Document processing device

Abstract

This document processing device is provided with a first and second vectorization unit, a first and second clustering unit, a first and second time series data generation unit, a similarity evaluation unit, and a mapping unit. The first and second vectorization units vectorize known documents and event logs, respectively. The first and second clustering units perform clustering on the basis of similarity in the number of appearance of respective words included in the known documents and in sentences of the event logs, respectively. The first and second time series data generation units generate first and second time series data on the basis of publication dates of the known documents and occurrence dates of the events belonging to the clusters. The similarity evaluation unit evaluates the similarities between respective first time series data items and respective second time series data items, and maps a first cluster and a second cluster that are highly similar. The mapping unit maps the known documents and the event logs in the mapped first cluster and second cluster.

Description

Document Processing Device

[0001] The embodiments relate to a document processing device.

[0002] The notification document is a document that describes information that should be made known to users. The notification document may include, for example, an update notification document that notifies users to update their software. With the increase in cyber attacks in recent years, the importance of software update work related to information security has increased, and the importance of notification documents that notify users of such software update work has also increased.

[0003] Here, it is also important to check whether the user who received the notification document actually implements the content notified by the notification document. For example, in the case of a software update, it is possible to identify from the software event log that the software has actually been updated. By associating the notification document with the event log, it is possible to manage whether the user who received the notification document actually implements the content notified by the notification document.

[0004] Hiroki Nakanishi et al., "Update Notification Filtering Method for Information Security," Institute of Electronics, Information and Communication Engineers, 2024 General Conference, B-14-11 (February 26, 2024)

[0005] For example, when associating an update notification document with an event log, the association can be easily achieved if the document contains the name of the software to be updated, etc. However, the update notification document and the event log may not directly describe the software name, etc., using named entities. Furthermore, even when the same software is represented, different named entities may be used. Even when the corresponding content in the notification document and the event log is described using different expressions, it is desirable to be able to associate the notification document with the event log.

[0006] The embodiment provides a document processing device that can associate a public document with an event log even when the corresponding contents in the public document and the event log are written using different expressions.

[0007] A document processing device according to one embodiment includes a first vectorization unit, a second vectorization unit, a first clustering unit, a second clustering unit, a first time-series data generation unit, a second time-series data generation unit, a similarity evaluation unit, and a correspondence unit. The first vectorization unit vectorizes each of a plurality of publicly known documents describing content to be made public. The second vectorization unit vectorizes each of a plurality of event logs describing logs of events related to content made public by each of the publicly known documents. The first clustering unit clusters the publicly known documents into a plurality of first clusters based on similarities in the number of occurrences of each word included in the text of the publicly known documents vectorized by the first vectorization unit. The second clustering unit clusters the event logs into a plurality of second clusters based on similarities in the number of occurrences of each word included in the text of the event logs vectorized by the second vectorization unit. The first time-series data generation unit generates first time-series data based on publication dates of the publicly known documents belonging to each of the first clusters. The second time-series data generation unit generates second time-series data based on the occurrence dates of events in the event logs belonging to each second cluster. The similarity evaluation unit evaluates the similarity between each first time-series data and each second time-series data, and associates first clusters and second clusters that have high similarity. The association unit associates publicly known documents with event logs in the associated first and second clusters.

[0008] According to the embodiment, a document processing device is provided that can associate a public document with an event log even if the corresponding contents in the public document and the event log are written using different expressions.

[0009] FIG. 1 is a block diagram showing the configuration of a document processing apparatus according to an embodiment. FIG. 2A is a conceptual diagram for explaining vectorization of a sentence based on the number of occurrences of a word. FIG. 2B is a conceptual diagram for explaining vectorization of a sentence based on the number of occurrences of a word. FIG. 3A is a conceptual diagram for explaining clustering in an embodiment. FIG. 3B is a conceptual diagram for explaining clustering in an embodiment. FIG. 4A is a conceptual diagram for explaining generation of time-series data in an embodiment. FIG. 4B is a conceptual diagram for explaining generation of time-series data in an embodiment. FIG. 5 is a flowchart showing the operation of a document processing apparatus according to an embodiment. FIG. 6A is a diagram showing an example of a known document. FIG. 6B is a diagram showing an example of an event log. FIG. 7 is a block diagram showing an example of the hardware configuration of a document processing apparatus.

[0010] Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a block diagram showing the configuration of a document processing device according to an embodiment. The document processing device according to the embodiment can be applied to, for example, a computer device that manages the configuration of an IT system. The IT system can include, but is not limited to, computer systems such as a personnel management system and a time attendance management system, as well as network management systems.

[0011] The document processing device according to the embodiment associates, for example, a notification document with an event log. The notification document according to the embodiment is a document that describes content that should be notified to the user. The notification document is, for example, an update notification document that notifies the user to perform a software update. The notification document can be data in any format that includes notification text, such as data in the body of an email or document data attached as an attachment. In contrast, the event log is a log of events related to the content notified by the notification document. For example, if the notification document is an update notification document, the event log can be a log of software updates.

[0012] The document processing device 1 includes vectorization units 11a and 11b, clustering units 12a and 12b, time-series data generation units 13a and 13b, a similarity evaluation unit 14, a correlation unit 15, a storage unit 16, and an output unit 17.

[0013] The vectorization unit 11a vectorizes the sentences included in each input publicly known document D based on the number of occurrences of words. The vectorization unit 11b vectorizes the sentences of events included in each input event log L based on the number of occurrences of words. Vectorization based on the number of occurrences of words can be performed using a method such as BOW (Bag Of Words).

[0014] 2A and 2B are conceptual diagrams for explaining the vectorization of a sentence based on the number of occurrences of words. Here, Fig. 2A is a conceptual diagram of vectorization of a sentence of a publicly known document, and Fig. 2B is a conceptual diagram of vectorization of a sentence of an event.

[0015] For example, the vectorization unit 11a divides the text of the well-known document D into word units using morphological analysis and counts the number of occurrences of each divided word. Then, the vectorization unit 11a generates a vector whose elements are the number of occurrences of each word. Furthermore, the vectorization unit 11a associates the word occurrence count vector of the well-known document D with the publication date of the well-known document D. In other words, the vectorization unit 11a generates data for each well-known document D having two attributes: a vector of the number of occurrences of words and the publication date of the well-known document. The publication date of the well-known document D may also include the publication time. In the following description, the word occurrence count vector for the well-known document D generated by the vectorization unit 11a may be referred to as a first vector.

[0016] Here, one publicly known document D usually contains a sentence indicating one well-known content. However, it is also possible that the publicly known document D contains sentences indicating a plurality of different well-known contents. When the publicly known document D contains sentences indicating a plurality of different well-known contents, the vectorization unit 11a vectorizes the sentences indicating each well-known content as separate entities.

[0017] For example, the vectorization unit 11b divides the sentences in each event log L into word units using morphological analysis and counts the number of occurrences of each divided word. Then, the vectorization unit 11b generates a vector whose elements are the number of occurrences of each word. Furthermore, the vectorization unit 11b associates the word occurrence count vector of an event in the event log L with the corresponding date of occurrence of the event. That is, the vectorization unit 11b generates data for each event log L having two attributes: a vector of the number of occurrences of the word and the date of occurrence of the event. The date of occurrence of the event may also include the time of occurrence. In the following description, the word occurrence count vector for the event log L generated by the vectorization unit 11b may be referred to as a second vector.

[0018] Here, the words (1), (2), ... shown in Figure 2A and the words (A), (B), ... shown in Figure 2B simply indicate that they are words extracted from different sentences, but may contain the same word. In other words, the word (1) and the word (A) may be the same word or different words.

[0019] The clustering unit 12a clusters the well-known documents D based on the similarity of the first vectors obtained for each of the well-known documents D. The clustering unit 12b clusters the event logs L based on the similarity of the second vectors obtained for each of the event logs L.

[0020] 3A and 3B are conceptual diagrams for explaining clustering in an embodiment, where Fig. 3A is a conceptual diagram of clustering based on a first vector, and Fig. 3B is a conceptual diagram of clustering based on a second vector.

[0021] The clustering unit 12a classifies well-known document D into clusters based on the similarity between the first vectors, which is obtained by, for example, calculating the Euclidean distance between the first vectors or calculating the cosine similarity. In FIG. 3A , well-known documents 1, 3, and 5 have similar word occurrence counts, and well-known documents 2 and 4 have similar word occurrence counts. Therefore, the clustering unit 12a classifies well-known documents 1, 3, and 5 into one cluster and well-known documents 2 and 4 into another cluster. The cluster labels may be assigned arbitrarily as long as they can be identified. FIG. 3A shows an example in which well-known documents 1, 3, and 5 are classified into cluster (1), and well-known documents 2 and 4 are classified into cluster (2). Hereinafter, each cluster clustered by the clustering unit 12a may be referred to as a first cluster.

[0022] The clustering unit 12b classifies the event log L into clusters based on the similarity between the second vectors, which is obtained by, for example, calculating the Euclidean distance between the respective second vectors or calculating the cosine similarity. In FIG. 3B , the number of occurrences of words in event logs 1, 3, and 5 is similar, and the number of occurrences of words in event logs 2 and 4 is similar. Therefore, the clustering unit 12b classifies event logs 1, 3, and 5 into one cluster and event logs 2 and 4 into another cluster. The cluster labels may be assigned arbitrarily as long as they can be identified. In FIG. 3B , an example is shown in which event logs 1, 3, and 5 are classified into cluster (A), and well-known documents 2 and 4 are classified into cluster (B). Hereinafter, each cluster clustered by the clustering unit 12b may be referred to as a second cluster.

[0023] The time-series data generating unit 13a generates time-series data from the publication date of each publicly known document belonging to each first cluster, and the time-series data generating unit 13b generates time-series data from the occurrence date of each event in the event log belonging to each second cluster.

[0024] 4A and 4B are conceptual diagrams for explaining generation of time series data in an embodiment. Here, FIG. 4A is a conceptual diagram of generation of time series data for a publicly known document. Also, FIG. 4B is a conceptual diagram of generation of time series data for an event log. Here, in FIG. 4A, the time interval between t1 and t14 is, for example, one day, but is not limited to one day. Similarly, in FIG. 4B, the time interval between t1 and t14 is, for example, one day, but is not limited to one day. On the other hand, it is desirable that the time intervals for the publicly known document and the event log are the same.

[0025] For example, for each first cluster, the time-series data generating unit 13a sorts the publication dates of the publicly known documents belonging to the first cluster in chronological order, regardless of the type of publicly known document. Then, for each first cluster, the time-series data generating unit 13a generates time-series data in which elements for days with a publication date are set to 1 and elements for days without a publication date are set to 0. Here, the publication date criterion for generating the time-series data may be determined arbitrarily. The publication date criterion may be, for example, the date on which processing by the document processing device 1 was performed, or a date specified by the user.

[0026] In the example of FIG. 4A , cluster (1) includes four different publicly known documents with publication dates t2, t4, t9, and t12. Therefore, the time series data for cluster (1) is data with elements 0101000010.... Similarly, cluster (2) includes three different publicly known documents with publication dates t4, t7, and t10. Therefore, the time series data for cluster (2) is data with elements 0001001001.... The time series data generator 13a generates time series data for other clusters in a similar manner. Hereinafter, the time series data generated by the time series data generator 13a may be referred to as first time series data.

[0027] For example, for each second cluster, the time-series data generator 13b sorts the occurrence dates of events in each event log belonging to the second cluster in chronological order without distinguishing between events. Then, for each second cluster, the time-series data generator 13b generates time-series data in which elements for days on which an occurrence date exists are set to 1 and elements for days on which no occurrence date exists are set to 0. Here, the criteria for the occurrence dates when generating the time-series data may be determined arbitrarily as long as they are the same as the criteria for the publication dates of the publicly known documents.

[0028] In the example of FIG. 4B , cluster (A) includes four different event logs having occurrence dates t5, t9, t12, and t14. Therefore, the time series data for cluster (A) is data with elements of 0000100010.... Similarly, cluster (B) includes three different event logs having occurrence dates t7, t9, and t13. Therefore, the time series data for cluster (B) is data with elements of 0000001010.... The time series data generator 13b generates time series data for the other clusters in a similar manner. Hereinafter, the time series data generated by the time series data generator 13b may be referred to as second time series data.

[0029] The time series data generated as shown in Figure 4A is data representing the publication dates of publicly known documents in which the number of occurrences of words is similar, in chronological order. Similarly, the time series data generated as shown in Figure 4B is data representing the occurrence dates of event logs in which the number of occurrences of words is similar, in chronological order. On the other hand, as described above, the publication dates and occurrence dates may be represented as dates and times. When the publication dates and occurrence dates are represented as dates and times, the time series data may be data representing the dates and times at which each publicly known document or event log appears, in chronological order.

[0030] The similarity evaluation unit 14 evaluates the similarity between the first time series data generated for each first cluster and the second time series data generated for each second cluster. Then, the similarity evaluation unit 14 associates the first cluster and the second cluster with each other, where the first time series data and the second time series data have a high similarity. The similarity s of the time series data can be calculated, for example, based on the following formula (1): x in formula (1) ｉ y(n) is the n-th element of the first time series data generated for the i-th (i=1, 2, ...) first cluster. ｊ (n) is the nth element of the second time series data generated for the jth (j = 1, 2, ...) second cluster. m is the number of elements of the first time series data and the second time series data. k is a value that minimizes s in equation (1) when (i, j) is fixed and k is varied within the range of 0≦k≦m. As will be explained in detail later, software updates are performed by users who receive an update notification document. Therefore, the software update is always actually performed after the update notification document is received. k is a value used to adjust for the discrepancy between the publication date of such a notification document and the occurrence date of an event.

[0031] In formula (1), s is x ｉ (n) and y ｊ The higher the similarity of (n), the smaller the value. ｉ (n) and y ｊ The high similarity of (n) means that x ｉ The time-series appearance tendency of the word corresponding to (n) in known documents and y ｊ This means that the time-series appearance trends in the event log of a word corresponding to (n) are similar. The similarity evaluation unit 14 calculates s for all combinations of (i, j) with k set as a fixed value based on equation (1) in which (i, j) is fixed. The similarity evaluation unit 14 then associates the first cluster with the second cluster based on the calculation result of s. Specifically, the similarity evaluation unit 14 associates the first cluster with the second cluster corresponding to the combination of (i, j) for which the value of similarity s is equal to or less than a threshold. If multiple second clusters can be associated with one first cluster or multiple first clusters can be associated with one second cluster, the similarity evaluation unit 14 associates the first cluster with the second cluster corresponding to the combination of (i, j) with the smallest value of similarity s. Note that if there is no combination of (i, j) for which the value of similarity s is equal to or less than the threshold, the first cluster is not associated with the second cluster.

[0032] The association unit 15 associates the well-known document D with the event log L in the first cluster and the second cluster associated by the similarity evaluation unit 14. Among the well-known document D belonging to the first cluster and the event log L belonging to the second cluster that have been evaluated as corresponding to each other, the association unit 15 associates the well-known document D and the event log L that have an earlier publication date and have the smallest difference between the publication date and the occurrence date. The association unit 15 then stores in the storage unit 16 association data C indicating each combination of the well-known document D and the event log L. The association unit 15 then stores in the storage unit 16 association data C indicating each combination of the well-known document D and the event log L.

[0033] The storage unit 16 stores the correspondence data C generated by the association unit 15. The storage unit 16 may also store a public notice D and an event log L.

[0034] The output unit 17 performs various output processes based on the information stored in the storage unit 16. For example, the output unit 17 displays a list showing the correspondence between publicly known documents D and event logs L on a display based on the correspondence data C. Alternatively, the output unit 17 transmits the correspondence data C to a document filtering device or the like that filters the publicly known documents D. Using the correspondence data C, the document filtering device can associate publicly known documents with event logs.

[0035] Next, the operation of the document processing device 1 will be described. Fig. 5 is a flowchart showing the operation of the document processing device 1 according to the embodiment. The operation of Fig. 5 is performed every certain period, such as one day, one week, one month, or one year. Alternatively, the operation of Fig. 5 may be performed in response to an instruction from a user. The user here may be an administrator of the IT system, or a user of an individual terminal that constitutes the IT system.

[0036] In step S1, the document processing device 1 acquires a publicly known document D and an event log L. In step S2, the document processing device 1 stores the publicly known document D and the event log L in the storage unit 16. The publicly known document D and the event log L acquired by the document processing device 1 may be stored in a predetermined storage unit of the IT system, or may be input by a user. Furthermore, the publicly known document D and the event log L acquired by the document processing device 1 in step S1 may be stored in the storage unit 16. Furthermore, the publicly known document D and the event log L for which corresponding data C has already been created may not be the subject of acquisition. Furthermore, the process of storing the publicly known document D and the event log L in the storage unit 16 in step S2 may be omitted.

[0037] In step S3, the vectorization unit 11a vectorizes the text of the acquired publicly known document D. The vectorization unit 11b vectorizes the text of the acquired event log L.

[0038] In step S4, the clustering unit 12a clusters the well-known documents D based on the first vectors for each of the well-known documents D obtained by the vectorization unit 11a. The clustering unit 12b clusters the event logs L based on the second vectors for each of the event logs L obtained by the vectorization unit 11b.

[0039] In step S5, the time-series data generator 13a generates first time-series data for each of the first clusters obtained by the clustering unit 12a, and the time-series data generator 13b generates second time-series data for each of the second clusters obtained by the clustering unit 12b.

[0040] In step S6, the similarity evaluation unit 14 evaluates the similarity between the first time series data generated for each first cluster and the second time series data generated for each second cluster, and associates the first clusters with the second clusters.

[0041] In step S7, the association unit 15 associates the public-known document D with the event log L based on the association result between the first cluster and the second cluster obtained by the similarity evaluation unit 14.

[0042] In step S8, the association unit 15 generates association data C based on the result of association between the public-known document D and the event log L, and stores the generated association data C in the storage unit 16.

[0043] In step S9, the output unit 17 outputs the correspondence data C stored in the storage unit 16. Then, the process of Fig. 5 ends. The output unit 17 displays, for example, a list showing the correspondence between the publicly known document D and the event log L based on the correspondence data C.

[0044] The operation of FIG. 5 will be described in detail below. FIG. 6A is a diagram showing an example of a publicly known document D. FIG. 6B is a diagram showing an example of an event log L. An example of the publicly known document D is a list of titles of publicly known documents by publication date. An example of the event log L is a text listing the contents of events by occurrence date. Here, "X" and "Y" shown in FIG. 6A and "α" and "β" shown in FIG. 6B are both named entities representing specific names.

[0045] First, the text of the public document D and the event log L is vectorized. As described above, the text is vectorized based on, for example, the BOW. Then, the publication date of the public document is associated with the first vector. Similarly, the occurrence date of the event is associated with the second vector.

[0046] Next, clustering of the well-known documents D is performed based on the first vectors generated for each of the well-known documents D. Furthermore, clustering of the event logs L is performed based on the second vectors generated for each of the event logs L. In the example shown in FIG. 6A , as clustering based on the first vectors, the well-known documents 1 dated November 5, 2023, 3 dated November 15, 2023, and 5 dated November 25, 2023 are all the same text, and therefore have similar word occurrence counts, i.e., similar first vectors. Therefore, well-known documents 1, 3, and 5 are classified into cluster (1). Similarly, in the example shown in FIG. 6A , the well-known documents 2 dated November 10, 2023 and 4 dated November 20, 2023 are all the same text, and therefore have similar word occurrence counts, i.e., similar first vectors. Therefore, well-known documents 2 and 4 are classified into cluster (2). In addition, in the example of clustering based on the second vector shown in FIG. 6B, event log 1 dated November 6, 2023, event log 3 dated November 16, 2023, and event log 5 dated November 26, 2023 contain the same sentence, so the number of occurrences of words, i.e., the second vectors, are similar. Therefore, event logs 1, 3, and 5 are classified into cluster (A). Similarly, in the example shown in FIG. 6B, event log 2 dated November 11, 2023 and event log 4 dated November 21, 2023 contain the same sentence, so the number of occurrences of words, i.e., the second vectors, are similar. Therefore, event logs 2 and 4 are classified into cluster (B).

[0047] Next, first time series data is generated based on the publication dates of the publicly known documents belonging to each first cluster. Second time series data is generated based on the occurrence dates of the events belonging to each second cluster. For example, to explain the generation of first time series data for clusters (1) and (2), cluster (1) includes publicly known document 1, published on November 5th, publicly known document 3, published on November 15th, and publicly known document 5, published on November 25th. Therefore, the first time series data x for cluster (1) is １ For example, if (n) is data at one-day intervals based on November 5th, then x １(n) = (1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0). Similarly, cluster (2) includes publicly known document 2 published on November 10th and publicly known document 4 published on November 20th. Therefore, the first time series data x ２ (n) is x ２ (n) = (0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0). Further, as an example of the generation of second time series data, the generation of second time series data for clusters (A) and (B) will be described. Cluster (A) includes event log 1 with the occurrence date of November 6th, event log 3 with the occurrence date of November 16th, and event log 5 with the occurrence date of November 26th. Therefore, the second time series data Y １ (n) is Y １ (n) = (0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1). Similarly, cluster (B) includes event log 2 with an occurrence date of November 11th and event log 4 with an occurrence date of November 21st. Therefore, the second time series data Y ２ (n) is Y ２ (n) = (0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0).

[0048] Next, the similarity between the first time series data and the second time series data is evaluated based on Equation (1). For example, if the first time series data x １ (n) and the second time series data y １ To explain the similarity with (n), first, the first time series data x １ (n) and the second time series data y １The sum of the differences of each element of (n) is calculated. In the example, when k is 1, s(1,A) has the minimum value of 0. A similar calculation is performed for other combinations with k fixed at 1. As a result, s(1,B) = 5, s(2,A) = 5, and s(2,B) = 0 are obtained. From these, the cluster of (1) is associated with the cluster of (A), and the cluster of (2) is associated with the cluster of (B).

[0049] Next, for each associated cluster, a well-known document D is associated with an event log L. As described above, well-known documents 1, 3, and 5 belong to cluster (1), and event logs 1, 3, and 5 belong to cluster (A) associated with cluster (1). Also, well-known documents 2 and 4 belong to cluster (2), and event logs 2 and 4 belong to cluster (B) associated with cluster (2).

[0050] Because update notification documents are documents that inform users that they should update their software, they are likely to contain at least a description of the name or other information identifying the software being updated. On the other hand, since all that is required is for users to recognize the software being updated, it is possible that the information identifying the software differs between the update notification document and the event log. However, because update notification documents and the accompanying event logs represent similar content, there is a high possibility that the words that appear correspond to each other. Furthermore, there is a temporal relationship in which software updates are always performed after the update notification document is received. Furthermore, the interval between the issuance of an update notification document and the implementation of the corresponding update tends to be roughly similar. In other words, it is likely that the time intervals that appear in corresponding update notification documents and event logs will also tend to be similar.

[0051] Therefore, in the embodiment, clusters of publicly known documents and clusters of event logs having similar time-series data are associated with each other, and then publicly known document D and event log L are associated with each other, where the published date comes first and the difference between the published date and the occurrence date is the smallest. In the example, publicly known document 1 and event log 1 are associated, publicly known document 3 and event log 3 are associated, and publicly known document 5 and event log 5 are associated. Similarly, publicly known document 2 and event log 2 are associated, and publicly known document 4 and event log 4 are associated. This is because, after an updated publicly known document is issued, there is a high possibility that the next corresponding event log will be an event log resulting from the update of this updated publicly known document.

[0052] If the number of public documents and event logs belonging to a cluster does not match, some documents will not be able to be matched. For example, if the number of public documents is greater than the number of event logs, some public documents will not be able to be matched. This means, for example, that a public document was issued but not updated.

[0053] In addition, in the example, the correspondence between the notice and the event log is performed based on the sentence in the title of the notice and the sentence in the event log. However, it goes without saying that the correspondence between the notice and the event log may also be performed based on the sentence in the main text of the notice.

[0054] Fig. 7 is a block diagram showing an example of the hardware configuration of the document processing device 1. As shown in Fig. 7, the document processing device 1 includes, for example, a processor 101, a read only memory (ROM) 102, a random access memory (RAM) 103, a communication module 104, a display 105, and a storage 106. The document processing device 1 may be, for example, a terminal device such as a smartphone or a personal computer (PC). Alternatively, the document processing device 1 may be a device built on a cloud environment.

[0055] The processor 101 is a processing circuit that controls the overall operation of the document processing device 1. The processor 101 operates as vectorization units 11a and 11b, clustering units 12a and 12b, time-series data generation units 13a and 13b, a similarity evaluation unit 14, an association unit 15, and an output unit 17, for example, by executing a document processing program stored in the storage 106. The processor 101 is, for example, a CPU. The processor 101 may be an MPU, a GPU, an ASIC, an FPGA, or the like. The processor 101 may be a single CPU or the like, or multiple CPUs or the like.

[0056] The ROM 102 is a non-volatile semiconductor memory that stores a startup program and various setting values ​​for the document processing device 1. The RAM 103 is a volatile memory that is used, for example, as a working memory when the processor 101 performs processing.

[0057] The communication module 104 is a circuit having an interface for communication between the document processing device 1 and an external device. The communication module 104 may be a wireless communication module or a wired communication module.

[0058] The display 105 is, for example, a liquid crystal display (LCD) or an electroluminescence (EL) display, and displays a graphical user interface (GUI) corresponding to various applications such as an email application.

[0059] The storage 106 is a non-volatile storage device such as a hard disk or flash memory. The storage 106 stores various programs such as the operating system (OS) of the document processing device 1 and a document processing program. The storage 106 can also function as the storage unit 16. In this case, the storage 106 stores the publicly known document D, the event log L, and the corresponding data C. The publicly known document D, the event log L, and the corresponding data C may be stored in a storage device such as a server external to the document processing device 1. Furthermore, the document processing program may be downloaded to the storage 106 via a network.

[0060] As described above, according to the embodiment, well-known documents are clustered based on the similarity in the frequency of word appearances in the well-known documents, and event logs are clustered based on the similarity in the frequency of word appearances in the event logs. Furthermore, first time series data is generated based on the publication dates of well-known documents belonging to each first cluster, and second time series data is generated based on the occurrence dates of events belonging to each second cluster. Then, clusters of the well-known documents are associated with clusters of the event logs based on the similarity between the first time series data and the second time series data. Then, based on the association result between the clusters of the well-known documents and the clusters of the event logs, the well-known documents and the event logs can be associated. This allows the well-known documents and the event logs to be associated even if the same content is written using different expressions in the well-known documents and the event logs.

[0061] In the embodiment, the public document to be associated is an update public document. However, the public document to be associated is not limited to an update public document. In other words, as long as the change in status due to the content notified by the public document is stored as an event log, the technology of the embodiment can be applied even when the public document to be associated is something other than an update public document. For example, the public document to be associated may be a public document notifying the user that a software update has been performed, a public document notifying the user that an error has occurred, or the like. In the case of a public document notifying an update or an error, the user will receive the respective public document after the update has actually been performed or after the error has occurred. Therefore, when associating the public document with the event log, public document D and event log L are associated with a combination of documents with later issue dates and with the smallest difference between the issue date and the occurrence date.

[0062] The present invention is not limited to the above-described embodiments, and various modifications can be made in the implementation stage without departing from the spirit of the invention. Furthermore, the embodiments may be implemented in appropriate combinations, in which case the combined effects can be obtained. Furthermore, the above-described embodiments include various inventions, and various inventions can be extracted by combining selected elements from the disclosed elements. For example, if the problem can be solved and the desired effect can be obtained even if some elements are deleted from all elements shown in the embodiments, the configuration from which these elements are deleted can be extracted as an invention.

[0063] REFERENCE SIGNS LIST 1 document processing device 11a, 11b vectorization unit 12a, 12b clustering unit 13a, 13b time series data generation unit 14 similarity evaluation unit 15 association unit 16 storage unit 17 output unit 101 processor 102 ROM 103 RAM 104 communication module 105 display 106 storage

Claims

1. A first vectorization unit that vectorizes each of a plurality of publicly known documents describing content to be made public; a second vectorization unit that vectorizes each of a plurality of event logs describing logs of events related to the content made public by each of the publicly known documents; a first clustering unit that clusters the publicly known documents into a plurality of first clusters based on the similarity in the number of occurrences of each word included in the text of the publicly known documents vectorized by the first vectorization unit; a second clustering unit that clusters the event logs into a plurality of second clusters based on the similarity in the number of occurrences of each word included in the text of the event logs vectorized by the second vectorization unit; a first time series data generation unit that generates first time series data based on the publication dates of the publicly known documents belonging to each of the first clusters; a second time series data generation unit that generates second time series data based on the occurrence dates of events in the event logs belonging to each of the second clusters; and a similarity evaluation unit that evaluates the similarity between each of the first time series data and each of the second time series data and associates the first clusters and the second clusters that have a high similarity. a correlation unit that correlates the publicly known document with the event log in the correlated first cluster and second cluster.

2. The document processing device according to claim 1, wherein the first time series data generation unit, for each of the first clusters, arranges the publication dates of each of the publicly known documents belonging to the first cluster in order, and generates the first time series data in which elements for days for which a publication date exists are set to 1 and elements for days for which a publication date does not exist are set to 0; and the second time series data generation unit, for each of the second clusters, arranges the occurrence dates of events in each of the event logs belonging to the second cluster in order, and generates the second time series data in which elements for days for which an occurrence date exists are set to 1 and elements for days for which an occurrence date does not exist are set to 0.

3. The document processing device according to claim 2, wherein the similarity between the first time series data and the second time series data is calculated based on the sum of the differences between each element of the first time series data and the second time series data.

4. The document processing device according to claim 1, wherein the notification document is an update notification document that notifies the user to update the software, and the event log is a log of the software update.

Images