Operation log abstraction device, method, and program

Abstract

An operation log abstraction device according to the present invention comprises: an analysis target log database in which analysis target logs to be analyzed are accumulated; an operation log database in which operation logs collected in the past are accumulated by project; a log database reading unit that reads the operation logs for each project from the operation log database; a similarity degree calculation unit that calculates a degree of similarity between a part of an analysis target log and the operation logs read for each project by the log database reading unit; a similar log extraction unit that extracts, on the basis of the degree of similarity, operation logs similar to the analysis target log from the operation logs read for each project by the log database reading unit; and an operation log size calculation unit that calculates an operation log size, which is the average size of the operation logs extracted by the similar log extraction unit.

Description

Operation Log Abstraction Device, Method, and Program

[0001] The present invention relates to an operation log abstraction device, method, and program that are excellent in analyzing and visualizing an entire operation log from an overview perspective.

[0002] In recent years, a method of using system logs for current situation analysis for business improvement has been in the spotlight (for example, Non-Patent Document 1). However, in order to obtain log information with an abstraction level that can be easily understood by humans, it is often necessary to access server-side information, and it can often only be realized in a favorable environment such as having an interface for the system side to extract information.

[0003] On the other hand, when using log information at the operation unit level that can be obtained regardless of the target system such as user interface logs, although there are methods for visualizing each operation such as automatic generation technology for explanatory texts for operation logs, the granularity is too fine and it is difficult to grasp the overall picture.

[0004] Therefore, in order to grasp the overall picture of the operation log, it is necessary to appropriately cut off the information of branches and leaves and increase the abstraction level by extracting features, etc.

[0005] Business Improvement Support Technology Supporting Wide Deployment and Application of DX Measures https: / / journal.ntt.co.jp / article / 26203 (searched on August 6, 2024)

[0006] In the prior art, information at the operation unit level that can be easily obtained is directly used for analysis and visualization, and it is difficult to increase the abstraction level and analyze and visualize the entire operation log from an overview perspective.

[0007] The present invention has been made in view of such circumstances, and aims to provide an operation log abstraction device, method, and program that can handle the structuring of data using information on the relevance of each element of the operation log, thereby increasing the abstraction level of the operation log.

[0008] A first embodiment for achieving the above objective is an operation log abstraction device comprising: an analysis target log database in which analysis target logs are stored; an operation log database in which operation logs collected in the past are stored on a case-by-case basis; a log database reading unit that reads operation logs from the operation log database on a case-by-case basis; a similarity calculation unit that calculates the similarity between a portion of the analysis target logs and the operation logs read on a case-by-case basis by the log database reading unit; a similar log extraction unit that extracts operation logs similar to the analysis target logs from the operation logs read on a case-by-case basis by the log database reading unit based on the similarity; and an operation log size calculation unit that calculates the operation log size, which is the average size of the operation logs extracted by the similar log extraction unit.

[0009] The second embodiment is an operation log abstraction device of the first embodiment, which treats operations within the range of the operation log size, including operations before and after a certain operation in the log to be analyzed, as operations related to a certain operation in the log to be analyzed.

[0010] The third aspect is an operation log abstraction method in which the processor performs the following actions: read operation logs for each case from an operation log database in which operation logs collected in the past are stored on a case-by-case basis; calculate the similarity between a portion of the logs to be analyzed and the operation logs read for each case; extract operation logs similar to the logs to be analyzed from the operation logs read for each case based on the similarity; and calculate the operation log size, which is the average size of the extracted operation logs.

[0011] The fourth aspect is a program for causing a computer to function as a log database reading unit, a similarity calculation unit, a similar log extraction unit, and an operation log size calculation unit, which are included in the operation log abstraction device of the first aspect.

[0012] According to the present invention, by handling data structuring using information on the relationships between each element of the operation log and increasing the level of abstraction, it is possible to provide an operation log abstraction device, method, and program that are excellent for overviewing and visualizing the entire operation log.

[0013] Figure 1 is a block diagram showing an example configuration of an operation log abstraction device to which the operation log abstraction method according to this embodiment is applied. Figure 2 shows an example of extracting a group of operation logs similar to the log to be analyzed. Figure 3 shows an example of the co-occurrence range. Figure 4 is a simplified diagram showing the hardware configuration of a typical computer. Figure 5 shows an example of the operation of the operation log abstraction device according to this embodiment.

[0014] Embodiments of the present invention will be described below with reference to the drawings. The drawings are schematic or conceptual, and in this specification and in each drawing, elements similar to those described in previously shown drawings are denoted by the same reference numerals, and detailed or redundant explanations are omitted as appropriate.

[0015] The operation log abstraction device, method, and program according to this embodiment structure task mining using a co-occurrence network used in text mining. A co-occurrence network is used when you want to grasp the general content of a document without reading the entire content.

[0016] When attempting to apply co-occurrence network diagrams to task mining, a problem arises in how to define the scope to be treated as co-occurrence. In text mining, words appearing within semantic segments are often treated as related terms, but operation logs do not have such segments. Therefore, the operation log abstraction device, method, and program according to this embodiment treat operations that appear within the size of the cases included in the log to be analyzed as related operations.

[0017] Figure 1 is a block diagram showing an example configuration of an operation log abstraction device to which the operation log abstraction method according to this embodiment is applied.

[0018] The operation log abstraction device 1 according to this embodiment includes an analysis target log database storage unit 10 (hereinafter referred to as "analysis target log DB storage unit 10"), an input unit 20, an operation log database storage unit 30 (hereinafter referred to as "operation log DB storage unit 30"), a related operation range calculation unit 40, and an output unit 50.

[0019] The log database storage unit 10 stores the log database 10A (hereinafter referred to as "log database 10A"). The log database 10A stores the log α1 to be analyzed. The log α1 to be analyzed is provided to the input unit 20 as input.

[0020] The input unit 20 receives the analysis target log α1 provided from the analysis target log DB 10A as input, and provides the received analysis target log α1 to the related operation range calculation unit 40.

[0021] The operation log DB storage unit 30 stores the operation log database 30A (hereinafter referred to as "operation log DB 30A"). The operation log DB 30A stores operation logs α2 collected in the past on a case-by-case basis. A case refers to the entire process from the start to the end of work in a particular case, such as the identifier for each slip in the purchase slip work for each slip.

[0022] The operation log abstraction device 1 assumes that the operation log DB 30A stores a set of processes from the start to the end of an operation.

[0023] The related operation range calculation unit 40 includes a log database reading unit 41 (hereinafter referred to as "log DB reading unit 41"), a similarity calculation unit 42, a similar log extraction unit 43, and an operation log size calculation unit 44.

[0024] The log DB reading unit 41 receives the analysis target log α1 provided from the input unit 20 and outputs the received analysis target log α1 to the similarity calculation unit 42. The log DB reading unit 41 also reads the operation log α2 from the operation log DB storage unit 30 for each case and outputs the read operation log α2 to the similarity calculation unit 42.

[0025] The similarity calculation unit 42 receives the analysis target log α1 and operation log α2 output from the log DB reading unit 41. It then calculates the similarity α3 between a portion of the analysis target log α1 and the operation log α2, and outputs the calculated similarity α3 along with the analysis target log α1 and operation log α2 to the similarity log extraction unit 43.

[0026] The similarity log extraction unit 43 receives the analysis target log α1, operation log α2, and similarity score α3 output from the similarity calculation unit 42. Based on the similarity score α3, it extracts operation logs α2 that are similar to the analysis target log α1, and outputs the extracted operation logs α2 to the operation log size calculation unit 44.

[0027] The operation log size calculation unit 44 calculates the operation log size α4 based on the operation log α2 output from the similar log extraction unit 43. The operation log size α4 is the average size of the operation log α2 group extracted by the similar log extraction unit 43. Operations within the range of the operation log size α4, which includes the operations before and after a particular operation in the log α1 under analysis, are treated as operations related to that particular operation in the log α1 under analysis.

[0028] For example, as shown in Figure 2, if the similarity log extraction unit 43 extracts four groups of operation logs α2 from the operation log α2 as operation logs α2 similar to the log α1 to be analyzed, the operation log size calculation unit 44 calculates "4" as the operation log size α4. When the operation log size α4 is "4", operations within four ranges before and after a certain operation in the log α1 to be analyzed are treated as operations related to that operation in the log α1 to be analyzed.

[0029] The operation log size calculation unit 44 outputs the calculated operation log size α4 to the output unit 50.

[0030] The output unit 50 outputs the operation log size α4 output from the operation log size calculation unit 44. The output unit 50 can be, for example, a display. If the output unit 50 is implemented as a display, the output unit 50 outputs the operation log size α4 by displaying it on the display.

[0031] The related operation range calculation unit 40 performs these processes for all operation logs α2, thereby enabling structuring of the operation logs α2 using co-occurrence relationships.

[0032] As mentioned above, the operation log abstraction device 1 assumes that the operation log DB 30A stores a set of processes from the start to the end of an operation. Based on this, the operation log size α4, which indicates the size of the case contained in the operation log α2 to be processed, is estimated from similar cases in operation log α2, and the range to be treated as co-occurrence is calculated.

[0033] For example, as shown in Figure 3(a), in the case of text mining, there are text mining methods that focus on co-occurring words, such as co-occurrence ranges 1 and 2, which target natural language. This makes it possible to visualize the structural features of text.

[0034] Furthermore, as shown in Figure 3(b), in the case of task mining, operations that appear within the size of the cases included in the log being analyzed, such as operation 1, operation 2, operation 3, operation 4, operation 5, etc., are treated as related operations.

[0035] In this way, the operation log abstraction device 1 can perform analysis and visualization of the operation log α2 at a higher level of abstraction by structuring the operation log α2 using co-occurrence relationships.

[0036] Such an operation log abstraction device 1 can be implemented using a computer such as a PC.

[0037] Figure 4 is a simplified diagram showing the hardware configuration of a typical computer.

[0038] Computer 100 receives some kind of input from the outside, processes it, and outputs the result to the outside. Input is handled by input device 120, and output is handled by output device 140. CPU (Central Processing Unit) 110 controls the entire flow of data and processing, and performs calculations and other processing. In Figure 4, solid arrows represent the flow of data, and dashed arrows represent the flow of control.

[0039] For the computer 100 to perform processing, a program describing the processing procedure is required. The program contains a series of instructions and the data used by the instructions, and all of these are temporarily placed in the memory 130. The CPU 110 fetches the instructions in the memory 130 one by one, interprets the instructions, and operates according to the instructions.

[0040] Therefore, the operation log abstraction apparatus 1 according to the present embodiment is realized by the operation of the CPU 110 according to the program stored in the memory 130.

[0041] Although not shown in FIG. 4, the computer 100 can incorporate a storage device such as an SSD (Solid State Drive) or an HDD (Hard Disk Drive). The analysis target log database storage unit 10 and the operation log database storage unit 30 can be realized by such an incorporated storage device. Further, the analysis target log database storage unit 10 and the operation log database storage unit 30 are not limited to these incorporated storage devices, and can also be realized in an area provided in a storage system such as an external storage medium such as a USB (Universal Serial Bus) memory or a database server arranged in the cloud. In FIG. 1, the analysis target log database storage unit 10 and the operation log database storage unit 30 are shown as individual storage units for clarity, but the analysis target log database storage unit 10 and the operation log database storage unit 30 may be physically the same storage device.

[0042] Next, an operation example of the operation log abstraction apparatus 1 according to the present embodiment will be described.

[0043] FIG. 5 is a diagram showing an operation example of the operation log abstraction apparatus 1 according to the present embodiment.

[0044] The analysis target log DB storage unit 10 stores an analysis target log DB 10A, and the analysis target log DB 10A stores an analysis target log α1.

[0045] The analysis target log α1 is provided to the input unit 20. The analysis target log α1 is received by the input unit 20 and further provided to the related operation range calculation unit 40.

[0046] The analysis target log α1 provided to the related operation range calculation unit 40 is provided to the log DB reading unit 41 and output to the similarity calculation unit 42 by the log DB reading unit 41. Also, in the log DB reading unit 41, the operation log α2 is read from the operation log DB storage unit 30 for each case and output to the similarity calculation unit 42.

[0047] The analysis target log α1 and the operation log α2 output from the log DB reading unit 41 are received by the similarity calculation unit 42. Then, in the similarity calculation unit 42, the similarity α3 between a part of the analysis target log α1 and the operation log α2 is calculated, and the calculated similarity α3 is output to the similar log extraction unit 43 together with the analysis target log α1 and the operation log α2.

[0048] The analysis target log α1, the operation log α2, and the similarity α3 output from the similarity calculation unit 42 are received by the similar log extraction unit 43. Then, in the similar log extraction unit 43, the operation log α2 similar to the analysis target log α1 is extracted based on the similarity α3, and the extracted operation log α2 is output to the operation log size calculation unit 44.

[0049] In FIG. 5, as groups of operation logs α2 similar to the analysis target log α1 (a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p, q, r, s, t, u, a, b, c, d, e, f, g), three operation logs α2-1 (a, b, c, d, e, f, g), α2-2 (a, b, c, e, e), and α2-5 (k, l, m, n, o, p, q) read for each case are illustrated. The English letters (a to z) in the operation log α2 (α2-1 to 5) represent each line of the operation log.

[0050] The operation log size calculation unit 44 calculates the operation log size α4 based on the operation log α2 output from the similar log extraction unit 43. The operation log size α4 is the average size of the group of operation logs α2 extracted by the similar log extraction unit 43. In the example shown in Figure 5, the operation log size α4 is "6". In this case, operations within a range of 6 before and after a certain operation (in the example of Figure 5, "g") in the log α1 under analysis are considered to be related to "g".

[0051] By performing the above process for all operations, it is possible to obtain the relationships between operations in the analyzed log α1.

[0052] For example, as shown in Figure 3(a), in the case of text mining, there are text mining methods that focus on co-occurring words when targeting natural language. This makes it possible to visualize the structural features of text.

[0053] Furthermore, as shown in Figure 3(b), in the case of task mining, we can use operations 1, 2, 3, 4, 5, and so on.

[0054] In this way, the operation log abstraction device 1 can perform analysis and visualization of the operation log α2 at a higher level of abstraction by structuring the operation log α2 using co-occurrence relationships.

[0055] In text mining, the difference between treating phrases as co-occurrence ranges and treating them as co-occurrence ranges using average size, as in the operation log abstraction device 1 according to this embodiment, is that when phrases are treated as co-occurrence ranges, there is no overlap in the co-occurrence ranges, but when using average size as the co-occurrence range, the determination of whether a certain range before and after each operation is a co-occurrence range is performed for all operations, resulting in overlap.

[0056] As described above, an abstraction device to which the operation log abstraction method according to this embodiment is applied can increase the level of abstraction of the operation log by assigning an appropriate range to be treated as related operations based on information from similar logs for operation logs that do not have semantic divisions such as phrases, and then structuring them using co-occurrence relationships, thereby improving the overall analysis and visualization of the operation log.

[0057] This technology can be applied to visualization applications that allow users to understand the work content without having to read the entire operation log, for example, by visualizing the operation log as a co-occurrence network diagram.

[0058] The present invention is not limited to the embodiments described above, and in the implementation stage, the components can be modified and implemented without departing from the spirit of the invention. Furthermore, various inventions can be formed by appropriately combining the multiple components disclosed in the above embodiments. For example, some components may be deleted from all the components shown in the embodiments. Moreover, components from different embodiments may be appropriately combined.

[0059] 1 Operation log abstraction device 10 Log database storage unit for analysis 10A Log database for analysis 20 Input unit 30 Operation log database storage unit 30A Operation log database 40 Related operation range calculation unit 41 Log database reading unit 42 Similarity calculation unit 43 Similar log extraction unit 44 Operation log size calculation unit 50 Output unit 100 Computer 110 CPU 120 Input device 130 Memory 140 Output device a-z Each line of the operation log α1 Log for analysis α2 Operation log α3 Similarity α4 Operation log size

Claims

1. An operation log abstraction device comprising: an analysis target log database in which analysis target logs are stored; an operation log database in which operation logs collected in the past are stored on a case-by-case basis; a log database reading unit that reads the operation logs from the operation log database on a case-by-case basis; a similarity calculation unit that calculates the similarity between a portion of the analysis target logs and the operation logs read by the log database reading unit on a case-by-case basis; a similar log extraction unit that extracts operation logs similar to the analysis target logs from the operation logs read by the log database reading unit on a case-by-case basis based on the similarity; and an operation log size calculation unit that calculates the operation log size, which is the average size of the operation logs extracted by the similar log extraction unit.

2. The operation log abstraction device according to claim 1, wherein operations within the range of the operation log size, including those before and after a certain operation in the log to be analyzed, are treated as operations related to the certain operation in the log to be analyzed.

3. An operation log abstraction method, wherein the processor performs the following steps: read operation logs for each case from an operation log database in which operation logs collected in the past are stored on a case-by-case basis; calculate the similarity between a portion of the logs to be analyzed and the operation logs read for each case; extract operation logs similar to the logs to be analyzed from the operation logs read for each case based on the similarity; and calculate the operation log size, which is the average size of the extracted operation logs.

4. A program for causing a computer to function as the log database reading unit, the similarity calculation unit, the similar log extraction unit, and the operation log size calculation unit, which are included in the operation log abstraction device according to claim 1.

Images