-1-2-1, the average value of the day-time differences is 1, so the similarity is 1, which is the reciprocal of the same. Further, in the first event subset ID1-1-2-2, the average value of the day-time difference is 1/3, so the similarity is 3 (= 3/1).

Incidentally, when the average of the day-time differences is 0, the similarity becomes infinite, but as the similarity in that case, for example, the maximum value on the system may be set. The similarity can also be applied to a one-to-many combination of the first event ID 1 and the second event ID 2. In this case as well, as in the above calculation method, the reciprocal of the average value of the day-time differences of the related event numbers may be used as the similarity, and various other scales as long as the smaller the day-time difference is, the higher the reciprocal is. Things can be adopted as the degree of similarity.

Further, in this embodiment, the coverage calculation unit 113 (FIG. 1) calculates the coverage in the first event subset generated for each second event set, as shown in FIG. Specifically, in this embodiment, the ratio of the total number of events included in the first event subset (ID1- * -2- *) to the total number of events included in the first event set (ID1- *) is calculated. Calculated as coverage.

For example, the first event set ID1-1 contains nine events, while the first event subset ID1-1-2-1 contains three events, so the coverage is 0.333. (= 3/9).

Here, from the coverage calculation in this embodiment, the coverage also determines the ratio of the first event subset associated with the second event set to be included in the original first event set. Be caught. That is, it is also understood to indicate the degree of the inclusion relationship between the first event set and the second event set. The coverage can also be applied to a one-to-many combination of the first event ID 1 and the second event ID 2. In this case, the coverage can be calculated by the ratio of the events included in the first event subset to the events included in the first event set.

Next, the related event determination unit 115 (FIG. 1) uses the similarity and coverage calculated for each first event subset (second event set) as shown in FIG. 9, and the first event ID 1 The (one-to-many) combination of related events between and the second event ID 2 is determined, and this is output as the event integration result.

Here, in this embodiment, as in the above (a1) described above, among the combinations of the first event subsets generated for each second event set ID2, the similarities in the first event subset included in the combination. The maximum similarity combination having the maximum total degree is determined as the "event integration combination", and when there are a plurality of maximum similarity combinations as described in (a2) above, these similarities are used. Among the maximum combinations, the combination having the maximum total coverage in the first event subset included in the maximum similarity combination is determined as the "event integration combination".

Specifically, the second event set ID2 corresponding to the first event ID 1 is added so that the similarity becomes higher first, and the process ends when the coverage reaches the maximum value 1. Processing is being performed. According to FIG. 9, for example, when the related investigation target is the first event ID 1-1, the second event sets ID2-2, ID2-3, and ID2 are arranged in descending order of similarity (of the corresponding first event subset). When -1 is added in sequence and the total coverage reaches 1, the set of these second event IDs {ID2-1, ID2-2, ID2-3} and the IDs of the related events to be investigated. Event integration information associated with ID1-1 is generated.

If the related investigation target is the first event ID1-2, the second event sets ID2-5 and ID2-4 are sequentially added in descending order of similarity (of the corresponding first event subset), and the coverage is increased. The total of is 0.667 (= 0.5 + 0.167), which has not reached the maximum value of 1, but since all the corresponding second event sets (with the first event subset) are added, it ends here, and in the end , Event integration information is generated in which the set {ID2-5, ID2-4} of these second event IDs is associated with ID1-2, which is the ID of the related investigation target event.

It should be noted that the process of determining the related event as described above is the process of determining the second event set included in the ID of the first event subset included in the "event integration combination" determined by the similarity and the coverage. It is also possible to consider that the set of IDs is determined to be the related ID set related to the IDs to be investigated. That is, for example, if the "event integration combination" includes three first event subsets ID1-1-2-1, ID1-1-2-2, and ID1-1-2-3, these parts are included. {ID2-1, ID2-2, ID2-3}, which is a set of second event IDs included in the set ID, is determined as a related ID set related to ID1-1, which is a related investigation target ID. ..

As described above, the related event integration method according to the present invention has been specifically described using the examples shown in FIGS. 3 to 9, but in order to facilitate the understanding of the entire process, FIG. 10 shows the relationship in the present embodiment. The event determination process is schematically shown.

Incidentally, the related event integration method according to the present invention can also be formulated according to a known solution of the collective cover problem. That is, as a solution to the set cover problem that selects the first event subset that minimizes the sum of the weights W _G from the family of the first event subsets to which the weights W _G are given, the "event integration combination" is used. Can be decided.

Here, at this time, the weight W _G given to each first event subset is set to
(A) Dissimilarity calculated based on the magnitude of the "time difference" of the time information of the events included in the first event subset, and (b) for all the first event subsets included in the family. Event number ratio (anti-coverage) between the number of events belonging to the event and the number of events belonging to the first event subset.
It may be decided based on. Of course, it is also possible to adopt only one of the dissimilarity of the above (a) and the event number ratio of the above (b) as the weight W _G.

As described above in detail, according to the related event integration program, apparatus and method of the present invention, it is possible to extract and integrate events related to each other in a one-to-many manner, which has been difficult to grasp the correspondence relationship in the past. can. Also, since we first approach from the 2nd event group side to the 1st event group side using temporal proximity, and then determine the related 2nd event set in a form that wraps around without performing complicated calculations. , Related events can be searched for in a short time with less storage space.

By the way, the event group characterized by the temporal proximity between the events can generally occur in a form in which the front-end and back-end systems operate in cooperation with each other, and also has a one-to-many form. Events related to each other often occur in various cases. Therefore, the scope of application of the related event integration processing according to the present invention is considerably wide.

Further, according to the present invention, as one embodiment, it is possible to link the IDs of event logs in different types of devices / systems and search for IDs to be synchronized quickly. As a result, for example, IDs between communication services can be linked, and network devices can be linked. Furthermore, even in the field of IoT (Internet of Things), which is currently making great progress, it is possible to process the investigation of the relevance of information output from a large number of devices / devices in a shorter time by using a smaller storage area. Is possible.

Various modifications, modifications and omissions of the various embodiments of the present invention described above within the scope of the technical idea and viewpoint of the present invention can be easily made by those skilled in the art. The above explanation is merely an example and is not intended to be a constraint. The present invention is limited only by the claims and their equivalents.

1 Related event integration device 101 Communication interface 102 1st event buffer 103 2nd event buffer 104 Event set storage unit 105 Event union storage unit 106 1st event subset storage unit 107 Coverage / similarity storage unit 108 Event integration information storage Part 109 Display (DP)
111 Event acquisition unit 112 ID matching unit 112a Time difference determination unit 113 Coverage calculation unit 114 Similarity calculation unit 115 Related event determination unit 115a Total coverage / similarity determination unit 121 Application

Claims (12)

A program that operates a computer mounted on a device that extracts events related to each other from different types of first event group and second event group.
Each event has an identifier of the event and time information related to the time of the event, and the program is
At least one event included in the first event set, which is a set of events having the identifier of the related investigation target in the first event group, and is a set of events having the same identifier in the second event group. At least one event having a time information having a small time difference with respect to the time information in each event included in a certain second event set is selected, and the selected at least one event is used for each second event set. ID matching means for generating the first event subset to be
Event integration is a combination of the first event subsets generated for each second event set, and as a result of the combination, the events included in the first event set belong to each other without duplication. The set of identifiers related to the second event set corresponding to the first event subset included in the determined event integration combination is determined to be the identifier set related to the identifier of the related investigation target. A related event integration program characterized by operating a computer as a means of determining related events. The related event determining means is characterized in that, among the combinations, a combination in which events of a predetermined ratio or more included in the first event set belong to each other without duplication is determined as the event integration combination. The related event integration program according to claim 1. Similarity calculation means for calculating the similarity of the first event subset based on the small time difference of the time information of the events included in the first event subset for each generated first event subset. To make the computer work further,
The related event determining means is characterized in that, among the combinations, the combination having the maximum total similarity in the first event subset included in the combination is determined as the event integration combination. The related event integration program according to Item 1 or 2. For each generated first event subset, based on the ratio of the number of events belonging to the first event subset to the number of events belonging to all the first event subsets contained in the first event set. Further, the computer is made to function as a coverage calculation means for calculating the coverage of the first event subset.
The related event determining means is used in the first event subset included in the maximum similarity combination among the maximum similarity combinations when there are a plurality of maximum similarity combinations having the maximum total similarity. The related event integration program according to claim 3, wherein the combination having the maximum total coverage is determined. For each generated first event subset, based on the ratio of the number of events belonging to the first event subset to the number of events belonging to all the first event subsets contained in the first event set. Further, the computer is made to function as a coverage calculation means for calculating the coverage of the first event subset.
The related event determining means is characterized in that, among the combinations, the combination having the maximum total coverage in the first event subset included in the combination is determined as the event integration combination. The related event integration program according to Item 1 or 2. Similarity calculation means for calculating the similarity of the first event subset based on the small time difference of the time information of the events included in the first event subset for each generated first event subset. To make the computer work further,
The related event determining means is used in the first event subset included in the maximum coverage combination among the maximum coverage combinations when there are a plurality of maximum coverage combinations having the maximum total coverage. The related event integration program according to claim 5, wherein the combination having the maximum degree of similarity is determined. The related event determination means is
The combination for event integration is determined as the solution of the set cover problem that selects the first event subset that minimizes the sum of the weights from the family of the first event subsets to which the weights are given.
The weight given to each first event subset is included in the dissimilarity calculated based on the magnitude of the time difference of the time information of the events included in the first event subset, and / or the family. The related event integration program according to claim 1, wherein the determination is made based on the ratio of the number of events belonging to all the first event subsets to the number of events belonging to the first event subset. The ID matching means is a union of a first event set and a second event set, and generates a union in which the order related to time is given based on the time information possessed by the event to which the event belongs, and the union is generated. One of claims 1 to 7, wherein the first event subset having the time information having a small time difference with respect to the time information in each event included in the second event set is generated based on the set. Related event integration program described in Section 1. The ID matching means assigns a subset identifier including the identifier of the related investigation target and the identifier related to the corresponding second event set to the first event subset generated for each second event set. ,
The related event determining means targets the related investigation target for a set of identifiers related to the second event set included in the subset identifier given to the first event subset included in the determined event integration combination. The related event integration program according to any one of claims 1 to 8, wherein the identifier set is determined to be related to the identifier of the above. Each event has an identifier of the event, time information related to the time of the event, and attribute information related to the event.
When the attribute information of at least one event included in the first event set matches or is similar to the attribute information of the event of the second event set associated with the ID matching means as having a small time difference, the ID matching means is used. The related event integration program according to any one of claims 1 to 9, wherein the first event subset is generated with the at least one event. It is a related event integration device that extracts events related to each other from each of the first event group and the second event group of different types.
Each event has an identifier of the event and time information related to the time of the event, and the related event integration device is a device.
At least one event included in the first event set, which is a set of events having the identifier of the related investigation target in the first event group, and is a set of events having the same identifier in the second event group. At least one event having a time information having a small time difference with respect to the time information in each event included in a certain second event set is selected, and the selected at least one event is used for each second event set. ID matching means for generating the first event subset to be
Event integration is a combination of the first event subsets generated for each second event set, and as a result of the combination, the events included in the first event set belong to each other without duplication. The set of identifiers related to the second event set corresponding to the first event subset included in the determined event integration combination is determined to be the identifier set related to the identifier of the related investigation target. A related event integration device, characterized by having a related event determining means. It is a related event integration method executed by a computer mounted on a device for extracting events related to each other from each of different types of first event group and second event group.
Each event has an identifier of the event and time information related to the time of the event, and the related event integration method is
At least one event included in the first event set, which is a set of events having the identifier of the related investigation target in the first event group, and is a set of events having the same identifier in the second event group. At least one event having a small time difference with respect to the time information in each event included in a certain second event set is selected, and the selected at least one event is used for each second event set. And the steps to generate the first event subset
Event integration is a combination of the first event subsets generated for each second event set, and as a result of the combination, the events included in the first event set belong to each other without duplication. The set of identifiers related to the second event set corresponding to the first event subset included in the determined event integration combination is determined to be the identifier set related to the identifier of the related investigation target. A method of integrating related events, characterized by having steps.

Images