String classification device, program, and string classification method

Abstract

To provide a character string classification device capable of streamlining data cleansing.SOLUTION: A data cleansing device 100 includes: a vectorization unit 112 that converts a character string included in one event log entry into a vector; a dimensional compression unit 113 that converts the vector into a low dimensional vector by dimensional compression processing; a clustering unit 114 that classifies the low dimensional vector into one or more clusters through clustering processing; and a subdivision and integration unit 115 that reorganizes the clusters by performing at least one of the cluster segmentation and the cluster consolidation.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a string classification device, a program, and a string classification method that extract, classify, and visualize logs required for process mining from event logs. [Background technology]

[0002] Process mining is gaining attention as a solution for automating and streamlining business processes. Process mining is a method for supporting business efficiency by understanding the entire business process from event logs, discovering and monitoring the actual business process, and identifying specific areas for improvement.

[0003] Regarding event logs, the IEEE Process Mining Task Force created the "Process Mining Manifesto" (Internet<URL:https: / / www.tf-pm.org / upload / 1580738062276.pdf> The article states, "Although a collection of events is called an event log, events do not necessarily have to be stored in a dedicated log file. Events may be stored in database tables, message logs, mail archives, transaction logs, or other data sources."

[0004] To perform process mining, the event logs used must be of a certain level of quality. The above-mentioned "Process Mining Manifesto" defines the quality indicator of this event log as the event log maturity level. Event log maturity levels range from 1 to 5, with process mining applicable at level 3 and above. In principle, process mining can be applied at level 2 or below, but the reliability of the results obtained will be low due to the low maturity level.

[0005] A conventional process mining technique is described in Patent Document 1. This technique divides a process group, which includes multiple nodes corresponding to multiple tasks and edges indicating transition relationships between the nodes, into multiple subprocesses, thereby supporting the understanding and optimization of the entire process, as well as the understanding and optimization of subprocesses. The process groups used in the technology described in Patent Document 1 are generated from event logs. These event logs are recorded automatically and systematically and are assumed to be at maturity level 4 or higher. This allows for highly reliable process mining results. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Publication No. 2020-201601 Summary of the Invention [Problem to be solved by the invention]

[0007] Event logs that show a company's business processes are often not recorded systematically, and at the same time, their maturity level is often low. Patent Document 1 does not mention event log data with a low maturity level, and therefore does not consider it as a target for process mining. When the maturity level of event logs is low, a process called data preprocessing or data cleansing is required to improve the quality of the acquired event logs by organizing, extracting, and classifying the logs necessary for process mining. The volume of system logs that show a company's business processes is enormous, and they come in a wide variety of formats. For this reason, in practice, the significant effort and time required for data cleansing processing has become a major problem, and a solution is needed. The present invention has been made in view of the above background, and an object of the present invention is to provide a string classification device, a program, and a string classification method that improve the efficiency of data cleansing. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, a string classification device (data cleansing device) according to the present invention includes a vectorization unit that converts a string included in one item of an event log into a vector, a dimensionality reduction unit that converts the vector into a low-dimensional vector by a dimensionality reduction process, a clustering unit that classifies the low-dimensional vector into one or more clusters by a clustering process, and a subdivision and integration unit that reorganizes the clusters by performing at least one of subdivision and integration of the clusters. wherein the vector indicates the meaning of the character string, and the subdivision and integration unit reorganizes the clusters so that a similarity between character strings indicated by the vectors included in each cluster becomes greater than a predetermined value, and the similarity is calculated based on a character string edit distance between the character strings indicated by the vectors. . [Effects of the Invention]

[0009] According to the present invention, it is possible to provide a string classification device, a program, and a string classification method that improve the efficiency of data cleansing. Problems, configurations, and effects other than those described above will become clear from the description of the following embodiments. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 2 is a functional block diagram of the data cleansing apparatus according to the present embodiment. [Figure 2] FIG. 4 is a diagram showing an event log according to the embodiment. [Figure 3] FIG. 10 is a diagram showing an event log after being converted into a table format according to the present embodiment. [Figure 4] FIG. 10 is a diagram showing the event log after the format has been corrected and records containing missing items have been deleted according to the present embodiment. [Figure 5] 10A and 10B are diagrams for explaining conversion of a character string into a vector according to the present embodiment. [Figure 6] 10A and 10B are diagrams for explaining conversion of a character string into a low-dimensional vector according to the present embodiment. [Figure 7] 10 is a flowchart of a data cleansing process according to the present embodiment. [Figure 8] 10 is a flowchart of a classification process according to the present embodiment. [Figure 9] FIG. 2 is a three-dimensional plot of low-dimensional vectors according to the present embodiment. [Figure 10] 10 is a histogram of low-dimensional vectors according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] <<Outline of the data cleansing device>> A data cleansing device (string classification device) according to an embodiment of the present invention will be described below. The data cleansing device receives an event log as input, classifies the events by specific items, and visualizes them. The specific items are items that indicate the name, type, and content of an event, such as an action name, and are items that indicate activities (steps) within a business process. Specific examples of these specific items will be described later.

[0012] Depending on the event log, activities that are considered to be the same or of the same type may be recorded under different names or character strings, which can be an obstacle to process mining. Data cleansing devices use clustering and natural language processing on items that indicate activity to separate events into groups with similar meanings or content. Using event logs preprocessed by such data cleansing devices makes it possible to perform appropriate process mining.

[0013] <Configuration of data cleansing device> 1 is a functional block diagram of a data cleansing apparatus 100 (string classification apparatus) according to this embodiment. The data cleansing apparatus 100 is a computer, and includes a control unit 110, a storage unit 120, and an input / output unit 180. User interface devices such as a display, keyboard, and mouse are connected to the input / output unit 180. The input / output unit 180 may include a communication device, enabling data transmission and reception with other devices. A media drive may also be connected to the input / output unit 180, enabling data exchange using a recording medium.

[0014] <<Data cleansing device: memory unit>> The storage unit 120 includes storage devices such as a read-only memory (ROM), a random access memory (RAM), and a solid-state drive (SSD). The storage unit 120 stores an event log database 130 and a program 128. The event log database 130 stores an event log 510 (see FIG. 2, which will be described later) to be processed. The program 128 includes a description of a data cleansing process (see FIG. 7, which will be described later).

[0015] <<Data cleansing device: control unit>> The control unit 110 includes a CPU (Central Processing Unit) and includes a preprocessing unit 111, a vectorization unit 112, a dimensionality reduction unit 113, a clustering unit 114, a subdivision and integration unit 115, a display control unit 116, and a postprocessing unit 117.

[0016] <Data cleansing device: preprocessing section> The preprocessing unit 111 reads the event log 510 (see FIG. 2, which will be described later) to be processed from the event log database 130, extracts items, corrects the format, and deletes blank data.

[0017] FIG. 2 is a diagram showing an event log 510 according to this embodiment. The event log 510 is, for example, text data, with one line representing one event. An event is one step in a business process or an operation on a business system, for example, a process displayed on one screen of the business system. One line includes one or more items separated by, for example, a semicolon (";"). In the event log 510, the first item on each line includes the date and time. The first two lines include two items, while the other lines each include items for the operator, operation page name, process name, action name, and order number. As will be described later, in the event log 510, the action name corresponds to the activity.

[0018] The preprocessing unit 111 reads the event log 510 and converts it into a table-format event log 520 (see FIG. 3, which will be described later) in which items separated by semicolons are arranged as columns. Note that the character used as a separator is not limited to a semicolon and may be another character. The preprocessing unit 111 may obtain the separator by inquiring of the user of the data cleansing device 100.

[0019] 3 is a diagram showing the event log 520 after conversion into a table format according to this embodiment. The rows (records) of the event log 520 correspond to the rows (events) of the event log 510. The columns (attributes) of the event log 520 correspond to the items of the event log 510. The names of the columns (item names) of the event log 520 are obtained from the items of the event log 510, but may also be obtained by inquiring with the user of the data cleansing apparatus 100 or may be selected from predefined names. The first item includes the date and time, and the data cleansing apparatus 100 uses the predefined name "timestamp" as the column name.

[0020] Next, the preprocessing unit 111 corrects the format of each item. For example, the preprocessing unit 111 corrects the format of the date and time to a default format. In addition, the preprocessing unit 111 may, for example, standardize full-width alphanumeric characters to half-width alphanumeric characters (convert "A:3" to "A:3"). Next, the preprocessing unit 111 deletes records that contain missing items (blank items). The first two lines in the event log 520 are missing the operation page name and process name, and are deleted. The preprocessing unit 111 may also delete records in which specific items are blank. The specific items are items necessary for process mining, such as timestamps, activities, and case identification information items, and in the event log 510, these are the timestamp, action name, and order number.

[0021] 4 shows an event log 530 according to the present embodiment after the format has been corrected and records containing missing entries have been deleted. Compared to event logs 510 and 520, the date format for the timestamps has been changed and data other than the date and time has been deleted. Additionally, records containing missing entries have been deleted, including the first two lines of event logs 510 and 520.

[0022] <Data cleansing device: Vectorization unit> Returning to Fig. 1, the description of the control unit 110 will continue. The vectorization unit 112 converts character strings corresponding to activities in the event log 530 into vectors. An activity indicates a step in a business process or an operation of a business system, and indicates the name or content of an event. In the event log 530, the name of an operation becomes an activity.

[0023] A vector is a multi-dimensional vector, and the vectorization unit 112 converts character strings into vectors using natural language processing technology. An example of a natural language processing technology used by the vectorization unit 112 for vectorization is BERT (Bidirectional Encoder Representations from Transformers). Alternatively, word2vec may be used, or any natural language processing technology that allows clustering or the creation of a regression model using the generated vectors may be used. Fig. 5 is a diagram for explaining the conversion of a character string into a vector according to this embodiment. Fig. 5 shows that a character string in an action name is converted into a vector of 768 dimensions. Note that 768 dimensions is just an example.

[0024] As described above, the vectorization unit 112 provided in the data cleansing apparatus 100 converts a character string included in one item of the event log into a vector. The vectorization unit 112 converts character strings into vectors using natural language processing techniques.

[0025] <Data cleansing device: dimensional compression section> Returning to FIG. 1, the explanation of the control unit 110 will be continued. The dimension reduction unit 113 converts the multi-dimensional vector output by the vectorization unit 112 into a low-dimensional vector. The dimension reduction unit 113 converts it into, for example, a two-dimensional or three-dimensional vector that can be visualized. A representative dimension reduction processing method for converting it into a low-dimensional vector is principal component analysis (PCA). In the following, it is assumed that the dimension reduction unit 113 converts it into a three-dimensional vector. 6 is a diagram for explaining the conversion of a character string into a low-dimensional vector according to this embodiment. The character string of an action name is converted into a 768-dimensional vector by the vectorization unit 112, and further converted into a three-dimensional vector by the dimension reduction unit 113.

[0026] As described above, the dimensionality reduction unit 113 included in the data cleansing apparatus 100 converts vectors into low-dimensional vectors through dimensionality reduction processing. Furthermore, the dimension reduction unit 113 converts the vector into a two-dimensional vector or a three-dimensional vector.

[0027] <Data cleansing device: clustering section and subdivision and integration section> Returning to Fig. 1, the description of the control unit 110 continues. The clustering unit 114 and the subdivision and integration unit 115 alternately perform processing to classify the three-dimensional vectors (character strings in the action names). The clustering unit 114 classifies the three-dimensional vectors into clusters using, for example, an X-means clustering method. The subdivision and integration unit 115 divides and subdivides clusters based on the similarity (distance) of character strings corresponding to three-dimensional vectors included in the cluster. The subdivision and integration unit 115 also integrates clusters based on the similarity (distance) of character strings corresponding to three-dimensional vectors included in different clusters. In this way, the subdivision and integration unit 115 reorganizes clusters based on the similarity of character strings corresponding to three-dimensional vectors included in the cluster. Details of the processing by the clustering unit 114 and the subdivision and integration unit 115 will be described later with reference to FIG. 8.

[0028] As described above, the clustering unit 114 included in the data cleansing apparatus 100 classifies low-dimensional vectors into one or more clusters through clustering processing. The clustering process is X-means. The subdivision and integration unit 115 included in the data cleansing apparatus 100 reorganizes the clusters by performing at least one of subdivision and integration of the clusters.

[0029] <Data cleansing device: post-processing section> The post-processing unit 117 replaces the character string in the action name with a character string that serves as a representative of the cluster that includes the character string, and outputs the event log 530. The representative may be a character string close to the center of the cluster, a character string with the shortest length in the cluster, a character string with the largest average similarity with other character strings, or any character string included in the cluster.

[0030] <Data cleansing process> FIG. 7 is a flowchart of the data cleansing process according to this embodiment. In step S11, the preprocessing unit 111 reads the event log 510 (see FIG. 2) in the event log database . In step S12, the preprocessing unit 111 extracts items contained in the event log 510. In the event log 510, items separated by semicolons (";") are extracted.

[0031] In step S13, the preprocessing unit 111 identifies the item names of the items extracted in step S12. In the event log 510, the item names identified are time stamp, operator name, process name, action name, and order number. In step S14, the preprocessing unit 111 corrects the format of the item. For example, the preprocessing unit 111 corrects (converts) the format of the date and time into a default format. In step S15, the preprocessing unit 111 deletes events (records, rows) that include empty items. The processing result up to step S15 is the event log 530 (see FIG. 4).

[0032] In step S16, the vectorization unit 112 converts the character string in the action name into a high-dimensional vector. In step S17, the dimension reduction unit 113 converts the multi-dimensional vector converted in step S16 into a low-dimensional vector. Step S18 is a classification process, which will be described in detail later with reference to FIG. In step S19, the display control unit 116 displays a three-dimensional plot diagram 610 and a histogram 620 (see FIGS. 9 and 10) as classification results, which will be described later.

[0033] In step S20, the display control unit 116 acquires the user's evaluation of the classification results. If the evaluation is OK (step S20→OK), the display control unit 116 proceeds to step S22, and if NG (step S20→NG), the display control unit 116 proceeds to step S21. In step S21, the subdivision and integration unit 115 adjusts a parameter (δ) for classification processing, which will be described later, and returns to step S 18. For example, the subdivision and integration unit 115 may adjust the parameter by inquiring of the user. In step S22, the post-processing unit 117 replaces the character string in the action name with a character string that serves as a representative of the cluster that includes the character string, and outputs the event log 530 (see FIG. 4).

[0034] <Classification process> 8 is a flowchart of the classification process according to this embodiment, and step S18 (see FIG. 7) will be described in detail with reference to FIG. In step S31, the clustering unit 114 performs clustering processing using, for example, X-means on the low-dimensional vectors resulting from step S17.

[0035] In step S32, the subdivision and integration unit 115 starts the process of performing steps S33 to S35 on each cluster included in the result of step S31. In step S33, if the number of character strings of action names corresponding to the low-dimensional vectors included in the cluster is one or more (step S33 → YES), the subdivision and integration unit 115 proceeds to step S34, and if there is one item (step S33 → NO), steps S33 to S35 are repeated for the next cluster.

[0036] In step S34, if the similarity between the character strings indicated by the low-dimensional vectors in the cluster is smaller than a predetermined value δ (step S34 → YES), the subdivision and integration unit 115 proceeds to step S35, and if it is equal to or greater than δ (step S34 → NO), steps S33 to S35 are repeated for the next cluster. The similarity between two character strings is calculated based on, for example, the Levenshtein distance, which is the character string edit distance. For example, the calculation is similarity = 1 - (Levenshtein distance / length of the longer character string).

[0037] In step S35, the subdivision and integration unit 115 invokes itself (the subdivision and integration unit 115) and performs classification processing on the low-dimensional vectors included in the cluster. In other words, the subdivision and integration unit 115 regards the low-dimensional vectors included in the cluster as the entire low-dimensional vector, and recursively invokes and executes the classification processing, which is the main processing. In step S31 of the recursively invoked classification processing, the clusters are subdivided by the clustering processing by the clustering unit 114.

[0038] In step S36, the subdivision and integration unit 115 starts the process of performing steps S37 to S38 on each cluster included in the results of steps S31 to S35. In step S37, if the similarity with another cluster is greater than δ (step S37→YES), subdivision and integration unit 115 proceeds to step S38, and if the similarity is equal to or less than δ (step S37→NO), steps S37 to S38 are repeated for the next cluster. The similarity between two clusters may be, for example, the maximum similarity between character strings corresponding to the low-dimensional vectors included in each cluster, or the similarity between character strings corresponding to the low-dimensional vectors that are representative of the clusters. In step S38, the subdivision and integration unit 115 integrates the cluster with the maximum similarity. Specifically, the cluster that is the target of the repeated processing of steps S37 to S38 and the cluster with the maximum similarity to the cluster are integrated into one cluster.

[0039] In steps S34 to S35, if the similarity of the character strings indicated by the low-dimensional vectors in a cluster is smaller than a predetermined value, the subdivision and integration unit 115 divides the cluster. Furthermore, if there is a cluster whose similarity with another cluster is greater than a predetermined value, the subdivision and integration unit 115 integrates the cluster with the other cluster whose similarity is greatest. By performing this process, the clusters are reorganized so that a cluster is formed for each low-dimensional vector whose character string similarity is greater than or equal to a predetermined value.

[0040] As described above, the subdivision and integration unit 115 reorganizes the clusters so that the similarity between the character strings indicated by the vectors included in each cluster becomes greater than a predetermined value. Furthermore, as explained in steps S34 to S35 above, when the similarity between character strings indicated by vectors included in a cluster is smaller than a predetermined value, the clustering unit 114 performs clustering processing on the low-dimensional vectors included in the cluster. Furthermore, as explained in steps S37 to S38 above, when the similarity between one cluster and another cluster is greater than a predetermined value, the subdivision and integration unit 115 integrates the cluster with the cluster that has the greatest similarity to the one cluster to form a new cluster. The similarity between two clusters is calculated based on the similarity between the strings indicated by the vectors contained in each cluster, and the similarity between strings is calculated based on the string edit distance between the strings indicated by the vectors.

[0041] <3D plot> 9 is a three-dimensional plot 610 of a low-dimensional vector according to this embodiment. The low-dimensional vector is a vector obtained by converting the character string of the action name into a three-dimensional vector (see FIG. 6). The display control unit 116 outputs the three-dimensional plot 610 to a display connected to the input / output unit 180. The straight lines in the three-dimensional plot diagram 610 are lines with values ​​of 0, ±4, ±8, ... on three axes. The circles represent low-dimensional vectors plotted in three-dimensional space. Circles included in the same cluster are depicted with the same pattern. In FIG. 9, clusters are represented by patterns, but clusters may also be represented by color. A legend below the plot diagram 610 shows the plotted circles, the number of three-dimensional vectors included in the cluster corresponding to the circle, and the representative character string (action name).

[0042] The display control unit 116 may zoom in and out on the 3D plot 610 or change the position or direction of the viewpoint in accordance with a user's instructions. The display control unit 116 may also display the low-dimensional vectors of all clusters, or may display the low-dimensional vectors of a top-ranking cluster (one containing a large number of low-dimensional vectors) or a cluster containing a low-dimensional vector containing a character string specified by the user. Instead of plotting individual 3D vectors, the display control unit 116 may plot and display the representative element of the cluster as a circle of a size corresponding to the number of 3D vectors contained in the cluster. Additionally, when a plotted low-dimensional vector is specified, the display control unit 116 may display the character string (action name) corresponding to the low-dimensional vector. The user evaluates the results of classifying the character strings of the action names into clusters (classification results) by referring to such a display.

[0043] <Histogram> 10 shows a histogram 620 of low-dimensional vectors according to this embodiment. The display control unit 116 outputs the histogram 620 to a display connected to the input / output unit 180. The display control unit 116 may display all clusters, or may display top clusters (clusters containing a large number of low-dimensional vectors) or clusters of low-dimensional vectors containing a character string specified by the user. Furthermore, when a rectangle in the histogram corresponding to a cluster is specified, the display control unit 116 may display the character string of the low-dimensional vectors contained in that cluster. With reference to such a display, the user evaluates the results of classifying the character strings of action names into clusters (classification results).

[0044] <Characteristics of data cleansing processing> The data cleansing device 100 classifies character strings indicating action names (activities) by converting the character strings into high-dimensional vectors and then compressing them to low-dimensional vectors (see step S31 in FIG. 8), subdividing the character strings based on their similarity (see step S35), and integrating them (step S38). By performing this classification, even different action names (character strings) are classified into actions that are considered to be the same action (activity). Using an event log converted into actions classified in this way makes it possible to perform appropriate process mining.

[0045] The following describes an example of classification of action names by the data cleansing apparatus 100. The number of items in the event log 510 before processing is 10,000. Note that no records are deleted by the pre-processing unit 111, including blank items. These 10,000 records contain 366 action name strings. Of these, over 300 action names begin with the string "EstimateSYS-0003_0000 Initial Display," with the difference being the number at the end of the action name string. In conventional data cleansing processes, action names are considered different unless the strings match. Performing process mining after conventional data cleansing processes does not produce the desired results. One possible reason for this is that action names representing the same action are treated as different actions due to differences in the strings, which can result in inaccurate statistics such as the number of action occurrences in process mining.

[0046] In such cases, it is easy for the user to combine the action names into one by deleting unnecessary characters such as numbers at the end. However, the number of event log entries is often enormous, and checking each entry and deleting unnecessary characters takes a lot of time. The number of character strings in the action names classified by the data cleansing device 100 was 38, a reduction of 328. For example, over 300 action names beginning with the character string "EstimateSYS-0003_0000 Initial Display" were consolidated into a single action name (cluster). By classifying and consolidating the action names (activities) in this way, it becomes possible to perform appropriate process mining.

[0047] <<Variation: Parameter Adjustment>> In the data cleansing process, if the evaluation of the classification result is NG, the subdivision and integration unit 115 adjusts δ, which is a parameter for the classification process (see step S21 in FIG. 7). Based on a user's instruction, clusters may be subdivided (see step S35 in FIG. 8) or integrated (step S38). For example, a cluster specified by the user in the three-dimensional plot 610 (see FIG. 9) or histogram 620 (see FIG. 10) may be subdivided. Furthermore, multiple clusters specified by the user may be integrated. To specify a cluster, for example, a cluster in the legend in the three-dimensional plot 610 may be specified, a plotted low-dimensional vector may be specified, or a cluster name or a rectangle in the histogram 620 may be specified.

[0048] Other variations Although several embodiments of the present invention have been described above, these embodiments are merely examples and do not limit the technical scope of the present invention. For example, the data cleansing device 100 classifies character strings of action names (activities) in event logs, but it may also classify character strings of other items in event logs. Furthermore, as a character string classifier, it may also classify general character strings, not just character strings contained in event logs.

[0049] The present invention can take on various other embodiments, and various modifications such as omissions and substitutions can be made without departing from the spirit of the present invention. These embodiments and modifications are included in the scope and spirit of the invention described in this specification, etc., and are also included in the invention described in the claims and their equivalents. [Explanation of symbols]

[0050] 100 Data cleansing device (string classification device) 111 Pretreatment section 112 Vectorization Department 113 Dimensionality Compression Unit 114 Clustering Department 115 Subdivision and Integration Department 116 Display control unit 117 Post-processing section 510,520,530 Event Log

Claims

1. a vectorizer that converts strings into vectors; a dimension reduction unit that converts the vector into a low-dimensional vector by a dimension reduction process; a clustering unit that classifies the low-dimensional vectors into one or more clusters by a clustering process; a subdivision and integration unit that performs at least one of subdivision and integration of the clusters to reorganize the clusters, The vector is indicates the meaning of the character string, The subdivision and integration unit reorganizing the clusters so that the similarity between character strings indicated by the vectors included in each cluster is greater than a predetermined value; The similarity is Calculated based on the string edit distance of the strings indicated by the vector String classifier.

2. The clustering unit When the similarity between character strings indicated by the vectors included in the cluster is smaller than the predetermined value, the clustering process is performed on the low-dimensional vectors included in the cluster. The string classification device according to claim 1 .

3. The subdivision and integration unit If the similarity between one cluster and another cluster is greater than the predetermined value, the cluster having the largest similarity from the one cluster is integrated with the one cluster to form a new cluster; The similarity between the two clusters is calculated based on the similarity between the character strings indicated by the vectors included in each cluster. The string classification device according to claim 1 .

4. The vectorization unit converts character strings into vectors using natural language processing technology. The string classification device according to claim 1 .

5. The clustering process is X-means The string classification device according to claim 1 .

6. The dimensionality reduction unit Convert to a 2D or 3D vector The string classification device according to claim 1 .

7. The character string is a character string contained in one item of the event log.

2. The string classification device according to claim 1

8. Computer, A vectorization part that converts strings into vectors, a dimension reduction unit that converts the vector into a low-dimensional vector by a dimension reduction process; a clustering unit that classifies the low-dimensional vectors into one or more clusters by a clustering process; and a subdivision and integration unit that performs at least one of subdivision and integration of the clusters to reorganize the clusters, The vector is indicates the meaning of the character string, The subdivision and integration unit reorganizing the clusters so that the similarity between character strings indicated by the vectors included in each cluster is greater than a predetermined value; The similarity is Calculated based on the string edit distance of the strings indicated by the vector To function as a string classifier program.

9. The string classifier converting the string to a vector; converting the vector into a low-dimensional vector by a dimensionality reduction process; classifying the low-dimensional vectors into one or more clusters by a clustering process; reorganizing the clusters by at least one of subdividing and integrating the clusters; The vector is indicates the meaning of the character string, In the step of reorganizing the clusters, reorganizing the clusters so that the similarity between character strings indicated by the vectors included in each cluster is greater than a predetermined value; The similarity is Calculated based on the string edit distance of the strings indicated by the vector String classification method.

Images