Information processing device and method

Abstract

An information processing device according to one embodiment comprises: an extraction unit that extracts second events that have occurred in response to a first event that has occurred in a period obtained by extending a period recorded as a period in which the first event has occurred according to an assumed error between the recorded period and a period in which the first event has actually occurred; an evaluation unit that extracts, from among the second events extracted by the extraction unit, the second event that has occurred in response to the first event that has occurred in a period starting from a given timing within the extended period, obtains, on the basis of the result of the extraction, candidates for a rule in which a relationship between the first and second events is determined, and for each of the obtained candidates, obtains an evaluation value of the possibility of occurrence of the second event in response to the occurrence of the first event; and a generation unit that generates a rule in which an appropriate relationship between the first and second events is determined among the rule candidates on the basis of the evaluation value obtained by the evaluation unit.

Description

Information processing device and method

[0001] FIELD Embodiments of the present invention relate to an information processing apparatus and method.

[0002] With the provision of various IT services, the maintenance and management of networks by telecommunications carriers has become important. When the servers or transmission equipment on the network required to provide the services become unavailable due to a malfunction or other reason, alarms indicating an abnormality are issued from various points, such as the network equipment or the servers providing the services.

[0003] The alarms that are issued are collected by a monitoring system. Maintenance personnel must use the collected alarms and the network configuration to analyze where and what kind of fault is occurring and then take action to restore the system.

[0004] However, various alarms are generated depending on the cause of the failure and the type of failed device, and the number of devices generating alarms and the type of alarm also vary depending on the network configuration. Understanding the characteristics of such alarms and identifying the location and cause of the failure requires a vast amount of know-how, and when many alarms are generated, even an experienced technician finds it difficult to instantly identify the cause of the failure. Therefore, it is effective to create rules in advance for alarms generated by failures and to instantly identify the cause and location of the failure when an alarm is generated.

[0005] There are technologies for estimating the cause and location of a failure from messages such as alarms that are generated when a failure occurs on a network (see, for example, Patent Document 1 and Non-Patent Document 1). For example, there is a method for estimating a failure using an If-then rule with an If condition such as "alarm type" for each failure case, but know-how is required to manually set the rule conditions.

[0006] For this reason, automatic rule generation technology has been used, in which alarms that occur when a failure occurs are identified as candidate alarms from recorded information on failure responses, and alarms that are specific to each failure type are automatically extracted from the candidate alarms and adopted as rule conditions.

[0007] Japanese Patent No. 6637854

[0008] Kanai Shunsuke et al.: Network Fault Location Learning Process Using Machine Learning (Transactions of the Institute of Electronics, Information and Communication Engineers, Vol. J104-B, No. 3, pp. 163-174 (2021)).

[0009] The time of occurrence of a fault indicated in the recorded information may be the time when the operator recognized the fault or the time when they began to deal with it, which may result in a discrepancy with the time when the alarm actually occurred. As a result, rules are automatically generated using alarms that occurred at the wrong time. As a result, alarms that should have been adopted are overlooked, reducing the accuracy of the rules.

[0010] This invention has been made in light of the above circumstances, and its purpose is to provide an information processing device and method that can appropriately identify an event depending on the timing of the event's occurrence.

[0011] An information processing device according to one aspect of the present invention includes an extraction unit that extracts second events that occur in response to first events that occurred during a period recorded as a period in which a first event occurred, the period being extended in accordance with an expected error between the period in which the first event actually occurred and the period in which the first event actually occurred; an evaluation unit that extracts, from the second events extracted by the extraction unit, second events that occurred in response to the first event that occurred during a period starting from any timing within the extended period, and based on the results of the extraction, determines candidate rules that define a relationship between the first and second events, and determines, for each of the determined candidates, an evaluation value of the possibility of the second event occurring in response to the occurrence of the first event; and a generation unit that generates, from the candidate rules, rules that define an appropriate relationship between the first and second events, based on the evaluation value determined by the evaluation unit.

[0012] An information processing method according to one aspect of the present invention is a method performed by an information processing device, comprising: an extraction unit of the information processing device extracting a second event that occurred in response to a first event that occurred during a period that was recorded as a period in which a first event occurred, extended in accordance with an expected error between that period and the period in which the first event actually occurred; an evaluation unit of the information processing device extracting, from the second events extracted by the extraction unit, a second event that occurred in response to the first event that occurred during a period starting from any timing within the extended period; based on the results of the extraction, determining candidate rules that define a relationship between the first and second events; and, for each of the determined candidates, determining an evaluation value of the possibility of the second event occurring in response to the occurrence of the first event; and a generation unit of the information processing device generating, from the candidate rules, rules that define an appropriate relationship between the first and second events, based on the evaluation value determined by the evaluation unit.

[0013] According to the present invention, an event can be appropriately identified depending on the timing difference of the occurrence of the event.

[0014] FIG. 1 is a diagram illustrating an application example of an information processing device according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a network configuration according to the first embodiment. FIG. 3 is a diagram illustrating an example of an alarm occurrence situation and a target period according to the first embodiment. FIG. 4 is a diagram illustrating an example of a pattern of a period starting from an arbitrary time point according to the first embodiment. FIG. 5 is a diagram illustrating an example of a calculation result of an evaluation value for each rule according to the first embodiment. FIG. 6 is a diagram illustrating a first example of an event occurrence and an alarm occurrence in a network configuration according to the second embodiment. FIG. 7 is a diagram illustrating a second example of an event occurrence and an alarm occurrence in a network configuration according to the second embodiment. FIG. 8 is a diagram illustrating a first example of an alarm occurrence situation and a target period according to the second embodiment. FIG. 9 is a diagram illustrating a second example of an alarm occurrence situation and a target period according to the second embodiment. FIG. 10 is a diagram illustrating a first example of a pattern of a period starting from an arbitrary time point according to the second embodiment. FIG. 11 is a diagram illustrating a second example of a pattern of a period starting from an arbitrary time point according to the second embodiment. FIG. 12 is a diagram illustrating a first example of a calculation result of an evaluation value for each rule according to the second embodiment. Fig. 13 is a diagram showing a second example of the calculation results of the evaluation values ​​for each rule according to the second embodiment. Fig. 14 is a block diagram showing an example of the hardware configuration of an information processing device according to an embodiment of the present invention.

[0015]

[0023] An embodiment of the present invention will now be described. Fig. 1 is a diagram showing an application example of an information processing device according to an embodiment of the present invention. As shown in Fig. 1, an information processing device 10 according to an embodiment of the present invention includes a correction candidate extraction unit 11, a correction information evaluation unit 12, and a knowledge generation unit 13.

[0016] When generating knowledge, i.e., rules, for estimating events based on the recorded information recorded in an external recorded information DB (database) 20, in this case, information on an event that occurred as a first event and information on an alarm that occurred as a second event as a result of the occurrence of the event, the correction candidate extraction unit 11 takes into consideration the possibility of errors between the text information, etc. recorded in the recorded information DB 20 and the correct information, and determines correction candidates for errors related to the recorded information.

[0017] The correction information evaluation unit 12 calculates an evaluation value of the judgment result of the recorded event based on the knowledge created based on the correction candidates determined by the correction candidate extraction unit 11, assuming that the knowledge is adopted.

[0018] The knowledge generation unit 13 corrects the recorded information in the recorded information DB 20 to the correction candidate with the highest evaluation value based on the evaluation value of the recorded event judgment result by the correction information evaluation unit 12 for each correction candidate determined by the correction candidate extraction unit 11, and generates knowledge.

[0019] The information to be corrected is information that can be determined as a correction candidate based on whether the numerical difference or similarity, etc., for two parameters consisting of the original information and the correction candidate information is within a reference value, or based on a list of candidate targets, etc.

[0020] For example, let us assume that a rule is generated using, as a candidate knowledge condition, an alarm that occurs as a result of a ripple effect from a failure during a time period beginning with the date and time of the event recorded in the record information DB 20, e.g., the date and time of a device failure on the network, and ending with a time α, e.g., 10 minutes later, as a starting point. In this case, there may be an error between this recorded date and time of the event and the time when the alarm accompanying the event occurs, such as the time when the recorder recognized the occurrence of the event.

[0021] Therefore, in this embodiment, knowledge is generated based on an alarm that occurs when an error in the event occurrence date and time is corrected. The correction candidate extraction unit 11 expands the time before and after the event occurrence date and time information recorded in the record information DB 20 to cover the range of the expected recording error, and extracts correction candidates by assuming that the event occurred at any point within this expanded time.

[0022] The correction information evaluation unit 12 calculates an evaluation value at the time of the event occurrence using rules created based on the correction candidates. The knowledge generation unit 13 adopts the correction results and rules that can highly evaluate the probability that the event recorded in the record information DB 20 has occurred at the event occurrence location.

[0023] A more specific example of the process will be described below. It is assumed here that I (I≧1) cases are recorded in the record information DB 20 for each type of event to be recorded.

[0024] (1-1) The correction candidate extraction unit 11 ｉ (:(t0 ｉ -t ｍａｒｇｉｎ ) to (t0 ｉ +α+t ｍａｒｇｉｎ )) to extract alarms that occur between t0 ｉ is the recorded date and time of the event occurrence of case i (i = 1 to I). ｍａｒｇｉｎ is the expected error in the recording date and time, and α is the alarm generation period associated with the event occurrence.

[0025] (1-2) The correction candidate extraction unit 11 ｉ Starting from any point in time, the same period P ｉ A group of alarms occurring over a period α ending within C ｉ，ｊ j is a value equal to or greater than 1, and there are as many combinations of alarm groups that occur within the period of expected error for case i.

[0026] For example, an alarm that occurs over a period α starting from an arbitrary time point is t １The alarm that occurs in "period 1" that starts at t and ends at the same period α is (alarm A), and １ t within the period α later than ２ When the alarms occurring in "period 2" starting from and ending at the same period α are (alarm A, alarm B), j=1, 2.

[0027] (1-3) The correction information evaluation unit 12 selects an arbitrary alarm group C for each case. １，ｊ , C ２，ｊ , ..., C Ｉ，ｊ The rule R is adopted when it is assumed that the alarm is generated when an event occurs. ｌ The estimation process is performed using

[0028] Specifically, the correction information evaluation unit 12 evaluates the i-th case by applying the l-th rule, rule R ｌ The probability of an event occurring at node number k, for example, the evaluation value S ｉ，ｌ，ｋ where l is 1 or more, and the arbitrary alarm group C that each case can take is calculated. １，ｊ , C ２，ｊ , ..., C Ｉ，ｊ is the upper limit of the number of rule patterns that are adopted when an alarm occurs at the time of an event.

[0029] (1-4) The knowledge generating unit 13 assigns the node number related to the original event occurrence in the case i to K ｉ Then, in all cases, k = K ｉ Under the condition, the evaluation value S ｉ，ｌ，ｋ The lth rule R when ｌ will be adopted.

[0030] The evaluation value S ｉ，ｌ，ｋ Where k = K ｉ When there are multiple l's that are the maximum, the l'th rule R when the value calculated by (1) below is the highest ｌ may be adopted by the knowledge generating unit 13.

[0031]

[0032] In this embodiment, the error period before and after the actual event occurrence date and time is taken into consideration, and a rule pattern to be adopted from a combination of alarms occurring within the expanded time is created. Then, by adopting the rule that can most highly evaluate the possibility that an event has occurred at the location of the recorded case from among the created rules, alarms that are not adopted due to recording errors can be appropriately adopted, and the adoption of alarms that should not be adopted into the rule can be reduced, thereby improving the accuracy of the rules.

[0033] First Embodiment Next, an example of processing when one case (I=1) is registered in the record information DB 20 will be described. FIG. 2 is a diagram showing an example of a network configuration according to the first embodiment. In the network shown in FIG. 2, devices b, c, and d are connected to device a, devices a, c, and e are connected to device b, devices a, b, and d are connected to device c, devices a, c, and e are connected to device d, and devices b and d are connected to device e. In this network, device c is the failure point, and in response to this failure, alarms a and b are generated from device a, alarms a and c are generated from device b, alarms b and c are generated from device d, and alarm c is generated from device e as alarms at nodes near the event occurrence point.

[0034] 3 is a diagram illustrating an example of an alarm occurrence situation and a target period according to the first embodiment. The recording date and time of the event occurrence is the recording date and time t0 of the event occurrence of "Case 1" shown in FIG. １ In the known method, when the event occurs, the node (a in FIG. 3) １ Starting from "t0 １ ~t0 １ The alarm b occurring during the period "+α" (symbol b in FIG. 3) is the condition of the rule.

[0035] (2-1) On the other hand, in this embodiment, the target period P １ is "(t0 １ -t ｍａｒｇｉｎ ) to (t0 １ +α+t ｍａｒｇｉｎThe correction candidate extraction unit 11 extracts alarms that have occurred during this period.

[0036] (2-2) FIG. 4 is a diagram showing an example of a pattern of a period starting from an arbitrary point in time according to the first embodiment. １ Starting from any point in the same period P １ With regard to alarms that occur over a period α that ends within the period α shown in FIG. 4, the alarms that occur in "period 1" are "alarms a and b," the alarm that occurs in "period 2" that starts later than "period 1" is "alarm b," the alarm that occurs in "period 3" that starts later than "period 2" is "alarms b and c," and the alarm that occurs in "period 4" that starts later than "period 3" is "alarm c."

[0037] As a result, the correction candidate extraction unit 11 extracts alarms of the following four patterns C ｊ In this embodiment, since I=1, the above-mentioned C ｉ，ｊ The subscript "i," in ｊ (Alarm group C ｊ ) C １ = (alarm a, alarm b), C ２ = (alarm b), C ３ = (alarm b, alarm c), C ４ = (alarm c)

[0038] (2-3) As described above, in the first embodiment, there is one case, so the combination of alarms that is the condition of the rule is as follows: (Combination of alarms) R １ = (alarm a), R ２ = (alarm b), R ３ = (alarm c), R ４ = (alarm a, alarm b), R ５ = (alarm b, alarm c)

[0039] The above-mentioned alarm group C ｊ Among the four patterns, there is no pattern with only alarm a, but the alarm occurrence period is alarm group C. ｊ C in １When the period is corrected to the period when alarm a occurs, there may be cases where only alarm a is adopted in the rule. １ 2, only alarm a is used as a condition for the rule. In addition, in the example shown in FIG. 2, all alarms that are conditions for the rule are generated from devices adjacent to the faulty device.

[0040] According to the combination of alarms that are the conditions of the rules described above, there are five types of candidate rules to be adopted in this embodiment, and the types of alarms that are the conditions of the rules. All alarms of these conditions occur in devices adjacent to the faulty device. (Rule Candidates) R １ = (alarm a), R ２ = (alarm b), R ３ = (alarm c), R ４ = (alarm a, alarm b), R ５ = (alarm b, alarm c)

[0041] 5 is a diagram showing an example of the calculation results of the evaluation values ​​for each rule according to the first embodiment. Fig. 5 shows the calculation results of the evaluation values ​​indicating the possibility of an event occurring in each node, in this case, each device, when each rule is used in the alarm occurrence situation in "Case 1."

[0042] For example, rule R in the above-mentioned rule candidates １ When the rule R is used, when the possibility of an event occurring in the device a is evaluated, the condition indicating that an alarm a will occur from three locations consisting of the devices b, c, and d that are adjacent devices of the device a is satisfied. １ On the other hand, among devices b, c, and d adjacent to device a, only device b has actually generated alarm a, so the evaluation value is 0.33 (= 1 / 3).

[0043] (4) In addition, the number in a bold cell in the column for each rule in Figure 5 represents the number in each row of the same column that has the highest evaluation value when that rule is used compared to when other rules are used.

[0044] Since the original event occurrence node in "Case 1" is device c, among the rules shown in FIG. 5, the rule with the highest evaluation value of the possibility of an event occurring in device c is rule R , which has two nodes with the highest evaluation value. ２ Rule R excluding １ and R ４ is the rule to be adopted.

[0045] In this embodiment, the rule R １ and R ４ When either rule is used, the evaluation value for device c is the same, 0.67. Therefore, rule R ４ It may be a rule that only the above is adopted.

[0046] As described above, in the configuration shown in FIG. 2 , in the existing method of knowledge generation, which is rule generation based on recorded information, only alarm b is used as the rule condition, and therefore devices c and d are equally determined to be faulty. In contrast, in this embodiment, by taking into account the error in the recorded date and time, it is possible to use target alarm a as the rule condition when the time before the recorded date and time is set as the correct time, and therefore it is possible to improve the fault determination performance of device c, which is the original event occurrence node.

[0047] Second Embodiment Next, an example of processing when two cases (I=2) are registered in the record information DB 20 will be described. FIG. 6 is a diagram showing a first example of an event occurrence and an alarm occurrence in a network configuration according to the second embodiment. FIG. 7 is a diagram showing a second example of an event occurrence and an alarm occurrence in a network configuration according to the second embodiment. In the networks shown in FIGS. 6 and 7, the relationships between each device and its adjacent devices are as follows:

[0048] Device A: Device B, C Device B: Device A, E Device C: Device A, D, F, G Device D: Device C, E, G Device E: Device B, D, G Device F: Device C, G, H Device G: Device C, D, E, F, H, J Device H: Device F, G, I Device I: Device H, J Device J: Device G, I

[0049] In "Case 1" shown in Figure 6, device C is the faulty part, and this fault causes alarms to be generated from each device. The relationship between the devices that generated alarms and the types of alarms generated from those devices is as follows: Device A: Alarms C and D Device D: Alarms C and Z Device E: Alarms A and E Device F: Alarms C and D Device G: Alarm D Device H: Alarm Y Device I: Alarm F Device J: Alarm E

[0050] In "Case 2" shown in Figure 7, device D is the faulty part, and this fault causes alarms to be generated from each device. The relationship between the devices that generated alarms and the types of alarms generated from the devices is as follows: Device C: Alarm C Device E: Alarm C Device G: Alarm D Device H: Alarm E Device I: Alarms B, F Device J: Alarm E

[0051] 8 is a diagram showing a first example of an alarm occurrence situation and a target period according to the second embodiment. FIG. 9 is a diagram showing a second example of an alarm occurrence situation and a target period according to the second embodiment. As shown in FIG. 8, for a node (reference symbol a in FIG. 8) in the vicinity of the event occurrence location, the recording date and time of the event occurrence in "Case 1" is t0. １ As shown in FIG. 9, for the node (reference symbol a in FIG. 9) in the vicinity of the event occurrence location, the recording date and time of the event occurrence in "Case 2" is t0 ２ In the conventional method, the extracted alarm is １ The period starting from "t0 １ ~t0 １ Alarm D occurring at t0 ２ The period starting from "t0 ２ ~t0 ２ Since alarms C and D occur in "Case 1" and "Case 2" (symbol b in FIG. 8 and symbol b in FIG. 9), alarm D occurring in both "Case 1" and "Case 2" becomes the condition of the rule.

[0052] (3-1) On the other hand, in this embodiment, the target period P for alarm extraction in “Case 1” １ is "(t0 １ -tｍａｒｇｉｎ ) to (t0 １ +α+t ｍａｒｇｉｎ ) and the target period for alarm extraction in "Case 2" P ２ is "(t0 ２ -t ｍａｒｇｉｎ ) to (t0 ２ +α+t ｍａｒｇｉｎ The correction candidate extraction unit 11 extracts alarms that have occurred during this period for nodes in the vicinity of the event occurrence location.

[0053] (3-2) Fig. 10 is a diagram showing a first example of a pattern of a period starting from an arbitrary time point according to the second embodiment. Fig. 11 is a diagram showing a second example of a pattern of a period starting from an arbitrary time point according to the second embodiment. Period P １ or P ２ Regarding alarms that occur over a period α starting from any point in the above and ending at the same period, as shown in FIG. 10, for "Case 1," "alarms C and D" occur in "period 1," and alarm D occurs in "period 2."

[0054] 11, for "Case 2", "Alarms C and D" occur in "Period 3", and "Alarm D" occurs in "Period 4". Therefore, the alarm group C extracted by the correction candidate extraction unit 11 is ｉ，ｊ The combination of alarms in each case is expressed as follows: Alarm Z occurring in "Case 1" occurs during the period P １ Since this alarm occurs outside, it is not subject to extraction.

[0055] (Alarm group C extracted in "Case 1" ｉ，ｊ ) C １，１ = Alarm C, Alarm D, C １，２ = (Alarm D) (Alarm group C extracted in "Case 2" ｉ，ｊ ) C ２，１ = Alarm C, Alarm D, C ２，２ = (Alarm D)

[0056] (3-3) As described above, in the second embodiment, since there are two cases, the combination of alarms occurring in the corrected period is "C １，１ and C２，１ "," "C １，１ and C ２，２ "," "C １，２ and C ２，１ "," "C １，２ and C ２，２ ". When the alarms common to the two cases above are to be adopted as rules, the alarm group "C １，１ and C ２，１ The common alarms in the alarm group "C" are "(Alarm C, Alarm D)". １，１ and C ２，２ "," "C １，２ and C ２，１ " and "C １，２ and C ２，２ The common alarm in all of these is "(Alarm D)."

[0057] Therefore, there are three patterns of alarm combinations that can be the conditions of a rule. In this embodiment, as shown in Figures 6 and 7, all alarms that can be the conditions are adjacent devices of the faulty device. (Alarm Combination) R １ = (Alarm C), R ２ = (Alarm D), R ３ = (Alarm C, Alarm D)

[0058] Fig. 12 is a diagram showing a first example of the calculation results of the evaluation values ​​for each rule according to the second embodiment. Fig. 13 is a diagram showing a second example of the calculation results of the evaluation values ​​for each rule according to the second embodiment. Fig. 12 shows the calculation results of the evaluation values ​​indicating the possibility of an event occurring at each node when each rule is used in the alarm occurrence situation of "Case 1". Fig. 13 shows the calculation results of the evaluation values ​​indicating the possibility of an event occurring at each node when each rule is used in the alarm occurrence situation of "Case 2".

[0059] For example, rule R in the above-mentioned rule candidates １ When the rule R is used, when evaluating the possibility of an event occurring in device A, it is possible that alarm C will occur from two locations, devices B and C, which are adjacent devices of device A. １ This is the condition set.

[0060] On the other hand, of the adjacent devices B and C, the number of devices that actually generated alarm C in "Case 1" is 0, so the evaluation value is 0.00 (= 0 / 2). Also, of the adjacent devices B and C, only device C actually generated alarm C in "Case 2", so the evaluation value is 0.5 (= 1 / 2).

[0061] (3-4) Furthermore, the value in a bold cell in the column for each rule in FIGS. 12 and 13 indicates the value with the highest evaluation value among the values ​​in each row of the same column when that rule is used.

[0062] The original event occurrence node in "Case 1" is device C, and the rule with the highest evaluation value under this condition is rule R １ , R ２ and R ３ In addition, the original event occurrence node in "Case 2" is device D, and the rule with the highest evaluation value under this condition is rule R １ and R ３ Therefore, the rule with the highest evaluation value in the condition of the original event occurrence node in all cases is rule R. １ or R ３ is.

[0063] In this embodiment, the rule R １ or R ３ Rule R １ Since the evaluation value of the original event occurrence node in each case is higher in rule R, １ This is because in "Case 1", the evaluation value in device D is the same 0.75 regardless of which rule is used, but in "Case 2", rule R １ This is because the evaluation value of device D when rule 1 is used is 0.67, which is the highest compared to the evaluation values ​​of device D when other rules are used.

[0064] As described above, in the configurations shown in FIGS. 6 and 7 , in the existing method of knowledge generation, which is rule generation based on recorded information, only alarm D is used as the rule condition, but in this embodiment, by taking into account the error in the recorded date and time, it is possible to use alarm C, which becomes the target when the time before this recorded date and time is set as the correct time, as the rule condition. This makes it possible to generate a rule that can appropriately evaluate two cases, and makes it possible to improve the fault determination performance of the device that is the original event occurrence node.

[0065] 14 is a block diagram showing an example of the hardware configuration of an information processing device according to an embodiment of the present invention. In the example shown in FIG. 14, the information processing device 10 according to the embodiment is configured, for example, as a server computer or a personal computer, and has a hardware processor 111A such as a CPU (Central Processing Unit). A program memory 111B, a data memory 112, an input / output interface 113, and a communication interface 114 are connected to this hardware processor 111A via a bus 115.

[0066] The communication interface 114 includes, for example, one or more wireless communication interface units, and enables transmission and reception of information to and from a communication network. As the wireless interface, for example, an interface that adopts a low-power wireless data communication standard such as a wireless LAN (Local Area Network) is used.

[0067] An input device 200 and an output device 300 attached to the information processing device 10 and used by a user or the like are connected to the input / output interface 113. The input / output interface 113 can take in operation data input by a user or the like through the input device 200 such as a keyboard, a touch panel, a touchpad, or the like, and can output and display output data to an output device 300 including a display device using a liquid crystal or an organic electroluminescence (EL) display, or the like. The input device 200 and the output device 300 may be devices built into the information processing device 10, or may be input devices and output devices of other information terminals that can communicate with the information processing device 10 via a network.

[0068] The program memory 111B is a non-transitory tangible storage medium that is a combination of a non-volatile memory that can be written to and read from at any time, such as a hard disk drive (HDD) or a solid state drive (SSD), and a non-volatile memory such as a read only memory (ROM), and can store programs necessary to execute various control processes, etc., according to one embodiment.

[0069] The data memory 112 is a tangible storage medium that is, for example, a combination of the above-mentioned nonvolatile memory and a volatile memory such as RAM (Random Access Memory), and can be used to store various data or information acquired and created during various processes.

[0070] An information processing apparatus 10 according to one embodiment of the present invention can be configured as an information processing apparatus having the units shown in FIG. 1 as software-based processing function units.

[0071] The information storage unit used as a work memory or the like by each unit of the information processing device 10 can be configured by using the data memory 112 shown in Fig. 6. However, these configured storage areas are not essential components within the information processing device 10, and may be areas provided in, for example, an external storage medium such as a USB (Universal Serial Bus) memory, or a storage device such as a database server located in the cloud.

[0072] The processing function units in each of the above units can be realized by reading and executing a program stored in the program memory 111B by the hardware processor 111A. Note that some or all of these processing function units may be realized in various other forms, including integrated circuits such as an application specific integrated circuit (ASIC) or a field-programmable gate array (FPGA).

[0073] The methods described in each embodiment can be stored as a program (software means) that can be executed by a computer on a recording medium such as a magnetic disk (floppy disk, hard disk, etc.), optical disk (CD-ROM, DVD, MO, etc.), or semiconductor memory (ROM, RAM, flash memory, etc.), and can also be distributed by transmitting it via a communication medium. The program stored on the medium also includes a configuration program that configures the software means (including not only execution programs but also tables or data structures) that the computer executes. The computer that realizes this device reads the program stored on the recording medium and, in some cases, configures the software means using the configuration program, and executes the above-mentioned processing by controlling the operation of this software means. The term "recording medium" as used herein is not limited to a storage medium for distribution, but also includes a storage medium such as a magnetic disk or semiconductor memory installed inside the computer or in a device connected via a network.

[0074] The present invention is not limited to the above-described embodiments, and various modifications can be made in the implementation stage without departing from the spirit of the invention. Furthermore, the embodiments may be implemented in appropriate combinations, in which case the combined effects can be obtained. Furthermore, the above-described embodiments include various inventions, and various inventions can be extracted by combining selected elements from the disclosed elements. For example, if the problem can be solved and the desired effect can be obtained even if some elements are deleted from all elements shown in the embodiments, the configuration from which these elements are deleted can be extracted as an invention.

[0075] REFERENCE SIGNS LIST 10... Information processing device 11... Correction candidate extraction unit 12... Correction information evaluation unit 13... Knowledge generation unit 20... Recorded information DB

Claims

1. An information processing device comprising: an extraction unit that extracts second events that occur in response to first events that occur within a period that is extended from a recorded period in which a first event occurred according to an expected error between that period and the period in which the first event actually occurred; an evaluation unit that extracts, from the second events extracted by the extraction unit, second events that occur in response to the first event that occurred within a period starting from any timing within the extended period, and based on the extraction results, determines candidate rules that define a relationship between the first and second events, and determines an evaluation value for each of the determined candidates regarding the likelihood of the second event occurring in response to the occurrence of the first event; and a generation unit that generates, from the candidate rules, rules that define an appropriate relationship between the first and second events based on the evaluation value determined by the evaluation unit.

2. The information processing device of claim 1, wherein the evaluation unit determines a pattern of the type of second event that occurs in conjunction with the occurrence of the first event based on the second event that occurred in response to the first event that occurred in a period starting from any timing within the extended period extracted by the extraction unit, determines candidates for the rule according to the pattern, and calculates the evaluation value for each of the determined candidates for each type of the first event.

3. The information processing device of claim 1, wherein the evaluation unit calculates the evaluation value based on the location where the second event actually occurred, and the generation unit generates a rule from the candidate rules that defines an appropriate relationship between the first event and the second event based on the evaluation value calculated by the evaluation unit that relates to the location where the first event actually occurred.

4. A method performed by an information processing device, comprising: an extraction unit of the information processing device extracting a second event that occurred in response to a first event that occurred during a period that was recorded as the period in which a first event occurred, extended in accordance with an expected error between that period and the period in which the first event actually occurred; an evaluation unit of the information processing device extracting, from the second events extracted by the extraction unit, a second event that occurred in response to the first event that occurred during a period starting from any timing within the extended period, and based on the results of the extraction, determining candidate rules that define the relationship between the first and second events, and determining, for each of the determined candidates, an evaluation value for the possibility of the second event occurring in response to the occurrence of the first event; and a generation unit of the information processing device generating, from the candidate rules, rules that define an appropriate relationship between the first and second events, based on the evaluation value determined by the evaluation unit.

Images