WO2021210100A1

WO2021210100A1 - Pattern extraction device, pattern extraction method, and program

Info

Publication number: WO2021210100A1
Application number: PCT/JP2020/016583
Authority: WO
Inventors: 忍斎藤
Original assignee: 日本電信電話株式会社
Priority date: 2020-04-15
Filing date: 2020-04-15
Publication date: 2021-10-21

Abstract

This pattern extraction device efficiently extracts, from among patterns of processes for executing functions of a system, a pattern including a function which requires improvement, such extraction carried out as a result of the pattern extraction device including: a calculation unit that calculates, for each function, the number of execution instances for each time segment of the function, on the basis of a history of processes for executing functions of the system; an identification unit that identifies a function with an execution timing deviation, on the basis of the number of execution instances for each time segment; and an extraction unit that extracts, on the basis of the history, a pattern including the function identified by the identification unit, from among the execution process patterns.

Description

Pattern extraction device, pattern extraction method and program

The present invention relates to a pattern extraction device, a pattern extraction method, and a program.

Inside the information system (hereinafter, simply referred to as "system"), various functions are sequentially executed in order to provide various services. As the services required for systems have become larger and more complex, the number of patterns of system behavior (function execution process) has reached an enormous number.

Conventionally, in order to improve the system, the pattern of the function execution process is visualized from the system execution data (system log), and the pattern that frequently occurs (high frequency pattern) is identified from a huge number of patterns. A technique for extracting a function included in a high-frequency pattern (= often used) as a candidate for improvement is disclosed (for example, Patent Document 1).

Note that each function inside the system has a mutual dependency relationship, so changing one function may affect the behavior of other functions. Therefore, at the timing of system reconstruction, etc., not only investigate how each function is used alone, but also investigate the flow of multiple functions (function execution process) executed when the system provides services. It is also important.

JP-A-2017-228257

On the other hand, it is also important to analyze patterns (rare patterns) that rarely occur in order to improve the system. Examples of improvements include discarding unused functions (selecting deleted functions) and integrating with other functions.

However, the number of times the pattern is executed tends to be as shown in FIG. FIG. 1 is a diagram showing an example of distribution of the number of times the pattern of the system execution process is executed.

In FIG. 1, the horizontal axis corresponds to the number of patterns and the vertical axis corresponds to the number of executions. As shown in FIG. 1, the number (type) of rare patterns with a small number of executions tends to be much larger than the number of high-frequency patterns.

Therefore, a technology is required to efficiently extract patterns (improvement-requiring patterns) that include functions that need improvement from a huge number of rare patterns.

The present invention has been made in view of the above points, and an object of the present invention is to efficiently extract a pattern including a function that needs improvement from among the patterns of the execution process of the function of the system.

Therefore, in order to solve the above problem, the pattern extraction device includes a calculation unit that calculates the number of executions of the function for each time interval for each function based on the history of the execution process of the function of the system, and a calculation unit for each time interval. Based on the number of executions, the pattern including the function specified by the specific unit is extracted from the specific unit that specifies the function whose execution time is biased and the pattern of the execution process based on the history. It has an extraction unit.

It is possible to efficiently extract patterns that include functions that need improvement from the patterns of the system function execution process.

It is a figure which shows the image example of the pattern of the execution process of a system. It is a figure which shows the hardware configuration example of the pattern extraction apparatus 10 in 1st Embodiment. It is a figure which shows the functional structure example of the pattern extraction apparatus 10 in 1st Embodiment. It is a figure for demonstrating the outline of the extraction of the improvement necessary pattern in 1st Embodiment. It is a figure which shows the number of executions of function E and function F by month. It is a flowchart for demonstrating an example of the processing procedure executed by the pattern extraction apparatus 10 in 1st Embodiment. It is a figure which shows the configuration example of a system log. It is a figure which shows the structural example of the execution number storage part 122. It is a figure which shows an example of the calculation result of the execution number of each function for each time interval. It is a figure which shows an example of the determination result whether or not the execution time is limited. It is a figure which shows an example of the count result of the content number of the target function in 1st Embodiment. It is a figure for demonstrating the outline of the extraction of the improvement-requiring pattern in the 2nd Embodiment. It is a figure which shows an example of the monthly execution number of function E and function G, and the fluctuation rate of the execution number. It is a flowchart for demonstrating an example of the processing procedure executed by the pattern extraction apparatus 10 in 2nd Embodiment. It is a figure which shows an example of the calculation result of the fluctuation rate of the number of times of execution of each function for each time interval. It is a figure which shows an example of the determination result whether or not it is an overvariation function. It is a figure which shows an example of the count result of the content number of the target function in 2nd Embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 2 is a diagram showing a hardware configuration example of the pattern extraction device 10 according to the first embodiment. The pattern extraction device 10 of FIG. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, a display device 106, an input device 107, and the like, which are connected to each other by a bus B, respectively.

The program that realizes the processing in the pattern extraction device 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed in the auxiliary storage device 102 from the recording medium 101 via the drive device 100. However, the program does not necessarily have to be installed from the recording medium 101, and may be downloaded from another computer via the network. The auxiliary storage device 102 stores the installed program and also stores necessary files, data, and the like.

The memory device 103 reads and stores the program from the auxiliary storage device 102 when the program is instructed to start. The CPU 104 realizes the function related to the pattern extraction device 10 according to the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network. The display device 106 displays a programmatic GUI (Graphical User Interface) or the like. The input device 107 is composed of a keyboard, a mouse, and the like, and is used for inputting various operation instructions.

FIG. 3 is a diagram showing a functional configuration example of the pattern extraction device 10 according to the first embodiment. In FIG. 3, the pattern extraction device 10 includes a pattern generation unit 11, an index calculation unit 12, a target function identification unit 13, a pattern extraction unit 14, an output unit 15, and the like.

Each of these parts is realized by a process of causing the CPU 104 to execute one or more programs installed in the pattern extraction device 10. The pattern extraction device 10 also uses the system log storage unit 121, the execution count storage unit 122, and the like. Each of these storage units can be realized by using, for example, a storage device that can be connected to the auxiliary storage device 102 or the pattern extraction device 10 via a network.

In the first embodiment, the pattern (hereinafter, simply referred to as “pattern”) of the function execution process of a computer system (hereinafter, simply referred to as “system”) such as an information system needs to be improved by focusing on the execution time. Pattern extraction (search) is performed. The function execution process means, for example, information indicating the execution order of functions used in a certain business work (hereinafter, referred to as “case”). The functions used and the order in which the functions are executed differ depending on the case. For example, in a system including functions A, B, C, D, etc., A → B → D is executed in a certain work (case 1), and A → C → D is executed in another work (case 2). NS. In this case, each of "A-> B-> D" and "A-> C-> D" corresponds to the pattern or type of the function execution process (hereinafter, simply referred to as "pattern"). However, the case (execution process) and the pattern do not have a one-to-one correspondence. For example, when the same execution process appears in a plurality of cases in which the cases are different from each other, these execution processes are extracted as one pattern.

In addition, the improvement-required pattern refers to a pattern in which there is a relatively high possibility that improvement is required among a plurality of patterns.

In the present embodiment, not only a rare pattern but also a pattern including a function having a temporal characteristic (biased) in the execution time (hereinafter referred to as "temporal characteristic pattern") is extracted (search) as a pattern requiring improvement. Will be done. In particular, in the first embodiment, a pattern including a function having a limited execution time (execution time is limited) (hereinafter, referred to as “target function”) corresponds to a time phase feature pattern and is required. It is extracted (searched) as an improvement pattern.

FIG. 4 is a diagram for explaining the outline of extraction of the improvement-requiring pattern in the first embodiment. FIG. 4, shows patterns 1, patterns 70 to 79, ..., Patterns 80 to 89, and the like. In each pattern, a rounded rectangle containing the letters A, B, C, E or F indicates a function.

When the number of times these patterns are executed in a certain period is as shown in the figure (4 times each), the number of times each of patterns 70 to 79 and patterns 80 to 89 is executed is relatively very small. That is, each of patterns 70 to 79 and patterns 80 to 89 corresponds to a rare pattern. The number of times the pattern is executed is the number of times the pattern is executed based on the execution record of each pattern in the past use of the system. Although not shown in FIG. 4, it is assumed that the patterns 71 to 78 are executed four times each, and the patterns 81 to 88 are executed four times each.

Further, it is assumed that the number of times each function is executed in the certain period (the total number of times each function is executed in each pattern) is as follows in descending order.
A: 200 times B: 200 times:
E: 40 times F: 40 times In this case, the number of times each of the function E and the function F included in the rare pattern is executed is 40 times, but this value is insignificant as compared with the number of times the other functions are executed. Not really. Further, even if the function E is included only in the patterns 70 to 79 and the function F is included only in the patterns 80 to 89, the number of appearance patterns of the function E and the function F is 10, respectively, which is not necessarily insignificant. ..

In view of the above, it is considered that patterns 70 to 89 do not have any special features that should be judged to require improvement, except that they are rare patterns.

Here, it is assumed that the number of monthly executions of function E and the number of monthly executions of function F are as shown in FIG.

FIG. 5 is a diagram showing the number of executions of the function E and the function F by month. FIG. 5 shows the number of executions by month for the six months from October to March for each of the functions E and F in the form of a table and a bar graph.

According to the table and the graph, the function E is executed almost the same number of times (6 or 7 times) every month, while the function F is executed 40 times only in March. Then, the execution time of the function F is limited, and it can be said that the function F corresponds to the target function. Therefore, each of the patterns 80 to 89 including the target function corresponds to the time phase feature pattern and is a candidate for the improvement-required pattern. As an example of improvement of the improvement-required pattern, since the execution time of the improvement-required pattern is limited, it is possible to return to manual operation, delete the function F, or replace the function F with another function. ..

Hereinafter, the processing procedure executed by the pattern extraction device 10 in the first embodiment will be described. FIG. 6 is a flowchart for explaining an example of the processing procedure executed by the pattern extraction device 10 in the first embodiment.

In step S101, the pattern generation unit 11 extracts a pattern based on the system log stored in the system log storage unit 121.

FIG. 7 is a diagram showing a configuration example of the system log. In the present embodiment, each line constituting the system log is referred to as "log data". The log data is recorded in the system log storage unit 121 (added to the system log) each time one function of the system is executed.

In FIG. 7, each log data includes a case ID, a function name, a date and time, and the like. The case ID is unique identification information for each work using the system. The function name is identification information of the function executed in the case related to the case ID. The date and time is the date and time when the function was executed.

The sequence of function names of the log data group with the same case ID corresponds to the function execution process. Therefore, it can be said that the system log is a history of the function execution process.

In step S101, the type of the function execution process is extracted as a pattern. For example, in FIG. 7, the execution process (A → B → C) of the function indicated by the log data group whose _{case ID is “W 1} ” is extracted as pattern 1, and the log data _{whose case ID is “W m” is extracted.} The function execution process (A → E → B → C) indicated by the group is extracted as the pattern 70, and the function execution process (A → F → B → C) indicated by the log data group whose _{case ID is “W n”.} Is shown as an example in which is extracted as pattern 80. These

patterns

1, 70 and 80 correspond to the

patterns

1, 70 and 80 shown in FIG.

The pattern can be extracted from the system log by using a known technique (for example, the technique disclosed in Patent Document 1 and JP-A-2017-187953).

Subsequently, the pattern generation unit 11 records the number of executions of the pattern and the number of executions of each function in the pattern in the execution number storage unit 122 for each extracted pattern (S102).

FIG. 8 is a diagram showing a configuration example of the execution number storage unit 122. FIG. 8 shows a table in which patterns are assigned in the row direction and the number of times the pattern is executed and the number of times each function is executed (number of times the function is executed) are assigned in the column direction as an example of the configuration of the execution number storage unit 122. ing. The number of function executions in each line is the number of times each function is executed in the pattern corresponding to the line.

For example, when the pattern generation unit 11 extracts each pattern from the system log, the pattern generation unit 11 can obtain the number of executions of each pattern by counting the execution process of the function matching each pattern in the system log. can.

Further, the pattern generation unit 11 can obtain the number of function executions in the pattern by totaling the number of times each function is executed in the execution sequence classified into the pattern for each pattern.

Subsequently, the index calculation unit 12 calculates the number of executions for each continuous time interval (Time Bucket) for each function with reference to the system log (FIG. 7) (S103).

FIG. 9 is a diagram showing an example of the calculation result of the number of executions of each function for each time interval. FIG. 9 shows the number of executions for each continuous time interval (unit period) in the time series for each function. In the example of FIG. 9, one time interval is one month. Therefore, FIG. 9 shows the number of times each function is executed by month. In the index calculation unit 12, the value of the "function name" is the function name of the function and the value of the "date and time" is the month for a certain time interval (a certain month of a certain year) of a certain function. By totaling the number of log data belonging to, the number of executions in the time interval is calculated.

Subsequently, the target function specifying unit 13 determines whether or not the execution time of each function is limited based on the calculation result (FIG. 9) by the index calculation unit 12, and the function whose execution time is limited. (Target function) is specified (S104). For example, when the threshold value for the number of time intervals in which the number of executions is 1 or more (hereinafter referred to as "the number of execution periods") is 1, and the number of execution periods is not more than the threshold value, the execution time is limited. It may be a condition.

FIG. 10 is a diagram showing an example of a determination result of whether or not the execution time is limited. In FIG. 10, a column of “time-limited determination” is added to the table shown in FIG. The "time-limited determination" is an item indicating a determination result of whether or not the execution time is limited. The value of the item is 1 or 0. 1 indicates a determination result that the execution time is limited. 0 indicates a determination result that the execution time is not limited.

Subsequently, the pattern extraction unit 14 counts (counts) the content of the target function for each pattern (S105). The content number of the target function for each pattern can be specified by referring to the execution number storage unit 122 (FIG. 8). The number of target functions contained in the pattern means the number of types of target functions included in the pattern. Therefore, for example, when the target function is one type of the function F, the maximum value of the content is 1.

Specifically, when the function F is the target function, the pattern extraction unit 14 specifies a pattern in which the number of times the function F is executed is 1 or more in FIG. The pattern extraction unit 14 sets the content number of the target function of the pattern to 1. On the other hand, the content number of the target function for the pattern in which the function execution count of the function F is empty is set to 0.

FIG. 11 is a diagram showing an example of the counting result of the content number of the target function in the first embodiment. FIG. 11 shows the counting result of the content when the storage content of the execution number storage unit 122 is as shown in FIG. 8 and the function F is the target function.

That is, in FIG. 8, for each of the patterns 80 to 89, the number of times the function F is executed is 1 or more. Therefore, in FIG. 11, the value of the "content of the target function" for each of the patterns 80 to 89 is set to 1, and the value of the "content of the target function" for the patterns other than these is set to 0. There is.

Subsequently, the pattern extraction unit 14 extracts a pattern related to the pattern number in which the "content number of the target function" is 1 or more as a pattern requiring improvement (S106).

Subsequently, the output unit 15 outputs a pattern requiring improvement (S107). For example, the pattern number of the pattern requiring improvement may be output. At this time, the value of "content number of target function" may be used for prioritization. For example, the pattern number may be output in descending order of the value of "content number of target function". The output unit 15 may also output the function name of the target function included in the pattern related to the pattern number in association with the output pattern number. The output form is not limited to the predetermined one. For example, it may be displayed on the display device 106, stored in the auxiliary storage device 102, or transmitted to another device.

The user can identify the improvement-requiring pattern and the improvement-requiring function by referring to the output information.

As described above, according to the first embodiment, the pattern requiring improvement can be automatically extracted from the rare patterns. That is, it is possible to efficiently extract patterns including functions that need improvement from the patterns of the system function execution process.

Next, the second embodiment will be described. The second embodiment will be described which is different from the first embodiment. The points not particularly mentioned in the second embodiment may be the same as those in the first embodiment.

In the second embodiment, a function (hereinafter referred to as "target function") having a large variation in the number of executions in each time interval (variation in the number of executions in an adjacent time interval) is performed at the execution time. An example of a function having a specific feature (biased) will be described.

FIG. 12 is a diagram for explaining an outline of extraction of the improvement-required pattern in the second embodiment. In FIG. 12, patterns 90 to 99 are shown instead of patterns 70 to 89.

It is assumed that the number of times these patterns are executed in a certain period is as shown in the figure, and the number of times each function is executed in the period is as follows in descending order.
A: 200 times B: 200 times:
G: 40 times According to the above, the number of times the function G is executed (40 times) is not very small, and the function G is included in a fixed number of patterns (10 patterns 90 to 99).

Here, it is assumed that the number of monthly executions of the functions E and G and the fluctuation rate of the number of executions are as shown in FIG.

FIG. 13 is a diagram showing an example of the monthly execution number of the function E and the function G and the fluctuation rate of the execution number. FIG. 13 shows a table and a graph showing the number of executions by month (by time interval) for 6 months from October to March for each of function E and function G, and the fluctuation rate of the number of executions by month (adjacent). A table showing the volatility of the number of executions in the time interval) in chronological order is shown. The volatility for a given month is calculated by the following formula.
Volatility = (number of executions in the current month / number of executions in the previous month) -1
According to FIG. 13, the function G is executed every month like the function E. Therefore, in the first embodiment, the function G is not specified as a target function.

On the other hand, the fluctuation rate of function G in December (the fluctuation rate between November and December) stands out at 1400%, and the number of executions of function G increases momentarily in December (only in December). It can be seen that the number of executions increases sharply). That is, the function G corresponds to a function (target function) in which the number of executions in chronological order for each time interval fluctuates greatly.

Therefore, in the second embodiment, the patterns 90 to 9 including the function G, which is the target function, correspond to the time phase feature pattern and are extracted as the improvement-required pattern. As an example of the improvement of the improvement-requiring pattern, the speed improvement (scale-out) is performed only when the improvement-requiring pattern increases momentarily.

FIG. 14 is a flowchart for explaining an example of the processing procedure executed by the pattern extraction device 10 in the second embodiment. In FIG. 14, the same steps as those in FIG. 6 are assigned the same step numbers, and the description thereof will be omitted.

In step S204, the index calculation unit 12 calculates the fluctuation rate of the number of executions of each time interval of each function with respect to the number of executions of the immediately preceding execution section based on the calculation result (FIG. 9) in step S103 (S204). ..

FIG. 15 is a diagram showing an example of the calculation result of the fluctuation rate of the number of executions of each function for each time interval. FIG. 15 shows the calculation result of the volatility of the number of executions for each time interval in chronological order for each function. The method of calculating the volatility is as described above.

Subsequently, the target function specifying unit 13 determines the presence or absence of the over-variation function for each function based on the calculation result (FIG. 15) by the index calculation unit 12, and identifies the function (target function) corresponding to the over-variation function. (S205). For example, the condition that the threshold value with respect to the absolute value of the volatility is 1000% and the absolute value of the volatility is equal to or more than the threshold value (that is, the volatility is + 1000% or more or -1000% or less) is the excessive fluctuation function. May be.

FIG. 16 is a diagram showing an example of a determination result of whether or not the function is an excessive fluctuation function. In FIG. 16, a column of “excessive fluctuation determination” is added to the table shown in FIG. The "excessive fluctuation determination" is an item indicating a determination result of whether or not the function is an excessive fluctuation function. The value of the item is 1 or 0. 1 indicates a determination result that the function is an excessive fluctuation function. 0 indicates a determination result that the function is not an excessive fluctuation function.

FIG. 16 shows the determination result when having a volatility of + 1000% or more or -1000% or less is a condition for the over-variation function. Therefore, the function G having a volatility of 1400% is determined to be an excessive volatility function. That is, in this case, the function G is specified as the target function.

Subsequently, the pattern extraction unit 14 counts (counts) the content of the target function for each pattern (S206). The content number of the target function for each pattern can be specified by referring to the execution number storage unit 122 (FIG. 8) as in step S105 of FIG.

Specifically, when the function G is the target function, the pattern extraction unit 14 specifies a pattern in which the number of times the function G is executed is 1 or more in FIG. The pattern extraction unit 14 sets the content number of the target function of the pattern to 1. On the other hand, the content number of the target function for the pattern in which the function execution count of the function G is empty is set to 0.

FIG. 17 is a diagram showing an example of the counting result of the content number of the target function in the second embodiment. FIG. 17 shows the counting result of the content when the storage content of the execution number storage unit 122 is as shown in FIG. 8 and the function G is the target function.

That is, in FIG. 8, the number of times the function G is executed is 1 or more for each of the patterns 90 to 99. Therefore, in FIG. 17, the value of the "content of the target function" for each of the patterns 90 to 99 is set to 1, and the value of the "content of the target function" for the patterns other than these is set to 0. There is.

After that, it is the same as the first embodiment.

As described above, according to the second embodiment, it is possible to extract the improvement-requiring pattern from the rare patterns that are difficult to extract as the improvement-requiring pattern in the first embodiment. Therefore, among the patterns of the execution process of the functions of the system, the patterns including the functions that need improvement can be efficiently extracted.

Note that the first embodiment and the second embodiment may be combined. For example, the processing procedure of FIG. 14 may be executed following the processing procedure of FIG. In this case, a pattern including either or both of the target function in the first embodiment and the target function in the second embodiment may be extracted as a pattern requiring improvement.

Further, in each of the above embodiments, the distinction between the execution subject (user who executes each function) of each function constituting the function execution process (pattern) is omitted for convenience, but for example, Patent Document 1 The present embodiment may be applied to the execution process (pattern) of the function with a swim lane in the above.

In each of the above embodiments, the index calculation unit 12 is an example of the calculation unit. The target function specifying unit 13 is an example of the specific unit. The pattern extraction unit 14 is an example of an extraction unit.

Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications are made within the scope of the gist of the present invention described in the claims.・ Can be changed.

10 Pattern extraction device 11 Pattern generation unit 12 Index calculation unit 13 Target function identification unit 14 Pattern extraction unit 15 Output unit 100 Drive device 101 Recording medium 102 Auxiliary storage device 103 Memory device 104 CPU
105 Interface device 106 Display device 107 Input device 121 System log storage unit 122 Execution count storage unit B bus

Claims

A calculation unit that calculates the number of times the function is executed for each time interval for each function based on the history of the system function execution process.
Based on the number of executions for each time interval, a specific part that identifies the function whose execution time is biased, and
An extraction unit that extracts the pattern including the function specified by the specific unit from the patterns of the execution process based on the history.
A pattern extraction device characterized by having.
The specific unit is one of the functions in which the number of executions is 1 or more and the number of time intervals is equal to or less than a threshold value, and the functions in which the absolute value of the fluctuation rate of the number of executions in adjacent time intervals is equal to or more than a threshold value. Identify one or both,
The pattern extraction device according to claim 1.
The extraction unit counts the content of the function specified by the specific unit for each pattern.
An output unit that outputs the pattern extracted by the extraction unit by prioritization based on the content.
The pattern extraction device according to claim 1 or 2, wherein the pattern extraction device is characterized by having.
Based on the history of the execution process of the function of the system, the calculation procedure for calculating the number of executions of the function for each time interval for each function, and the calculation procedure.
A specific procedure for identifying the function whose execution time is biased based on the number of executions for each time interval, and
An extraction procedure for extracting the pattern including the function specified by the specific procedure from the patterns of the execution process based on the history.
A pattern extraction method characterized by a computer performing.
The specific procedure is one of the functions in which the number of executions is 1 or more and the number of time intervals is equal to or less than a threshold value, and the functions in which the absolute value of the fluctuation rate of the number of executions in adjacent time intervals is equal to or more than a threshold value. Identify one or both,
The pattern extraction method according to claim 4, wherein the pattern is extracted.
In the extraction procedure, the content number of the function specified by the specific procedure is counted for each pattern.
An output unit that outputs the pattern extracted by the extraction procedure by prioritizing based on the content.
The pattern extraction method according to claim 4 or 5, wherein the pattern extraction method is characterized by having.
A program characterized by operating a computer as the pattern extraction device according to any one of claims 1 to 3.