Routine event identification device, routine event identification method, and routine event identification program

Abstract

A routine event identification device (100) comprises an attribute analysis unit (140) and a consistency analysis unit (150). When, for each subject indicated by a log, first correlation information indicating a correlation between the occurrence frequencies of objects indicated by the log has been created, and if the first correlation information relating to each of subjects linked to a target attribute satisfies a correlation condition, then the attribute analysis unit (140) creates second correlation information by integrating the first correlation information relating to the subjects. For each pair of two objects corresponding to the second correlation information, if a consistency condition, which is a condition based on second correlation information created in the past, is satisfied, the consistency analysis unit (150) includes the object pair in a routine list utilized for reducing the log, on the basis of the correlation between the objects.

Description

Routine event identification device, routine event identification method, and routine event identification program

[0001] The present disclosure relates to a routine event identification device, a routine event identification method, and a routine event identification program.

[0002] In security operation centers (SOCs), log analysis techniques such as rule detection analysis or anomaly detection analysis lack sufficient accuracy. As a result, the number of alarms increases when the number of logs to be inspected is enormous. Therefore, there is a technology for addressing the large number of false positive alarms in SOCs. Non-Patent Document 1 discloses a technology for narrowing down useful logs (templates) based on the correlation between templates. Templates that are highly correlated with other templates in terms of frequency of occurrence are likely to be caused by programs that are constantly running, and can therefore be excluded from analysis. A specific example of correlation is the correlation between the frequency of occurrence of print statements for log output in a program. Here, if the frequency of occurrence of a certain template is higher than a certain value above a baseline (statistical information calculated in advance), the template is likely to be an important template. Furthermore, if a certain template contains words that are not contained in other templates, the template is likely to be an important template.

[0003] Byungchul Tak, Seorin Park, Prabhakar Kudva, “Priolog: Mining Important Logs via Temporal Analysis and Prioritization”, Sustainability, November 2019

[0004] In order to improve the efficiency of log analysis, it is conceivable to consider the idea of ​​excluding logs related to routine normal operations from logs related to human behavior other than Syslog and application logs (specifically, proxy logs or authentication system logs). However, according to Non-Patent Document 1, there is a problem in that this idea cannot be realized. The present disclosure aims to exclude logs related to routine normal operations from the objects of inspection.

[0005] a routine event identification device according to the present disclosure, in which, when a subject of each type of one or more subjects indicated in a preparation log consisting of a plurality of logs each indicating a pair of a subject and an object is taken as a target subject, there are a plurality of object types corresponding to the target subjects, a frequency vector indicating the frequency of occurrence of the object for each time period for each type of object corresponding to the target subjects is created, and first correlation information indicating the correlation between each two frequency vectors corresponding to the target subjects is created, an attribute analysis unit is configured to: when an attribute of each type associated with any of the subjects indicated in the preparation log is taken as a target attribute, and a pair of two objects of each type corresponding to the correlation indicated by any of the first correlation information corresponding to each of the subjects associated with the target attribute is taken as a first target object pair, if a target correlation group consisting of one or more correlations corresponding to the first target object pair among the correlations indicated by the first correlation information corresponding to each of the subjects associated with the target attribute satisfies a correlation condition, integrate correlations included in the target correlation group to derive an integrated correlation, and create second correlation information which is information corresponding to the target attribute and indicates each of the derived integrated correlations; and a consistency analysis unit that, when a set of two objects corresponding to each integrated correlation indicated by the second correlation information corresponding to the target attribute is defined as a second target object set, if a consistency condition, which is a condition based on the second correlation information corresponding to the target attribute created in the past, is satisfied for the second target object set, includes information indicating the second target object set in a routine list, which is a list corresponding to the target attribute and is used to reduce logs based on correlations between objects from an operation log consisting of a plurality of logs each indicating a pair of a subject and an object.

[0006] According to the present disclosure, the attribute analysis unit creates second correlation information indicating an integrated correlation corresponding to the correlation between pairs of subjects and objects related to the logs. The consistency analysis unit determines consistency for each subject based on previously created second correlation information for each integrated correlation, and includes information indicating pairs of two objects corresponding to each integrated correlation determined to be consistent in the routine list. Therefore, each pair of two objects indicated in the routine list corresponding to each subject is considered to correspond to a routinized normal task for each subject. Therefore, according to the present disclosure, logs related to routinized normal tasks can be excluded from inspection targets.

[0007] 1 is a diagram showing an example of the configuration of a routine event identification device 100 according to the first embodiment. 2 is a diagram showing an example of the hardware configuration of the routine event identification device 100 according to the first embodiment. 3 is a diagram explaining an overview of the operation of the routine event identification device 100 during preparation according to the first embodiment. 4 is a flowchart showing the operation of the event creation unit 110 according to the first embodiment. 5 is a diagram showing a specific example of a post-exclusion log according to the first embodiment. 6 is a diagram showing a specific example of a first divided log according to the first embodiment. 7 is a flowchart showing the operation of the frequency calculation unit 120 according to the first embodiment. 8 is a diagram showing a frequency table according to the first embodiment. 9 is a diagram explaining the processing of the correlation calculation unit 130 according to the first embodiment, where (a) is a flowchart showing the operation of the correlation calculation unit 130 and (b) is a diagram explaining the processing of deriving a correlation matrix. 10 is a flowchart showing the operation of the attribute analysis unit 140 according to the first embodiment. 11 is a diagram showing a specific example of an attribute information DB 193 according to the first embodiment. 12 is a diagram explaining the processing of the attribute analysis unit 140 according to the first embodiment. 13 is a diagram explaining the processing of the consistency analysis unit 150 according to the first embodiment, where (a) is a flowchart showing the operation of the consistency analysis unit 150 and (b) is a table showing a specific example of a routine list. FIG. 1 is a diagram for explaining an overview of the operation of the routine event identification device 100 during operation according to the first embodiment. FIG. 2 is a flowchart showing the operation of the filter unit 160 according to the first embodiment. FIG. 3 is a diagram for explaining the processing of the filter unit 160 according to the first embodiment. FIG. 4 is a diagram for explaining the effects of the first embodiment, where (a) is a diagram for explaining a case where the first embodiment is not utilized, and (b) is a diagram for explaining a case where the first embodiment is utilized. FIG. 5 is a diagram showing an example of the hardware configuration of the routine event identification device 100 according to a modified example of the first embodiment. FIG. 6 is a diagram showing an example of the configuration of the routine event identification device 100 according to the second embodiment. FIG. 7 is a diagram showing an example of the hardware configuration of the routine event identification device 100 according to the second embodiment. FIG. 8 is a diagram for explaining the processing of the seasonal division unit 210 according to the second embodiment, where (a) is a flowchart showing the operation of the seasonal division unit 210, and (b) is a diagram showing a specific example of the processing of the seasonal division unit 210. FIG. 9 is a diagram showing an example of the configuration of the routine event identification device 100 according to the third embodiment. FIG. 10 is a diagram showing an example of the hardware configuration of the routine event identification device 100 according to the third embodiment. FIG. 11 is a diagram showing an example of the hardware configuration of the routine event identification device 100 according to the third embodiment.FIG. 1 is a diagram showing an example of the configuration of a routine event identification device 100 according to a fourth embodiment. FIG. 2 is a diagram showing an example of the hardware configuration of the routine event identification device 100 according to the fourth embodiment. FIG. 3 is a flowchart showing the operation of a filter unit 160 according to the fourth embodiment. FIG. 4 is a flowchart showing the operation of an update confirmation unit 410 according to the fourth embodiment. FIG. 3 is a diagram showing an example of the configuration of a routine event identification device 100 according to a fifth embodiment. FIG. 4 is a diagram showing an example of the hardware configuration of the routine event identification device 100 according to the fifth embodiment. FIG. 5 is a flowchart showing the operation of a feedback unit 510 according to the fifth embodiment. (a) is a diagram explaining the processing of the feedback unit 510, and (b) is a flowchart showing the operation of the consistency analysis unit 150. FIG. 5 is a diagram showing an example of the configuration of a routine event identification device 100 according to a sixth embodiment. FIG. 6 is a diagram showing an example of the hardware configuration of the routine event identification device 100 according to the sixth embodiment. FIG. 7 is a flowchart showing the operation of a schedule information analysis unit 610 according to the sixth embodiment. FIG. 8 is a flowchart showing the operation of a filter unit 160 according to the sixth embodiment. FIG. 9 is a diagram showing an example of the configuration of a routine event identification device 100 according to a seventh embodiment. 13 is a diagram showing an example of a hardware configuration of a routine event identification device 100 according to a seventh embodiment. FIG. 14 is a flowchart showing the operation of an aggregation unit 710 according to a seventh embodiment. FIG. 15 is a diagram explaining the processing of the aggregation unit 710 according to a seventh embodiment.

[0008] In the description of the embodiments and the drawings, the same elements and corresponding elements are given the same reference numerals. The description of elements given the same reference numerals will be omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, "unit" may be read as "circuit," "step," "procedure," "process," or "circuitry" as appropriate.

[0009] Embodiment 1. This embodiment will be described in detail below with reference to the drawings. When a user regularly performs tasks such as accessing multiple specific websites over a certain period of time, a high correlation may be observed in the frequency of log entries. Therefore, in this embodiment, routine normal tasks, including those that are obvious from the content of the tasks but not obvious from the content of the tasks, are identified, a whitelist is created based on the identified normal tasks, and the created whitelist is used to reduce logs. Routine normal tasks include, for example, access to multiple specific websites, access to multiple specific databases, and access to multiple specific tools. This embodiment aims to efficiently analyze logs related to human behavior other than syslogs and application logs (for example, proxy logs or authentication system logs), even when a large number of different types of logs exist. This embodiment is specifically used for rule detection analysis or anomaly detection analysis.

[0010] ***Configuration*** FIG. 1 shows an example of the configuration of a routine event identification device 100 according to this embodiment. As shown in FIG. 1, the routine event identification device 100 includes an event creation unit 110, a frequency calculation unit 120, a correlation calculation unit 130, an attribute analysis unit 140, a consistency analysis unit 150, and a filter unit 160. The routine event identification device 100 also stores a time period information DB 191, a subject / object information DB 192, an attribute information DB 193, and a correlation information DB 194. DB is an abbreviation for Database. The routine event identification device 100 extracts events from logs using subject and object information, calculates correlations between the extracted events, and calculates correlations on an attribute-by-attribute basis based on the calculated correlations and attribute information. The routine event identification device 100 then compares the calculated correlations with correlations in past logs to identify routinized events in a set having the same attributes. Furthermore, the routine event identification device 100 makes analysis more efficient by excluding logs corresponding to routine events as normal logs from logs to be inspected. An event corresponds to a template. A template indicates a pair of a subject and an object. A subject is an entity related to a log. Specific examples of a subject include a user who performed an operation related to the log, an IP (Internet Protocol) address indicated by the log, or a computer that performed processing related to the log. An object corresponds to the purpose of the subject in the log, and specific examples include a domain, a server, a computer, an IP address, a process, or a file.

[0011] The event creation unit 110 receives logs as input, and divides the logs for regular time periods among the input logs by event by referring to the time period information DB 191 and the subject / object information DB 192, and outputs the divided logs for each event. The logs are, for example, a compilation of the access histories of each user belonging to an organization such as a company. The logs are the subject of analysis. For example, the logs are logs collected at an SOC (Security Operation Center). The entire collected logs may be referred to as a log, or a portion of the collected logs may be referred to as a log. For example, an irregular time period is a time period during which normal business operations are not performed. For example, irregular time periods include lunch breaks, Saturdays, Sundays, and holidays.

[0012] The frequency calculation unit 120 receives a log for each event as input, calculates the occurrence frequency of each event in each time period based on the input log for each event, and outputs frequency information indicating the calculated frequency.

[0013] The correlation calculation unit 130 receives frequency information as input, calculates correlation values ​​between events based on the input frequency information, and outputs first correlation information indicating the calculated correlation values ​​between events.

[0014] When the target correlation group satisfies the correlation condition, the attribute analysis unit 140 integrates the correlations included in the target correlation group to derive an integrated correlation and create second correlation information. The target correlation group consists of one or more correlations corresponding to the first target object pair among the correlations indicated by the first correlation information corresponding to each entity linked to the target attribute. The target attribute is each type of attribute associated with one of the entities indicated in the preparation log. The preparation log consists of multiple logs, each indicating a pair of an entity and an object. The preparation log may be composed of logs acquired during a time period other than an irregular time period. The first target object pair is a pair of two objects of each type corresponding to the correlation indicated by one of the first correlation information corresponding to each entity linked to the target attribute. The second correlation information is information corresponding to the target attribute and indicates each derived integrated correlation. It is assumed that there are multiple types of objects corresponding to the target entity, and a frequency vector is created for each type of object corresponding to the target entity, and the first correlation information is created. The target entity is each type of entity among the one or more types of entities indicated in the preparation log. The frequency vector indicates the occurrence frequency of an object for each time period. The first correlation information indicates the correlation between each two frequency vectors corresponding to the target subject. As a specific example, the attribute analysis unit 140 receives the first correlation information as input, analyzes the attributes of the subject corresponding to each first correlation information by referring to the attribute information DB 193, merges the correlation values ​​indicated by the first correlation information according to the analyzed attributes, and outputs second correlation information indicating the merged correlation values. The second correlation information indicates the correlation values ​​between events for each attribute.

[0015] The consistency analysis unit 150 includes information indicating the second target object pair in the routine list 151 corresponding to the target attribute when a consistency condition regarding the target attribute is satisfied for the second target object pair. The consistency condition is a condition based on second correlation information corresponding to the target attribute created in the past. A specific example of the consistency condition is that second correlation information corresponding to the target attribute created in the past indicates an integrated correlation corresponding to the second target object pair. The second target object pair is a pair of two objects corresponding to each integrated correlation indicated by the second correlation information corresponding to the target attribute. The operation log consists of multiple logs, each indicating a pair of a subject and an object. The operation log may be composed of logs acquired during a time period other than a non-regular time period. The routine list 151 is a list used to reduce logs from the operation log based on the correlation between objects. As a specific example, the consistency analysis unit 150 receives second correlation information as input, analyzes the consistency between past second correlation information and current second correlation information by referring to the correlation information DB 194, creates a routine list 151 based on the results of the consistency analysis, and outputs the created routine list 151. The routine list 151 is a list of sets of routinized events for each attribute, i.e., sets of correlated events. An event set is a set of objects related to a certain subject or attribute.

[0016] When two objects included in the third target object set co-occur with an excluded subject in the target log, the filter unit 160 excludes logs corresponding to both the excluded subject and the excluded object from the target log. The excluded subject is each subject linked to the target attribute. The third target object set is a set of two objects indicated by the routine list 151 corresponding to the target attribute. The excluded object is each object included in the third target object set. The target log consists of logs collected during a target time period from among the operation logs. In other words, the filter unit 160 narrows down the logs by referring to the routine list 151 and outputs the narrowed down logs as filtered logs.

[0017] The time period information DB 191 is a database made up of information indicating non-regular time periods.

[0018] The subject / object information DB 192 is a database made up of information indicating definitions of each subject and each object for each type of log.

[0019] The attribute information DB 193 is a database that contains information indicating the attributes of each subject. A plurality of attributes may be set for each subject.

[0020] The correlation information DB 194 is a database that includes second correlation information that has been created in the past. The correlation information included in the correlation information DB 194 is information that indicates a set of events having a relatively high corresponding correlation value, and is information that corresponds to a routine event.

[0021] However, it is difficult to apply existing technologies to logs with a fixed format, such as proxy logs or authentication logs, i.e., logs with a single template. This is because existing technologies assume logs consisting of multiple templates, such as Syslog or application logs. However, because existing technologies only have a single template, there are no other templates with which to perform correlation. Furthermore, it is necessary to create multiple meaningful events from a single template as the target for correlation. Therefore, in this embodiment, a subject and an object are defined for each type of log, and multiple events (templates) are extracted from the log based on the definitions of the subject and object.

[0022] Furthermore, it is difficult to apply existing technologies to logs that contain a mixture of events from various machines, such as proxy logs or authentication system logs. This is because existing technologies are designed to handle logs related to programs on a single machine. Here, correlations are difficult to detect when multiple entities are mixed. Furthermore, it is necessary to divide the log into meaningful units that make correlations more likely to appear. Note that, because different people work at different times, it is difficult to detect correlations between people. Therefore, in this embodiment, the structure of the organization is taken into consideration, and correlations between events are calculated for the entire organization, sub-organization, and individual units.

[0023] Furthermore, it is difficult to apply existing technologies to logs related to human activity, such as proxy logs or authentication system logs, which exhibit trend changes. This is because existing technologies are designed to handle logs related to programs, which do not exhibit trend changes. Here, because business operations vary depending on the season or time of year, correlations do not appear in the business operations. Furthermore, it is necessary to find correlated events regardless of the season or time of year, or to find events that correlate for each season or time of year. Therefore, in this embodiment, the correlation between events is detected while taking consistency into consideration by comparing the detected correlation with correlations in past data.

[0024] 2 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The routine event identification device 100 is made up of a general computer including a processor 11 and a storage device 12. The routine event identification device 100 may be made up of multiple computers.

[0025] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of a computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The routine event identification device 100 may include multiple processors that replace the processor 11. The multiple processors share the role of the processor 11.

[0026] The storage device 12 is specifically composed of a volatile storage device and a non-volatile storage device. The storage device 12 stores a routine event identification program. The routine event identification program is a program that causes a computer to realize the functions of each unit included in the routine event identification device 100. The routine event identification program is executed by the processor 11. The functions of each unit included in the routine event identification device 100 are realized by software.

[0027] Data used when executing the routine event identification program and data obtained by executing the routine event identification program are appropriately stored in the storage device 12. Each unit of the routine event identification device 100 appropriately uses the storage device 12. Note that the terms "data" and "information" may have the same meaning. The storage device 12 may be independent of the computer.

[0028] The routine event identification program may be stored in a computer-readable non-volatile recording medium, such as an optical disk or a flash memory. The routine event identification program may be provided as a program product.

[0029] ***Explanation of Operation*** The operating procedure of the routine event identification device 100 corresponds to a routine event identification method. Also, the program that realizes the operation of the routine event identification device 100 corresponds to a routine event identification program.

[0030] Fig. 3 shows an overview of the processing of the routine event identification device 100 during preparation. This overview will be explained using Fig. 3. During preparation, the routine event identification device 100 derives a routinized normal operation.

[0031] (Step S1) The event creating unit 110 defines a subject and an object according to the type of log, and extracts a plurality of events from the log based on the defined subject and object.

[0032] (Step S2) The frequency calculation unit 120 divides the event logs by time period, calculates the occurrence frequency of each object for each subject for each time period for each divided log, and creates a frequency table showing the calculated occurrence frequency for each subject. Each frequency table corresponds to frequency information and shows the occurrence frequency of each object for each subject for each time period.

[0033] (Step S3) The correlation calculation unit 130 creates a correlation matrix indicating the correlation between the objects for each subject from the frequency table. The created correlation matrix corresponds to first correlation information.

[0034] (Step S4) The attribute analysis unit 140 calculates the correlation between objects for each unit in the organization, taking into account the structure of the organization. Each unit is an appropriate division of the organization. Specific examples of each unit include the entire organization, a sub-organization, or an individual.

[0035] (Step S5) The attribute analysis unit 140 creates a correlation list indicating pairs of correlated events for each unit based on the calculated correlation. The created correlation list corresponds to second correlation information.

[0036] (Step S6) The consistency analysis unit 150 compares the created correlation list with a correlation list based on past logs for each unit, and extracts correlations between consistent objects from the created correlation list.

[0037] 4 is a flowchart showing an example of the operation of the event creating section 110. The operation of the event creating section 110 will be described with reference to FIG.

[0038] (Step S111) The event creation unit 110 reads the log and creates a post-exclusion log by excluding logs for non-regular time periods from the read log with reference to the time period information DB 191. Fig. 5 shows a specific example of the post-exclusion log.

[0039] (Step S112) Based on the identifier of the log or the post-exclusion log, the event creation unit 110 obtains information corresponding to the subject and object to be used from the subject / object information DB 192. The log identifier is, for example, written in the file name of the log. For example, the information corresponding to the subject and object is information indicating the column name or row number corresponding to each of the subject and object when the log format is CSV (Comma Separated Values). For another example, the information corresponding to the subject and object is information indicating the key value corresponding to each of the subject and object when the log format is JSON (JavaScript Object Notation) expressed as key:value.

[0040] (Step S113) The event creating unit 110 extracts unique character strings included in the subject item from all events indicated by the post-exclusion log, without duplication.

[0041] (Step S114) The event creating unit 110 extracts unique character strings included in the items corresponding to objects from all events indicated by the post-exclusion log, without duplication.

[0042] (Step S115) The event creation unit 110 creates one or more first split logs by dividing the post-exclusion log by unique character strings of the extracted subjects. Figure 6 shows a first split log created by dividing the post-exclusion log for the subject USER1, as an example of the first split log corresponding to the post-exclusion log shown in Figure 5. The event creation unit 110 divides the post-exclusion log for each subject in the same manner.

[0043] (Step S116) The event creation unit 110 creates one or more second split logs by dividing each first split log by unique character strings of the extracted objects. The second split logs correspond to logs divided by unique words or character strings of the subjects and objects.

[0044] 7 is a flowchart showing an example of the operation of the frequency calculation section 120. The operation of the frequency calculation section 120 will be described with reference to FIG.

[0045] (Step S121) The frequency calculation unit 120 excludes second split logs that contain fewer events than a predetermined threshold. Hereinafter, when referring to second split logs, it is assumed that the second split logs that have not been excluded in this step are being referred to.

[0046] (Step S122) For each second divided log, the frequency calculation unit 120 creates one or more third divided logs by dividing the second divided log by a fixed time unit. The frequency calculation unit 120 does not have to divide each second divided log by a fixed time unit.

[0047] (Step S123) The frequency calculation unit 120 counts the number of logs included in each third divided log and creates a frequency table showing the results of counting the number of occurrences of each unique character string of the subject and object for each time period. Each column in the frequency table corresponds to a frequency vector corresponding to each object. The frequency vector is an array in which the occurrence frequency of the object is recorded in time period order. Note that if the second divided log is a log covering a period of two or more days, the frequency calculation unit 120 adds the frequencies corresponding to the logs from the second day onwards to the end of the array, one day at a time. Figure 8 shows a specific example of a frequency table corresponding to a certain subject. In Figure 8, the number of occurrences of each domain is shown for each time period, and each column corresponds to a frequency vector.

[0048] Fig. 9A is a flowchart showing an example of the operation of the correlation calculation section 130. The operation of the correlation calculation section 130 will be described with reference to Fig. 9A.

[0049] (Step S131) ​​The correlation calculation unit 130 creates a correlation matrix for frequency vectors between objects for each subject. In this case, the correlation calculation unit 130 uses the Pearson correlation coefficient shown in [Equation 1] for column-to-column of the correlation matrix as a specific example. Here, x corresponds to one object (domain) and y corresponds to the other object (domain). x ｉ indicates the frequency of access to one domain within a certain period of time. The certain period corresponds to each third split log. x' is x ｉ The overall average value is shown. ｉ indicates the frequency of access to the other domain within a certain period of time. ｉ It indicates the overall average value. r indicates the correlation coefficient. Note that if the value of r is close to 1, there is a positive correlation, if the value of r is close to -1, there is a negative correlation, and if the value of r is close to 0, there is no correlation. n indicates the number of data points for each of x and y.

[0050]

[0051] FIG. 9B shows a specific example of a process for deriving a correlation matrix from a frequency table. A correlation matrix is ​​a matrix that indicates the correlation values ​​between objects for each subject. A collection of correlation matrices is also called a correlation table. Each time period indicated in the frequency table corresponds to a target time period. In FIG. 9B, the correlation calculation unit 130 derives a correlation value between the frequency vector of the object WEBSITE1 and the frequency vector of the object WEBSITE2.

[0052] 10 is a flowchart showing an example of the operation of the attribute analysis unit 140. The operation of the attribute analysis unit 140 will be described with reference to FIG.

[0053] (Step S141) The attribute analysis unit 140 refers to the attribute information DB 193 and groups entities linked to the same attribute for each attribute. That is, the attribute analysis unit 140 groups entities having each attribute for each attribute, thereby creating a group corresponding to each attribute. FIG. 11 shows a specific example of the attribute information DB 193. In this example, the organization and each sub-organization to which each user, who is the entity, belongs are shown. "Entire company" and "First department" each correspond to an attribute.

[0054] (Step S142) For each created group, the attribute analysis unit 140 calculates the mean and standard deviation for each element of the correlation matrix within the group. Then, for each group, the attribute analysis unit 140 extracts pairs of objects that satisfy a predetermined condition and creates an object list A consisting of the extracted pairs of objects. For example, the predetermined condition is that the mean is equal to or greater than a predetermined threshold θ1 and the standard deviation is less than a predetermined threshold θ2. For example, assuming that there are subjects S1, S2, and S3, objects O1, O2, and O3, and that S1, S2, and S3 belong to the same group, the attribute analysis unit 140 calculates the mean (O1·O2), mean (O1·O3), mean (O2·O3), and standard deviation (O1·O2), standard deviation (O1·O3), and standard deviation (O2·O3) as correlation information (mean and standard deviation) for each pair of objects for the group. Then, for each set of objects for which correlation information has been calculated, if both the mean and standard deviation satisfy predetermined conditions, the attribute analysis unit 140 adds the set to the object list A. Figure 12 shows the process of calculating the mean and standard deviation for each element of the correlation matrix for each group using the correlation table corresponding to each subject belonging to that group. This process corresponds to merging the correlation matrices.

[0055] (Step S143) For each created group, the attribute analysis unit 140 calculates the average and standard deviation of the number of events included in the second divided log for each object within the group. Then, for each group, the attribute analysis unit 140 extracts objects that satisfy a predetermined condition and creates an object list B consisting of the extracted objects. A specific example of the predetermined condition is that the average is equal to or greater than a predetermined threshold θ3 and the standard deviation is less than a predetermined threshold θ4. For example, given subjects S1, S2, and S3 and an object O1, the attribute analysis unit 140 calculates the average and standard deviation of object O1 based on the respective frequencies of events that are a combination of S1 and O1, events that are a combination of S2 and O1, and events that are a combination of S3 and O1. If the average and standard deviation of object O1 satisfy the predetermined condition, the attribute analysis unit 140 adds object O1 to object list B. The conditions described in steps S142 and S143 correspond to conditions that constitute correlation conditions.

[0056] (Step S144) For each group, the attribute analysis unit 140 excludes from object list A any object pairs that include an object not included in object list B, and generates second correlation information indicating each pair of objects included in object list A that has not been excluded. Each extracted pair of objects corresponds to the integrated correlation. The average value of the correlation shown in FIG. 12 corresponds to the correlation value corresponding to the integrated correlation. Here, since each user is also an attribute, filtering for each user is possible. As a specific example, if object list A is [O1·O2, O1·O3, O2·O3] and object list B is [O1, O3], the attribute analysis unit 140 excludes O1·O2 and O2·O3 from object list A because O2 is not included in object list B, and generates [O1·O3] as the second correlation information.

[0057] 13A is a flowchart showing an example of the operation of the consistency analysis unit 150. The operation of the consistency analysis unit 150 will be described with reference to FIG.

[0058] (Step S151) The consistency analysis unit 150 refers to the correlation information DB 194 for each attribute and extracts a pair of objects corresponding to a routinized event from the second correlation information as an exclusion target. The exclusion target has a consistent correlation. The consistency analysis unit 150 creates a routine list 151 indicating the pair of objects extracted for each attribute. As a specific example, if there is a consistent correlation between pairs of objects WEBSITE1 and WEBSITE4 and WEBSITE1 and WEBSITE5 for a certain attribute, the consistency analysis unit 150 creates a list consisting of pairs of objects such as [“WEBSITE1”:“WEBSITE4”, “WEBSITE1”:“WEBSITE5”] as the routine list 151 corresponding to the certain attribute. At this time, a correlation value corresponding to each pair of objects may be recorded in the routine list 151. That is, the consistency analysis unit 150 may create a routine list 151 such as ["WEBSITE1":"WEBSITE4"(0.3), "WEBSITE1":"WEBSITE5"(0.4)]. FIG. 13B shows a specific example of the routine list 151. In FIG. 13B, a set of objects corresponding to events routinized for each attribute is shown. In addition, if there is a set of objects included in both the routine list 151 corresponding to a higher-level attribute and the routine list 151 corresponding to a lower-level attribute, the consistency analysis unit 150 deletes the set of objects from the routine list 151 corresponding to the lower-level attribute. As a specific example, if the routine list 151 corresponding to the entire company is ["WEBSITE1":"WEBSITE4", "WEBSITE1":"WEBSITE5"] and the routine list 151 corresponding to the first department is ["WEBSITE1":"WEBSITE4", "WEBSITE4":"WEBSITE5"], then "WEBSITE1":"WEBSITE4" is excluded from the routine list 151 corresponding to the first department. It is assumed that information indicating the hierarchical relationship between attributes is registered in the attribute information of the attribute information DB 193. As a specific example, this information is information indicating "first department ⊂ entire company" and "user ⊂ first department".

[0059] Fig. 14 shows an outline of the processing of the routine event identification device 100 during operation. This outline will be explained using Fig. 14. It is assumed that the routine list 151 has already been created.

[0060] The filter unit 160 reduces the number of logs by excluding logs corresponding to routine events from the logs collected during system operation with reference to the routine list 151. At this time, the filter unit 160 utilizes the routine list 151 as a whitelist.

[0061] Fig. 15 is a flowchart showing an example of the operation of the filter unit 160. The operation of the filter unit 160 will be described with reference to Fig. 15. It is assumed that the event creation unit 110 divides a log generated during system operation into subjects and objects, thereby creating one or more second divided logs corresponding to the log.

[0062] (Step S161) The filter unit 160 receives the second divided log from the event creation unit 110 and identifies the attribute of the subject corresponding to the received second divided log by referring to the attribute information DB 193. At this time, the filter unit 160 may identify multiple attributes.

[0063] (Step S162) The filter unit 160 acquires the routine list 151 corresponding to each of the identified attributes.

[0064] (Step S163) The filter unit 160 divides the second divided log into one or more third divided logs by a fixed time unit. Each third divided log corresponds to a target log.

[0065] (Step S164) The filter unit 160 refers to each acquired routine list 151 and records third divided logs in which pairs of objects corresponding to pairs of routinized events co-occur over a certain period of time, and each object included in the pair of co-occurring objects. A log in which pairs of objects co-occur is a log in which both objects included in the pair of objects are included. Each recorded object is an exclusion target for the third divided log corresponding to each recorded object. In this case, the filter unit 160 checks for exclusion targets in order of pairs with relatively high corresponding correlation values, and may exclude only objects included in pairs of objects corresponding to correlation values ​​exceeding a certain threshold, or may set a certain upper limit on the number of pairs of objects to be checked. As a specific example, if both objects of "WEBSITE1":"WEBSITE2", which is a set of objects corresponding to a set of routinized events for an attribute corresponding to a certain third divided log, are included in the certain third divided log, the filter unit 160 records the ID of the certain third divided log and "WEBSITE1" and "WEBSITE2", which are objects included in the set of objects. The two recorded objects are exclusion targets for the certain third divided log. Note that instead of each object, each log having each object may be recorded as an exclusion target. After finishing checking the exclusion targets for all routine lists 151 obtained for all third divided logs, the filter unit 160 proceeds to step S165.

[0066] (Step S165) For each third split log, the filter unit 160 excludes logs related to the recorded exclusion targets from the third split log. FIG. 16 shows an example of the process of excluding logs from a certain third split log. In this example, it is assumed that "WEBSITE1" and "WEBSITE4" are recorded as exclusion targets. FIG. 16 shows an example of the third split log, with the excluded logs crossed out. The excluded logs are logs that correspond to both the exclusion target subject and the exclusion target object.

[0067] ***Explanation of the Effects of Embodiment 1*** Figure 17 is a diagram illustrating the effects of this embodiment. In anomaly detection, if embodiment 1 is not utilized, when the number of normal logs per day is 1 million, as shown in (a) of Figure 17, 1,000 alerts due to false positives will be generated per day, even if the false positive rate is relatively high at 0.1%. On the other hand, by utilizing embodiment 1, when the number of normal logs per day is 1 million, as shown in (b) of Figure 17, logs corresponding to routinized normal events are excluded from the inspection target, narrowing it down to 10,000. Therefore, according to embodiment 1, even if the false positive rate is 1%, the number of alerts due to false positives can be reduced to 100 per day. Here, routinized normal events are events derived based on the correlation between the occurrence frequencies of specific events in logs. Creating and managing routinized normal events is easier than using a normal whitelist. Furthermore, according to the conventional technology, the amount of logs is so large that it exceeds the allowable amount of logs that can be used for learning anomaly detection, which reduces the accuracy of anomaly detection. On the other hand, according to the first embodiment, the amount of logs can be reduced to or below the allowable amount by filtering.

[0068] ***Other Configurations*** <Modification 1> Fig. 18 shows an example of the hardware configuration of a routine event identification device 100 according to this modification. The routine event identification device 100 includes a processing circuit 18 instead of the processor 11, or instead of the processor 11 and the storage device 12. The processing circuit 18 is hardware that realizes at least a portion of the components included in the routine event identification device 100. The processing circuit 18 may be dedicated hardware, or may be a processor that executes a program stored in the storage device 12.

[0069] When the processing circuitry 18 is dedicated hardware, the processing circuitry 18 may be, for example, a single circuit, multiple circuits, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The routine event localizer 100 may include multiple processing circuits that replace the processing circuitry 18. The multiple processing circuits share the role of the processing circuitry 18.

[0070] In the routine event localization device 100, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0071] As a specific example, the processing circuitry 18 is realized by hardware, software, firmware, or a combination of these. The processor 11, the storage device 12, and the processing circuitry 18 are collectively referred to as "processing circuitry." In other words, the functions of each functional component of the routine event identification device 100 are realized by the processing circuitry. Routine event identification devices 100 according to other embodiments may also have a configuration similar to that of this modified example.

[0072] Second Embodiment The following mainly describes the differences from the above-described embodiment with reference to the drawings.

[0073] ***Description of Configuration*** Fig. 19 shows an example of the configuration of a routine event identification device 100 according to this embodiment. The routine event identification device 100 further includes a seasonal division unit 210, and further stores a seasonal information DB 291.

[0074] The seasonal division unit 210 divides the frequency information based on seasonal information. The seasonal information is information indicating a season or a specific period, and specific examples include information indicating the four seasons, the first half of the year, the second half of the year, or a busy season. Each of the seasons and specific periods corresponds to a target period, and is a period divided according to the similarity of business trends. In this embodiment, each frequency vector corresponding to a target entity is a vector corresponding to logs collected in each target period. The operation logs according to this embodiment are logs collected in each target period.

[0075] The season information DB 291 is a database made up of season information.

[0076] 20 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0077] ***Explanation of Operation*** Fig. 21(a) is a flowchart showing an example of the operation of the seasonal splitting unit 210. The operation of the seasonal splitting unit 210 will be explained using Fig. 21(a).

[0078] (Step S211) The seasonal division unit 210 refers to the seasonal information DB 291 and divides each piece of frequency information based on the timestamp (or time zone information) indicated by each piece of frequency information and the seasonal information. As a specific example, if the seasonal information defines a first half (April to September), a second half (October to February), and a busy season (March), the seasonal division unit 210 divides each piece of frequency information into information for three periods according to the seasonal information, as shown in (b) of FIG. 21 . The subsequent processing (the processing of the correlation calculation unit 130, the attribute analysis unit 140, the consistency analysis unit 150, and the filter unit 160) is basically the same as in the first embodiment. However, each processing is performed in units divided by the seasonal information.

[0079] ***Explanation of Effect of Second Embodiment*** In logs related to human behavior other than Syslog or application logs (for example, proxy logs or authentication system logs), trends may change depending on the time of year (first half, second half, busy season, etc.). Therefore, if logs related to all time periods are handled together, it may not be possible to calculate correlations appropriately. According to this embodiment, logs are divided based on information regarding the seasonality of predefined tasks and correlations are calculated. Therefore, according to this embodiment, the accuracy of correlations can be improved. In other words, according to this embodiment, correlations can be calculated with relatively high accuracy from logs whose trends change depending on the season, making it possible to more appropriately identify routinized events.

[0080] Third Embodiment Hereinafter, differences from the above-described embodiments will be mainly described with reference to the drawings.

[0081] 22 shows an example of the configuration of the routine event identification device 100 according to this embodiment. The routine event identification device 100 further includes an integration unit 310.

[0082] The integration unit 310 selects one or more sets of integrated correlations from the integrated correlations indicated in the routine list 151 corresponding to the target attribute based on their relevance, sets each of the selected sets of integrated correlations as a target correlation set, and integrates the integrated correlations included in the target correlation set to create one or more integrated object groups. The integration unit 310 also deletes pairs of two objects corresponding to the target correlation set from the routine list 151 corresponding to the target attribute and adds one or more integrated object groups corresponding to the target correlation set to the routine list 151 corresponding to the target attribute to create an integrated routine list 311 corresponding to the target attribute. The integrated object group consists of two or more objects corresponding to the target correlation set. As a specific example, the integration unit 310 creates the integrated routine list 311 by appropriately integrating pairs of objects indicated in the routine list 151 based on the structure of the correlation. The pairs of objects to be integrated are pairs of objects related to each other. By the integration unit 310 appropriately integrating routinized events (objects) that are in a co-occurring relationship based on correlation, the conditions for determining whether a routine is a normal operation can be made stricter, thereby improving the accuracy of exclusion.

[0083] The filter unit 160 according to this embodiment uses the integrated routine list 311 instead of the routine list 151. Specifically, when all objects included in the target integrated object group co-occur with an excluded subject in a target log collected during a target time period among operation logs, the filter unit 160 excludes logs corresponding to both the excluded subject and the excluded subject from the target log. The target integrated object group is each integrated object group indicated by the integrated routine list 311 corresponding to the target attribute. The excluded subject is each subject linked to the target attribute. The excluded object is each object included in the target integrated object group.

[0084] 23 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0085] ***Explanation of Operation*** Fig. 24 is a flowchart showing an example of the operation of the integrating unit 310. The operation of the integrating unit 310 will be described with reference to Fig. 24 .

[0086] (Step S311) The integration unit 310 identifies, for each routine list 151, one or more sets of objects that can be integrated.

[0087] (Step S312) The integration unit 310 creates an integrated routine list 311 by integrating a plurality of sets of objects for each identified set for each routine list 151.

[0088] The processing of the integration unit 310 will be described in detail below. As a specific example, assume that the routine list 151 is ["A":"B", "B":"C", "C":"A", "A":"D", "B":"E", "C":"F"]. The following two methods are described as specific examples of methods for identifying sets of multiple objects that can be integrated, but other methods may also be used.

[0089] [Method 1] When "A":"B" ("A" and "B" are correlated) and "B":"C" ("B" and "C" are correlated), the integration unit 310 determines that "A":"C" ("A" and "C" are also expected to be correlated) and identifies "A":"B" and "B":"C" as pairs of objects that can be integrated. In this case, the integration unit 310 integrates the identified pair of objects with "A":"B":"C". When [Method 1] is applied to the routine list 151 according to the above example, the integration unit 310 creates a list of all pairs of objects integrated as the integrated routine list 311, such as ["A":"B":"C":"D":"E":"F"]. The elements of the created list correspond to integrated object groups.

[0090] [Method 2] [Method 2] is more accurate in terms of correlation than [Method 1]. When "A":"B" ("A" and "B" are correlated), and "B":"C" ("B" and "C" are correlated), and "A":"C" ("A" and "C" are correlated), the integration unit 310 identifies "A":"B", "B":"C", and "A":"C" as pairs of objects that can be integrated. In this case, the integration unit 310 integrates the identified pair of objects with "A":"B":"C". When [Method 2] is applied to the routine list 151 according to the above example, the integration unit 310 creates a list in which some pairs are integrated, such as ["A":"B":"C", "A":"D", "B":"E", "C":"F"], as the integrated routine list 311. "A":"B":"C" corresponds to the integrated object group. In this case, the object correlation pairs consist of "A":"B", "B":"C", and "C":"A".

[0091] The integration unit 310 may record the correlation values ​​corresponding to each pair together. That is, the integration unit 310 may create an integrated routine list 311 such as ["A":"B":"C":0.5, "A":"D", "B":"E":0.4, "C":"F":0.6]. Note that the correlation value of the integrated object pair may be calculated, for example, from the average, minimum, or maximum of the correlation values ​​of the multiple pairs before integration.

[0092] The operation of the filter section 160 will now be described.

[0093] (Step S164) This step is the same as step S164 according to the first embodiment. However, when all objects included in a set of objects indicated by integrated routine list 311 corresponding to a certain third divided log are included in the certain third divided log, filter unit 160 records each object included in the set of objects (for example, "WEBSITE1", "WEBSITE4", and "WEBSITE7") as an object to be excluded. At this time, logs are excluded as shown in FIG. 25 as a specific example.

[0094] ***Explanation of Effects of Embodiment 3*** As described above, according to this embodiment, in a list showing sets of routinized events for each attribute, sets of related events are integrated. Therefore, according to this embodiment, the number of conditions increases through integration, making it possible to detect routinized tasks that are to be excluded with higher accuracy.

[0095] Fourth Embodiment. The following mainly describes the differences from the above-described embodiments, with reference to the drawings. In the above-described embodiments, it was assumed that information on routine events and past correlation information would be prepared in advance and used. In this embodiment, the timing for updating this information is determined depending on the increase or decrease in the amount of routine events to be reduced from the log.

[0096] 26 shows an example of the configuration of the routine event identification device 100 according to this embodiment. The routine event identification device 100 further includes an update confirmation unit 410.

[0097] The update confirmation unit 410 instructs updating of information on routine events and past correlation information at an appropriate timing according to the latest trends of the logs being operated. As a specific example, the update confirmation unit 410 determines whether to update the routine list 151 corresponding to the target attribute based on the results of logs being excluded from the operation log using the routine list 151 corresponding to the target attribute.

[0098] The filter unit 160 according to this embodiment creates and updates filtering record information, which indicates the results of filtering performed by the filter unit 160.

[0099] 27 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0100] ***Explanation of Operation*** Fig. 28 is a flowchart showing an example of the operation of the filter section 160. The operation of the filter section 160 will be described using Fig. 28.

[0101] (Step S166) The filter unit 160 counts the number of sets of routinized events that have been excluded from the log for each routine list 151, and updates the filtering performance information based on the count result. As a specific example, the filtering performance information is information that indicates, for each routine list 151, the number of times that routine information has been deleted so far (the number of split logs that have been deleted), the total amount of logs that have been deleted so far, the average amount of logs that have been deleted so far, the standard deviation of the amount of logs that have been deleted so far, a threshold, the number of times that routine information has been deleted this time, and the average amount of logs that have been deleted this time.

[0102] 29 is a flowchart showing an example of the operation of the update confirmation unit 410. The operation of the update confirmation unit 410 will be described with reference to FIG.

[0103] (Step S411) The update confirmation unit 410 confirms filtering performance information for each group of events indicated by each routine list 151.

[0104] (Step S412) The update confirmation unit 410 calculates the difference (absolute value) between the average amount of logs that have been reduced so far and the average amount of logs that have been deleted this time for each set of events indicated by each routine list 151, and checks whether the calculated difference exceeds a specified threshold A. The threshold A may be a predetermined value or a dynamically determined value. As a specific example, the dynamically determined threshold A is 3 x (the standard deviation of the amount of logs that have been deleted so far for each routine list 151).

[0105] (Step S413) If the number of pairs of events whose corresponding difference exceeds threshold A is equal to or greater than a specified threshold B, the update confirmation unit 410 instructs the event creation unit 110 to update the information on the routineized events and the past correlation information. That is, the update confirmation unit 410 instructs the event creation unit 110 to re-execute the preparation process. Here, it is assumed that threshold B is determined in advance. Note that the update confirmation unit 410 may instruct only the updating of the routine list 151 and past correlation information corresponding to a certain attribute.

[0106] ***Explanation of the Effects of the Fourth Embodiment*** As described above, according to this embodiment, information on routine events and past correlation information are updated according to the amount of routine events that are deleted. Therefore, according to this embodiment, it is possible to dynamically adapt to the latest trends.

[0107] Fifth Embodiment. Differences from the above-described embodiments will be mainly described below with reference to the drawings. In the above-described embodiments, pairs of correlated events that are not included in past correlation information are not subject to filtering. Therefore, in this embodiment, feedback is applied to the correlation between events, regardless of whether they are included in past correlation information, and pairs of events that have a correlation exceeding a specified threshold value after the feedback are filtered.

[0108] 30 shows an example of the configuration of the routine event identification device 100 according to this embodiment. The routine event identification device 100 further includes a feedback section 510.

[0109] The feedback unit 510 corrects the current correlation information based on the past correlation information. The corrected current correlation information is used by the consistency analysis unit 150. The feedback unit 510 corrects each correlation value indicated by the newly created second correlation information corresponding to the target attribute based on the previously created second correlation information corresponding to the target attribute, thereby generating fed-back correlation information corresponding to the target attribute. As a specific example, the feedback unit 510 corrects each correlation value based on whether the previously created second correlation information corresponding to the target attribute indicates a pair of two objects corresponding to each correlation value. In this embodiment, the second correlation information corresponding to the target attribute indicates a correlation value corresponding to each integrated correlation for the target attribute.

[0110] The consistency condition according to the present embodiment is that the correlation value corresponding to the second target object pair in the fed-back correlation information corresponding to the target attribute is equal to or greater than a correlation threshold. The correlation threshold may be determined in any manner.

[0111] 31 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0112] ***Explanation of Operation*** Fig. 32 is a flowchart showing an example of the operation of the feedback section 510. The operation of the feedback section 510 will be described with reference to Fig. 32.

[0113] (Step S511) The feedback unit 510 refers to the correlation table for each attribute to the correlation information between events.

[0114] (Step S512) The feedback unit 510 refers to the correlation information DB 194 and updates the correlation information between events obtained this time based on past correlation information. A specific example of the update method is shown below. If a correlation between certain events has already been registered in the correlation information DB 194, the feedback unit 510 positively corrects the correlation between the certain events. At this time, the feedback unit 510 adds a specified value α to the correlation value obtained this time for the certain events. Note that the upper limit of the correlation value after the addition is 1.0. If a correlation between certain events is not registered in the correlation information DB 194, the feedback unit 510 negatively corrects the correlation between the certain events. At this time, the feedback unit 510 subtracts a specified value β from the correlation value obtained this time for the certain events. Note that the lower limit of the correlation value after the subtraction is 0.0. (a) of FIG. 33 shows a specific example of correlation information for each pair of events updated for each attribute.

[0115] (Step S513) The feedback unit 510 registers information indicating the correlation between the events obtained this time as past correlation information in the correlation information DB 194. At this time, the feedback unit 510 may register information indicating the updated correlation value in the correlation information DB 194.

[0116] Fig. 33(b) is a flowchart showing an example of the operation of the consistency analysis unit 150. The operation of the consistency analysis unit 150 will be described using Fig. 33(b).

[0117] (Step S152) For each attribute, if the correlation value (value after update by the feedback unit 510) of the pair of events for the attribute exceeds a predetermined threshold, the consistency analysis unit 150 regards the pair of events as a routine event for the attribute. As a specific example, if the correlation threshold is 0.35, and the correlation information (after feedback) corresponding to the candidate pair of objects corresponding to an event for a certain attribute is [“WEBSITE1”:“WEBSITE2”:(0.3), “WEBSITE1”:“WEBSITE4”:(0.4)], only the pair of events corresponding to [“WEBSITE1”:“WEBSITE4”:(0.4)] is regarded as the pair of events that is routine for the certain attribute.

[0118] ***Explanation of Effect of Fifth Embodiment*** As described above, according to this embodiment, it is possible to filter even pairs of events that are not included in past correlation information.

[0119] Sixth Embodiment. The following mainly describes the differences from the above-described embodiments with reference to the drawings. In the above-described embodiments, it is expected that events with a small absolute number are difficult to extract as routine events because it is difficult to obtain a high correlation. Therefore, in this embodiment, schedule information is referenced from a schedule management system or the like, and correlations between events during limited time periods such as meetings are calculated, thereby enabling events with a small absolute number to be extracted as routine events.

[0120] 34 shows an example of the configuration of the routine event identification device 100 according to this embodiment. The routine event identification device 100 further includes a schedule information analysis unit 610.

[0121] The schedule information analysis unit 610 analyzes the schedule information registered in the schedule management system and divides the log into items corresponding to the schedule based on the analysis results. Schedule information is, for example, information indicating the name, time period, participants (e.g., meeting participants), and identifier (e.g., a meeting ID) for each schedule. An item is a collection of identical schedules. In this embodiment, each frequency vector corresponding to a target subject is a vector corresponding to logs collected during a time period corresponding to a target schedule that is periodically implemented. The time period corresponding to the target schedule may also refer to a certain time period on the day of the week or date on which the target schedule is implemented. The target schedule does not always have to be implemented during the same time period or on the same day of the week. The operation log according to this embodiment is composed of logs collected during a time period corresponding to the target schedule. Each target schedule corresponds to an item.

[0122] The filter unit 160 according to this embodiment uses, as the routine list 151 corresponding to each attribute, a list indicating information created based on an item in addition to the information indicated by the routine list 151 described above.

[0123] 35 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0124] ***Explanation of Operation*** Fig. 36 is a flowchart showing an example of the operation of the schedule information analysis unit 610. The operation of the schedule information analysis unit 610 will be described using Fig. 36.

[0125] (Step S611) The schedule information analysis unit 610 collects schedule information for each user from the schedule management system.

[0126] (Step S612) During preparation, the schedule information analysis unit 610 extracts, for each user, multiple schedules that are considered to be identical scheduled tasks based on the similarity of schedule names, etc., as items. The identity between multiple schedules is determined, for example, based on the edit distance of character strings or the cosine similarity of vector expressions of words obtained from Word2Vec, etc. The schedule information analysis unit 610 may extract multiple schedules as items if the same identifier is assigned to multiple schedules in the schedule. The schedule information analysis unit 610 may extract multiple schedules as items if the same participant is listed in multiple schedules in the schedule.

[0127] During operation, the schedule information analysis unit 610 extracts items that are considered to be the same scheduled work based on the similarity of the item names and schedule names of the items merged between users during preparation. The method of extracting items is the same as during preparation.

[0128] (Step S613) This step is executed during preparation. The schedule information analysis unit 610 merges the items extracted for each user between users. At this time, the schedule information analysis unit 610 merges items based on matches between item names, scheduled time periods, schedule identifiers, etc. If the schedule includes participant information, the schedule information analysis unit 610 may merge multiple items based on the participant information.

[0129] (Step S614) This step is executed during preparation. For each merged item, the schedule information analysis unit 610 registers the item as an attribute and each user linked to the item in the attribute information DB 193.

[0130] (Step S615) The schedule information analysis unit 610 divides the log for each merged item based on the time period and subject corresponding to the item. Each unit performs processing based on the divided logs. The divided logs in this step are used to extract events that are routine but have a small absolute number.

[0131] The frequency calculation unit 120 according to this embodiment does not execute the process of step S121, taking into consideration that the absolute number of events is small.

[0132] 37 is a flowchart showing an example of the operation of the filter section 160. The operation of the filter section 160 will be described with reference to FIG.

[0133] (Step S162) This step is basically the same as the above-mentioned step S162. However, when a set of events whose corresponding attribute is an item exists in the acquired routine list 151, the filter unit 160 acquires item information corresponding to the set of events.

[0134] (Step S164) This step is basically the same as step S164 described above. However, when using a set of events corresponding to an attribute that is an item, the filter unit 160 checks whether a set of objects indicated by the set of events co-occurs only for logs acquired during a time period indicated by item information corresponding to the attribute. In other words, in this case, the condition for exclusion is that logs acquired during a time period corresponding to the attribute be included.

[0135] ***Explanation of the Effects of Sixth Embodiment*** As described above, according to this embodiment, even routinized events with a small absolute number can be extracted as routinized events and excluded.

[0136] Seventh Embodiment The following mainly describes the differences from the above-described embodiments, with reference to the drawings. In the first embodiment, sets of routine events are deleted from the log. In contrast, in this embodiment, sets of routine events are consolidated into a single log instead of being deleted, thereby reducing the amount of logs.

[0137] 38 shows an example of the configuration of a routine event identification device 100 according to this embodiment. The routine event identification device 100 includes an aggregation unit 710 instead of the filter unit 160.

[0138] The aggregating unit 710 aggregates multiple logs corresponding to pairs of routine events. Specifically, when two objects included in a third target object set co-occur with an excluded subject in target logs collected during a target time period among operation logs, the aggregating unit 710 creates an aggregated log by aggregating logs corresponding to both the excluded subject and each object included in the third target object set in the target logs, and excludes logs corresponding to both the excluded subject and each object included in the third target object set from the target log. The aggregating unit 710 also adds each aggregated log created for the target log to the target log. The third target object set is a pair of two objects indicated in the routine list 151 corresponding to the target attribute. The excluded subject is each subject linked to the target attribute.

[0139] 39 shows an example of the hardware configuration of the routine event identification device 100 according to this embodiment. The hardware configuration of the routine event identification device 100 is similar to the hardware configuration of the routine event identification device 100 according to the first embodiment.

[0140] ***Explanation of Operation*** Fig. 40 is a flowchart showing an example of the operation of the aggregation unit 710. The operation of the aggregation unit 710 will be described with reference to Fig. 40.

[0141] (Step S711) This step is the same as step S161.

[0142] (Step S712) This step is similar to step S162.

[0143] (Step S713) This step is the same as step S163.

[0144] (Step S714) This step is basically the same as step S164. However, for each pair of routine events (e.g., a pair corresponding to "WEBSITE1" and "WEBSITE2"), if the objects included in the pair of events for each subject corresponding to the pair of events are both included in the third divided log, the aggregator 710 records the logs corresponding to both the subjects corresponding to the pair of events and their objects as aggregation targets, and creates an aggregated log indicating that the aggregation targets have been aggregated. Each aggregated log corresponds to one of the pair of events. For example, the aggregated log is information indicating the objects corresponding to the aggregation targets in alphabetical order, such as "WEBSITE1:WEBSITE2," as object information, and the timestamp calculated from the logs corresponding to the aggregation targets as timestamps. For example, the calculated timestamp is the average, minimum, or maximum of the timestamps of the logs corresponding to the aggregation targets. When the aggregating unit 710 has finished checking the aggregation targets for all the routine lists 151 corresponding to each of the third divided logs, the process proceeds to step S715.

[0145] (Step S715) For each third split log, the aggregator 710 inserts the aggregated log into the third split log based on the recorded aggregation target, and deletes each log corresponding to the aggregation target from the third split log. FIG. 41 shows a specific example of the processing of the aggregator 710. The upper part of FIG. 41 shows an example of the third split log, with each log corresponding to the aggregation target underlined. The lower part of FIG. 41 shows the aggregated log underlined. In this example, the pairs of objects corresponding to the set of events routinized for the subject USER1 are "WEBSITE1" and "WEBSITE4," and "WEBSITE1" and "WEBSITE8." These pairs of objects correspond to the third target object pair. In addition, the maximum value of the timestamps indicated by the logs corresponding to the aggregation targets corresponding to each pair of events is used as the timestamp of the aggregated log corresponding to each pair of events. The aggregation unit 710 aggregates logs for each set of events in the same manner as appropriate. In Fig. 41, for the target logs, logs corresponding to both the excluded subject and each object included in the third target object set are aggregated.

[0146] ***Explanation of the Effects of Embodiment 7*** As described above, according to this embodiment, by aggregating multiple logs corresponding to a set of routine events into a single log, it is possible to reduce the amount of logs to be analyzed while retaining a record of routine events that occurred during abnormal time periods.

[0147] ***Other Embodiments*** The above-described embodiments can be freely combined, or any of the components of each embodiment can be modified, or any of the components can be omitted from each embodiment. Furthermore, the embodiments are not limited to those shown in embodiments 1 to 7, and various modifications are possible as needed. The procedures described using flowcharts, etc., can be modified as appropriate.

[0148] Various aspects of the present disclosure are summarized below as appendices.

[0149] (Supplementary Note 1) When each type of subject of one or more types of subjects indicated in a preparation time log consisting of a plurality of logs each indicating a pair of a subject and an object is taken as a target subject, there are a plurality of object types corresponding to the target subjects, a frequency vector indicating the occurrence frequency of the object for each time period for each type of object corresponding to the target subjects is created, and first correlation information indicating the correlation between each two frequency vectors corresponding to the target subjects is created, an attribute analysis unit that, when an attribute of each type linked to any of the subjects indicated in the preparation time log is taken as a target attribute and a pair of two objects of each type corresponding to a correlation indicated by any of the first correlation information corresponding to each of the subjects linked to the target attribute is taken as a first target object pair, integrates correlations included in the target correlation group to derive an integrated correlation when a target correlation group consisting of one or more correlations corresponding to the first target object pair among correlations indicated by the first correlation information corresponding to each of the subjects linked to the target attribute satisfies a correlation condition, and creates second correlation information which is information corresponding to the target attribute and indicates each of the derived integrated correlations; and a consistency analysis unit that, when a set of two objects corresponding to each integrated correlation indicated by the second correlation information corresponding to the target attribute is defined as a second target object set, if a consistency condition, which is a condition based on the second correlation information corresponding to the target attribute created in the past, is satisfied for the second target object set, includes information indicating the second target object set in a routine list, which is a list corresponding to the target attribute and is used to reduce logs based on correlations between objects from an operation log consisting of a plurality of logs each indicating a set of a subject and an object.

[0150] (Supplementary Note 2) The routine event identification device described in Supplementary Note 1, wherein the consistency condition is that second correlation information corresponding to the target attribute created in the past indicates a post-integration correlation corresponding to the second target object set.

[0151] (Supplementary Note 3) The routine event identification device according to Supplementary Note 1 or 2 further comprises a filter unit that, when each set of two objects indicated in the routine list corresponding to the target attribute is defined as a third target object set and each entity linked to the target attribute is defined as an excluded target entity, if two objects included in the third target object set co-occur with the excluded target entity in the target logs collected during a target time period among the operation logs, defines each object included in the third target object set as an excluded target object and excludes logs corresponding to both the excluded target entity and the excluded target object from the target logs.

[0152] (Appendix 4) A routine event identification device as described in Appendix 3, wherein the preparation log consists of logs acquired during a time period other than a non-regular time period, and the operation log consists of logs acquired during a time period other than the non-regular time period.

[0153] (Supplementary Note 5) A routine event identification device as described in Supplementary Note 3 or 4, wherein each frequency vector corresponding to the target entity is a vector corresponding to logs collected during a target period divided according to the similarity of trends in business content, and the operational logs are logs collected during the target period.

[0154] (Appendix 6) The routine event identification device according to any one of Appendices 3 to 5 further comprises an update confirmation unit that determines whether to update the routine list corresponding to the target attribute based on the track record of logs being excluded from the operational log using the routine list corresponding to the target attribute.

[0155] (Supplementary Note 7) A routine event identification device according to any one of Supplementary Notes 3 to 6, wherein each frequency vector corresponding to the target entity is a vector corresponding to logs collected during a time period corresponding to a target schedule that is periodically implemented, and the operational logs consist of logs collected during a time period corresponding to the target schedule.

[0156] (Supplementary Note 8) The routine event identification device further includes an integration unit that selects one or more sets of a plurality of integrated correlations based on relevance from the integrated correlations indicated in the routine list corresponding to the target attribute, sets of the selected plurality of integrated correlations as a target correlation set, and creates one or more integrated object groups consisting of two or more objects corresponding to the target correlation set by integrating the plurality of integrated correlations included in the target correlation set, and creates an integrated routine list corresponding to the target attribute by deleting each set of two objects corresponding to the target correlation set from the routine list corresponding to the target attribute and adding one or more integrated object groups corresponding to the target correlation set to the routine list corresponding to the target attribute. a filter unit that, when each integrated object group indicated in the integrated routine list corresponding to the target attribute is defined as a target integrated object group and each entity linked to the target attribute is defined as an excluded target entity, defines each object included in the target integrated object group as an excluded target object if all objects included in the target integrated object group co-occur with the excluded target entity in the target log collected during a target time period among the operation logs, and excludes logs corresponding to both the excluded target entity and the excluded target object from the target log.

[0157] (Supplementary Note 9) The second correlation information corresponding to the target attribute indicates a correlation value corresponding to each integrated correlation, and the routine event identification device further includes: a feedback unit that creates fed-back correlation information corresponding to the target attribute by correcting each correlation value indicated by the created second correlation information corresponding to the target attribute based on second correlation information corresponding to the target attribute that was created in the past, and the consistency condition is that in the fed-back correlation information corresponding to the target attribute, the correlation value corresponding to the second target object set is greater than or equal to a correlation threshold.

[0158] (Supplementary Note 10) The routine event identification device according to Supplementary Note 1 or 2 further comprises an aggregation unit that, when each pair of two objects indicated in a routine list corresponding to the target attribute is defined as a third target object pair and each entity linked to the target attribute is defined as an excluded target entity, if two objects included in the third target object pair co-occur for the excluded target entity in a target log collected during a target time period among the operation logs, creates an aggregated log by aggregating logs corresponding to both the excluded target entity and each object included in the third target object pair in the target log, excludes logs corresponding to both the excluded target entity and each object included in the third target object pair from the target log, and adds each aggregated log created for the target log to the target log.

[0159] 11 Processor, 12 Storage device, 18 Processing circuit, 100 Routine event identification device, 110 Event creation unit, 120 Frequency calculation unit, 130 Correlation calculation unit, 140 Attribute analysis unit, 150 Consistency analysis unit, 151 Routine list, 160 Filter unit, 191 Time zone information DB, 192 Subject / object information DB, 193 Attribute information DB, 194 Correlation information DB, 210 Seasonal division unit, 291 Seasonal information DB, 310 Integration unit, 311 Integrated routine list, 410 Update confirmation unit, 510 Feedback unit, 610 Schedule information analysis unit, 710 Aggregation unit.

Claims

1. When each type of subject of one or more types of subjects indicated in a preparation log consisting of multiple logs each indicating a pair of a subject and an object is taken as a target subject, there are multiple types of objects corresponding to the target subjects, a frequency vector indicating the frequency of occurrence of objects for each time period for each type of object corresponding to the target subjects is created, and first correlation information indicating the correlation between each two frequency vectors corresponding to the target subjects is created, an attribute analysis unit that, when an attribute of each type associated with any of the subjects indicated in the preparation log is taken as a target attribute and a pair of two objects of each type corresponding to a correlation indicated by any of the first correlation information corresponding to each subject associated with the target attribute is taken as a first target object pair, integrates correlations included in the target correlation group to derive an integrated correlation when a target correlation group consisting of one or more correlations corresponding to the first target object pair among the correlations indicated by the first correlation information corresponding to each subject associated with the target attribute satisfies a correlation condition, and creates second correlation information which is information corresponding to the target attribute and indicates each derived integrated correlation; and a consistency analysis unit that, when a set of two objects corresponding to each integrated correlation indicated by the second correlation information corresponding to the target attribute is defined as a second target object set, if a consistency condition, which is a condition based on the second correlation information corresponding to the target attribute created in the past, is satisfied for the second target object set, includes information indicating the second target object set in a routine list, which is a list corresponding to the target attribute and is used to reduce logs based on correlations between objects from an operation log consisting of a plurality of logs each indicating a set of a subject and an object.

2. The routine event identification device of claim 1, wherein the consistency condition is that second correlation information corresponding to the target attribute previously created indicates a post-integration correlation corresponding to the second target object set.

3. The routine event identification device according to claim 1 or 2 further comprises a filter unit which, when each pair of two objects indicated in the routine list corresponding to the target attribute is defined as a third target object pair and each entity linked to the target attribute is defined as an excluded target entity, sets each object included in the third target object pair as an excluded target object if two objects included in the third target object pair co-occur with the excluded target entity in the target logs collected during a target time period among the operation logs, and excludes logs corresponding to both the excluded target entity and the excluded target object from the target logs.

4. A routine event identification device as described in claim 3, wherein the preparation logs consist of logs acquired during time periods other than non-regular time periods, and the operation logs consist of logs acquired during time periods other than the non-regular time periods.

5. A routine event identification device as described in claim 3 or 4, wherein each frequency vector corresponding to the target entity is a vector corresponding to logs collected during a target period divided according to the similarity of business content trends, and the operational logs are logs collected during the target period.

6. The routine event identification device according to any one of claims 3 to 5, further comprising an update confirmation unit that determines whether or not to update the routine list corresponding to the target attribute based on the track record of logs being excluded from the operational log using the routine list corresponding to the target attribute.

7. A routine event identification device as described in any one of claims 3 to 6, wherein each frequency vector corresponding to the target entity is a vector corresponding to logs collected during a time period corresponding to a target schedule that is periodically implemented, and the operational logs consist of logs collected during a time period corresponding to the target schedule.

8. The routine event identification device further includes an integration unit that selects one or more sets of integrated correlations based on relevance from the integrated correlations indicated in the routine list corresponding to the target attribute, sets of the selected integrated correlations as target correlation sets, and creates one or more integrated object groups consisting of two or more objects corresponding to the target correlation set by integrating the integrated correlations included in the target correlation set, and creates an integrated routine list corresponding to the target attribute by deleting each pair of objects corresponding to the target correlation set from the routine list corresponding to the target attribute and adding one or more integrated object groups corresponding to the target correlation set to the routine list corresponding to the target attribute.

3. The routine event identification device of claim 1, further comprising: a filter unit that, when each integrated object group indicated in the integrated routine list corresponding to the target attribute is defined as a target integrated object group and each entity linked to the target attribute is defined as an excluded target entity, if all objects included in the target integrated object group co-occur with the excluded target entity in the target logs collected during a target time period among the operation logs, defines each object included in the target integrated object group as an excluded target object and excludes logs corresponding to both the excluded target entity and the excluded target object from the target logs.

9. The routine event identification device of claim 1, wherein the second correlation information corresponding to the target attribute indicates a correlation value corresponding to each integrated correlation, and the routine event identification device further comprises: a feedback unit that creates fed-back correlation information corresponding to the target attribute by correcting each correlation value indicated in the created second correlation information corresponding to the target attribute based on second correlation information corresponding to the target attribute that was created in the past, and the consistency condition is that in the fed-back correlation information corresponding to the target attribute, the correlation value corresponding to the second target object set is greater than or equal to a correlation threshold.

10. The routine event identification device according to claim 1 or 2 further comprises an aggregation unit that, when each pair of two objects indicated in the routine list corresponding to the target attribute is defined as a third target object pair and each entity linked to the target attribute is defined as an excluded target entity, creates an aggregated log by aggregating logs corresponding to both the excluded target entity and each object included in the third target object pair in the target log when two objects included in the third target object pair co-occur for the excluded target entity in the target log collected during a target time period among the operation logs, excludes logs corresponding to both the excluded target entity and each object included in the third target object pair from the target log, and adds each aggregated log created for the target log to the target log.

11. When a subject of each type of one or more subjects indicated in a preparation log consisting of multiple logs each indicating a pair of a subject and an object is taken as a target subject, there are multiple object types corresponding to the target subjects, a frequency vector indicating the frequency of object occurrence per time period is created for each object type corresponding to the target subjects, and first correlation information indicating the correlation between each two frequency vectors corresponding to the target subjects is created, a computer takes an attribute of each type associated with any of the subjects indicated in the preparation log as a target attribute, and a pair of two objects of each type corresponding to a correlation indicated by any of the first correlation information corresponding to each subject associated with the target attribute as a first target object pair, and when a target correlation group consisting of one or more correlations corresponding to the first target object pair among the correlations indicated by the first correlation information corresponding to each subject associated with the target attribute satisfies a correlation condition, integrates correlations included in the target correlation group to derive an integrated correlation, and creates second correlation information which is information corresponding to the target attribute and indicates each derived integrated correlation, A method for identifying routine events, in which when the computer defines a pair of two objects corresponding to each integrated correlation indicated by the second correlation information corresponding to the target attribute as a second target object pair, if a consistency condition, which is a condition based on the second correlation information corresponding to the target attribute created in the past, is satisfied for the second target object pair, the computer includes information indicating the second target object pair in a routine list, which is a list corresponding to the target attribute and is used to reduce logs based on correlations between objects from an operational log consisting of multiple logs each indicating a pair of a subject and an object.

12. When each type of subject of one or more types of subjects indicated in a preparation log consisting of multiple logs each indicating a pair of a subject and an object is taken as a target subject, there are multiple object types corresponding to the target subjects, a frequency vector indicating the frequency of object occurrence for each time period for each type of object corresponding to the target subjects is created, and first correlation information indicating the correlation between each two frequency vectors corresponding to the target subjects is created, an attribute analysis process is performed to derive an integrated correlation by integrating correlations included in the target correlation group when a target correlation group consisting of one or more correlations corresponding to the first target object group among the correlations indicated by the first correlation information corresponding to each subject associated with the target attribute satisfies a correlation condition, and to create second correlation information which is information corresponding to the target attribute and indicates each integrated correlation derived; and a consistency analysis process for including information indicating the second target object pair in a routine list, which is a list corresponding to the target attribute and is used to reduce logs based on correlations between objects from an operation log consisting of a plurality of logs each indicating a pair of a subject and an object, when the second target object pair is a pair of two objects corresponding to each integrated correlation indicated by the second correlation information corresponding to the target attribute and a consistency condition, which is a condition based on the second correlation information corresponding to the target attribute created in the past, is satisfied for the second target object pair.

Images