KR20170110796A - Method for diagnosing process abnormality based on internet of things by using parallel processing and Apparatus thereof - Google Patents

Abstract

The present invention relates to a method for diagnosing a process anomaly, comprising: generating a first event log file having an event key as an object from an event log file and deriving only an event field necessary for process anomaly judgment as an event value; A second event log file is generated by adding the process abnormal event type value to the first event log file of the object in which the process anomaly occurs according to the determination result by using the event log file By including the step, analysis of large-scale object Internet data by parallel processing technique enables low-cost, high-efficiency analysis.

Description

TECHNICAL FIELD [0001] The present invention relates to a method for diagnosing an abnormal phenomenon of an Internet data-based process using a parallel processing technique,

The present invention relates to a method for diagnosing a process anomaly phenomenon, and a method and apparatus for diagnosing a process anomaly phenomenon by using parallel processing of an event log file.

The Smart Factory concept is emerging all over the world to cope with the intensification of global manufacturing competition and to maintain future competitiveness. The basic concept of Smart Factory is that everything in the factory, factory, and factory is connected to the network, the work in the physical world is mirrored to the virtual world, the production process is controlled, It means a plant that can be made available.

In the Smart Factory environment, it will become possible to implement a distributed control system that decides the production equipment and the path by installing smart memory in materials and parts, away from the rigid centralized unidirectional production system in the past. In addition, the application of object Internet technology and vision technology will mirror the work in the physical world to a virtual world, enabling pre-verification of process and product quality, real-time management, and post-analysis.

Smart Factories' core driving force is information and communication technology (ICT), specifically Internet, big data, cloud computing, and cyber physics. RFID tags and sensor technologies, which are core technologies of the Internet, enable real-time acquisition of parts location, process variables, and environmental data, thus enabling flexible production planning and shipment instructions. Also, if a quality problem arises, the cause of the quality problem can be analyzed by analyzing the sensor data of the production facility to precisely search for the cause of the source defect.

RFID, sensors, etc. Internet data is constantly generated and has a large capacity and atypical nature. Therefore, there is a limitation in terms of processing speed and expansion cost to deal with large-scale object Internet data only by existing relational database technology. Therefore, 'big data processing technology' using distributed file system, distributed database management system, and parallel processing technology is emerging as the core technology for the implementation and calculation of object Internet data storage.

However, even if technology such as Internet of object and big data is applied to all production process and logistics process, it will not be able to block 100% of shrinkage due to loss, theft or breakage in process and logistics process.

The prior art related to the present invention is a system and method for monitoring the Internet based transformer (Korean Patent Publication No. 10-1573806).

A first problem to be solved by the present invention is to provide a method for diagnosing a process abnormal phenomenon by using parallel processing of an event log file.

A second problem to be solved by the present invention is to provide an apparatus for diagnosing a process abnormal phenomenon by using parallel processing of an event log file.

In order to solve the first problem, the present invention provides a method for diagnosing a process anomaly, the method comprising: setting an object as an event key from an event log file, deriving only an event field required for process anomaly judgment, Generating a file; And a process event abnormality determination unit for determining whether a process abnormality exists for each object by using the first event log file, adding a process abnormality event type value to a first event log file of an object in which a process abnormality occurs, And generating a file.

According to another embodiment of the present invention, the event field included in the first event log file may include at least one of an event time, an event occurrence point, and an operator.

According to another embodiment of the present invention, the process abnormal event type value is one of a value indicating lost / stolen or unrecognized.

According to another embodiment of the present invention, the generating of the second event log file may include: performing token reproduction in a process model using event log files collected for each object; Determining, as a result of performing the token regeneration, whether the token has reached a final position of the process; If the token does not reach the final position of the process, it is determined that a loss has occurred and a second event log file is generated, and if the token reaches the final position of the fixation, ; And if there is an ignited token, the second event log file is generated, and if the ignited token does not exist, the second event log file is generated The method comprising the steps of:

According to another embodiment of the present invention, the token may be moved to the next process by the ignition in which the process is performed.

According to another embodiment of the present invention, even in the case where the ignited token exists, even if it can not be ignited, even in the case where it can not be ignited, the first event log file corresponding to the process before the position where the ignited token is located, And adding the event type value to generate a second event log file.

According to another aspect of the present invention, there is provided an apparatus for diagnosing a process abnormal phenomenon, comprising: a storage unit for storing an event log file; And generating a first event log file for reading out the stored event log file and using the object as an event key from the event log file as an event value by deriving only event fields necessary for process abnormalities, And generating a second event log file by adding the process abnormal event type value to the first event log file of the object in which the process anomaly occurs according to the determination result, Device.

According to the present invention, low-cost and high-efficiency analysis becomes possible by analyzing large-scale object Internet data using a parallel processing technique using low-specification computing resources. In addition, it can support continuous process improvement activities by exploiting abnormal phenomena such as lost / stolen and unrecognized in process / logistics process by utilizing continuously generated Internet data of objects.

1 is a block diagram of a process anomaly diagnosis apparatus according to an embodiment of the present invention.
FIGS. 2 to 3 illustrate a parallel processing procedure used for diagnosing a process abnormal phenomenon according to an embodiment of the present invention.
4 to 7 illustrate a token regeneration process used in the process abnormal phenomenon diagnosis according to the embodiment of the present invention.
FIG. 8 to FIG. 12 illustrate a process abnormal phenomenon diagnosis according to an embodiment of the present invention, using specific examples.
13 is a flow chart of a method for diagnosing process anomalies according to an embodiment of the present invention.
14 is a flow chart of a method for diagnosing process anomalies according to another embodiment of the present invention.

Prior to the description of the concrete contents of the present invention, for the sake of understanding, the outline of the solution of the problem to be solved by the present invention or the core of the technical idea will be given first.

A method for diagnosing a process anomaly according to an embodiment of the present invention includes generating a first event log file having an event key as an object from an event log file and deriving only an event field required for process anomaly judgment as an event value, A process abnormality event type value is added to the first event log file of the object in which the process abnormality occurs according to the determination result, and the second event log file .

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. It will be apparent to those skilled in the art, however, that these examples are provided to further illustrate the present invention, and the scope of the present invention is not limited thereto.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other features and advantages of the present invention will become more apparent by describing in detail preferred embodiments thereof with reference to the attached drawings in which: It is possible to quote the above. In the following detailed description of the principles of operation of the preferred embodiments of the present invention, it is to be understood that the present invention is not limited to the details of the known functions and configurations, and other matters may be unnecessarily obscured by the present invention. A detailed description thereof will be omitted.

1 is a block diagram of a process anomaly diagnosis apparatus according to an embodiment of the present invention.

The apparatus 100 for diagnosing a process abnormal phenomenon according to an embodiment of the present invention may include a storage unit 110 and a processing unit 120 and may further include a communication unit 130. [

The storage unit 110 stores an event log file.

More specifically, event log files, which are process information detected by sensing units such as sensors installed at the process site, are stored. The event log file may be received by the communication unit 130 from the process 140 and stored in the storage unit 110 or processed by the processing unit 120 and may be stored in the storage unit 110.

The processing unit 120 reads the stored event log file, generates a first event log file having an event key as an object from the event log file, deriving only an event field required for process abnormalities, as an event value, It is determined whether there is a process abnormality for each object by using the event log file and a process abnormality event type value is added to the first event log file of the object in which the process abnormality occurs according to the determination result to generate the second event log file .

More concretely, a parallel processing method is used because there is a large amount of processing for judging an event log file for judging process abnormality. To this end, an object is set as an event key so that the event log file can be divided into objects, and a first event log file is generated by extracting only necessary event fields as event values in order to use only information necessary for judging process anomalies. In order to judge the process anomaly based on the object, the object is set as an event key, and when the process anomaly occurs, event fields for identifying process anomaly information are set as event values. The event field included in the first event log file may include at least one of an event time, an event occurrence point, and an operator. May include one or more of an event time, an event occurrence point, or an operator to determine when, where, by whom the process anomaly occurred. It is of course possible to further include an event field containing the information if there is more information needed to solve the process anomaly.

The first event log file, which is the key of the object, is divided into objects, and information on each object is used to determine whether there is a process anomaly. If it is determined that a process anomaly has occurred, a process abnormal event type value is added to the first event log file to generate a second event log file. Whether or not the event type value is added and the added event type value indicates whether or not the process is abnormal and what type of process is abnormal.

The process abnormal event type value may be one of a value indicating lost / stolen or unrecognized. It is possible to distinguish whether the object has lost or stolen according to the form of the process or not.

For parallel processing of event log files, a Map-Reduce method can be used. The MapReduce is composed of a function called Map and Reduce. The map extracts only necessary data among the fields included in one record into a pair of Key and Value. Reduce takes the result of the map as input data and performs the desired operation. The general data flow of MapReduce can be shown in FIG. The design of the map and reduction can be defined as follows.

Map: (k1, v1) - > < (k2, v2)

Reduce: (k2, <v2>) → <(k2, <v3>)>

The map receives the data composed of the key (k1) and the value (v1), extracts only the necessary data, and then returns a pair of the new key (k2) and the value (v2). (<V2>) grouped by the new key (k2) is received as input data. (K2, <v3>) after reconstructing a set of values (<v3>) by performing an operation such as an aggregation on a set of input values (<v2> Return.

3, a first event log file is generated using the map function from the event log file, the process abnormality is determined for the first event log file, and a redundancy function is used And adds the event type to the event log files having process anomalies to generate the second event log file.

In order to determine process anomalies, the processing unit 120 performs token reproduction on the process model using event log files collected for each object, and determines whether the token reaches the final position of the process as a result of performing the token reproduction, It is determined whether or not there is an ignited token, and it is determined whether or not there is a process abnormality for each object. Even in the case where the ignited token exists, even if the ignited token can not be ignited, the process abnormal event type value is added to the first event log file corresponding to the process before the position where the ignited token is located, Create a file.

To determine process anomalies, token regeneration is performed in a process model for a process to determine process anomalies. The token reproduction is performed according to the event log file collected for each object. In carrying out the token reproduction, Petri net is used.

Hereinafter, the token reproduction will be described in detail.

Petri nets have formal and graphical features that are suitable for modeling concurrent systems. As shown in FIG. 4, Petri nets are represented by a two-dimensional directed graph, and consist of two types of node points, places, transitions, and arcs. The current state of the system can be described by the point where the token is located. If the position of the token is changed by firing, the state of the system is considered to change. Ignition is possible when you have at least one token at every forward point connected to one transition, and when the transition is ignited, each forward point of the transition loses one token, and each backward point of the transition is a token . It is called consume and produce that the transition is ignited and the token of the forward point is moved to the rear point. The business process can be modeled with Petri net. FIG. 5 is an example of modeling the ticket purchase process as Petri net. In the case of a workflow, the point at which the token is located represents the current progress of the entire workflow, and in the case of an object flow, the position of the object in the entire process.

As shown in FIG. 6, the token replay process replay the generated event log into the predefined process model as shown in FIG. 6 to calculate the number of missing token, remaining token, produced token, and consumed token, This is the process of checking the abnormal state. A missing token means the number of tokens that are ignited, even though the transition can not be ignited. The remaining token means the number of tokens remaining at the point before the last point, even though the process has ended because the token arrived at the sink place. A produced token is the number of tokens generated at the source place and the number generated by the transition. The consumed token is the number of tokens consumed by the transition and the number of tokens at the end point disappearing.

Figures 6 and 7 illustrate token replay of the event log {a, d, c, e, h}. Initially, the values of p and c are 0 and all points are empty. As shown in FIG. 6 (a), when one token is generated at the point start, p = 1 is increased. When the transition a is executed, the token at the starting point is consumed, and a token is produced at the point p1 to change p = 2 and c = 1 (Fig. 6 (b)). In order for the second transition d in the log to be ignited, the token must exist at point p2. Since there is no transition to the transition d in the non-existent state, a missing token occurs at p2 and increases to m = 1, p = 3, c = 2 (Fig. 6 (c)). If the third transition c in the log is ignited then the token at point p1 is consumed and produced at point p2. Thus, p = 4 and c = 3, respectively (Fig. 7 (d)). When the fourth transition e is executed in the log, the token of the point p3 is consumed, and the token is produced at the point p4, and increases to p = 5 and c = 4 respectively (Fig. 7 (e)). Finally, when the transition h is ignited, the token at point p4 is consumed, the token is produced at the end of the branch, and p = 6, c = 5 is changed. At this time, when the token disappears from the last point, the token is present at the previous point p2, and r = 1 is increased (Fig. 7 (f)). That is, the event logs {a, d, c, e, h} are recorded as p = 6, c = 6, m = 1 and r = } Is not 100% satisfied with the model.

The process abnormality is determined using the parallel processing and the token reproduction described above. Hereinafter, a process for determining process anomalies will be described using a specific example.

As shown in Table 1, the event fields for the objects collected through the reader and the sensor in the environment using the automatic recognition installed at the process site include an Object ID indicating the object, an eventTime indicating the time when the event occurred, and a readPoint SiteName which indicates the location of the workplace, sensor information such as temperature and pressure indicating the process environment and process facility conditions, and worker information such as process worker, may be additionally included.

ObjectID eventTime readPoint siteName Temperature Pressure workers ... ObjectID1 2015-05-01T10: 00: 00Z RP-1 Supplier1 24 12 Wokrer1 Worker2 ... ObjectID1 2015-05-01T10: 00: 01Z RP-2 Supplier1 24 15 Wokrer5 Worker6 ... ObjectID2 2015-05-01T10: 00: 01Z RP-1 Supplier1 19 21 Wokrer1 Worker2 ... ObjectID1 2015-05-01T10: 00: 02Z RP-3 Supplier1 27 20 Wokrer9 Worker10 ... ObjectID2 2015-05-01T10: 00: 02Z RP-2 Supplier1 26 22 Wokrer5 Worker6 ... ObjectID3 2015-05-01T10: 00: 02Z RP-1 Supplier1 19 23 Wokrer1 Worker2 ... ObjectID2 2015-05-01T10: 00: 03Z RP-3 Supplier1 24 19 Wokrer9 Worker10 ... ObjectID3 2015-05-01T10: 00: 03Z RP-2 Supplier1 25 23 Wokrer5 Worker6 ... ObjectID4 2015-05-01T10: 00: 03Z RP-1 Supplier1 26 18 Wokrer1 Worker2 ... ObjectID2 2015-05-01T10: 00: 04Z RP-4 Supplier1 21 21 Wokrer11 Worker12 ... ObjectID4 2015-05-01T10: 00: 04Z RP-2 Supplier1 24 12 Wokrer5 Worker6 ... ObjectID5 2015-05-01T10: 00: 04Z RP-1 Supplier1 27 16 Wokrer1 Worker2 ... ObjectID2 2015-05-01T10: 00: 05Z RP-5 Supplier1 24 27 Wokrer13 Worker14 ... ObjectID3 2015-05-01T10: 00: 05Z RP-4 Supplier1 19 20 Wokrer11 Worker12 ... ObjectID5 2015-05-01T10: 00: 05Z RP-2 Supplier1 29 17 Wokrer5 Worker6 ... ObjectID6 2015-05-01T10: 00: 05Z RP-1 Supplier1 22 18 Wokrer1 Worker2 ... ObjectID3 2015-05-01T10: 00: 06Z RP-5 Supplier1 27 23 Wokrer13 Worker14 ... ObjectID5 2015-05-01T10: 00: 06Z RP-3 Supplier1 24 14 Wokrer9 Worker10 ... ObjectID5 2015-05-01T10: 00: 07Z RP-4 Supplier1 26 19 Wokrer11 Worker12 ... ObjectID6 2015-05-01T10: 00: 07Z RP-3 Supplier1 21 19 Wokrer9 Worker10 ... ObjectID5 2015-05-01T10: 00: 08Z RP-5 Supplier1 25 20 Wokrer13 Worker14 ... ObjectID6 2015-05-01T10: 00: 09Z RP-5 Supplier1 28 20 Wokrer13 Worker14 ...

In order to process the above event log files in parallel, the map function can be set as follows.

map: file <ObjectID, (eventTime, readPoint, workers)>

The map function reads the file in which the above-described event data is stored, one line at a time, extracts only the necessary fields and converts them into key-value pairs. The fields needed to detect anomalies are ObjectID, eventTime, and readPoint. The workers are also extracted from the map to identify workers related to the abnormal phenomenon. Since we will extract the fields centered on each ObjectID, return the ObjectID as a key and the remaining fields as a value to form a key-value pair. The file returned is the first event log file. An example of the result data by the map is shown in Fig. The set of values for the key value ObjectID is listed using the delimiter comma (,).

A process abnormality is determined for the first event log file generated by the map function, and only an event in which a process abnormality occurs is derived using the redess function. The Reduce function can be set as follows.

reduce: (ObjectID, <eventTime, readPoint, workers>) → <(ObjectID, <(eventTime, readPoint, workers, type) >>

The process for judging the process abnormality is shown in Fig.

① Execute token replay between events collected by ObjectID and predefined process model.

(2) After the token is reproduced, determine whether the token has reached the sink place of the predefined process.

③ If the token does not reach the end point, it means that there is no lost / stolen. Therefore, the ObjectID is set to the key (k2) and the fields of the event (eventTime, readPoint, workers) corresponding to the forward transition at the point where the token last is located, To the value set (<v3>). At this time, the type is assigned the lost / stolen.

④ Determine whether m = 0.

⑤ If m = 0, there is no missing, which is not lost / stolen or unrecognized, so there is nothing to add to the key (k2) -value set (<v2>) pair resulting from the reduction.

⑥ If m is not 0, a missing event occurs. Since the unrecognized event occurred, the event ID (eventTime, readPoint, workers) corresponding to the forward transition at the point where the object ID and the key (k2) Add to the set (<v2>). At this time, unrecognized type is assigned.

The result file of the redo may be the second event log file as shown in Fig. 10, and output event fields (eventTime, readPoint, workers) and process anomaly type for each ObjectID showing process anomalies, With a comma (,).

The token reproduction is performed for each object in the event log files of FIG. 10 as shown in FIGS. 11 and 12. FIG.

In the case of ObjectID1, since the token regeneration is completed and it is judged that the end point has reached no, the fields of the event corresponding to the forward transition of the point where the token last is located (2015-05-01T10: 02: 00Z, RP- worker9, worker10) to the value set. type is assigned to the lost / stolen (Fig. 11 (a)). In the case of ObjectID2, whether or not the end point is reached is YES, and since m = 0, the key value and the event are not added (Fig. 11 (b)). In the case of ObjectID3, the end point is reached and m = 1, so that the unrecognized phenomenon occurs. Therefore, the event field (2015-05-01T10: 03: 00Z, RP-2, worker5, worker6) corresponding to the forward transition at the point where the missing occurs is added to the value set and unrecognized is assigned to the type 11 (c)). In the case of ObjectID4, since the end point has not been reached, the fields of the event (2015-05-01T10: 04: 00Z, RP-2, worker5, worker6) And the lost / stolen is assigned to the type (Fig. 12 (d)). In the case of Object ID 5, the end point is reached, and since m = 0, the key value and the event are not added (Fig. 12 (e)). In the case of ObjectID6, the end point is reached and m = 2. (2015-05-01T10: 05: 00Z, RP-1, worker1, worker2), 2015-05-01T10: 07: 00Z, RP-3, worker9 , worker10) are added to the value set, and all unrecognized types are assigned to the type (Fig. 12 (f)).

The process abnormality information diagnosed through the above process can be transmitted to the server or the process manager through the communication unit 130. Or a display unit, and display the result.

FIG. 13 is a flowchart of a method for diagnosing a process anomaly according to an embodiment of the present invention, and FIG. 14 is a flowchart of a method for diagnosing a process anomaly according to another embodiment of the present invention. 13 and 14 correspond to the detailed description of Figs. 1 to 12, and a duplicate description will be omitted.

In operation 1310, an object is set as an event key from the event log file, and a first event log file is generated as an event value by deriving only event fields required for process abnormalities.

More specifically, in order to process an event log file in parallel rather than in a process order or an order according to an object, an object is set as an event key from an event log file, and a first event log Create a file. The event field included in the first event log file may include at least one of an event time, an event occurrence point, and an operator.

In step 1320, it is determined whether a process abnormality exists for each object by using the first event log file. The process abnormality event type value is added to the first event log file of the object in which the process abnormality occurs according to the determination result, And generating an event log file.

More specifically, it is determined whether a process abnormality exists for each object using the first event log file generated in step 1310, and the process abnormality event type value To generate a second event log file. The process abnormal event type value may be one of a value indicating lost / stolen or unrecognized.

Specifically, step 1320 may be performed by steps 1410 to 1440 of FIG.

The token reproduction is performed in the process model using the event log files collected for each object in step 1410 and the token reproduction is performed in step 1420 to determine whether the token reaches the final position of the process. If it is determined in step 1430 that the token has not reached the final position of the process, it is determined that a loss has occurred and a second event log file is generated. If the token reaches the final position of the token, It is determined whether or not there is an ignited token. As a result of the determination in step 1440, if it is determined that there is an ignited token even if it can not be ignited, it is determined that the unrecognized expression has occurred and a second event log file is generated. If there is no ignited token The process execution is terminated without generating the second event log file. The token is moved to the next process by the ignition in which the process is performed. In the case where the token is ignited, even if the token can not be ignited, the token corresponds to the process before the position where the ignited token is located And adds a process abnormal event type value to the first event log file to generate a second event log file.

Embodiments of the present invention may be implemented in the form of program instructions that can be executed on various computer means and recorded on a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and configured for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

Claims (12)

A method for diagnosing process anomalies,
Generating a first event log file having an event key as an object from an event log file and deriving only an event field required for process abnormalities to be an event value; And
A process abnormality event type value is added to the first event log file of the object in which the process abnormality occurs according to the determination result, and the second event log file &Lt; / RTI &gt; The method according to claim 1,
The event field included in the first event log file includes:
An event time, an event occurrence point, or an operator. The method according to claim 1,
The process abnormality event type value is a value
Lost / stolen, or unrecognized. The method according to claim 1,
Wherein the generating the second event log file comprises:
Performing token reproduction in a process model using event log files collected for each object;
Determining, as a result of performing the token regeneration, whether the token has reached a final position of the process;
If the token does not reach the final position of the process, it is determined that a loss has occurred and a second event log file is generated, and if the token reaches the final position of the fixation, ; And
If the ignited token does not exist, the second event log file is determined to be generated when the ignored token is present. If the ignited token does not exist, the second event log file is not generated &Lt; / RTI &gt; 5. The method of claim 4,
The token,
Characterized in that the process moves to the next process by ignition being carried out. 5. The method of claim 4,
If there is an ignited token even though it can not be ignited,
Wherein the second event log file is generated by adding the process abnormal event type value to the first event log file corresponding to the process before the position where the ignited token is located, even if it can not be ignited. A computer-readable recording medium storing a program for causing a computer to execute the method according to any one of claims 1 to 6. An apparatus for diagnosing a process anomaly,
A storage unit for storing an event log file; And
Reads the stored event log file, generates a first event log file that uses an object from the event log file as an event key, derives only event fields required for process abnormalities and uses the event log file as an event value, And generating a second event log file by adding a process abnormal event type value to a first event log file of an object in which a process anomaly occurs according to the determination result, . 9. The method of claim 8,
The event field included in the first event log file includes:
An event time, an event occurrence point, or an operator. 9. The method of claim 8,
The process abnormality event type value is a value
Lost / stolen, or unrecognized. 9. The method of claim 8,
Wherein,
A token reproduction is performed on the process model using event log files collected for each object, and whether the token reaches the final position of the process as a result of performing the token reproduction and whether or not there is an ignited token even when it can not be ignited And judges whether or not there is a process abnormality for each object. 12. The method of claim 11,
Wherein,
If there is an ignited token even though it can not be ignited,
And generates a second event log file by adding a process anomaly event type value to a first event log file corresponding to a process before a position where the ignited token is located, even if it can not be ignited.

Images