Data conversion apparatus and method

Abstract

To provide a technique for quickly applying a rule for detecting an event from data.SOLUTION: A data conversion apparatus includes: assets; a management information generation unit which acquires information on a rule that defines the content of an event, information on a target which is an asset for which the event is to be detected, and information on a trigger which is conditions for detecting the event, and generates management information; a management information storage unit which stores the management information; and an event detection engine which selects, from the management information, information necessary for detecting the event based on data from the assets, stores the information, as detection information, on a cache memory, and detects the event from input data from the assets, using the detection information on the cache memory.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to techniques for detecting events from data. [Background technology]

[0002] In recent years, the installation of various sensors on various devices (assets) has made it possible to generate IoT (Internet of Things) data, and the importance of utilizing this IoT data is increasing. For example, it is conceivable that a wide variety of IoT data can be used to detect faults in assets or their surroundings (fault detection) or to diagnose the presence or absence of signs of faults, etc. (predictive diagnosis).

[0003] By deploying a data conversion device that processes IoT data from assets to detect failures and their precursors and outputs events that indicate the failures or their precursors, it becomes possible to perform predictive diagnosis and failure detection, which have previously been done manually, without human intervention.In this case, in order to detect events from data, rules that associate data with events are defined in advance in the data conversion device.

[0004] In this regard, Patent Document 1 discloses a technique for associating IoT data with meaningful events. According to the disclosure of Patent Document 1, IoT event objects can be tailored to specific device types and capabilities. IoT event objects can use flexible definitions of events that can be reconfigured. IoT event objects enable the ability to set different trigger conditions and priorities. Individual event definitions can be extended to generate more complex events. Notification handlers support sending requests or commands in response to events that require actions. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Special Publication No. 2016-535359 Summary of the Invention [Problem to be solved by the invention]

[0006] As the types and volumes of IoT data increase, improvements in IoT data utilization are expected. However, as the types and volumes of IoT data increase, it is likely that rules will become more complex in order to use that data to make more accurate decisions. In this case, the amount of work required to modify the source code that defines the rules will also increase. Furthermore, as rules become more complex, the event detection process also becomes more complex, increasing the processing load. This may require the deployment of new resources. Furthermore, event detection cannot be performed while the source code is being modified or resources are being deployed. The time during which events that occur when rules are updated cannot be detected should be as short as possible, so it is necessary to apply new rules quickly.

[0007] In this regard, the technique of Patent Document 1 can assist in creating rules for associating IoT data with events, but does not take into consideration the rapid application of new rules. One objective of this disclosure is to provide a technique that allows for the rapid application of rules to detect events in data. [Means for solving the problem]

[0008] A data conversion device according to one aspect of the present disclosure includes a management information creation unit that acquires information regarding assets, rules that define the content of events, targets that are assets for detecting events, and triggers that are conditions for detecting events, and creates management information; a management information storage unit that stores the management information; and an event detection engine that selects information from the management information necessary to detect the event based on data from the asset, stores the information in a cache memory as detection information, and uses the detection information in the cache memory to detect the event from input data from the asset. [Effects of the Invention]

[0009] One aspect of the present disclosure allows for the rapid application of rules to detect events in data. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram of an event detection system. [Figure 2] FIG. 2 is a block diagram of a data conversion device. [Figure 3] 10 is a flowchart of the overall process executed by the data conversion device. [Figure 4] 10 is a flowchart of a management information creation process. [Figure 5] FIG. 10 is a diagram showing an example of a GUI screen for creating asset management information. [Figure 6] FIG. 10 is a diagram showing an example of asset management information on a database. [Figure 7] FIG. 10 is a diagram showing an example of a GUI screen for creating event rule management information and event target management information. [Figure 8] FIG. 10 is a diagram showing an example of a GUI screen for creating a trigger in event trigger item management information. [Figure 9] FIG. 10 is a diagram illustrating an example of event rule related information. [Figure 10]10 is a flowchart of a detection information cache process. [Figure 11] FIG. 10 is a diagram illustrating an example of asset detection information stored in a cache memory. [Figure 12] FIG. 10 is a diagram illustrating an example of trigger detection information stored in a cache memory. [Figure 13] 10 is a flowchart of an event detection process. [Figure 14] FIG. 10 is a conceptual diagram illustrating an asset detection process. [Figure 15] FIG. 10 is a conceptual diagram illustrating a trigger confirmation process. [Figure 16] FIG. 10 is a conceptual diagram illustrating an event detection process. [Figure 17] FIG. 2 is a block diagram showing a hardware configuration of the data conversion device. [Figure 18] FIG. 1 is a block diagram showing an example of the configuration of a data conversion device including two server devices. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0012] 1 is a block diagram of an event detection system according to this embodiment. The event detection system 10 includes an asset 11, an edge device 12, a gateway 13, a data conversion device 14, and an external device 15.

[0013] The event detection system 10 is a system that detects events from data acquired by various assets 11, detects events such as precursors to events and failures using a data conversion device 14, and uses the event information in an external device 15.

[0014] The asset 11 is not particularly limited, but is a device or facility that is the target of monitoring, i.e., a source of data. Examples of the asset 11 include industrial robots, factory equipment, transportation vehicles, and work vehicles. The asset 11 is equipped with a sensor (not shown), and data observed by the sensor is acquired by an edge device 12. The edge device 12 acquires the data from the asset 11 and transmits it to a data conversion device 14 via a gateway 13. The gateway 13 transfers the data from each edge device 12 to the data conversion device 14. The data conversion device 14 receives data from each asset 11, detects events from the data, and notifies an external device 15.

[0015] The external device 15 is a system or device that uses event information, and includes, for example, a DTC (Digital Twin Computing) monitoring application that builds a digital twin of the asset 11 and monitors its operation, a location information display application that displays the location of the asset 11 in real time, an advanced analysis application that analyzes IoT data, an AI application that performs machine learning on IoT data, and other external systems.

[0016] FIG. 2 is a block diagram of the data conversion device. The data conversion device 14 includes a management information creation unit 21 , a management information storage unit 22 , a data reception processing unit 23 , an event detection engine 24 , and a data lake 25 .

[0017] The management information creation unit 21 provides a GUI (Graphical User Interface) to the user to accept input of information, and creates various management information for detecting events from data acquired from the desired asset 11.

[0018] The management information creation unit 21 has an asset management GUI unit 26, a device management GUI unit 27, an event management GUI unit 28, an event trigger creation GUI unit 29, and an IoT data mapping creation GUI unit 30. The functions of these units will be described later along with an explanation of the processing.

[0019] The management information storage unit 22 contains an asset management database (DB) 31, a device management database 32, an event management database 33, an event rule management database 34, an event target management database 35, an event trigger management database 36, an event trigger item management database 37, and an IoT data mapping database 38. Each of these databases will be described later together with an explanation of the processing.

[0020] The data receiving processor 23 receives data of each asset 11 from the edge device 12, accumulates the data in the data lake 25 without classifying it, and inputs it to the event detection engine 24. The data lake 25 stores the data of each asset 11 from the data receiving processor 23.

[0021] The event detection engine 24 detects an event from the data of each asset received from the data reception processing unit 23. The event detection engine 24 has a cache memory 39 and an event detection processing unit 40. The functions of these units will be described later together with an explanation of the processing.

[0022] 3 is a flowchart of the overall processing executed by the data conversion device. Referring to FIG. 3, first, in step S101, the management information creation unit 21 executes management information creation processing. The management information creation processing is processing for creating management information for associating data with events.

[0023] 4 is a flowchart of the management information creation process. The management information creation process is a process for creating various types of management information. Each piece of management information created by the management information creation process is stored in a database in the management information storage unit 22.

[0024] 4, in step S201, the asset management GUI unit 26 displays a GUI screen and accepts information input from a user, thereby creating asset management information and registering it in the asset management database 31. The asset management information is information about each asset 11 included in the event detection system 10.

[0025] FIG. 5 is a diagram showing an example of a GUI screen for creating asset management information.

[0026] For a certain asset, GUI screen G01 accepts input of asset serial, asset name, asset type, group name, manufacturer, model information, and asset attribute information. Asset serial is the serial number of the asset. Asset name is the name of the asset. Asset type is the type of the asset. The user can select the asset type to register from a list of asset types displayed using a pull-down menu. Group name is the name of the group to which the asset belongs. The user can press the group selection button to display a list of group names and select the group name to register from there. Manufacturer is the manufacturer that produced the asset. Model is the model of the asset.

[0027] Asset attribute information is information about the attributes of an asset. An administrator who manages assets can add any items to the asset attribute information to make asset management easier. The user can select the item to add from a list of items displayed in a pull-down menu in the optional asset attribute addition field. In the example of Figure 5, items for vehicle attributes (Vehicle_type) and telephone number (MSISDN) are provided. The vehicle attributes (Vehicle_type) and telephone number (MSISDN) of a vehicle equipped with an asset whose asset type is "Temperature controller" are registered.

[0028] FIG. 6 is a diagram showing an example of asset management information on a database.

[0029] Referring to FIG. 6, the asset management information includes an asset ID, a group ID, an asset serial number, a display name, an asset type ID, a maker, a model, and additional information for each asset.

[0030] The asset ID is identification information unique to the asset in the asset management database 31. The group ID is identification information of the group to which the asset belongs. The group ID is the same as the group name above. The asset serial is the serial number of the asset. The display name is the name of the asset displayed on the screen. The display name is the same as the asset name above. The asset type ID is identification information indicating the type of the asset. The Maker is the manufacturer that produced the asset. The Model is the model of the asset. The additional information is additional information for managing the asset. The latitude and longitude are location information of the asset. The additional information is an item that is arbitrarily added as the asset attribute information above.

[0031] 4 , in step S202, the device management GUI unit 27 displays a GUI screen and accepts information input from the user, thereby creating device management information and registering it in the device management database 32. The device management information is information about each of the edge devices 12 included in the event detection system 10.

[0032] 4 , in step S203, the IoT data mapping creation GUI unit 30 displays a GUI screen and accepts information input from the user, thereby creating IoT data mapping information and registering it in the IoT data mapping database 38. The IoT data mapping information is information that indicates the mapping of the types of IoT data to be input to the data conversion device 14.

[0033] In step S204, the event management GUI unit 28 displays a GUI screen and accepts information input from the user, thereby creating event rule management information and registering it in the event rule management database 34. The event rule management information is information relating to each rule for detecting an event in the event detection system 10. Details of the event rule management information will be described later.

[0034] FIG. 7 is a diagram showing an example of a GUI screen for creating event rule management information and event target management information.

[0035] For a certain rule, the GUI screen G02 accepts input of basic information such as group name, rule name, priority, event type, and notification status. Also, trigger type information is accepted as trigger information. Also, target group, target type, mapping type, and asset information are accepted as target information.

[0036] The group name is the name of the group to which the asset to which the rule applies belongs. The user can press the group selection button to display a list of group names and select the group name to register from the list. The rule name is the name of the rule. The priority is the priority of the event detected by the rule. The priority is set to three levels, for example, High, Medium, and Low. The user can select the priority to register from the list of priorities displayed using a pull-down menu. The event type is the type of event detected by the rule. Event types include, for example, Alert, Fault, Info, and Maintenance. Alert is an alarm event. Fault is an event that a failure has occurred. Info is an event that notifies information such as the status. Maintenance is an event that notifies that maintenance is required. The user can select the type to register from the list of types displayed using a pull-down menu. Notification presence / absence is information indicating whether or not to notify the administrator of an event detected by the rule. Notification is, for example, an email notification when an event is detected. The user can select whether to display a notification or not using the pull-down menu. The trigger type is the type of trigger that detects an event with the rule. The user can select the type to register from the list of types displayed in the pull-down menu.

[0037] The target group is a group of assets that are targets for detecting events with the rule. By pressing the group selection button, the user can display a list of groups and select the group to register from that list. The target type is the type of asset that is the target for detecting events with the rule. The mapping type is information that indicates the type of IoT data that is the target for detecting events with the rule. The user can select the type to register from the list of types displayed using a pull-down menu. The asset is the asset that is the target for detecting events with the rule. The user can press the asset selection button to display a list of assets and select the target asset from that list.

[0038] In this embodiment, the user can define various event rules to suit the use case, eliminating the need to modify or deploy the data conversion device 14 system itself, and enabling the rapid introduction of rules for predictive diagnosis and fault detection.

[0039] 4, in step S205, the event management GUI unit 28 displays a GUI screen and receives information input from the user, thereby creating event target management information and registering it in the event target management database 35. The event target management information is information about each target of each rule. Details of the event target management information will be described later.

[0040] In step S206, the event trigger creation GUI unit 29 displays a GUI screen and accepts information input from the user, thereby creating event trigger management information and registering it in the event trigger management database 36. The event trigger management information is information that indicates each trigger of each rule. Details of the event trigger management information will be described later.

[0041] In step S207, the event trigger creation GUI unit 29 displays a GUI screen and accepts information input from the user, thereby creating event trigger item management information and registering it in the event trigger item management database 37. The event trigger item management information is information about each trigger.

[0042] FIG. 8 is a diagram showing an example of a GUI screen for creating a trigger in the event trigger item management information. Referring to FIG. 8, the input of trigger type and trigger content information is accepted on a GUI screen G03 as trigger information for a certain trigger.

[0043] The trigger content can be set using threshold discrimination, which compares a value indicated in the input data with a predetermined threshold, string discrimination, which compares a string indicated in the input data with a predetermined string, frequency discrimination, which determines whether the input data occurs at a predetermined frequency, or date and time discrimination, which determines whether the input data occurs at a predetermined date and time. For example, threshold discrimination can be applied when the input data is a temperature. Also, string discrimination can be applied when the input data is a status code. Furthermore, the trigger content can be set in a sophisticated manner using logical operations including logical sum and / or logical product for multiple conditions.

[0044] In the example in Figure 8, the trigger content for IoT data is set as the logical sum (OR) of Trigger 1 and Trigger 2. Trigger 1 and Trigger 2 each have a data item and a trigger content expressed as a comparison condition and value. Trigger 1 is the logical product (AND) of the condition that the data item is "set temperature" and the trigger content is ">10°C," and the condition that the data item is "power" and the trigger content is "=ON." Trigger 2 is the condition that the data item is "radio signal strength" and the trigger content is "<20dBm."

[0045] The user can also delete Trigger 1, Trigger 2, and the two conditions that make up Trigger 1 by pressing the respective minus (-) buttons. The user can also add more triggers by pressing the add trigger button. The user can also add more conditions by pressing the plus (+) button.

[0046] In addition, when data is entered into a data item, the trigger content area for that data may be configured to display previously entered trigger content corresponding to the entered data item as a recommendation that can be confirmed or rewritten.

[0047] FIG. 9 is a diagram illustrating an example of event rule related information.

[0048] The event rule related information includes event rule management information, event target management information, event trigger management information, and event trigger item management information. The event rule management information is stored in an event rule management database 34. The event target management information is stored in an event target management database 35. The event trigger management information is stored in an event trigger management database 36. The event trigger item management information is stored in an event trigger item management database 37.

[0049] Referring to FIG. 9, the event rule management information includes, for each rule, a rule master ID, a group ID, a rule type, a rule name, a priority, an event type, and a notification flag.

[0050] The rule master ID is identification information unique to the rule. The group ID is identification information of the group to which the asset to which the rule applies belongs. The rule type is the type of the rule. The rule name is the name of the rule. The priority is the priority of the event detected by the rule. The event type is the type of event detected by the rule. This event type is the same as the event type described above. This event type may also be used as the rule type. The notification flag is information indicating whether or not to notify the administrator of an event detected by the rule. This notification flag is the same as the notification / non-notification flag described above.

[0051] Referring again to FIG. 9, the event target management information registers, for each rule, a rule master ID, a target ID, a target type, a mapping type ID, a target, an application start date, and an application end date.

[0052] The rule master ID is identification information unique to the rule. The target ID is identification information for the target asset to which the rule applies. The target type is the type of asset to which the rule applies. The mapping type ID is identification information that indicates the type of IoT data for which events are detected by the rule. The target is information that indicates the asset to which the rule applies. The application start date is the date on which the application of the rule begins. The application end date is the date on which the application of the rule ends.

[0053] 9 again, in the event trigger management information, a rule master ID and a trigger ID are registered for each rule. The rule master ID is identification information unique to the rule. The trigger ID is identification information unique to the trigger corresponding to the rule.

[0054] Referring again to Figure 9, the event trigger item management information registers, for each rule, the rule master ID, trigger ID, trigger item ID, trigger type, trigger detailed type, mapping type ID, trigger item, threshold, comparison condition, trigger date and time, monitoring period unit, monitoring period, number of event occurrences, and event occurrence number update date and time.

[0055] The rule master ID is identification information unique to the rule. The trigger ID is identification information unique to the trigger corresponding to the rule. The trigger item ID is identification information unique to the data item of the trigger corresponding to the rule. The trigger type and trigger detail type are information indicating the type and detailed type that indicate the classification of the trigger corresponding to the rule. The mapping type ID is identification information that indicates the IoT data mapping type of the IoT data that is the target of event detection by the rule. The trigger item is the name of the data item of the trigger corresponding to the rule. The threshold is the threshold applied in the rule. The comparison condition is condition information that indicates how the data is compared with the threshold in the rule. The trigger date and time is information that indicates the date and time when the trigger corresponding to the rule is applied. The monitoring period unit is information that indicates the unit of the period when the trigger corresponding to the rule is applied. The monitoring period is information that indicates the value of the period when the trigger corresponding to the rule is applied. The event occurrence count is information that indicates the number of times an event caused by the trigger corresponding to the rule is triggered within the monitoring period. The event occurrence count update date and time is information that indicates the date and time when the event occurrence count of the event caused by the trigger corresponding to the rule is updated. Returning to FIG. 3, in step S102, the event detection engine 24 executes a detection information cache process.

[0056] 10 is a flowchart of the detection information cache process. The detection information cache process extracts event detection information, which is information necessary for detecting events based on data, from the management information recorded in the database and stores it in the cache memory 39. The detection information cache process is executed repeatedly at regular time intervals or whenever the management information is updated, and the event detection information in the cache is kept up to date.

[0057] Referring to Figure 10, in step S301, the event detection engine 24 extracts information (asset detection information) for extracting data from the target asset (target asset) for detecting the event from the data from the data receiving processing unit 23, and stores it in the cache memory 39.

[0058] FIG. 11 is a diagram illustrating an example of asset detection information stored in the cache memory. Referring to FIG. 11, the asset detection information includes an asset ID and an asset serial number for each asset.

[0059] Returning to FIG. 10, in step S302, the event detection engine 24 extracts information (asset rule master information) linking the target asset with the rule master ID that identifies the rule to be applied to the data from the target asset (target data) and stores it in the cache memory 39.

[0060] Furthermore, in step S303, the event detection engine 24 extracts the rule master ID and information (event rule trigger information) that links the trigger of the rule identified by the rule master ID with the target event, and stores it in the cache memory 39.

[0061] Hereinafter, asset rule master information and event rule trigger information may be collectively referred to as trigger detection information. Trigger detection information is information that specifies triggers, which are conditions for detecting whether data from a target asset corresponds to a target event.

[0062] FIG. 12 is a diagram illustrating an example of trigger detection information stored in the cache memory. Referring to FIG. 12, the trigger detection information includes asset rule master management information and event rule trigger management information.

[0063] The asset rule master management information registers the asset ID and rule master ID for each rule. The event rule trigger management information registers the rule master ID, rule name, priority, event type, notification flag, trigger item, threshold, and comparison condition for each rule.

[0064] 3, in step S103, the event detection engine 24 executes an event detection process. The event detection process is a process of detecting an event from data input from the data reception processing unit 23 using the event detection information in the cache memory 39.

[0065] FIG. 13 is a flowchart of the event detection process.

[0066] 13, in step S401, the event detection engine 24 uses the asset detection information in the cache memory 39 to extract data from the target asset from the data received from the data receiving processor 23, and adds the corresponding asset ID to the extracted data. This process is hereinafter also referred to as asset detection processing.

[0067] Fig. 14 is a conceptual diagram showing the asset detection process. Referring to Fig. 14, input data of Temp="14", pres="199", pow="on", and AssetSerial="Asset" is given. In the asset detection process (S401), the event detection engine 24 searches for asset detection information in the cache memory 39 using the AssetSerial of the input data as a key. In the example of Fig. 14, a corresponding entry is found, and the event detection engine 24 adds the information of asset ID="A0001" registered in the corresponding entry to the input data.

[0068] 13, in step S402, the event detection engine 24 identifies the rule and trigger to be applied to the input data to which the asset ID is added, using the trigger detection information in the cache memory 39. This process is hereinafter also referred to as the trigger confirmation process. Fig. 15 is a conceptual diagram showing the trigger confirmation process. Referring to Fig. 15, the data obtained in step S401 is provided to the trigger confirmation process.

[0069] In the trigger confirmation process (S402), the event detection engine 24 first searches the asset rule master management information using the asset ID added to the data from the asset detection process as a key to identify the corresponding rule master ID.The event detection engine 24 then identifies the trigger threshold discrimination, which is composed of the trigger item, threshold, and comparison condition linked to the asset ID and rule master ID, in the event rule trigger management information.The event detection engine 24 then adds the rule master ID and trigger threshold discrimination to the data.

[0070] In the example of Figure 15, the trigger item is "temp", the threshold is "10", and the comparison condition is ">", so the trigger threshold judgment is "temp>10". Therefore, the information "Rule master ID="R0001" and trigger threshold judgment="Temp>10" is added to the data.

[0071] 13, in step S403, the event detection engine 24 determines whether the input data, to which the asset ID, rule master ID, and trigger threshold determination information are added, corresponds to an event, and outputs information indicating the event. This process is hereinafter also referred to as event detection process. 16 is a conceptual diagram showing the event detection process. Referring to FIG. 16, the data obtained in step S402 is given to the event detection process.

[0072] In the event detection process (S403), the event detection engine 24 determines whether the data from the trigger confirmation process corresponds to a trigger based on the trigger threshold judgment attached to the data. In the example of FIG. 16, the trigger threshold judgment is "Temp>10" and the temp of the data is "14", so the data corresponds to an event. Therefore, information indicating the event is output. In the example of FIG. 16, based on the event rule trigger management information, information on "Event A" with a priority of "high", an event type of "Alert", and a notification flag of "True" is output. The output event information is registered in the event management database 33. The events of fault detection and predictive diagnosis detected as described above are linked to external devices 15 such as various applications and systems, as shown in FIG. FIG. 17 is a block diagram showing the hardware configuration of the data conversion device.

[0073] Referring to FIG. 17, the data conversion device 14 has a hardware configuration in which a communication unit 41, a storage unit 42, a calculation unit 43, an input unit 44, and an output unit 45 are connected by a bus.

[0074] The memory unit 42 is a device that stores data in a writable and readable manner. The various databases of the management information memory unit 22 and the data lake 25 shown in FIG. 2 are configured in the memory unit 42. The calculation unit 43 is a processor that executes software program processing. The calculation unit 43 realizes the management information creation unit 21, the data reception processing unit 23, and the event detection engine 24. The cache memory 39 described above is provided in the calculation unit 43. The communication unit 41 can transmit and receive information processed by the calculation unit 43 and information required for processing via wired or wireless connections. Data acquired by each asset is received by the communication unit 41. Information linked to the external device 15 is also transmitted by the communication unit 41. The input unit 44 is an input device for inputting information, such as a keyboard or mouse. Information input to various GUIs of the management information creation unit 21 is acquired by the input unit 44. The output unit 45 is an output device that outputs information to a display or the like. Screens of various GUIs created by the management information creation unit 21 are displayed by the output unit 45.

[0075] 17 is just an example, and various other configurations are possible. For example, data conversion device 14 may be configured on a cloud. Data conversion device 14 may also be configured to include multiple server devices and achieve load balancing or duplication. FIG. 18 is a block diagram showing an example of the configuration of a data conversion device including two server devices.

[0076] The data conversion device 14 shown in FIG. 18 is configured to include two server devices, a server 0 system and a server 1 system. Each of the server 0 system and the server 1 system is equipped with a data reception processing unit 23, a cache memory 39, and an event detection processing unit 40. On the other hand, there is only one management information storage unit 22, which is shared by both the server 0 system and the server 1 system. Detection information extracted from the management information recorded in the database of the management information storage unit 22 is stored in each cache memory 39. Each cache memory 39 is updated at regular intervals and used for event detection by the event detection processing unit 40. This makes it possible to distribute the event detection load across the two server devices.

[0077] Furthermore, for example, when information required by the data reception processing unit 23, such as IoT data mapping information, is updated in the cache memory 39, the updated information is provided to the data reception processing unit 23. Furthermore, for example, when the number of event reports is updated in the event detection processing unit 40, the value in the database of the management information storage unit 22 is updated by the value in the cache memory 39. These operations are also performed by the server 0 system and the server 1 system, respectively.

[0078] The above-described embodiments are merely examples for explaining the present invention, and are not intended to limit the scope of the present invention to these embodiments. Those skilled in the art can implement the present invention in various other forms without departing from the scope of the present invention. The technical scope of the above-described embodiment includes the matters described in the following supplementary notes, but the present invention is not limited to the following matters.

[0079] (Item 1) The data conversion device includes a management information creation unit that acquires information regarding assets, rules that define the content of events, targets that are assets for which events are to be detected, and triggers that are conditions for detecting events, and creates management information, a management information storage unit that stores the management information, and an event detection engine that selects from the management information information required to detect the events based on data from the assets, stores the information in a cache memory as detection information, and uses the detection information in the cache memory to detect the events from input data from the assets. This allows for the creation of management information, recording detection information extracted from the created management information in the cache memory, and detecting events using the detection information in the cache memory, thereby enabling the rapid application of rules that detect events from data.

[0080] (Item 2) In the data conversion device described in item 1, the management information creation unit creates the management information by accepting information on the asset, the rule, the target, and the trigger from a user, and the event detection engine stores asset detection information for extracting data from the target asset and trigger detection information for detecting that the extracted data corresponds to the event in the cache memory as the detection information, uses the asset detection information to extract data from the target from the input data as target data, and uses the trigger detection information to detect that the target data corresponds to the trigger. This allows the creation of management information using an interface that is easy for users to use by accepting the target asset and the trigger for determining an event separately, and enables trigger detection to be achieved through a simple process by first extracting target data from the input data and then detecting that the target data corresponds to the trigger.

[0081] (Item 3) In the data conversion device described in item 2, the asset detection information is information that links an asset serial, which is information unique to an asset and assigned to data from the asset, with an asset ID that identifies the asset. By storing the link between the asset ID and the asset serial in a cache memory, data from a target asset can be quickly extracted.

[0082] (Item 4) In the data conversion device described in item 3, the event detection engine stores, as the trigger detection information, asset rule master information linking the target asset with a rule master ID that identifies a rule to be applied to data from the asset, and event rule trigger information linking the rule master ID, the trigger of the rule identified by the rule master ID, and the event in the cache memory, identifies the rule master ID of the rule to be applied to the target data based on the asset rule master information, and detects the occurrence of the event linked to the rule master ID in the event rule trigger information when the target data satisfies the trigger condition of the rule linked to the rule master ID in the event rule trigger information. This allows the asset rule master information linking the target asset with the rule master ID and the event rule trigger information linking the rule master ID with the trigger and the event to be stored in cache memory, respectively, and the processing configuration of sequentially applying the asset rule master information and the event rule trigger information to the target data makes it possible to realize event detection processing with a simpler process.

[0083] (Item 5) In the data conversion device described in item 1, when the management information is updated by the management information creation unit, the event detection engine updates the detection information in the cache memory based on the updated management information. By keeping the detection information in the cache memory up to date, it becomes possible to continue detecting events when scaling out the processing resources of the event detection engine.

[0084] (Item 6) In the data conversion device described in item 2, the management information creation unit displays a first screen that allows a user to specify a target asset, accepts the target asset specified on the first screen, displays a second screen that allows a user to register an event trigger, and accepts the trigger registered on the second screen. This makes it easy for a user to create management information by displaying the screen and performing the corresponding specification and registration operations.

[0085] (Item 7) In the data conversion device described in item 6, the management information creation unit displays, on the second screen, a first input area for inputting a data item and a second input area for inputting the content of a trigger for the data. When a data item is input into the first input area, the content of a trigger previously input into the second input area corresponding to the input data item is displayed in the second input area as a recommendation so that it can be confirmed or rewritten. This makes it easy for users to register trigger conditions by using recommendations based on past input content.

[0086] (Item 8) In the data conversion device described in item 2, the management information creation unit accepts a trigger that determines whether or not an event exists based on at least one of the results of comparing the value indicated in the data with a predetermined threshold, the results of comparing a string indicated in the data with a predetermined string, the occurrence of the data at a predetermined frequency, and the occurrence of the data at a predetermined date and time.

[0087] (Item 9) In the data conversion device described in item 2, the management information creation unit accepts a trigger that determines whether an event has occurred based on the result of a logical operation on multiple events that indicate that the data satisfies a predetermined condition. This makes it possible to set a trigger that corresponds to complex bitmap data or status codes.

[0088] (Item 10) The data conversion method involves a computer acquiring information regarding an asset, a rule that defines the content of an event, a target that is an asset for which the event is to be detected, and a trigger that is a condition for detecting the event, creating management information, storing the management information, selecting from the management information information necessary to detect the event based on data from the asset, saving the information in a cache memory as detection information, and using the detection information in the cache memory to detect the event from input data from the asset. [Explanation of symbols]

[0089] 10...Event detection system, 11...Asset, 12...Edge device, 13...Gateway, 14...Data conversion device, 15...External device, 21...Management information creation unit, 22...Management information storage unit, 23...Data reception processing unit, 24...Event detection engine, 25...Data lake, 26...Asset management GUI unit, 27...Device management GUI unit, 28...Event management GUI unit, 29...Event trigger creation GUI unit, 30...IoT data mapping creation GUI unit, 31...Asset management database, 32...Device management database, 33...Event management database, 34...Event rule management database, 35...Event target management database, 36...Event trigger management database, 37...Event trigger item management database, 38...IoT data mapping database, 39...Cache memory, 40...Event detection processing unit, 41...Communication unit, 42...Storage unit, 43...Calculation unit, 44...Input unit, 45...Output unit

Claims

1. a management information creation unit that acquires information regarding assets, rules that define the content of events, targets that are assets for which events are to be detected, and triggers that are conditions for detecting events, and creates management information; a management information storage unit that stores the management information; an event detection engine that selects information from the management information required to detect the event based on data from the asset, stores the selected information in a cache memory as detection information, and uses the detection information in the cache memory to detect the event from input data from the asset; A data conversion device having:

2. the management information creation unit creates the management information by receiving information on the asset, the rule, the target, and the trigger from a user; The event detection engine asset detection information for extracting data from the target asset and trigger detection information for detecting that the extracted data corresponds to the event are stored in the cache memory as the detection information; extracting data from the target as target data from the input data using the asset detection information; Detecting whether the target data corresponds to the trigger using the trigger detection information; 2. The data conversion device according to claim 1.

3. The asset detection information is information linking an asset serial, which is information unique to an asset and assigned to data from the asset, with an asset ID that identifies the asset.

3. The data conversion device according to claim 2.

4. The event detection engine asset rule master information linking the target asset with a rule master ID that identifies a rule to be applied to data from the asset, and event rule trigger information linking the rule master ID, a trigger of the rule identified by the rule master ID, and the event, are stored in the cache memory as the trigger detection information; Identifying a rule master ID of a rule to be applied to the target data based on the asset rule master information; When the target data satisfies a trigger condition of a rule linked to the rule master ID in the event rule trigger information, it is detected that the event linked to the rule master ID in the event rule trigger information has occurred.

4. The data conversion device according to claim 3.

5. When the management information is updated by the management information creating unit, the event detection engine updates the detection information in the cache memory based on the updated management information.

2. The data conversion device according to claim 1.

6. the management information creation unit displays a first screen that enables a user to specify a target asset, accepts the target asset specified on the first screen, displays a second screen that enables a user to register an event trigger, and accepts the registered trigger on the second screen; 3. The data conversion device according to claim 2.

7. The management information creation unit displays, on the second screen, a first input area for inputting a data item and a second input area for inputting the content of a trigger for the data, and when a data item is input into the first input area, the content of a trigger previously input into the second input area corresponding to the input data item is displayed in the second input area so that it can be confirmed or rewritten as a recommendation.

7. The data conversion device according to claim 6.

8. the management information creation unit receives a trigger for determining whether or not an event exists based on at least one of a result of comparing a value indicated in the data with a predetermined threshold, a result of comparing a character string indicated in the data with a predetermined character string, whether the data occurs at a predetermined frequency, and whether the data occurs at a predetermined date and time; 3. The data conversion device according to claim 2.

9. the management information creation unit receives a trigger for determining whether or not an event has occurred based on a result of a logical operation on a plurality of events that the data satisfies a predetermined condition; 3. The data conversion device according to claim 2.

10. Obtaining information about assets, rules that define the content of events, targets that are assets that are targets for detecting events, and triggers that are conditions for detecting events, and creating management information; storing the management information; selecting information from the management information required to detect the event based on data from the asset, and storing the selected information in a cache memory as detection information; Detecting the event from input data from the asset using the detection information in the cache memory; A data conversion method performed by a computer.

Images