Data analysis device, data analysis system, and storage medium

Abstract

The data analysis device (2) has: a character string classification section (211) and a numerical value classification section (212) that acquire sequence data in which characters strings related to an information system as an analysis target are set as elements and sequence data in which numerical values representing states of devices constituting the information system are set as elements, each having an index capable of comparing order relations of elements within and between sequences, classify the elements into classification categories for each of the acquired sequence data, and output sequence data in which classification values representing the classification categories are set as elements; a sequence integration section (213) that integrates the sequence data in which the classification values of the character strings are set as elements and the sequence data in which the classification values of the numerical values are set as elements into one sequence data; and a frequent pattern detection section (215) that detects occurrence of a combination of elements that is frequent, i.e., a frequent pattern, using the sequence data integrated into one by the sequence integration section (213).

Description

Technical Field

[0001] This invention relates to data analysis devices, data analysis systems, and storage media. Background Technology

[0002] The following technique has been proposed: applying frequent pattern mining to log data of strings output from devices constituting an information system, thereby analyzing phenomena occurring in the information system. For example, Non-Patent Document 1 describes a prior art technique that performs frequent pattern mining on the results obtained by classifying each line of data in the log data of strings, thereby analyzing phenomena occurring in the information system as the object of analysis.

[0003] Existing technical documents

[0004] Non-patent literature

[0005] Non-patent literature 1: F. Lin, K. Muzumdar, NLPaptev, M.-V. Curelea, S. Lee, and S. Sankar, "Fast dimensional analysis for root cause investigation in a large-scale service environment," in Proceedings of the ACM on Measurement and Analysis of Computing Systems (POMACS), 2020. Summary of the Invention

[0006] The problem that the invention aims to solve

[0007] However, the prior art described in Non-Patent Document 1 has the following problem: when the log data used for frequent pattern mining is insufficient for the analysis, the accuracy of the analysis of phenomena occurring in the information system being analyzed is reduced.

[0008] The present invention addresses the aforementioned problems and aims to provide a data analysis device, a data analysis system, and a storage medium capable of supplementing the data needed for the analysis of phenomena occurring in information systems.

[0009] Methods for solving problems

[0010] The data analysis apparatus of the present invention comprises: a classification unit that acquires sequence data having indexes that enable comparison of the sequential relationships of elements within and between sequences, and sequence data having strings related to the information system as the object of analysis and numerical values ​​representing the states of devices constituting the information system as elements; classifying elements into classification categories according to each acquired sequence data; and outputting sequence data having classification values ​​representing the classification categories as elements; an integration unit that unifies the sequence data having string classification values ​​as elements and the sequence data having numerical classification values ​​as elements into a single sequence data; and a detection unit that uses the sequence data unified by the integration unit to detect the occurrence of frequent combinations of elements, i.e., frequent patterns.

[0011] Invention Effects

[0012] According to the present invention, sequence data containing strings related to the information system being analyzed and sequence data containing numerical values ​​representing the states of devices constituting the information system are unified into a single sequence data. This allows for frequent pattern mining of the sequence data obtained by supplementing one sequence data with another. Therefore, the data analysis apparatus of the present invention can supplement the data needed for analyzing phenomena occurring in the information system. Attached Figure Description

[0013] [ Figure 1 [Illustration 1] is a block diagram showing the structure of the data analysis system in Implementation 1.

[0014] [ Figure 2 ] Figure 2 A is a diagram illustrating an example of time-series data where strings are set as elements. Figure 2 B is a graph showing an example of time-series data with numerical values ​​as elements. Figure 2 C is a graph showing an example of time series data obtained by interpolating elements from timestamps not included in the time series data.

[0015] [ Figure 3 [ ] is a flowchart illustrating the operation of the data analysis device in Embodiment 1.

[0016] [ Figure 4 [Illustration 1] is a block diagram showing the structure of the frequent pattern analysis unit.

[0017] [ Figure 5 [ ] is a flowchart illustrating the actions of the frequent pattern analysis unit during learning.

[0018] [ Figure 6 ] Figure 6 A is a diagram illustrating an example of time-series data where strings are set as elements. Figure 6B is a graph showing an example of time-series data with numerical values ​​as elements. Figure 6 C is a diagram illustrating an example of time-series data where the categorical values ​​of strings are set as elements. Figure 6 D is a diagram illustrating an example of time-series data where the categorical values ​​of the numerical values ​​are set as elements.

[0019] [ Figure 7 [ ] is a diagram showing an overview of the extraction process for frequent patterns.

[0020] [ Figure 8 [ ] is a flowchart illustrating the data analysis method of Implementation Method 1.

[0021] [ Figure 9 [ ] is a diagram showing an overview of the detection process for frequent patterns.

[0022] [ Figure 10 [ ] is a block diagram showing the structure of the interpolation processing unit.

[0023] [ Figure 11 [ ] is a flowchart illustrating the interpolation process for time-series data.

[0024] [ Figure 12 ] Figure 12 A is a diagram illustrating an example of time-series data where strings are set as elements. Figure 12 B is a graph showing an example of time-series data with numerical values ​​as elements. Figure 12 C is a graph showing an example of interpolated time series data.

[0025] [ Figure 13 [ ] is a block diagram showing the structure of the retrieval processing unit.

[0026] [ Figure 14 [This is a flowchart illustrating the retrieval and processing of past job information.]

[0027] [ Figure 15 ] Figure 15 A is a diagram showing frequent pattern information stored in the storage device. Figure 15 B is a diagram showing an example of past job information.

[0028] [ Figure 16 ] Figure 16 A is a block diagram illustrating the hardware structure for implementing the data analysis device of Embodiment 1. Figure 16 B is a block diagram illustrating the hardware structure of the software that performs the functions of the data analysis device in Embodiment 1. Detailed Implementation

[0029] Implementation Method 1

[0030] Figure 1This is a block diagram illustrating the structure of the data analysis system 1 according to Embodiment 1. Figure 1 In this context, data analysis system 1 is a system that analyzes phenomena occurring within an information system, which is the object of analysis. An information system is a system that processes various types of information, and may be configured to include devices that perform actions related to information exchange. Furthermore, information systems may include, for example, computer systems that implement databases, data warehouses, data integration services, distributed applications, or network services.

[0031] The data analysis system 1 includes a data analysis device 2, an input device 3A, an input device 3B, and a storage device 4. The data analysis device 2 acquires time-series data related to the information system being analyzed, and uses the acquired time-series data for data analysis.

[0032] Input device 3A accepts input of time-series data containing strings as elements related to the information system being analyzed, and outputs the accepted string time-series data to data analysis device 2. Input device 3B accepts input of time-series data containing numerical values ​​representing the states of devices constituting the information system, and outputs the accepted numerical value time-series data to data analysis device 2.

[0033] Furthermore, the time-series data obtained from the information system being analyzed, which uses strings as elements and numerical values ​​as elements, respectively have indices, namely timestamps, that enable comparison of the order of elements within and between sequences.

[0034] Storage device 4 stores definition information of frequent patterns. The frequent patterns shown in the definition information can be frequent patterns extracted by data analysis device 2 from time-series data obtained from the information system being analyzed, or they can be data of the same form set or modified by the user. Furthermore, storage device 4 correspondingly stores past operation information and frequent patterns related to phenomena occurring in the information system.

[0035] Figure 2 Figure A is an example of time-series data where strings are set as elements. The time-series data of strings obtained by the frequent pattern analysis unit 21 includes timestamps that allow for comparison of the sequential relationship of strings within a time series or between time-series data. For example, in... Figure 2 The time-series data shown in Figure A contains timestamps such as "Oct 10 0:00:00" and strings such as "received xxx". The timestamps can be used to... Figure 2 It can compare the sequential relationships of items within the time series shown in A, and can also compare the sequential relationships of elements between time series data.

[0036] Figure 2 B is a graph showing an example of time-series data with numerical values ​​as elements. For example, as... Figure 2 As shown in Figure B, the time-series data (1) of the values ​​obtained by the frequent pattern analysis unit 21 can be represented using a graph showing the relationship between the values ​​representing the state of the devices constituting the information system as the object of analysis and time. The values ​​representing the state of the devices are elements of the time-series data, and each time point on the time axis is a timestamp. Figure 2 In B, the time series data (1) is the time series up to time T1.

[0037] Figure 2 C is a graph showing an example of time series data obtained by interpolating elements from timestamps not included in the original time series data. Figure 2 In the time series data (1) shown in C, the interpolation processing unit 22 performs interpolation on the data. Figure 2 The estimated values ​​of the elements in the time series data (1) shown in B, which are not included in the time stamps, i.e., the time stamps after time T1, are interpolated. The representative values ​​of the estimated values ​​of the interpolated elements in the time series data (1) are, for example, the average (1a), maximum (1b), and minimum (1c) values ​​of each time stamp.

[0038] The data analysis device 2 includes a frequent pattern analysis unit 21, an interpolation processing unit 22, and a retrieval processing unit 23. Figure 3 This is a flowchart illustrating the operation of the data analysis device 2. The frequent pattern analysis unit 21 acquires sequence data with strings related to the information system being analyzed as elements, and sequence data with values ​​representing the states of the devices constituting the information system as elements, and performs frequent pattern analysis using the acquired time-series data (step ST1).

[0039] For example, the frequent pattern analysis unit 21 combines the timing data of the string input received by the input device 3A and the timing data of the numerical value input received by the input device 3B into one, and rearranges the elements in the unified timing data according to the order relationship shown by the timestamps. Then, the frequent pattern analysis unit 21 uses the timing data obtained by rearranging the elements to detect the occurrence of frequent combinations of elements, i.e., frequent patterns.

[0040] The interpolation processing unit 22 takes into input time-series data containing frequent patterns detected by the frequent pattern analysis unit 21 as elements, interpolates the elements in the timestamps not included in the input time-series data, and outputs the interpolated time-series data (step ST2). For example, the interpolation processing unit 22 uses the time-series data of frequent patterns detected by the frequent pattern analysis unit 21 to calculate an estimate of the occurrence rate of the frequent patterns and a statistic of the occurrence rate of the frequent patterns. Then, the interpolation processing unit 22 uses the estimate of the occurrence rate of the frequent patterns and the statistic of the occurrence rate of the frequent patterns to interpolate the elements in the timestamps not included in the time-series data.

[0041] The retrieval processing unit 23 retrieves past job information for phenomena corresponding to frequent patterns detected by the frequent pattern analysis unit 21, and outputs job information as a result of the retrieval (step ST3). For example, the retrieval processing unit 23 selects time-series data based on importance from at least one of time-series data that sets the frequent patterns detected by the frequent pattern analysis unit 21 as elements, and time-series data that sets strings as elements and values ​​as elements obtained from the information system being analyzed. Then, the retrieval processing unit 23 retrieves job information corresponding to the selected time-series data from the job information stored in the storage device 4, and outputs the retrieved job information.

[0042] Figure 4 This is a block diagram showing the structure of the frequent pattern analysis unit 21. Figure 4 In this unit, the frequent pattern analysis unit 21 includes a string classification unit 211, a numerical classification unit 212, a sequence integration unit 213, a frequent pattern extraction unit 214, and a frequent pattern detection unit 215. During the learning phase of the data analysis device 2, where it learns frequent patterns corresponding to phenomena occurring in the information system being analyzed, only the frequent pattern analysis unit 21 operates. The frequent pattern analysis unit 21 uses time-series string data and time-series numerical data obtained from the information system being analyzed as learning data to extract frequent patterns of the analyzed object.

[0043] The data analysis device 2 combines sequence data containing strings related to the information system being analyzed and sequence data containing values ​​representing the states of the devices constituting the information system into a single sequence data. This allows for frequent pattern mining of the sequence data obtained by supplementing one sequence data with another. For example, the data analysis device 2, limited to applications that do not require information generated by the interpolation processing unit 22 and the retrieval processing unit 23, only has... Figure 4 The structural elements of the frequent pattern analysis unit 21 shown are sufficient. That is, Figure 4 The frequent pattern analysis unit 21 shown functions as a data analysis device 2.

[0044] The string classification department 211 is a classification department that: acquires time-series data with strings related to the information system as the object of analysis as elements, classifies the strings in each timestamp of the acquired time-series data into classification categories, and outputs time-series data with classification values ​​representing classification categories as elements.

[0045] For example, the string classification unit 211 classifies strings in each timestamp of time-series data that match any one of a pre-defined template of multiple strings; if no matching template exists, it assumes that the element in that timestamp does not exist. Furthermore, the string classification unit 211 classifies the strings in each line of log data obtained from the information system being analyzed.

[0046] The numerical classification unit 212 is a classification unit that acquires time-series data with elements representing the state of devices constituting the information system as the object of analysis, classifies the elements in each timestamp of the acquired time-series data into classification categories, and outputs time-series data with elements representing classification categories. The numerical classification unit 212 classifies a set of values ​​related to the timestamps of the acquired time-series data (e.g., a list of values ​​existing near the timestamps) into classification categories and outputs time-series data with elements representing classification categories.

[0047] The time vicinity of a timestamp is a time range that includes timestamps in time-series data. For example, the time vicinity of a timestamp is a time range of 3 seconds before and after the time of the timestamp. For example, the numerical classification unit 212 classifies the values ​​or representative values ​​of the list of values ​​in the timestamps of the acquired time-series data that belong to any of the intervals of a pre-defined set of multiple values, and sets the absence of an element in that timestamp if no matching range exists. Furthermore, the numerical classification unit 212 classifies the shapes of the curves showing the values ​​or lists of values ​​in the timestamps of the acquired time-series data that are similar to the shapes of the curves showing the pre-defined set of multiple values.

[0048] The sequence integration unit 213 is an integration unit that unifies the sequence data that sets the category value of strings as elements and the sequence data that sets the category value of numbers as elements into a single sequence data.

[0049] For example, the sequence integration unit 213 combines sequence data with string classification values ​​set as elements and sequence data with numerical classification values ​​set as elements in the time direction indicated by the timestamps to generate time-series data that rearranges the elements according to the order relationship indicated by the timestamps.

[0050] Therefore, information related to phenomena occurring in the information system being analyzed, which is not included in the string-format log data, is supplemented by time-series data representing the state of the devices.

[0051] In the following description, the category values ​​of elements or lists of elements in time series data are recorded as items.

[0052] The frequent pattern extraction unit 214 is an extraction unit that generates transaction data by assigning timestamp identification values ​​to the set of items contained in the time series data output from the sequence integration unit 213, performs frequent pattern mining on the transaction data, and thereby extracts frequent patterns. For example, the frequent pattern extraction unit 214 extracts combinations of items that are determined to be frequent in the aforementioned time series data as frequent patterns based on the frequency of occurrence of a portion of the set of items.

[0053] Frequent patterns are combinations of items with different orders, but they can also be represented as relevance rules, divided into conditional and concluding parts. Furthermore, the conditional and concluding parts can be further processed as frequent patterns. For example, frequent patterns can also use the following pattern: the set of specific items included in the combination of items is set as the conditional part in the relevance rule for frequent pattern mining, and the set of the remaining items is set as the concluding part in the relevance rule, assigning a value representing the confidence level of the concluding part when the conditional part is true. For example, in transaction data {a,b,c,d,e,f}, if the frequent pattern "combination of items with different orders" is {a,b,c,d} and the conditional part is {a,c}, then the set of the remaining items {b,d} becomes the concluding part.

[0054] In addition, a frequent pattern is a set of items that occur frequently in the information system that is the object of analysis. A subset of these items can be used as data to represent their causes.

[0055] Furthermore, the set of items is a combination of items with different orders and no duplicates. For example, duplicate items can be removed from the list of items containing elements near each timestamp in the time series data, thereby generating a set of items based on the time series data. In addition, the frequent pattern extraction unit 214 generates transaction data using the time series data and performs correlation analysis on the generated transaction data, thereby extracting frequent patterns.

[0056] Transactional data is data that distinguishes a set of items by assigning an identifier to each event that occurs within that set. For example, in the settlement process of goods sales, the combination of purchased items is a set of items, and the purchase history data managed by the settlement process number assigned to the set of items is the object transactional data for frequent pattern mining.

[0057] The frequent pattern detection unit 215 is a detection unit that detects the occurrence of frequent patterns, i.e., combinations of frequent elements, in the time-series data output from the sequence integration unit 213. For example, the frequent pattern detection unit 215 generates transaction data using the time-series data and compares the set of items contained in the generated transaction data with the definition information of frequent patterns stored in the storage device 4. If there is a set of items that matches the definition information of frequent patterns stored in the storage device 4, the frequent pattern detection unit 215 determines that a frequent pattern has occurred in the time-series data obtained from the information system being analyzed.

[0058] The frequent pattern detection unit 215 generates time-series data of the identification values ​​of frequent patterns that occur near each timestamp, and outputs the generated time-series data to the interpolation processing unit 22.

[0059] The frequent pattern detection unit 215 generates time-series data of the identification values ​​of frequent patterns that occur near each timestamp, and outputs the generated time-series data to the retrieval processing unit 23.

[0060] Furthermore, the frequent pattern detection unit 215 generates time-series data that sets elements of combinations of items that do not belong to frequent patterns and are sets of items that occur more frequently than during the learning phase, and outputs the generated time-series data to the retrieval processing unit 23. Moreover, when frequent patterns are represented using a combination of the condition part, conclusion part, and the confidence level of the conclusion part occurring when the condition part is true in the relevant rules, the frequent pattern detection unit 215 outputs time-series data that sets elements of frequent patterns that only have a condition part and do not have a conclusion part to the retrieval processing unit 23.

[0061] In the absence of the interpolation processing unit 22 or the retrieval processing unit 23, the aforementioned timing data output from the frequent pattern detection unit 215 to the interpolation processing unit 22 or the retrieval processing unit 23 is displayed on the display device as analysis auxiliary information of the information system in tabular or graph form, thereby providing prompts to the user.

[0062] Figure 5 This is a flowchart showing the operation of the frequent pattern analysis unit 21 during learning, illustrating the operation of the data analysis device 2 in the learning phase when it learns frequent patterns corresponding to phenomena occurring in the information system that is the object of analysis.

[0063] The string classification unit 211 classifies the strings in each timestamp of the time-series data where strings are set as elements, received by the input device 3A, into classification categories, and the value classification unit 212 classifies the values ​​in each timestamp of the time-series data where values ​​are set as elements, received by the input device 3B, into classification categories (step ST1a). The string classification unit 211 and the value classification unit 212 can operate independently of each other, or one of them can operate first, or they can operate in parallel.

[0064] Figure 6 A is a diagram illustrating an example of time-series data where strings are set as elements. String classification section 211, for example, obtains... Figure 6 The time series data shown in A. Figure 6 B is a graph showing an example of time-series data with numerical values ​​as elements. The numerical classification section 212, for example, obtains... Figure 6 The time series data shown in B.

[0065] Figure 6 C is a diagram illustrating an example of time-series data where the classification value of a string is set as an element. The string classification section 211... Figure 6 After classifying the strings in each timestamp of the time-series data shown in Figure A into their respective categories, the output will set the category value representing the category to the element's value. Figure 6 The time series data shown in C. For example, Figure 6 In the time series data shown in Figure A, the strings "received xxx" and "received yyy" containing the word "received" have a classification value of "L3", while the strings "sent abc" and "sent abd" containing the word "sent" have a classification value of "L5". For example... Figure 6 As shown in C, the string classification unit 211 generates time-series data that sets the classification value of the string as the element, and outputs the generated time-series data to the sequence integration unit 213.

[0066] Figure 6 D is a diagram illustrating an example of time-series data where the categorical value of a numerical value is set as an element. The numerical classification unit 212, in setting... Figure 6 After classifying the values ​​in each timestamp of the time-series data shown in B into their respective categories, the output sets the category value representing the category to the element's value. Figure 6 The time series data shown in D. For example, Figure 6 In the curve graph shown in B, the values ​​near the timestamps at each moment are categorized and assigned a category value such as "M3". For example... Figure 6 As shown in D, the numerical classification unit 212 generates time-series data that sets the classification value of the numerical values ​​as elements, and outputs the generated time-series data to the sequence integration unit 213.

[0067] Next, the sequence integration unit 213 performs integration processing to unify the sequence data with string classification values ​​as elements and the sequence data with numerical classification values ​​as elements into a single sequence data (step ST2a). Figure 7 This is a diagram illustrating an overview of the extraction process for frequent patterns. For example, sequence integration section 213... Figure 6 As shown in C, the categorization value of the string is set as the time series data of the element and Figure 6 As shown in D, the numerical classification values ​​are set as the time series data of the elements, which are then unified into one and rearranged according to the timestamps to calculate the order. Figure 7 The left side shows the so-called integrated time series data.

[0068] exist Figure 7 In the time series data shown on the left, string classification values ​​and numerical classification values ​​are set for timestamps contained in the two time series data before merging. Even if a time series data point is not included in the one before merging, a classification value is set for a timestamp contained in the other time series data. That is, the merged time series data becomes a data set that interpolates the items of one time series data point with another time series data point.

[0069] The frequent pattern extraction unit 214 generates transaction data that assigns a timestamp identification value to the set of items contained in the time series data output from the sequence integration unit 213, performs frequent pattern mining on the transaction data, and thereby extracts frequent patterns (step ST3a).

[0070] For example, such as Figure 7 As shown on the right, there is a time near the timestamp of project "M0" that is... Figure 7 The frequent items “L3” and “L5” in the time series data shown on the left are extracted by the frequent pattern extraction unit 214 as the frequent pattern “Pattern1”. The frequent pattern extraction unit 214 extracts the set of items “L3” and “L5” as the frequent pattern “Pattern2” in the same steps, and extracts the set of items “L1”, “M4”, “M5” and “M6” as the frequent pattern “Pattern3”.

[0071] The frequent pattern extraction unit 214 can also perform machine learning using neural networks or the like in the frequent pattern extraction process. For example, the frequent pattern extraction unit 214 uses... Figure 7 The time-series data shown on the left is used as input, and the output is used as the learning model of frequent patterns in the information system for analysis. The frequent pattern analysis unit 21 repeatedly performs this process during the learning phase. Figure 5 The process shown is a series of steps. This is repeated. Figure 5During processing, the frequent pattern extraction unit 214 uses time-series data obtained from the information system being analyzed as learning data to learn frequent patterns in that information system. The definition information of the frequent patterns extracted by the frequent pattern extraction unit 214 is stored in the storage device 4.

[0072] The data analysis device 2 analyzes log data representing the state of the information system as the object of analysis in string form, using time-series data that directly represents the state of the devices constituting the information system. As a result, the frequent patterns of the learning results become more detailed, thus enabling more detailed analytical support information for the information system generated using frequent patterns and utilized in the inference phase.

[0073] Figure 8 This is a flowchart illustrating the data analysis method of Implementation Method 1, showing... Figure 3 The details of step ST1 are as follows. Figure 8 The series of processes involved are the actions of the frequent pattern analysis unit 21 during the inference phase. Additionally, Figure 8 Steps ST1b and ST2b in the text are related to... Figure 5 The processes in steps ST1a and ST2a are the same, so the explanation is omitted.

[0074] During the inference phase, the frequent pattern analysis unit 21 operates independently, or the interpolation processing unit 22 or the retrieval processing unit 23 operates using the time-series data output from the frequent pattern detection unit 215. Furthermore, during the inference phase, the frequent pattern extraction unit 214 does not operate. The frequent pattern detection unit 215 detects the occurrence of frequent patterns in the information system being analyzed based on whether the time-series data obtained from the information system being analyzed matches the frequent patterns obtained during the learning phase.

[0075] The frequent pattern detection unit 215 detects the occurrence of frequent patterns (step ST3b) by detecting combinations of frequent elements in the time series data output from the sequence integration unit 213. For example, the frequent pattern detection unit 215 generates transaction data using the input time series data and compares the set of items contained in the transaction data with the frequent patterns stored in the storage device 4.

[0076] Figure 9 This is a diagram illustrating an overview of the detection process for frequent patterns. For example, as shown below... Figure 9 As shown on the right, in Figure 9 The set of items contained in the integrated time-series data shown on the left contains a set that matches the frequent patterns "Pattern1", "Pattern2", and "Pattern3" stored in storage device 4. Therefore, the frequent pattern detection unit 215 detects the occurrence of frequent patterns in the information system as the object of analysis.

[0077] After detecting the occurrence of frequent patterns in the information system being analyzed, the frequent pattern detection unit 215 generates time-series data of the identification values ​​of frequent patterns occurring near each timestamp, and outputs the generated time-series data to the interpolation processing unit 22. Furthermore, the frequent pattern detection unit 215 generates time-series data of the identification values ​​of frequent patterns occurring near each timestamp, and outputs the generated time-series data to the retrieval processing unit 23.

[0078] Furthermore, after detecting the occurrence of frequent patterns in the information system being analyzed, the frequent pattern detection unit 215 generates time-series data that sets elements of combinations of items that do not belong to frequent patterns and are sets of items that occur more frequently than during the learning phase, and outputs the generated time-series data to the retrieval processing unit 23. Moreover, when frequent patterns are represented using a combination of conditional clauses, conclusion clauses, and the confidence level of the conclusion clause occurring when the conditional clause is true, the frequent pattern detection unit 215 outputs time-series data that sets elements of frequent patterns that only have conditional clauses and do not have conclusion clauses to the retrieval processing unit 23.

[0079] As described above, after classifying each time series data point, the various classification values ​​are unified into a single time series data point for frequent pattern mining. This eliminates the need to ensure consistency of timestamps across multiple time series data points. In other words, it expands the scope of a single time series data point used in the analysis.

[0080] Figure 10 This is a block diagram showing the structure of the interpolation processing unit 22. Figure 10 In this model, the interpolation processing unit 22 includes a frequent pattern occurrence rate calculation unit 221, an estimability determination unit 222, an estimation unit 223, a statistics calculation unit 224, and an interpolation data calculation unit 225. The frequent pattern occurrence rate calculation unit 221 is an occurrence rate calculation unit that acquires sequence data with frequent patterns detected by the frequent pattern detection unit 215 as elements and calculates the occurrence rate of the frequent patterns. For example, the frequent pattern occurrence rate calculation unit 221 calculates the occurrence rate of the frequent patterns by dividing the number of occurrences of the frequent patterns contained in the vicinity of each timestamp by the total time of the time range near a specified time. The occurrence rate of the frequent patterns is calculated for each frequent pattern.

[0081] The estimation determination unit 222 determines whether it is possible to estimate the interpolation value of elements in the sequence data of elements whose frequent pattern occurrence rate is calculated by the frequent pattern occurrence rate calculation unit 221 is set as the interpolation value of elements in the time series data that are not included in the time series data. For example, for a partial range of elements in the time series data where the occurrence rate of frequent patterns is set as the element, the estimation determination unit 222 determines whether it is possible to estimate the interpolation value of elements in the time series data that are not included in the time series data, and outputs a determination value of 0 or 1 representing the determination result to the above partial range.

[0082] The estimability determination unit 222 determines whether it is possible to estimate the interpolation value of an element in the sequence data that is not included in the timestamps, where the occurrence rate of the frequent pattern calculated by the frequent pattern occurrence rate calculation unit 221 is set as an element. For example, the estimability determination unit 222 divides the time series data of the occurrence rate of the frequent pattern into model adjustment data and model validation data. The model adjustment data is used to adjust the internal parameters of the machine learning-based time series prediction model, and the model validation data is used to measure the accuracy of the estimation. Then, the estimability determination unit 222 determines that it is possible to estimate if the estimation accuracy is above an allowable threshold, and determines that it is not possible to estimate if the estimation accuracy is below the allowable threshold. A determination value of 0 or 1, indicating whether it is possible to estimate, is assigned to the sequence data where the occurrence rate of the frequent pattern is set as an element.

[0083] The estimation unit 223 estimates the interpolated values ​​of elements that the estimability determination unit 222 determines can be estimated. For example, regarding the portion of time series data where the occurrence rate of frequent patterns is set as an element and a determination value indicating that it can be estimated (e.g., determination value = 1) is assigned, the estimation unit 223 estimates the interpolated values ​​of elements in timestamps not included in the time series data. The estimation unit 223 estimates the interpolated values ​​of elements, for example, using the same model as the time series prediction model used by the estimability determination unit 222.

[0084] The statistics calculation unit 224 calculates a statistic representing the statistical distribution of elements that the estimability determination unit 222 determines cannot be estimated. For example, the statistics calculation unit 224 calculates a statistic representing the statistical distribution of elements in the time series data of an element for which the occurrence rate of frequent patterns is set, and which is assigned a determination value indicating that the interpolation value cannot be estimated. The statistic is, for example, the mean or variance.

[0085] The interpolation data calculation unit 225 unifies the interpolated value estimated by the estimation unit 223 and the statistic calculated by the statistic calculation unit 224 into one, and calculates the time series data in which the estimated value of the interpolated value, the representative value of the estimated value of the interpolated value, or the range of the estimated value of the interpolated value are set as elements. For example, for each time series data in which the occurrence rate of a frequent pattern is set as an element, the interpolation data calculation unit 225 unifies the interpolated value estimated by the estimation unit 223 and the statistic calculated by the statistic calculation unit 224 into one, and calculates the time series data in which the estimated value of the interpolated value, the representative value of the estimated value of the interpolated value, and the range of the estimated value of the interpolated value are set as elements.

[0086] Furthermore, the interpolation data calculation unit 225 calculates representative values ​​or ranges of interpolated values ​​representing the state of the devices constituting the information system as the object of analysis, based on the interpolated values ​​estimated by the estimation unit 223, the statistics calculated by the statistics calculation unit 224, and the definition information representing the classification values. The classification values ​​represent the category to which the values ​​included in the frequent patterns are classified. For example, the average, maximum, and minimum values ​​of the interpolated values ​​are calculated.

[0087] Figure 11 This is a flowchart illustrating the interpolation process for time-series data. Figure 3 The details of step ST2 are as follows: The frequent pattern occurrence rate calculation unit 221 acquires time-series data containing frequent patterns detected by the frequent pattern detection unit 215 as elements, and calculates the occurrence rate of the frequent patterns contained in the time-series data (step ST1c). For example, the frequent pattern occurrence rate calculation unit 221 uses the time-series data containing the identification value of the frequent patterns as elements to calculate the occurrence rate of each frequent pattern near each timestamp.

[0088] Next, the estimability determination unit 222 determines whether it is possible to estimate the interpolation value of an element in a timestamp not included in the time series data of an element whose occurrence rate of a frequent pattern is set to the element (step ST2c). For example, when determining whether it is possible to estimate the interpolation value of an element in a timestamp not included in the time series data of an element whose occurrence rate of a frequent pattern is set to the element, the estimability determination unit 222 assigns a determination value of 0 or 1 to the corresponding part of the time series data, representing the determination result.

[0089] If it is determined that the interpolation value of an element can be estimated (step ST2c: Yes), the estimation unit 223 estimates the interpolation value (step ST3c). For example, the estimation unit 223 estimates the interpolation value of a portion of the time series data that has been assigned a determination value indicating that it can be estimated.

[0090] When it is determined that the interpolation value of an element cannot be estimated (step ST2c: No), the statistics calculation unit 224 calculates a statistic representing the statistical distribution of the element (step ST4c). For example, the statistics calculation unit 224 calculates a statistic representing the statistical distribution of elements in the time series data of the element for which the occurrence rate of frequent patterns is set, and which is assigned a determination value indicating that the interpolation value cannot be estimated. The processes of the estimation unit 223 and the statistics calculation unit 224 are executed independently of each other, so one of them can be processed first, or they can be executed in parallel.

[0091] The interpolation data calculation unit 225 calculates the time series data in which the interpolation value estimated by the estimation unit 223 and the statistic calculated by the statistic calculation unit 224 are unified into one, and sets the interpolation value, representative value of the interpolation value, or range of the interpolation value as elements, and outputs it as the interpolated time series data (step ST5c). Furthermore, the interpolation data calculation unit 225 calculates the representative value or range of the interpolation value representing the state of the equipment constituting the information system as the object of analysis, based on the interpolation value estimated by the estimation unit 223, the statistic calculated by the statistic calculation unit 224, and the definition information representing the classification value. The classification value represents the category to which the value contained in the frequent pattern is classified. The interpolation data calculation unit 225 performs these processes independently; therefore, either process can be performed first, or both can be performed in parallel.

[0092] Figure 12 A is a diagram showing an example of time-series data with strings as elements. Figure 12 B is a graph showing examples of time-series data (1) and time-series data (2) with numerical values ​​set as elements. The frequent pattern analysis unit 21, for example, obtains... Figure 12 A and Figure 12 The time series data shown in B outputs the time series data of the identification values ​​of frequent patterns to the interpolation processing unit 22.

[0093] Figure 12 C is a graph showing an example of the interpolated time series data. For example... Figure 12 As shown in the upper layer of C, the interpolation data calculation unit 225 calculates the representative values ​​of the estimated values ​​of the interpolation values ​​of the occurrence rates of frequent patterns in the time series data A, which sets the occurrence rates of frequent patterns as elements, namely the average value A1, the maximum value A2, and the minimum value A3, and calculates the time series data that sets them as elements.

[0094] like Figure 12As shown in the middle layer of C, the interpolation data calculation unit 225 calculates the representative values ​​of the estimated interpolation values ​​of the elements in the time-series data (1), which are the average (1a), maximum (1b), and minimum (1c) of the elements, representing the state of the equipment constituting the information system as the object of analysis, and calculates them as the time-series data of the elements. Furthermore, as Figure 12 As shown in the lower layer of C, the interpolation data calculation unit 225 calculates the representative values ​​of the estimated interpolation values ​​of the elements in the time series data (2) that represent the state of the equipment constituting the information system as the object of analysis, namely the average value (2a), the maximum value (2b), and the minimum value (2c), and calculates them as the time series data of the elements.

[0095] The frequent patterns detected by the frequent pattern analysis unit 21 are related to phenomena occurring in the information system, which is the object of analysis. Therefore, by focusing on frequent patterns and analyzing the phenomena occurring in the information system, it is possible to efficiently analyze the disruptive phenomena occurring in the information system. Furthermore, by using frequent patterns, the prediction accuracy of the information system's actions is improved. For example, the estimated value of the interpolated value of an element whose timestamp is not included in the time series data may sometimes be equivalent to the value of an element whose future timestamp has been predicted. In this case, the interpolation data calculation unit 225 calculates a representative value or range of the estimated interpolated value, thereby indicating the error range of the predicted value of the element.

[0096] Figure 13 This is a block diagram showing the structure of the retrieval processing unit 23. Figure 13 In this process, the retrieval processing unit 23 includes a frequent pattern selection unit 231 and a retrieval unit 232. The frequent pattern selection unit 231 is a selection unit that selects time-series data from at least one of the following based on importance: time-series data that sets frequent patterns detected by the frequent pattern detection unit 215 as elements, time-series data that sets strings as elements received by the input device 3A, and time-series data that sets values ​​as elements received by the input device 3B.

[0097] In time-series data where the identification value of a frequent pattern is set as an element, importance can be measured, for example, by the deviation of the ratio of the frequency of occurrence of the element in the information system being analyzed to the frequency of occurrence of the same element in the time-series data used during the frequent pattern learning phase, starting from a value of 1. For example, if the ratio is 1.2, the deviation of this ratio from a value of 1 is 1.2 - 1.0 = 0.2.

[0098] Furthermore, for time-series data that sets combinations of items that cannot be classified into frequent patterns as elements, the occurrence count of items that cannot be classified into frequent patterns can be used as importance. Moreover, for time-series data that sets the identification value of frequent patterns that only have a condition set as elements, the confidence level calculated for the corresponding frequent pattern during the learning phase can be used as importance.

[0099] The retrieval unit 232 retrieves the job information corresponding to the time-series data selected by the frequent pattern selection unit 231 from the past job information of phenomena occurring in the information system as the object of analysis, and outputs the retrieved job information. The past job information is information that records the judgments or job content made by the user in the past regarding phenomena occurring in the information system.

[0100] Figure 14 This is a flowchart illustrating the retrieval process of past job information. Figure 3 The details of step ST3 are as follows. The frequent pattern selection unit 231 selects time-series data from at least one of the following based on importance: time-series data with frequent patterns set as elements, time-series data with strings set as elements, and time-series data with values ​​set as elements (step ST1d). For example, the frequent pattern selection unit 231 uses importance to select the portion of the time-series data with frequent patterns set as elements, time-series data with strings set as elements, and time-series data with values ​​set as elements that is intended to prompt the user.

[0101] The retrieval unit 232 retrieves job information from the past job information stored in the storage device 4 that corresponds to the timing data selected by the frequent pattern selection unit 231, and outputs the retrieved job information (step ST2d). For example, the retrieval unit 232 retrieves past job information corresponding to the frequent patterns stored in the storage device 4 based on the same frequent pattern or item combination from the list of frequent pattern identification values, the list of item combinations, or the list of frequent pattern identification values ​​that only the condition unit is met, and outputs the job information of the retrieval result.

[0102] Furthermore, when the frequent patterns or combinations of items other than frequent patterns used by the retrieval unit 232 in the retrieval are used by the user as analytical auxiliary information, the retrieval unit 232 generates job information representing the user's judgment or job content in the job using them, and stores the generated job information in the storage device 4. In addition, the job information stored in the storage device 4 can also be information generated by the user using an input device.

[0103] Figure 15 A is a diagram showing the frequent pattern information stored in storage device 4. Figure 15 B is a diagram illustrating an example of past job information. For example, storage device 4 stores... Figure 15The frequent patterns shown in A and past job information corresponding to the phenomena of those frequent patterns are used as frequent pattern information. After the frequent pattern selection unit 231 selects timing data containing frequent patterns "Pattern1" and "Pattern3", the retrieval unit 232 retrieves past job information stored in the storage device 4 based on the frequent patterns "Pattern1" and "Pattern3". Thus, the information is retrieved from the storage device 4. Figure 15 The job information 232A shown in B is displayed and presented to the user.

[0104] The retrieval unit 232 retrieves the job information stored in the storage device 4 from past job information that corresponds to the timing data selected by the frequent pattern selection unit 231. Therefore, if a situation recurs where a similar situation existed in the past, the user can identify and repair the problem area based on the past job information related to that situation. This reduces work time and also helps to suppress deviations in the accuracy of each person's response.

[0105] The previous description showed time-series data with timestamps as indexes; however, the data analysis device 2 is not limited to this. In general, it can also process string sequence data and numerical sequence data with indices that allow for sequential comparisons within and between sequences.

[0106] For example, the data analysis device 2 uses an index that defines the sequential relationship of pixel positions in image data, obtains sequence data with pixel values ​​(numerical values) determined by the index as elements, and sequence data with descriptive data (strings) consisting of strings assigned to pixels as elements, and performs the aforementioned data analysis on these sequence data. The results of this data analysis can be used for image analysis or interpolation processing of defective pixels.

[0107] Furthermore, even when the timestamps corresponding to the log data of the information system being analyzed and the numerical values ​​representing the state of the devices constituting the information system are replaced with sequential data such as English letters that define the order, the data analysis device 2 can still perform the aforementioned data analysis.

[0108] In the data analysis system 1, the data analysis device 2 and the storage device 4 can also be connected via a communication network.

[0109] Furthermore, when the data analysis processing performed by data analysis device 2 is combined with other analysis processing of common sequence data, the explanatory power of the analysis results is further enhanced. For example, in the case of an anomaly detection device that receives string-based log data from the input information system, data analysis device 2 performs the aforementioned data analysis on the same log data obtained by the anomaly detection device, or other log data or numerical data obtained simultaneously. The data analysis results of data analysis device 2 can serve as analytical aid information for analyzing the causes of phenomena that trigger warnings from the anomaly detection device. For example, by predicting the future frequency of events that cause the anomalies, it is possible to provide information on measures to be studied before information system failures occur.

[0110] In the data analysis device 2 only by Figure 4 In the case of the frequent pattern analysis unit 21 shown, the functions of the string classification unit 211, the numerical classification unit 212, the sequence integration unit 213, the frequent pattern extraction unit 214, and the frequent pattern detection unit 215 in the data analysis device 2 are implemented by the processing circuit. That is, the data analysis device 2 has the function of executing... Figure 8 The processing circuits for steps ST1b to ST3b. The processing circuits can be dedicated hardware or CPUs (Central Processing Units) that execute programs stored in memory.

[0111] Figure 16 A is a block diagram showing the hardware structure that implements the functions of the data analysis device 2. Figure 16 B is a block diagram illustrating the hardware structure of the software that executes the functions of the data analysis device 2. Figure 16 A and Figure 16 In section B, input interface 100 relays timing data output from input devices 3A and 3B to data analysis device 2. Output interface 101, for example, relays timing data output from data analysis device 2 to a device having interpolation processing unit 22.

[0112] In the processing circuit Figure 16In the case of the dedicated hardware processing circuit 102 shown in Figure A, the processing circuit 102 may be, for example, a single circuit, a composite circuit, a programmable processor, a parallel programmable processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The functions of the string classification unit 211, the numerical classification unit 212, the sequence integration unit 213, the frequent pattern extraction unit 214, and the frequent pattern detection unit 215 in the data analysis device 2 can be implemented by different processing circuits, or these functions can be implemented by a single processing circuit.

[0113] In the processing circuit Figure 16 In the case of processor 103 shown in B, the functions of string classification unit 211, numerical classification unit 212, sequence integration unit 213, frequent pattern extraction unit 214, and frequent pattern detection unit 215 in data analysis device 2 are implemented by software, firmware, or a combination of software and firmware. Furthermore, the software or firmware is described as a program and stored in memory 104.

[0114] The processor 103 reads and executes the program stored in the memory 104, thereby realizing the functions of the string classification unit 211, the numerical classification unit 212, the sequence integration unit 213, the frequent pattern extraction unit 214, and the frequent pattern detection unit 215 in the data analysis device 2. For example, the data analysis device 2 has a memory 104 for storing the results of execution by the processor 103. Figure 8 The flowchart shown illustrates the processing procedures for steps ST1b to ST3b. These procedures cause the computer to execute the processing steps or methods performed by the string classification unit 211, the numerical classification unit 212, the sequence integration unit 213, the frequent pattern extraction unit 214, and the frequent pattern detection unit 215. The memory 104 may also be a computer-readable storage medium storing programs for enabling the computer to function as the string classification unit 211, the numerical classification unit 212, the sequence integration unit 213, the frequent pattern extraction unit 214, and the frequent pattern detection unit 215.

[0115] The memory 104 is, for example, non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable Read Only Memory), and EEPROM (Electrically Erasable Programmable Read Only Memory), as well as disks, floppy disks, optical disks, high-density disks, mini disks, DVDs, etc.

[0116] Alternatively, the functions of the string classification unit 211, the numerical classification unit 212, the sequence integration unit 213, the frequent pattern extraction unit 214, and the frequent pattern detection unit 215 in the data analysis device 2 may be partially implemented in dedicated hardware and partially implemented in software or firmware. For example, the string classification unit 211 and the numerical classification unit 212 may be implemented using the processing circuit 102 as dedicated hardware, and the sequence integration unit 213, the frequent pattern extraction unit 214, and the frequent pattern detection unit 215 may be implemented by the processor 103 reading and executing the program stored in the memory 104. In this way, the processing circuit can implement the above functions using hardware, software, firmware, or a combination thereof.

[0117] As described above, the data analysis apparatus 2 of Embodiment 1 includes: a string classification unit 211 and a numerical classification unit 212, which acquire sequence data in which strings related to the information system as the object of analysis are set as elements and sequence data in which numerical values ​​representing the state of the devices constituting the information system are set as elements, classify the elements into classification categories according to each sequence data, and output sequence data in which classification values ​​representing the classification categories are set as elements; a sequence integration unit 213, which unifies the sequence data in which string classification values ​​are set as elements and the sequence data in which numerical classification values ​​are set as elements into a single sequence data; and a frequent pattern detection unit 215, which uses the sequence data unified by the sequence integration unit 213 to detect the occurrence of frequent combinations of elements, i.e., frequent patterns.

[0118] By unifying sequence data containing strings related to the information system being analyzed and sequence data containing values ​​representing the states of the devices constituting the information system into a single sequence data, frequent pattern mining can be performed on the sequence data obtained by supplementing one sequence data with the other. Thus, data analysis device 2 can supplement the data needed for analyzing phenomena occurring in the information system being analyzed.

[0119] The data analysis apparatus 2 in Embodiment 1, based on the frequent pattern analysis unit 21, includes an interpolation processing unit 22. The interpolation processing unit 22 calculates an estimate of the occurrence rate of the frequent patterns and a statistic of the occurrence rate of the frequent patterns based on sequence data in which frequent patterns detected by the frequent pattern analysis unit 21 are set as elements. It then interpolates elements in the sequence data that are not included in the timestamps. Since frequent patterns are related to phenomena occurring in the information system being analyzed, by focusing on frequent patterns and analyzing the phenomena occurring in the information system, it is possible to efficiently analyze disruptive phenomena occurring in the information system. Furthermore, by using frequent patterns, the prediction accuracy of the information system's actions is improved.

[0120] The data analysis apparatus 2 of Embodiment 1 includes a retrieval processing unit 23 based on the frequent pattern analysis unit 21. The retrieval processing unit 23 selects sequence data from at least one of the following: sequence data with frequent patterns detected by the frequent pattern analysis unit 21 as elements, sequence data with strings as elements, and sequence data with numerical values ​​as elements, based on importance. It then retrieves job information corresponding to the selected sequence data from past job information related to phenomena occurring in the information system being analyzed, and outputs the retrieved job information.

[0121] In the event of a recurrence of a similar situation, the user can identify and repair the problem area based on past operational information related to that situation. This reduces operational time and also minimizes deviations in the accuracy of each person's response.

[0122] Furthermore, it is possible to modify or omit any structural element of the implementation method.

[0123] Industrial availability

[0124] The data analysis apparatus of the present invention can be used, for example, to analyze phenomena occurring in information systems.

[0125] Label Explanation

[0126] 1: Data analysis system; 2: Data analysis device; 3A, 3B: Input devices; 4: Storage device; 21: Frequent pattern analysis unit; 22: Interpolation processing unit; 23: Retrieval processing unit; 100: Input interface; 101: Output interface; 102: Processing circuit; 103: Processor; 104: Memory; 211: String classification unit; 212: Numerical classification unit; 213: Sequence integration unit; 214: Frequent pattern extraction unit; 215: Frequent pattern detection unit; 221: Frequent pattern occurrence rate calculation unit; 222: Estimability determination unit; 223: Estimation unit; 224: Statistical calculation unit; 225: Interpolation data calculation unit; 231: Frequent pattern selection unit; 232: Retrieval unit; 232A: Job information.

Claims

1. A data analysis device, characterized in that, The data analysis device has the following features: The classification department acquires sequence data that has an index that enables comparison of the order relationship of elements within and between sequences, sets strings related to the information system as the object of analysis as elements, and sets numerical values ​​representing the state of the devices constituting the information system as elements. It classifies each element of the acquired sequence data into one of a plurality of classification categories and outputs sequence data that sets one of a plurality of classification values ​​as elements, wherein the one of the plurality of classification values ​​represents one of the plurality of classification categories. The unification unit takes as one part the sequence data where the first classification value of the string is set as an element, and as another part the sequence data where the second classification value of the numerical value is set as an element, and unifies the first part and the other part into a single sequence data, wherein the first classification value and the second classification value are classification values ​​among the plurality of classification values; and The detection unit uses the sequence data unified into one by the integration unit to detect the occurrence of frequent combinations of elements, i.e., frequent patterns.

2. The data analysis device according to claim 1, characterized in that, The data analysis device includes an extraction unit that generates transaction data by assigning an index identification value to the set of elements contained in the sequence data unified by the integration unit, and performs frequent pattern mining on the transaction data to extract frequent patterns. The detection unit detects the occurrence of frequent patterns extracted by the extraction unit.

3. The data analysis device according to claim 2, characterized in that, The detection unit detects the occurrence of frequent patterns based on whether there is a set of elements in the transaction data that matches the frequent patterns extracted by the extraction unit.

4. The data analysis device according to claim 1, characterized in that, The data analysis device has an interpolation processing unit that calculates an estimate of the occurrence rate of frequent patterns and a statistic of the occurrence rate of frequent patterns based on sequence data in which frequent patterns detected by the detection unit are set as elements, and interpolates the elements in the index that are not included in the sequence data using the calculated estimate of the occurrence rate of frequent patterns and the statistic of the occurrence rate of frequent patterns.

5. The data analysis device according to claim 2, characterized in that, The data analysis device has an interpolation processing unit that calculates an estimate of the occurrence rate of frequent patterns and a statistic of the occurrence rate of frequent patterns based on sequence data in which frequent patterns detected by the detection unit are set as elements, and interpolates the elements in the index that are not included in the sequence data using the calculated estimate of the occurrence rate of frequent patterns and the statistic of the occurrence rate of frequent patterns.

6. The data analysis device according to claim 3, characterized in that, The data analysis device has an interpolation processing unit that calculates an estimate of the occurrence rate of frequent patterns and a statistic of the occurrence rate of frequent patterns based on sequence data in which frequent patterns detected by the detection unit are set as elements, and interpolates the elements in the index that are not included in the sequence data using the calculated estimate of the occurrence rate of frequent patterns and the statistic of the occurrence rate of frequent patterns.

7. The data analysis apparatus according to any one of claims 1 to 6, characterized in that, The data analysis device has a retrieval processing unit that, based on importance, selects sequence data from at least one of sequence data that sets frequent patterns detected by the detection unit as elements, sequence data that sets strings as elements, and sequence data that sets numerical values ​​as elements, retrieves job information corresponding to the selected sequence data from past job information related to the phenomenon occurring in the information system, and outputs the retrieved job information.

8. The data analysis apparatus according to any one of claims 4 to 6, characterized in that, The interpolation processing unit has: An occurrence rate calculation unit acquires sequence data that sets frequent patterns detected by the detection unit as elements, and calculates the occurrence rate of frequent patterns. Can the determination unit estimate whether it can estimate the interpolation value of the index of the element that is not included in the sequence data of the element, with the occurrence rate of the frequent pattern calculated by the occurrence rate calculation unit set as the occurrence rate of the frequent pattern calculated by the occurrence rate calculation unit; The estimation unit estimates the interpolated values ​​of elements that are determined by the estimability determination unit to be estimable. The statistics calculation unit calculates the statistics of the statistical distribution of elements that are determined by the estimability determination unit to be unestimateable. as well as The interpolation data calculation unit unifies the interpolation value estimated by the estimation unit and the statistic calculated by the statistic calculation unit into one, and calculates the sequence data in which the estimated value of the interpolation value, the representative value of the estimated value of the interpolation value, or the range of the estimated value of the interpolation value is set as an element.

9. The data analysis device according to claim 8, characterized in that, The interpolation data calculation unit calculates a representative value or range of the interpolation value representing the state of the device based on the interpolation value estimated by the estimation unit, the statistics calculated by the statistics calculation unit, and the definition information representing the classification value. The classification value represents the category to which the value contained in the frequent pattern is classified. The device constitutes the information system as the object of analysis.

10. The data analysis device according to claim 7, characterized in that, The retrieval processing unit has: The selection unit selects sequence data from at least one of the sequence data that sets the frequent patterns detected by the detection unit as elements, the sequence data that sets the strings as elements, and the sequence data that sets the values ​​as elements, based on importance. as well as The retrieval unit retrieves job information corresponding to the selected sequence data from past job information related to the phenomena occurring in the information system, and outputs the retrieved job information.

11. A data analysis system, characterized in that, The data analysis system has the data analysis apparatus according to any one of claims 1 to 10.

12. A computer-readable storage medium, the computer having a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein when the processor executes the program, it performs the following processing: The process involves obtaining sequence data with indices that allow for comparison of element order within and between sequences. The sequence data consists of elements representing strings related to the information system being analyzed, and elements representing the states of devices constituting the information system. For each sequence data item, the elements are categorized into one of multiple classification categories. The output sequence data is then set to one of these categories as its element. One of the multiple classification values ​​represents one of the multiple classification categories. Take the sequence data where the first category value of the string is set as an element as one part, and the sequence data where the second category value of the numerical value is set as an element as another part. Combine the first part and the other part into a single sequence data, wherein the first category value and the second category value are category values ​​among the plurality of category values. Using the sequence data unified into a single unit, the occurrence of frequent combinations of elements, i.e., frequent patterns, is detected.

Images