Routine event specification device, routine event specification method, and routine event specification program

Abstract

To remove logs related to routine normal operations from logs to be inspected.SOLUTION: A routine event specification device 100 comprises an attribute analysis unit 140 and a consistency analysis unit 150. While first correlation information is generated indicating the correlation between the occurrence frequencies of objects indicated by logs for the objects indicated by the logs, when the first correlation information on the objects linked to a target attribute satisfies a correlation condition, the attribute analysis unit 140 integrates the pieces of first correlation information on the objects to generate second correlation information. When, for a pair of the two objects corresponding to the second correlation information, a consistency condition that is a condition based on second correlation information generated in the past is satisfied, the consistency analysis unit 150 includes information on the pair of the two objects in a routine list that is used for reducing logs on the basis of the correlation between the objects.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a routine event identification device, a routine event identification method, and a routine event identification program. [Background technology]

[0002] In SOCs (Security Operation Centers), log analysis techniques such as rule detection analysis or anomaly detection analysis are not accurate enough. As a result, when the number of logs to be inspected is huge, the number of alarms becomes large. Therefore, there is a technology in SOCs to deal with the large number of alarms caused by false positives. Non-Patent Document 1 discloses a technique for narrowing down useful logs (templates) based on the correlation between templates. Templates that are highly correlated with other templates in terms of frequency of appearance are likely to be from programs that are constantly running, and can therefore be excluded from analysis. A specific example of the correlation is the correlation regarding the frequency of appearance of print statements for log output in a program. Here, if the frequency of appearance of a certain template is higher than a baseline (statistical information calculated in advance) by a certain value or more, the certain template is likely to be an important template. Furthermore, if a certain template contains words that are not contained in other templates, the certain template is likely to be an important template. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Byungchul Tak, Seorin Park, Prabhakar Kudva, “Priolog: Mining Important Logs via Temporal Analysis and Prioritization,” Sustainability, November 2019. Summary of the Invention [Problem to be solved by the invention]

[0004] In order to improve the efficiency of log analysis, it is possible to consider the idea of ​​excluding logs related to routine normal operations from logs related to human actions (specifically, proxy logs or authentication system logs) other than Syslog and application logs, etc. However, according to Non-Patent Document 1, there is a problem in that this idea cannot be realized. The present disclosure aims to exclude logs related to routine normal operations from inspection targets. [Means for solving the problem]

[0005] The routine event identification device according to the present disclosure comprises: When each type of subject of one or more types of subjects indicated in a preparation log consisting of a plurality of logs each indicating a pair of a subject and an object is set as a target subject, there are a plurality of object types corresponding to the target subjects, a frequency vector indicating the occurrence frequency of the object for each time period for each object type corresponding to the target subjects is created, and first correlation information indicating the correlation between each two frequency vectors corresponding to the target subjects is created, an attribute analysis unit that, when each type of attribute associated with any of the entities indicated in the preparation log is taken as a target attribute and a pair of two objects of each type corresponding to a correlation indicated by any of the first correlation information corresponding to each entity associated with the target attribute is taken as a first target object pair, integrates correlations included in the target correlation group to derive an integrated correlation when a target correlation group consisting of one or more correlations corresponding to the first target object pair among the correlations indicated by the first correlation information corresponding to each entity associated with the target attribute satisfies a correlation condition, and creates second correlation information that is information corresponding to the target attribute and indicates each of the derived integrated correlations; a consistency analysis unit that, when a pair of two objects corresponding to each post-integration correlation indicated by the second correlation information corresponding to the target attribute is defined as a second target object pair, if a consistency condition based on the second correlation information corresponding to the target attribute created in the past is satisfied for the second target object pair, includes information indicating the second target object pair in a routine list that is a list corresponding to the target attribute and is used to reduce logs based on correlations between objects from an operation log consisting of a plurality of logs each indicating a pair of a subject and an object; Equipped with. [Effects of the Invention]

[0006] According to the present disclosure, the attribute analysis unit creates second correlation information indicating integrated correlations corresponding to correlations between pairs of subjects and objects related to the log. The consistency analysis unit determines consistency for each subject based on previously created second correlation information for each integrated correlation, and includes information indicating pairs of two objects corresponding to each integrated correlation determined to be consistent in a routine list. Therefore, each pair of two objects indicated in the routine list corresponding to each subject is considered to correspond to a routinized normal task for each subject. Therefore, according to the present disclosure, logs related to routine normal operations can be excluded from inspection targets. [Brief explanation of the drawings]

[0007] [Figure 1] 1 is a diagram showing an example of the configuration of a routine event identification device 100 according to a first embodiment. [Figure 2] 1 is a diagram showing an example of the hardware configuration of a routine event identification device 100 according to a first embodiment. [Figure 3] FIG. 2 is a diagram for explaining an outline of the operation during preparation of the routine event identification device 100 according to the first embodiment. [Figure 4] 4 is a flowchart showing the operation of the event creating section 110 according to the first embodiment. [Figure 5] FIG. 4 is a diagram showing a specific example of a post-exclusion log according to the first embodiment. [Figure 6]FIG. 4 is a diagram showing a specific example of a first divided log according to the first embodiment. [Figure 7] 4 is a flowchart showing the operation of the frequency calculation unit 120 according to the first embodiment. [Figure 8] FIG. 3 is a diagram showing a frequency table according to the first embodiment. [Figure 9] 5A and 5B are diagrams illustrating the processing of the correlation calculation unit 130 according to the first embodiment, where FIG. 5A is a flowchart illustrating the operation of the correlation calculation unit 130, and FIG. 5B is a diagram illustrating the processing of deriving a correlation matrix. [Figure 10] 4 is a flowchart showing the operation of the attribute analysis unit 140 according to the first embodiment. [Figure 11] FIG. 10 is a diagram showing a specific example of an attribute information DB 193 according to the first embodiment. [Figure 12] FIG. 3 is a diagram for explaining the processing of an attribute analysis unit 140 according to the first embodiment. [Figure 13] 1A and 1B are diagrams illustrating the processing of the consistency analysis unit 150 according to the first embodiment, where FIG. 1A is a flowchart illustrating the operation of the consistency analysis unit 150, and FIG. 1B is a table illustrating a specific example of a routine list. [Figure 14] FIG. 2 is a diagram for explaining an outline of the operation of the routine event identification device 100 according to the first embodiment during operation. [Figure 15] 5 is a flowchart showing the operation of the filter unit 160 according to the first embodiment. [Figure 16] FIG. 3 is a diagram for explaining processing by a filter unit 160 according to the first embodiment. [Figure 17] 1A and 1B are diagrams illustrating the effects of the first embodiment, where FIG. 1A illustrates a case where the first embodiment is not utilized, and FIG. 1B illustrates a case where the first embodiment is utilized. [Figure 18] FIG. 10 is a diagram showing an example of the hardware configuration of a routine event identification device 100 according to a modification of the first embodiment. [Figure 19] FIG. 10 is a diagram showing an example of the configuration of a routine event identification device 100 according to a second embodiment. [Figure 20] FIG. 10 is a diagram showing an example of the hardware configuration of a routine event identification device 100 according to a second embodiment. [Figure 21]10A and 10B are diagrams illustrating the processing of the seasonal division unit 210 according to the second embodiment, where FIG. 10A is a flowchart illustrating the operation of the seasonal division unit 210, and FIG. 10B is a diagram illustrating a specific example of the processing of the seasonal division unit 210. [Figure 22] FIG. 10 is a diagram showing an example of the configuration of a routine event identification device 100 according to a third embodiment. [Figure 23] FIG. 10 is a diagram showing an example of the hardware configuration of a routine event identification device 100 according to a third embodiment. [Figure 24] 11 is a flowchart showing the operation of an integration unit 310 according to the third embodiment. [Figure 25] FIG. 11 is a diagram for explaining processing by a filter unit 160 according to the third embodiment. [Figure 26] FIG. 10 is a diagram showing an example of the configuration of a routine event identification device 100 according to a fourth embodiment. [Figure 27] FIG. 10 is a diagram showing an example of the hardware configuration of a routine event identification device 100 according to a fourth embodiment. [Figure 28] 10 is a flowchart showing the operation of the filter section 160 according to the fourth embodiment. [Figure 29] 10 is a flowchart showing the operation of an update confirmation unit 410 according to the fourth embodiment. [Figure 30] FIG. 10 is a diagram showing an example of the configuration of a routine event identification device 100 according to a fifth embodiment. [Figure 31] FIG. 10 is a diagram showing an example of the hardware configuration of a routine event identification device 100 according to a fifth embodiment. [Figure 32] 13 is a flowchart showing the operation of a feedback section 510 according to the fifth embodiment. [Figure 33] 13A and 13B are diagrams for explaining the processing of the fifth embodiment, in which FIG. 13A is a diagram for explaining the processing of the feedback unit 510, and FIG. 13B is a flowchart showing the operation of the consistency analysis unit 150. [Figure 34] FIG. 20 is a diagram showing an example of the configuration of a routine event identification device 100 according to a sixth embodiment. [Figure 35] FIG. 20 is a diagram showing an example of the hardware configuration of a routine event identification device 100 according to a sixth embodiment. [Figure 36]13 is a flowchart showing the operation of a schedule information analysis unit 610 according to the sixth embodiment. [Figure 37] 13 is a flowchart showing the operation of the filter unit 160 according to the sixth embodiment. [Figure 38] FIG. 13 is a diagram showing an example of the configuration of a routine event identification device 100 according to a seventh embodiment. [Figure 39] FIG. 20 is a diagram showing an example of the hardware configuration of a routine event identification device 100 according to a seventh embodiment. [Figure 40] 13 is a flowchart showing the operation of a consolidating unit 710 according to the seventh embodiment. [Figure 41] FIG. 20 is a diagram for explaining the processing of a consolidation unit 710 according to the seventh embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0008] In the description of the embodiments and the drawings, the same elements and corresponding elements are given the same reference numerals. The description of elements given the same reference numerals will be omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, "unit" may be read as "circuit," "step," "procedure," "process," or "circuitry" as appropriate.

[0009] Embodiment 1 Hereinafter, this embodiment will be described in detail with reference to the drawings. When a user regularly performs tasks such as accessing multiple specific websites over a certain period of time, there is a possibility that a high correlation will be observed in the frequency of log entries. Therefore, in this embodiment, routine normal tasks, including those that are obvious from the content of the tasks but not obvious from the content of the tasks, are identified, a whitelist is created based on the identified normal tasks, and the created whitelist is used to reduce logs. As a specific example, routine normal tasks include access to multiple specific websites, access to multiple specific databases, and access to multiple specific tools. The present embodiment aims to efficiently analyze logs related to human behavior other than Syslog and application logs (specifically, proxy logs or authentication system logs, etc.) even when there are a large number of different types of logs. Specific examples of this embodiment are used for analysis by rule detection or analysis by anomaly detection.

[0010] ***Configuration Description*** Fig. 1 shows an example of the configuration of a routine event identification device 100 according to this embodiment. As shown in Fig. 1, the routine event identification device 100 includes an event creation unit 110, a frequency calculation unit 120, a correlation calculation unit 130, an attribute analysis unit 140, a consistency analysis unit 150, and a filter unit 160. The routine event identification device 100 also stores a time period information DB 191, a subject / object information DB 192, an attribute information DB 193, and a correlation information DB 194. DB is an abbreviation for Database. The routine event identification device 100 extracts events from logs using subject and object information, calculates correlations between the extracted events, and calculates attribute-based correlations based on the calculated correlations and attribute information. The routine event identification device 100 then compares the calculated correlations with correlations in past logs to identify routine events in a set having the same attributes. The routine event identification device 100 also streamlines analysis by excluding logs corresponding to routine events as normal logs from logs to be inspected. An event corresponds to a template. A template indicates a pair of a subject and an object. A subject is a subject related to a log. Specific examples of a subject include a user who performed an operation related to a log, an IP (Internet Protocol) address indicated by the log, or a computer that performed processing related to the log. An object corresponds to the purpose of the subject in the log, and specific examples include a domain, a server, a computer, an IP address, a process, or a file.

[0011] The event creation unit 110 receives logs as input, and divides the logs for regular time periods among the input logs by event by referring to the time period information DB 191 and the subject / object information DB 192, and outputs the divided logs for each event. A specific example of a log is a compilation of the access history of each user belonging to an organization such as a company. The log is the subject of analysis. A specific example of a log is a log collected by a SOC (Security Operation Center). The entire collected log may be referred to as a log, or a portion of the collected log may be referred to as a log. A specific example of an irregular time period is a time period when normal business operations are not performed. Specific examples of irregular time periods include lunch breaks, Saturdays, Sundays, and holidays.

[0012] The frequency calculation unit 120 receives a log for each event as input, calculates the occurrence frequency for each event in each time period based on the input log for each event, and outputs frequency information indicating the calculated frequency.

[0013] The correlation calculation unit 130 receives frequency information as input, calculates correlation values ​​between events based on the input frequency information, and outputs first correlation information indicating the calculated correlation values ​​between events.

[0014] The attribute analysis unit 140 integrates the correlations included in the target correlation group when the target correlation group satisfies the correlation condition, derives an integrated correlation, and creates second correlation information. The target correlation group consists of one or more correlations corresponding to the first target object pair among the correlations indicated by the first correlation information corresponding to each entity linked to the target attribute. The target attribute is each type of attribute associated with one of the entities indicated in the preparation log. The preparation log consists of multiple logs, each indicating a pair of an entity and an object. The preparation log may be composed of logs acquired during a time period other than an irregular time period. The first target object pair is a pair of two objects of each type corresponding to the correlation indicated by one of the first correlation information corresponding to each entity linked to the target attribute. The second correlation information is information corresponding to the target attribute and indicates each derived integrated correlation. It is assumed that there are multiple types of objects corresponding to the target entity, and a frequency vector is created for each type of object corresponding to the target entity, and the first correlation information is created. The target entity is each type of entity of one or more types of entities indicated in the preparation log. The frequency vector indicates the occurrence frequency of the object for each time period. The first correlation information indicates the correlation between each two frequency vectors corresponding to the target subject. As a specific example, attribute analysis unit 140 receives first correlation information as input, analyzes the attributes of the subjects corresponding to each piece of first correlation information by referring to attribute information DB 193, merges the correlation values ​​indicated by the first correlation information according to the analyzed attributes, and outputs second correlation information indicating the merged correlation values. The second correlation information indicates the correlation values ​​between events for each attribute.

[0015] The consistency analysis unit 150 includes information indicating the second target object pair in the routine list 151 corresponding to the target attribute when the consistency condition for the target attribute is satisfied for the second target object pair. The consistency condition is a condition based on second correlation information corresponding to the target attribute created in the past. A specific example of the consistency condition is that second correlation information corresponding to the target attribute created in the past indicates an integrated correlation corresponding to the second target object pair. The second target object pair is a pair of two objects corresponding to each integrated correlation indicated by the second correlation information corresponding to the target attribute. The operation log consists of multiple logs, each indicating a pair of a subject and an object. The operation log may be composed of logs acquired during a time period other than a non-regular time period. The routine list 151 is a list used to reduce logs from the operation log based on the correlation between objects. As a specific example, the consistency analysis unit 150 receives second correlation information as input, analyzes the consistency between past second correlation information and current second correlation information by referring to the correlation information DB 194, creates a routine list 151 based on the results of the consistency analysis, and outputs the created routine list 151. The routine list 151 is a list consisting of sets of routinized events for each attribute, i.e., sets of correlated events. A set of events is a set of objects related to a certain subject or attribute.

[0016] When two objects included in the third target object set co-occur with an excluded subject in the target log, the filter unit 160 excludes logs corresponding to both the excluded subject and the excluded object from the target log. The excluded subject is each subject linked to the target attribute. The third target object set is each set of two objects indicated by the routine list 151 corresponding to the target attribute. The excluded object is each object included in the third target object set. The target log consists of logs collected during a target time period from the operation logs. That is, the filter unit 160 refers to the routine list 151 to narrow down the logs, and outputs the narrowed down logs as filtered logs.

[0017] The time period information DB 191 is a database made up of information indicating non-regular time periods.

[0018] The subject / object information DB 192 is a database consisting of information indicating definitions of each subject and each object for each type of log.

[0019] The attribute information DB 193 is a database consisting of information indicating the attributes of each subject. A plurality of attributes may be set for each subject.

[0020] The correlation information DB 194 is a database consisting of second correlation information created in the past. The correlation information included in the correlation information DB 194 is information indicating a set of events having a relatively high corresponding correlation value, and is information corresponding to a routine event.

[0021] However, it is difficult to apply existing technologies to logs with a fixed format, such as proxy logs or authentication logs, that is, logs with a single template, because existing technologies are designed to handle logs that consist of multiple templates, such as Syslog or application logs. In the existing technology, there is only one template, so there are no other templates to correlate with. Furthermore, it is necessary to create multiple meaningful events from one template as correlation targets. Therefore, in this embodiment, a subject and an object are defined for each type of log, and multiple events (templates) are extracted from the log based on the definitions of the subject and object.

[0022] Furthermore, it is difficult to apply existing technologies to logs that contain a mixture of events from various machines, such as proxy logs or authentication system logs, because existing technologies are designed to handle logs related to programs on a single machine. Here, correlations are difficult to detect when multiple entities are mixed. It is also necessary to divide the log into meaningful units that make correlations more likely to appear. Since different people work at different times, it is difficult to detect correlations between people. Therefore, in this embodiment, the structure of the organization is taken into consideration, and correlations between events are calculated for the entire organization, sub-organization, and individual units.

[0023] Furthermore, it is difficult to apply existing technologies to logs related to human activities that tend to change, such as proxy logs or authentication logs, because existing technologies are designed to handle logs related to programs that tend not to change. Here, since the work content varies depending on the season or time of year, correlations do not appear in the work content. Furthermore, it is necessary to find events that are correlated regardless of the season or time of year, or it is necessary to find events that are correlated for each season or time of year. Therefore, in this embodiment, the correlation between events is detected by comparing the detected correlation with the correlation in past data, taking consistency into consideration.

[0024] 2 shows an example of the hardware configuration of a routine event identification device 100 according to this embodiment. The routine event identification device 100 is made up of a general computer including a processor 11 and a storage device 12. The routine event identification device 100 may be made up of multiple computers.

[0025] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of the computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The routine event localizer 100 may include multiple processors that replace the processor 11. The multiple processors share the role of the processor 11.

[0026] The storage device 12 is specifically composed of a volatile storage device and a non-volatile storage device. The storage device 12 stores a routine event identification program. The routine event identification program is a program that causes a computer to realize the functions of each unit included in the routine event identification device 100. The routine event identification program is executed by the processor 11. The functions of each unit included in the routine event identification device 100 are realized by software.

[0027] Data used when executing the routine event identification program and data obtained by executing the routine event identification program are appropriately stored in the storage device 12. Each part of the routine event identification device 100 appropriately uses the storage device 12. Note that the terms "data" and "information" may have the same meaning. The storage device 12 may be independent of the computer.

[0028] The routine event identification program may be stored in a computer-readable non-volatile recording medium, such as an optical disk or a flash memory. The routine event identification program may be provided as a program product.

[0029] ***Explanation of Operation*** The operating procedure of the routine event identification device 100 corresponds to a routine event identification method, and the program that realizes the operation of the routine event identification device 100 corresponds to a routine event identification program.

[0030] Fig. 3 shows an overview of the processing of the routine event identification device 100 during preparation. This overview will be explained using Fig. 3. During preparation, the routine event identification device 100 derives a routinized normal operation.

[0031] (Step S1) The event creating unit 110 defines a subject and an object according to the type of log, and extracts a plurality of events from the log based on the defined subject and object.

[0032] (Step S2) The frequency calculation unit 120 divides the logs for each event by time period, calculates the occurrence frequency of each object for each subject for each time period for each divided log, and creates a frequency table showing the calculated occurrence frequency for each subject. Each frequency table corresponds to frequency information and shows the occurrence frequency of each object for each subject for each time period.

[0033] (Step S3) The correlation calculation unit 130 creates a correlation matrix indicating the correlation between the objects for each subject from the frequency table. The created correlation matrix corresponds to first correlation information.

[0034] (Step S4) The attribute analysis unit 140 takes into account the structure of the organization and calculates the correlation between objects for each unit in the organization. Each unit is an appropriate division of the organization. Specific examples of each unit include the entire organization, a sub-organization, or an individual.

[0035] (Step S5) The attribute analysis unit 140 creates a correlation list indicating pairs of correlated events for each unit based on the calculated correlation. The created correlation list corresponds to second correlation information.

[0036] (Step S6) The consistency analysis unit 150 compares the created correlation list with a correlation list based on past logs for each unit, and extracts correlations between consistent objects from the created correlation list.

[0037] 4 is a flowchart showing an example of the operation of the event creating section 110. The operation of the event creating section 110 will be described with reference to FIG.

[0038] (Step S111) The event creating unit 110 reads the logs, and creates a post-exclusion log by excluding logs for non-regular time periods from the read logs with reference to the time period information DB 191. FIG. 5 shows a specific example of the post-exclusion log.

[0039] (Step S112) Based on the identifier of the log or the post-exclusion log, the event creation unit 110 acquires information corresponding to the subject and object to be used from the subject / object information DB 192. The identifier of the log is specifically written in the file name of the log. For example, the information corresponding to the subject and object is information indicating the column name or row number corresponding to each of the subject and object when the log format is CSV (Comma Separated Values). For another example, the information corresponding to the subject and object is information indicating the key value corresponding to each of the subject and object when the log format is JSON (JavaScript Object Notation) expressed as key:value.

[0040] (Step S113) The event creating unit 110 extracts unique character strings contained in the subject items from all events indicated by the post-exclusion log, without duplication.

[0041] (Step S114) The event creating unit 110 extracts unique character strings included in the items corresponding to the objects from all events indicated by the post-exclusion log, without duplication.

[0042] (Step S115) The event creation unit 110 creates one or more first divided logs by dividing the post-exclusion log in units of unique character strings of the extracted subjects. Fig. 6 shows a first divided log created by dividing the post-exclusion log for the subject USER1, as an example of the first divided log corresponding to the post-exclusion log shown in Fig. 5. The event creation unit 110 divides the post-exclusion log for each subject in the same manner.

[0043] (Step S116) The event creation unit 110 creates one or more second split logs by dividing each first split log by unique character strings of the extracted objects. The second split logs correspond to logs divided by unique words or character strings of the subjects and objects.

[0044] 7 is a flowchart showing an example of the operation of the frequency calculation section 120. The operation of the frequency calculation section 120 will be described with reference to FIG.

[0045] (Step S121) The frequency calculation unit 120 excludes the second divided logs that contain fewer events than the specified threshold. Hereinafter, when referring to second divided logs, it refers to the second divided logs that have not been excluded in this step.

[0046] (Step S122) The frequency calculation unit 120 creates one or more third divided logs by dividing each second divided log by a fixed time unit. The frequency calculation unit 120 does not have to divide each second divided log by a fixed time unit.

[0047] (Step S123) The frequency calculation unit 120 counts the number of logs included in each third divided log and creates a frequency table showing the results of counting the number of occurrences of each unique character string of the subject and object for each time period. Each column in the frequency table corresponds to a frequency vector corresponding to each object. The frequency vector is an array in which the occurrence frequency of the object is recorded in time period order. Note that if the second divided log is a log covering a period of two or more days, the frequency calculation unit 120 adds the frequencies corresponding to the logs from the second day onwards to the end of the array one day at a time. Figure 8 shows a specific example of a frequency table corresponding to a certain entity. In Figure 8, the number of occurrences of each domain is shown for each time period, and each column corresponds to a frequency vector.

[0048] Fig. 9(a) is a flowchart showing an example of the operation of the correlation calculation section 130. The operation of the correlation calculation section 130 will be described with reference to Fig. 9(a).

[0049] (Step S131) The correlation calculation unit 130 creates a correlation matrix for frequency vectors between objects for each subject. In this case, the correlation calculation unit 130 uses the Pearson correlation coefficient shown in [Equation 1] for column-to-column of the correlation matrix as a specific example. Here, x corresponds to one object (domain) and y corresponds to the other object (domain). x i indicates the frequency of access to one domain within a certain period. The certain period corresponds to each third split log. x' is x i Shows the overall average value. i indicates the frequency of access to the other domain within a certain period. y' is y i Indicates the overall average value. r indicates the correlation coefficient. Note that if the value of r is close to 1, there is a positive correlation, if the value of r is close to -1, there is a negative correlation, and if the value of r is close to 0, there is no correlation. n indicates the number of data points for each of x and y.

[0050]

number

[0051] Figure 9(b) shows a specific example of the process of deriving a correlation matrix from a frequency table. A correlation matrix is ​​a matrix that shows the correlation values ​​between objects for each subject. A collection of correlation matrices is also called a correlation table. Each time period shown in the frequency table corresponds to a target time period. In FIG. 9(b), the correlation calculation unit 130 derives a correlation value between the frequency vector of the object WEBSITE1 and the frequency vector of the object WEBSITE2.

[0052] 10 is a flowchart showing an example of the operation of the attribute analysis unit 140. The operation of the attribute analysis unit 140 will be described with reference to FIG.

[0053] (Step S141) The attribute analysis unit 140 refers to the attribute information DB 193 and groups entities linked to the same attribute for each attribute. That is, the attribute analysis unit 140 creates a group corresponding to each attribute by grouping entities having each attribute for each attribute. 11 shows a specific example of the attribute information DB 193. In this example, the organization and each sub-organization to which each subject user belongs are shown. "Entire company" and "First department" each correspond to an attribute.

[0054] (Step S142) For each group created, the attribute analysis unit 140 calculates the mean and standard deviation for each element of the correlation matrix within the group. Then, for each group, the attribute analysis unit 140 extracts a set of objects that satisfy a predetermined condition, and creates an object list A consisting of each set of extracted objects. As a specific example, the predetermined condition is that the mean is equal to or greater than a predetermined threshold θ1 and the standard deviation is less than a predetermined threshold θ2. As a specific example, if there are subjects S1, S2, and S3, and objects O1, O2, and O3, and S1, S2, and S3 belong to the same group, the attribute analysis unit 140 calculates the mean (O1·O2), mean (O1·O3), mean (O2·O3), and standard deviation (O1·O2), standard deviation (O1·O3), and standard deviation (O2·O3) as correlation information (mean and standard deviation) for each pair of objects in the group. Thereafter, the attribute analysis unit 140 adds each pair of objects for which correlation information has been calculated to object list A if both the mean and standard deviation satisfy predetermined conditions. 12 shows the process of calculating the mean and standard deviation for each element of the correlation matrix for each group using the correlation table corresponding to each entity belonging to that group. This process corresponds to merging the correlation matrices.

[0055] (Step S143) For each created group, the attribute analysis unit 140 calculates the average and standard deviation of the number of events included in the second divided log for each object within the group. Thereafter, the attribute analysis unit 140 extracts objects that satisfy a predetermined condition for each group and creates an object list B consisting of the extracted objects. As a specific example, the predetermined condition is that the average is equal to or greater than a predetermined threshold θ3 and the standard deviation is less than a predetermined threshold θ4. As a specific example, in a case where there are S1, S2, and S3 as subjects and O1 as an object, the attribute analysis unit 140 calculates the mean and standard deviation of the object O1 based on the respective frequencies of an event that is a pair of S1 and O1, an event that is a pair of S2 and O1, and an event that is a pair of S3 and O1. If the mean and standard deviation of the object O1 satisfy a predetermined condition, the attribute analysis unit 140 adds the object O1 to the object list B. The conditions described in steps S142 and S143 correspond to conditions that constitute correlation conditions.

[0056] (Step S144) The attribute analysis unit 140 excludes from object list A, for each group, any object pairs that include an object not included in object list B, and creates second correlation information indicating each object pair that is not excluded from the object pairs included in object list A. Each extracted object pair corresponds to the integrated correlation. The average value of the correlation shown in FIG. 12 corresponds to the correlation value corresponding to the integrated correlation. Here, since each user itself is also an attribute, filtering by user is possible. As a specific example, if object list A is [O1·O2, O1·O3, O2·O3] and object list B is [O1, O3], the attribute analysis unit 140 excludes O1·O2 and O2·O3 from object list A because O2 is not included in object list B, and creates [O1·O3] as the second correlation information.

[0057] 13(a) is a flowchart showing an example of the operation of the consistency analysis unit 150. The operation of the consistency analysis unit 150 will be described with reference to FIG.

[0058] (Step S151) The consistency analysis unit 150 references the correlation information DB 194 and extracts, for each attribute, a set of objects corresponding to a routine event from the second correlation information as an object to be excluded. The object to be excluded has a consistent correlation. The consistency analysis unit 150 creates a routine list 151 indicating the set of objects extracted for each attribute. As a specific example, when there is a consistent correlation between WEBSITE1 and WEBSITE4 and WEBSITE1 and WEBSITE5, which are pairs of objects, for a certain attribute, the consistency analysis unit 150 creates a list of pairs of objects such as [“WEBSITE1”:“WEBSITE4”, “WEBSITE1”:“WEBSITE5”] as a routine list 151 corresponding to the certain attribute. At this time, the correlation value corresponding to each pair of objects may be recorded in the routine list 151. That is, the consistency analysis unit 150 may create a routine list 151 such as [“WEBSITE1”:“WEBSITE4”(0.3), “WEBSITE1”:“WEBSITE5”(0.4)]. FIG. 13(b) shows a specific example of the routine list 151. FIG. 13(b) shows pairs of objects corresponding to events routinized for each attribute. Furthermore, when there is a pair of objects included in both the routine list 151 corresponding to a higher-level attribute and the routine list 151 corresponding to a lower-level attribute that is related to the higher-level attribute, the consistency analysis unit 150 deletes the pair of objects from the routine list 151 corresponding to the lower-level attribute. As a specific example, if the routine list 151 corresponding to the entire company is [“WEBSITE1”:“WEBSITE4”, “WEBSITE1”:“WEBSITE5”] and the routine list 151 corresponding to the first department is [“WEBSITE1”:“WEBSITE4”, “WEBSITE4”:“WEBSITE5”], the consistency analysis unit 150 excludes “WEBSITE1”:“WEBSITE4” from the routine list 151 corresponding to the first department. It is assumed that information indicating the hierarchical relationship between attributes is registered in the attribute information of the attribute information DB 193. As a specific example, the information is information indicating "first department ⊂ entire company" and "user ⊂ first department".

[0059] Fig. 14 shows an overview of the processing of the routine event identification device 100 during operation. This overview will be explained using Fig. 14. It is assumed that the routine list 151 has already been created.

[0060] The filter unit 160 reduces the number of logs by excluding logs corresponding to routine events from the logs collected during system operation with reference to the routine list 151. At this time, the filter unit 160 utilizes the routine list 151 as a whitelist.

[0061] Fig. 15 is a flowchart showing an example of the operation of filter unit 160. The operation of filter unit 160 will be described with reference to Fig. 15. It is assumed that event creation unit 110 divides a log during system operation into subjects and objects, thereby creating one or more second divided logs corresponding to the log.

[0062] (Step S161) The filter unit 160 receives the second divided log from the event creation unit 110, and identifies the attribute of the subject corresponding to the received second divided log by referring to the attribute information DB 193. At this time, the filter unit 160 may identify multiple attributes.

[0063] (Step S162) The filter unit 160 obtains the routine list 151 corresponding to each of the identified attributes.

[0064] (Step S163) The filter unit 160 divides the second divided log into a certain time unit to create one or more third divided logs. Each third divided log corresponds to a target log.

[0065] (Step S164) The filter unit 160 refers to each acquired routine list 151 and records a third divided log in which a pair of objects corresponding to a pair of routinized events co-occurs during a certain period of time, and each object included in the pair of co-occurring objects. A log in which a pair of objects co-occurs is a log in which both objects included in the pair of objects are included. Each recorded object is an object to be excluded from the third divided log corresponding to each recorded object. In this case, the filter unit 160 checks for objects to be excluded in order of the pair with the highest corresponding correlation value, and may exclude only objects included in the pair of objects corresponding to a correlation value exceeding a certain threshold, or may set a certain upper limit on the number of pairs of objects to be checked. As a specific example, if each object of a set of objects "WEBSITE1":"WEBSITE2" corresponding to a set of events routinized for an attribute corresponding to a certain third segment log is both included in the certain third segment log, the filter unit 160 records the ID of the certain third segment log and the objects "WEBSITE1" and "WEBSITE2" included in the set of objects. The two recorded objects are targets for exclusion related to the certain third segment log. Note that instead of each object, each log having each object may be recorded as a target for exclusion. When the filter unit 160 has finished checking the exclusion targets for all routine lists 151 acquired for all third divided logs, the process proceeds to step S165.

[0066] (Step S165) The filter unit 160 excludes from each third divided log the logs related to the recorded exclusion targets. FIG. 16 shows an example of the process of excluding logs from a certain third segment log. In this example, it is assumed that "WEBSITE1" and "WEBSITE4" are recorded as targets for exclusion. FIG. 16 shows an example of the third segment log, with the excluded logs crossed out. The excluded logs are logs that correspond to both the subject and object to be excluded.

[0067] ***Explanation of the effect of the first embodiment*** FIG. 17 is a diagram illustrating the effect of this embodiment. In anomaly detection, if embodiment 1 is not utilized, as shown in (a) of Figure 17, when the number of normal logs per day is 1 million, even if the false positive rate is 0.1%, which is a relatively high accuracy, 1,000 alerts due to false positives will be generated per day. On the other hand, by utilizing the first embodiment, as shown in (b) of FIG. 17, when the number of normal logs per day is 1 million, logs corresponding to routinized normal events are excluded from the inspection target, narrowing it down to 10,000. Therefore, according to the first embodiment, even if the false positive rate is 1%, it is possible to reduce the number of alerts due to false positives to 100 per day. Here, routinized normal events are events derived based on the correlation of the occurrence frequency between specific events in logs. Creating and managing routinized normal events is easier than using a normal whitelist. Furthermore, with the conventional technology, the amount of logs is so large that it exceeds the allowable amount of logs that can be used for learning anomaly detection, resulting in a problem of reduced accuracy in anomaly detection. On the other hand, with the first embodiment, the amount of logs can be reduced to below the allowable amount by filtering.

[0068] ***Other Configurations*** <Variation 1> FIG. 18 shows an example of the hardware configuration of a routine event identification device 100 according to this modification. The routine event localizer 100 includes a processing circuit 18 in place of the processor 11 or the processor 11 and the storage device 12 . The processing circuit 18 is hardware that realizes at least a part of each unit of the routine event identification device 100 . The processing circuitry 18 may be dedicated hardware, or may be a processor that executes a program stored in the storage device 12 .

[0069] When processing circuitry 18 is dedicated hardware, processing circuitry 18 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The routine event localizer 100 may include multiple processing circuits that replace the processing circuit 18. The multiple processing circuits share the role of the processing circuit 18.

[0070] In the routine event localization device 100, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0071] Processing circuitry 18 is illustratively implemented in hardware, software, firmware, or a combination thereof. The processor 11, the memory device 12, and the processing circuit 18 are collectively referred to as "processing circuitry." That is, the functions of the functional components of the routine event localization device 100 are realized by the processing circuitry. The routine event identification device 100 according to other embodiments may also have a configuration similar to that of this modified example.

[0072] Embodiment 2 The following mainly describes the differences from the above-described embodiment with reference to the drawings.

[0073] ***Configuration Description*** 19 shows an example of the configuration of the routine event identification device 100 according to this embodiment. The routine event identification device 100 further includes a seasonal division unit 210, and further stores a seasonal information DB 291.

[0074] The seasonal division unit 210 divides the frequency information based on seasonal information. The seasonal information is information indicating a season or a specific period, such as four seasons, the first half of the year, the second half of the year, or a busy season. Each of the seasons and specific periods is a target period, and is a period divided according to the similarity of business trends. In this embodiment, each frequency vector corresponding to a target entity is a vector corresponding to logs collected during each target period. Operation logs according to this embodiment are logs collected during each target period.

[0075] The season information DB 291 is a database made up of season information.

[0076] 20 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0077] ***Explanation of Operation*** Fig. 21(a) is a flowchart showing an example of the operation of the seasonal division unit 210. The operation of the seasonal division unit 210 will be explained using Fig. 21(a).

[0078] (Step S211) The seasonal division unit 210 refers to the seasonal information DB 291 and divides each piece of frequency information based on the timestamp (or time zone information) indicated by each piece of frequency information and the seasonal information. As a specific example, if the seasonal information defines the first half of the year (April to September), the second half of the year (October to February), and the busy season (March), the seasonal division unit 210 divides each piece of frequency information into information for three periods according to the seasonal information, as shown in (b) of Figure 21. The subsequent processes (the processes of the correlation calculation unit 130, the attribute analysis unit 140, the consistency analysis unit 150, and the filter unit 160) are basically the same as those in embodiment 1. However, each process is performed in units divided by seasonal information.

[0079] ***Explanation of the effect of the second embodiment*** In logs related to human behavior other than syslog or application logs (for example, proxy logs or authentication system logs), trends may change depending on the time of year (first half, second half, busy season, etc.). Therefore, if logs related to all periods are treated together, it may not be possible to calculate correlations appropriately. According to this embodiment, the log is divided based on information about the seasonality of predefined tasks, and then the correlation is calculated. Therefore, according to this embodiment, the accuracy of the correlation can be improved. In other words, according to this embodiment, by calculating the correlation with a relatively high degree of accuracy from logs whose trends change depending on the season, it is possible to more appropriately identify routinized events.

[0080] Embodiment 3 The following mainly describes the differences from the above-described embodiment with reference to the drawings.

[0081] ***Configuration Description*** 22 shows an example of the configuration of the routine event identification device 100 according to this embodiment. The routine event identification device 100 further includes an integration unit 310.

[0082] The integration unit 310 selects one or more sets of integrated correlations from the integrated correlations shown in the routine list 151 corresponding to the target attribute based on relevance, sets each of the selected sets of integrated correlations as a target correlation set, and creates one or more integrated object groups by integrating the integrated correlations included in the target correlation set. The integration unit 310 also deletes each pair of two objects corresponding to the target correlation set from the routine list 151 corresponding to the target attribute, and adds one or more integrated object groups corresponding to the target correlation set to the routine list 151 corresponding to the target attribute, thereby creating an integrated routine list 311 corresponding to the target attribute. An integrated object group consists of two or more objects corresponding to the target correlation set. As a specific example, the integration unit 310 creates the integrated routine list 311 by appropriately integrating sets of objects indicated by the routine list 151 based on the correlation structure. The sets of objects to be integrated are sets of objects that are related to each other. By the integration unit 310 appropriately integrating routinized events (objects) that are in a co-occurring relationship based on correlation, the conditions for determining whether a routine is a normal operation can be made stricter, thereby improving the accuracy of exclusion.

[0083] The filter unit 160 according to this embodiment uses an integrated routine list 311 instead of the routine list 151 . Specifically, when all objects included in the target integrated object group co-occur with the excluded subject in the target logs collected during the target time period among the operation logs, the filter unit 160 excludes logs corresponding to both the excluded subject and the excluded subject from the target logs. The target integrated object group is each integrated object group indicated by the integrated routine list 311 corresponding to the target attribute. The excluded subject is each subject linked to the target attribute. The excluded object is each object included in the target integrated object group.

[0084] 23 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0085] ***Explanation of Operation*** 24 is a flowchart showing an example of the operation of the integrating section 310. The operation of the integrating section 310 will be described with reference to FIG.

[0086] (Step S311) The integration unit 310 identifies, for each routine list 151, one or more sets of objects that can be integrated.

[0087] (Step S312) The integration unit 310 creates an integrated routine list 311 by integrating a plurality of sets of objects for each identified set in each routine list 151 .

[0088] The following is a specific description of the processing performed by the integration unit 310. As a specific example, assume that the routine list 151 is [“A”:“B”, “B”:“C”, “C”:“A”, “A”:“D”, “B”:“E”, “C”:“F”]. The following two methods are described as specific examples of methods for identifying a set of multiple objects that can be merged, but other methods may also be used.

[0089] [Method 1] When "A":"B" ("A" and "B" are correlated) and "B":"C" ("B" and "C" are correlated), the integration unit 310 determines that "A":"C" ("A" and "C" are also expected to be correlated) and identifies "A":"B" and "B":"C" as pairs of objects that can be integrated. In this case, the integration unit 310 integrates the identified pair of objects with "A":"B":"C". When the integration unit 310 applies [Method 1] to the routine list 151 according to the above example, it creates a list that integrates all sets of objects, such as ["A":"B":"C":"D":"E":"F"], as the integrated routine list 311. The elements of the created list correspond to integrated object groups.

[0090] [Method 2] [Method 2] is more accurate in terms of correlation compared to [Method 1]. When "A":"B" ("A" and "B" are correlated), and "B":"C" ("B" and "C" are correlated), and "A":"C" ("A" and "C" are correlated), the integration unit 310 identifies "A":"B", "B":"C", and "A":"C" as sets of multiple objects that can be integrated. In this case, the integration unit 310 integrates the identified set of objects with "A":"B":"C". When the integration unit 310 employs [Method 2] for the routine list 151 according to the above example, it creates an integrated routine list 311 by integrating some pairs, such as ["A":"B":"C", "A":"D", "B":"E", "C":"F"]. "A":"B":"C" corresponds to the integrated object group. In this case, the object correlation pair consists of "A":"B", "B":"C", and "C":"A".

[0091] The integration unit 310 may record the correlation values ​​corresponding to each pair together, i.e., the integration unit 310 may create an integrated routine list 311 such as [“A”:“B”:“C”:0.5,“A”:“D”,“B”:“E”:0.4,“C”:“F”:0.6]. The correlation value of the integrated object pair is, for example, a value calculated from the average, minimum, or maximum of the correlation values ​​of the multiple pairs before integration.

[0092] The operation of the filter unit 160 will now be described.

[0093] (Step S164) This step is the same as step S164 according to embodiment 1. However, when all objects included in a set of objects indicated by integrated routine list 311 corresponding to a certain third split log are included in the certain third split log, filter unit 160 records each of the objects included in the set of objects (for example, "WEBSITE1", "WEBSITE4", and "WEBSITE7") as targets to be excluded. At this time, logs are excluded as shown in FIG. 25 as a specific example.

[0094] ***Explanation of the effect of the third embodiment*** As described above, according to this embodiment, related event sets are integrated in a list showing sets of routine events for each attribute. Therefore, according to this embodiment, the number of conditions increases through integration, making it possible to detect routine tasks that are subject to exclusion with higher accuracy.

[0095] Embodiment 4 The following mainly describes the differences from the above-described embodiment with reference to the drawings. In the above-described embodiment, it was assumed that the information on routine events and past correlation information were prepared in advance and used. In this embodiment, the timing for updating this information is determined depending on the increase or decrease in the amount of routine events to be reduced from the log.

[0096] ***Configuration Description*** 26 shows an example of the configuration of the routine event identification device 100 according to this embodiment. The routine event identification device 100 further includes an update confirmation unit 410.

[0097] The update confirmation unit 410 instructs updating of information on routine events and past correlation information at appropriate timing according to the latest trends in the logs being used. As a specific example, the update confirmation unit 410 determines whether to update the routine list 151 corresponding to the target attribute based on the track record of logs being excluded from the operation log using the routine list 151 corresponding to the target attribute.

[0098] The filter unit 160 according to this embodiment creates and updates filtering result information. The filtering result information is information indicating the results of filtering performed by the filter unit 160.

[0099] 27 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0100] ***Explanation of Operation*** 28 is a flowchart showing an example of the operation of the filter section 160. The operation of the filter section 160 will be described with reference to FIG.

[0101] (Step S166) The filter unit 160 counts the number of sets of routinized events that have been excluded from the log for each routine list 151, and updates the filtering performance information based on the counting result. As a specific example, the filtering performance information is information that indicates, for each routine list 151, the number of times that routine information has been deleted so far (the number of divided logs that have been deleted), the total amount of logs that have been deleted so far, the average amount of logs that have been deleted so far, the standard deviation of the amount of logs that have been deleted so far, a threshold value, the number of times that routine information has been deleted this time, and the average amount of logs that have been deleted this time.

[0102] 29 is a flowchart showing an example of the operation of the update confirmation unit 410. The operation of the update confirmation unit 410 will be described with reference to FIG.

[0103] (Step S411) The update confirmation unit 410 confirms the filtering performance information for each group of events indicated by each routine list 151.

[0104] (Step S412) The update confirmation unit 410 calculates the difference (absolute value) between the average amount of logs that have been reduced so far and the average amount of logs that have been deleted this time for each group of events indicated by each routine list 151, and checks whether the calculated difference exceeds the specified threshold A. The threshold A may be a predetermined value or may be a dynamically determined value. A specific example of the dynamically determined threshold A is 3×(standard deviation of the amount of logs deleted so far for each routine list 151).

[0105] (Step S413) The update confirmation unit 410 instructs the event creation unit 110 to update the information on routine events and past correlation information when the number of pairs of events whose corresponding difference exceeds threshold A is equal to or greater than a specified threshold B. In other words, the update confirmation unit 410 instructs the event creation unit 110 to re-execute the preparation process. Here, threshold B is assumed to be predetermined. The update confirmation unit 410 may instruct only updating of the routine list 151 and past correlation information corresponding to a certain attribute.

[0106] ***Explanation of the effect of the fourth embodiment*** As described above, according to this embodiment, the routine event information and past correlation information are updated according to the amount of routine events that are deleted, so that this embodiment can dynamically adapt to the latest trends.

[0107] Embodiment 5. The following mainly describes the differences from the above-described embodiment with reference to the drawings. In the above-described embodiment, pairs of correlated events that are not included in past correlation information are not subject to filtering. Therefore, in this embodiment, feedback is applied to the correlation between events, regardless of whether they are included in past correlation information, and pairs of events that have a correlation exceeding a specified threshold after the feedback are filtered.

[0108] ***Configuration Description*** 30 shows an example of the configuration of the routine event identification apparatus 100 according to this embodiment. The routine event identification apparatus 100 further includes a feedback section 510.

[0109] The feedback unit 510 corrects the current correlation information based on the past correlation information, and the corrected current correlation information is used by the consistency analyzer 150. The feedback unit 510 corrects each correlation value indicated by the generated second correlation information corresponding to the target attribute based on second correlation information corresponding to the target attribute generated in the past, thereby generating fed-back correlation information corresponding to the target attribute. As a specific example, the feedback unit 510 corrects each correlation value based on whether the second correlation information corresponding to the target attribute generated in the past indicates a pair of two objects corresponding to each correlation value. In this embodiment, the second correlation information corresponding to the target attribute indicates a correlation value corresponding to each integrated correlation for the target attribute.

[0110] The consistency condition according to this embodiment is that the correlation value corresponding to the second target object pair in the fed-back correlation information corresponding to the target attribute is equal to or greater than a correlation threshold. The correlation threshold may be determined in any manner.

[0111] 31 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0112] ***Explanation of Operation*** 32 is a flowchart showing an example of the operation of feedback section 510. The operation of feedback section 510 will be described with reference to FIG.

[0113] (Step S511) The feedback unit 510 refers to the correlation information between events from the correlation table for each attribute.

[0114] (Step S512) The feedback unit 510 updates the correlation information between events obtained this time based on past correlation information with reference to the correlation information DB 194. A specific example of the update method is shown below. If a correlation between certain events has already been registered in the correlation information DB 194, the feedback unit 510 positively corrects the correlation between the certain events. At this time, the feedback unit 510 adds a specified value α to the correlation value obtained this time for the certain event. Note that the upper limit of the correlation value after the addition is 1.0. If a correlation between certain events is not registered in the correlation information DB 194, the feedback unit 510 performs a negative correction on the correlation between the certain events. At this time, the feedback unit 510 subtracts a specified value β from the correlation value obtained this time for the certain event. Note that the lower limit of the correlation value after subtraction is set to 0.0. FIG. 33(a) shows a specific example of correlation information for each set of events updated for each attribute.

[0115] (Step S513) The feedback section 510 registers the information indicating the correlation between the events obtained this time as past correlation information in the correlation information DB 194. At this time, the feedback section 510 may also register information indicating the updated correlation value in the correlation information DB 194.

[0116] Figure 33(b) is a flowchart showing an example of the operation of the consistency analysis unit 150. The operation of the consistency analysis unit 150 will be described using Figure 33(b).

[0117] (Step S152) For each attribute, the consistency analysis unit 150 considers an event to be routine for that attribute if the correlation value of the set of events for that attribute (after update by the feedback unit 510) exceeds a predetermined threshold. As a specific example, when the correlation threshold is 0.35, if the correlation information (after feedback) corresponding to candidate pairs of objects corresponding to events for a certain attribute is [“WEBSITE1”:“WEBSITE2”:(0.3), “WEBSITE1”:“WEBSITE4”:(0.4)], only the pair of events corresponding to [“WEBSITE1”:“WEBSITE4”:(0.4)] is considered to be a pair of events routinized for the certain attribute.

[0118] ***Explanation of the effect of the fifth embodiment*** As described above, according to this embodiment, it is possible to filter out pairs of events that are not included in past correlation information.

[0119] Embodiment 6 The following mainly describes the differences from the above-described embodiment with reference to the drawings. In the above-described embodiment, it is expected that events with a small absolute number are difficult to extract as routine events because it is difficult to obtain a high correlation for these events. Therefore, in this embodiment, the purpose is to extract events with a small absolute number as routine events by referencing schedule information from a schedule management system or the like and calculating the correlation between events during limited time periods such as meetings.

[0120] ***Configuration Description*** 34 shows an example of the configuration of the routine event identification device 100 according to this embodiment. The routine event identification device 100 further includes a schedule information analysis unit 610.

[0121] The schedule information analysis unit 610 analyzes the schedule information registered in the schedule management system and divides the log into items corresponding to the schedules based on the analysis results. Schedule information is, for example, information indicating the name, time period, participants (for example, participants in a meeting), and identifier (for example, a meeting ID) for each schedule. An item is a group of identical schedules. In this embodiment, each frequency vector corresponding to a target entity is a vector corresponding to logs collected during a time period corresponding to a target schedule that is periodically implemented. The time period corresponding to a target schedule may refer to a certain time period on the day of the week or date on which the target schedule is implemented. The target schedule does not always have to be implemented during the same time period, or on the same day of the week. The operation log according to this embodiment is made up of logs collected during a time period corresponding to the target schedule. Each target schedule corresponds to each item.

[0122] The filter unit 160 according to this embodiment uses, as the routine list 151 corresponding to each attribute, a list indicating information created based on an item in addition to the information indicated by the routine list 151 described above.

[0123] 35 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0124] ***Explanation of Operation*** 36 is a flowchart showing an example of the operation of the schedule information analysis unit 610. The operation of the schedule information analysis unit 610 will be described with reference to FIG.

[0125] (Step S611) The schedule information analysis unit 610 collects schedule information for each user from the schedule management system.

[0126] (Step S612) During preparation, the schedule information analysis unit 610 extracts, for each user, multiple schedules that are considered to be identical scheduled tasks based on the similarity of schedule names, etc., as items. Specific examples of identity between multiple schedules include character string edit distance or cosine similarity between vector representations of words obtained from Word2Vec, etc. The schedule information analysis unit 610 may extract multiple schedules as items when the same identifier is assigned to multiple schedules in a schedule. The schedule information analysis unit 610 may extract multiple schedules as items when the same participants are listed in multiple schedules in a schedule.

[0127] During operation, the schedule information analysis unit 610 extracts items that are considered to be the same scheduled work based on the similarity of the item names and schedule names of the items merged between users during preparation. The method of extracting items is the same as during preparation.

[0128] (Step S613) This step is executed during preparation. The schedule information analysis unit 610 merges the items extracted for each user between users. In this case, the schedule information analysis unit 610 merges items based on matches between item names, scheduled time periods, schedule identifiers, etc. If a schedule includes participant information, the schedule information analysis unit 610 may merge multiple items based on the participant information.

[0129] (Step S614) This step is executed during preparation. For each merged item, the schedule information analysis unit 610 registers the item as an attribute and each user associated with the item in the attribute information DB 193.

[0130] (Step S615) The schedule information analysis unit 610 divides the log for each merged item based on the time period and subject corresponding to the item. Each unit performs processing based on the divided log. The logs divided in this step are used to extract events that are routine events but have a small absolute number.

[0131] The frequency calculation unit 120 according to this embodiment does not execute the process of step S121, taking into consideration that the absolute number of events is small.

[0132] 37 is a flowchart showing an example of the operation of the filter section 160. The operation of the filter section 160 will be described with reference to FIG.

[0133] (Step S162) This step is basically the same as the above-mentioned step S162. However, when a set of events whose corresponding attribute is an item exists in the acquired routine list 151, the filter unit 160 acquires item information corresponding to the set of events.

[0134] (Step S164) This step is basically the same as the above-mentioned step S164. However, when using a set of events corresponding to an attribute that is an item, the filter unit 160 checks whether or not a set of objects indicated by the set of events co-occurs only for logs acquired during a time period indicated by item information corresponding to the attribute. In other words, in this case, the condition for exclusion is imposed that logs acquired during a time period corresponding to the attribute be included.

[0135] ***Explanation of the effect of the sixth embodiment*** As described above, according to this embodiment, even routine events with a small absolute number can be extracted as routine events and excluded.

[0136] Embodiment 7 The following mainly describes the differences from the above-described embodiment with reference to the drawings. In the first embodiment, sets of routine events are deleted from the log. On the other hand, in the present embodiment, sets of routine events are consolidated into one log instead of being deleted, thereby reducing the amount of logs.

[0137] ***Configuration Description*** 38 shows an example of the configuration of the routine event identification device 100 according to this embodiment. The routine event identification device 100 includes an aggregation unit 710 instead of the filter unit 160.

[0138] The aggregation unit 710 aggregates multiple logs corresponding to each set of routine events. Specifically, when two objects included in the third target object set co-occur with respect to an excluded subject in target logs collected during a target time period among operation logs, the aggregation unit 710 creates an aggregated log by aggregating logs corresponding to both the excluded subject and each object included in the third target object set in the target logs, and excludes logs corresponding to both the excluded subject and each object included in the third target object set from the target log. The aggregation unit 710 also adds each aggregated log created for the target log to the target log. The third target object set is a set of two objects indicated by the routine list 151 corresponding to the target attribute. The excluded subject is each subject linked to the target attribute.

[0139] 39 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0140] ***Explanation of Operation*** 40 is a flowchart showing an example of the operation of aggregation section 710. The operation of aggregation section 710 will be described with reference to FIG.

[0141] (Step S711) This step is similar to step S161.

[0142] (Step S712) This step is similar to step S162.

[0143] (Step S713) This step is similar to step S163.

[0144] (Step S714) This step is basically the same as step S164. However, for each pair of routine events (e.g., a pair corresponding to "WEBSITE1" and "WEBSITE2"), if both the objects included in the pair of events for each subject corresponding to the pair of events are included in the third divided log, the aggregation unit 710 records the logs corresponding to both the subjects corresponding to the pair of events and their objects as aggregation targets, and creates an aggregated log indicating that the aggregation targets have been aggregated. Each aggregated log corresponds to one of the pair of events. For example, the aggregated log is information indicating each object corresponding to the aggregation target in alphabetical order, such as "WEBSITE1:WEBSITE2," as object information, and a timestamp calculated from the log corresponding to the aggregation target as a timestamp. For example, the calculated timestamp is the average, minimum, or maximum of the timestamps of the logs corresponding to the aggregation target. When the aggregation unit 710 has finished checking the aggregation targets for all the routine lists 151 corresponding to each of the third divided logs for all the third divided logs, the process proceeds to step S715.

[0145] (Step S715) The aggregation unit 710 inserts the aggregated log into the third divided log based on the recorded aggregation target for each third divided log, and deletes each log corresponding to the aggregation target from the third divided log. FIG. 41 shows a specific example of the processing of the aggregation unit 710. The upper part of FIG. 41 shows an example of a third divided log, with each log corresponding to an aggregation target underlined. The lower part of FIG. 41 shows an aggregated log underlined. In this example, the object pairs corresponding to the routinized event pair for the subject USER1 are "WEBSITE1" and "WEBSITE4," and "WEBSITE1" and "WEBSITE8." These object pairs correspond to the third target object pair. Furthermore, the maximum value of the timestamps indicated by the logs corresponding to the aggregation targets corresponding to each event pair is used as the timestamp for the aggregated log corresponding to each event pair. The aggregation unit 710 similarly aggregates logs for each event pair as appropriate. In FIG. 41, for the target log, logs corresponding to both the excluded subject and each object included in the third target object pair are aggregated.

[0146] ***Explanation of the effect of the seventh embodiment*** As described above, according to this embodiment, by aggregating multiple logs corresponding to a set of routine events into a single log, it is possible to reduce the amount of logs to be analyzed while still retaining records of routine events that occurred during abnormal time periods.

[0147] ***Other embodiments*** The above-described embodiments may be freely combined, or any of the components in each embodiment may be modified, or any of the components in each embodiment may be omitted. Furthermore, the embodiments are not limited to those shown in the first to seventh embodiments, and various modifications are possible as necessary. The procedures explained using flowcharts and the like may be modified as appropriate.

[0148] Various aspects of the present disclosure are summarized below as appendices.

[0149] (Appendix 1) When each type of subject of one or more types of subjects indicated in a preparation log consisting of a plurality of logs each indicating a pair of a subject and an object is set as a target subject, there are a plurality of object types corresponding to the target subjects, a frequency vector indicating the occurrence frequency of the object for each time period for each object type corresponding to the target subjects is created, and first correlation information indicating the correlation between each two frequency vectors corresponding to the target subjects is created, an attribute analysis unit that, when each type of attribute associated with any of the entities indicated in the preparation log is taken as a target attribute and a pair of two objects of each type corresponding to a correlation indicated by any of the first correlation information corresponding to each entity associated with the target attribute is taken as a first target object pair, integrates correlations included in the target correlation group to derive an integrated correlation when a target correlation group consisting of one or more correlations corresponding to the first target object pair among the correlations indicated by the first correlation information corresponding to each entity associated with the target attribute satisfies a correlation condition, and creates second correlation information that is information corresponding to the target attribute and indicates each of the derived integrated correlations; a consistency analysis unit that, when a pair of two objects corresponding to each post-integration correlation indicated by the second correlation information corresponding to the target attribute is defined as a second target object pair, if a consistency condition based on the second correlation information corresponding to the target attribute created in the past is satisfied for the second target object pair, includes information indicating the second target object pair in a routine list that is a list corresponding to the target attribute and is used to reduce logs based on correlations between objects from an operation log consisting of a plurality of logs each indicating a pair of a subject and an object; A routine event identification device comprising:

[0150] (Appendix 2) The routine event identification device of Appendix 1, wherein the consistency condition is that second correlation information corresponding to the target attribute created in the past indicates a post-integration correlation corresponding to the second target object set.

[0151] (Appendix 3) The routine event specific device further comprises: a filter unit that, when a set of two objects indicated in a routine list corresponding to the target attribute is defined as a third target object set and each entity linked to the target attribute is defined as an excluded target entity, defines each object included in the third target object set as an excluded target object when two objects included in the third target object set co-occur with the excluded target entity in a target log collected during a target time period among the operation logs, and excludes logs corresponding to both the excluded target entity and the excluded target object from the target log. 3. The routine event identification device of claim 1 or 2, comprising:

[0152] (Appendix 4) The preparation time log is made up of logs acquired during a time period other than a non-regular time period, 4. A routine event identification device according to claim 3, wherein the operational logs consist of logs acquired during time periods other than the non-regular time periods.

[0153] (Appendix 5) Each frequency vector corresponding to the target entity is a vector corresponding to logs collected during a target period divided according to the sameness of the business content trends, 5. A routine event identification device according to claim 3 or 4, wherein the operational logs are logs collected during the target period.

[0154] (Appendix 6) The routine event specific device further comprises: an update confirmation unit that determines whether to update the routine list corresponding to the target attribute based on the results of logs being excluded from the operation log by utilizing the routine list corresponding to the target attribute; 6. The routine event localizer of any one of claims 3 to 5, comprising:

[0155] (Appendix 7) Each frequency vector corresponding to the target subject is a vector corresponding to logs collected during a time period corresponding to a target schedule that is periodically implemented, A routine event identification device according to any one of appendices 3 to 6, wherein the operational log is composed of logs collected during a time period corresponding to the target schedule.

[0156] (Appendix 8) The routine event specific device further comprises: Selecting one or more sets of integrated correlations from the integrated correlations indicated in the routine list corresponding to the target attribute based on relevance, setting each of the selected sets of integrated correlations as a target correlation set, and creating one or more integrated object groups consisting of two or more objects corresponding to the target correlation set by integrating the integrated correlations included in the target correlation set; an integration unit that creates an integrated routine list corresponding to the target attribute by deleting each pair of two objects corresponding to the target correlation pair from a routine list corresponding to the target attribute and adding one or more integrated object groups corresponding to the target correlation pair to a routine list corresponding to the target attribute; a filter unit that, when each integrated object group indicated by the integrated routine list corresponding to the target attribute is defined as a target integrated object group and each entity linked to the target attribute is defined as an excluded object, if all objects included in the target integrated object group co-occur with the excluded entity in the target log collected during a target time period among the operation logs, defines each object included in the target integrated object group as an excluded object and excludes logs corresponding to both the excluded entity and the excluded object from the target log; 3. The routine event identification device of claim 1 or 2, comprising:

[0157] (Appendix 9) The second correlation information corresponding to the target attribute indicates a correlation value corresponding to each integrated correlation, The routine event specific device further comprises: a feedback unit that generates fed-back correlation information corresponding to the target attribute by correcting each correlation value indicated by the generated second correlation information corresponding to the target attribute based on second correlation information corresponding to the target attribute that was generated in the past; Equipped with The routine event identification device of Appendix 1, wherein the consistency condition is that in the fed-back correlation information corresponding to the target attribute, the correlation value corresponding to the second target object set is greater than or equal to a correlation threshold.

[0158] (Appendix 10) The routine event specific device further comprises: When a pair of two objects indicated in the routine list corresponding to the target attribute is defined as a third target object pair, and each entity linked to the target attribute is defined as an excluded target entity, if two objects included in the third target object pair co-occur with the excluded target entity in the target logs collected during a target time period among the operation logs, an aggregated log is created by aggregating logs corresponding to both the excluded target entity and each object included in the third target object pair in the target logs, and logs corresponding to both the excluded target entity and each object included in the third target object pair are excluded from the target logs; an aggregation unit that adds each aggregated log created for the target log to the target log; 3. The routine event identification device of claim 1 or 2, comprising: [Explanation of symbols]

[0159] 11 processor, 12 storage device, 18 processing circuit, 100 routine event identification device, 110 event creation unit, 120 frequency calculation unit, 130 correlation calculation unit, 140 attribute analysis unit, 150 consistency analysis unit, 151 routine list, 160 filter unit, 191 time zone information DB, 192 subject-object information DB, 193 attribute information DB, 194 correlation information DB, 210 seasonal division unit, 291 seasonal information DB, 310 integration unit, 311 integrated routine list, 410 update confirmation unit, 510 feedback unit, 610 schedule information analysis unit, 710 aggregation unit.

Claims

1. When each type of subject of one or more types of subjects indicated in a preparation log consisting of a plurality of logs each indicating a pair of a subject and an object is set as a target subject, there are a plurality of object types corresponding to the target subjects, a frequency vector indicating the occurrence frequency of the object for each time period for each type of object corresponding to the target subjects is created, and first correlation information indicating the correlation between each two frequency vectors corresponding to the target subjects is created, an attribute analysis unit that, when each type of attribute associated with any of the subjects indicated in the preparation log is set as a target attribute and a pair of two objects of each type corresponding to a correlation indicated by any of the first correlation information corresponding to each of the subjects associated with the target attribute is set as a first target object pair, integrates correlations included in the target correlation group to derive an integrated correlation when a target correlation group consisting of one or more correlations corresponding to the first target object pair among the correlations indicated by the first correlation information corresponding to each of the subjects associated with the target attribute satisfies a correlation condition, and creates second correlation information that is information corresponding to the target attribute and indicates each of the derived integrated correlations; a consistency analysis unit that, when a set of two objects corresponding to each post-integration correlation indicated by the second correlation information corresponding to the target attribute is defined as a second target object set, if a consistency condition based on the second correlation information corresponding to the target attribute created in the past is satisfied for the second target object set, includes information indicating the second target object set in a routine list that is a list corresponding to the target attribute and is used to reduce logs based on correlations between objects from an operation log consisting of a plurality of logs each indicating a pair of a subject and an object; A routine event identification device comprising:

2. 2. The routine event identification device of claim 1, wherein the consistency condition is that second correlation information corresponding to the target attribute created in the past indicates a post-integration correlation corresponding to the second target object set.

3. The routine event specific device further comprises: a filter unit that, when a set of two objects indicated in a routine list corresponding to the target attribute is defined as a third target object set and each entity linked to the target attribute is defined as an excluded target entity, sets each object included in the third target object set as an excluded target object when two objects included in the third target object set co-occur with the excluded target entity in a target log collected during a target time period among the operation logs, and excludes logs corresponding to both the excluded target entity and the excluded target object from the target log.

3. A routine event localization device according to claim 1 or 2, comprising:

4. The preparation time log is made up of logs acquired during a time period other than a non-regular time period, 4. The routine event identification device according to claim 3, wherein the operation logs are logs acquired during a time period other than the non-regular time period.

5. Each frequency vector corresponding to the target entity is a vector corresponding to logs collected during a target period divided according to the sameness of the business content trends, 4. The routine event identification device according to claim 3, wherein the operation logs are logs collected during the target period.

6. The routine event specific device further comprises: an update confirmation unit that determines whether to update the routine list corresponding to the target attribute based on the results of logs being excluded from the operation log by utilizing the routine list corresponding to the target attribute; 4. The routine event localizer of claim 3, comprising:

7. Each frequency vector corresponding to the target subject is a vector corresponding to logs collected during a time period corresponding to a target schedule that is periodically implemented, 4. The routine event identification device according to claim 3, wherein the operation logs are logs collected during a time period corresponding to the target schedule.

8. The routine event specific device further comprises: Selecting one or more sets of integrated correlations from the integrated correlations indicated in the routine list corresponding to the target attribute based on relevance, setting each of the selected sets of integrated correlations as a target correlation set, and creating one or more integrated object groups consisting of two or more objects corresponding to the target correlation set by integrating the integrated correlations included in the target correlation set; an integration unit that creates an integrated routine list corresponding to the target attribute by deleting each pair of two objects corresponding to the target correlation pair from a routine list corresponding to the target attribute and adding one or more integrated object groups corresponding to the target correlation pair to a routine list corresponding to the target attribute; a filter unit that, when each integrated object group indicated by the integrated routine list corresponding to the target attribute is defined as a target integrated object group and each entity linked to the target attribute is defined as an excluded object, if all objects included in the target integrated object group co-occur with the excluded entity in the target log collected during a target time period among the operation logs, defines each object included in the target integrated object group as an excluded object and excludes logs corresponding to both the excluded entity and the excluded object from the target log; 3. A routine event localization device according to claim 1 or 2, comprising:

9. the second correlation information corresponding to the target attribute indicates a correlation value corresponding to each integrated correlation; The routine event specific device further comprises: a feedback unit that generates fed-back correlation information corresponding to the target attribute by correcting each correlation value indicated by the generated second correlation information corresponding to the target attribute based on second correlation information corresponding to the target attribute that was generated in the past; Equipped with The routine event identification device of claim 1 , wherein the consistency condition is that a correlation value corresponding to the second target object pair in the fed-back correlation information corresponding to the target attribute is equal to or greater than a correlation threshold.

10. The routine event specific device further comprises: When a pair of two objects indicated in a routine list corresponding to the target attribute is defined as a third target object pair, and each entity linked to the target attribute is defined as an excluded target entity, if two objects included in the third target object pair co-occur with the excluded target entity in the target logs collected during a target time period among the operation logs, an aggregated log is created by aggregating logs corresponding to both the excluded target entity and each object included in the third target object pair in the target logs, and logs corresponding to both the excluded target entity and each object included in the third target object pair are excluded from the target logs, an aggregation unit that adds each aggregated log created for the target log to the target log; 3. A routine event localization device according to claim 1 or 2, comprising:

11. When each type of subject of one or more types of subjects indicated in a preparation log consisting of a plurality of logs each indicating a pair of a subject and an object is set as a target subject, there are a plurality of object types corresponding to the target subjects, a frequency vector indicating the occurrence frequency of the object for each time period for each type of object corresponding to the target subjects is created, and first correlation information indicating the correlation between each two frequency vectors corresponding to the target subjects is created, When the computer sets each type of attribute associated with any of the subjects indicated in the preparation log as a target attribute, and sets each type of two objects corresponding to a correlation indicated by any of the first correlation information corresponding to each of the subjects associated with the target attribute as a first target object set, if a target correlation group consisting of one or more correlations corresponding to the first target object set among the correlations indicated by the first correlation information corresponding to each of the subjects associated with the target attribute satisfies a correlation condition, the computer integrates the correlations included in the target correlation group to derive an integrated correlation, and creates second correlation information which is information corresponding to the target attribute and indicates each of the derived integrated correlations, A method for identifying routine events, in which when the computer defines a pair of two objects corresponding to each integrated correlation indicated by the second correlation information corresponding to the target attribute as a second target object pair, if a consistency condition, which is a condition based on the second correlation information corresponding to the target attribute created in the past, is satisfied for the second target object pair, the computer includes information indicating the second target object pair in a routine list, which is a list corresponding to the target attribute and is used to reduce logs based on correlations between objects from an operational log consisting of multiple logs each indicating a pair of a subject and an object.

12. When each type of subject of one or more types of subjects indicated in a preparation log consisting of a plurality of logs each indicating a pair of a subject and an object is set as a target subject, there are a plurality of object types corresponding to the target subjects, a frequency vector indicating the occurrence frequency of the object for each time period for each type of object corresponding to the target subjects is created, and first correlation information indicating the correlation between each two frequency vectors corresponding to the target subjects is created, an attribute analysis process in which, when each type of attribute associated with any of the entities indicated in the preparation log is set as a target attribute, and a pair of two objects of each type corresponding to a correlation indicated by any of the first correlation information corresponding to each entity associated with the target attribute is set as a first target object pair, if a target correlation group consisting of one or more correlations corresponding to the first target object pair among the correlations indicated by the first correlation information corresponding to each entity associated with the target attribute satisfies a correlation condition, the correlations included in the target correlation group are integrated to derive an integrated correlation, and second correlation information is information corresponding to the target attribute and indicating each of the derived integrated correlations; a consistency analysis process in which, when a set of two objects corresponding to each post-integration correlation indicated by the second correlation information corresponding to the target attribute is defined as a second target object set, if a consistency condition, which is a condition based on the second correlation information corresponding to the target attribute created in the past, is satisfied for the second target object set, information indicating the second target object set is included in a routine list, which is a list corresponding to the target attribute and is used to reduce logs based on correlations between objects from an operation log consisting of a plurality of logs each indicating a pair of a subject and an object; A routine event identification program that causes a routine event identification device, which is a computer, to execute the above.

Images