Classification device, classification method, and classification program

Abstract

A classification device (10) of one embodiment gathers the operation logs of a terminal device (20). On the basis of the operation logs, the classification device (10) creates information indicating the co-occurrence frequency among operations performed on the terminal device (20). Using the information indicating the co-occurrence frequency and information indicating similarity among the operations, the classification device (10) classifies, into classes, the operations performed on the terminal device (20).

Description

Technical Field

[0001] The present invention relates to a classification device, a classification method, and a classification program.

Background Art

[0002] In order to effectively improve operations in companies and the like, it is important to accurately understand the target operations. The person in charge of the operation performs multiple operations every day using an information terminal such as a PC or a tablet. The operations performed via the information terminal are composed of multiple tasks. The tasks performed on the PC refer to, for example, a series of information input operations (input to a text box, click on a button, etc.) necessary to perform the operation.

[0003] In actual operations, the operation procedures vary due to various factors such as the person in charge and the content of the order. The operation procedures are basically defined by a manual, but there may be a deviation from the manual because the work content has changed since the manual was created or the person in charge has performed the work in an original way.

[0004] As a prerequisite for considering business improvement measures, business analysts need to understand what tasks are being performed, how much time is spent on them, and what procedures (operations) are involved. For example, in order to introduce RPA (Robotic Process Automation) and enhance the improvement effect, it is possible to efficiently achieve business improvement by grasping the types and amounts of tasks performed in the operation and introducing RPA from the task types with a large amount of work.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Non-Patent Documents

[0006]

Non-Patent Document 1

[0007] However, in the conventional technology, it may be difficult to classify work considering the similarity between operations.

[0008] For example, Non-Patent Document 4 describes a method of classifying operation logs by operation type, then focusing on the co-occurrence of operations to divide the operation logs into segments, and classifying the divided segments into work units using agglomerative clustering.

[0009] Here, consider a system where the URL and window style change depending on the case. At this time, for example, an operation such as "press the decision button" is preferably classified as the same work even if the URL and window style change.

[0010] On the other hand, in the method of Non-Patent Document 4, since the similarity between operations is not considered, when the URL and window style change, an operation such as "press the decision button" may be classified as a different work.

Means for Solving the Problems

[0011] In order to solve the above-described problems and achieve the object, the classification device of the present invention includes a collection unit that collects an operation log of an information processing device, a creation unit that creates information representing the co-occurrence frequency between operations on the information processing device based on the operation log, and a classification unit that classifies operations on the information processing device into classes using the information representing the co-occurrence frequency and the information representing the similarity between operations.

Effects of the Invention

[0012] According to the present invention, it is possible to classify work in consideration of the similarity between operations.

Brief Description of the Drawings

[0013]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Embodiments for Carrying Out the Invention

[0014] Hereinafter, embodiments of the classification device, classification method, and classification program according to the present application will be described in detail with reference to the drawings. Also, the present invention is not limited to the embodiments described below.

[0015] [Configuration of Classification Device] FIG. 1 is a block diagram showing an example of the configuration of a classification device. As shown in FIG. 1, the classification device 10 is connected to a terminal device 20 via a network.

[0016] The terminal device 20 is an information processing device used by a user. The user is, for example, a business operator. The business operator uses various software such as business systems and general-purpose applications on the terminal device 20, for example.

[0017] Note that the terminal device 20 may be any type of information processing device including client devices such as smartphones, desktop PCs, notebook PCs, tablet PCs, etc.

[0018] Also, in the example of FIG. 1, the classification device 10 and the terminal device 20 are shown as separate devices, but the terminal device 20 may have some or all of the functions of the classification device 10.

[0019] The terminal device 20 acquires the operation logs of the user. For example, the terminal device 20 acquires operation logs including the operation date and time, operation location, operation position, etc. at the timing when an operation event occurs. The terminal device 20 transmits the acquired operation logs to the classification device 10.

[0020] The classification device 10 includes a communication unit 11, a storage unit 12, and a control unit 13.

[0021] The communication unit 11 is realized by a NIC (Network Interface Card) or the like, and controls communication with external devices via telecommunication lines such as a LAN (Local Area Network) and the Internet. For example, the communication unit 11 receives operation logs from the terminal device 20.

[0022] The storage unit 12 stores data and programs necessary for various processes by the control unit 13, and has an operation log storage unit 121 and a similarity storage unit 122. For example, the storage unit 12 is a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

[0023] The operation log storage unit 121 stores the operation logs acquired from the terminal device 20.

[0024] FIG. 2 is a diagram showing an example of an operation log. As shown in FIG. 2, the operation log stored in the operation log storage unit 121 includes an operation date and time, user information which is information for identifying the user who performed the operation, application information which is information for identifying the application to be operated, window information which is information regarding the window to be operated, an operation location (objects such as buttons, text boxes, cells, etc.), a captured image of the screen when the operation is performed, and an operation position (coordinates within the screen).

[0025] The classification device 10 receives an operation log from the terminal device 20 and stores the received operation log in the operation log storage unit 121. Note that the timing at which the classification device 10 receives the operation log may be any timing. For example, the classification device 10 may receive the operation log at regular time intervals, or may receive the operation log each time a new operation log is generated.

[0026] The similarity storage unit 122 stores the similarity between the center-of-gravity vectors, which will be described later. The center-of-gravity vectors and the similarity will be described later.

[0027] The control unit 13 has an internal memory for storing a program that defines various processing procedures and the like and required data, and executes various processes based on these.

[0028] For example, the control unit 13 includes a collection unit 131, a specification unit 132, a creation unit 133, and a classification unit 134.

[0029] Also, the control unit 13 is an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0030] The collection unit 131 collects the operation logs of the terminal device 20. The terminal device 20 is an example of an information processing device.

[0031] The specifying unit 132 specifies the operation corresponding to the operation log. For example, the specifying unit 132 reads out the operation log table shown in FIG. 2 from the operation log storage unit 121 and adds a column of operation content.

[0032] The specifying unit 132 adds the information obtained by combining the window information and the operation location to the column of operation content and stores it in the operation log storage unit 121.

[0033] For example, the specifying unit 132 adds information such as "Web page 1 + button e" and "Web page 1 + text box b" to the column of operation content.

[0034] Furthermore, for operations with the same operation content, the specifying unit 132 specifies that they are the same operation. The specifying unit 132 can specify the type of operation.

[0035] To explain with a specific example, when there are multiple operations with the operation content of "Web page 1 + button a", the specifying unit 12 specifies that these operations are the same operation.

[0036] The creation unit 133 creates information representing the co-occurrence frequency between operations on the terminal device 20 and information representing the similarity between operations based on the operation log.

[0037] For example, the creation unit 133 creates a co-occurrence matrix having the same number of rows and columns as the number of operations on the terminal device 20 and having the co-occurrence frequency between operations as elements, and a similarity matrix having the same number of rows and columns as the number of operations and having the similarity between operations as elements.

[0038] FIG. 3 is a diagram showing an example of a co-occurrence matrix. The creation unit 133 reads operations from the operation log storage unit 121 in chronological order (in the order of earlier operation date and time), counts the n operations (where n is an integer of 1 or more) before and after each operation, and creates a co-occurrence matrix for each operation. Each row of the operation log storage unit 121 corresponds to an operation.

[0039] At this time, when the previous and subsequent operations occur within the same window (the web page and file are common), the creation unit 133 may count them with weights. For example, the creation unit 133 counts an operation on a different web page as 1, and an operation on the same web page as 0.5.

[0040] FIG. 4 is a diagram showing an example of a similarity matrix. Here, each of a, b, c, d, and e is an operation identified as being the same by the identification unit 132.

[0041] Therefore, for example, there may be a plurality of operation logs corresponding to each operation (for example, operation a) in the operation log storage unit 121.

[0042] As shown in FIG. 4, the similarity matrix is represented as a square matrix with each operation corresponding to rows and columns.

[0043] Each component of the similarity matrix is the similarity between operations. The similarity is a continuous value from 0 to 1. In the embodiment, by considering such similarity, compared with the case of representing the relationship between operations in binary (1 (identical) or 0 (non-identical)), the operations can be classified more appropriately considering the similarity.

[0044] Note that the greater the similarity, the more similar the operations are. If the similarity between two operations is 1, the two operations are regarded as identical.

[0045] The similarity between operations may be given in advance by an administrator or the like. Also, the similarity may be calculated by the creation unit 133 based on the similarity of each item in the operation log storage unit 121.

[0046] For example, the creation unit 133 may increase the similarity as the number of items with the same value increases. Also, for example, the creation unit 133 may increase the similarity as the operation positions are closer.

[0047] Furthermore, the creation unit 133 creates a similar co-occurrence matrix from the co-occurrence matrix and the similarity matrix.

[0048] Here, the co-occurrence matrix C is represented as in Equation (1). For example, c ij is the co-occurrence frequency of operations i and j. Note that the creation unit 133 can create the co-occurrence matrix by the method described in Non-Patent Document 4.

[0049]

Equation

[0050] Also, the similarity matrix S is represented as in Equation (2). For example, s ij is the similarity between operations i and j.

[0051]

Equation

[0052] In this case, n is the number of types of operations. And the creation unit 133 calculates the components of the similar co-occurrence matrix by Equation (3). However, i, j, and k are indices for specifying the matrix components.

[0053]

Equation

[0054] Figure 5 is a diagram for explaining the method of creating the similar co-occurrence matrix. The creation unit 133 applies the method of Equation (3) to the co-occurrence matrix in Figure 3 and the similarity matrix in Figure 4, and calculates the components of the row corresponding to operation a as shown in Figure 5.

[0055] In the example of Figure 5, the operation vector of operation a is [0.4, 1.6, 2, 0.7].

[0056] In this way, the creation unit 133 creates an operation vector for each operation using the co-occurrence matrix.

[0057] Since the length of the operation vector is equal to the number of operation types, the greater the number of operation types, the higher the calculation cost. For this reason, the creation unit 133 may perform dimensionality reduction on each operation vector using a dimensionality reduction method such as SVD (Singular Value Decomposition). For example, the creation unit 133 compresses a 1000-dimensional operation vector to 50 dimensions by SVD.

[0058] The classification unit 134 classifies the operations on the terminal device 20 into classes using the information representing the co-occurrence frequency and the information representing the similarity. For example, the classification unit 134 classifies the operations on the terminal device 20 into classes using the co-occurrence matrix and the similarity matrix.

[0059] Also, the classification unit 134 classifies the operations on the terminal device 20 into classes using the similar co-occurrence matrix obtained by adding the product of the co-occurrence matrix and the similarity matrix to the co-occurrence matrix.

[0060] Specifically, the classification unit 134 obtains each row of the similar co-occurrence matrix as an operation vector, determines a split point in the sequence of operations based on the operation log, and classifies the set of operations split at the split point into classes based on the change in the similarity between the centroids of the operation vectors of a plurality of operations before and after the split point in the sequence.

[0061] First, the classification unit 134 arranges the operations in chronological order. The sequence obtained here is called an operation sequence. Also, each operation in the operation sequence is identified by a number (for example, operation 1, operation i, operation n).

[0062] Then, the classification unit 134 sets the operation i, which is the i-th operation in the operation sequence, as the operation to be judged for splitting (split point), and obtains m operation sequences (operation (i - m), operation (i - m + 1), …, operation i) up to operation i and m operation sequences (operation (i + 1), operation (i + 2), …, operation (i + m + 1)) after operation i.

[0063] Let the m operation sequences up to operation i be operation sequence A. Also, let the m operation sequences after operation i be operation sequence B.

[0064] The classification unit 134 acquires the operation vectors of each operation included in operation sequence A, and calculates the centroid vector of the acquired operation vectors.

[0065] FIG. 6 is a diagram showing an example of an operation sequence. In the example of FIG. 6, it is assumed that a division point is defined between operation sequence bdefg (operation sequence A) and operation sequence opqrs (operation sequence B).

[0066] At this time, the classification unit 134 calculates the centroid (centroid vector A) of operation sequence A as in equation (4).

[0067]

Equation

[0068] Also, the classification unit 134 calculates the centroid (centroid vector B) of operation sequence B as in equation (5).

[0069]

Equation

[0070] However, m is the number of operation vectors, and in the examples of equations (4) and (5), m = 5. Note that the classification unit 134 may calculate the sum vector instead of the centroid vector.

[0071] Furthermore, the classification unit 134 calculates the similarity between the calculated centroid vectors as in equation (6), and stores the calculated similarity in the similarity storage unit 122. However, |V| is the dimension number of the centroid vector.

[0072]

Equation

[0073] Similarly, the classification unit 134 calculates the similarity between the centroid vectors for each split point of the operation sequence. Note that the similarity may be the cosine similarity shown in Equation (6), or may be the Euclidean distance or the like.

[0074] FIG. 7 is a diagram for explaining the change in the similarity between the centroids. The lines in FIG. 7 represent the change in the similarity between the centroid vectors for each split point.

[0075] The classification unit 134 divides the operation sequence at a split point where the difference in similarity is equal to or greater than a threshold value. The arrows in FIG. 7 represent monotonic decrease and monotonic increase. The classification unit 134 divides the operation sequence at the split point corresponding to the local minimum point if (similarity at the start position of monotonic decrease - similarity at the local minimum point) + (similarity at the end position of monotonic increase - similarity at the local minimum point) is equal to or greater than the threshold value.

[0076] In the example of FIG. 7, the classification unit 134 obtains the operation sequences abcdefg, opqrstuvwxyz, and hijklmn by the division. Thus, the operation sequences obtained by the division are called operation sets.

[0077] The classification unit 134 classifies the operation sets into classes. First, the classification unit 134 performs classification in descending order of the number of types of operations included.

[0078] FIGS. 8 and 9 are diagrams showing an example of the classification result. In the example of FIG. 8, as shown in FIG. 9, the operation sets can be divided according to the number of types of operations included.

[0079] First, the classification unit 134 classifies the operation set abcdefgabcdefefg, which has the largest number of types of operations included, into class 1.

[0080] Then, for the operation set opqrssutxwxyz, which has the second largest number of types of operations included, since the number of operations in common with the already classified operation set abcdefgabcdefefg is 0 and is equal to or less than a threshold value (for example, 5), the classification unit 134 classifies the operation set opqrssutxwxyz into class 2, which is a new class.

[0081] Also, since the number of operations common to the classified operation set abcdefgabcdefefg in the operation set abcdefg is 5, which is equal to or greater than the threshold value, the classification unit 134 classifies the operation set abcdefg into class 1.

[0082] [Processing Procedure of Classification Device] The flowchart is used to explain the flow of each process by the classification device 10.

[0083] FIG. 10 is a flowchart showing the flow of the process of collecting operation logs. As shown in FIG. 10, the classification device 10 acquires operation logs from the PC terminal (terminal device 20) until the user of the PC terminal stops the process or shuts down the PC terminal (step S101, No) (step S102).

[0084] Also, when the user of the PC terminal stops the process or shuts down the PC terminal (step S101, Yes), the classification device 10 ends the process of collecting operation logs.

[0085] FIG. 11 is a flowchart showing the flow of the process of creating a similarity matrix. As shown in FIG. 11, the classification device 10 substitutes the operation similarity into each component of the similarity matrix until all components of the similarity matrix are substituted with similarity (step S201, No) (step S202).

[0086] When the classification device 10 has finished substituting similarity into all components of the similarity matrix (step S201, Yes), the classification device 10 ends the process of creating the similarity matrix.

[0087] FIG. 12 is a flowchart showing the flow of the process of creating a co-occurrence matrix. As shown in FIG. 12, the classification device 10 targets operations in chronological order until all operations are targeted (step S301, No), counts the n operations before and after, and reflects them in the co-occurrence matrix (step S302).

[0088] When the reflection of the co-occurrence matrix is completed for all operations (step S301, Yes), the classification device 10 ends the process of creating the co-occurrence matrix.

[0089] FIG. 13 is a flowchart showing the flow of the process of creating a similar co-occurrence matrix. As shown in FIG. 13, until all components of the co-occurrence matrix are targeted (step S401, No), the classification device 10 creates a similar co-occurrence matrix from the similarity matrix and the co-occurrence matrix (step S402).

[0090] When the classification device 10 has finished targeting all components of the co-occurrence matrix (step S401, Yes), it generates an operation vector for each operation from the similar co-occurrence matrix (step S403).

[0091] FIG. 14 is a flowchart showing the flow of the process of calculating the similarity of the centroid vectors. As shown in FIG. 14, until all operations are targeted (step S501, No), the classification device 10 targets the operations in chronological order and generates centroid vectors for the first m operations including the target operation (step S502).

[0092] Subsequently, the classification device 10 generates centroid vectors for m operations starting from the operation next to the target operation (step S503). Then, it calculates the similarity of the two centroid vectors and accumulates it in the similarity storage unit 122 (step S504).

[0093] When the classification device 10 has finished targeting all operations (step S501, Yes), it ends the process of calculating the similarity of the centroid vectors.

[0094] FIG. 15 is a flowchart showing the flow of the process of dividing the operation sequence. As shown in FIG. 15, until all operations are targeted (step S601, No), the classification device 10 detects the start of the decrease in the similarity between the centroid vectors arranged in chronological order (step S602).

[0095] Here, the classification device 10 detects the next start of decrease (= end of increase) and the minimum point therebetween from the start of decrease in similarity (step S603).

[0096] The classification device 10 calculates a depth (d) = the difference from the start of decrease in similarity to the minimum point + the difference between the minimum point and the end of increase (step S604).

[0097] When the calculated depth is greater than or equal to the threshold value (step S605, Yes), the classification device 10 divides between the target operation and the next operation (step S606). When the calculated depth is not greater than or equal to the threshold value (step S605, No), the classification device 10 returns to step S601.

[0098] When the classification device 10 has finished targeting all operations (step S601, Yes), it ends the process of dividing the operation sequence.

[0099] FIG. 16 is a flowchart showing the flow of the process of classifying operations into classes. As shown in FIG. 16, the classification device 10 determines the target operation sequence (step S702) until it targets all operation sequences (step S701, No).

[0100] Here, if there is no classified operation sequence (step S703, No), the classification device 10 classifies the target operation sequence into a new class (step S707).

[0101] If there is a classified operation sequence (step S703, Yes), the classification device 10 calculates the number of common operation types between the target operation sequence and the operation sequences within each class (step S704).

[0102] Then, when there is a class where the number of common operation types is greater than or equal to the threshold value and the number of common operation types is the largest (step S705, Yes), the classification device 10 classifies the target operation sequence into the class that satisfies the conditions (step S706).

[0103] When the number of common operation types is equal to or greater than the threshold value and there is no class with the largest number of common operation types (step S705, No), the classification device 10 classifies the target operation sequence into a new class based on the conditions (step S707).

[0104] When the classification device 10 has finished processing all operation sequences (step S701, Yes), it ends the process of dividing the operation sequences.

[0105] [Effects of the Embodiment] As described above, the classification device 10 of the embodiment includes a collection unit 131, a creation unit 133, and a classification unit 134. The collection unit 131 collects the operation logs of the terminal device 20. The creation unit 133 creates information representing the co-occurrence frequency between operations on the terminal device 20 based on the operation logs. The classification unit 134 classifies the operations on the terminal device 20 into classes using the information representing the co-occurrence frequency and the information representing the similarity. The creation unit 133 can create information representing the similarity based on the items or operation positions included in the operation logs.

[0106] In this way, the classification device 10 can classify work considering the similarity between operations. As a result, the work can be classified in a form closer to the actual state of the business.

[0107] Further, the creation unit 133 creates a co-occurrence matrix having the same number of rows and columns as the number of operations on the terminal device 20 and having the co-occurrence frequency between operations as elements, and a similarity matrix having the same number of rows and columns as the number of operations and having the similarity between operations as elements. The classification unit 134 classifies the operations on the terminal device 20 into classes using the co-occurrence matrix and the similarity matrix. For example, the classification unit 134 classifies the operations on the terminal device 20 into classes using a similar co-occurrence matrix obtained by adding the product of the co-occurrence matrix and the similarity matrix to the co-occurrence matrix.

[0108] This makes it possible to perform classification considering both the co-occurrence frequency and the similarity between operations.

[0109] In addition, the classification unit 134 obtains each row of the similarity co-occurrence matrix as an operation vector, determines a split point in a series of operations based on the operation log, and classifies the set of operations split at the split point into classes based on the change in similarity between the centroids of the operation vectors of a plurality of operations before and after the split point in the series.

[0110] Thereby, the similarity between operations can also be reflected in the splitting of the operation series.

[0111] [Regarding the System Configuration of the Embodiment] Each component of the classification device 10 shown in FIG. 1 is a functional concept, and does not necessarily have to be physically configured as shown in the figure. That is, the specific form of the distribution and integration of the functions of the classification device 10 is not limited to that shown in the figure, and all or part of it can be functionally or physically distributed or integrated in any unit according to various loads, usage situations, etc.

[0112] In addition, all or any part of each process performed in the classification device 10 may be realized by a program analyzed and executed by a CPU and the CPU. Also, each process performed in the classification device 10 may be realized as hardware by wired logic.

[0113] In addition, among the processes described in the embodiment, all or part of the processes described as being automatically performed can also be manually performed. Or, all or part of the processes described as being manually performed can also be automatically performed by a known method. In addition, regarding the above-described and illustrated process procedures, control procedures, specific names, and information including various data and parameters, they can be appropriately changed unless otherwise specified.

[0114] [Program] FIG. 17 is a diagram showing an example of a computer that executes a classification program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0115] The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System), for example. The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100, for example. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to a display 1130, for example.

[0116] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, the program that defines each process of the classification device 10 is implemented as a program module 1093 in which executable code by the computer 1000 is described. The program module 1093 is stored in the hard disk drive 1090, for example. For example, a program module 1093 for executing the same processing as the functional configuration in the classification device 10 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0117] In addition, the setting data used in the processing of the above-described embodiment is stored, for example, in the memory 1010 or the hard disk drive 1090 as program data 1094. Then, the CPU 1020 reads out and executes the program modules 1093 and program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as needed.

[0118] Note that the program modules 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, and may be stored, for example, in a removable storage medium and read by the CPU 1020 via a disk drive 1100 or the like. Alternatively, the program modules 1093 and program data 1094 may be stored in another computer connected via a network (such as a LAN (Local Area Network) or a WAN (Wide Area Network)). Then, the program modules 1093 and program data 1094 may be read by the CPU 1020 from another computer via the network interface 1070.

[0119] As described above, the embodiments to which the invention made by the present inventor is applied have been described. However, the present invention is not limited by the description and drawings that form a part of the disclosure of the present invention according to the present embodiment. That is, all other embodiments, examples, and operation techniques made by those skilled in the art based on the present embodiment are included in the scope of the present invention.

Description of Reference Numerals

[0120] 10 Classification device 11 Communication unit 12 Storage unit 13 Control unit 20 Terminal device 121 Operation log storage unit 122 Similarity storage unit 131 Collection unit 132 Identification unit 133 Creation unit 134 Classification unit

Claims

1. A collecting unit that collects operation logs of an information processing device, A creating unit that creates information representing the co-occurrence frequency between operations on the information processing device based on the operation logs, A classifying unit that classifies operations on the information processing device into classes using the information representing the co-occurrence frequency and the information representing the similarity between operations, A classification device, characterized by comprising the above.

2. The creating unit creates a co-occurrence matrix having the same number of rows and columns as the number of operations on the information processing device, with the co-occurrence frequency between operations as components, and a similarity matrix having the same number of rows and columns as the number of operations, with the similarity between operations as components. The classifying unit classifies operations on the information processing device into classes using the co-occurrence matrix and the similarity matrix. The classification device according to claim 1, characterized by this.

3. The classifying unit classifies operations on the information processing device into classes using a similar co-occurrence matrix obtained by adding the product of the co-occurrence matrix and the similarity matrix to the co-occurrence matrix. The classification device according to claim 2, characterized by this.

4. The classifying unit acquires each row of the similar co-occurrence matrix as an operation vector, determines a splitting point in a series of operations based on the operation logs, and classifies the set of operations split at the splitting point into classes based on the change in the similarity between the centroids of the operation vectors of a plurality of operations before and after the splitting point in the series. The classification device according to claim 3, characterized by this.

5. The creating unit creates the information representing the similarity based on items or operation positions included in the operation logs. The classification device according to claim 1, characterized by this.

6. A classification method executed by a classification device, A collecting step of collecting operation logs of an information processing device, A creating step of creating information representing the co-occurrence frequency between operations on the information processing device based on the operation logs, A classifying step of classifying operations on the information processing device into classes using the information representing the co-occurrence frequency and the information representing the similarity between operations, A classification method, characterized by including the above.

7. A collecting step of collecting operation logs of an information processing device, A creating step of creating information representing the co-occurrence frequency between operations on the information processing device based on the operation logs, A classifying step of classifying operations on the information processing device into classes using the information representing the co-occurrence frequency and the information representing the similarity between operations, A classification program, characterized by causing a computer to execute the above.

Images