Data processing system, management device and data processing method

Abstract

To provide a technique that improves the accuracy of the calculated device abnormality degree and allows a user to accurately grasp the abnormality degree by numerical values.SOLUTION: A data processing system comprises: a communication device connected to one or more devices for data communication; and a management device connected to the communication device so as be able to perform data communication and analyzing information obtained from the communication device. The communication device has an information obtaining unit which obtains information including an operation log of the connected devices and / or an operation log of the communication device and transmits the information to the management device. The management device includes: a classification unit which classifies at least one of the devices or the communication device based on the information received from the communication device; and a statistical processing unit which compares the operation log of the devices or the operation log of the communication device with an operation log of other devices and / or communication device classified into the same group as the devices or the communication device based on a classification result of the classification unit, and outputs a comparison result.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a technology for processing data in a system including a communication device connected to one or more devices so as to be capable of data communication, and a management device connected to the communication device so as to be capable of data communication and which analyzes information obtained from the communication device. [Background technology]

[0002] In recent years, the industrial sector has been introducing the Industrial IoT (Internet of Things) with the aim of improving equipment operation rates and understanding equipment status from remote locations. With the Industrial IoT, data acquired from industrial equipment is collected on a server via wireless communication, and the data is referenced and utilized on the server side, which is useful for detecting signs of equipment failure and monitoring its status.

[0003] Generally, industrial equipment does not have communication functions, so communication devices with communication functions are often connected to the industrial equipment. In this usage, the communication device acquires data such as operation information from the industrial equipment via a specified communication standard such as RS232 or RS485, and periodically transmits the acquired data to a server. The server refers to the acquired data to understand the operating status of the industrial equipment and detect the occurrence of any faults.

[0004] In this application, there are cases where simple threshold detection of acquired data is not sufficient for system failure detection. For example, it is not possible to set a threshold in advance to detect abnormal operation within the guaranteed operating range of individual devices, such as a sudden increase in communication volume or a drop in power supply voltage. For this reason, a method has been proposed to calculate the degree of anomaly in the system by learning from past data. In learning from past data, a method has been proposed to improve the accuracy and efficiency of anomaly calculation by adding preprocessing to the past data to improve accuracy.

[0005] For example, there is a technology that generates multiple feature vectors based on multiple acquired log data and calculates the degree of anomaly based on the distance between the multiple generated feature vectors (see Patent Document 1). This technology divides the huge amount of acquired data by time, calculates features such as maximum, minimum, and average for each data type, and generates a high-dimensional vector. Unimportant elements are removed by compressing the dimensions of this vector, and then the distance to the vector generated from the abnormal data is calculated using a similar procedure. The detection accuracy is improved by grouping the acquired data based on time and performing preprocessing, namely conversion to feature vectors.

[0006] Also, for example, there is a technology that divides a set of data measured in a geographical space into multiple groups representing multiple predetermined partial geographical spaces, and determines whether or not any group contains anomalous data by using the feature amount calculated for each group (Patent Document 2). This technology aims to improve the efficiency of anomaly detection by grouping the acquired data based on location information and performing preprocessing, which is the calculation of feature amounts. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Patent Publication No. 2022-115745 [Patent Document 2] International Publication No. 2021 / 048989 Summary of the Invention [Problem to be solved by the invention]

[0008] In order to calculate the degree of anomaly in an industrial system, the accuracy of the calculated degree of anomaly must be reduced if equipment with similar degrees of deterioration is not compared. In particular, a reliable degree of anomaly is required for users of the equipment to objectively measure the degree of anomaly of the equipment they use.

[0009] In the technology described in Patent Document 1, acquired logs are grouped by time, but if data acquired within the same time period from devices with different degrees of deterioration are mixed, the same type of log may show different behavior. As a result, data that originally belong to separate distributions with different means and standard deviations are grouped together to calculate the feature vector, which reduces the accuracy of the calculated degree of anomaly.

[0010] In the technology described in Patent Document 2, acquired logs are grouped based on location information, but even if the groups are divided within a geographical space, devices with different degrees of deterioration do not necessarily belong to the same group. In addition, groups representing multiple predetermined geographical spaces cannot be applied to devices whose shipping destinations cannot be specified and whose locations cannot be determined.

[0011] For the above reasons, existing technology does not realize grouping of devices with similar degrees of deterioration, and as a result, the accuracy of the calculated degree of anomaly and the presence or absence of anomaly decreases. One possible use of the degree of anomaly is to grasp the status of owned devices. A numerical value of the degree of anomaly is necessary for users to objectively measure the degree of anomaly of the devices they use, but if this issue is left unresolved, it will be impossible to obtain reliable accuracy for the degree of anomaly.

[0012] The present invention has been made in consideration of the above-mentioned problems, and aims to provide a technology that improves the accuracy of calculated device anomaly levels and enables users to accurately grasp the anomaly level through numerical values. [Means for solving the problem]

[0013] The system according to the present invention is a data processing system comprising a communication device connected to one or more devices so as to be able to communicate data with them, and a management device connected to the communication device so as to be able to communicate data with them and which analyzes information acquired from the communication device, wherein the communication device has an information acquisition unit which acquires information including operation logs of the connected devices and / or operation logs of the communication devices and transmits the information to the management device, and the management device has a classification unit which classifies at least one of the devices or the communication devices based on the information received from the communication devices, and a statistical processing unit which compares the operation log of the device or the operation log of the communication device with the operation logs of other devices and / or communication devices classified in the same group as the device or the communication device based on the classification result of the classification unit, and outputs the comparison result.

[0014] Other problems and solutions disclosed in the present application will be made clear in the section of the description of the invention and the drawings. Effect of the Invention

[0015] According to the present invention, the accuracy of the calculated device anomaly degree is improved, and the user can accurately grasp the anomaly degree through a numerical value. [Brief description of the drawings]

[0016] [Figure 1] 1 is a diagram illustrating an example of a configuration of an entire system including a data processing system according to a first embodiment. [Diagram 2] FIG. 2 illustrates an example of a hardware configuration of a communication device according to a first embodiment. [Diagram 3] 11 is a flowchart illustrating an example of the flow of an information acquisition process executed by an information acquisition unit of the communication device in the first embodiment. [Figure 4] FIG. 2 illustrates an example of a hardware configuration of a management apparatus according to a first embodiment. [Diagram 5] FIG. 11 is a diagram illustrating an example of a configuration of reception log data in the first embodiment. [Figure 6] FIG. 11 is a diagram illustrating an example of a GUI of a device list display screen in the first embodiment. [Figure 7] FIG. 11 is a diagram showing an example of a GUI of a comparison setting screen in the first embodiment. [Figure 8] FIG. 13 is a diagram showing an example of a GUI of a comparison result display screen in the first embodiment. [Figure 9] 11 is a sequence diagram showing an example of the flow of a GUI generation process for a comparison result display screen executed by the management device in the first embodiment. FIG. [Figure 10] FIG. 11 is a diagram illustrating an example of a configuration of comparison setting data in the first embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of a configuration of classification result response data in the first embodiment. [Figure 12] 11 is a flowchart showing an example of the flow of a classification process executed by a classification unit of the management device in the first embodiment. [Figure 13] 11 is a flowchart showing an example of the flow of a comparison process executed by a statistical processing unit of the management device in the first embodiment. [Figure 14] FIG. 11 illustrates an example of a hardware configuration of a communication device according to a second embodiment. [Figure 15] FIG. 11 is a diagram illustrating an example of a configuration of reception log data of a management device in the second embodiment. [Figure 16] FIG. 13 is a diagram showing an example of a GUI of a screen displaying a comparison result of a plurality of types of data in the third embodiment. [Figure 17] 13 is a flowchart showing an example of the flow of a multiple-type data comparison process executed by a statistical processing unit of a management device in a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] In the following description, an "interface unit" may refer to one or more interface devices. The one or more interface devices may be at least one of the following: One or more I / O (Input / Output) interface devices. The I / O (Input / Output) interface devices are interface devices to at least one of the I / O devices and a remote display computer. The I / O interface device to the display computer may be a communications interface device. The at least one I / O device may be a user interface device, e.g., either an input device such as a keyboard and pointing device, or an output device such as a display device. One or more communication interface devices. The one or more communication interface devices may be one or more homogeneous communication interface devices (e.g., one or more NICs (Network Interface Cards)) or two or more heterogeneous communication interface devices (e.g., a NIC and an HBA (Host Bus Adapter)).

[0018] In the following description, a "memory" refers to one or more memory devices, which are an example of one or more storage devices, and may typically be a primary storage device. At least one memory device in the memory may be a volatile memory device or a non-volatile memory device.

[0019] In the following description, a "persistent storage device" may be one or more persistent storage devices, which are an example of one or more persistent storage devices. A persistent storage device may typically be a non-volatile storage device (e.g., an auxiliary storage device), and more specifically, may be, for example, a hard disk drive (HDD), a solid state drive (SSD), a non-volatile memory express (NVME) drive, or a storage class memory (SCM).

[0020] Also, in the following description, "storage device" may be at least memory, including memory and persistent storage device.

[0021] Furthermore, in the following description, a "processor" may be one or more processor devices. The at least one processor device may typically be a microprocessor device such as a CPU (Central Processing Unit), but may also be other types of processor devices such as a GPU (Graphics Processing Unit). The at least one processor device may be a single-core or multi-core. The at least one processor device may be a processor core. The at least one processor device may also be a broader processor device such as a circuit that is a collection of gate arrays written in a hardware description language that performs part or all of the processing (e.g., an FPGA (Field-Programmable Gate Array), a CPLD (Complex Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit)).

[0022] In the following description, functions may be described using the expression "yyy unit", but the functions may be realized by one or more computer programs being executed by a processor, or by one or more hardware circuits (e.g., FPGA or ASIC), or by a combination thereof. When a function is realized by a program being executed by a processor, the function may be at least a part of the processor, since the specified processing is performed using a storage device and / or an interface device as appropriate. Processing described with a function as the subject may be processing performed by a processor or a device having the processor. A program may be installed from a program source. The program source may be, for example, a program distribution computer or a computer-readable recording medium (e.g., a non-transitory recording medium). The description of each function is an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0023] In the following description, a process may be described with a "program" as the subject, but the process described with a program as the subject may be a process performed by a processor or a device having the processor. Two or more programs may be realized as one program, and one program may be realized as two or more programs.

[0024] In the following description, information that provides an output for an input may be described using expressions such as "xxx table," but the information may be a table of any structure, or may be a neural network that generates an output for an input, or a learning model such as a genetic algorithm or random forest. Therefore, the "xxx table" may be referred to as "xxx information." In the following description, the structure of each table is an example, and one table may be divided into two or more tables, or all or part of two or more tables may be one table.

[0025] Furthermore, in the following description, a "data processing system" may be a system composed of one or more physical computers, or may be a system (e.g., a cloud computing system) realized on a group of physical computing resources (e.g., a cloud infrastructure). When a data processing system "displays" display information, it may mean displaying the display information on a display device possessed by the computer, or the computer may transmit the display information to a display computer (in the latter case, the display information is displayed by the display computer).

[0026] Various embodiments will now be described in detail with reference to the drawings.

[0027] In the following description, the same or similar components will be denoted by common reference symbols, and redundant description may be omitted.

[0028] In addition, when there are multiple elements having the same or similar functions, the multiple elements may be described by using the same reference numerals with different subscripts in order to distinguish between them. On the other hand, when there is no need to distinguish between the multiple elements, the subscripts may be omitted. EXAMPLES

[0029] (Example of the overall system configuration) FIG. 1 is a diagram illustrating an example of the overall configuration of a system including a data processing system 1 according to a first embodiment.

[0030] The data processing system 1 includes communication devices 110a, 110b, 110c,..., 110n (hereinafter collectively referred to as "communication devices 110" when referring to them collectively or when no distinction is made) connected to one or more connected devices 100 (hereinafter simply referred to as "devices 100") so as to be capable of data communication, and a management device 140 connected to the communication devices 110 via a network 120 so as to be capable of data communication and which analyzes information obtained from the communication devices 110.

[0031] The connection device 100 is an industrial device or an information device. For example, a server, an air compressor, an inverter, etc. correspond to the connection device 100. In this embodiment, it is assumed that sensors that output temperature, humidity, etc. are installed instead of the connection device 100. The connection device 100 is connected to the communication device 110 via an IP network or an industrial network. Operation information 101 and setting information 102, which are data that can be acquired from the connection device 100, are acquired by the communication device 110 as information that complies with a communication standard such as Modbus.

[0032] The communication device 110 is a device that acquires data from the connection device 100 or the communication device 110 itself, and transmits the data to the management device 140 via the network 120. A plurality of communication devices 110 are connected to the management device 140 via the network 120.

[0033] The network 120 is a general interface that can be connected to the management device 140, regardless of the network type, such as a mobile communication network, the Internet network, a LAN (Local Area Network), or a USB (Universal Serial Bus). Communication between the management device 140 and other components is performed via the network 120. Note that the communication device 110 and the management device 140 constituting the data processing system 1 are connected to the network 120 by wire via well-known communication equipment (not shown), but may be connected wirelessly.

[0034] The management device 140 is assumed to be a server on which a program runs, and is a device that accumulates information received from a plurality of communication devices 110, compares the information, and then visualizes the results.

[0035] The communication device 110 is composed of an information acquisition unit 111. The information acquisition unit 111 periodically acquires operation information 101 and setting information 102 of the connected device 100 and data of the communication device 110 based on preset information. The acquired data is transmitted to the management device 140 via the network 120.

[0036] As illustrated in FIG. 1, the data processing system 1 is connected to user devices 130a, 130b, 130c, . . . 130n (hereinafter, collectively referred to as "user devices 130" when collectively referred to or when no particular distinction is made) such as PCs and mobile terminals owned by users of the data processing system 1 via a network 120 so as to be able to perform data communications with each other. The user devices 130 are mainly used to access the management device 140 via the network 120 and refer to the comparison results of settings and logs. The user devices 130 and the network 120 are connected wirelessly, but may be connected by wire. Each user of the data processing system 1 who owns the user device 130 is given a unique ID called a user ID in advance.

[0037] Further, other devices and terminals may be connected to the data processing system 1 so as to be able to communicate data with each other via the network 120. The data processing system 1 may obtain various data from such other devices and terminals.

[0038] In the following description of this embodiment, other devices and terminals connected to the data processing system 1, including the user device 130, may be abbreviated to simply "other devices" or "other terminals."

[0039] In this embodiment, the communication device 110 and the management device 140 are described as being composed of a single device as shown in Fig. 1. However, for example, the communication device 110 and the management device 140 may be composed of multiple devices.

[0040] In the present embodiment, as shown in Fig. 1, the data processing system 1 is described as being connected to other devices and terminals such as the user device 130 via the network 120. However, for example, the data processing system may be configured as a system including such other devices and terminals. Also, for example, the data processing system may be configured to include some or all of the functions performed by the other devices and terminals.

[0041] (Example of functional block of management device 140) Next, a description will be given of an example of blocks of various functions provided in the management device 140. Each block described below does not represent a hardware-based configuration, but represents a functional block.

[0042] An example of the hardware configuration of the management device 140 will be described later with reference to FIG.

[0043] The management device 140 includes the following functional blocks: a control unit (not shown), a storage unit (not shown), and a communication unit 141.

[0044] The control unit executes various data processing based on the programs and data stored in the storage unit and the data acquired by the communication unit 141. The control unit also functions as an interface between the storage unit and the communication unit 141.

[0045] The control unit has the following functional blocks: a GUI generation unit 143, a statistical processing unit 144, and a classification unit 145.

[0046] The GUI generation unit 143 generates a GUI (Graphical User Interface) and responds to the inquiry from the communication unit 141. When responding with data, elements required for displaying the GUI are acquired from the log DB 142 and the statistical processing unit 144.

[0047] Statistical processing unit 144 performs processing to compare log data of connected device 100 in response to an inquiry from GUI generation unit 143, and responds with data related to the comparison result. When responding with data, log data of connected device 100 required for the comparison processing is obtained from classification unit 145.

[0048] In response to an inquiry from the statistical processing unit 144, the classification unit 145 acquires log data of the connected device 100 stored in the log DB 142, classifies the acquired log data, and then responds with the log data of the connected device 100 to the statistical processing unit 144.

[0049] The control unit is configured using a processor such as a CPU 400 described later, and can realize these functional blocks by executing a predetermined program. Note that instead of a processor, the control unit may be configured using a logic circuit such as an FPGA (Field Programmable Gate Array). The control unit may also be configured by combining a processor and a logic circuit.

[0050] The memory unit is configured using a memory device consisting of, for example, a main memory device 401 and an auxiliary memory IF 402 described below, and stores programs that supply various processing instructions to the control unit, and data representing various information used in the processing executed by the control unit.

[0051] The storage unit stores log DB 142. Log DB 142 is a database that stores data received from communication device 110 and acquired from connection device 100 and communication device 110.

[0052] The communication unit 141 is responsible for communication processing with other devices, such as the communication device 110 and the user device 130, performed via the network 120. The communication unit 141 is configured using, for example, a network interface card (NIC) or a host bus adapter (HBA).

[0053] Furthermore, the management device 140 may include a user interface unit (not shown) that includes the functional blocks of an input unit (not shown) and an output unit (not shown).

[0054] The input unit is responsible for input-related processes, such as accepting input operations from the user, among other processes related to the user interface. The input unit is configured using, for example, a touch panel, and detects various operations from the user.

[0055] The output unit is responsible for output-related processes such as displaying various screens on a display device, outputting audio, etc. The output unit is configured using, for example, a touch screen or a liquid crystal display.

[0056] The above description of each function is merely an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0057] In the present embodiment, the functions of the management device 140 have been described as being integrally realized by one computer device. However, these functions may be realized by a plurality of computers or server devices connected to each other. The management device 140 may be configured to include a general-purpose computer device such as a laptop PC and a web browser installed thereon, or may be configured to include a web server and various portable devices.

[0058] Furthermore, the communication device 110 and / or the management device 140 constituting the data processing system 1 may have other functions in addition to the various functions described above. For example, the communication device 110 may be configured to include some of the above functions of the management device 140, and the management device 140 may be configured to include some of the above functions of the communication device 110.

[0059] (Example of Hardware Configuration of Communication Device 110 in First Embodiment) FIG. 2 is a diagram illustrating an example of a hardware configuration of the communication device 110 according to the first embodiment.

[0060] 2, the communication device 110 includes a CPU (Central Processing Unit) 200, a main memory device 201, a network IF 202, an auxiliary memory IF 203, an input / output IF 204, a serial communication IF 205, and a LAN communication IF 206, and each part is connected by a bus.

[0061] The CPU 200 controls each unit of the communication device 110, and loads necessary programs into the main memory device 201 and executes them.

[0062] The main memory device 201 is typically configured with a volatile memory such as a RAM (Random Access Memory), and stores programs executed by the CPU 200 and data referenced by the CPU 200.

[0063] The network IF 202 is an interface for connecting to the network 120 .

[0064] The input / output IF 204 is an interface for connecting input / output devices such as a keyboard and a mouse.

[0065] The auxiliary storage IF 203 is an interface for connecting an auxiliary storage device such as an EEPROM (Electrically Erasable Programmable Read Only Memory), an HDD (Hard Disk Drive), or an SSD (Solid State Drive).

[0066] The serial communication IF 205 is an interface that connects to the serial communication IF of the connection device 100 when performing serial communication with the connection device 100 using a Modbus-RTU (Remote Terminal Unit) or the like.

[0067] The LAN communication IF 206 is an interface that connects to the LAN communication IF of the connection device 100 when LAN communication such as Modbus-TCP (Transmission Control Protocol) is performed with the connection device 100.

[0068] The auxiliary storage device has a large storage capacity, and stores an information acquisition program 210 and an information acquisition setting file 220 for executing this embodiment.

[0069] The information acquisition program 210 is a program that realizes the functions of the information acquisition unit 111 .

[0070] The information acquisition setting file 220 is a file in which setting information related to information acquisition is described. The information acquisition setting file 220 describes an information acquisition cycle 221, interface information 222, a communication method 223, an information storage location 224, and data information 225. The interface information 222 is information on the interface of the connected device 100, such as LAN or serial. The communication method 223 is information on a communication standard used for information acquisition, such as Modbus-RTU or Modbus-TCP. The information storage location 224 is information such as register address information required for Modbus communication and the file path of the acquired file. The data information 225 is information required for reading data, such as the data length and data type of the acquired data.

[0071] (Information acquisition processing) FIG. 3 is a flowchart 300 showing an example of the flow of information acquisition processing executed by the information acquisition unit 111 of the communication device 110 in the data processing system 1 according to the first embodiment.

[0072] The operation of the information acquisition unit 111 will be described below with reference to a flowchart 300 shown in FIG.

[0073] The information acquisition unit 111 executes the processes of steps S301 to S303 described below at each information acquisition cycle 221 of the information acquisition setting file 220, that is, periodically.

[0074] In step S301, the control unit of communication device 110 executes processing to acquire multiple pieces of information from connection device 100 and communication device 110 based on interface information 222, communication method 223, information storage location 224, and data information 225 of information acquisition setting file 220, using information acquisition unit 111. As a result, multiple pieces of information are acquired from connection device 100 and communication device 110. When the processing in step S301 is completed, the control unit of communication device 110 proceeds to step S302.

[0075] In step S302, the control unit of the communication device 110 executes a process of converting data representing the information acquired in step S301 into JSON format by the information acquisition unit 111. As a result, the data is converted into JSON format. When the process in step S302 is completed, the control unit of the communication device 110 proceeds to step S303.

[0076] In step S303, the control unit of communication device 110 executes a process in which information acquisition unit 111 transmits the data converted into JSON format in step S302 to management device 140. As a result, the data is transmitted to management device 140. Management device 140 receives the data from communication device 110 via communication unit 141. Upon completing the process in step S303, the control unit of communication device 110 ends the information acquisition process shown in flowchart 300 in FIG. 3.

[0077] (Example of Hardware Configuration of Management Device 140) FIG. 4 is a diagram illustrating an example of a hardware configuration of the management device 140 according to the first embodiment.

[0078] The management device 140 comprises a CPU 400, a main memory device 401, an auxiliary memory IF 402, an input / output IF 403, and a network IF 404, and each of these components is connected via a bus.

[0079] The CPU 400 controls each unit of the management device 140, and loads necessary programs into the main memory device 401 and executes them.

[0080] The main storage device 401 is usually configured as a volatile memory such as a RAM, and stores the programs executed by the CPU 400 and data to be referenced.

[0081] The auxiliary storage IF 402 is an interface for connecting an auxiliary storage device such as an HDD or SSD.

[0082] The input / output IF 403 is an interface for connecting input / output devices such as a keyboard and a mouse.

[0083] The network IF 404 is a communication interface for connecting to the network 120 and communicating with other terminals.

[0084] The auxiliary storage device has a large storage capacity, and stores database management software 410, a communication program 420, a GUI generation program 421, a statistical processing program 422, and a classification program 423 for executing this embodiment.

[0085] The database management software 410 is software that manages the log DB 142. By receiving a specific control command written in SQL or the like, the database management software 410 stores, searches, deletes, outputs, aggregates, and performs calculation processing on data in the log DB 142. The log DB 142 stores received log data 412, which is data received from the communication device 110.

[0086] A communication program 420, a GUI generation program 421, a statistical processing program 422, and a classification program 423 are programs which respectively realize the functions of the communication unit 141, the GUI generation unit 143, the statistical processing unit 144, and the classification unit 145.

[0087] (Example of the configuration of the reception log data 412 in the first embodiment) FIG. 5 is a diagram showing an example of the configuration of the reception log data 412 in the first embodiment.

[0088] The reception log data 412 is in JSON format, and has a timestamp 500, connected device data 510, and communication device data 520 as elements.

[0089] The timestamp 500 is a value indicating the time when the log was acquired. In the first embodiment, the timestamp 500 is stored in the epoch second format.

[0090] The connected device data 510 includes elements such as a device type 511 , a device ID 512 , an accumulated operating time 513 , and connected device detailed data 514 .

[0091] The device type 511 stores model information and a hardware identifier that can uniquely classify the type of the connected device 100.

[0092] In the device ID 512, an identifier specific to each connected device 100 that can uniquely identify the device is stored.

[0093] The accumulated value of the time during which the connected device 100 has been powered on and in operation is stored in the accumulated operating time 513. In the first embodiment, the accumulated operating time 513 stores a numerical value in hours.

[0094] As the connected device detailed data 514, data of the connected device 100 acquired by the information acquisition unit 111 of the communication device 110 with reference to the information acquisition setting file 220 is stored.

[0095] The communication device data 520 includes elements such as a communication device ID 521 , an accumulated operating time 522 , and communication device detailed data 523 .

[0096] In the communication device ID 521, an identifier specific to each communication device 110 that can uniquely identify the communication device 110 is stored.

[0097] The accumulated value of the time during which the communication device 110 has been powered on and in operation is stored in the accumulated operation time 522. In the first embodiment, the accumulated operation time 522 stores a numerical value in hours.

[0098] The communication device detailed data 523 stores data of the communication device 110 acquired by the information acquisition unit 111 of the communication device 110 with reference to the information acquisition setting file 220 .

[0099] Hereinafter, elements constituting the connected device data 510 or the communication device data 520 (such as the device type 511, the device ID 512, and the accumulated operating time 513) will be referred to as a log type.

[0100] (Device list display screen 600) FIG. 6 is a diagram showing an example of a GUI of a device list display screen 600 in the first embodiment.

[0101] On the device list display screen 600, a list 610 of connected devices 100 is displayed.

[0102] The list 610 of connected devices 100 is generated by extracting unique elements from the data of the log DB 142. The list 610 of connected devices 100 is composed of a device type 611, a device ID 612, a communication device ID 613, and a link to comparison settings 614. The device type 611, the device ID 612, and the communication device ID 613 store values ​​corresponding to the device type 511, the device ID 512 in the connected device data 510 of the reception log data 412, and the communication device ID 521 in the communication device data 520, respectively. The link to comparison settings 614 stores a character string that links to a comparison settings screen (described in detail later in relation to FIG. 7) in which the connected device 100 corresponding to the row is the device to be compared.

[0103] Hereinafter, the connected device 100 and communication device 110 having the device ID 612 or communication device ID in the row where the link 614 to the comparison setting was selected on the device list display screen 600 will be referred to as the comparison target device, and the other devices will be referred to as the other devices. In addition, the reception log data 412 acquired from the comparison target device will be referred to as the comparison target device log or comparison target device log data, and the reception log data 412 acquired from the other devices will be referred to as the other device log or other device log data.

[0104] (Comparison setting screen 700) FIG. 7 is a diagram showing an example of a GUI of a comparison setting screen 700 in the first embodiment.

[0105] The comparison setting screen 700 is used to make settings related to the comparison process executed by the statistical processing unit 144. The comparison setting screen 700 displays classification settings 710, an add classification setting button 720, log time range settings 730, other device log time range settings 740, comparison data settings 750, an add comparison data setting button 760, and an execute comparison button 770.

[0106] The classification settings 710 are made up of a classification method setting 711 , a classification range setting 712 , and a classification setting deletion button 713 .

[0107] The classification method setting 711 is a setting for specifying, from two pull-down menus, which log type of reception log data 412 is to be used for classification in the classification process of classification unit 145 performed during the comparison process. The first pull-down menu specifies either connected device data 510 or communication device data 520. The second pull-down menu allows selection of all keys of the elements of connected device data 510 and communication device data 520 of reception log data 412, and one of them is specified.

[0108] The classification range setting 712 is a setting for specifying the range of values ​​of the log data of other devices to be classified into the same group as the comparison target device in the classification process. The distance from the average value of the comparison target device in the log data of the type specified in the classification method setting 711 is specified by inputting a numerical value.

[0109] When a delete category setting button 713 is selected, the category setting 710 containing the delete category setting button 713 is deleted from the GUI.

[0110] The add category setting button 720 is a button that, when selected, displays one additional category setting 710 on the GUI.

[0111] In the log time range setting 730, the time range of the logs of the comparison target device is specified by inputting a character string, and a condition for filtering the logs of the comparison target device based on the time range is specified.

[0112] In the time range setting 740 for other device logs, the time range of the logs of other devices is specified by inputting a character string, and a condition for filtering other device log data based on the time range is specified.

[0113] The comparison data setting 750 is made up of a comparison data type setting 751 , a pre-processing setting 752 , and a comparison data setting deletion button 753 .

[0114] The comparison data type setting 751 specifies the log type of data to be compared. In the first pull-down, either connected device data 510 or communication device data 520 is specified. In the second pull-down, all keys of the elements of connected device data 510 and communication device data 520 in reception log data 412 can be selected, and one of them is specified. The options in the pull-down are generated by extracting unique elements in the keys of the data stored in connected device details data 514 and communication device details data 523 stored in log DB 142.

[0115] Pre-processing setting 752 specifies pre-processing of the data to be compared. The content of pre-processing is specified from three types: simple comparison, amount of change (increase), and amount of change (decrease) using a pull-down menu. With simple comparison, no pre-processing is performed. With amount of change (increase), the data is converted to an amount of change in the positive direction in time units before comparison. With amount of change (decrease), the data is converted to an amount of change in the negative direction in time units before comparison.

[0116] When the comparison data setting delete button 753 is selected, the comparison data setting 750 including the comparison data setting delete button 753 is deleted from the GUI.

[0117] The comparison data setting addition button 760 is a button that, when selected, displays one additional comparison data setting 750 on the GUI.

[0118] When the comparison execution button 770 is selected, the comparison process is started, and when the comparison process is completed, a comparison result display screen (described in detail below in relation to FIG. 8) is displayed.

[0119] (Comparison result display screen 800) FIG. 8 is a diagram showing an example of a GUI of a comparison result display screen 800 in the first embodiment.

[0120] On the comparison result display screen 800, a comparison result plot 810, comparison results 820, comments 830, and an overall tendency plot 840 are displayed for each comparison data setting 750 set on the comparison setting screen 700.

[0121] A histogram or graph showing the distribution of the other device's log data and the comparison target device's log data is displayed in the comparison result plot 810. For example, a plot can be conceived in which the logs of the other device are treated as a comparison group, and the logs of the comparison target device are treated as a target device, and a histogram is displayed in a different color for each, with a marker placed at the average value for each.

[0122] The comparison result 820 is composed of an abnormality level 821 and comparison result details 822 .

[0123] The degree of anomaly 821 is expressed as a number from 1 to 5, and is an index showing the occurrence probability of the average value of the target device log with other device log data as the parent set. When the degree of anomaly 821 is "5", it indicates an occurrence probability of 1% or less, when the degree of anomaly 821 is "4", it indicates an occurrence probability of 10% or less, when the degree of anomaly 821 is "3", it indicates an occurrence probability of 50% or less, when the degree of anomaly 821 is "2", it indicates an occurrence probability of 75% or less, and when the degree of anomaly 821 is "1", it indicates an occurrence probability of more than 75%.

[0124] Comparison result details 822 displays different text depending on the degree of abnormality 821. The text includes information regarding the relationship between the comparison target device log data and the other device log data, and the presence or absence of deterioration or failure.

[0125] If the abnormality level 821 is "3" or higher, the comment displays information recommending maintenance or replacement of the device. If the abnormality level 821 is "2", the comment displays information recommending maintenance. If the abnormality level 821 is "1", the comment displays information indicating that maintenance or replacement of the device is not necessary.

[0126] The overall trend plot 840 displays a graph of the relationship between the data type specified in the classification settings and the operating time for the target device log data and other device log data. In addition, the graph also displays information such as the range of logs used in the comparison process and the average device replacement timing. If multiple comparison data settings 750 are set on the comparison settings screen 700, multiple graphs are displayed vertically.

[0127] (GUI generation process for comparison result display screen 800) FIG. 9 is a sequence diagram 900 showing an example of the flow of GUI generation processing for the comparison result display screen 800 executed in the management device 140. As shown in FIG.

[0128] The operation of each part of management device 140 will be described below with reference to a sequence diagram 900 shown in FIG.

[0129] In step S901, when an input indicating that the comparison execution button has been selected on the comparison setting screen is generated, the GUI generation unit 143 transmits the comparison setting data related to the selection to the statistical processing unit 144.

[0130] In step S 902 , upon receiving the comparison setting data, the statistical processing unit 144 transmits the comparison setting data to the classification unit 145 .

[0131] In step S 903 , the classification unit 145 performs classification processing based on the received comparison setting data, and generates classification result response data as a result of the processing and transmits it to the statistical processing unit 144 .

[0132] In step S 904 , the statistical processing unit 144 performs a comparison process based on the received classification result response data, and generates comparison result response data as a result of the comparison, and transmits the comparison result response data to the GUI generation unit 143 .

[0133] (Example of comparison setting data 1000) FIG. 10 is a diagram showing an example of the configuration of the comparison setting data 1000 in the first embodiment.

[0134] The comparison setting data 1000 is composed of a device type 1010 , a device ID 1020 , a classification setting 1030 , a time range of a log 1040 , a time range of logs of other devices 1050 , and comparison data 1060 .

[0135] The device type 1010 and device ID 1020 store the device type 611 and device ID 612 of the row in which the link 614 to the comparison setting is selected on the device list display screen 600 .

[0136] The setting values ​​of the classification setting 710, the log time range setting 730, the other device log time range setting 740, and the comparison data setting 750 on the comparison setting screen 700 are stored in the classification setting 1030, the log time range 1040, the other device log time range 1050, and the comparison data 1060. If there are multiple items in the setting, the settings are stored in list format. For the comparison data 1060, the contents of the comparison data type setting 751 and the preprocessing setting 752 are combined into one item, and the settings are stored in the comparison data type 1061 and the preprocessing 1062 in list format.

[0137] (Example of the configuration of the classification result response data 1100) FIG. 11 is a diagram showing an example of the configuration of the classification result response data 1100 in the first embodiment.

[0138] The classification result response data 1100 is made up of classification setting details 1110 , classification results 1120 , and overall trends 1130 .

[0139] The detailed classification settings 1110 are items that notify details about the classification process settings. The detailed classification settings 1110 are items in list format, and each list is made up of a classification key 1111 and a range 1112.

[0140] The classification key 1111 stores the same value as the classification method 1031 of the comparison setting data 1000 .

[0141] The range 1112 stores in list form values ​​obtained by adding and subtracting the classification range of the comparison setting data 1000 to and from the average value of the log data of the comparison target device acquired in the classification process.

[0142] Classification result 1120 indicates the output of the classification process, stores the grouped other device log data and target device log data by log type, and is an item that notifies data necessary for generating comparison result plot 810. Classification result 1120 is a list of the same length as the number of elements in comparison data 1060 of comparison setting data 1000, and for each item, a comparison data type 1121, other device log 1122, and target device log 1123 are generated and stored using each item of one element of comparison data 1060.

[0143] The comparison data type 1121 stores a character string obtained by combining the character strings in the comparison data type 1061 and pre-processing 1062 in the comparison data 1060 of the comparison setting data 1000 .

[0144] The other device log 1122 is stored in list format in which the element values ​​of the connected device data 510 or communication device data 520 specified by the comparison data type of the comparison data of the comparison setting data 1000 are narrowed down by classification processing from the other device log data obtained from the log DB 142.

[0145] The target device log 1123 stores, in list form, the values ​​of elements of the connected device data 510 or the communication device data 520 specified in the comparison data type 1061 of the comparison data 1060 of the comparison setting data 1000 from among the target device logs used in the comparison.

[0146] Overall trend 1130 is an item that stores other device log data and target device log data acquired during classification processing by log type, and notifies data necessary for generating overall trend plot 840. Overall trend 1130 is a list of the same length as the number of elements in comparison data 1060 of comparison setting data 1000, and comparison data type 1131, other device log 1140, and target device log 1150 are generated and stored using each item of one element of comparison data 1060 for each item.

[0147] The comparison data type 1131 stores a character string obtained by combining the character strings in the comparison data type 1061 and pre-processing 1062 in the comparison data 1060 of the comparison setting data 1000 .

[0148] The other device log 1140 is composed of a classification key value 1141 and a log value 1144 .

[0149] The classification key value 1141 stores the data of the log type used for classification in list format in order to generate an overall trend plot 840 for each classification setting 1030 of the comparison setting data 1000. Each list in the classification key value 1141 is composed of a classification key 1142 and a value 1143, and has the same length as the classification setting details 1110.

[0150] In the classification key 1142, the value of the classification key 1111 in the classification setting details 1110 is stored.

[0151] Value 1143 stores the values ​​of the elements of connected device data 510 or communication device data 520 specified in classification method 1031 of comparison setting data 1000 from other device log data obtained from log DB 142 in list format after classification processing is performed.

[0152] The log value 1144 is stored in list format after the classification process is performed, in which the values ​​of the elements of the connected device data 510 or the communication device data 520 specified in the comparison data type 1061 of the comparison data 1060 of the comparison setting data 1000 from the other device log data obtained from the log DB 142 are stored.

[0153] The target device log 1150 is composed of a classification key value 1151 and a log value 1154 .

[0154] The classification key value 1151 stores the data of the log type used for classification in list format in order to generate an overall trend plot 840 for each classification setting 1030 of the comparison setting data 1000. Each list in the classification key value 1151 is composed of a classification key 1152 and a value 1153, and has the same length as the classification setting details 1110.

[0155] In the classification key 1152, the value of the classification key 1111 of the classification setting details 1110 is stored.

[0156] Value 1153 stores the values ​​of elements of connected device data 510 or communication device data 520 specified in classification method 1031 of comparison setting data 1000 from the comparison target device log data obtained from log DB 142 in list format after classification processing is performed.

[0157] The log value 1154 is stored in list format after the classification process is performed, in which the values ​​of the elements of the connected device data 510 or the communication device data 520 specified in the comparison data type 1061 of the comparison data 1060 of the comparison setting data 1000 from the comparison target device log data obtained from the log DB 142 are stored.

[0158] (Classification process) FIG. 12 is a flowchart 1200 showing an example of the flow of the classification process executed by the classification unit 145 of the management device 140 in the first embodiment.

[0159] The operation of the classification unit 145 will be described below with reference to a flowchart 1200 shown in FIG.

[0160] When the classification unit 145 receives the comparison setting data 1000 from the statistical processing unit 144, it starts executing each process from step S1201 onwards.

[0161] In step S1201, the control unit of the management device 140 generates a control command by using the classification unit 145, referring to the device type 1010, device ID 1020, time range of the log 1040, and comparison data 1060 of the comparison setting data 1000, sends the control command to the log DB 142, and executes a process of acquiring the comparison target device log data. The control command describes the content of acquiring data specified by the classification method 1031 of the classification setting 1030 and the comparison data type 1061 of the comparison data 1060, in which the device type 511 and device ID 512 match the contents of the comparison setting data 1000 and the time stamp 500 exists within the time range, from the received log data 412 of the log DB 142. For the comparison data type 1061 in which the amount of change (increase) or the amount of change (decrease) is specified in the preprocessing 1062 in the comparison data 1060, a control command is added to execute an operation of taking the positive and negative differences at the time of acquisition. The classification unit 145 executes a process of storing, in a list format, a character string obtained by combining the character strings of the comparison data type 1061 and the preprocessing 1062 in the comparison data 1060 of the comparison setting data 1000 in the comparison data type 1131 of the overall tendency 1130, a value of data specified in the classification method 1031 of the classification setting 1030 among the acquired values ​​in the classification key value 1141 of the target device log 1150, and a value of data specified in the comparison data type 1061 for each comparison data 1060 of the comparison setting data 1000 in the log value 1144, according to the format of the classification result response data 1100. As a result, the comparison target device log data is acquired. When the process in step S1201 is completed, the control unit of the management device 140 proceeds to step S1202.

[0162] In step S1202, the control unit of the management device 140 generates a control command for executing a process of acquiring other device log data by using the classification unit 145 and referring to the device type 1010, device ID 1020, time range 1050 of the other device log, and comparison data 1060 of the comparison setting data 1000. The control command describes the content of acquiring data of a log type specified by the classification method 1031 of the classification setting 1030 and the comparison data type 1061 of the comparison data 1060, in which the device type 511 matches the content of the comparison setting data 1000, the device ID 512 does not match the content of the comparison setting data 1000, and the time stamp 500 is within the time range 1050 of the other device log, from the received log data 412 of the log DB 142. A control command is added to the comparison data type 1061 in which the amount of change (increase) or the amount of change (decrease) is specified in the preprocessing 1062 in the comparison data 1060 to execute an operation of taking a positive and negative difference, respectively, at the time of acquisition. According to the format of classification result response data 1100, the value of the data specified in classification method 1031 of classification setting 1030 among the acquired values ​​is stored in the value of classification key 1141 of other device log 1140 of overall trend 1130, and the value of the data specified in comparison data type 1061 for each comparison data 1060 of comparison setting data 1000 is stored in list form in log value 1144. In this way, the other device log data is acquired. When the process in step S1202 is completed, the control unit of management device 140 proceeds to step S1203.

[0163] In step S1203, the control unit of the management device 140 executes a process in which the classification unit 145 calculates an average value for the log data type specified in the classification method 1031 of the classification setting 1030 of the comparison setting data 1000 for the comparison target device log data acquired in step S1201, and calculates a value obtained by adding and subtracting the numerical value of the classification range 1032 of the comparison setting data 1000 to and from the calculated average value as the classification range 1032. According to the format of the classification result response data 1100, the classification key 1111 of the classification setting details 1110 stores the value of the classification method 1031 of the classification setting 1030 of the comparison setting data 1000, and the calculated classification range 1032 is stored in the range 1112 as one element. The control unit of the management device 140 repeats this process by the classification unit 145 as many times as the number of classification settings 1030 of the comparison setting data 1000. In this way, the classification range is determined. When the process in step S1203 is completed, the control unit of the management device 140 proceeds to step S1204.

[0164] In step S1204, the control unit of the management device 140 executes a process of extracting only data in which the value of the type of log data specified in the classification method 1031 for each comparison data type 1061 of the comparison data 1060 of the comparison setting data 1000 falls within the classification range 1032 calculated in step S1203 from the other device log data acquired in step S1202 by the classification unit 145, and outputting the data as other device classification result data. The classification unit 145 executes a process of storing a character string in which the comparison data type 1061 in the comparison data 1060 of the comparison setting data 1000 and the character string of the preprocessing 1062 are combined in the comparison data type 1121 of the classification result 1120 according to the format of the classification result response data 1100, storing the other device classification result data in the other device log 1122 in list format for each log type, and storing the comparison target device log data acquired in step S1201 in list format for each log type in the target device log. As a result, the other device log data is classified. When the process in step S1204 is completed, the control unit of the management device 140 proceeds to step S1205.

[0165] In step S1205, the control unit of the management device 140 executes a process of transmitting the classification result response data 1100 generated through the procedures up to step S1204 by the classification unit 145 to the statistical processing unit 144. As a result, the classification result response data 1100 is transmitted to the statistical processing unit 144. Upon completing the process in step S1205, the control unit of the management device 140 ends the classification process shown in the flowchart 1200 of FIG.

[0166] After completing the classification process shown in the flowchart 1200 of FIG. 12, the control unit of the management device 140 waits for the classification unit 145 to receive the comparison setting data 1000.

[0167] (Comparison process) FIG. 13 is a flowchart 1300 showing an example of the flow of the comparison process executed by the statistical processing unit 144 of the management device 140 in the first embodiment.

[0168] The operation of the statistical processing unit 144 will be described below with reference to a flowchart 1300 shown in FIG.

[0169] When the statistical processing unit 144 receives the comparison setting data 1000 from the GUI generating unit 143, it starts executing each process from step S1301 onwards.

[0170] In step S1301, the control unit of management device 140 executes a process of transferring comparison setting data 1000 received from GUI generation unit 143 to classification unit 145 by statistical processing unit 144. As a result, comparison setting data 1000 received from GUI generation unit 143 is transferred to classification unit 145. When the process in step S1301 is completed, the control unit of management device 140 proceeds to step S1302.

[0171] In step S1302, the control unit of management device 140 executes a process of waiting for a response from classification unit 145, and receiving classification result response data 1100 from classification unit 145, using statistical processing unit 144. As a result, classification result response data 1100 is received from classification unit 145. When the process in step S1302 is completed, the control unit of management device 140 proceeds to step S1303.

[0172] In step S1303, the control unit of the management device 140 executes a process in which the statistical processing unit 144 refers to the classification result 1120 of the classification result response data 1100 and calculates the average value and standard deviation of the other device log 1122 and the target device log 1123 as statistical values ​​for each item in the list. As a result, the average value and standard deviation of the other device log 1122 and the target device log 1123 are calculated as statistical values. When the process in step S1303 is completed, the control unit of the management device 140 proceeds to step S1304.

[0173] In step S1304, the control unit of the management device 140 executes a process of calculating, by the statistical processing unit 144, the extent to which the average value of the target device log 1123 is an outlier from the other device log 1122 for each log type of comparison data, using the average value and standard deviation of the other device log 1122 calculated in step S1303. By calculating how many times the standard deviation is away from the average value of the other device log 1122, the occurrence probability of the average value of the target device log 1123 is calculated. Furthermore, the occurrence probability is calculated by using the occurrence probability. The abnormality degree is expressed by a value from 1 to 5, and is an index indicating the occurrence probability of the average value of the target device log 1123 with the other device log 1122 as the population. When the abnormality degree is "5", the occurrence probability is 1% or less, when the abnormality degree is "4", the occurrence probability is 10% or less, when the abnormality degree is "3", the occurrence probability is 50% or less, when the abnormality degree is "2", the occurrence probability is 75% or less, and when the abnormality degree is "1", the occurrence probability is greater than 75%. The rate of outliers is a numerical value obtained by subtracting the occurrence probability from 100. In this manner, the comparison target device log data is compared with the other device log data. After completing the process in step S1304, the control unit of the management device 140 proceeds to step S1305.

[0174] In step S1305, the control unit of the management device 140 generates GUI data for displaying the comparison result display screen 800 by the statistical processing unit 144 using the classification result of the classification result response data. A comparison result plot 810 and an overall tendency plot 840 of the comparison result display screen 800 are generated for each item of the list. Furthermore, a comparison result 820 and a comment 830 of the comparison result display screen 800 are generated using the degree of abnormality and the rate of outliers calculated in step S1304. The statistical processing unit 144 executes a process of transmitting the GUI data thus generated to the GUI generating unit 143. In this process, for example, HTML for displaying the comparison result display screen in a browser is generated. The comparison result plot 810 and the overall tendency plot 840 can be displayed by embedding JavaScript (registered trademark) source code in HTML. A method of displaying the comparison result 820 and the comment 830 in a format in which a template is prepared for each degree of abnormality to be calculated and a numerical value is stored in the template can be considered. In addition to HTML, even when using dedicated visualization software, it is possible to handle it by processing the classification result response data 1100. In this way, the statistical processing unit 144 generates GUI data based on the classification result response data 1100. As a result, the GUI data is transmitted to the GUI generation unit 143. When the process in step S1305 is completed, the control unit of the management device 140 ends the comparison process shown in the flowchart 1300 in FIG.

[0175] According to the data processing system 1 of the first embodiment, when calculating the degree of abnormality of the connected devices 100 connected to the multiple communication devices 110, devices with similar degrees of deterioration can be compared by classifying (grouping) the devices using as a criterion whether the values ​​of log data types, including the cumulative operating time (513, 522), fall within a specified range. This prevents a decrease in the accuracy of the calculated degree of abnormality even when the collected log data contains a mixture of device data with various degrees of deterioration. As a result, it becomes possible to output an abnormality degree with a degree of accuracy that is reliable for a user who uses the device to objectively measure the degree of abnormality of the device being used. EXAMPLES

[0176] In the first embodiment, classification is realized using whether data of a specified log type, including the cumulative operating time (513, 522), falls within a specified range as a criterion for judgment. However, there is a limit to the types of log data that can be acquired, and it is not necessarily known whether classification of devices with similar degrees of deterioration is possible. In grasping the state of industrial equipment and detecting anomalies, data indicating the usage environment is required as information that is closely related to the degree of deterioration. For example, location information indicating that the equipment is used in the same base or information common to the bases, and temperature information that has a significant effect on the deterioration and performance of the equipment can be cited. Unless these data can be acquired by the communication device 110 regardless of the connected equipment 100, the classification unit 145 cannot distinguish between equipment with similar degrees of deterioration, and the calculation accuracy of the degree of abnormality may decrease.

[0177] For this reason, the communication device 110 of the second embodiment is equipped with hardware capable of receiving location information, a base station ID in mobile radio, an SSID in wireless LAN communication, and beacon information of Bluetooth (registered trademark) as information indicating that the device is used within the same base, and is equipped with a temperature sensor capable of acquiring temperature information. Then, information that can be acquired from the additionally installed hardware is added to the information of the communication device 110 that can be acquired by the information acquisition unit 111. The differences between the first embodiment and the second embodiment will be described below with reference to the drawings.

[0178] (Example of Hardware Configuration of Communication Device 110 in Second Embodiment) FIG. 14 is a diagram illustrating an example of a hardware configuration of the communication device 110 according to the second embodiment.

[0179] The difference from the first embodiment is that a GNSS signal receiver 1401, a wireless signal receiver 1402, and a temperature sensor 1403 are added.

[0180] A GNSS signal receiver 1401 receives a signal from a GNSS (Global Navigation Satellite System) and outputs latitude and longitude as position information.

[0181] The wireless signal receiver 1402 receives signals exchanged via mobile radio, wireless LAN, and Bluetooth (registered trademark), and interprets and outputs the data contained in each signal.

[0182] The temperature sensor 1403 is a sensor that outputs a temperature.

[0183] (Example of the configuration of the reception log data 412 in the second embodiment) FIG. 15 is a diagram showing an example of the configuration of the reception log data 412 in the second embodiment.

[0184] As differences from the first embodiment, location information 1501, cell ID 1502, wireless LAN SSID 1503, Bluetooth beacon 1504, and temperature sensor value 1505 are added to communication device data 520.

[0185] The location information 1501 is location information acquired from the GNSS signal receiver 1401, and latitude and longitude information is stored in list format.

[0186] The cell ID 1502 stores an identifier of a base station in mobile radio acquired from the radio signal receiver 1402. Of the base stations present in the vicinity, the cell ID of the base station with the strongest signal is stored.

[0187] The wireless LAN SSID 1503 is the SSID of the wireless LAN acquired from the wireless signal receiver 1402. Of the wireless LAN access points present in the vicinity, the SSID of the access point with the strongest signal is stored.

[0188] The Bluetooth beacon 1504 stores data contents included in the Bluetooth (registered trademark) beacon information acquired from the wireless signal receiver 1402. Among the Bluetooth beacons 1504 present in the vicinity, information on the Bluetooth beacon 1504 with the strongest signal is stored.

[0189] The temperature sensor value 1505 stores the temperature value acquired from the temperature sensor 1403 .

[0190] Since the location information is in list format, and the wireless LAN SSID and Bluetooth beacon 1504 are character strings, the contents of the classification process of the statistical processing unit 144 in the management device 140 are changed.

[0191] In the classification process shown in the flowchart 1200 of FIG. 12, the following process is added to the process content of step S1203.

[0192] When the location information 1501 of the communication device data 520 is specified as the classification method 1031 of the classification setting 1030 in the comparison setting data 1000, the range 1112 of the classification setting details 1110 of the generated classification result response data 1100 stores 0 and the classification range value 1032 in the classification setting 1030 of the comparison setting data 1000 in list format.

[0193] When the wireless LAN SSID 1503 and Bluetooth beacon 1504 of the communication device data 520 are specified as the classification method 1031 of the classification setting 1030 in the comparison setting data 1000, the range 1112 of the classification setting details 1110 of the generated classification result response data 1100 stores a list having two elements, each of which has the value of the classification range 1032 in the classification setting 1030 of the comparison setting data 1000.

[0194] Moreover, the following process is added to the process content of step S1204 in the classification process shown in the flowchart 1200 of FIG.

[0195] The average value of latitude and longitude in the location information 1501 of the comparison target device log data acquired in step S1201 is calculated. Then, the distance is calculated using the calculated latitude and longitude and the latitude and longitude in the location information 1501 of the other device log data. The distance may be calculated using the Euclidean distance or the Mahalanobis distance. Only data whose calculated distance falls within the classification range 1032 calculated in step S1203 is extracted and output as other device classification result data. When storing a value in the other device log 1122 of the classification result 1120 according to the format of the classification result response data 1100, the other device classification result data obtained in this process is stored in list format. When storing a value in the value 1143 of the classification key value 1141 of the other device log 1140 in the overall trend 1130, the distance calculated in this process is stored in storage list format instead of the location information 1501. This prevents list-format values ​​of the location information 1501 from being stored in a list, resulting in multiple arrays, and by converting them into distances, the values ​​can be stored as a list of numerical values ​​in the same way as other log types.

[0196] When the wireless LAN SSID 1503 and Bluetooth beacon 1504 of the communication device data 520 are specified as the classification method 1031 of the classification setting 1030 in the comparison setting data 1000, the most frequent character string is obtained from the wireless LAN SSID 1503 and Bluetooth beacon 1504 of the comparison target device log data acquired in step S1201. Other device log data having as elements the wireless LAN SSID 1503 and Bluetooth beacon 1504 that match this most frequent character string is extracted. This makes it possible to extract only devices that refer to the SSID of the wireless LAN or the beacon information of Bluetooth (registered trademark) used within the same location.

[0197] According to the data processing system 1 of the second embodiment, hardware capable of acquiring location information, a base station ID in mobile radio, an SSID in wireless LAN communication, beacon information of Bluetooth (registered trademark), and a temperature sensor value is added to the communication device 110, and the information can be acquired by the information acquisition unit 111. This makes it possible for the communication device 110 to acquire the above information regardless of the connected device 100, and by having the classification unit 145 distinguish between devices with similar degrees of deterioration based on the data acquired by the information acquisition unit 111, it is possible to prevent a decrease in the accuracy of calculation of the degree of anomaly. EXAMPLES

[0198] In the first and second embodiments, when the comparison results are displayed, the comparison results are displayed for all log types specified in the comparison data 1060 of the comparison setting data 1000. However, from the user's perspective, it is impossible to predict which log type will have a high degree of abnormality. For this reason, it is highly likely that a user who uses the data processing system 1 will increase the number of setting items in the comparison data 1060 and perform comparisons for many log types. In the current display content, the comparison results for all log types are displayed vertically, and the order is not in order of abnormality, making it difficult to compare the degree of abnormality for each data type.

[0199] For this reason, in the management device 140 of the second embodiment, a comparison result display screen 800 for multiple types of data and processing related to the screen display are added. The comparison result display screen 800 for multiple types of data collectively displays the comparison results of multiple log types specified in the comparison data 1060. Furthermore, the contribution to the abnormality degree is calculated for each type of comparison data and displayed in a list. In the list, a link to the comparison result display screen 800 for each log type is shown, and the comparison result display screen 800 in the first embodiment can also be displayed individually. Below, the differences of the third embodiment from the first and second embodiments will be described with reference to the drawings.

[0200] (Screen 1600 showing the results of comparing multiple types of data) FIG. 16 is a diagram showing an example of a GUI of a comparison result display screen 1600 of a plurality of types of data in the third embodiment.

[0201] A multiple type data comparison result display screen 1600 displays a multiple type comparison result plot 1610, comparison results 1620, comments 1630, and a contribution degree table 1640 for all log types of the comparison data settings 750 set on the comparison setting screen 700.

[0202] The multi-type comparison result plot 1610 displays the other device log data and the comparison target device log data in a two-dimensional plot. When the number of comparison data settings 750 is three or more, the data is converted into a two-dimensional plot using a method such as principal component analysis or t-SNE (t-distributed Stochastic Neighbor Embedding) and displayed.

[0203] The comparison result 1620 and the comment 1630 are displayed with the same contents as the comparison result 820 and the comment 830 on the comparison result display screen 800, but using the degree of abnormality calculated using data of a plurality of log types.

[0204] The contribution degree table 1640 is a table made up of a contribution rank 1641, a log type 1642, a contribution degree 1643, and a link to an individual result 1644. In the contribution degree table 1640, rows are generated for the number of comparison data settings 750 set on the comparison setting screen 700.

[0205] The contribution rank 1641 stores a numerical value indicating the rank of the contribution of the item in that row to the entirety.

[0206] A character string indicating the log type of the item in that row is stored as the log type 1642. For example, a character string combining the comparison data type and the contents of pre-processing in the comparison data setting 750 on the comparison setting screen 700 is stored.

[0207] The contribution degree 1643 stores the contribution degree calculated as a result of the multiple types of data comparison process by the statistical processing unit 144 for the item in that row.

[0208] Link 1644 to individual results is a link to comparison result display screen 800 when only the log type in that row is set as comparison data. When link 1644 to individual results is selected, comparison setting data 1000 is sent to statistical processing unit 144 in the same manner as when comparison result display screen 800 is displayed. At this time, for settings other than comparison data 1060, the same setting contents as when comparison result display screen 1600 for multiple types of data is displayed are stored. For comparison data 1060 only, information on the log type in the same row as link 1644 to individual results is stored.

[0209] When two or more comparison data settings 750 are set on the comparison setting screen 700 and the comparison execution button 770 is selected, a process is executed to display a comparison result display screen 1600 for multiple types of data. When only one comparison data setting 750 is set, a process is executed to display a comparison result display screen 800. For this reason, the statistical processing unit 144 switches the process by referring to the length of the list of comparison data 1060 in the comparison setting data 1000.

[0210] (Multiple types of data comparison processing) FIG. 17 is a flowchart 1700 showing an example of the flow of a multiple type data comparison process executed by the statistical processing unit 144 of the management device 140 in the third embodiment.

[0211] The operation of the statistical processing unit 144 for the difference from the comparison processing flowchart 1300 will be described below with reference to a flowchart 1700 shown in FIG.

[0212] Note that the processes executed before and after the flowchart 1700 in FIG. 17 are the same as the processes executed before and after the flowchart 1300 in FIG.

[0213] 13. Moreover, the processing shown as steps S1701 and S1702 in the flowchart 1700 in FIG. 17 is the same as the processing shown as steps S1301 and S1302 in the flowchart 1300 in FIG.

[0214] When the process in step S1702 is completed, the control unit of the management device 140 proceeds to step S1703.

[0215] In step S1703, the control unit of the management device 140 uses the statistical processing unit 144 to obtain an average value for all target device logs 1123 of the classification result 1120 of the classification result response data 1100. Then, the distance between the average value of the target device log 1123 and the other device log 1122 is obtained for each list of the classification result 1120. Specifically, the vector of the obtained average value of the target device log and the first value of all other device logs in the list of the classification result of the classification result response data are regarded as vectors, and the distance between the two vectors is obtained. This calculation is repeated for the second, third, and other lengths of the other device logs 1122. The distance to be obtained is assumed to be Euclidean distance or Mahalanobis distance. If the scale differs for each log type, normalization is performed on the target device log 1123 and the other device log 1122 as a preprocessing step to adjust the scale for all log types. When the Mahalanobis distance is used as a distance to be calculated, the degree of anomaly of the distance can be measured because the Mahalanobis distance follows a chi-square distribution. In this embodiment, the percentage of the distribution included within the determined distance is calculated, and this is taken as the occurrence probability. Using the average value of the determined occurrence probability, the degree of anomaly and the rate of outliers are calculated in the same manner as in step S1304 in the flowchart 1300 of FIG. 13. In this manner, the statistical processing unit 144 executes a process of comparing the comparison target device log data with the other device log data. This allows the comparison target device log data to be compared with the other device log data. When the process in step S1703 is completed, the control unit of the management device 140 proceeds to step S1704.

[0216] In step S1704, the control unit of the management device 140 executes a process of calculating the contribution degree for the vector of the other device log 1122 in which the ratio of outliers calculated in step S1703 is 10% or less, by the statistical processing unit 144. When the Mahalanobis distance is used as the distance to be calculated, the contribution degree can be obtained by calculating the SN ratio. The SN ratio can be calculated for each variable (in this case, for each log type) for each data, and has the characteristic that the value becomes large for abnormal data that becomes noise. In this embodiment, the SN ratio calculated for each data is averaged for each log type and output as the contribution degree. The log types are sorted in descending order of the contribution degree, and a contribution ranking 1641, a log type 1642, a contribution degree 1643, and a link 1644 to an individual result are generated for each log type, and output as the contribution degree table 1640. As a result, the contribution degree table 1640 is generated. When the process in step S1704 is completed, the control unit of the management device 140 proceeds to step S1705.

[0217] In step S1705, the control unit of the management device 140 executes a process of generating GUI data for displaying a comparison result display screen 1600 of multiple types of data by using the classification result of the classification result response data 1100 and the calculation result calculated in the process up to step S1704, by using the statistical processing unit 144. The other device log 1122 and the target device log 1123 of the entire list of the classification result 1120 in the classification result response data 1100 are made into a multidimensional array, and converted into a two-dimensional plot using a method such as principal component analysis or t-SNE, and a multiple types comparison result plot 1610 is output. Furthermore, the comparison result 1620 and the comment 1630 of the comparison result display screen are generated using the degree of anomaly and the rate of outliers calculated in step S1703. In addition, the contribution degree table 1640 generated in step S1704 is embedded in the GUI data. The generated GUI data is transmitted to the GUI generation unit 143. As a result, the GUI data is transmitted to the GUI generation unit 143. When the process in step S1705 is completed, the control unit of the management device 140 ends the multiple types of data comparison process shown in the flowchart 1700 of FIG.

[0218] According to the data processing system 1 of the third embodiment, a screen for displaying the comparison results of multiple types of data and a process for comparing multiple types of data are added to the management device 140. This makes it possible to compare the magnitude of the degree of anomaly for each data type on a single display.

[0219] The above-described embodiment of the present invention can be summarized as follows.

[0220] (1) A data processing system 1 comprising: a communication device 110 connected to one or more devices 100 so as to be able to communicate data with; and a management device 140 connected to the communication device 110 so as to be able to communicate data with the communication device 110 and configured to analyze information acquired from the communication device 110, wherein the communication device 110 has an information acquisition unit 111 which acquires information including the operation log of the connected device 100 and / or the operation log of the communication device 110 and transmits the information to the management device 140, and the management device 140 has a classification unit 145 which classifies at least one of the devices 100 or the communication devices 110 based on the information received from the communication device 110, and a statistical processing unit 144 which compares, based on the classification result of the classification unit 145, the operation log of the device 100 or the operation log of the communication device 110 with the operation logs of other devices 100 and / or communication devices 110 classified into the same group as the device 100 or the communication device 110, and outputs the comparison result. As a result, the data processing system 1 can improve the accuracy of calculating the degree of abnormality by objectively measuring the degree of abnormality of the device 100. As a result, the user of the data processing system 1 can accurately grasp the degree of abnormality of the device 100 through a numerical value.

[0221] (2) The operation log includes the operation time of the device 100 or the communication device 110 related to the operation log, and the classification unit 145 classifies at least one of the device 100 or the communication device 110 based on the operation time.

[0222] (3) The operating time is the cumulative operating time. The cumulative operating time is acquired from the communication device 110 or the device 100 connected to the communication device 110, and indicates the time the device has been turned on and operated since shipment. It is a suitable index for reading the degree of deterioration of the parts and consumables that constitute the device 100.

[0223] (4) The operation log includes location information of the device 100 or communication device 110 related to the operation log, and the classification unit 145 classifies at least one of the device 100 or communication device 110 based on the location information.

[0224] (5) The location information is acquired based on a base station ID that indicates information about a base station in mobile wireless communication performed by the communication device 110 related to the location information.

[0225] (6) The location information is acquired based on the SSID, which is information regarding wireless communication performed by the communication device 110 related to the location information.

[0226] (7) The operation log includes the value of a temperature sensor 1403 installed in the equipment 100 or communication device 110 related to the operation log, and the classification unit 145 classifies at least one of the equipment 100 or the communication device 110 based on the value of the temperature sensor 1403.

[0227] (8) The operation log includes at least one of the number of abnormal events occurring in the device 100 or communication device 110 related to the operation log, the degree of deterioration of parts, or the degree of consumption of consumables, and the classification unit 145 classifies at least one of the devices 100 or communication devices 110 based on at least one of the number of abnormal events occurring, the degree of deterioration of parts, or the degree of consumption of consumables.

[0228] (9) As a comparison result, the statistical processing unit 144 outputs the extent to which the operation log of the device 100 or the operation log of the communication device 110 is an outlier compared to the operation logs of all other devices 100 and communication devices 110 classified into the same group as the device 100 or the communication device 110.

[0229] (10) The statistical processing unit 144 calculates the occurrence probability of an event related to the operation log based on a probability distribution, and outputs a numerical value representing the calculated occurrence probability as a value representing the degree of abnormality of the equipment 100 or communication device 110 related to the operation log.

[0230] (11) The statistical processing unit 144 calculates the occurrence probability of an event related to the operation log based on the probability distribution, plots the value representing the calculated occurrence probability on the probability distribution represented in the form of a histogram, and outputs the result as a comparison result.

[0231] (12) The statistical processing unit 144 calculates the occurrence probability of each type of event related to the operation log based on the probability distribution, and outputs events with a relatively large calculated occurrence probability as events that are likely to be an anomaly cause.

[0232] The present invention is not limited to the above-described embodiment, and can be implemented using any components without departing from the spirit of the present invention.

[0233] (13) For example, in the data processing system 1, an operation log includes the operation time of the device 100 or communication device 110 related to the operation log, and the location information of the device 100 or communication device 110 related to the operation log and / or the value of the temperature sensor 1403 installed in the device 100 or communication device 110 related to the operation log, and the operation time is recorded in association with the location information and / or the value of the temperature sensor 1403 for each piece of location information and / or each value of the temperature sensor 1403, and the classification unit 145 may classify at least one of the devices 100 or the communication device 110 based on the operation time associated with the location information and / or the value of the temperature sensor 1403. In this case, the data processing system 1 can grasp the difference in the operating environment from each piece of location information and / or the value of the temperature sensor 1403. Also, in this case, the data processing system 1 can grasp the operation time by dividing it into different operating environments by associating the operation time with the location information and / or the value of the temperature sensor 1403. As a result, the data processing system 1 can further improve the accuracy of calculating the degree of abnormality of the device 100 by accurately and objectively measuring the degree of abnormality in a manner that reflects differences in the operating environments of the device 100. As a result, the user of the data processing system 1 can more accurately grasp the degree of abnormality of the device 100 through numerical values.

[0234] The above-mentioned embodiments, examples, and modifications are merely examples, and the present invention is not limited to these contents as long as the characteristics of the invention are not impaired. In addition, although various embodiments, examples, and modifications have been described above, the present invention is not limited to these contents. Other aspects that are conceivable within the scope of the technical idea of ​​the present invention are also included in the scope of the present invention.

[0235] In the above figures, the control lines and information lines are shown as those considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the actual implementation. For example, it may be considered that almost all the components are actually connected to each other.

[0236] The above-described layout of each functional unit of the data processing system 1 is merely an example. The layout of each functional unit may be changed to an optimal layout in terms of the performance, processing efficiency, communication efficiency, and the like of the hardware and software included in the data processing system 1. [Explanation of symbols]

[0237] 1 Data Processing System 100 connected devices 101 Operation Information 102 Setting information 110 Communication equipment 111 Information Acquisition Department 120 Network 130 User Equipment 140 Management device 141 Communications Department 142 Log DB 143 GUI generation section 144 Statistical Processing Unit 145 Classification Department 200 CPU 201 Main storage 202 Network Interface 203 Auxiliary Memory IF 204 Input / Output Interface 205 Serial communication IF 206 LAN communication interface 210 Information Acquisition Program 220 Information Acquisition Configuration File 400 CPU 401 Main storage 402 Auxiliary Memory IF 403 Input / Output Interface 404 Network Interface 410 Database Management Software 411 Log DB 412 Received log data 420 Correspondence Programs 421 GUI Generator 422 Statistical Processing Program 423 Classification Program 600 Device list display screen 700 Comparison setting screen 800 Comparison result display screen 1000 Comparison setting data 1100 Classification result response data 1401 GNSS signal receiver 1402 Radio signal receiver 1403 Temperature Sensor 1600 Screen showing comparison results of multiple types of data

Claims

1. 1. A data processing system comprising: A communication device connected to one or more devices for data communication; a management device that is connected to the communication device so as to be capable of data communication and that analyzes information acquired from the communication device; Equipped with The communication device includes: an information acquisition unit that acquires information including an operation log of a connected device and / or an operation log of the communication device and transmits the information to the management device; The management device includes: A classification unit that classifies at least one of the device and the communication device based on information received from the communication device; a statistical processing unit that compares the operation log of the device or the operation log of the communication device with the operation logs of other devices and / or communication devices classified into the same group as the device or the communication device based on the classification result of the classification unit, and outputs the comparison result; have Data processing system.

2. The operation log includes an operation time of the device or communication device related to the operation log, The classification unit classifies at least one of the appliance and the communication device based on an operating time.

2. The data processing system of claim 1.

3. 3. The data processing system of claim 2, wherein the operating time is a cumulative operating time.

4. The operation log includes location information of a device or communication device related to the operation log, The classification unit classifies at least one of the device and the communication device based on the location information.

2. The data processing system of claim 1.

5. 5. The data processing system according to claim 4, wherein the location information is acquired based on a base station ID representing information of a base station in mobile wireless communication performed by a communication device related to the location information.

6. The data processing system according to claim 4 , wherein the location information is acquired based on an SSID, which is information regarding wireless communication performed by a communication device related to the location information.

7. The operation log includes a value of a temperature sensor installed in a device or a communication device related to the operation log, The classification unit classifies at least one of the device and the communication device based on a value of the temperature sensor.

2. The data processing system of claim 1.

8. The operation log includes at least one of the number of occurrences of abnormal events in the device or communication device related to the operation log, the degree of deterioration of parts, or the degree of consumption of consumables; The classification unit classifies at least one of the equipment and the communication device based on at least one of the number of occurrences of abnormal events, the degree of deterioration of a part, and the degree of consumption of a consumable item.

2. The data processing system of claim 1.

9. The operation log includes: The operation time of the device or communication device related to the operation log; Location information of the device or communication device related to the operation log and / or the value of a temperature sensor installed in the device or communication device related to the operation log Including, The operating time is recorded in association with the location information and / or the temperature sensor value for each piece of location information and / or each piece of temperature sensor value; The classification unit classifies at least one of the appliance and the communication device based on the operating time associated with the location information and / or the value of the temperature sensor.

2. The data processing system of claim 1.

10. 2. The data processing system of claim 1, wherein the statistical processing unit outputs, as the comparison result, an indication of the extent to which the operation log of the device or the operation log of the communication device is an outlier compared to the operation logs of all other devices and communication devices classified into the same group as the device or the communication device.

11. 2. The data processing system according to claim 1, wherein the statistical processing unit calculates an occurrence probability of an event related to the operation log based on a probability distribution, and outputs a numerical value representing the calculated occurrence probability as a value representing an abnormality degree of the equipment or communication device related to the operation log.

12. 2. The data processing system according to claim 1, wherein the statistical processing unit calculates an occurrence probability of an event related to the operation log based on a probability distribution, plots a value representing the calculated occurrence probability on the probability distribution expressed in the form of a histogram, and outputs the value as the comparison result.

13. 2. The data processing system according to claim 1, wherein the statistical processing unit calculates the occurrence probability of each type of event related to the operation log based on a probability distribution, and outputs events with a relatively large calculated occurrence probability value as events that are highly likely to be an anomaly cause.

14. A management device that is connected to a communication device that is connected to one or more devices in a data-communicable manner and analyzes information acquired from the communication device, A classification unit that classifies at least one of the device and the communication device based on information received from the communication device; a statistical processing unit that compares the operation log of the device or the operation log of the communication device with the operation logs of other devices and / or communication devices classified into the same group as the device or the communication device based on the classification result of the classification unit, and outputs the comparison result; A management device having the above configuration.

15. The operation log includes an operation time of the device or communication device related to the operation log, The classification unit classifies at least one of the appliance and the communication device based on an operating time. The management device according to claim 14.

16. The management device according to claim 15 , wherein the operating time is a cumulative operating time.

17. The operation log includes location information of a device or communication device related to the operation log, The classification unit classifies at least one of the device and the communication device based on the location information. The management device according to claim 14.

18. The management device according to claim 17 , wherein the location information is acquired based on a base station ID representing information of a base station in mobile wireless communication performed by a communication device related to the location information.

19. The management device according to claim 17 , wherein the location information is acquired based on an SSID that is information regarding wireless communication performed by a communication device related to the location information.

20. The operation log includes a value of a temperature sensor installed in a device or a communication device related to the operation log, The classification unit classifies at least one of the device and the communication device based on a value of the temperature sensor. The management device according to claim 14.

21. The operation log includes at least one of the number of occurrences of abnormal events in the device or communication device related to the operation log, the degree of deterioration of parts, or the degree of consumption of consumables; The classification unit classifies at least one of the equipment and the communication device based on at least one of the number of occurrences of abnormal events, the degree of deterioration of a part, and the degree of consumption of a consumable item. The management device according to claim 14.

22. The operation log includes: The operation time of the device or communication device related to the operation log; Location information of the device or communication device related to the operation log and / or the value of a temperature sensor installed in the device or communication device related to the operation log Including, The operating time is recorded in association with the location information and / or the temperature sensor value for each piece of location information and / or each piece of temperature sensor value; The classification unit classifies at least one of the appliance and the communication device based on the operating time associated with the location information and / or the value of the temperature sensor. The management device according to claim 14.

23. The management device of claim 14, wherein the statistical processing unit outputs, as the comparison result, an indication of the extent to which the operation log of the device or the operation log of the communication device is an outlier compared to the operation logs of all other devices and communication devices classified into the same group as the device or the communication device.

24. The management device according to claim 14, wherein the statistical processing unit calculates an occurrence probability of an event related to the operation log based on a probability distribution, and outputs a numerical value representing the calculated occurrence probability as a value representing an abnormality degree of the equipment or communication device related to the operation log.

25. The management device according to claim 14, wherein the statistical processing unit calculates an occurrence probability of an event related to the operation log based on a probability distribution, plots a value representing the calculated occurrence probability on the probability distribution expressed in the form of a histogram, and outputs the value as the comparison result.

26. The management device according to claim 14, wherein the statistical processing unit calculates the occurrence probability of each type of event related to the operation log based on a probability distribution, and outputs events with a relatively large calculated occurrence probability value as events that are highly likely to be an anomaly cause.

27. 1. A data processing method comprising the steps of: A communication device connected to one or more devices for data communication; a management device that is connected to the communication device so as to be capable of data communication and that analyzes information acquired from the communication device; A data processing system comprising: The communication device, Acquire information including an operation log of the connected device and / or an operation log of the communication device, and transmit the information to the management device; The management device, classifying at least one of the device or the communication device based on the information received from the communication device; Based on the classification result, the operation log of the device or the operation log of the communication device is compared with the operation logs of other devices and / or communication devices classified into the same group as the device or the communication device, and a comparison result is output. Data processing methods.

Images