Determination device, determination method, and determination program

Abstract

A determination device (10) comprises: a reception unit (15a) that receives an operation event; an estimation unit (15b) that estimates, on the basis of an attribute value of an operation log included in an operation event, a determination criterion for determining the identity of the operation event; and a determination unit (15c) that determines, on the basis of the determination criterion, the identify of an operation event to be processed.

Description

[Technical field]

[0001] The present invention relates to a determination device, a determination method, and a determination program. [Background technology]

[0002] Conventionally, a process mining technique is known that analyzes and visualizes the flow of work performed in a business operation in order to find areas for improving the business operation. The information used for analysis and visualization in such a process mining technique is a log in which the events to be analyzed are recorded. For example, the events to be analyzed vary depending on the type of business operation and the granularity to be analyzed, but may be GUI (Graphical User Interface) operations such as "clicking a button" or "entering information into a text box."

[0003] Logs used in process mining must meet certain requirements, such as being "narrowed down to only the information to be analyzed," "divided by case," and "in a state where events can be identified." For example, operation logs that record operations on a personal computer (PC) often do not meet the requirements for logs used in process mining. Therefore, when performing process mining, it is necessary to process the operation logs so that they meet these requirements, for example, by performing three pre-processing steps: "removal of unnecessary operation events," "determination of identical operation events," and "division by case."

[0004] Here, the "identical operation determination" process is a process that determines which operations have the same meaning in the operation log and makes them identifiable as work events. In other words, since the operation log only records the GUI information as it was at the time of recording, in the initial state, all operations become separate events. Therefore, a process is required to identify identical events by considering the meaning of the operation in the work. Conventionally, when analyzing and visualizing operations on a PC to find areas for improving work, a human would visually check the operation log and manually link identical operation events by adding a unique operation type ID to multiple events that are considered to be the same. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Yokose, Urabe, Yagi, et al.: Business visualization technology that contributes to the promotion of DX, 2020, NTT Technical Journal, 2020 vol.32 No.2, p.72-75, [online], [Retrieved April 23, 2021], Internet<https: / / journal.ntt.co.jp / article / 880> Summary of the Invention [Problem to be solved by the invention]

[0006] However, in the above-mentioned conventional technology, it is not possible to easily link the same operation events in the pre-processing of process mining because the above-mentioned conventional technology has the following problems.

[0007] First, because it is not possible to identify identical operations in the operation logs, it is necessary to link identical operation events. Also, although it is possible to link them one by one manually, if there is a large amount of logs, it is difficult to link them all manually.

[0008] On the other hand, because the systems that are the subject of process mining analysis have different internal structures, fixed rules and algorithms cannot automatically determine the connections. In addition, it is possible to manually customize the rules and algorithms to suit the internal structure and operations of the above systems, but this requires understanding the internal structure of the above systems and the meaning of the attribute values ​​contained in the operation logs, which is difficult for general users. [Means for solving the problem]

[0009] In order to solve the above-mentioned problems and achieve the object, the determination device of the present invention is characterized by comprising: a reception unit that receives a log event; an estimation unit that estimates a determination criterion for determining the identity of the log event based on an attribute value of a log included in the log event; and a determination unit that determines the identity of a log event to be processed based on the determination criterion.

[0010] In addition, a determination method according to the present invention is a determination method executed by a determination device, and is characterized in that it includes the steps of: accepting a log event; estimating a determination criterion for determining the identity of the log event based on an attribute value of a log contained in the log event; and determining the identity of the log event to be processed based on the determination criterion.

[0011] In addition, the judgment program of the present invention is characterized in that it causes a computer to execute the steps of accepting a log event, estimating a judgment criterion for judging the identity of the log event based on an attribute value of a log contained in the log event, and judging the identity of the log event to be processed based on the judgment criterion. Effect of the Invention

[0012] In the present invention, identical operation events can be easily linked in pre-processing for process mining. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of a determination device according to the first embodiment. [Diagram 2] FIG. 2 is a diagram illustrating a log stored in a storage unit according to the first embodiment. [Diagram 3] FIG. 3 is a diagram illustrating an example of an exemplary reception process by linking operation events according to the first embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of a rule type for each attribute element according to the first embodiment. [Diagram 5] FIG. 5 is a diagram illustrating an example of a process of estimating a determination criterion according to the first embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of the operation event determination process according to the first embodiment. [Figure 7] FIG. 7 is a flowchart showing an example of the overall flow of processing according to the first embodiment. [Figure 8] FIG. 8 is a diagram illustrating process mining. [Figure 9] FIG. 9 is a diagram illustrating the pre-processing of process mining. [Figure 10] FIG. 10 is a diagram for explaining the conventional problem. [Figure 11] FIG. 11 is a diagram illustrating a computer that executes a program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of a determination device, a determination method, and a determination program according to the present invention will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the preferred embodiments described below.

[0015] [First embodiment] The process of the determination system according to the first embodiment (or, appropriately, the present embodiment), the configuration of the determination device 10, details of each process, and the flow of each process will be described below in order, and finally, the effect of the present embodiment will be described.

[0016] [Processing of the judgment system] The process of the determination system (this system) according to this embodiment will be described below. This system is used for processing an operation log that records operations on a PC, and in particular, performs automatic determination processing of the same operation event based on an example by a user. The process of this system will be described below in comparison with the conventional technology.

[0017] The process mining techniques for business analysis mentioned above are widely used in the market. There are also systems that record operations on a PC as logs (operation logs). In this case, pre-processing may be required to process mine the operation logs. In other words, because the same operations cannot be identified in the operation logs, it is necessary to link the same operation events. Also, although it is possible to link them one by one manually, when there is a large volume of logs, it is difficult to link them all manually.

[0018] On the other hand, because the systems that are the subject of process mining analysis have different internal structures, fixed rules and algorithms cannot automatically determine the associations. It is also possible to manually customize the rules and algorithms to suit the internal structure and operations of the above systems, but this requires an understanding of the internal structure of the above systems and the meaning of the attribute values ​​contained in the operation logs.

[0019] Therefore, this system executes the following process. First, multiple operation events that are common to the user, in other words, events that are to be judged as identical, are given as examples. Second, rules for determining linking are inferred from the relationships between the attribute values ​​of the example operation events. Third, the inferred rules are used to automatically determine identical operation events. Through the above process, it becomes possible to automatically link identical operation events based on examples given by the user, even without a deep understanding of the internal structure of the system being analyzed or the attribute values ​​of the operation logs.

[0020] [Configuration of determination device 10] The configuration of a determination device 10 according to this embodiment will be described in detail with reference to Fig. 1. Fig. 1 is a block diagram showing an example of the configuration of a determination device according to this embodiment. The determination device 10 has an input unit 11, an output unit 12, a communication unit 13, a storage unit 14, and a control unit 15.

[0021] The input unit 11 controls the input of various information to the determination device 10. For example, the input unit 11 is realized by a mouse, a keyboard, or the like, and accepts input of setting information, etc. to the determination device 10. The output unit 12 controls the output of various information from the determination device 10. For example, the output unit 12 is realized by a display, etc., and outputs setting information, etc. stored in the determination device 10.

[0022] The communication unit 13 is responsible for data communication with other devices. For example, the communication unit 13 performs data communication with each communication device. The communication unit 13 can also perform data communication with an operator's terminal (not shown).

[0023] The storage unit 14 stores various information referenced when the control unit 15 operates and various information acquired when the control unit 15 operates. Here, the storage unit 14 can be realized by, for example, a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. Note that, in the example of FIG. 1, the storage unit 14 is installed inside the determination device 10, but it may be installed outside the determination device 10, or multiple storage units may be installed.

[0024] The storage unit 14 stores an operation log of a processing target. For example, the storage unit 14 stores, as the operation log, the "occurrence time of the operation" and "unique information of the operated GUI component." In addition, in the operation log, information of one operation event is expressed as a collection of multiple attribute values ​​(columns, items).

[0025] Here, the operation log stored in the storage unit 14 will be described with reference to Fig. 2. Fig. 2 is a diagram showing the log stored in the storage unit 14. In the example of Fig. 2, in order to simplify the example, it is assumed that the operation log records only operations on the browser. Therefore, only the attribute values ​​related to the browser are shown in the log.

[0026] In addition to GUI operations on a PC, the operation log may also record input from some input device or command input on a CUI (Character-based User Interface). If these different types of operations are to be recorded, it is necessary to increase the number of log items as necessary.

[0027] 2, the storage unit 14 stores "date and time", "operation type", "URL", "title", "tagName", "type", "id", "value", "name", "className", "left", "top", "width", and "height". Note that the operation log stored in the storage unit 14 is not limited to the above-mentioned, and may also store, for example, an image capture at the time of operation.

[0028] In the example of Fig. 2, when the item is not set or cannot be acquired, the storage unit 14 stores a "null" value indicating that the value is not set. Note that the attribute elements included in the operation log do not need to be the directly acquired information itself, but may be processed, a combination of multiple pieces of information, or may be processed using information that is not ultimately included in the operation log. Also, the storage unit 14 stores the operation log in the chronological order of events so that the order of events that occurred during the work can be known.

[0029] The control unit 15 controls the entire determination device 10. The control unit 15 has a reception unit 15a, an estimation unit 15b, and a determination unit 15c. Here, the control unit 15 is, for example, an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0030] (Reception section 15a) The reception unit 15a receives an operation event as a log event. For example, the reception unit 15a receives images of operation events associated with the same operation by the user among images of multiple operation events. That is, the reception unit 15a receives a combination of capture images associated with the same operation by the user among capture images of multiple operation events displayed in chronological order. Here, the log event is an event including a log having a similar structure as the operation event (for example, a call reception / transmission history, etc.).

[0031] To explain using a specific example, when multiple operation events are selected by the user clicking on captured images visually displayed in chronological order on the screen of the user's terminal, the reception unit 15a receives the operation logs of the operation events linked to the selected captured images as the "same operation log." Furthermore, when another multiple operation events are selected, the reception unit 15a receives the operation logs of the operation events linked to the selected captured images as another "same operation log." The above reception process will also be described in detail in [Details of each process] (1. Exemplary reception process by linking operation events) described later.

[0032] Furthermore, the reception unit 15a refers to the operation logs stored in the storage unit 14 and acquires the selected operation logs. Meanwhile, the reception unit 15a outputs a set of the selected operation logs to the estimation unit 15b. The reception unit 15a may store the set of the selected operation logs in the storage unit 14.

[0033] (Estimation part 15b) The estimation unit 15b estimates a judgment criterion (rule) for judging the identity of operation events based on the attribute value of the operation log included in the operation event as a log event. For example, the estimation unit 15b estimates a judgment criterion for judging the identity of operation events by extracting the attribute value common to the operation logs. That is, the estimation unit 15b estimates a first judgment criterion in a set of operation events associated as the same operation by extracting a character string or a numerical range commonly included in the elements of the attribute according to a condition set for each element of the attribute. Furthermore, the estimation unit 15b estimates a second judgment criterion between sets of operation events associated as the same operation by comparing the first judgment criterion.

[0034] To explain using a specific example, when a common character string "input" is included as the attribute value of the attribute element "operation type" (rule type A: character string is judged by exact match) in a plurality of operation logs accepted by the acceptance unit 15a as the same operation event, the estimation unit 15b estimates an operation event with an exact match in the attribute element "operation type" as a judgment criterion (first judgment criterion) in the same operation set. In addition, when the attribute element "operation type" is exactly the same between a set of a plurality of operation logs accepted by the acceptance unit 15a as the same operation event, the estimation unit 15b estimates an operation event with an exact match in the attribute element "operation type" as a judgment criterion (second judgment criterion) between the same operation sets, that is, a final judgment criterion. The above estimation process will also be described in detail in [Details of each process] (4. Estimation process of rules for each attribute value) described later.

[0035] Furthermore, the estimation unit 15b acquires the set of operation logs output by the reception unit 15a and the rule type of the attribute value stored in the storage unit 14, and extracts a commonly included character string or a numerical range as a judgment criterion. Furthermore, the estimation unit 15b may extract a pattern in which a set of multiple operation logs satisfies the rule type of the attribute value as a judgment criterion. Meanwhile, the estimation unit 15b outputs the extracted judgment criterion to the judgment unit 15c. The estimation unit 15b may store the extracted judgment criterion in the storage unit 14.

[0036] (Judgment part 15c) The determination unit 15c determines the identity of the operation event to be processed as the log event to be processed based on the determination criterion. For example, the determination unit 15c determines the identity of the operation event to be processed using the extracted attribute value. That is, the determination unit 15c determines the identity of the operation event to be processed by matching operation events including a character string or operation events satisfying a numerical range using the first determination criterion. Furthermore, the determination unit 15c determines the identity of the operation event to be processed by matching the adoption result of the condition set for each element of the attribute using the second determination criterion.

[0037] To explain using a specific example, when the determination unit 15c infers that the attribute element "operation type" is completely identical as the determination criterion (first determination criterion) within the same operation set, the determination unit 15c infers that the "operation type" is completely identical as a condition for determining the identity of the operation events. Furthermore, when the determination unit 15c infers that the operation event with the completely identical attribute element "operation type" is the final determination criterion as the determination criterion (second determination criterion) between the same operation sets, the determination unit 15c searches for an operation event that is completely identical to the attribute element "operation type" from among the operation events that have not been linked by the user, and outputs the searched operation event as the determination result. The above determination process will also be described in detail in [Details of Each Process] (5. Determination Process of Operation Event) described later.

[0038] Furthermore, the determination unit 15c transmits the output determination result to the output unit 12. Note that the determination unit 15c may store the output determination result in the storage unit .

[0039] In addition, the determination unit 15c presents the result of the identity determination to the user and outputs the determination result approved by the user, thereby determining identity for the operation event to be processed.

[0040] To explain using a specific example, when the determination unit 15c outputs multiple visual images with a completely matching attribute element "operation type" as the same operation event, it outputs the operation event whose visual image was selected by the user's click operation again as the confirmed determination result. Note that the above estimation process will also be described in detail in [Details of each process] (6. Determination process by dialogue with the user) described later.

[0041] [Details of each process] Details of each process according to the present embodiment will be described with reference to Fig. 3 to Fig. 6 and formulas, etc. Below, an example reception process by linking operation events, rule types for each attribute value, details of rules, rule estimation process, and determination process of operation events will be described in detail.

[0042] (1. Example of reception process by linking operation events) A process of accepting an example based on linking of operation events will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of a process of accepting an example based on linking of operation events according to the first embodiment.

[0043] First, the user is asked to give examples of one or more combinations of the same operations. For example, as shown in Figure 3, operation events can be visually displayed in chronological order, and the user can associate the same operations. In Figure 3, one operation event is displayed as one node, and the node displays a captured image recorded at the same time as the operation event is recorded, and the operation position is displayed on the image in a thick frame. By displaying in this way, the user can recognize which specific operation each operation event is, without having to understand the contents recorded in the operation log.

[0044] The determination device 10 then accepts the operation events linked by the user as examples of the user. Note that, although each link is a combination of two operation events in Fig. 3 (see Fig. 3(1) and (2)), it may be a combination of three or more operation events.

[0045] (2. Rule types for each attribute value) The rule type of each attribute value will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the rule type of each attribute value according to the first embodiment.

[0046] The determination device 10 applies the following four types of rules, which are also shown in Fig. 4, according to the nature of each attribute value of the operation event. The first rule is "determine character strings by exact match" (rule type A), the second rule is "determine character strings by partial match" (rule type B), the third rule is "determine within a numerical range" (rule type C), and the fourth rule is "not used in determination" (rule type D).

[0047] The user associates attribute elements with the rule types to be used in advance, as shown in Figure 4. For example, in Figure 4, rule type A is applied to the attribute elements "operation type", "tagName", "type", "id", and "name", rule type B is applied to the attribute elements "URL" and "title", rule type C is applied to the attribute elements "width" and "height", and rule type D is applied to the attribute elements "date and time", "value", "className", "left", and "top". Note that the user may not use some of the above four types of rules, or may add other types of rules.

[0048] (3. Details of rules for each attribute value) Prior to the rule estimation process, the rules for each attribute value above will be explained in detail. Below, we will explain in the order of character strings that are judged by exact match (rule details 1), character strings that are judged by partial match (rule details 2), and items that are judged by numerical range (rule details 3).

[0049] (Rule details 1: String to be judged by exact match) First, details of the rule (rule type A) that judges character strings by exact match will be described. Below, the following will explain the order of rule inference process 1 (first stage) to which rule type A is applied, rule inference process 2 (second stage) to which rule type A is applied, and rule matching process.

[0050] (Rule inference process 1: Inference process within the same operation set) The determination device 10 adopts this rule for the corresponding attribute element when all attribute values ​​are completely identical in the illustrated set of identical operations. On the other hand, the determination device 10 does not adopt this rule for the corresponding attribute element when the attribute values ​​are not completely identical in the illustrated set of identical operations. Note that, even if all attribute values ​​are "null" in the illustrated set of identical operations, the determination device 10 adopts this rule for the corresponding attribute element.

[0051] (Rule inference process 2: Inference process between the same operation set) If there is an unadopted identical operation set among the relationships between a plurality of identical operation sets, the determination device 10 rejects the set as a whole.

[0052] (Rule matching process) When the attribute values ​​of the operation events to be compared are completely identical, the determination device 10 determines that the rule matches. In addition, when case does not need to be distinguished, the determination device 10 performs comparison using the attribute values ​​converted to uppercase or lowercase.

[0053] (Rule details 2: String to be judged by partial match) Secondly, a rule (rule type B) that judges character strings by partial matching will be described in detail. Below, an inference process 1 (first stage) of a rule to which rule type B is applied, an inference process 2 (second stage) of a rule to which rule type B is applied, and a rule matching process will be described in that order.

[0054] (Rule inference process 1: Inference process within the same operation set) If the corresponding attribute value in the illustrated identical operation set contains "null", the determination device 10 does not adopt this rule for the corresponding attribute element. On the other hand, the determination device 10 finds the longest common substring in the illustrated identical operation set. At this time, the ratio of the length of the common substring to the length of the attribute value with the longest number of characters in the illustrated identical operation set is calculated as the minimum matching ratio (matching rate), and this minimum matching ratio is used as a parameter of this rule. Then, the determination device 10 does not adopt this rule if the minimum matching ratio is equal to or less than a threshold value.

[0055] The above threshold can be set arbitrarily, for example, if it is less than 50%, it may be rejected. To make it more advanced, information about the truth of "forward match", "backward match", "partial match", and "exact match" may also be taken into consideration, multiple common parts may be taken into consideration, and the length of the string may also be taken into consideration.

[0056] (Rule inference process 2: Inference process between the same operation set) If there is an unaccepted identical operation set among the plurality of operation event sets to be compared, the determination device 10 rejects the set as a whole. In addition, the determination device 10 sets the smallest minimum matching ratio among the plurality of operation event sets to be compared as an overall parameter.

[0057] (Rule matching process) If the ratio of the longest common substring of the attribute value between the operation events to be compared exceeds the minimum matching ratio, the determination device 10 determines that the rule matches. In addition, if the determination device 10 does not need to distinguish between uppercase and lowercase letters, it compares the attribute value converted to uppercase or lowercase.

[0058] (Rule Details 3: Items judged based on numerical ranges) Thirdly, the rule (rule type C) that judges based on a range of numerical values ​​will be described in detail. Below, the following will explain the order of inference process 1 (first stage) of a rule to which rule type C is applied, inference process 2 (second stage) of a rule to which rule type C is applied, and rule matching process.

[0059] (Rule inference process 1: Inference process within the same operation set) In the case of the same operation set illustrated as an example, if the attribute value in question contains null, if the attribute value in question contains a value that cannot be treated as a number, or if the attribute value in question contains other abnormal values ​​(e.g., width is a negative value), the determination device 10 will not adopt this rule for the attribute element in question.

[0060] In addition, the determination device 10 calculates the standard deviation σ for the illustrated set of identical operations, and sets this as a parameter of this rule. At this time, the determination device 10 may reject this rule if the standard deviation σ is equal to or greater than a certain threshold value, or if a sufficient number of examples are not provided (only one example is provided). For example, if the threshold value is set to 30, if the number is 30 or more, it is deemed that there is a large variation and almost no commonality, and the rule is rejected.

[0061] (Rule inference process 2: Inference process between the same operation set) If there is an unaccepted identical operation set among the plurality of operation event sets to be compared, the determination device 10 rejects the set as a whole. In addition, the determination device 10 determines the maximum standard deviation σ among the plurality of operation event sets to be compared as an overall parameter.

[0062] (Rule matching process) The determination device 10 determines that the rule matches (is consistent) when the attribute value between the operation events to be compared is in the range of (the absolute value of the difference between the values ​​of the two attribute elements)≦2kσ. Here, k is a constant that is determined arbitrarily. In addition, when it is assumed that the variation in values ​​follows a normal distribution, it is generally recommended to set k=3 (99.7% range).

[0063] (4. Inference process for rules for each attribute value) The process of estimating the rule for each attribute value will be described in detail with reference to FIG. 5. FIG. 5 is a diagram showing an example of the process of estimating the judgment criterion according to the first embodiment. As described below, the judgment device 10 first estimates a rule for each group of operation events exemplified as the same operation in the first stage. Next, in the second stage, a rule is further estimated based on the relationship between a plurality of sets of the same operation. In FIG. 5, two sets of the same operation including two exemplified operation events are shown (see the upper and lower stages of FIG. 5).

[0064] (First Stage) As the first stage estimation process, the rule estimation within the illustrated same operation set will be described. First, the determination device 10 determines whether each attribute element is "adopted" or "rejected" according to a rule type previously set for each attribute element. Next, the determination device 10 extracts a parameter from the attribute value of the attribute element determined to be "adopted" according to a rule type previously set for each attribute element. Then, the determination device 10 estimates whether each attribute element is "adopted" or "rejected" or the extracted parameter as a rule corresponding to the attribute element (first determination criterion).

[0065] In the example in the upper part of Fig. 5, the character string "input" is an exact match as the attribute value of the attribute element "operation type" (rule type A: character strings are judged by exact match), so the determination device 10 determines the attribute element to be "adopted". Also, in the example in the lower part of Fig. 5, the character string "click" is an exact match as the attribute value of the attribute element "operation type" (rule type A: character strings are judged by exact match), so the determination device 10 determines the attribute element to be "adopted".

[0066] In addition, in the examples in the upper and lower parts of FIG. 5, since only the last character out of 41 characters differs in the attribute value of the attribute element “URL” (rule type B: determine character strings by partial match), the determination device 10 calculates the matching rate to be 97% (40 / 41=0.976) and determines the attribute element to be “adopted.”

[0067] (Second Stage) As the second-stage estimation process, a process for checking consistency between the illustrated multiple identical operation sets will be described. First, the determination device 10 compares the "adopted" or "unadopted" status of each attribute element in the multiple identical operation sets. At this time, if there is an unadopted identical operation set among the multiple identical operation sets to be compared, the determination device 10 rejects it as a whole. Then, the determination device 10 estimates the "adopted" or "unadopted" pattern of each matching attribute element as a rule (second determination criterion). In other words, the second-stage estimation process can be said to be a process for finding a rule as to which attribute values ​​are common among the operations included in the identical operation sets.

[0068] In the example of FIG. 5, the determination device 10 determines that the attribute element "operation type" of the same operation set in the upper row is "adopted" and that the attribute element "operation type" of the same operation set in the lower row is also "adopted", so that the determination device 10 presumes that the "operation type" must be completely identical to determine the identity of the operation events. In the same manner, the determination device 10 compares whether the other attribute elements are "adopted" or "not adopted". In FIG. 5, the determination device 10 presumes that the pattern of "adopted" and "not adopted" of all the same operation sets in the upper and lower rows matches, so that the determination device 10 uses that pattern as the final determination criterion.

[0069] (5. Operation event determination process) The details of the process of determining the same operation event from the estimated rule will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the operation event determination process according to the first embodiment. The determination device 10 uses the estimated rule to check the rule for operation events other than the exemplified operation event, and determines the identity, as follows.

[0070] In the example of FIG. 6, the determination device 10 uses rules (e.g., patterns of “adopt” and “reject” for each attribute element) between operation event sets inferred from a plurality of exemplified operation event sets (see FIG. 6(1)(2)) to determine identity for non-exemplified operation events, and outputs combinations of identical operation events (see FIG. 6(3)(4)(5)).

[0071] In addition, the determination device 10 may use rules (e.g., parameters of each attribute element) in the operation event set inferred from the exemplified operation event set to determine the identity of the non-exemplified operation event, and output a non-exemplified identical operation event.

[0072] (6. Judgment process through dialogue with the user) The following describes the details of the process of determining an operation event through a dialogue with a user. The determination device 10 may not be able to correctly determine the identity of an operation event when the number of exemplified operation events described above is small or the exemplified operation events are insufficiently diverse. Therefore, instead of immediately determining the determination result, the determination device 10 may provisionally present the determined operation event to the user and confirm the determination result after receiving confirmation from the user. In other words, if the presented determination result is determined to be inappropriate by the user, the determination device 10 may cancel the provisional determination result and prompt the user to provide more examples.

[0073] By gradually increasing the number of examples through such interactive interaction, the system can provide examples to the user more efficiently. Furthermore, by providing a UI (User Interface) that allows the user to set various thresholds and turn on / off the rules adopted by estimation, the system can meet more advanced user requirements.

[0074] [Process flow] The flow of each process according to this embodiment will be described in detail with reference to Fig. 7. Fig. 7 is a flowchart showing an example of the overall flow of the process according to the first embodiment. Below, the flow of the entire determination process will be shown, and an overview of each process will be described.

[0075] (Overall process flow) First, the reception unit 15a of the determination device 10 executes an operation event selection reception process (step S101). Next, the estimation unit 15b of the determination device 10 executes a determination rule estimation process (step S102). Then, the determination unit 15c of the estimation device 10 executes an operation event determination process (step S103) and ends the process. Note that the following steps S101 to S103 may be executed in a different order. Also, some of the following steps S101 to S103 may be omitted.

[0076] (Flow of each process) First, the operation event selection reception process by the reception unit 15a will be described. In this process, the user is prompted to provide one or more examples of combinations of the same operation events, and the operation logs of the illustrated same operation events are received. At this time, the operation events are visually displayed in chronological order, and the user is prompted to select a connection, so that the user can recognize which operation each operation event is specifically, without understanding the contents of the attribute values ​​recorded in the operation log.

[0077] Secondly, the judgment rule estimation process by the estimation unit 15b will be described. In this process, according to the rule type previously set for each attribute element of the operation event selected, "adopt" or "reject" is determined for each attribute element, parameters are extracted from the attribute value of the attribute element determined to be "adopted", and the extracted parameters are estimated as the rule corresponding to the attribute element. At this time, by previously associating the attribute element with the rule type to be used, the judgment rule of the selected operation event can be effectively estimated. In addition, in this process, a rule that the user judges to be the same is also estimated from the pattern of "adopt" or "reject" for each attribute element, and the same operation event can be estimated in addition to the exemplified operation events.

[0078] Thirdly, the judgment rule estimation process by the judgment unit 15c will be described. In this process, the estimated judgment rule is used to check the rule for operation events other than the exemplified operation events, and the same operation event is judged. At this time, the judgment result is not immediately confirmed, but the judged operation event is provisionally shown to the user, and the judgment result of the same operation event is confirmed after the user's confirmation. This makes it possible to prompt the user to gradually increase the number of examples through interactive exchanges, and makes it possible to easily and effectively judge the same operation event.

[0079] [Advantages of the First Embodiment] First, in the determination process according to the present embodiment described above, a determination unit receives an operation event, estimates a determination criterion for determining the identity of the operation event based on an attribute value of the operation log included in the operation event, and determines the identity of the operation event to be processed based on the estimated determination criterion. Therefore, in this process, identical operation events can be easily linked in pre-processing of process mining.

[0080] Here, we will explain process mining. In process mining, the flow of work performed in a business can be analyzed by visualizing the sequence and relationships of events, as shown in the example in Figure 8. Figure 8 is a diagram for explaining process mining.

[0081] In such process mining, for example, pre-processing such as "removal of unnecessary operation events," "determination of identical operation events," and "division by case unit" are required when performing process mining, as shown in Fig. 9. Fig. 9 is a diagram for explaining the pre-processing of process mining.

[0082] Conventionally, such pre-processing is performed manually. For example, when performing such pre-processing manually, as shown in FIG. 10, a user in the field can intuitively illustrate the process from a screen capture, but it may not be easy to process the operation log. FIG. 10 is a diagram explaining the conventional problem. For example, attribute values ​​recorded in the operation log require specialized knowledge to interpret. For example, knowledge of HTML (Hyper Text Markup Language) and DOM is required to interpret the meaning of the operation log that records the operations on the browser. Also, URLs may not be completely the same even for the same page. Also, for example, if a session ID is included, a part of the URL changes every time you log in, so it is necessary to infer the URL generation rules to determine the identity of the URL.

[0083] In this way, there is no correlation between the appearance of the screen and the internal structure (such as the method of assigning IDs), so the internal structure cannot be inferred from similarities in appearance that even a general user can judge. Because the internal structure of a screen varies widely, a fixed algorithm cannot always make the best judgment. A user with specialized knowledge can infer rules from trends in operation logs and create an algorithm to handle a variety of screen structures, but this is difficult for a general user.

[0084] For this reason, when dividing operation logs into cases manually, the operator needs to understand the internal structure of the system and the meaning of the attribute values ​​of the operation logs, and furthermore, handling a large amount of logs requires a large amount of work. Furthermore, with fixed rules and algorithms, it is difficult to automatically divide operation logs into cases because the internal structure of each system is different. In contrast, in the determination process according to this embodiment, the same operation events can be easily linked in the pre-processing of process mining. In addition, the effects that can be achieved by the determination process according to this embodiment will be described below.

[0085] In the determination process according to the present embodiment described above, images of operation events associated with the same operation by a user are accepted from among images of multiple operation events, and common attribute values ​​in the operation logs are extracted to estimate a determination criterion, and the extracted attribute values ​​are used to determine identity for the operation event to be processed. Therefore, in the pre-processing of process mining, the process can easily link identical operation events by using common attribute values ​​in the operation logs based on the image operations.

[0086] In the determination process according to the present embodiment described above, a combination of captured images associated by a user as the same operation is accepted from among captured images of multiple operation events displayed in chronological order, a character string or a numerical range commonly included in the attribute elements is extracted according to a condition set for each attribute element, a first determination criterion is estimated within a set of operation events associated as the same operation, and the first determination criterion is used to match operation events that include the character string or satisfy the numerical range, thereby determining identity for the operation event to be processed. Therefore, in the present process, in the pre-processing of process mining, the same operation events can be easily linked by using a common attribute value in the operation log based on the image operation according to the condition set for each attribute element.

[0087] In the determination process according to the present embodiment described above, the first determination criterion is compared to further estimate a second determination criterion between sets of operation events associated as the same operation, and the estimated second determination criterion is used to match the adoption results of the conditions set for each attribute element, thereby determining the identity of the operation event to be processed. Therefore, in the pre-processing of process mining, the process can easily link multiple sets of the same operation events by using common attribute values ​​in the operation log based on the image operation according to the conditions set for each attribute element.

[0088] In the determination process according to the present embodiment described above, the identity of the operation events to be processed is determined by presenting the identity determination result to the user and outputting the determination result approved by the user. Therefore, in this process, identical operation events can be linked easily and more effectively in pre-processing of process mining.

[0089] [System configuration, etc.] Each component of each device shown in the figures according to the above embodiment is a functional concept, and does not necessarily have to be physically configured as shown in the figures. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figures, and all or a part of them can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc. Furthermore, each processing function performed by each device can be realized in whole or in any part by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0090] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

[0091] 〔program〕 It is also possible to create a program in which the processing executed by the determination device 10 described in the above embodiment is written in a language executable by a computer. In this case, the same effect as in the above embodiment can be obtained by the computer executing the program. Furthermore, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by a computer to realize the same processing as in the above embodiment.

[0092] Fig. 11 is a diagram showing a computer that executes a program. As shown in Fig. 11, a computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070, and these components are connected by a bus 1080.

[0093] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012, as exemplified in FIG. 11. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090, as exemplified in FIG. 11. The disk drive interface 1040 is connected to a disk drive 1100, as exemplified in FIG. 11. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120, as exemplified in FIG. The video adapter 1060 is connected to, for example, a display 1130, as exemplified in FIG. 11.

[0094] 11, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above programs are stored in, for example, the hard disk drive 1090 as program modules in which instructions to be executed by the computer 1000 are written.

[0095] Furthermore, the various data described in the above embodiment are stored as program data, for example, in the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes various processing procedures.

[0096] Note that the program module 1093 and program data 1094 relating to the program are not limited to being stored in the hard disk drive 1090, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via a disk drive or the like. Alternatively, the program module 1093 and program data 1094 relating to the program may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)) and read by the CPU 1020 via the network interface 1070.

[0097] The above-described embodiments and their modifications are included in the technology disclosed in this application, as well as in the scope of the invention described in the claims and their equivalents. [Explanation of symbols]

[0098] 10 Judgment device 11 Input section 12 Output section 13. Communications Department 14 Storage section 15 Control section 15a Reception 15b Estimation part 15c Judgment section

Claims

1. a reception unit that receives a log event; an estimation unit that estimates a determination criterion for determining identity of the log event based on an attribute value of a log included in the log event; a determination unit that determines whether a log event to be processed has an identity based on the determination criterion; A determination device comprising:

2. the reception unit receives, as the log event, an image of an operation event associated with a same operation by a user from among images of a plurality of operation events; The estimation unit estimates the determination criterion by extracting the attribute value common to the operation log as the log; the determination unit determines identity of the operation event to be processed by using the extracted attribute value.

2. The determination device according to claim 1.

3. the receiving unit receives a combination of capture images associated by the user as a single operation from among the capture images of a plurality of operation events displayed in chronological order; the estimation unit estimates a first determination criterion in the set of operation events associated with each other as an identical operation by extracting a character string or a numerical range commonly included in the elements of the attribute according to a condition set for each element of the attribute; the determination unit determines identity of the operation event to be processed by matching an operation event including the character string or an operation event satisfying the numerical range using the first determination criterion; 3. The determination device according to claim 2.

4. The estimation unit further estimates a second determination criterion between a set of the operation events associated with each other as a same operation by comparing the first determination criterion; the determination unit uses the second determination criterion to match an adoption result of the condition set for each element of the attribute, thereby determining identity of the operation event to be processed.

4. The determination device according to claim 3.

5. the determination unit presents a result of the identity determination to the user, and outputs the determination result approved by the user, thereby determining identity for the operation event to be processed.

5. The determination device according to claim 4.

6. A determination method executed by a determination device, comprising: accepting a log event; estimating a criterion for determining identity of the log event based on an attribute value of a log included in the log event; determining whether a log event to be processed has an identity based on the determination criteria; A method for determining whether or not a particular

7. accepting a log event; estimating a criterion for determining identity of the log event based on an attribute value of a log included in the log event; determining whether a log event to be processed has an identity based on the determination criterion; A determination program that causes a computer to execute the above steps.

Images