Document processing device

Abstract

This document processing device includes a division unit, a first correspondence relationship estimation unit, a second correspondence relationship estimation unit, and a synthesis unit. The division unit divides a known document into a first common portion, which is a portion in common with a previously inputted document, and a first difference portion, which is a portion different from the previously inputted known document. The first correspondence relationship estimation unit inputs the first common portion to a first correspondence relationship estimation model and receives, from the first correspondence relationship estimation model, an estimation result of a second common portion, which is a common portion of an event log corresponding to the first common portion from among a plurality of event logs describing logs of events relating to content made known by a plurality of known documents. The second correspondence relationship estimation unit inputs the second common portion to a second correspondence relationship estimation model and receives, from the second correspondence relationship estimation model, an estimation result of a second difference portion that is a difference portion of an event log corresponding to the first difference portion from among the plurality of event logs. The synthesis unit synthesises the second common portion and the second difference portion to generate an event log.

Description

Document processing apparatus

[0001] The embodiment relates to a document processing apparatus.

[0002] A notice document is a document that describes content to be notified to a user. The notice document may include, for example, an update notice document that notifies the user to perform a software update. In recent years, with the increase in cyberattacks, the importance of software update operations related to information security has increased, and the importance of notice documents for notifying users of such software update operations has also increased.

[0003] Here, it may also be important whether the user who has received the notice document actually implements the content notified by the notice document. For example, in the case of a software update operation, it is possible to identify from the software event log that the software has actually been updated. By associating the notice document with the event log, it is possible to manage whether the user who has received the notice document actually implements the content notified by the notice document.

[0004] There is a hierarchical relationship between the notice document and the event log, where the event log is created as a result after the content notified by the notice document has been actually implemented after the notice document is issued. Based on such a hierarchical relationship between the documents, it has also been considered to perform the association between the notice document and the event log using a machine learning model. In this case, the machine learning model is, for example, a correspondence relationship estimation model that takes a notice document as input and estimates the corresponding event log based on the feature amount extracted from the input notice document. For the learning of such a correspondence relationship estimation model, a large number of pairs of notice documents and event logs that correspond to each other are used as teacher data.

[0005] Hiroki Nakanishi et al., "Update Notification Filtering Method Related to Information Security", Institute of Electronics, Information and Communication Engineers, 2024 General Conference, B-14-11 (February 26, 2024)

[0006] Much of the text in public notices and event logs consists of standardized phrases. Therefore, a large volume of public notices used as training data contains many common elements. Similarly, a large volume of event logs used as training data also contains many common elements. For this reason, in order to properly associate public notices with specific event logs, it is important to focus on the differences within the public notices. Traditionally, correspondence estimation models have been trained with a mixture of common and differing elements. Consequently, the computational load for estimation tends to be high, and the estimation accuracy tends to decrease.

[0007] The embodiment provides a document processing device that accurately estimates the correspondence between publicly known documents and event logs using a machine learning model.

[0008] One embodiment of the document processing device includes a division unit, a first correspondence relationship estimation unit, a second correspondence relationship estimation unit, and a synthesis unit. The division unit divides a publicly known document containing information to be made public into a first common part, which is the common part with publicly known documents previously input, and a first difference part, which is the difference part with publicly known documents previously input. The first correspondence relationship estimation unit inputs the first common part into a first correspondence relationship estimation model and receives from the first correspondence relationship estimation model the estimation result of a second common part, which is the common part of the event log corresponding to the first common part among a plurality of event logs containing logs of events related to the information made public by the plurality of publicly known documents. The second correspondence relationship estimation unit inputs the second common part into a second correspondence relationship estimation model and receives from the second correspondence relationship estimation model the estimation result of a second difference part, which is the difference part of the event log corresponding to the first difference part among a plurality of event logs. The synthesis unit synthesizes the second common part and the second difference part to generate an event log.

[0009] According to one embodiment, a document processing device is provided that accurately estimates the correspondence between publicly known documents and event logs using a machine learning model.

[0010] Figure 1 is a block diagram showing the configuration of a document processing device according to an embodiment. Figure 2 is a diagram illustrating the division of a well-known document. Figure 3 is a diagram illustrating the division of an event log. Figure 4 is a flowchart showing the learning operation of the correspondence estimation model of the document processing device according to an embodiment. Figure 5 is a conceptual diagram of the adjustment of the model parameters of the correspondence estimation model 13a. Figure 6 is a conceptual diagram of the adjustment of the model parameters of the correspondence estimation model 13b. Figure 7 is a flowchart showing the estimation operation of the document processing device according to an embodiment. Figure 8 is a diagram showing the division of an example of a well-known document. Figure 9A is a diagram showing an example of the estimation result of the common part of the event log for the common part of the well-known document. Figure 9B is a diagram showing an example of the estimation result of the difference part of the event log for the difference part of the well-known document. Figure 10 is a diagram showing an example of synthesis. Figure 11 is a block diagram showing an example of the hardware configuration of the document processing device.

[0011] Embodiments will be described below with reference to the drawings. Figure 1 is a block diagram showing the configuration of a document processing device according to an embodiment. The document processing device according to an embodiment can be applied, for example, to a computer device that manages the configuration of an IT system. The IT system is not limited to this, but may include, for example, computer systems such as personnel management systems and attendance management systems, and network management systems.

[0012] The document processing device according to the embodiment associates, for example, a public information document with an event log. In the embodiment, the public information document is a document that contains information to be made known to the user. For example, the public information document is an update notification document that notifies the user to perform a software update. Since the update notification document is also a document that instructs the user to perform the update, it can also be called an instruction document. The public information document may be data in any format that includes a public information document, such as the data in the body of an email or document data attached as an attachment. In contrast, the event log is a log of events related to the information made known by the public information document. For example, if the public information document is an update notification document, the event log may be a log of the software update.

[0013] The document processing device 1 includes division units 11a and 11b, correspondence estimation units 12a and 12b, a synthesis unit 14, and an output unit 15. The document processing device 1 may also include correspondence estimation models 13a and 13b and a storage unit 16.

[0014] The division unit 11a divides the input public information document D into a common part and a difference part. The common part is, for example, the part that is common with the public information document that was input immediately before. The difference part is, for example, the part that is different from the public information document that was input immediately before, and is the part other than the common part.

[0015] Figure 2 is a diagram illustrating the division of publicly known documents. Publicly known documents D can be input to the division unit 11a, for example, in order of oldest issue date. The division unit 11a detects words and symbols common to the publicly known document D2 with a newer issue date and the publicly known document D1 with the immediately preceding issue date, and generates a common part Dc of the publicly known document consisting only of the detected words and symbols, and a difference part Dd consisting of the remaining words and symbols. The division unit 11a can detect common words and symbols using any method. For example, the division unit 11a converts the words and symbols in the respective sentences of publicly known documents D1 and D2 into vectors using a method such as BOW (Bag of Words). Then, the division unit 11a calculates the difference between each element of the vector obtained from publicly known document D1 and each element of the vector obtained from publicly known document D2. Then, the division unit 11a extracts the elements with the largest differences as the difference part, and converts the elements of the extracted difference part back to the original words or symbols. Furthermore, the splitting section 11a extracts elements other than the difference portion as a common portion, and converts the extracted common portion elements back to the original words or symbols. In Figure 2, the publication dates of the respective notification documents, "January 6, 2024" and "February 14, 2024 (0214 (Wed))", the request dates, "0106 (Mon)" and "0214 (Wed)", and the software versions to be updated, "v1" and "v2", are different. Therefore, the difference portion Dd is the data from which "February 14, 2024", "0214 (Wed)", and "v2" have been extracted, and the common portion Dc is the data of the portion other than "February 14, 2024", "0214 (Wed)", and "v2". Here, the common portion Dc is data that also contains the position information of the difference portion Dd extracted from notification document D, that is, the information of the blank position shown by "□" in Figure 2.

[0016] The splitting unit 11b divides the input event log L into a common part and a difference part. The common part is, for example, the part that is common with the immediately preceding input event log. The difference part is, for example, the part that is different from the immediately preceding input event log, and is the part other than the common part.

[0017] Figure 3 is a diagram illustrating the division of an event log. Similar to the publicly known document D, the event log L can also be input to the division unit 11b, for example, in chronological order of occurrence date. The division unit 11b detects words and symbols common to the newer event log L2 with the occurrence date to be divided and the event log L1 with the immediately preceding occurrence date, and generates a common part Lc of the event log containing only the detected words and symbols, and a difference part Ld consisting of the remaining words and symbols. The division unit 11b can detect common words and symbols using any method. For example, the division unit 11b may divide the event log L into a common part and a difference part in the same way as the division unit 11a. In Figure 3, the generation dates and times of the respective event logs, "2024 / 01 / 10 10:11:08" and "2024 / 02 / 19 15:23:38", and the updated software versions, "v1" and "v2", are different. Therefore, the difference portion Ld is the data from which "2024 / 02 / 19 15:23:38" and "v2" have been extracted, and the common portion Lc is the data other than "2024 / 02 / 19 15:23:38" and "v2". Here, the common portion Lc is data that also contains the position information of the difference portion Ld extracted from the event log L, that is, the information of the blank position shown by "□" in Figure 3.

[0018] Here, the splitting sections 11a and 11b do not necessarily have to split the document into common parts and differences with the most recently acquired public notice document, as long as the public notice document was acquired before the public notice document to be split. Also, the public notice documents and event logs do not necessarily have to be entered into the splitting sections 11a and 11b in chronological order from oldest to newest.

[0019] The correspondence estimation unit 12a receives the common portion of the publicly known document D from the division unit 11a. The correspondence estimation unit 12a also receives the common portion of the event log L from the division unit 11b. The correspondence estimation unit 12a then inputs the common portion of the publicly known document D received from the division unit 11a into the correspondence estimation model 13a and performs estimation of the common portion of the event log L that corresponds to the input common portion of the publicly known document D. The correspondence estimation unit 12a then performs training of the correspondence estimation model 13a based on the estimation error between the estimation result of the common portion of the event log L and the common portion of the event log L received from the division unit 11b.

[0020] The correspondence estimation unit 12b receives the difference portion of the publicly known document D from the division unit 11a. The correspondence estimation unit 12b also receives the difference portion of the event log L from the division unit 11b. The correspondence estimation unit 12b then inputs the difference portion of the publicly known document D received from the division unit 11a into the correspondence estimation model 13b and performs estimation of the difference portion of the event log L corresponding to the input difference portion of the publicly known document D. The correspondence estimation unit 12a then performs training of the correspondence estimation model 13b based on the estimation error between the estimation result of the difference portion of the event log L and the difference portion of the event log L received from the division unit 11b.

[0021] The correspondence estimation model 13a is a machine learning model whose model parameters are set to receive input of the common parts of the publicly known document D and estimate the common parts of the event logs L stored in the memory unit 16 that correspond to the input common parts of the publicly known document D. For example, the correspondence estimation model 13a converts the words and symbols of the common parts of the input publicly known document D into vectors, and outputs the probability that the common parts of each event log L stored in the memory unit 16 correspond to the common parts of the input publicly known document D based on the features of the converted vectors. The correspondence estimation model 13a can be any machine learning model capable of estimating corresponding common parts. Support vector machines and neural networks are among the machine learning models that can be used as the correspondence estimation model 13a.

[0022] The correspondence estimation model 13b is a machine learning model whose model parameters are set to receive the difference portion of a known document D as input and estimate the difference portion of the event log L corresponding to the input difference portion of the known document D in the event log L stored in the memory unit 16. For example, the correspondence estimation model 13b converts the words and symbols of the difference portion of the input known document D into vectors, and outputs the probability that the difference portion of each event log L stored in the memory unit 16 corresponds to the difference portion of the input known document D based on the features of the converted vectors. The correspondence estimation model 13b can be any machine learning model capable of estimating corresponding difference portions. The correspondence estimation model 13b may be a machine learning model with the same configuration as the correspondence estimation model 13a but with different training data. That is, support vector machines and neural networks are envisioned as machine learning models that can be used as the correspondence estimation model 13b.

[0023] The synthesis unit 14 generates an event log L by combining the common portion of the event log L estimated by the correspondence estimation unit 12a and the difference portion of the event log L estimated by the correspondence estimation unit 12b. As will be explained in detail later, the synthesis can be performed by copying the difference portion of the event log L to the position of the difference portion in the common portion of the event log L.

[0024] The output unit 15 performs various output processing based on the synthesis results of the synthesis unit 14. For example, the output unit 15 displays the event log L generated by the synthesis unit 14 on the display. Alternatively, the output unit 15 stores correspondence data C, which indicates the correspondence between the event log L generated by the synthesis unit 14 and the input publicly known document D, in the storage unit 16. Using the correspondence data C, the document filtering device can associate the publicly known document with the event log.

[0025] The storage unit 16 stores the input public document D and event log L. The storage unit 16 may also store the corresponding data C generated by the output unit 15.

[0026] The operation of the document processing device 1 will be described below. Figure 4 is a flowchart showing the learning operation of the correspondence estimation model of the document processing device 1 according to this embodiment.

[0027] In step S1, the document processing device 1 acquires a well-known document D and an event log L to serve as training data. The training data consists of pairs of well-known documents D and event logs L whose correspondence is known in advance. The pairs of well-known documents D and event logs L used as training data may be combined into a single data file and input to the document processing device 1, or they may be input to the document processing device 1 as separate data files.

[0028] In step S2, the splitting unit 11a divides the publicly known document D acquired this time into a common part and a difference part based on the publicly known document D acquired immediately before. The splitting unit 11b divides the event log L acquired this time into a common part and a difference part based on the event log L acquired immediately before.

[0029] In step S3, the correspondence estimation unit 12a inputs the common portion of the publicly known document D into the correspondence estimation model 13a and receives the estimation result of the common portion of the event log L corresponding to the common portion of the publicly known document D. The correspondence estimation unit 12b inputs the difference portion of the publicly known document D into the correspondence estimation model 13b and receives the estimation result of the difference portion of the event log L corresponding to the difference portion of the publicly known document D.

[0030] In step S4, the correspondence estimation unit 12a calculates the estimation error between the estimation result of the common part of the event log L corresponding to the common part of the well-known document D received from the correspondence estimation model 13a and the common part of the event log L received from the division unit 11a. As the estimation error, for example, the difference between the vectors of the common part of the event log L that has the highest probability in the estimation result of the common part of the event log L and the common part of the event log L received from the division unit 11a may be used. The correspondence estimation unit 12a then adjusts the model parameters of the correspondence estimation model 13a by feeding back the calculated estimation error to the correspondence estimation model 13a. The correspondence estimation unit 12b calculates the estimation error between the estimation result of the difference part of the event log L corresponding to the difference part of the well-known document D received from the correspondence estimation model 13b and the difference part of the event log L received from the division unit 11b. As the estimation error, for example, the difference between the vectors of the event log L difference portion that has the highest probability in the estimation result of the difference portion of the event log L and the difference portion of the event log L received from the splitting unit 11b may be used. Then, the correspondence relationship estimation unit 12b adjusts the model parameters of the correspondence relationship estimation model 13b by feeding back the calculated estimation error to the correspondence relationship estimation model 13b.

[0031] Figure 5 is a conceptual diagram of the adjustment of the model parameters of the correspondence estimation model 13a. As shown in Figure 5, the correspondence estimation unit 12a inputs the common portion Dtc of the well-known document D from the training data Tc received from the division unit 11a to the correspondence estimation model 13a. The correspondence estimation model 13a estimates the probability that the input common portion Dtc corresponds to the common portion of each event log L stored in the storage unit 16, and returns that probability to the correspondence estimation unit 12a as the corresponding data Cc. The correspondence estimation unit 12a performs learning of the model parameters of the correspondence estimation model 13a by feeding back the estimation error between the common portion Ltc of the event log L received from the division unit 11a and the corresponding data Cc to the correspondence estimation model 13a.

[0032] Figure 6 is a conceptual diagram of the adjustment of the model parameters of the correspondence estimation model 13b. As shown in Figure 6, the correspondence estimation unit 12b inputs the difference portion Dtd of the well-known document D from the training data Td received from the division unit 11b into the correspondence estimation model 13b. The correspondence estimation model 13b estimates the probability that the input difference portion Dtd corresponds to the difference portion of each event log L stored in the storage unit 16, and returns that probability to the correspondence estimation unit 12b as the corresponding data Cd. The correspondence estimation unit 12b performs learning of the model parameters of the correspondence estimation model 13b by feeding back the estimation error between the difference portion Ltd of the event log L received from the division unit 11b and the corresponding data Cd to the correspondence estimation model 13b.

[0033] In step S5, the document processing device 1 determines whether or not the learning process is complete. For example, if the model parameters have been adjusted a predetermined number of times, the learning process is determined to be complete when the estimation errors of both the correspondence estimation model 13a and the correspondence estimation model 13b fall below a threshold. If the learning process is determined to be complete in step S5, the process shown in Figure 4 ends. If the learning process is determined to be incomplete in step S5, the process returns to step S1.

[0034] Here, the training data input during learning may be pairs of public documents and event logs that have already been divided into common and differential parts. In this case, the division process in step S2 may be omitted.

[0035] Figure 7 is a flowchart showing the estimation operation of the document processing device 1 according to the embodiment. It is assumed that sufficient training has been performed on the correspondence estimation models 13a and 13b prior to the processing shown in Figure 7.

[0036] In step S11, the document processing device 1 acquires a publicly known document D as input. Figure 8 shows an example of a publicly known document D. As shown in Figure 8, the publicly known document D includes multiple publicly known documents D1 and D2 in chronological order. Of the publicly known documents D1 and D2, publicly known document D2 is the publicly known document for which the correspondence relationship is estimated. Here, publicly known documents D1 and D2 may be combined into a single data and input to the document processing device 1, or they may be input to the document processing device 1 as separate data.

[0037] In step S12, the division unit 11a divides the publicly known document D2 into a common part and a difference part based on the difference between the publicly known document D1 and the publicly known document D2. Figure 8 shows an example in which the publicly known document D2 is divided into a common part Dc and a difference part Dd. In other words, the publicly known document D1 and the publicly known document D2 differ in their respective publication dates, "July 29, 2024" and "July 30, 2024," and the software versions to be updated, "vN" and "vM." Therefore, the difference part Dd is the data from which "July 30, 2024" and "vM" have been extracted, and the common part Dc is the data from which everything except "July 30, 2024" and "vM" has been extracted. Here, the common part Dc is data that also contains the position information of the difference part Dd extracted from the publicly known document D, that is, the information of the blank position shown by "□" in Figure 8.

[0038] In step S13, the correspondence estimation unit 12a inputs the common portion Dc of the known document D into the correspondence estimation model 13a and receives the estimation result of the common portion of the event log L corresponding to the common portion Dc of the known document D. The correspondence estimation unit 12b inputs the difference portion Dd of the known document D into the correspondence estimation model 13b and receives the estimation result of the difference portion of the event log L corresponding to the difference portion of the known document D. Figure 9A shows an example of the estimation result of the common portion Lc of the event log L for the common portion Dc of the known document D. Figure 9B shows an example of the estimation result of the difference portion Ld of the event log L for the difference portion Dd of the known document D. The correspondence estimation model 13a outputs the probability that the common portion of each event log L stored in the storage unit 16 corresponds to the input common portion Dc of the known document D as correspondence data Cc. Similarly, the correspondence estimation model 13b outputs the probability that the difference portion Dd of each event log L stored in the storage unit 16 corresponds to the difference portion Dd of the input publicly known document D as correspondence data Cd. Based on the correspondence data Cc received from the correspondence estimation model 13a, the correspondence estimation unit 12a may determine the common portion of the event log L with the highest probability to be the common portion Dc of the input publicly known document D and the event log L that corresponds to it. Similarly, based on the correspondence data Cd received from the correspondence estimation model 13b, the correspondence estimation unit 12b may determine the difference portion of the event log L with the highest probability to be the difference portion Dd of the input publicly known document D and the event log L that corresponds to it.

[0039] In step S14, the synthesis unit 14 generates an event log L corresponding to the input public document D by synthesizing the common portion Lc of the event log L received from the correspondence estimation unit 12a and the difference portion Ld of the event log L received from the correspondence estimation unit 12b. Figure 10 shows an example of synthesis. The synthesis unit 14 generates the event log L by copying the difference portion Dd to the position of the difference portion in the common portion Lc of the event log L.

[0040] In step S15, the output unit 15 performs various output processing based on the synthesis result of the synthesis unit 14. After that, the processing shown in Figure 7 is completed. For example, the output unit 15 displays the event log L generated by the synthesis unit 14 on the display. Alternatively, the output unit 15 stores correspondence data C, which indicates the correspondence between the event log L generated by the synthesis unit 14 and the input publicly known document D, in the storage unit 16. Correspondence data C is data that indicates that the event log L generated by the synthesis unit 14 corresponds to the input publicly known document D. Alternatively, correspondence data C may include both correspondence data Cc and correspondence data Cd.

[0041] Figure 11 is a block diagram showing an example of the hardware configuration of a document processing device 1. As shown in Figure 11, the document processing device 1 includes, for example, a processor 101, a ROM (read-only memory) 102, a RAM (random access memory) 103, a communication module 104, a display 105, and storage 106. The document processing device 1 may be, for example, a terminal device such as a smartphone or a PC (personal computer). In addition, the document processing device 1 may be a device built on a cloud environment.

[0042] The processor 101 is a processing circuit that controls the overall operation of the document processing device 1. The processor 101 operates as a splitting unit 11a, 11b, a correspondence estimation unit 12a, 12b, a synthesis unit 14, and an output unit 15 by executing a document processing program stored in the storage 106, for example. The processor 101 is, for example, a CPU. The processor 101 may also be an MPU, GPU, ASIC, FPGA, etc. The processor 101 may be a single CPU, or multiple CPUs, etc.

[0043] ROM 102 is a non-volatile semiconductor memory. ROM 102 stores the startup program and various setting values ​​of the document processing device 1. RAM 103 is a volatile memory. RAM 103 is used, for example, as working memory during processing in the processor 101.

[0044] The communication module 104 is a circuit provided with an interface for the document processing apparatus 1 to communicate with an external device. The communication module 104 may be a wireless communication module or a wired communication module.

[0045] The display 105 is, for example, an LCD (liquid crystal display) or an EL (electro-luminescence) display. The display 105 displays a GUI (graphical user interface) etc. corresponding to various applications such as an email application.

[0046] The storage 106 is a non-volatile storage device such as a hard disk or a flash memory. The storage 106 stores various programs such as the operating system (OS) of the document processing apparatus 1 and a document processing program. Further, the storage 106 can also operate as the storage unit 16. In this case, the storage 106 stores the well-known document D, the event log L, and the correspondence data C. Also, the storage 106 may store the correspondence relation estimation models 13a and 13b. The well-known document D, the event log L, the correspondence data C, and the correspondence relation estimation models 13a and 13b may be stored in a storage such as a server as an external device of the document processing apparatus 1. Furthermore, the document processing program may be downloaded to the storage 106 through a network.

[0047] As described above, according to the embodiment, in a document processing apparatus that searches for an event log corresponding to an input well-known document from a storage unit, the input well-known document is divided into a common part and a difference part with respect to a past well-known document. Then, the common part of the event log corresponding to the common part of the divided well-known document is searched by a correspondence relationship estimation model optimized for searching the common part of the event log. Similarly, the difference part of the event log corresponding to the difference part of the divided well-known document is searched by a correspondence relationship estimation model optimized for searching the difference part of the event log. Finally, the common part and the difference part of the searched event log are combined. Thus, in the correspondence relationship estimation model in the embodiment, learning is not performed in a state where the common part and the difference part are mixed. Therefore, it is expected that the calculation amount of each correspondence relationship estimation model is likely to be reduced, and a decrease in estimation accuracy can also be suppressed.

[0048] Here, in the embodiment, the well-known document to be associated is assumed to be an updated well-known document. In contrast, the well-known document to be associated is not limited to the updated well-known document. That is, if a change in the situation due to the content notified by the well-known document is stored as an event log, the technology of the embodiment can be applied even when the well-known document to be associated is other than the updated well-known document. For example, the well-known document to be associated may be a well-known document that notifies the user that software has been updated, a well-known document that notifies the user of the occurrence of an error, or the like.

[0049] Furthermore, in this embodiment, the common and differing portions of the corresponding event log are searched for in response to the input of a well-known document. Conversely, the common and differing portions of the corresponding well-known document may be searched for in response to the input of an event log. In this case, the correspondence estimation model 13a may be a machine learning model in which the model parameters are set to receive input of the common portion of the event log L and estimate the common portion of the well-known document D that corresponds to the input event log L, within the well-known document D stored in the storage unit 16. Similarly, the correspondence estimation model 13b may be a machine learning model in which the model parameters are set to receive input of the differing portion of the event log L and estimate the differing portion of the well-known document D that corresponds to the input event log L, within the well-known document D stored in the storage unit 16.

[0050] It should be noted that the present invention is not limited to the embodiments described above, and can be modified in various ways during implementation without departing from its essence. Furthermore, each embodiment may be combined as appropriate, and in that case, the combined effects can be obtained. Moreover, the above embodiments include various inventions, and various inventions can be extracted by selecting combinations from the multiple constituent elements disclosed. For example, if the problem can be solved and effects obtained even if some constituent elements are deleted from all the constituent elements shown in the embodiment, then the configuration with these deleted constituent elements can be extracted as an invention.

[0051] 1...Document processing device 11a...Dividing unit 11b...Dividing unit 12a...Correspondence relationship estimation unit 12b...Correspondence relationship estimation unit 13a...Correspondence relationship estimation model 13b...Correspondence relationship estimation model 14...Synthesis unit 15...Output unit 16...Storage unit 101...Processor 102...ROM 103...RAM 104...Communication module 105...Display

Claims

1. A document processing device comprising: a division unit that divides a notification document containing information to be made public into a first common part which is a common part with a previously entered notification document and a first difference part which is a difference part with the previously entered notification document; a first correspondence estimation unit that inputs the first common part into a first correspondence estimation model and receives from the first correspondence estimation model the estimation result of a second common part which is a common part of an event log corresponding to the first common part among a plurality of event logs which contain logs of events related to the information made public by a plurality of notification documents; a second correspondence estimation unit that inputs the second common part into a second correspondence estimation model and receives from the second correspondence estimation model the estimation result of a second difference part which is a difference part of an event log corresponding to the first difference part among a plurality of event logs; and a synthesis unit that synthesizes the second common part and the second difference part to generate an event log.

2. The document processing apparatus according to claim 1, wherein the first correspondence estimation unit receives the common portion of a pre-associated well-known document and the common portion of an event log as first training data, inputs the common portion of the well-known document in the first training data as the first common portion into the first correspondence estimation model and receives the estimation result of the second common portion, adjusts the model parameters of the first correspondence estimation model based on the estimation error between the second common portion and the common portion of the event log in the first training data, and the second correspondence estimation unit receives the difference portion of a pre-associated well-known document and the difference portion of an event log as second training data, inputs the difference portion of the well-known document in the second training data as the first difference portion into the second correspondence estimation model and receives the estimation result of the second difference portion, and adjusts the model parameters of the second correspondence estimation model based on the estimation error between the second difference portion and the difference portion of the event log in the second training data.

3. The document processing apparatus according to claim 1, wherein the synthesis unit copies the second difference portion to the position corresponding to the difference portion with the previously input publicly known document in the second common portion and generates the event log.

4. The document processing apparatus according to claim 1, further comprising an output unit that displays the event log generated by the synthesis unit on a display.

Images