Determination device, determination method, and determination program

Abstract

A determination device (10) comprises: a reception unit (15a) that receives an operation event; an estimation unit (15b) that estimates a determination criterion for determining whether an operation event is necessary or unnecessary on the basis of an attribute value of an operation log included in the operation event; and a determination unit (15c) that determines whether an operation event to be processed is necessary or unnecessary on the basis of the determination criterion.

Description

[Technical Field]

[0001] The present invention relates to a determination device, a determination method, and a determination program. [Background technology]

[0002] Process mining is a well-known method for analyzing and visualizing the workflow of business processes in order to identify areas for improvement. The information used for analysis and visualization in such process mining methods is a log that records the events to be analyzed. For example, the events to be analyzed vary depending on the type of business process and the granularity of the analysis, but they can also be GUI (Graphical User Interface) operations such as "clicking a button" or "entering information into a text box."

[0003] Logs used in process mining must meet certain requirements, such as being "narrowed down to only the information to be analyzed," "divided by case," and "being in a state where events can be identified." For example, operation logs that record operations on a personal computer (PC) often do not meet the requirements for logs used in process mining. Therefore, when performing process mining, it is necessary to process the operation logs so that they meet these requirements by, for example, performing three pre-processing steps: "removing unnecessary operation events," "identifying identical operation events," and "dividing by case."

[0004] Here, the "removal of unnecessary operation events" process refers to the process of removing unnecessary information contained in operation logs. In other words, operation logs may contain unnecessary operation events that are not related to the work being analyzed. Conventionally, when analyzing and visualizing PC operations to find areas for business improvement, the process of removing unnecessary operation events has been done manually by humans, who visually check the operation logs and delete unnecessary events one by one. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Yokose, Urabe, Yagi, et al.: Business Visualization Technology Contributing to DX Promotion, 2020, NTT Technical Journal, 2020 vol.32 No.2, pp.72-75, [online], [Retrieved April 23, 2021], Internet<https: / / journal.ntt.co.jp / article / 880> Summary of the Invention [Problem to be solved by the invention]

[0006] However, in the above-described conventional technology, it is not possible to easily remove unnecessary operation events in the pre-processing of process mining because the above-described conventional technology has the following problems.

[0007] First, it is possible to manually remove unnecessary events one by one, but if the volume of logs is large, it is difficult to remove all of them manually.

[0008] On the other hand, because the systems analyzed by process mining have different internal structures, fixed rules and algorithms cannot automatically determine what to remove. While it is possible to manually customize the rules and algorithms to suit the internal structure and operations of the systems, this requires understanding the internal structure of the systems and the meaning of the attribute values ​​contained in the operation logs, making it difficult for average users. [Means for solving the problem]

[0009] In order to solve the above-mentioned problems and achieve the object, the determination device of the present invention is characterized by comprising: a reception unit that receives a log event; an estimation unit that estimates a determination criterion for determining whether the log event is necessary or unnecessary based on an attribute value of a log included in the log event; and a determination unit that determines whether the log event to be processed is necessary or unnecessary based on the determination criterion.

[0010] Furthermore, a determination method according to the present invention is a determination method executed by a determination device, and is characterized by including the steps of: accepting a log event; estimating a determination criterion for determining whether the log event is necessary or unnecessary based on an attribute value of a log included in the log event; and determining whether the log event to be processed is necessary or unnecessary based on the determination criterion.

[0011] In addition, the determination program of the present invention is characterized in that it causes a computer to execute the steps of: accepting a log event; estimating a determination criterion for determining whether the log event is necessary or unnecessary based on an attribute value of a log included in the log event; and determining whether the log event to be processed is necessary or unnecessary based on the determination criterion. [Effects of the Invention]

[0012] In the present invention, unnecessary operation events can be easily removed in the pre-processing of process mining. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of a determination device according to the first embodiment. [Figure 2] FIG. 2 is a diagram illustrating a log stored in a storage unit according to the first embodiment. [Figure 3] FIG. 3 is a diagram illustrating an example of an exemplary reception process based on the selection of an operation event according to the first embodiment. [Figure 4]FIG. 4 is a diagram illustrating an example of rule types for each attribute element according to the first embodiment. [Figure 5] FIG. 5 is a diagram illustrating an example of a process of estimating a determination criterion according to the first embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of the operation event determination process according to the first embodiment. [Figure 7] FIG. 7 is a flowchart showing an example of the overall flow of processing according to the first embodiment. [Figure 8] FIG. 8 is a diagram illustrating process mining. [Figure 9] FIG. 9 is a diagram illustrating the pre-processing of process mining. [Figure 10] FIG. 10 is a diagram illustrating the conventional problem. [Figure 11] FIG. 11 is a diagram illustrating a computer that executes a program. DETAILED DESCRIPTION OF THE INVENTION

[0014] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of a determination device, a determination method, and a determination program according to the present invention will be described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the following embodiments.

[0015] [First embodiment] The processing of the determination system according to the first embodiment (or, where appropriate, the present embodiment), the configuration of the determination device 10, details of each process, and the flow of each process will be described below, and finally, the effects of the present embodiment will be described.

[0016] [Processing of the judgment system] The processing of the determination system (referred to as "this system" as appropriate) according to this embodiment will be described below. This system is used for processing an operation log that records operations on a PC, and in particular, executes automatic determination processing of unnecessary operation events based on user examples. The processing of this system will be described below in comparison with conventional technology.

[0017] The process mining techniques for business analysis mentioned above are widely used in the market. There are also systems that record PC operations as logs (operation logs). In such cases, pre-processing of the operation logs may be necessary before process mining can be performed on them. In other words, if the operation logs are recorded as is, they will contain events that are not subject to process mining, so unnecessary events must be removed. It is also possible to remove unnecessary events one by one manually, but if the volume of logs is large, removing all of them manually is difficult.

[0018] On the other hand, because the systems analyzed by process mining have different internal structures, fixed rules and algorithms cannot automatically determine what to remove. It is also possible to manually customize the rules and algorithms to suit the internal structure and operations of the systems, but this requires an understanding of the internal structure of the systems and the meaning of the attribute values ​​contained in the operation logs.

[0019] Therefore, this system performs the following process. First, the user is asked to provide multiple examples of operation events that they wish to keep / remove. Second, rules for determining which operation events should be kept / removed are inferred from the relationships between the attribute values ​​of the example operation events. Third, the inferred rules are used to automatically determine which operation events should be kept / removed. Through the above process, unnecessary operations can be automatically removed based on the user's examples, even without a deep understanding of the internal structure of the system being analyzed or the attribute values ​​of the operation logs.

[0020] [Configuration of Determination Device 10] The configuration of a determination device 10 according to this embodiment will be described in detail with reference to Fig. 1. Fig. 1 is a block diagram showing an example of the configuration of the determination device according to this embodiment. The determination device 10 includes an input unit 11, an output unit 12, a communication unit 13, a storage unit 14, and a control unit 15.

[0021] The input unit 11 controls the input of various information to the determination device 10. For example, the input unit 11 is realized by a mouse, a keyboard, or the like, and accepts input of setting information, etc. to the determination device 10. The output unit 12 controls the output of various information from the determination device 10. For example, the output unit 12 is realized by a display, etc., and outputs setting information, etc. stored in the determination device 10.

[0022] The communication unit 13 controls data communication with other devices. For example, the communication unit 13 performs data communication with each communication device. The communication unit 13 can also perform data communication with an operator's terminal (not shown).

[0023] The storage unit 14 stores various pieces of information that the control unit 15 refers to when it operates and various pieces of information that the control unit 15 acquires when it operates. Here, the storage unit 14 can be realized by, for example, a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. Note that, in the example of FIG. 1, the storage unit 14 is installed inside the determination device 10, but it may be installed outside the determination device 10, or multiple storage units may be installed.

[0024] The storage unit 14 stores an operation log of the processing target. For example, the storage unit 14 stores, as the operation log, the "occurrence time" of the operation, "unique information of the operated GUI component," etc. In addition, in the operation log, information of one operation event is expressed as a collection of multiple attribute values ​​(columns, items).

[0025] The operation log stored in the storage unit 14 will now be described with reference to Fig. 2. Fig. 2 is a diagram showing the log stored in the storage unit according to the first embodiment. In the example of Fig. 2, for simplicity, it is assumed that the operation log records only operations on the browser. Therefore, only the attribute values ​​of the log related to the browser are shown.

[0026] In addition to GUI operations on a PC, the operation log may also record input from some input device or command input on a CUI (Character-based User Interface). If these different types of operations are to be recorded, it is necessary to add more log items as necessary.

[0027] 2, the storage unit 14 stores "date and time," "operation type," "URL," "title," "tagName," "type," "id," "value," "name," "className," "left," "top," "width," and "height." Note that the operation logs stored by the storage unit 14 are not limited to those described above, and may also store, for example, image captures taken during operations.

[0028] In the example of Fig. 2, if an item is not set or cannot be acquired, the storage unit 14 stores a "null" value indicating that the value is not set. Note that the attribute elements included in the operation log do not need to be the directly acquired information itself, but may be processed, a combination of multiple pieces of information, or processed using information that is not ultimately included in the operation log. In addition, the storage unit 14 stores the operation log in chronological order of events so that the order of events that occurred during the work can be understood.

[0029] The control unit 15 controls the entire determination device 10. The control unit 15 has a reception unit 15a, an estimation unit 15b, and a determination unit 15c. Here, the control unit 15 is, for example, an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0030] (Reception section 15a) The reception unit 15a receives an operation event as a log event. For example, the reception unit 15a receives an image of an operation event selected by a user from among images of a plurality of operation events. That is, the reception unit 15a receives a plurality of capture images selected as necessary or unnecessary by a user from among capture images of a plurality of operation events displayed in chronological order. Here, the log event is not only an operation event but also an event including a log having a similar structure (for example, a call reception / transmission history, etc.).

[0031] To explain using a specific example, when a user clicks on capture images visually displayed in chronological order on the screen of the user's terminal to select multiple capture images as "necessary selections," i.e., operation events that the user wants to keep, the reception unit 15a receives the operation logs of the operation events linked to the selected capture images as "necessary operation logs." On the other hand, when a user clicks on capture images visually displayed in chronological order on the screen of the user's terminal to select multiple capture images as "unnecessary selections," i.e., operation events that the user wants to remove, the reception unit 15a receives the operation logs of the operation events linked to the selected capture images as "unnecessary operation logs." The above reception process will also be described in detail in [Details of Each Process] (1. Illustrative Reception Process by Selection of Operation Event) below.

[0032] Furthermore, the reception unit 15a refers to the operation logs stored in the storage unit 14 and acquires the selected operation logs. Meanwhile, the reception unit 15a outputs a set of the selected operation logs to the estimation unit 15b. Note that the reception unit 15a may store the set of the selected operation logs in the storage unit 14.

[0033] (Estimation part 15b) The estimation unit 15b estimates a determination criterion (rule) for determining whether an operation event is necessary or unnecessary based on an attribute value of an operation log included in an operation event as a log event. For example, the estimation unit 15b estimates a determination criterion for determining whether an operation event is necessary or unnecessary by extracting a common attribute value of the operation logs. That is, the estimation unit 15b estimates a determination criterion for determining whether an operation event is necessary or unnecessary by extracting a character string or a numerical value range commonly included in the attribute elements according to a condition (rule type) set for each attribute element (attribute element).

[0034] To explain using a specific example, when a plurality of operation logs accepted by the accepting unit 15a as operation events that are "required selection" contain a common character string "route search" as the attribute value of the attribute element "title" (rule type B: determining character strings by partial match), the estimating unit 15b infers operation events that contain the character string "route search" in the attribute element "title" as a determination criterion for operation events to be retained. Note that the above estimation process will also be described in detail in [Details of Each Process] (4. Estimation Process for Rules of Each Attribute Value) described later.

[0035] Furthermore, the estimation unit 15b acquires the set of operation logs output by the reception unit 15a and the rule types of attribute values ​​stored in the storage unit 14, and extracts a commonly included character string or a numerical range as a judgment criterion. Meanwhile, the estimation unit 15b outputs the extracted judgment criterion to the judgment unit 15c. Note that the estimation unit 15b may store the extracted judgment criterion in the storage unit 14.

[0036] (Judgment part 15c) The determination unit 15c determines whether a log event to be processed is necessary or unnecessary for the operation event to be processed based on the determination criteria. For example, the determination unit 15c determines whether a log event to be processed is necessary or unnecessary for the operation event to be processed by using the extracted attribute value. That is, the determination unit 15c determines whether a log event to be processed is necessary or unnecessary for the operation event to be processed by matching operation events that include a character string commonly included in the elements of the attribute or that satisfy a numerical range commonly included in the elements of the attribute.

[0037] To explain using a specific example, when the determination unit 15c estimates that the inclusion of the character string "route search" in the attribute element "title" is a criterion for determining whether an operation event is to be kept, the determination unit 15c searches for operation events not selected by the user that include the character string "route search" in the attribute element "title", and outputs the searched operation event as the determination result. On the other hand, when there is no other determination criterion, the determination unit 15c outputs an operation event that is not included in the operation events to be kept as an operation event to be removed. The above determination process will be described in detail in [Details of Each Process] (5. Determination Process of Operation Event) described later.

[0038] The determination unit 15c transmits the output determination result to the output unit 12. The determination unit 15c may store the output determination result in the storage unit .

[0039] Additionally, the determination unit 15c presents the determination result of whether the operation event to be processed is necessary or unnecessary to the user, and outputs the determination result approved by the user, thereby determining whether the operation event to be processed is necessary or unnecessary.

[0040] To explain this using a specific example, when the determination unit 15c outputs multiple visual images as operation events to be retained that include the character string "route search" in the attribute element "title," the determination unit 15c re-outputs the operation event whose visual image was selected by the user's click operation as the confirmed determination result. Note that the above estimation process will also be described in detail in [Details of each process] (6. Determination process by dialogue with the user) described later.

[0041] [Details of each process] 3 to 6, mathematical expressions, etc. Below, an example of reception processing by selecting an operation event, rule types for each attribute value, details of the rules, rule estimation processing, and determination processing of an operation event will be described in detail.

[0042] (1. Example of reception process by selecting operation event) A process of accepting an example of a selected operation event will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of a process of accepting an example of a selected operation event according to the first embodiment.

[0043] First, the user is asked to select multiple examples of operation events that they wish to keep or remove. For example, it is a good idea to visually display operation events in chronological order as shown in Figure 3 and let the user make their selection. In Figure 3, one operation event is displayed as one node, and the node displays a captured image that was recorded at the same time as the operation event, with the operation position indicated by a bold frame on the image. By displaying the events in this way, the user can recognize the specific operation that each operation event represents, without having to understand the contents recorded in the operation log.

[0044] The determination device 10 then accepts the operation event selected by the user (the dashed frame in the lower part of FIG. 3) as an example of the user. Note that, although FIG. 3 illustrates examples of operation events that are desired to be kept, i.e., necessary operation events, it is also possible to select operation events that are desired to be removed, i.e., unnecessary operation events.

[0045] (2. Rule type for each attribute value) The rule type of each attribute value will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the rule type of each attribute value according to the first embodiment.

[0046] The determination device 10 applies the following four types of rules, which are also shown in Fig. 4, according to the properties of each attribute value of the operation event. The first rule is to "determine a character string by exact match" (rule type A), the second rule is to "determine a character string by partial match" (rule type B), the third rule is to "determine a range of numerical values" (rule type C), and the fourth rule is to "not use in determination" (rule type D).

[0047] The user associates attribute elements with the rule types to be used in advance, as shown in Figure 4. For example, in Figure 4, rule type A is applied to the attribute elements "operation type," "tagName," "type," "id," and "name," rule type B is applied to the attribute elements "URL" and "title," rule type C is applied to the attribute elements "width" and "height," and rule type D is applied to the attribute elements "date and time," "value," "className," "left," and "top." Note that the user may not use some of the four types of rules above, or may add other types of rules.

[0048] (3. Details of rules for each attribute value) Before proceeding with the rule estimation process, we will explain the details of the rules for each attribute value listed above. Below, we will explain in order the strings that are judged by an exact match (rule details 1), the strings that are judged by a partial match (rule details 2), and the items that are judged by a numerical range (rule details 3).

[0049] (Rule details 1: String to be judged by exact match) First, details of the rule (rule type A) that determines a character string by exact match will be explained. Below, the rule estimation process and rule matching process when rule type A is applied will be explained in order.

[0050] (Rule inference processing) If all attribute values ​​do not match exactly in the multiple operation events shown as examples, the determination device 10 does not adopt this rule for the corresponding attribute element. On the other hand, the determination device 10 uses strings that match exactly in all attribute values ​​in the multiple operation events shown as parameters for this rule. Furthermore, if case does not need to be distinguished, the parameters are converted to uppercase or lowercase to be consistent. Note that, even if all attribute values ​​are "null" in the multiple operation events shown as examples, this rule is adopted for the corresponding attribute element.

[0051] (Rule matching process) If the attribute value of the operation event to be inspected completely matches the character string found in the rule estimation process, the determination device 10 determines that the rule matches. In addition, if case does not need to be distinguished, the determination device 10 compares the attribute value converted to uppercase or lowercase, just like the parameter.

[0052] (Rule details 2: String to be judged by partial match) Secondly, details of the rule (rule type B) that determines character strings by partial matching will be explained. Below, the order of rule estimation processing and rule matching processing when rule type B is applied will be explained.

[0053] (Rule inference processing) If the attribute value in the multiple operation events shown as examples contains "null," the determination device 10 does not adopt this rule for the corresponding attribute element. On the other hand, the determination device 10 finds a common substring in the multiple operation events shown as examples. In this case, in the simplest mechanism, the determination device 10 finds the longest common substring included in all events and uses this as a parameter for this rule.

[0054] Furthermore, the determination device 10 will not adopt this rule if the common part of the character string is equal to or less than a threshold number of characters. This threshold can be set arbitrarily, but for example, in the case of URLs, the initial "http: / / " or "https: / / " part is always common, so it would be good to set it so that anything less than eight characters exceeds this threshold and not adopt the rule. Note that, for more advanced purposes, it is also possible to take into account information about the truth of "prefix match," "suffix match," "partial match," and "exact match," or to consider multiple common parts or the length of the character string.

[0055] (Rule matching process) If the attribute value of the operation event to be inspected contains the common substring found in the rule estimation process, the determination device 10 determines that the rule matches.

[0056] (Rule Details 3: Items judged by numerical range) Thirdly, details of the rule (rule type C) that judges based on a range of numerical values ​​will be explained. Below, the order of the rule estimation process and rule matching process when rule type C is applied will be explained.

[0057] (Rule inference processing) In the multiple operation events exemplified, the determination device 10 will not adopt this rule for the corresponding attribute element if "the corresponding attribute value contains null," "the corresponding attribute value contains a value that cannot be treated as a number," or "the corresponding attribute value contains other abnormal values ​​(e.g., width is a negative value)."

[0058] Furthermore, the determination device 10 calculates the average μ and standard deviation σ for the multiple exemplified operation events, and uses these as parameters for this rule. At this time, the determination device 10 may reject this rule if the standard deviation σ is equal to or greater than a certain threshold value or if there are not enough exemplified events (only one exemplified event). For example, if the threshold value is set to 30, events equal to or greater than 30 are deemed to have large variations and little commonality, and are therefore rejected.

[0059] (Rule matching process) The determination device 10 determines that this rule matches (is consistent with) if the attribute value of the operation event being inspected is in the range μ-kσ≦attribute value≦μ+kσ. Here, k is a constant that can be determined arbitrarily. Furthermore, if it is assumed that the variation in values ​​follows a normal distribution, it is generally recommended to set k=3 (99.7% range).

[0060] (4. Inferring rules for each attribute value) The process of estimating the rule for each attribute value will be described in detail with reference to Fig. 5. Fig. 5 is a diagram showing an example of the process of estimating the determination criterion according to the first embodiment. The determination device 10 estimates a rule for each attribute element for the operation log data of the illustrated multiple operation events as follows. Fig. 5 shows the operation logs of the illustrated four operation events.

[0061] First, the determination device 10 determines whether each attribute element is "adopted" or "rejected" according to a rule type previously set for each attribute element. Next, the determination device 10 extracts parameters from the attribute values ​​of the attribute elements determined to be "adopted." Then, the determination device 10 estimates the extracted parameters as rules corresponding to the attribute elements.

[0062] 5, the attribute value of the attribute element "URL" (rule type B: determining character strings by partial match) contains the common character string "http: / / www.sample.jp / transit / ", so the determination device 10 determines the attribute element as "adopted" and extracts the inclusion of "http: / / www.sample.jp / transit / " as a character string as a parameter. Also, the attribute value of the attribute element "title" (rule type B: determining character strings by partial match) contains the common character string "route search", so the determination device 10 determines the attribute element as "adopted" and extracts the inclusion of "route search" as a character string as a parameter.

[0063] (5. Operation event determination process) The process of determining an operation event from the estimated rules will be described in detail with reference to Fig. 6. Fig. 6 is a diagram showing an example of the operation event determination process according to the first embodiment. Using the estimated rules, the determination device 10 checks the rules for operation events other than the exemplified operation events as follows, and determines which operation events to keep or remove. In Fig. 6, operation events that do not fall under the estimated rules are removed.

[0064] In the example of FIG. 6, the determination device 10 determines a "group not included in the operation events to be kept (a group of operation events to be removed)" (see FIG. 6(2)) and a "group automatically determined as the operation events to be kept" (see FIG. 6(3)) using rules (e.g., the attribute element "URL" contains the string "http: / / www.sample.jp / transit / " and the attribute element "title" contains the string "route search") inferred from a "group exemplified as the operation events to be kept" (see FIG. 6(1)).

[0065] (6. Determination process through dialogue with the user) The following describes in detail the process of determining an operation event through interaction with a user. The determination device 10 may not be able to correctly determine which operation events to keep / remove, for example, when the number of exemplified operation events described above is small or the exemplified operation events are not diverse enough. Therefore, instead of immediately finalizing the determination result, the determination device 10 may tentatively present the determined operation events to the user and finalize the determination result of which operation events to keep / remove after receiving confirmation from the user. In other words, if the user determines that the presented determination result is inappropriate, the determination device 10 may cancel the tentative determination result and prompt the user to add more examples.

[0066] By gradually increasing the number of examples through such interactive interaction, the system can provide examples to the user more efficiently.Furthermore, by providing a UI (User Interface) that allows the user to set various thresholds and turn on / off rules adopted by estimation, it is possible to meet more advanced user requirements.

[0067] [Process flow] The flow of each process according to this embodiment will be described in detail with reference to Fig. 7. Fig. 7 is a flowchart showing an example of the overall flow of the process according to the first embodiment. Below, the flow of the overall determination process will be shown, and an overview of each process will be described.

[0068] (Overall processing flow) First, the reception unit 15a of the determination device 10 executes an operation event selection reception process (step S101). Next, the estimation unit 15b of the determination device 10 executes a determination rule estimation process (step S102). Then, the determination unit 15c of the estimation device 10 executes an operation event determination process (step S103) and ends the process. Note that the following steps S101 to S103 may be executed in a different order. Also, some of the following steps S101 to S103 may be omitted.

[0069] (Flow of each process) First, the operation event selection and reception process by the reception unit 15a will be described. In this process, the user is prompted to select multiple examples of operation events that the user wants to keep or remove, and the operation logs of the selected operation events are received. At this time, the operation events are visually displayed in chronological order, and the user is prompted to select an operation event. This allows the user to recognize which specific operation each operation event is, without having to understand the contents recorded in the operation log.

[0070] Secondly, the determination rule estimation process by the estimation unit 15b will be described. In this process, "adopt" or "reject" is determined for each attribute element according to a rule type previously set for each attribute element of the operation event whose selection has been accepted, parameters are extracted from the attribute value of the attribute element determined to be "adopted," and the extracted parameters are estimated as the rule corresponding to the attribute element. At this time, by previously associating the attribute element with the rule type to be used, the determination rule for the selected operation event can be effectively estimated.

[0071] Thirdly, a description will be given of a determination rule estimation process by the determination unit 15c. In this process, the estimated determination rule is used to check the rules for operation events other than the exemplified operation events, and an operation event to be kept / removed is determined. At this time, the determination result is not immediately confirmed, but the determined operation event is provisionally shown to the user, and the determination result of the operation event to be kept / removed is confirmed after the user's confirmation. This makes it possible to prompt the user to gradually increase the number of examples through interactive exchanges, and it is possible to easily and effectively determine an operation event to be kept / removed.

[0072] [Advantages of the first embodiment] First, in the determination process according to the present embodiment described above, an operation event is received, a determination criterion for determining whether the operation event is necessary or unnecessary is estimated based on the attribute value of the operation log included in the operation event, and whether the operation event to be processed is necessary or unnecessary is determined based on the estimated determination criterion. Therefore, in this process, unnecessary operation events can be easily removed in the pre-processing of process mining.

[0073] Here, we will explain process mining. Process mining makes it possible to analyze the flow of work performed in a business by visualizing the order and relationships of events, as shown in the example in Figure 8. Figure 8 is a diagram for explaining process mining.

[0074] In this type of process mining, as shown in Figure 9, pre-processing such as "removal of unnecessary operation events," "determination of identical operation events," and "division into case units" are required. Figure 9 is a diagram explaining the pre-processing for process mining.

[0075] Conventionally, such pre-processing is performed manually. For example, when performing such pre-processing manually, a user on-site can intuitively illustrate the process from a screen capture, as shown in Figure 10, but processing the operation log can be difficult. Figure 10 illustrates the problems inherent in conventional methods. For example, attribute values ​​recorded in the operation log require specialized knowledge to interpret. For example, knowledge of HTML (Hyper Text Markup Language) and DOM is required to interpret the meaning of an operation log that records browser operations. Furthermore, URLs and other information may not be completely identical even for the same page. Furthermore, for example, if a session ID is included, part of the URL changes each time a user logs in, so determining whether the URL is identical requires inferring the URL generation rules.

[0076] As such, there is no correlation between the appearance of the screen and the internal structure (such as how IDs are assigned), so it is not possible to infer the internal structure from similarities in appearance that even an average user would be able to judge. Because the internal structure of a screen varies widely, a fixed algorithm cannot always make the best judgment. A user with specialized knowledge can infer rules from trends in operation logs and create an algorithm to handle a variety of screen structures, but this is difficult for average users.

[0077] For this reason, if operation logs are manually divided into units of cases, the operator must understand the internal structure of the system and the meaning of the attribute values ​​of the operation logs. Furthermore, handling large volumes of logs requires significant work. Furthermore, with fixed rules and algorithms, it is difficult to automatically divide operation logs into units of cases because systems have different internal structures. In contrast, the determination process of this embodiment makes it easy to remove unnecessary operation events in the pre-processing of process mining. Furthermore, the effects that can be achieved by the determination process of this embodiment are described below.

[0078] In the determination process according to the present embodiment described above, an image of an operation event selected by a user from among images of multiple operation events is accepted, and common attribute values ​​in the operation logs are extracted to estimate a determination criterion for determining whether the operation event is necessary or unnecessary, and the extracted attribute values ​​are used to determine whether the operation event to be processed is necessary or unnecessary. Therefore, in the pre-processing of process mining, unnecessary operation events can be easily removed by utilizing the criteria for common attribute values ​​in the operation logs based on the image selection operation.

[0079] In the determination process according to the present embodiment described above, a plurality of capture images selected by the user as necessary or unnecessary from among the capture images of a plurality of operation events displayed in chronological order are accepted, and a character string or a numerical range commonly included in the attribute elements is extracted in accordance with conditions set for each attribute element, thereby estimating a determination criterion, and operation events containing the character string or satisfying the numerical range are matched to determine whether the operation event to be processed is necessary or unnecessary. Therefore, in this process, unnecessary operation events can be easily removed in the pre-processing of process mining by utilizing common attribute values ​​in the operation log based on the image operations in accordance with the conditions set for each attribute element.

[0080] In the determination process according to the present embodiment described above, the necessity or non-necessity of an operation event to be processed is determined by presenting the determination result of necessity or non-necessity to the user and outputting the determination result approved by the user. Therefore, in this process, unnecessary operation events can be easily and effectively removed in the pre-processing of process mining.

[0081] [System configuration, etc.] The components of each device shown in the drawings according to the above embodiments are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of each device can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0082] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0083] 〔program〕 It is also possible to create a program in which the processing performed by the determination device 10 described in the above embodiment is written in a language executable by a computer. In this case, the same effects as those of the above embodiment can be obtained by having a computer execute the program. Furthermore, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by a computer to realize processing similar to that of the above embodiment.

[0084] 11 is a diagram showing a computer that executes a program. As shown in the example of FIG. 11, a computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070, and these components are connected by a bus 1080.

[0085] As shown in FIG. 11, the memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090 as shown in FIG. 11. The disk drive interface 1040 is connected to a disk drive 1100 as shown in FIG. 11. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120 as shown in FIG. 11. The video adapter 1060 is connected to a display 1130 as shown in FIG. 11.

[0086] 11, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above programs are stored, for example, on the hard disk drive 1090 as program modules in which instructions to be executed by the computer 1000 are written.

[0087] The various data described in the above embodiment are stored as program data, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 and the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as needed, and executes various processing procedures.

[0088] Note that the program module 1093 and program data 1094 related to the program are not limited to being stored in the hard disk drive 1090, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via a disk drive or the like. Alternatively, the program module 1093 and program data 1094 related to the program may be stored in another computer connected via a network (such as a LAN (Local Area Network) or WAN (Wide Area Network)) and read by the CPU 1020 via the network interface 1070.

[0089] The above-described embodiments and their modifications are included in the technology disclosed in this application, as well as in the scope of the invention described in the claims and their equivalents. [Explanation of symbols]

[0090] 10 Judgment device 11 Input section 12 Output section 13 Communications Department 14 Storage section 15 Control Unit 15a Reception 15b Estimation part 15c Judgment section

Claims

1. A reception unit that receives an image of an operation event selected by a user from among images of a plurality of operation events; an estimation unit that extracts a common attribute value of the operation log from the image of the received operation event as a determination criterion for determining whether the image of the operation event is necessary or not; a determination unit that determines whether the attribute value is necessary or unnecessary for the operation event to be processed, using the extracted attribute value; A determination device comprising:

2. the accepting unit accepts a plurality of capture images selected by the user as necessary or unnecessary from among the capture images of a plurality of operation events displayed in chronological order; the estimation unit extracts, as the determination criterion, character strings or numerical ranges that are commonly included in the elements of the attributes from the plurality of accepted captured images in accordance with conditions set for each element of the attributes; the determination unit determines whether the operation event to be processed is necessary or unnecessary by matching an operation event that includes the extracted character string or an operation event that satisfies the numerical range.

2. The determination device according to claim 1.

3. the determination unit presents a determination result of whether the operation event to be processed is necessary or unnecessary to the user, and outputs the determination result approved by the user, thereby determining whether the operation event to be processed is necessary or unnecessary.

3. The determination device according to claim 2.

4. A determination method executed by a determination device, receiving an image of an operation event selected by a user from among the images of the plurality of operation events; extracting a common attribute value of the operation log from the image of the accepted operation event as a criterion for determining whether or not the image of the operation event is necessary; a step of determining whether the extracted attribute value is necessary or unnecessary for the operation event to be processed; A determination method comprising:

5. A step of receiving an image of an operation event selected by a user from among images of a plurality of operation events; extracting a common attribute value of an operation log from the image of the accepted operation event as a criterion for determining whether or not the image of the operation event is necessary; a step of determining whether the extracted attribute value is necessary or unnecessary for the operation event to be processed, using the extracted attribute value; A determination program that causes a computer to execute the above.

Images