Information providing device, information providing method, and information providing program

Abstract

An information assignment device (10) identifies operations that correspond to events indicated in an operation log of a computer. This information assignment device (10) creates a task model indicating information in which a combination and a sequence pattern of the identified operations are associated with tasks in business. By using the task model, the information assignment device (10) assigns, to the events indicated in the operation log, task information indicating tasks corresponding to the respective events. The information assignment device (10) assigns, to events that are among the events indicated in the operation log and that are assigned with the task information, case information indicating cases corresponding thereto, on the basis of a capture image on a screen of the computer.

Description

[Technical field]

[0001] The present invention relates to an information providing device, an information providing method, and an information providing program. [Background technology]

[0002] In order to realize effective business improvement in companies, it is important to accurately understand the target business. The people in charge of business carry out multiple tasks every day using information terminals such as PCs (Personal Computers) and tablet terminals. Furthermore, the tasks performed via information terminals consist of multiple tasks.

[0003] For example, work performed on a PC refers to a series of information input operations (entering information into text boxes, clicking buttons, etc.) required to carry out a task.

[0004] Operational procedures in actual work vary depending on various factors such as the person in charge and the contents of the order. Operational procedures are basically stipulated in the manual, but there may be cases where the work content has changed since the manual was first created, or the person in charge performs the work in their own way, resulting in a discrepancy between the manual and the operational procedures in the actual work.

[0005] As a prerequisite for considering business improvement measures, business analysts need to understand what tasks require how much time and what procedures are used to carry out the tasks.

[0006] For example, when introducing RPA (Robotic Process Automation) to increase the effectiveness of business process improvement, it is possible to efficiently achieve business improvement by understanding the type and amount of work performed within the business and introducing RPA to the task types that require the most work.

[0007] Conventionally, a technique is known that uses process mining to analyze and visualize the flow of work carried out in a business in order to identify areas for improvement in the business (for example, Non-Patent Document 1).

[0008] The information used in the analysis and visualization of process mining is the operation log in which the events to be analyzed are recorded. In process mining, the operation log is divided into groups of tasks. For example, the operation log includes the operation time, events, and case information (also called sequences, etc.).

[0009] Process mining makes it possible to discover the main flow by overlaying the same events from the operation logs of each project that represents the same task and visualizing the process.

[0010] In addition, process mining allows you to visualize multiple cases by arranging identical operations in the same column, making it possible to compare the events that occurred for each case and discover problems.

[0011] The events to be analyzed vary depending on the type of business and the granularity to be analyzed. For example, the events to be analyzed are operations on GUI (Graphical User Interface) components such as clicking a button or inputting into a text box.

[0012] Further, conventionally, a technique for comprehensively collecting operation logs related to operations performed on a PC is known (for example, see Non-Patent Document 2). [Prior art documents] [Non-patent literature]

[0013] [Non-Patent Document 1] Urabe, Yagi, Tsuchikawa, and Masuda, A study on business process visualization method using operation logs as input, IEICE Technical Report, vol. 118, no. 483, ICM2018-64, pp. 83-88, March 2019. [Non-Patent Document 2] Yokose, Urabe, Yagi, Tsuchikawa, Masuda, and Oishi, Business Visualization Technology Contributing to Digital Transformation Promotion, NTT Technical Review, vol. 32, no. 2, February 2020. Summary of the Invention [Problem to be solved by the invention]

[0014] However, the conventional techniques have a problem in that it is difficult to perform process mining efficiently.

[0015] For example, in order to perform process mining using the method described in Non-Patent Document 1, it is necessary to identify the operations for each event shown in the operation log and to clarify the business tasks and cases to which each event corresponds.

[0016] On the other hand, the operation log collected by the method of Non-Patent Document 2 does not show the operation of each event or the corresponding work and item.

[0017] As a countermeasure to this, it is possible to manually add the necessary information to the operation log, but this method reduces efficiency. [Means for solving the problem]

[0018] In order to solve the above-mentioned problems and achieve the object, the information assignment device is characterized by having an identification unit that identifies operations corresponding to events indicated in a computer operation log, a creation unit that creates a work model, which is information that matches the combination and order pattern of operations identified by the identification unit with work in a business, a work information assignment unit that uses the work model to assign first information, which is information indicating the corresponding work, to each of the events indicated in the operation log, and a case information assignment unit that assigns second information, which is information indicating a corresponding case, to each of the events indicated in the operation log to which the first information has been assigned, based on a captured image of the computer screen. Effect of the Invention

[0019] According to the present invention, process mining can be carried out efficiently. [Brief description of the drawings]

[0020] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an information assignment system according to the first embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of the operation log. [Diagram 3] FIG. 3 is a diagram illustrating an example of working model information. [Figure 4] FIG. 4 is a diagram showing an example of a work model creation screen. [Diagram 5] FIG. 5 is a diagram for explaining the procedure for providing information. [Figure 6] FIG. 6 is a diagram for explaining the procedure for providing information. [Figure 7] FIG. 7 is a diagram showing an example of a screen on which work information is visualized. [Figure 8] FIG. 8 is a diagram showing an example of a screen on which case information is visualized. [Figure 9] FIG. 9 is a flowchart showing a flow of processing of the information providing device according to the first embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of a computer that executes an information providing program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] Hereinafter, an embodiment of an information providing device, an information providing method, and an information providing program according to the present application will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiment described below.

[0022] [First embodiment] Here, the operation log is assumed to be a collection of records corresponding to each event that occurs in response to an operation on a computer.

[0023] The record includes the date and time when the event occurred, information about the application that was the target of the operation, the details of the operation, and information about the screen and GUI parts that were displayed on the computer at the time of the operation.

[0024] Here, in the operation log used for process mining, the operation and case corresponding to each event must be known. Also, when process mining is performed for each task, the task corresponding to each event must be known.

[0025] On the other hand, in the technology described in Non-Patent Document 2, the operation, task, and case corresponding to each event are not specified in the collected operation log.

[0026] For example, while a computer performs operations corresponding to various cases and tasks, the operation log may be stored in a single file regardless of the corresponding cases and tasks. In this case, it is difficult to distinguish the cases and tasks corresponding to each record in the file using conventional technology.

[0027] The information addition device of this embodiment identifies the operation of an event included in the operation log, and further adds information indicating the work and case corresponding to each event.

[0028] [Configuration of the first embodiment] 1 is a diagram showing an example of the configuration of an information assignment system according to the first embodiment. As shown in FIG.

[0029] For example, the information providing device 10 is a server, and for example, the terminal device 20 is a computer such as a personal computer, a smartphone, or a tablet terminal.

[0030] The information providing device 10 and the terminal device 20 are connected via a network so as to enable data communication.

[0031] In the course of business, a user operates the terminal device 20. For example, the terminal device 20 executes applications such as a web browser, a spreadsheet software, and a word processing software. Then, the user performs operations such as inputting data to GUI parts displayed on the screen of the terminal device 20.

[0032] Note that some or all of the functions of the information providing device 10 may be provided in the terminal device 20. In this case, the terminal device 20 can function as the information providing device.

[0033] As shown in FIG. 1, the information providing device 10 includes a communication unit 11, a storage unit 12, and a control unit 13.

[0034] The communication unit 11 performs data communication with other devices via a network. For example, the communication unit 11 is a network interface card (NIC).

[0035] The storage unit 12 is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), an optical disk, etc. The storage unit 12 may be a semiconductor memory in which data can be rewritten, such as a random access memory (RAM), a flash memory, or a non-volatile static random access memory (NVSRAM).

[0036] The storage unit 12 stores an OS (Operating System) and various programs executed by the information providing device 10. The storage unit 12 stores an operation log 121 and working model information 122.

[0037] Fig. 2 is a diagram showing an example of an operation log. As shown in Fig. 2, the operation log 121 is a collection of records corresponding to each event that occurs in response to an operation on the terminal device 20. The terminal device 20 is an example of a computer.

[0038] 2 is called an attribute. Also, the value for each attribute of each record (row) in the operation log 121 is called an attribute value.

[0039] Also, the operation log 121 in Fig. 2 is information regarding operations on a Web browser. The attributes of the operation log 121 are not limited to those shown in Fig. 2. The attributes of the operation log 121 may include, for example, a history of input from an input device (keyboard, mouse, etc.), character strings of commands input on a CUI (Character User Interface), etc.

[0040] The terminal device 20 executes a Web browser to display a Web page on the screen, and accepts operations such as input to GUI parts on the Web page. The operation log 121 is information related to operations on the Web page.

[0041] The attributes included in the operation log 121 are as follows: Date and Time: The time when the event occurred (including the date) Operation type: A string representing the type of operation Application: A string representing the executable name of the running application. URL: A string representing the URL of the web page being displayed. Title: A string representing the title of the web page. tagName: A string representing the tag that the GUI part is in. type: A string that represents the type of GUI part. value: A string representing the input value to the GUI part id: A string to identify the GUI part name: A string representing the name of the GUI part className: A string representing the name of the GUI part class. left: A number representing the position of the GUI part top: A number that represents the position of the GUI part width: A number that represents the position of the GUI part height: A number that represents the position of the GUI part image: Screen capture image data (e.g., a string representing a file path)

[0042] Each attribute may correspond to an HTML tag of the same name. Furthermore, a null value is set in the operation log 121 for an attribute that is not set or for which the attribute value cannot be obtained.

[0043] The attribute value included in the operation log 121 does not need to be the information itself acquired from the terminal device 20. The attribute value may be obtained by processing the acquired information, or may be a combination of multiple pieces of information. In addition, the multiple pieces of information to be combined may not appear in the operation log 121.

[0044] The attribute "operation ID" is information for identifying the operation of the event indicated in each record. A method for identifying the operation ID will be described later.

[0045] For example, the record on the first line of Figure 2 shows information about an event that occurred on "2021 / 03 / 10 12:02:10" while the application "Example.exe" was displaying the web page at the URL "http: / / www.sample.jp / transit / ?session=0001."

[0046] In addition, the record on the first line of Figure 2 shows that the value "YRP Nobi" was entered into a GUI part on the screen titled "Route Search" with a tagName of "input", type of "text", id of "null", and name of "on_st".

[0047] The record on the first line in Figure 2 indicates that the GUI part is located at the position indicated by left "217", top "84", width "195", and height "24". It also indicates that a capture image of the screen during operation is stored in a file called "1.png".

[0048] The GUI parts include text boxes, buttons (including submit buttons), pull-down menus, check boxes, radio buttons, and the like.

[0049] Fig. 3 is a diagram showing an example of operation model information. An operation model is stored in the operation model information 122. As shown in Fig. 3, an operation model is a pattern of combination and order of operations. An operation is represented by an operation ID.

[0050] Figure 3 shows that the work model with the work name "on-site process search work" is a pattern that combines the following operations in the order of operation a, operation b, operation c, operation d, operation e, operation f, operation g, and operation h.

[0051] The work model may be identified by the work name as in FIG. 3, or by an ID given to each work model.

[0052] 1, the control unit 13 controls the entire information providing device 10. The control unit 13 is, for example, an electronic circuit such as a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or a GPU (Graphics Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0053] The control unit 13 also has an internal memory for storing programs that define various processing procedures and control data, and executes each process using the internal memory. The control unit 13 also functions as various processing units by the operation of various programs.

[0054] For example, the control unit 13 includes an identifying unit 131, a creating unit 132, a work information assigning unit 133, a case information assigning unit 134, and a display control unit 135.

[0055] The identification unit 131 identifies an operation corresponding to an event indicated in the operation log 121 of the computer.

[0056] The identifying unit 131 identifies an operation ID based on each attribute value of the operation log 121. The operation ID is an ID for identifying an event (record) corresponding to the same operation.

[0057] That is, the same operation may cause different events to occur in the terminal device 20. Conversely, different events may be regarded as being caused by the same operation.

[0058] For example, the event of inputting the character string "abc" into a text box and the event of inputting the character string "xyz" into the same text box are both caused by the operation of "inputting a character string into a text box." However, since the character strings input are different, each event is considered to be a different event.

[0059] The identification unit 131 identifies events of the same operation by applying one of the following rules to each attribute of the operation log 121: (1) determining whether a character string is an exact match, (2) determining whether a character string is a partial match, (3) determining whether a character string is a range of numerical values, or (4) not using the attribute for the determination.

[0060] The identification unit 131 applies (1) to the operation type, application, tagName, type, id, and name among the attributes of the operation log 121. The identification unit 131 applies (2) to the URL and title among the attributes of the operation log 121. The identification unit 131 applies (3) to the width and height among the attributes of the operation log 121. The identification unit 131 applies (4) to the date and time, value, className, left, and top among the attributes of the operation log 121.

[0061] For example, the identification unit 131 determines that the operation ID of the records on the first and ninth lines of the operation log 121 shown in Fig. 2 is "operation a". For example, the operation type and application of the records on the first and ninth lines match, but the date and time and the value do not match.

[0062] The creation unit 132 creates an activity model, which is information that associates the patterns of combinations and orders of operations identified by the identification unit 131 with tasks in a business. The activity model is a model that represents a series of operations performed to complete a task in a business.

[0063] The creation unit 132 may create a work model based on a user's specification received via a work model creation screen. For example, the creation unit 132 creates a work model based on an operation associated with a capture image selected by the user from among captured images on a computer screen.

[0064] 4 is a diagram showing an example of a working model creation screen. For example, the working model creation screen 31 is created by the information providing device 10 and displayed by the terminal device 20. In addition, the working model creation screen 31 may be displayed by a device different from the terminal device 20.

[0065] The creation unit 132 extracts the operation ID from the operation log 121 and a capture image associated with the operation ID, and displays the capture image for each operation ID in the area 311. The creation unit 132 extracts the capture image by referring to the image in the operation log 121.

[0066] Further, supplemental information regarding the captured image is displayed in the area 311. For example, the area 311 in Fig. 4 indicates that the captured image is from an airplane search screen.

[0067] The creation unit 132 may display the captured images in the area 311 for each piece of information about the screen (title, URL) so that the user can easily select the captured images.

[0068] In addition, the creation unit 132 may crop out only the area surrounding the operation location in the captured image so as to clearly display the operation location, and may also use information about the operation location (top, left, width, height) to highlight the portion of the captured image that corresponds to the operation location (thick-framed portion of the captured image in area 311).

[0069] The user selects and specifies the order of the captured images shown in the area 311. For example, the user moves the captured image selected in the area 311 to the area 312.

[0070] In the area 312, the selected captured images are arranged and displayed in positions corresponding to the specified order. Also, a text box for inputting the work name is provided in the area 312. In the example of Fig. 4, "on-site process search work" is input as the work name.

[0071] For example, when the save button is pressed, the creation unit 132 stores in the work model information 122 the operation ID of the operation corresponding to the capture image placed in the area 312 and the order based on the placement position, in association with the input work name.

[0072] The work information assigning unit 133 assigns, to each of the events shown in the operation log 121, first information (work information) that is information indicating the corresponding work, using the work model.

[0073] For example, the work information assigning unit 133 assigns information indicating the work included in the work model as work information to consecutive events in a sequence in which events shown in the operation log 121 are arranged according to the occurrence date and time, and the consecutive events satisfy a condition regarding the degree of match with a pattern included in the work model.

[0074] Fig. 5 is a diagram for explaining the procedure for adding information. The sequence in Fig. 5 is a sequence of events in the operation log 121 arranged in the order of the date and time of occurrence. Rectangular shapes correspond to each event, and alphabets represent operation IDs. For example, in Fig. 5, the operation ID "operation a" is abbreviated to "a".

[0075] Moreover, a blank figure with no operation ID written therein corresponds to an event with no specified operation ID, or an event with an operation ID unrelated to the target work model.

[0076] The work information assigning unit 133 sequentially checks the events in the series, and identifies a range that may match the work model. For example, the work information assigning unit 133 identifies consecutive events whose operation IDs match the operation ID sequence of the work model (operation sequence).

[0077] For example, the activity information attachment unit 133 detects an event with an operation ID of “a” from the sequence as the starting point. “a” is the first operation ID in the sequence in activity model A.

[0078] Then, the activity information attachment unit 133 determines whether or not the operation ID of the event following the identified starting point is included in the activity model.

[0079] The work information attachment unit 133 may also determine that an event whose operation ID is not included in the work model but whose title or URL matches that of an event determined to be included in the work model is included in the work model.

[0080] Then, the activity information assigning unit 133 sets the event immediately before the event determined not to be included in the activity model as the end point.

[0081] Then, the work information assignment unit 133 specifies a range from the start point to the end point. In the example of Fig. 5, the work information assignment unit 133 specifies ranges 51, 52, 53, and 54 as ranges that may match the work model A.

[0082] Next, the task information assigning unit 133 determines whether or not to assign task information corresponding to the task model to the specified range. The task information assigning unit 133 makes this determination based on at least one of the degree of agreement of the elements and the length of the sequence.

[0083] (Element Matching) The work information assignment unit 133 looks at each event in the identified range, and if the operation ID of the event matches an operation ID in the work model, it adds 1 to the degree of match, and if the operation ID of the event does not match an operation ID in the work model (corresponding to a blank figure), it adds 0.5 to the degree of match.

[0084] (Length of sequence) The activity information attachment unit 133 calculates the number of coincidences between the operation IDs of the events in the identified range and the operation IDs of the activity model as the length of the sequence.

[0085] For example, for range 51, the task information attachment unit 133 calculates the degree of match as 9.0 and the length of the sequence as 7.

[0086] The task information assigning unit 133 assigns task information to each event in a range in which at least one or both of the degree of match and the length of the sequence exceed a threshold. For example, the threshold of the length of the sequence may be a value such as 50% of the number of operation IDs of the task model.

[0087] For example, assume that the degree of match and the length of the sequence in the range 51 exceed the threshold value, and the work name of the work model A is “on-site process search work.” In this case, the work information attachment unit 133 attaches “on-site process search work” to the attribute “work name” added to the operation log 121 of the event included in the range 51.

[0088] In addition, the range identified by the work information assigning unit 133 may correspond to a plurality of work models. For example, as shown in Fig. 6, consider a case where a range 51 may correspond to both work model A and work model B. Fig. 6 is a diagram for explaining the information assigning procedure.

[0089] In this case, the task information attachment unit 133 determines which task model the identified range is closer to, based on the degree of agreement and the length of the sequence.

[0090] In the example of FIG. 6, the work model A has a higher degree of agreement and a higher sequence length, so the work information attachment unit 133 determines that the work model A falls within the range 51.

[0091] Furthermore, the work information attachment unit 133 may determine that the work model having the larger weighted sum of the degree of agreement and the length of the sequence as shown below is the work model that falls within the specified range. Weighted sum = agreement x 1 + length of series x 2

[0092] The case information assigning unit 134 assigns second information (case information), which is information indicating the corresponding case, to each of the events to which work information has been assigned, among the events shown in the operation log 121, based on a captured image of the computer screen.

[0093] The events in the range to which the work information is assigned by the work information assigning unit 133 may have occurred as a result of one or more operations related to cases being performed repeatedly. Therefore, the case information assigning unit 134 further assigns case information to the events in the range to which the work information is assigned.

[0094] An example will be described in which the case information assigning unit 134 further assigns case information to the range to which the work information corresponding to the work model A has been assigned.

[0095] The case information assigning unit 134 compares information about the computer screens corresponding to two consecutive events in a sequence in which events to which work information has been assigned among the events shown in the operation log 121 are arranged according to the occurrence date and time, and assigns case information to the two events based on the result of determining whether the two events correspond to the same case.

[0096] First, the case information attachment unit 134 sets an event whose operation ID matches the first operation ID in the work model as the start point of the case. For example, the first operation ID in the work model A is “a”.

[0097] The case information assigning unit 134 determines whether to assign the same case information as the first event to the second event of two consecutive events after the starting point.

[0098] Here, it is assumed that work information is added to ranges 51, 52, 53, and 54. Furthermore, the case information adding unit 134 focuses only on events to which work information is added. In other words, an event subsequent to the event at the right end of range 51 is regarded as the event at the left end of range 52.

[0099] First, when the screens of two consecutive events are the same, the case information assigning unit 134 assigns the same case information to the two consecutive events if all of the following conditions C1 to C4 are satisfied.

[0100] Furthermore, if the screens of two consecutive events are not identical, the case information assigner 134 assigns the same case information to the two consecutive events if any of the following conditions C1 to C4 except for condition C3 is satisfied.

[0101] Whether the screens are the same or not is determined based on whether the titles of the operation logs 121 are the same or not. If the same case information is not assigned by the above procedure, the case information assigning unit 134 assigns the second event with case information different from that of the first event.

[0102] (Condition C1) The operation ID of the second event is not the first operation ID in the working model. (Condition C2) The window handles of the screens in the two events match. (Condition C3) The score of template matching, which determines whether or not a capture image of an operation location of a first event is included in a capture image of a screen of a second event, is equal to or greater than a threshold. However, the operation location is acquired from the left, top, width, and height of the capture image of the screen and the operation log 121. (Condition C4) The difference in the occurrence dates and times of the first and second events is less than or equal to the threshold.

[0103] Regardless of the above conditions, the case information attachment unit 134 sets an event whose operation ID matches the last operation ID in the work model as the end point of the case. For example, the first operation ID in the work model A is “h”.

[0104] 5, the case information assigning unit 134 assigns the same case information (information indicating case α) to the range 51, the range 52, and the range 531. On the other hand, the case information assigning unit 134 assigns the same case information (information indicating case β) to the range 532 and the range 54.

[0105] Even if ranges such as range 531 and range 532 are continuous and have the same work information assigned to them, the case information may differ from each other.

[0106] The display control unit 135 displays a screen that displays work information or both the work information and the case information that are assigned to multiple events shown in the operation log 121. The display control unit 135 displays, on the terminal device 20, a screen that visualizes the work information and the case information.

[0107] Fig. 7 is a diagram showing an example of a screen that visualizes work information. As shown in Fig. 7, captured images of an event to which work model A is assigned are superimposed on the work information display screen 32 displayed by the display control unit 135. Also, arrows between each captured image indicate the order of the operation ID in work model A.

[0108] Fig. 8 is a diagram showing an example of a screen that visualizes case information. As shown in Fig. 8, the case information display screen 33 displayed by the display control unit 135 displays a capture image of an event to which the work model A is assigned for each case.

[0109] On the case information display screen 33, captured images of events with a common case are arranged in the same row, and captured images of events with a common operation ID are arranged in the same column.

[0110] Returning to FIG. 1, the terminal device 20 includes a communication unit 21, an input unit 22, an output unit 23, a storage unit 24, and a control unit 25.

[0111] The communication unit 21 performs data communication with other devices via a network. For example, the communication unit 21 is a NIC.

[0112] The input unit 22 is an input device such as a keyboard and a mouse, etc. The output unit 23 is a display device such as a display capable of outputting a screen.

[0113] The storage unit 24 is a storage device such as an HDD, an SSD, an optical disk, etc. Note that the storage unit 24 may be a data-rewritable semiconductor memory such as a RAM, a flash memory, or an NVSRAM.

[0114] The storage unit 24 stores the OS and various programs executed by the terminal device 20.

[0115] The control unit 25 controls the entire terminal device 20. The control unit 25 is, for example, an electronic circuit such as a CPU, an MPU, or a GPU, or an integrated circuit such as an ASIC or an FPGA.

[0116] The control unit 25 also has an internal memory for storing programs and control data that define various processing procedures, and executes each process using the internal memory. The control unit 25 also functions as various processing units by the operation of various programs.

[0117] For example, the control unit 25 includes an acquisition unit 251 and a display control unit 252 .

[0118] The acquiring unit 251 acquires an operation log in the terminal device 20. The acquiring unit 251 transmits the acquired operation log to the information providing device 10.

[0119] The display control unit 252 causes the output unit 23 to display screens. For example, the display control unit 252 causes the work model creation screen 31, the work information display screen 32, and the case information display screen 33 to be displayed in accordance with the control of the information provision device 10.

[0120] [Processing of the first embodiment] The flow of processing in the information providing device 10 will be described with reference to Fig. 9. Fig. 9 is a flowchart showing the flow of processing in the information providing device according to the first embodiment.

[0121] 9, the information providing device 10 identifies the operation ID of an event included in the operation log (step S101). For example, the information providing device 10 provides the same operation ID to events that have the same screen and GUI part names even if the dates and times and input values ​​are different from each other.

[0122] Next, the information-imparting device 10 creates a work model by combining the operation IDs (step S102). For example, the information-imparting device 10 presents the work model creation screen 31 to the user and creates a work model by combining the operation IDs of the events selected by the user.

[0123] Here, the information providing device 10 provides information for identifying a task to an event included in the operation log based on the task model (step S103). For example, the information providing device 10 provides task information based on the degree of agreement between a predetermined range in a sequence in which events are arranged according to occurrence time and the task model.

[0124] Next, the information providing device 10 provides the information identifying the case to the event to which the information identifying the work has been provided (step S104). For example, the information providing device 10 provides the case information according to the result of determining whether or not two consecutive events in the above-mentioned series are related to the same case.

[0125] Then, the information providing device 10 visualizes and displays the task information or the case information provided to the event (step S105). For example, the information providing device 10 displays the task information display screen 32 or the case information display screen 33.

[0126] [Advantages of the First Embodiment] As described above, the identification unit 131 identifies operations corresponding to events shown in the computer's operation log 121. The creation unit 132 creates an operation model, which is information that associates the combination and order patterns of operations identified by the identification unit 131 with operations in a business. The operation information assignment unit 133 assigns operation information, which is information indicating the corresponding operation, to each of the events shown in the operation log 121 using the operation model. The case information assignment unit 134 assigns case information, which is information indicating the corresponding case, to each of the events shown in the operation log 121 to which operation information has been assigned, based on a captured image of the computer screen.

[0127] In this way, the information assignment device 10 automatically identifies the operation (operation ID) of each event in the operation log by using the operation model, and further assigns the work information and the case information. As a result, according to this embodiment, process mining can be performed efficiently.

[0128] Here, there is a problem with the method of manually checking each event in the technical operation log and manually adding work information and case information, which requires a significant amount of work.

[0129] Furthermore, since the task information and the case information are determined according to the flow of operations, it is difficult to assign the task information and the case information without specifying an operation ID for each individual event shown in the operation log.

[0130] Furthermore, interpretation of attribute values ​​in operation logs requires specialized knowledge of HTML and DOM (Document Object Model).

[0131] It is also possible to acquire operation logs so that they are divided for each case, but it is not realistic for a user to start and stop a log acquisition tool at the start and end of each case.

[0132] According to this embodiment, the above problem can be solved.

[0133] Furthermore, the creation unit 132 creates a work model based on the operation associated with a capture image selected by the user from among the capture images on the computer screen.

[0134] This allows a user to create an operation model based on a captured image, even if the user does not have specialized knowledge and does not understand the contents of the operation log.

[0135] In addition, the user can create an operation model for each operation that the user recognizes. As a result, the user can grasp the operation log for each operation and each operation by looking at the operation information and the case information that are added.

[0136] The work information assigning unit 133 assigns, as work information, information indicating the work included in the work model to consecutive events in a sequence in which events shown in the operation log 121 are arranged according to the occurrence date and time, and which satisfy a condition regarding the degree of matching with a pattern included in the work model. In this way, it is possible to automatically assign work information.

[0137] The case information assigning unit 134 compares information about the computer screens corresponding to two consecutive events in a sequence in which events to which work information has been assigned among the events shown in the operation log 121 are arranged according to the occurrence date and time, and assigns case information to the two events based on the result of determining whether the two events correspond to the same case. This makes it possible to automatically assign case information.

[0138] The display control unit 135 displays a screen that displays the work information or both the work information and the case information that are assigned to the multiple events shown in the operation log 121. This makes it possible to present the work information and the case information in a manner that is easy for the user to understand.

[0139] [System configuration, etc.] In addition, each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or a part of it can be functionally or physically distributed or integrated in any unit according to various loads, usage conditions, etc. Furthermore, each processing function performed by each device can be realized in whole or in any part by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or can be realized as hardware by wired logic. Note that the program may be executed not only by the CPU but also by other processors such as a GPU.

[0140] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

[0141] [program] As an embodiment, the information imparting device 10 can be implemented by installing an information imparting program that executes the above-mentioned information imparting process as package software or online software on a desired computer. For example, the information imparting program can be executed by an information processing device, so that the information processing device can function as the information imparting device 10. The information processing device here includes desktop or notebook personal computers. In addition, the information processing device also includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone System), as well as slate terminals such as PDA (Personal Digital Assistant), etc.

[0142] The information imparting device 10 can also be implemented as an information imparting server device that provides a service related to the above-mentioned information imparting process to a client, the client being a terminal device used by a user. For example, the information imparting server device is implemented as a server device that provides an information imparting service that receives an operation log as an input and outputs the imparted work information and case information. In this case, the information imparting server device may be implemented as a Web server, or may be implemented as a cloud that provides a service related to the above-mentioned information imparting process by outsourcing.

[0143] 10 is a diagram showing an example of a computer that executes an information addition program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0144] The memory 1010 includes a read only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0145] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the information providing device 10 is implemented as a program module 1093 in which computer-executable code is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same process as the functional configuration of the information providing device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0146] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0147] Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)). The program module 1093 and the program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070. [Explanation of symbols]

[0148] 1 Information provision system 10 Information providing device 11, 21 Communications Department 12, 24 Storage section 13, 25 Control section 20 Terminal Equipment 22 Input section 23 Output section 31 Working model creation screen 32 Work information display screen 33 Item information display screen 121 Operation Log 122 Working Model Information 131 Specific part 132 Creation Department 133 Work information assignment unit 134 Case Information Assignment Department 135, 252 Display control unit 251 Acquisition Department

Claims

1. an identification unit that identifies an operation corresponding to an event indicated in an operation log of a computer; a creation unit that creates an activity model that is information that associates the patterns of combinations and sequences of operations identified by the identification unit with activities in a business; a task information assigning unit that assigns, to each of the events indicated in the operation log by using the task model, first information that is information indicating a corresponding task; a case information assigning unit that assigns second information, which is information indicating a corresponding case, to each of the events to which the first information is assigned, among the events shown in the operation log, based on a captured image of a screen of the computer; An information providing device comprising:

2. The information providing device according to claim 1, characterized in that the creation unit creates the work model based on an operation associated with a captured image selected by a user from among the captured images of the computer screen.

3. The information assignment device according to claim 1 or 2, characterized in that the work information assignment unit assigns information indicating work included in the work model as the first information to consecutive events in a series in which events shown in the operation log are arranged according to the occurrence date and time, the consecutive events satisfying a condition regarding the degree of match with a pattern included in the work model.

4. The information assignment device according to any one of claims 1 to 3, characterized in that the case information assignment unit assigns the second information to the two events based on a result of determining whether the two events correspond to the same case by comparing information about the computer screen corresponding to each of two consecutive events in a series in which events to which the first information is assigned among the events shown in the operation log are arranged according to the occurrence date and time.

5. The information assignment device according to any one of claims 1 to 4, further comprising a display control unit that displays a screen displaying the first information or both the first information and the second information assigned to a plurality of events shown in the operation log.

6. An information providing method executed by an information providing device, comprising: An identifying step of identifying an operation corresponding to an event indicated in an operation log of the computer; a creating step of creating an activity model which is information that associates the patterns of combinations and sequences of operations identified by the identifying step with tasks in a business; a task information assigning step of assigning, to each of the events indicated in the operation log, first information that is information indicating a corresponding task, by using the task model; a case information assigning step of assigning second information, which is information indicating a corresponding case, to each of the events to which the first information is assigned, among the events shown in the operation log, based on a captured image of the computer screen; An information providing method comprising:

7. An information providing program for causing a computer to function as the information providing device according to any one of claims 1 to 5.

Images