Extraction device, extraction method, and extraction program

Abstract

An acquisition unit (15a) acquires an operating log (14a). A creation unit (15b) creates an operating pattern using operating result states and the sequence of the states. An extraction unit (15c) extracts the operating pattern included in the acquired operating log (14a).

Description

Technical Field

[0001] The present invention relates to an extraction device, an extraction method, and an extraction program.

Background Art

[0002] In recent years, technologies for analyzing operations and the like by utilizing logs of PC operations (hereinafter referred to as operation logs) have attracted attention. For example, a large amount of operation logs are accumulated, and offline processing such as data mining is performed to mechanically discover characteristic patterns such as repetitive operations from the accumulated operation logs and utilize them for business analysis.

[0003] Alternatively, for the patterns expressed and input by the user, it may be determined offline whether there is a matching operation situation in the accumulated operation logs, or it may be determined online whether the current operation situation matches.

[0004] In addition, when expressing the pattern of the operation situation of a web system, there is a technology that expresses only states such as the URL, the title, and whether a specific UI exists in the system screen (see Non-Patent Document 1). There is also a technology for expressing the order of how time-series data has changed (see Non-Patent Document 2).

Prior Art Documents

Non-Patent Documents

[0005]

Non-Patent Document 1

Non-Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0006] However, in the prior art, it has been difficult to express the pattern of operations by uniformly using the state and the order. That is, in the prior art, the expression of the state and the expression of the order are independent of each other. For example, according to the technique described in Non-Patent Document 1, only a specific state can be expressed, and an expression such as the case where B is satisfied after A cannot be expressed. Further, according to the technique described in Non-Patent Document 2, when A, B, and C are input to the system screen, it is impossible to distinguish between the case where the input order of A, B, and C does not matter and the case where the input order is important. Therefore, it has been impossible to express a pattern including both the state and the order such as "in a situation where a certain state is satisfied and changes in the corresponding order". Therefore, in the prior art, it has been impossible to determine whether or not the situation of "in a state where a certain state is satisfied and the operation is performed in a certain order" matches the operation pattern.

[0007] The present invention has been made in view of the above, and an object thereof is to express the pattern of operations by uniformly using the state and the order.

Means for Solving the Problems

[0008] In order to solve the above-described problems and achieve the object, an extraction device according to the present invention includes a creation unit that creates an operation pattern using the state of an operation result and the order of the state, an acquisition unit that acquires an operation log, and an extraction unit that extracts the operation pattern included in the acquired operation log.

Effects of the Invention

[0009] According to the present invention, it becomes possible to represent an operation pattern by uniformly using a state and an order.

Brief Description of the Drawings

[0010]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Modes for Carrying Out the Invention

[0011] Hereinafter, with reference to the drawings, an embodiment of the present invention will be described in detail. Note that the present invention is not limited by this embodiment. Also, in the description of the drawings, the same parts are denoted by the same reference numerals.

[0012] [Outline of Extraction Device] FIG. 1 is a diagram for explaining the outline of the extraction device of this embodiment. The extraction device of this embodiment determines, for example, whether an operation pattern input by an analyst is included in an operation log of a user operating an application. As shown in FIG. 1, the extraction device expresses an operation pattern by uniformly using a state and an order.

[0013] Specifically, first, the extraction device represents the state of an actual operation result such as "the execution button is displayed" in a binary value of on (satisfied) / off (not satisfied). Then, as illustrated in Point (1), the extraction device encodes the situation of the actual operation result such as an operation log into string data of a series of binary states. For example, a state such as "the execution button is displayed" is represented in a binary value of on (satisfied) / off (not satisfied). In Point (1), for each of the three states A, B, and C, a time-series change of the state represented in a binary value of on (satisfied) / off (not satisfied) is illustrated. Also, at the timing when any of the three states changes, the change of the state is encoded into the string data representing the series of states by representing the change of the state with a character such as "B", "!B", etc. Here, when the state B changes from off to on, it is represented as "B", and when it changes from on to off, it is represented as "!B".

[0014] Next, as illustrated at point (2), the extraction device unifies the representation of the state and order of the operation log by introducing an operand {{<logical expression>}} to extend the regular expression for expressing a plurality of character strings in one format. In this embodiment, the regular expression is used to represent the order. Also, the state is represented by describing a logical expression between the operands "{{" and "}}". At point (2), for example, the operation pattern of "finally C is operated in a state where A and B are satisfied" is expressed as "{{A&B}}.*C$".

[0015] In this way, the extraction device uses the operation pattern represented by the introduced operand {{<logical expression>}} to determine offline, for example, whether there is a matching operation situation in the accumulated operation log. In such an offline process, the speed can be increased by converting the logical expression into an efficient regular expression.

[0016] It is also possible to determine online whether the operation pattern matches the current operation situation. In such an online process, the speed can be increased by caching the state.

[0017] [Configuration of Extraction Device] FIG. 2 is a schematic diagram illustrating the schematic configuration of the extraction device of this embodiment. As illustrated in FIG. 2, the extraction device 10 of this embodiment is realized by a general-purpose computer such as a personal computer, and includes an input unit 11, an output unit 12, a communication control unit 13, a storage unit 14, and a control unit 15.

[0018] The input unit 11 is realized using input devices such as a keyboard, a mouse, and a microphone, and inputs various instruction information such as a processing start to the control unit 15 in response to an input operation by an operator. The output unit 12 is realized by a display device such as a liquid crystal display, a printing device such as a printer, and the like.

[0019] The communication control unit 13 is implemented by a NIC (Network Interface Card) or the like, and controls the communication between the control unit 15 and an external device via a telecommunications line such as a LAN (Local Area Network) or the Internet. For example, the communication control unit 13 controls the communication between the control unit 15 and a terminal operated by a user, a terminal that outputs an operation log to be subjected to the extraction process described later, a management device that manages the user's operation log, and the like.

[0020] The storage unit 14 is implemented by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 14 stores in advance a processing program for operating the extraction device 10, data used during the execution of the processing program, and the like, or temporarily stores them each time processing is performed. Note that the storage unit 14 may be configured to communicate with the control unit 15 via the communication control unit 13.

[0021] In the present embodiment, the storage unit 14 stores, for example, an operation log 14a that is the target of the extraction process described later, a state conversion rule 14b used for the extraction process, and the like. The operation log 14a is acquired, for example, by the acquisition unit 15a described later from a terminal operated by a user prior to the extraction process and accumulated in the storage unit 14.

[0022] Also, FIG. 3 is a diagram for explaining the state conversion rule. The state conversion rule 14b is a rule for converting the state of an operation result as exemplified in FIG. 3 into a binary value of on (satisfied) / off (not satisfied). In the example shown in FIG. 3, the state of the operation result is defined by a state name, state specific information, and a condition for state change, so that it can be expressed in binary.

[0023] For example, in FIG. 3(b), the state name is "NW service input", the target identification information is "Name: service type, Type: text box, Selector: ****", and the condition for state change is defined as the state where the value is "network", and the state can be identified by the two values of on / off of the condition. Note that the selector is information for identifying an object on the system screen or desktop. For example, it is the selector notation of jQuery for identifying an object on a web browser, the information held by AutomationElement by UI Automation for identifying an object in the state of a Windows (registered trademark) application, and the like.

[0024] Returning to the description of FIG. 2. The control unit 15 is realized by using a CPU (Central Processing Unit) or the like and executes a processing program stored in the memory. Thereby, as illustrated in FIG. 2, the control unit 15 functions as an acquisition unit 15a, a creation unit 15b, and an extraction unit 15c. Note that these functional units may be implemented by different hardware, either individually or in part. For example, the acquisition unit 15a may be implemented by hardware different from the other functional units. Also, the control unit 15 may include other functional units.

[0025] The acquisition unit 15a acquires an operation log. For example, the acquisition unit 15a acquires the operation log targeted for the extraction process described later from a terminal operated by the user via the input unit 11 or the communication control unit 13, or from a management device or the like that manages the operation log. The acquisition unit 15a stores the acquired operation log in the storage unit 14. Alternatively, the acquisition unit 15a may transfer the acquired operation log online to the creation unit 15b described later.

[0026] The creation unit 15b creates an operation pattern using the state of the operation result and the order of the state. Specifically, the creation unit 15b creates an operation pattern using string data that is a series of states represented by two values.

[0027] Here, FIGS. 4 to 8 are diagrams for explaining the processing of the creation unit. As illustrated in FIG. 4, the creation unit 15b converts the state of actual operation results such as operation logs into a state that can be represented in binary using the state conversion rule 14b, and creates an operation pattern in a series of states.

[0028] In the example shown in FIG. 4, similar to the example shown in FIG. 1, for each of the three states A, B, and C, a time-series change of the state represented by binary values of on (satisfied) / off (not satisfied) is illustrated. Also, at the timing when any of the three states changes, for example, when state B changes from off to on, it is represented by the letter "B", and when it changes from on to off, it is represented by "!B". Thus, the change in the state of the operation result and its order are encoded in the string data.

[0029] For example, the creation unit 15b encodes the operation log 14a acquired by the acquisition unit 15a into string data as illustrated in FIG. 4 and stores it in the storage unit 14.

[0030] Also, the creation unit 15b creates and accepts the state of a given operation result and the order of that state as an operation pattern. For example, the creation unit 15b creates and accepts the conditions for the change in the situation of an operation specified by an analyst via the UI as an operation pattern.

[0031] Specifically, for example, when an analyst specifies the state of an operation result and the order of that state via the UI, the creation unit 15b creates an operation pattern using a regular expression extended with the operand {{<logical expression>}} and accepts it as the extraction condition in the extraction process.

[0032] Here, as illustrated in FIG. 5, the specified order of operations can be represented by string data. In example (1) of FIG. 5, the order of operations "After satisfying the state of A, satisfy the state of C, and then immediately stop satisfying the state of B" is illustrated. This order is encoded in the string data as described above and is represented by "AC!B".

[0033] Also, in example (2) of FIG. 5, the operation order of "after satisfying the state of A and finally ending without satisfying the state of B" is illustrated. This order is expressed as "A.*!B$".

[0034] Also, as illustrated in FIG. 6, the state of the specified operation can be represented by string data using a logical formula. In (1) of FIG. 6, the state of "satisfying both the states of A and B" is expressed as "{{A&B}}". Also, in (2) of FIG. 6, the state of "satisfying the state of A or B and not satisfying the state of C" is expressed as "{{(A|B)&!C}}".

[0035] And, as illustrated in FIG. 7, the state and order of the specified operation can be represented by a regular expression extended with a logical formula. In FIG. 7, the situation of "in a situation where the state of A&C is satisfied, after satisfying the state of B and then remaining in a state where the state of B is not satisfied" is expressed as "{{A&C}}B.*!B$".

[0036] And, as illustrated in FIG. 8(b), the creation unit 15b can represent the state in two values of on (satisfied) / off (not satisfied) by setting and using the state transition rule 14b. In the example shown in FIG. 8(a), for example, the operation pattern of "in a state where the network and plan 1 are set and an order input is performed" can be expressed as "{{<network>&<plan 1>}}.*<order input>".

[0037] Also, the operation pattern of "after setting the network, setting plan 1 immediately after that, and then performing an order input immediately after that" can be expressed as "<network><plan 1><order input>".

[0038] Also, the operation pattern of "currently ending in a state where the network and plan 1 are set" can be expressed as "{{<network>&<plan 1>}}$".

[0039] In this way, the creation unit 15b creates an operation pattern using the character string data which is a series of states represented by two values.

[0040] Return to the description of FIG. 2. The extraction unit 15c extracts the operation pattern included in the acquired operation log 14a. For example, it is determined whether the operation pattern received by the creation unit 15b is included in the acquired operation log 14a.

[0041] Here, FIGS. 9 to 12 are diagrams for explaining the processing of the extraction unit. In FIG. 9, a case where the extraction unit 15c determines whether the operation pattern represented by FIG. 9(1) is included in the operation situation represented by the character string data "BAC!BB!AA!C!A!B" indicating a two-valued state is illustrated.

[0042] In this case, as shown in FIG. 9(2), the extraction unit 15c divides the operation pattern into an order representation and a state representation, and generates a representation list in which each representation of the operation pattern is listed. In this case, the index given in the order of the oldest operation time is set as the variable "depth". Then, as shown in FIG. 9(3), the extraction unit 15c searches for the matching part in the order or state representation in the order of the larger value (newer order) of the variable "depth". Thereby, the operation pattern is extracted from the operation situation.

[0043] In the search for the order representation, using the pattern matching of the regular expression, it is searched where the corresponding order exists in the character string indicating the encoded two-valued state. In the example of FIG. 9(3), first, "!A" is searched. In this case, since there are two places where it matches "!A", the two places are decomposed into partial strings with the start of the character string as the end of the string, and the processing branches into two for each partial string.

[0044] Next, it is evaluated whether the "{{B&C}}", which is the expression of the state, is satisfied for the previous partial string. In the example of Fig. 9(3), in the branch of the partial string "BAC!BB!AA!C!A", it is determined as FALSE in the determination process of the state expression described later and does not satisfy the state, so the process ends assuming it does not match the operation pattern. In the branch of the partial string "BAC!BB!A", it is determined as TRUE, and the search for the expression "A" in the following order proceeds.

[0045] In the search for the expression "A" in the following order, for the partial string "BAC!BB!A", the same process as before is recursively executed. First, one location that matches "A" is found, so the partial string "B" with that location as the end is further extracted, and it is evaluated whether the next state expression "{{B}}" is satisfied for the partial string "B". In this case, it is determined as TRUE, and since the search and evaluation of all expressions are completed, the process ends.

[0046] As a result, since the entire "{{B}}A.*{{B&C}}!A" given as the operation pattern is satisfied, for the string data "BAC!BB!AA!C!A!B" indicating the given binary state, the extraction of the operation pattern "{{B}}A.*{{B&C}}!A" is successful, and "BAC!BB!A" is obtained as the extraction location.

[0047] In the determination of the state expression, it is determined whether the logical formula expressing the state is True or False. For example, the extraction unit 15c determines whether the state {{A&B&C}} is satisfied at the time of the trailing D for the string data shown in Fig. 10(1). In this case, as shown in Fig. 10(2), all patterns may be enumerated. Here, "A(?!.*￥!A)" expresses that any sequence follows A but!A does not occur.

[0048] In this case, for the sequence to the left of D, if any one of the six enumerated regular expression patterns matches, the state {{A&B&C}} is satisfied. However, this method requires searching for the factorial number of patterns of the number N of states (in this case, 3 for A, B, and C) used in the state expression.

[0049] In contrast, the extraction unit 15c may generate one regular expression for each state and hold the result of the match (True / False). For example, for the string data shown in FIG. 11(1), as shown in FIG. 11(2), the extraction unit 15c determines three patterns for the sequence to the left of D respectively and holds the respective match results. Then, as illustrated in FIG. 11(3), it is finally determined by reflecting it in a logical formula.

[0050] In this case, since it is sufficient to search for N (=3) patterns of states and perform one Boolean operation (set operation), the extraction process can be performed at high speed.

[0051] Note that the acquisition unit 15a is not limited to acquiring the operation log 14a offline as described above, and may acquire it online. In the case of online, instead of all the string data which is a sequence of binary states being given in advance, the states are sequentially added to the sequence over time.

[0052] In that case, as illustrated in FIG. 12, the extraction unit 15c holds the states at all times t, and when the determination of the state at time t is required, it makes a determination using the held states. Thereby, it is possible to make a determination at high speed without the need for pattern matching of regular expressions or the like.

[0053] [Extraction Process] Next, with reference to FIGS. 13 and 14, the extraction process by the extraction device 10 according to the present embodiment will be described. FIGS. 13 and 14 are flowcharts showing the extraction process procedure. FIG. 13 shows a procedure for converting the operation log to be subjected to the extraction process into string data which is a sequence of binary states in order to enable extraction by an operation pattern created separately.

[0054] In creating an operation pattern, for example, string data which is a series of binary states is converted according to state transition rules specified by an analyst using a UI or the like, and the operation pattern is created by uniformly using the state names defined by the corresponding state transition rules in regular expressions and logical expressions.

[0055] The flowchart in FIG. 13 starts, for example, at the timing when an analyst instructs the start of processing. First, the acquisition unit 15a acquires an operation log (step S1).

[0056] Next, the creation unit 15b refers to the state transition rule 14b and checks whether the object of the operation matches the "object identification information" of the state transition rule 14b (step S2). If they do not match (step S2, No), the series of processes is terminated. On the other hand, if they match (step S2, Yes), it is checked whether the object of the operation satisfies the "conditions" of the state transition rule 14b (step S3).

[0057] If the object of the operation satisfies the "conditions" (step S3, Yes), the "state name" of the state transition rule 14b is concatenated to the end of the string data, stored in the storage unit 14 (step S4), and the series of processes is terminated.

[0058] Also, if the object of the operation does not satisfy the "conditions" (step S3, No), a string obtained by concatenating "!" to the beginning of the "state name" of the state transition rule 14b is concatenated to the end of the string data, stored in the storage unit 14 (step S5), and the series of processes is terminated.

[0059] Next, FIG. 14 shows a procedure for extracting an operation pattern from an operation log targeted for extraction processing. The flowchart in FIG. 14 starts, for example, at the timing when an analyst instructs the start of processing. First, the extraction unit 15c divides the operation pattern into an expression of order and an expression of state, and generates a list of expressions in which each state of the operation pattern is listed (step S11). Also, the extraction unit 15c initializes the variable "depth" with the length of the list of expressions (step S12).

[0060] Then, the extraction unit 15c acquires, from the creation unit 15b, the character string data obtained by converting the operation log to be processed into a series of binary states (step S13). Further, the extraction unit 15c acquires, as the variable "depth", the index assigned to the expression list in ascending order of the operation time (step S14). Further, 1 is subtracted from the value of the acquired variable "depth" (step S15). Then, when the value of the variable "depth" is -1 or less (step S16, No), "operation pattern exists" and the discovery position are returned (step S17). Thereby, a series of processes ends.

[0061] On the other hand, when the value of the variable "depth" is greater than -1 (step S16, Yes), the extraction unit 15c checks whether the length of the character string data is greater than 0 (step S18). When the length of the character string data is 0 or less (step S18, No), the current recursive process ends (step S30). Thereby, a series of processes ends.

[0062] On the other hand, when the length of the character string data is greater than 0 (step S18, Yes), for the expression in order (step S19, Yes), the extraction unit 15c extracts the matching series from the character string data using a regular expression engine (step S20). Then, the extraction unit 15c repeats the processes of steps S22 to S23 for the number of matching series (steps S21, S24). That is, in the process of step S22, the index at the head of the matching series is saved as the discovery position. Also, in the process of step S23, the left side from the index at the head of the matching series is passed as new character string data.

[0063] If not all recursive processes have ended (step S25, No), the extraction unit 15c ends the current recursive process (step S30). Then, when all recursive processes have ended (step S25, Yes), the extraction unit 15c returns "no operation pattern" (step S26). Thereby, a series of processes ends.

[0064] On the other hand, regarding the expression of the state (Step S19, No), the extraction unit 15c determines whether the logical formula of the state expression is True or False for the character string data (Step S27). If the determination result is True (Step S28, True), the current character string data is passed as new character string data (Step S29), and the process returns to Step S13. On the other hand, if the determination result is False (Step S28, False), the current recursive process is terminated (Step S30). Thereby, a series of processes is completed.

[0065] [Effect] As described above, in the extraction device 10 of the present embodiment, the acquisition unit 15a acquires the operation log 14a. The creation unit 15b creates an operation pattern using the state of the operation result and the order of the states. The extraction unit 15c extracts the operation pattern included in the acquired operation log 14a.

[0066] Thereby, the extraction device 10 can express the operation pattern by uniformly using the state and the order. Also, it becomes easy to determine whether the operation pattern matches the situation.

[0067] Therefore, for example, when analyzing the operation log based on the user's experience, it becomes possible to analyze more flexibly using the operation pattern as a query. Alternatively, when realizing an application that determines the current operation situation of the system operator and causes an action, it becomes possible to express a more flexible operation pattern and make a determination in real time. Therefore, various applications such as preventing mistransmission by determining in real time whether a certain state was satisfied when the mail send button was pressed become easily possible.

[0068] In this way, for example, when it is desired to make a determination based on the state and order of operation logs, such as when a specific operation is performed from a certain system screen state, it becomes possible to easily perform the analysis. Also, after performing this operation, is another operation being performed? After this system screen state, does an operation log exist in which this operation is performed? In this way, it becomes possible for the user to utilize their experience to express an operation pattern and conduct search and analysis.

[0069] Also, the creation unit 15b creates an operation pattern using string data that is a series of states represented by two values. This enables the specification of the operation pattern intended by the analyst.

[0070] Also, the creation unit 15b creates and accepts the state of a given operation result that is input and the order of that state as an operation pattern, and the extraction unit 15c determines whether the accepted operation pattern is included in the acquired operation log. This makes it easily possible to extract the operation pattern intended by the analyst.

[0071] [Program] It is also possible to create a program that describes, in a language executable by a computer, the processing executed by the extraction device 10 according to the above embodiment. As one embodiment, the extraction device 10 can be implemented by installing an extraction program that executes the above extraction processing as package software or online software on a desired computer. For example, by causing the above extraction program to be executed on an information processing device, the information processing device can be made to function as the extraction device 10. The information processing device mentioned here includes desktop or notebook personal computers. In addition, the information processing device also includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone System), and furthermore, slate terminals such as PDAs (Personal Digital Assistants) are included in its scope. Also, the functions of the extraction device 10 may be implemented on a cloud server.

[0072] FIG. 15 is a diagram showing an example of a computer that executes an extraction program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0073] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. For example, a mouse 1051 and a keyboard 1052 are connected to the serial port interface 1050. For example, a display 1061 is connected to the video adapter 1060.

[0074] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each piece of information described in the above embodiment is stored, for example, in the hard disk drive 1031 or the memory 1010.

[0075] Also, the extraction program is stored in the hard disk drive 1031 as a program module 1093 in which instructions executed by the computer 1000 are described. Specifically, a program module 1093 in which each process executed by the extraction device 10 described in the above embodiment is described is stored in the hard disk drive 1031.

[0076] In addition, data used for information processing by the extraction program is stored, as program data 1094, in, for example, the hard disk drive 1031. Then, the CPU 1020 reads out the program module 1093 and program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-described procedures.

[0077] Note that the program module 1093 and program data 1094 related to the extraction program are not limited to being stored in the hard disk drive 1031, and may be stored in a removable storage medium, for example, and read out by the CPU 1020 via the disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 related to the extraction program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read out by the CPU 1020 via the network interface 1070.

[0078] As described above, the embodiments to which the invention made by the present inventor is applied have been described, but the present invention is not limited by the description and drawings that form a part of the disclosure of the present invention according to the present embodiment. That is, all other embodiments, examples, operation techniques, etc. made by those skilled in the art based on the present embodiment are included in the scope of the present invention.

Description of Reference Numerals

[0079] 10 Extraction device 11 Input unit 12 Output unit 13 Communication control unit 14 Storage unit 14a Operation log 14b State transition rule 15 Control unit 15a Acquisition unit 15b Creation unit 15c Extraction unit

Claims

1. A creation unit that creates an operation pattern using the state of the operation result and the order of the states; An acquisition unit that acquires an operation log; An extraction unit that extracts the operation pattern included in the acquired operation log, and having: The creation unit: Encodes the operation log into string data, and converts the state of the actual operation result included in the operation log into a state represented by two values using a state conversion rule; Creates an operation pattern in which the state of the operation result and the order of the states are represented by the string data using the string data that is a series of the states represented by the two values. An extraction device characterized by the above.

2. The creation unit creates and accepts the state of a predetermined operation result and the order of the states as the operation pattern; The extraction unit determines whether the accepted operation pattern is included in the acquired operation log. The extraction device according to claim 1, characterized by the above.

3. An extraction method executed by an extraction device, comprising: A creation step of creating an operation pattern using the state of the operation result and the order of the states; An acquisition step of acquiring an operation log; An extraction step of extracting the operation pattern included in the acquired operation log, and The creation step: Encodes the operation log into string data, and converts the state of the actual operation result included in the operation log into a state represented by two values using a state conversion rule; Creates an operation pattern in which the state of the operation result and the order of the states are represented by the string data using the string data that is a series of the states represented by the two values. An extraction method characterized by the above.

4. A creation step of creating an operation pattern using the state of the operation result and the order of the states; An acquisition step of acquiring an operation log; An extraction program for causing a computer to execute an extraction step of extracting the operation pattern included in the acquired operation log, and The creation step: Encodes the operation log into string data, and converts the state of the actual operation result included in the operation log into a state represented by two values using a state conversion rule; Creates an operation pattern in which the state of the operation result and the order of the states are represented by the string data using the string data that is a series of the states represented by the two values. An extraction program.

Images