JP7472652B2 - Classification program, classification method, and classification device - Google Patents

Description

The present invention relates to classification technology.

Conventionally, for example, technology is known that allows a company's employees to understand how much time they spend on what tasks based on logs from their personal computers (PCs). There is also known technology in which a management system classifies calendar entries based on pre-set business-related keywords (see, for example, Patent Document 1).

JP 2018-147174 A

However, when classifying logs based on pre-defined keywords, the system may not be able to classify them properly.

On one hand, the goal is to properly classify logs.

In one proposal, a classification program is provided that causes a computer to execute the following processes: classifying a first log according to a first classification rule based on keywords; extracting specific information related to at least one of schedule information, communication source information, communication destination information, and communication date and time information from a second log classified into a specific group by the process of classifying the first log; and classifying a third log according to a second classification rule based on the specific information.

In one aspect, logs are properly classified.

FIG. 1 is a diagram illustrating an example of the configuration of a classification system according to an embodiment. FIG. 2 is a diagram illustrating an example of a hardware configuration of an information processing device according to an embodiment. FIG. 2 is a diagram illustrating an example of a functional configuration of an information processing device according to an embodiment. 5 is a flowchart illustrating an example of processing executed in the information processing apparatus according to the first embodiment. 5 is a diagram illustrating an example of classification rule data according to the first embodiment; FIG. FIG. 4 is a diagram illustrating an example of a log according to the embodiment. FIG. 13 is a diagram illustrating an example of a display screen of an administrator terminal according to the embodiment. 13 is a flowchart illustrating an example of a process executed in a server according to the second embodiment. FIG. 13 is a diagram illustrating an example of classification rule data according to the second embodiment.

The following describes an embodiment of the present invention with reference to the drawings.

[First embodiment]
In the first embodiment, the classification system 1 classifies logs related to user operations based on set keywords. An example will be described in which the classification system 1 extracts information used to classify logs based on logs classified into specific groups. This allows the classification system 1 to appropriately classify logs.

The classification system 1 may also visualize what type of work a user is performing by classifying into groups the logs (e.g., operation information, schedule information, communication information) of a PC (Personal Computer) that the user uses for work.

<System Configuration>
FIG. 1 is a diagram showing an example of the configuration of a classification system 1 according to an embodiment. In FIG. 1, the classification system 1 includes a server 10 (an example of a "classification device"), a terminal 20A, a terminal 20B, and a terminal 20C (hereinafter, when there is no need to distinguish between them, they will be simply referred to as "terminals 20"), and an administrator terminal 30. Note that the number of servers 10, terminals 20, and administrator terminals 30 is not limited to the example in FIG. 1. Furthermore, the server 10 and the administrator terminal 30 may be one device, or one of the terminals 20 and the administrator terminal 30 may be one device.

The server 10, the terminal 20, and the administrator terminal 30 are each connected to a network N, such as the Internet, a LAN (Local Area Network), a wireless LAN, or a mobile phone network.

The terminal 20 and the administrator terminal 30 are, for example, information processing devices (computers) such as desktop PCs, notebook PCs, tablet PCs, and smartphones. The terminal 20 may be used, for example, by employees who perform various tasks.

The server 10 is, for example, an information processing device for a server. The server 10 classifies various logs in the terminal 20. The administrator terminal 30 displays information based on the logs classified by the server 10.

<Hardware Configuration>
2 is a diagram showing an example of the hardware configuration of the server 10, the terminal 20, and the administrator terminal 30 according to the embodiment. In the following, the server 10 will be described as an example. The hardware configuration of the terminal 20 and the administrator terminal 30 may be the same as the hardware configuration of the server 10.

The server 10 in FIG. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, a display device 106, and an input device 107, all of which are interconnected via a bus B.

The program (classification program) that realizes the processing in the server 10 may be provided by the recording medium 101. In this case, when the recording medium 101 on which the program is recorded is set in the drive device 100, the program may be installed in the auxiliary storage device 102 from the recording medium 101 via the drive device 100. The program may also be downloaded to the server 10 from another computer via a network, for example, and installed in the server 10.

The auxiliary storage device 102 stores the installed program as well as necessary files, data, etc. The memory device 103 reads out and stores the program from the auxiliary storage device 102 when an instruction to start the program is received. The CPU 104 realizes the functions related to the server 10 according to the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

The display device 106 is a device that displays a GUI (Graphical User Interface) or the like according to a program. The display device 106 may be, for example, a liquid crystal display, a touch panel, a projector, or the like.

The input device 107 accepts input of various operational instructions. The input device 107 may be, for example, a keyboard, a mouse, etc.

Note that examples of the recording medium 101 include portable recording media such as CD-ROMs, DVDs, and USB memory. Examples of the auxiliary storage device 102 include HDDs (Hard Disk Drives) and flash memory. Both the recording medium 101 and the auxiliary storage device 102 correspond to computer-readable recording media.

<Functional configuration>
Next, a functional configuration of the server 10 according to the embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of a functional configuration of the server 10 according to the embodiment.

The server 10 has a memory unit 11, a reception unit 12, an acquisition unit 13, a classification unit 14, an extraction unit 15, and an output unit 16. The functions of each of these units may be realized by cooperation between one or more programs installed on the server 10 and the CPU 104 of the server 10, etc.

The memory unit 11 stores various types of information. For example, the memory unit 11 stores classification rule data 501 including information on rules (conditions) for classifying logs of the terminal 20.

The reception unit 12 receives various pieces of information input by the administrator to the administrator terminal 30 from the administrator terminal 30. The reception unit 12 receives, for example, from the administrator terminal 30, rules (designated rules; an example of "first classification rules") based on specific keywords (character strings) input by the administrator for classifying the logs of the terminals 20 acquired by the acquisition unit 13. The acquisition unit 13 acquires various pieces of information. The acquisition unit 13 acquires, for example, the logs of the terminals 20. The acquisition unit 13 may acquire the logs of the terminals 20 directly from the terminals 20. The acquisition unit 13 may also acquire the logs of the terminals 20 from a database that stores logs collected from each terminal 20.

The classification unit 14 classifies the logs of the terminal 20 acquired by the acquisition unit 13 into various types (groups) based on the classification rules. The extraction unit 15 extracts information used in the rules for classifying the logs of the terminal 20 into a specific type based on the logs classified into the specific type by the classification unit 14, and generates rules based on the extracted information.

The output unit 16 outputs various information to the administrator terminal 30. For example, the output unit 16 outputs information based on the classification results by the classification unit 14 to the administrator terminal 30.

<Processing>
Next, an example of processing executed in the server 10 according to the first embodiment will be described with reference to Figs. 4 and 5. Fig. 4 is a flowchart showing an example of processing executed in the server 10 according to the first embodiment. Fig. 5 is a diagram explaining an example of classification rule data 501 according to the first embodiment. Fig. 6 is a diagram explaining an example of a log according to the embodiment. Fig. 7 is a diagram explaining an example of a display screen of the administrator terminal 30 according to the embodiment. An example of classifying logs in a first period of the terminal 20A used by user A will be described below.

The reception unit 12 of the server 10 receives a request to register a designation rule for classification from the administrator terminal 30 (step S1). Here, the designation rule for classification may be, for example, a classification rule based on keywords extracted by the administrator based on interviews with user A and user A's superior.

Next, the storage unit 11 of the server 10 registers the designation rules for classification in the classification rule data 501 (step S2). In the example of the classification rule data 501 in FIG. 5, a designation rule is registered such that if the subject of an email contains the character string (keyword) "compliance," the email is classified as "education."

Then, the acquisition unit 13 of the server 10 acquires various logs of the terminal 20A during the first period (step S3). Here, the server 10 acquires, for example, logs of the operation information of the user A, the schedule information of the user A, and the communication information of the user A from the terminal 20A.

The operation information of user A includes an operation history for terminal 20A. The operation history for terminal 20A may include, for example, information on the date and time when terminal 20A was turned on/off, location information of terminal 20A, information on user A's presence (input operation acceptance status), and operation history for various applications. The various applications may include, for example, a word processing application, an application for sending and receiving e-mail (mailer), and an instant messenger. The operation history for an application may include, for example, information on the name of the application that was run, information on the date and time when the application was started/ended, and information on the title of the application window (for example, the title of the file).

User A's schedule information includes, for example, information registered in a schedule management application. The schedule information may include, for example, information related to registered business trips and information related to registered conferences. The registered information related to business trips may include, for example, information such as the start date and time of the business trip, the end date and time of the business trip, the location of the business trip destination, the names of the people traveling with the business trip, and the names of the people accompanying the business trip. The registered information related to conferences may include, for example, information such as the start date and time of the conference, the end date and time of the conference, the location where the conference is being held, the names of the conference participants, the names of the departments to which the conference participants belong, and the job titles of the conference participants.

User A's communication information may include, for example, emails and instant messages (chats) sent and received by User A, calls (IP telephone calls) made by User A, and a communication history of online conferences. The communication history may include, for example, sending/receiving addresses, sending/receiving dates and times, call recipients, call dates and times, conference participants, and conference dates and times. User A's communication information may also include, for example, a browsing history of websites that User A viewed.

The classification unit 14 of the server 10 then classifies the logs for the first period acquired from the terminal 20A based on the designation rules registered in the classification rule data 501 (step S4). Here, the server 10 classifies, among the logs for the first period to be classified, those that match the designation rules for a specific type as logs of that specific type. Note that the server 10 may classify the logs by determining whether or not they match each designation rule for each type in the order of the types registered in the classification rule data 501 shown in FIG. 5, for example.

Figure 6 shows an example of email 601, which has been received by terminal 20A and classified as "education" according to the designated rules registered in classification rule data 501 shown in Figure 5. Server 10 classifies email 601 as "education" because the subject line contains the character string "compliance". In addition, in the example of Figure 6, the sender email address (From. An example of "sender information") of email 601 is "education-no-reply@our-company.example.co.jp" (hereinafter also referred to as "Address A"), and the destination email address (To. An example of "destination information") is "all-employee@our-company.example.co.jp" (hereinafter also referred to as "Address B").

Note that the server 10 may classify logs that do not match any of the rules registered in the classification rule data 501 shown in FIG. 5 and therefore are not classified into any category, into the "other" category.

Next, the extraction unit 15 of the server 10 generates one or more candidates for the first additional rule for classification (an example of a "second classification rule") based on each log classified into various types according to the specified rule (step S5). Here, the server 10 may generate a candidate for the first additional rule of classifying the email into the "education" category when the sender email address is address A (an example of "specific information"), based on the email 601 classified into the "education" category according to the specified rule. The server 10 may also generate a candidate for the first additional rule of classifying the email into the "education" category when the sender email address is address B. The server 10 may also generate a candidate for the first additional rule of classifying the email into the "education" category when the sender email address is address A and the sender email address is address B.

The server 10 may generate candidates for the first additional rule based on information on a specific item that changes relatively infrequently over time among the items included in the log of the terminal 20A classified according to the specified rule. In this case, the items that change relatively infrequently over time may be set in advance in the server 10 by an administrator, for example. In addition, the items that change relatively infrequently over time may be determined (inferred) by AI (Artificial Intelligence) using deep learning, etc., for example.

Then, the classification unit 14 of the server 10 classifies the logs acquired from the terminal 20 for the first period based on the generated candidates for the first additional rule (step S6). Note that if there are multiple candidates for the generated first additional rule, the server 10 classifies each of the logs acquired from the terminal 20 based on each candidate.

Then, the extraction unit 15 of the server 10 determines which of the candidates is to be the first additional rule based on the result of classification according to the specified rule and the result of classification according to the candidate for the first additional rule (step S7). Here, if the first degree of classification of a log classified into a specific type by the candidate for the first additional rule into a specific type by the specified rule is equal to or greater than a threshold, the server 10 determines the candidate as the first additional rule. In this case, the server 10 may determine the first degree based on the degree to which a log classified into a specific type by the candidate for the first additional rule (hereinafter also referred to as "log B") is included in a log classified into the specific type by the specified rule (hereinafter also referred to as "log A") (the degree to which the log is a subset). Then, if the first degree is equal to or greater than a first threshold, the server 10 may determine the candidate as the first additional rule.

In this case, the server 10 may determine the value of the first degree as, for example, the number of logs common to log A and log B divided by the number of logs B that are not included in log A. In this case, the reciprocal E of the first degree (hereinafter also referred to as "error rate E" as appropriate) can be expressed by the following formula (1). In formula (1), A represents the set of logs A, and B represents the set of logs B.

E = (B - A) / A ∩ B ... (1)
Next, the storage unit 11 of the server 10 registers the determined first additional rule in the classification rule data 501 shown in Fig. 5 (step S8). In the example of Fig. 5, the first additional rule is registered such that if the sender email address is address A, the email is classified into the "education" category.

Next, the classification unit 14 of the server 10 classifies the logs of the terminal 20A in each period after the first period based on the first additional rule registered in the classification rule data 501 (step S9). Here, the server 10 may classify the logs of the terminal 20A in each period after the first period based on each rule registered in the classification rule data 501. In this case, the server 10 may first classify the logs of the terminal 20A in each period based on the specified rule. Then, the server 10 may reclassify the logs of the terminal 20A in each period that were not classified into any type by the specified rule (logs classified into the type "other") based on the first additional rule. This allows the server 10 to appropriately classify logs that cannot be classified by keywords set based on, for example, a hearing with the user A. For example, if an email classified as "education" based on a specified rule using a specific keyword included in the name of an e-learning course was sent from the address A, the server 10 generates a classification rule using the sender's email address, etc. This allows the server 10 to properly classify emails for courses that do not include the specific keyword in the course name. Also, for example, if the course that user A is taking changes from compliance training to security training, and the subject of the email for the course changes so that it no longer includes the character string "compliance," the email will still be classified as "education" according to the additional rule because the sender email address is address A.

The server 10 may also classify the logs of the terminal 20A during the first period based on each rule registered in the classification rule data 501.

For example, if an email classified as "education" according to a designation rule using a specific keyword contained in the course name, etc., was sent from address A, server 10 generates a classification rule using the sender email address, etc., which is thought to change relatively infrequently over time. This allows server 10 to classify logs appropriately, for example, even if a course that includes the specific keyword in its name for classification as "education" ends and the course name is changed to another one. Also, for example, server 10 can classify logs appropriately, even if a company name that includes a specific keyword for classification as "customer service" is changed.

(About output of classification results)
The output unit 16 of the server 10 outputs information based on the classification results of the logs of the terminal 20A for a predetermined period to the administrator terminal 30. In the example of FIG. 7, the administrator terminal 30 displays a pie chart 701 showing the ratio of the work time of each classification of the user A for the predetermined period on the screen based on the information output by the output unit 16 of the server 10. In the pie chart 701, the area of the area 702 indicates the ratio of the work time of the "organizational work". Similarly, the areas of the areas 703 to 707 respectively indicate the ratio of the work time of the "internal correspondence", "customer correspondence", "education", "other", and "non-work". This can be useful for improving the way the user A works, for example.

The output unit 16 of the server 10 may calculate the task time for each category based on the operation information of user A contained in the log for a specified period of time of terminal 20A. In this case, the server 10 may determine the task time for "education" as the length of time during which user A is "present" by the presence function of the instant messenger and the window displaying the email classified as "education" has focus. When user A clicks on a window with a mouse or the like, terminal 20A focuses on the window and accepts input to the window via keyboard or other operations.

Second Embodiment
In the second embodiment, similarly to the first embodiment, the server 10 extracts first information for classifying logs related to the user's work into a specific group based on the logs classified into the specific group. Then, the server 10 classifies logs related to the user's work based on the first information, and extracts second information for classifying logs related to the user's work into the specific group based on the logs classified into the specific group by the first information. This allows the server 10 to appropriately classify various logs. Since the second embodiment is similar to the first embodiment except for a part, the description will be omitted as appropriate. In the following, the description of the parts common to the first embodiment will be omitted, and only the different parts will be described. The server 10 can perform each process of the first embodiment and each process of the second embodiment in appropriate combination.

<Processing>
Next, an example of processing executed in the server 10 according to the second embodiment will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of processing executed in the server 10 according to the second embodiment. Fig. 9 is a diagram for explaining an example of classification rule data 501A according to the second embodiment.

The server 10 may execute the process of FIG. 8 when a certain time has elapsed after each process of FIG. 4 has been executed. In this case, the server 10 may execute the process of FIG. 8 for a specific type when the accuracy of classification using the specified rule and the first additional rule for the specific type has decreased after the processes of steps S1 to S7 of FIG. 4 have been executed.

In this case, the server 10 may execute the process of FIG. 8 based on, for example, the number (number of logs, number of cases) of logs at the beginning of operation (for example, a period including the first period, etc.) classified into the specified type by each rule (designated rule and first additional rule) and the number of logs in the second period after the first period classified into the specified type by each rule. In this case, the server 10 may execute the process of FIG. 8 when, for example, the ratio value between the proportion of logs at the beginning of operation classified into the specified type by each rule and the proportion of logs in the second period after the first period classified into the specified type by each rule becomes equal to or greater than a threshold value. In addition, in this case, the server 10 may execute the process of FIG. 8 when the ratio value between the number of logs to be classified and the number of logs that cannot be classified into any type (logs classified into the "other" type) becomes equal to or greater than a threshold value.

The following describes an example of classifying the logs of terminal 20A in a second period that is later than the first period.

The acquisition unit 13 of the server 10 acquires various logs of the terminal 20A during the second period (step S101). Next, the classification unit 14 of the server 10 classifies the logs of the terminal 20A during the second period based on the first additional rule registered in the classification rule data 501 (step S102).

Next, the extraction unit 15 of the server 10 generates one or more candidates for a second additional rule for classification (an example of a "third classification rule") based on the logs classified according to the first additional rule (step S103). Here, the server 10 may extract noun words, for example, by morphologically analyzing sentences included in each log classified into various types by the processing of step S102. Then, the server 10 may set a classification rule based on the extracted words (keywords) as a candidate for the second additional rule.

The classification unit 14 of the server 10 then classifies the log of the terminal 20A based on the candidates for the second additional rule (step S104). The extraction unit 15 of the server 10 then determines which of the candidates will be the second additional rule based on the results of classifying the log of the terminal 20A according to the specified rule and the results of classifying the log of the terminal 20A according to the candidates for the second additional rule (step S105). This allows the server 10 to generate candidates for rules based on keywords, etc., that have changed over time based on the results of classification according to the first additional rule, which uses information on items that change relatively infrequently over time.

Here, the server 10 may determine whether or not to extract the word as a word to be used in the second additional rule based on the frequency of occurrence of the word in logs classified into type A by the processing of step S102 and the frequency of occurrence of the word in logs classified into various types other than type A. In this case, the server 10 may extract a word that appears relatively frequently in logs classified into type A by the processing of step S102 and relatively low frequently in logs classified into various types other than type A. Then, the server 10 may determine the classification rule based on the word as the second additional rule for classifying into type A.

In this case, the server 10 may calculate a score S for each word that is a keyword candidate, for example, using the following formula (2), and may set a classification rule based on a word that has a score S equal to or greater than the second threshold as a candidate for the second additional rule. In formula (2), i indicates the index of each word, and j indicates the index for each type.

S _i = α _i,j + t fidf _i,j ... (2)
Here, α _i,j is a constant A (e.g., 1) when the word t _i indicated by index i appears only in logs classified into the type d _j indicated by index j, and is a constant B (e.g., 0) smaller than the constant A otherwise. tfidf _i,j is calculated by the following formula (3).

tfidf _i,j = tfi _,j · idf _j ... (3)
Here, tf _i,j is the frequency of occurrence of word t _i in type d _j . tf _i,j may be, for example, the value obtained by dividing the number of occurrences of word t _i in type d _j by the sum of the number of occurrences of all words in type d _j . Also, idf _j may be the logarithm (log) of the value obtained by dividing the total number of types by the number of types that include word t _i .

(Regarding the second threshold)
The server 10 may determine the second threshold value so that the score S of the keyword set in the specified rule for the log at the beginning of operation (for example, a period including the first period, etc.) is similar to the score S of the keyword used as a candidate for the second additional rule for the log in the second period. This allows the server 10 to determine keywords that can classify logs after a certain time has passed with the same accuracy as the keywords set based on the hearing, for example.

In this case, the server 10 may perform the following process. First, the server 10 acquires the logs of the terminal 20A for the period before the second period. Then, the server 10 classifies the logs of the terminal 20A for the period before the second period based on the first additional rule. Then, the server 10 calculates the score S for each keyword of type A set in the specified rule based on the classification result by the first additional rule using the above-mentioned formula (2). Then, the server 10 determines a value obtained by multiplying a representative value (e.g., average value, mode, or median) of the scores S for each keyword of type A by a predetermined coefficient, as the second threshold value for type A. Then, the server 10 similarly determines the second threshold value for each type other than type A.

Then, the extraction unit 15 of the server 10 generates one or more candidates for a third additional rule for classification (an example of a "third classification rule") based on the candidates for the first additional rule and the candidates for the second additional rule (step S106). Here, the server 10 may set a rule that combines a candidate for the first additional rule with a candidate for the second additional rule as a candidate for the third additional rule. In this case, the server 10 may set a candidate for the third additional rule as a rule that combines, for example, a candidate for the first additional rule whose error rate E of formula (1) calculated in the process of step S7 in FIG. 4 is equal to or less than a threshold, and a candidate for the second additional rule whose score S of formula (2) calculated in the process of step S105 is equal to or greater than a threshold.

Next, the extraction unit 15 of the server 10 determines which of the candidates is to be the third additional rule (step S107). Here, the server 10 may calculate a score S2 (S2 = S/E) by dividing the value of the score S for the candidate for the first additional rule included in the candidates for the third additional rule by the value of the error rate E for the candidate for the first additional rule included in the candidates for the third additional rule. Then, the server 10 may determine the candidate for the _{third additional} rule as the third additional rule only when the score _S2 is equal to or greater than a threshold value.

Then, the storage unit 11 of the server 10 registers the determined second and third additional rules in the classification rule data 501A shown in FIG. 9 (step S108). The classification unit 14 of the server 10 then classifies the logs of the terminal 20A based on the second and third additional rules registered in the classification rule data 501 (step S109). This allows, for example, logs acquired from the terminal 20 that are not classified based on the specified rule and are not classified based on the first additional rule to be classified based on the second or third additional rule. Note that the server 10 may not use the second additional rule, for example.

In the example of classification rule data 501A shown in FIG. 9, a second additional rule is registered such that if the subject of an email contains the character string "legal compliance", the email is classified as "education". Also, a third additional rule is registered such that if the subject of an email contains the character string "excellent activity example" and the destination email address is address B, the email is classified as "education".

(Regarding the order of application of classification rules)
The server 10 may classify the logs of the terminal 20 by applying the rules registered in the classification rule data 501 in a predetermined order. In this case, the server 10 may, for example, first classify the logs by applying the rules included in the specified rules in a predetermined order that is preset for each rule. Then, the server 10 may classify the logs by applying the rules included in the first addition in the order of the smallest error rate E of formula (1) calculated in the process of step S7 in FIG. 4.

The server 10 may then classify the logs by applying each rule included in the second addition in ascending order of the score S of formula (2) calculated in the process of step S105. The server 10 may then classify the logs by applying each rule included in the third addition in ascending order of the score _S2 calculated in the process of step S107.

<Modification>
Each functional unit of the server 10 may be realized, for example, by cloud computing provided by one or more computers.

Although the above describes in detail an embodiment of the present invention, the present invention is not limited to such a specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims.

In addition to the above description, the following items are disclosed.
(Appendix 1)
A process of classifying the first log according to a first classification rule based on a keyword;
A process of extracting specific information related to at least one of operation information, schedule information, and communication information from the second logs classified into the specific groups by the process of classifying the first logs;
A process of classifying the third log according to a second classification rule based on the specific information;
A classification program characterized by causing a computer to execute the above steps.
(Appendix 2)
generating the second classification rule based on the extracted specific information and information of the specific group;
The classification program according to claim 1, characterized in that the classification program is executed by the computer.
(Appendix 3)
The process of classifying the third log includes a process of classifying the third log into the specific group when the third log matches the second classification rule.
3. The classification program according to claim 1 or 2.
(Appendix 4)
a ratio of logs common to the second log among the fourth logs classified into the specific group when the first log is classified according to the second classification rule is equal to or greater than a threshold value;
4. The classification program according to claim 1,
(Appendix 5)
The specific information includes at least one of source information of a message included in the communication information and destination information of the message.
5. The classification program according to claim 1,
(Appendix 6)
A process of extracting a specific word based on the frequency of appearance of a word in the log classified into the specific group and the frequency of appearance of a word in the log classified into a group other than the specific group;
A process of classifying the fourth log according to a third classification rule based on the extracted specific word;
6. The classification program according to claim 1, wherein the classification program is executed by the computer.
(Appendix 7)
the process of extracting the specific word is executed based on a comparison between the number of logs classified into the specific group among logs acquired in a first period and the number of logs classified into the specific group among logs acquired in a second period that is later than the first period.
7. The classification program according to claim 6,
(Appendix 8)
A process of classifying the first log according to a first classification rule based on a keyword;
a process of extracting specific information related to at least one of operation information, schedule information, and communication information from the second logs classified into the specific groups by the process of classifying the first logs;
A process of classifying the third log according to a second classification rule based on the specific information;
A classification method performed by a computer.
(Appendix 9)
a classification unit that classifies the first log according to a first classification rule based on a keyword;
an extracting unit that extracts specific information related to at least one of operation information, schedule information, and communication information from the second log classified into the specific group by the processing for classifying the first log,
The classification unit classifies logs that match a second classification rule based on the specific information into the specific group.

Reference Signs List 1 Classification system 10 Server 11 Storage unit 12 Reception unit 13 Acquisition unit 14 Classification unit 15 Extraction unit 16 Output unit 20 Terminal 30 Administrator terminal

Claims (9)

A process of classifying the first log according to a first classification rule based on a keyword;
a process of extracting specific information related to at least one of schedule information, communication source information, communication destination information, and communication date and time information from the second logs classified into the specific groups by the process of classifying the first logs;
A process of classifying the third log according to a second classification rule based on the specific information;
A classification program characterized by causing a computer to execute the above steps. generating the second classification rule based on the extracted specific information and information of the specific group;
2. The classification program according to claim 1, wherein the computer executes the steps of: The process of classifying the third log includes a process of classifying the third log into the specific group when the third log matches the second classification rule.
3. The classification program according to claim 1 or 2. a ratio of logs common to the second log among the fourth logs classified into the specific group when the first log is classified according to the second classification rule is equal to or greater than a threshold value;
4. The classification program according to claim 1, wherein the classification program is a program for performing a classification process. The communication source information is information about a sender of a message,
The communication destination information is message destination information.
5. The classification program according to claim 1, wherein the classification program is a program for performing a classification process. A process of extracting a specific word based on the frequency of appearance of a word in the log classified into the specific group and the frequency of appearance of a word in the log classified into a group other than the specific group;
A process of classifying the fourth log according to a third classification rule based on the extracted specific word;
6. The classification program according to claim 1, wherein the classification program is executed by the computer. the process of extracting the specific word is executed based on a comparison between the number of logs classified into the specific group among logs acquired in a first period and the number of logs classified into the specific group among logs acquired in a second period that is later than the first period.
7. The classification program according to claim 6. A process of classifying the first log according to a first classification rule based on a keyword;
a process of extracting specific information related to at least one of schedule information, communication source information, communication destination information, and communication date and time information from the second logs classified into the specific groups by the process of classifying the first logs;
A process of classifying the third log according to a second classification rule based on the specific information;
A classification method performed by a computer. a classification unit that classifies the first log according to a first classification rule based on a keyword;
an extracting unit that extracts specific information related to at least one of schedule information, communication source information, communication destination information, and communication date and time information from the second log classified into a specific group by the process of classifying the first log,
The classification unit classifies logs that match a second classification rule based on the specific information into the specific group.

Images