A method for filtering internal and external noise for user interaction logs

Abstract

The application discloses a user interaction log-oriented internal and external noise filtering method, which firstly carries out screening and processing of an event log, and extracts useful column information; secondly, a general template in the form of a natural language text is automatically generated; then, the general log template and an operation line are combined, a Markov state transition graph of different operation types and target element combinations is constructed, and corresponding state transition probabilities are output; finally, internal and external noises are marked out through transition probabilities between nodes, and an event log is marked in detail by using a mean value and a total standard deviation variance adaptive threshold of a normal distribution, so that effective detection of internal and external noises in robot process automation is realized, and the accuracy of task segmentation, routine segmentation and process model generation is optimized.

Description

Technical Field

[0001] This invention belongs to the field of robotic process automation, specifically relating to a method for filtering internal and external noise from user interaction logs. Background Technology

[0002] In the field of Robotic Process Automation (RPA), user interaction event logs record the interactions between users and applications. However, due to the complexity of systems and user behavior in real-world applications, noise is often generated—that is, abnormal or erroneous data that does not conform to expected patterns. This includes both internal noise (repetitive differences within a task, such as unnecessary repetitive operation sequences or abnormal execution orders in a specific routine) and external noise (the diversity of operation types within a task, such as unconventional behaviors like window adjustments, and sudden changes in operation objectives). This complexity makes handling abnormal or erroneous data that conforms to expected patterns challenging when modeling and aligning multiple routines, and it reduces the accuracy of the model, severely impacting the performance and accuracy of the RPA system. Therefore, removing this noise and improving the quality of event logs is crucial for the RPA field.

[0003] User interaction event logs are time-series logs recording interactions between users and applications. Noise-removed logs are of significant value in the RPA field. First, they provide reliable data support for RPA system performance evaluation and optimization. Accurate event logs help developers understand user behavior, identify system bottlenecks, and optimize the system. Second, noise-removed event logs provide a high-quality data foundation for modeling the automated processes of RPA tasks. Precise log data helps system analysts or developers better understand the task execution process and rules, thereby designing and deploying RPA tasks more efficiently. Importantly, accurate event logs are a prerequisite for data mining and intelligent analysis. They provide a clean and reliable dataset for subsequent data analysis, mining, and machine learning, offering a reliable basis for intelligent decision-making in RPA systems.

[0004] Domestic and international researchers have conducted many valuable studies on noise filtering in various fields. Existing robotic process automation methods generally have problems in noise filtering: insufficient classification of noise data, direct removal of noisy entire processes, high algorithm complexity, and imperfect modeling of data dependencies. These problems affect the accuracy and fit of the model.

[0005] Currently, several methods attempt to remove noise from user interaction event logs. Some of these methods rely on rules, pattern matching, or statistical analysis to identify and filter log events that do not conform to specific rules or patterns. However, these methods typically depend on manually defined rules, making them difficult to adapt to the diversity of RPA tasks and unable to handle complex noise conditions. Additionally, some methods utilize machine learning techniques, but these methods usually require large amounts of labeled data and cannot distinguish between internal and external noise, limiting their application in the RPA field. Summary of the Invention

[0006] This invention addresses the shortcomings of existing technologies in single-task repetitive routine scenarios by providing a method for filtering internal and external noise in user interaction logs. It identifies and simulates typical user operations in specific tasks using log templates, introduces a Markov model to analyze the dependencies between events in the logs, and combines this with a normal distribution probability statistical method for overall analysis. This invention provides a more in-depth noise filtering approach, enabling more accurate identification and processing of internal and external noise, improving the quality and usability of event logs, and providing strong support for research and application in the RPA field. It can also improve the accuracy of identifying internal and external noise in event logs in the robotic process automation field.

[0007] A method for filtering internal and external noise in user interaction logs, the method comprising the following steps:

[0008] (1) Collect user interaction event logs containing varying proportions of internal and external noise in single-task repetitive routine scenarios: Log=<a1,b1,c1,y,d1,a2,b2,c2,c2,d2,a3,b3,d3,c3,d3,...,a n ,b n ,c n ,d n >, where y represents an external noise, and the repeated c i Indicates an internal noise, an uncommon b i →d i d i →c i Indicates two internal noise edges;

[0009] (2) Based on (1), clean and filter the event log, including filling blank labels with nan, extracting the operation column used for log template generation, and generating a log set L consisting of multiple execution routines. preprocessed Each procedure α consists of multiple event operation types e i Composition, α=<e1,...,e n >, the α set of all routines is E α ;

[0010] (3) Based on (2), using event operation type as the node and natural language expression habits as the benchmark, design a general log template and merge the log templates S corresponding to operation lines with the same operation type and target element. template Extracting log entries;

[0011] (4) Traverse the event log and generate a direct association graph of operation types based on the behavior following relationship between operation lines;

[0012] (5) Based on (3), the direct association graph of (4) is expanded and weighted using the operation line log template. The same operation type executed on different target elements is split into several different nodes. Directed arcs are used to represent the transition between nodes. The weight value w from each log template node to the next node is calculated by the number of transitions.

[0013] (6) Based on (5), a Markov model is used to simulate the state transitions between log behaviors, and S is calculated according to the node transition weight value w. template ={s1,s2,s3,...,s n The state transition probability p between} ij Output the transition probability matrix The transition probabilities are labeled on the association graph to generate a Markov state transition graph;

[0014] (7) Based on (6), according to the state transition probability, use the mean μ of the normal distribution and the variance σ of the population standard deviation. 2 Determine the minimum noise threshold ξ, mark the operation nodes in the Markov state transition graph generated by (6) where all edges are below the threshold as potential noise behaviors, and add them to the noise candidate list;

[0015] The normal distribution μ and σ 2 The principle uses the basic idea of ​​hypothesis testing, considers the degree of data dispersion, uses variance to capture the distribution characteristics of tail extreme values, and defines the actual possible range of values ​​of the random variable to detect outliers, that is, using μ-σ. 2 Define a minimum threshold ξ, where μ represents the mean and σ 2 This indicates one variance;

[0016] (8) Based on (7), temporarily remove the operation lines of nodes identified as potential noise behavior from the log, calculate the transition probability between the remaining nodes, and if the transition probability between the neighboring nodes of the removed node increases, then the removed node is determined to be real noise; otherwise, the removed node is restored. Repeat steps (4) to (8) to update the noise candidate list until the noise candidate list remains unchanged, at which point all noise is considered to have been identified.

[0017] (9) Output the noise line index array based on (8) and mark the noise operation line of the event log to achieve noise filtering of user interaction event log for single task repetitive routines.

[0018] Preferably, in step (1), the user interaction event log is obtained from the behavior set E = (t, e, a, w, s, u, o) in ascending order of timestamps, where E is the behavior a i b i c i d i The set of ... and external noise y, where t represents timestamp, e represents event type, a represents target application, w represents workbook, s represents worksheet, u represents Uniform Resource Locator (URL), and o represents target element.

[0019] Preferably, in step (2), the method for cleaning and filtering event logs includes processing abnormal timestamps, filling in missing information, and extracting operation columns for generating log templates to ensure the accuracy and integrity of log data.

[0020] Preferably, in step (3), the method for automatically generating operation line log templates includes using a natural language processing algorithm, based on event type e as the main node, merging log templates corresponding to operation lines executing the same event type on the same type of target element, and extracting log behaviors to realize log template S. template = (l, e, o) intelligent generation, where l represents the application comprehensive identifier, e represents the event type, and o represents the target element identifier.

[0021] Preferably, in step (4), the method of traversing the event log includes constructing a direct association graph of operation types according to the timestamp order to ensure the temporal relationship between operation rows and provide a foundation for subsequent Markov model modeling.

[0022] Preferably, in step (5), the method of expanding and weighting the direct association graph using the operation line log template includes defining a node set N = {n1, n2, ..., n}. k}, where n i The model nodes represent combinations of event types and target elements; each node has n nodes. i Includes event type e i and target element o i Considering the uniform operation type performed on different target elements, the target element o i The system splits into multiple distinct nodes. Directed arcs are used to represent transitions between nodes, and a weight value w is calculated from each log template node to the next node based on the number of transitions, to capture more granular operation transition relationships.

[0023] Preferably, step (6) is specifically implemented as the following sub-steps:

[0024] (6.1) Define the set of directed edges E ij ′={(n i n j p ij )}.

[0025] Where n i and n j Let p represent two nodes respectively. ij Indicates from node n i Transfer to node n j The transition probability.

[0026] (6.2) Calculate the transition probabilities between nodes based on the discrete Markov model. The calculation formula is as follows:

[0027] p ij =P(X) n+1 |X n ..., X1) = P(X n+1 =j|X n =i), i=1, 2,…; j=1, 2,…

[0028] Where, p ij ≥0, X n Represents the current state i, X n+1 Let j represent the future state and n be the node. i Transfer to node n j The transition probability p ij It depends only on the current state i, and is not affected by X. n-1 The influence of past states such as ..., X0. The weight of the directed edges between nodes represents the number of node transitions w. ij For each state i, the total number of transitions is D. i =∑ i w ij D i Let the total weight of all directed edges originating from state i be represented, then the transition probabilities between states can be calculated. The transition probability matrix that constitutes a Markov chain

[0029] (6.3) Consider a Markov chain X = {X0, X1, ..., X...} n The probability distribution of state n is denoted as} Where π(n) = Pπ(X) n=i), i = 1, 2, ... A Markov chain starts with an initial state distribution π(0). The distribution in state n can be determined by the distribution in state n-1 and its transition probability distribution, i.e., π(n) = Pπ(n-1). Recursively, π(n) = P n π(0), where P n The transition probability in n steps According to the Chapman-Kolmogorov equation The transition probability of n steps can be determined as P(n) = P(1)P(n-1) = PPP(n-1) = P n The transition probabilities are plotted on the correlation graph to generate a Markov state transition diagram, which comprehensively considers the probability distribution of internal and external noise, providing a foundation for subsequent noise detection.

[0030] Preferably, in step (7), the method for determining the minimum threshold of internal and external noise includes using the mean μ of a normal distribution and the variance σ of the population standard deviation based on the transition probability matrix. 2 Calculate and set an appropriate threshold ξ, and add noisy nodes in the direct association graph to the noise candidate list. If node n i If the mutual transition probability of node n and its neighboring nodes is all less than the threshold ξ, then it is considered an external noise node; if node n i If a node is self-referential (self-loop) and the transition probability of its self-referential edge is less than the threshold ξ, then it represents an internal noise node; if node n i to n j If the transition probability of edge E is less than the threshold ξ, then edge E ij ′ represents the internal noise edge, thus visually representing the degree of internal and external noise.

[0031] Preferably, in step (8), the method for iteratively updating the noise candidate list includes temporarily removing the operation lines of nodes identified as potential noise behavior from the log, updating the graph structure information, calculating the transition probability between the remaining nodes, and determining that the removed node is real noise if the transition probability between the neighboring nodes of the removed node increases; otherwise, restoring the removed node. Steps (4) to (8) are repeated, and noise nodes are re-judged according to the new threshold, and the noise candidate list is updated until the candidate list remains unchanged, at which point it can be considered that all noise has been identified.

[0032] Preferably, in step (9), the method for annotating noisy operation lines in the event log includes comparing the color markings of operation nodes with the lowest threshold ξ of internal and external noise, statistically analyzing the indexes of operation nodes below the threshold, outputting an index array, and annotating the operation lines in the event log to achieve noise filtering of user interaction event logs for repetitive single-task routines, ensuring the accuracy and reliability of data analysis.

[0033] Beneficial effects of the present invention

[0034] This invention combines log templates to extract key log information, more accurately describing the similarity of user behavior. It can effectively compress the situation where the number of rows of data operations is too large in a single task repetitive routine scenario, and provides a feasible solution to the problem of time-consuming graph generation. This invention uses the state transition probability of the Markov model to determine the similarity and correlation between various event log templates. By comprehensively considering multi-dimensional information, the combination of the two can better identify internal and external noise. Attached Figure Description

[0035] Figure 1 Flowchart of the method of this invention. Detailed Implementation

[0036] To make the technical solutions of the embodiments of the present invention clearer, the present invention will be described in detail below with reference to the accompanying drawings.

[0037] Example 1 Figure 1 As shown.

[0038] This embodiment describes a method for filtering internal and external noise from user interaction logs, which includes the following steps:

[0039] (1) Collect user interaction event logs containing varying proportions of internal and external noise in single-task repetitive routine scenarios. <a1,b1,c1,y,d1,a2,b2,c2,c2,d2,a3,b3,d3,c3,d3,...,a n b n c n d n As shown in Table 1, the user interaction event log is obtained by sorting the behavior set E = (t, e, a, w, s, u, o) in ascending order of timestamps, where E represents behavior a. i b i c i d i The set of ... and external noise y, where t represents timestamp, e represents event type, a represents target application, w represents workbook, s represents worksheet, u represents Uniform Resource Locator (URL), and o represents target element.

[0040] Table 1. Collection of User Interaction Event Log Behaviors (Partial)

[0041]

[0042]

[0043] (2) Based on (1), clean and filter the event log, including the following sub-steps:

[0044] (2.1) Considering that abnormal timestamps may lead to inaccuracy in data analysis, abnormal timestamps in the event log are identified and corrected to ensure the continuity and consistency of the time series.

[0045] (2.2) In the event log, some operations may lack key information, such as missing target element identifiers or event types, or the operation may not require relevant information in certain columns. To ensure data integrity and the efficient operation of subsequent processing algorithms, NaN values ​​are used to fill in these missing information.

[0046] (2.3) During the data cleaning and filtering process, it is necessary to extract key operation columns for log template generation. These operation columns include information such as event type, target application, workbook, worksheet, URL, and target element, ultimately generating a log set L consisting of multiple execution routines. preprocessed Each procedure consists of multiple event operation types. i Composition, α = <e1,...,e n The α set of all routines is E. α This key information allows us to establish user behavior patterns, providing strong support for subsequent analysis.

[0047] (3) Based on (2), define a general log template generation function `generate_log_template`, using event operation type `e` as the main node to generate intelligent log templates. This function accepts event log data and an object collection as input parameters, and performs the following steps internally:

[0048] (3.1) Initialize the log_template variable to an empty string to store the generated log template.

[0049] (3.2) Use the custom extract_letters function to match and extract the letter parts of the target elements through regular expressions and merge them into a unit. For example, the indexes of the target elements in the table A1, A2, ... are all extracted as A to represent multiple routine executions of the same task.

[0050] (3.3) Use a function to determine whether the current event type e already exists in the object collection. If it does not exist, it means that it is a new event type and add it to the object collection.

[0051] (3.4) Obtain the index of all event logs with the same event type, and check if these event logs match other attributes (workbook, worksheet, URL, and target element, etc.) of the current event log. If no match is found, it indicates a new operation, such as "copyCell+Excel+A" not matching "copyCell+Excel+B", and a new operation line will be generated. Update the object collection and construct the corresponding operation line log template in natural language form, such as "CopyCell A in line 1, Excel:reimbursement.xlsx:Student details.", which includes application information, operation type, and target element identifier, aiming to provide a more meaningful description of the event operation, and implements the log template S. template The template intelligently generates a matrix (l, e, o), where l represents the application's overall identifier, e represents the event type, and o represents the target element identifier. This universal template can recognize interaction logs with different structures and generate a unified natural language text format for subsequent analysis and understanding.

[0052] (4) To analyze the relationships between user actions and better understand user interaction patterns in the application, a direct association graph is used for analysis. The event log is traversed, and a direct association graph of operation types is generated based on the behavior following relationship between operation lines. Different operation types are mapped to graph nodes, with each node representing an independent operation, such as "copyCell" and "paste". Edges are used to represent the association relationship between operation types.

[0053] (5) Based on (3), the direct association graph of (4) is expanded and weighted using the operation line log template. For each operation line in the log template, it is split into different nodes, which contain information such as operation type and target element. Define the node set N = {n1, n2, ..., n}. k}, where n i The model nodes represent combinations of event types and target elements; each node has n nodes. i Includes event type e i and target element o i Considering the uniform operation type performed on different target elements, it is split into multiple different nodes. Directed arcs are used to represent the transitions between nodes, and the weight value w from each log template node to the next node is calculated based on the number of transitions to capture more granular operation transition relationships.

[0054] (6) On the direct association graph after expansion and weight calculation, a Markov model is used to describe the transition behavior of the operation and calculate the state S. template ={s1, s2, s3, ..., sn The state transition probability p between} ij Output the transition probability matrix Includes the following sub-steps:

[0055] (6.1) Define the set of directed edges E ij ′={(n i n j p ij )}.

[0056] Where n i and n j Let p represent two nodes respectively. ij Indicates from node n i Transfer to node n j The transition probability.

[0057] (6.2) Calculate the transition probabilities between nodes based on the discrete Markov model. The calculation formula is as follows:

[0058] p ij =P(X) n+1 |X n ..., X1) = P(X n+1 =j|X n =i), i=1, 2,…; j=1, 2,…

[0059] Where, p ij ≥0, X n Represents the current state i, X n+1 Let j represent the future state and n be the node. i Transfer to node n j The transition probability p ij It depends only on the current state i, and is not affected by X. n-1 The influence of past states such as ..., X0. The weight of the directed edges between nodes represents the number of node transitions w. ij For each state i, the total number of transitions is D. i =∑ j w ij D i Let the total weight of all directed edges originating from state i be represented, then the transition probabilities between states can be calculated. The transition probability matrix that constitutes a Markov chain

[0060] (6.3) Consider a Markov chain X = {X0, X1, ..., X...} n The probability distribution of state n is denoted as} Where π(n) = Pπ(X) n=i), i = 1, 2, ... A Markov chain starts with an initial state distribution π(0). The distribution in state n can be determined by the distribution in state n-1 and its transition probability distribution, i.e., π(n) = Pπ(n-1). Recursively, π(n) = P n π(0), where P n The transition probability in n steps According to the Chapman-Kolmogorov equation The transition probability of n steps can be determined as P(n) = P(1)P(n-1) = PPP(n-1) = P n Taking into account the probability distribution of both internal and external noise provides a basis for subsequent noise detection.

[0061] (7) Based on the transition probability matrix, use the mean μ of the normal distribution and the variance σ of the population standard deviation. 2 Calculate and set an appropriate threshold ξ, and add noisy nodes in the direct association graph to the noise candidate list.

[0062] (7.1) Wherein, the normal distribution is determined by the mean μ and the standard deviation σ, and the probability density function is expressed as:

[0063]

[0064] (7.2) Based on the diversity and random distribution characteristics of noise data, using the basic idea of ​​hypothesis testing, considering the degree of data dispersion, using variance to capture the distribution characteristics of tail extreme values, defining the actual possible range of values ​​for the random variable, and using the mean μ minus one time the variance σ 2 Define the minimum threshold ξ.

[0065] (7.3) If node n i If the mutual transition probability of node n and its neighboring nodes is less than the threshold ξ, then the node is marked in red, indicating an external noise node; if node n i If a node is self-referential (self-loop) and the transition probability of its self-referential edge is less than the threshold ξ, then the node is marked in yellow to indicate an internal noise node; if node n i to n j If the transition probability is less than the threshold ξ, then edge E will be... ij The yellow '' mark indicates an internal noise edge, thus visually representing the degree of internal and external noise.

[0066] (8) Temporarily remove the operation lines of nodes identified as potential noise behavior from the log, update the graph structure information, calculate the transition probability between the remaining nodes, and if the transition probability between the neighboring nodes of the removed node increases, then the removed node is determined to be real noise. Repeat steps (4) to (8), re-judge the noise nodes according to the new threshold, update the noise candidate list, until the candidate list remains unchanged, then all noise can be considered to have been identified.

[0067] (9) After obtaining the graphical noise annotation, the noise lines in the event log need to be annotated to achieve noise filtering of user interaction event logs for repetitive single-task routines. This includes comparing the color annotation of operation nodes with the lowest threshold ξ of internal and external noise, statistically analyzing the indexes of operation nodes below the threshold, outputting the index array, and annotating the operation lines in the event log to achieve noise filtering of user interaction event logs for repetitive single-task routines, ensuring the accuracy and reliability of data analysis.

[0068] Examples 1-3 illustrate in detail the specific process of using the noise filtering method of the present invention to perform internal and external noise filtering on user interaction logs executed in a single task with multiple routines:

[0069] Example 1: Log routine

[0070] 1) Take them out one by one The unique event 'abcdy' is added to the object collection event_type_obj, and the corresponding log template S is generated. template = (u, e, o);

[0071] 2) Extract log template information into the event_nodes dictionary, which contains the index value of the template operation line, i.e., event_nodes = [0: {a_type, a_app, a_id}, 1: {b_type, b_app, b_id}, 2: {c_type, c_app, c_id}, 3: {d_type, d_app, d_id}, 6: {y_type, y_app, y_id}];

[0072] 3) Traverse the routine trajectory again. If the operation row index value matches the corresponding operation row index value in the event_nodes dictionary, generate event node n. Otherwise, find the corresponding event node n and add the current operation row index value to the index list stored in event node n.

[0073] 4) During the traversal, add edges to event node n to represent the transition from the previous event to the current event, generating the Markov transition graph structure.

[0074] 5) Calculate the initial transition probability matrix of the nodes. Calculate the 5-step transition probability matrix The mean μ = 0.2 was obtained, and σ 2 =0.13757, ξ = μ - σ 2 =0.06243;

[0075] 6) The initial transition probability is less than the ξ threshold and in the graph structure The actual edges in the graph are {b, y}, and the number of transitions of edge {y, c} is 0.05 of the maximum weight of the graph structure, which is also less than the threshold ξ. Therefore, node y is temporarily removed from the graph structure (its adjacent edge weight is set to 0), and steps 3-5 are repeated. The threshold ξ = 0.0256 is calculated. There is no other new noise. {b, y} is determined to be the real noise edge, and node y is external noise. It is added to the noise candidate list.

[0076] Example 2: Log Routine

[0077] 1) Take them out one by one The unique event "abcd" is added to the object collection "event_type_obj" and the corresponding log template "S" is generated. template = (u, e, o);

[0078] 2) Extract log template information into the event_nodes dictionary, which contains the index value of the template operation line, i.e., event_nodes = [0: {a_type, a_app, σ_id}, 1: {b_type, b_app, b_id}, 2: {c_type, c_app, c_id}, 3: {d_type, d_app, d_id}];

[0079] 3) Traverse the routine trajectory again. If the operation row index value matches the corresponding operation row index value in the event_nodes dictionary, generate event node n. Otherwise, find the corresponding event node n and add the current operation row index value to the index list stored in event node n.

[0080] 4) During the traversal, add edges to event node n to represent the transition from the previous event to the current event, generating the Markov transition graph structure.

[0081] 5) Calculate the initial transition probability matrix of the nodes. Calculate the 4-step transition probability matrix The mean μ = 0.25 was obtained, and σ 2 =0.16479, ξ = μ - σ 2 =0.08521.

[0082] 6) The initial transition probability is less than the ξ threshold and in the graph structure The actual edges in the graph are {c, c}, and node c is a self-referential node. Therefore, node c is temporarily removed from the graph structure (its adjacent edge weights are set to 0), and steps 3-5 are repeated. The threshold ξ = 0.0625 is calculated. There is no other new noise. {c, c} is determined to be a real noise edge, and node c is internal noise. It is then added to the noise candidate list.

[0083] Example 3: Log Routine

[0084] 1) Take them out one by one The unique event "abcd" is added to the object collection "event_type_obj" and the corresponding log template "S" is generated. template = (u, e, o);

[0085] 2) Extract log template information into the event_nodes dictionary, which contains the index value of the template operation line, i.e., event_nodes = [0: {a_type, a_app, a_id}, 1: {b_type, b_app, b_id}, 2: {c_type, c_app, c_id}, 3: {d_type, d_app, d_id}];

[0086] 3) Traverse the routine trajectory again. If the operation row index value matches the corresponding operation row index value in the event_nodes dictionary, generate event node n. Otherwise, find the corresponding event node n and add the current operation row index value to the index list stored in event node n.

[0087] 4) During the traversal, add edges to event node n to represent the transition from the previous event to the current event, generating the Markov transition graph structure.

[0088] 5) Calculate the initial transition probability matrix of the nodes. Calculate the 4-step transition probability matrix The mean μ was obtained as 0.24951, and σ was... 2 =0.14301, ξ = μ - σ 2 =0.05.

[0089] 6) The initial transition probability is less than the ξ threshold and in the graph structure The actual edges in the graph are [{b, d}, {d, c}], and the number of transitions of the other transition edges of nodes b, d, and c accounts for 0.95 of the maximum weight of the graph structure. Therefore, only the edge [{b, d}, {d, c}] is temporarily removed from the graph structure (the edge weight is set to 0), and steps 3-5 are repeated. The threshold ξ is calculated to be 0.0625. There is no other new noise, so [{b, d}, {d, c}] is determined to be a real internal noise edge. There are no noise nodes, so the edge is added to the noise candidate list.

[0090] The above description of the embodiments is based on multiple manual event logs. There are two original log files, divided into three groups: internal noise, external noise, and mixed noise, with the noise proportion in each group increasing from 0.1% to 2%. The log characteristics are shown in Table 2. Original log file 1 records the following scenario: a user opens the reimbursement.xlsx file, retrieves student information from different sheets, copies and pastes it into the corresponding form on the webpage https: / / form.jotform.com / 200477494954062, and submits the application. Original log file 2 records the following scenario: a user opens the StudentRecords.xlsx file, retrieves student grade information from a single sheet, copies and pastes it into the corresponding form on the webpage https: / / forms.zoho.com / universityofmelbourne / form / NewRecord, and submits the application. These logs simulate real-world scenarios. The manual event logs are extensions of the original log files, including the addition of external noise and internal repetitive noise, as well as the corresponding mixed noise interleaving.

[0091] Table 2 Characteristics of User Interaction Event Logs

[0092]

[0093]

[0094] The above embodiments are preferred embodiments of the present invention and are not intended to limit the invention. Those skilled in the art can make modifications to the above embodiments without departing from the spirit and scope of the invention. Therefore, all improvements made to the present invention should be within the protection scope of the present invention.

Claims

1. A method for filtering internal and external noise in user interaction logs, characterized in that, Includes the following steps: (1) Collect user interaction event logs containing different proportions of internal and external noise in single-task repetitive routine scenarios, and clean and filter the event logs. (2) Design a general log template based on event operation type, and merge the log templates corresponding to operation lines with the same operation type and target element. The process of extracting log data is as follows: Using natural language processing algorithms, based on event type For nodes, merge log templates corresponding to operation lines of the same event type executed on the same target element, and extract the log behavior to implement log templates. Intelligent generation, in which Indicates the overall identifier of the application. Indicates the event type, Indicates the target element identifier; (3) Traverse the event log and generate a direct association graph of operation types based on the behavior following relationship between operation lines; (4) Expand and weight the direct association graph using the operation line log template. calculate; (5) Simulate the state transitions between log behaviors using a Markov model, based on the weights of node transitions. calculate The state transition probabilities between them are calculated, and a Markov state transition graph is generated. (6) Based on the state transition probability, use the mean of the normal distribution. variance of population standard deviation Determine the minimum noise threshold Operation nodes in the Markov state transition graph where all edges are below a threshold are marked as potential noisy behaviors and added to the noise candidate list. The specific process is as follows: Use the mean of the normal distribution variance of population standard deviation Calculate and set the threshold , that is, use Define minimum threshold Noisy nodes in the direct association graph that has been modeled with Markov are added to the noise candidate list. If node The mutual transition probability of its neighboring nodes is less than the threshold. If the node is an external noise node; if the node is an external noise node. It is self-referential, and the transition probability of a self-referential edge is less than a threshold. If the node is an internal noise node; if the node is an internal noise node. arrive The transition probability is less than the threshold Then the edge Indicates an internal noise edge; (7) Temporarily remove the operation lines of nodes identified as potential noise behavior from the log, calculate the transition probability between the remaining nodes, and if the transition probability between the neighboring nodes of the removed node increases, then the removed node is determined to be real noise; otherwise, the removed node is restored. Repeat steps (3) to (7) to update the noise candidate list until the noise candidate list remains unchanged, then all noise will be identified. (8) Output the noise line index array to mark the noise operation lines of the event log, and realize noise filtering of user interaction event logs for single-task repetitive routines.

2. The method for filtering internal and external noise in user interaction logs according to claim 1, characterized in that, In step (1), the user interaction event log Specifically: ,in Indicates an external noise, repetitive Indicates an internal noise. Indicates two internal noise edges; The user interaction event log consists of a set of behaviors. Obtained in ascending order of timestamps, among which For behavior , , , ...and external noise The set, Represents a timestamp. Indicates the event type, Indicates the target application. Indicates workbook, Represents a worksheet. Uniform Resource Locator , Indicates the target element.

3. The method for filtering internal and external noise in user interaction logs according to claim 2, characterized in that, In step (1), the cleaning and filtering of the event logs includes filling in blank labels. Extract the operation columns used for log template generation to generate a log set consisting of multiple execution routines. Each regulation procedure Multiple event operation types composition, All routines The set is .

4. The method for filtering internal and external noise in user interaction logs according to claim 3, characterized in that, Step (4) specifically involves defining a set of nodes. ,in Each model node represents a combination of event type and target element. Includes event types and target element , target element It splits into multiple different nodes; Directed arcs are used to represent the transitions between nodes, and the weight value from each log template node to the next node is calculated based on the number of transitions. .

5. The method for filtering internal and external noise in user interaction logs according to claim 4, characterized in that, The specific process of step (5) is as follows: (5.1) Define the set of directed edges ,in and These represent two nodes respectively. Indicates from node Transfer to node The transition probability; (5.2) The transition probabilities between nodes are calculated based on the discrete Markov model. The calculation formula is as follows: ； in, , , Indicates the current state , Representing future state ,node Transfer to node transition probability Depends only on the current state , and not affected The influence of these past states; the weights of directed edges between nodes represent the number of node transitions. For each state The total number of its transfers is , Indicates from state Calculate the transition probabilities between states by using the total weight of all directed edges that originate from the starting point. The transition probability matrix that constitutes the Markov chain ; (5.3) Consider Markov chains In state The probability distribution is denoted as ,in Markov chains are distributed from initial states. At the beginning, in the state The distribution is determined by the state The distribution of and its transition probability distribution are determined, i.e. Recursion yields ,in for Step transition probability ,according to equation Sure Step transition probability The transition probabilities are marked on the association graph to generate a Markov state transition graph.

Images