Log division device, method, and program

Abstract

A log division device according to the present invention comprises: an analysis-target log database in which analysis-target logs are accumulated; an operation log database in which operation logs collected in the past are accumulated on a case-by-case basis; a log database reading unit that reads operation logs for each case from the operation log database; a similarity calculation unit that calculates similarity between a part of the analysis-target logs and the operation logs; and a division determination unit that determines a division point in the analysis-target logs on the basis of changes in the similarity.

Description

Log Splitting Device, Method, and Program

[0001] The present invention relates to a log splitting device, method, and program that enable case-by-case splitting even for logs that do not satisfy specific properties required for analysis.

[0002] In recent years, the technique of process mining has been in the spotlight for current situation analysis for business improvement.

[0003] However, in order to obtain log information of the granularity commonly used in process mining, it is often necessary to have access to server-side information or to have an interface for the system side to extract information, and it can only be realized in a favorable environment.

[0004] Therefore, it is necessary to convert generally obtained information into information that can be utilized in process mining regardless of the target system such as user interface logs obtained in task mining. To achieve this, there is a method of splitting logs on a case-by-case basis.

[0005] As a simple method to achieve this, it is conceivable to determine start and end operations for each case according to rules and determine the separation of cases.

[0006] However, in this method, in a situation where it is difficult to define start and end operations of a case, it is impossible to classify logs for each case based on operation actions.

[0007] For example, in the case of a single operation on the system screen of a screen, the screen transition becomes the timing. However, for example, when operations on multiple screens are conditions, it is impossible to determine whether an operation on a specific GUI component is the start and end.

[0008] Also, as another method, there is a method of inferring the separation of cases by using the co-occurrence between operations of a process.

[0009] However, this method is based on the co-occurrence of screen and operation characteristics between operations, and there are limitations to operation logs that can be split with sufficient accuracy, such as when a case is repeated a sufficient number of times within a single log.

[0010] NTT Research and Development “Operation process classification type business design support technology” https: / / www.rd.ntt / research / AS0088.html#:~:text=%E6%93%8D%E4%BD%9C%E3%83%97%E3%83%AD%E3% 82%BB%E3%82%B9%E5%88%86%E9%A1%9E,%E6%8A%80%E8%A1%93%E3%81%A7%E3%81%99%EF%BC%88%E5%9B%B3%EF%BC%89%E3%80%82 (searched on August 8, 2020)

[0011] Thus, while the conventional method of dividing logs into individual cases is effective for logs that meet certain characteristics, it is not effective for logs that do not.

[0012] This invention has been made in view of these circumstances, and aims to provide a log splitting device, method, and program that enable splitting into individual cases even for logs that do not satisfy certain properties necessary for analysis, such as co-occurrence of recurring cases.

[0013] To achieve the above objective, a first aspect of the present invention is a log splitting device comprising: an analysis target log database in which analysis target logs are stored; an operation log database in which operation logs collected in the past are stored on a case-by-case basis; a log database reading unit that reads operation logs from the operation log database on a case-by-case basis; a similarity calculation unit that calculates the similarity between a part of the analysis target log and the operation logs; and a splitting determination unit that determines the splitting point in the analysis target log based on the change in similarity.

[0014] A second aspect of the present invention is a log splitting device according to the first aspect, wherein the splitting determination unit splits the log to be analyzed at the splitting point, and the log splitting device further includes a split-analyze log database for storing the split-analyze logs, which are the split-analyze logs.

[0015] A third aspect of the present invention is a log splitting method in which a processor performs the following actions: read operation logs for each case from an operation log database in which operation logs collected in the past are stored on a case-by-case basis; calculate the similarity between a portion of the logs to be analyzed and the operation logs; and determine the splitting of the logs to be analyzed based on the change in similarity.

[0016] A fourth aspect of the present invention is a program for causing a computer to function as a log database reading unit, a similarity calculation unit, and a division determination unit, which are included in the log division device of the first aspect.

[0017] According to the log splitting device, method, and program of the present invention, it is possible to perform process splitting on a case-by-case basis even for logs that do not satisfy certain properties necessary for analysis, such as co-occurrence of cases.

[0018] Figure 1 is a block diagram showing an example configuration of a log partitioning device to which the log partitioning method according to this embodiment is applied. Figure 2 is an example of a program that implements repetitive processing. Figure 3 is a simplified diagram showing the hardware configuration of a computer. Figure 4 is a diagram showing an example of operation of the log partitioning device 1 according to this embodiment.

[0019] Embodiments of the present invention will be described below with reference to the drawings. In this specification and in each drawing, elements similar to those described in previously shown drawings are denoted by the same reference numerals, and detailed descriptions and redundant explanations are omitted as appropriate.

[0020] Figure 1 is a block diagram showing an example configuration of a log partitioning device to which the log partitioning method according to this embodiment is applied.

[0021] The log splitting device 1 comprises an analysis target log database storage unit 10 (hereinafter referred to as "analysis target log DB storage unit 10"), an input unit 20, an operation log database storage unit 30 (hereinafter referred to as "operation log DB storage unit 30"), a log database reading unit 40 (hereinafter referred to as "log DB reading unit 40"), a splitting processing unit 50, an output unit 60, and a split analysis target log database storage unit 70 (hereinafter referred to as "split analysis target log DB storage unit 70").

[0022] The analysis target log DB storage unit 10 stores the analysis target log database 10A (hereinafter referred to as "analysis target log DB 10A"). Analysis target log α1 is stored in the analysis target log DB 10A. Analysis target log α1 is provided as input to the input unit 20. Each row of the input analysis target log α1, that is, the analysis target log α1 stored in the analysis target log DB 10A, includes, for example, time (operation time) and operation (operation details, for example, the value of the GUI component that was operated).

[0023] The input unit 20 receives the log α1 to be analyzed from the log DB 10A as input, and provides the received log α1 to the log DB reading unit 40.

[0024] The operation log DB storage unit 30 stores the operation log database 30A (hereinafter referred to as "operation log DB 30A"). The operation log DB 30A stores operation logs α2 collected in the past, separated by case, that is, on a case-by-case basis. A case is a general term for a series of processes from the start to the end of work in a particular case, such as the identifier for each slip in the purchase slip work for each slip.

[0025] In the log partitioning device 1, it is assumed that the operation log DB 30A stores a set of processes from the start to the end of an operation.

[0026] The log DB reading unit 40 receives the analysis target log α1 provided from the input unit 20 and outputs the received analysis target log α1 to the splitting processing unit 50. The log DB reading unit 40 also reads the operation log α2 from the operation log DB storage unit 30 for each case and outputs the read operation log α2 to the splitting processing unit 50.

[0027] The division processing unit 50 includes a similarity calculation unit 52 and a division determination unit 54.

[0028] The similarity calculation unit 52 receives the analysis target log α1 and operation log α2 output from the log DB reading unit 40. Then, it calculates the similarity between a portion of the analysis target log α1 and the operation log α2.

[0029] The similarity is calculated and output to the segmentation determination unit 54 along with the analysis target log α1.

[0030] A specific example of how the similarity calculation unit 52 calculates the similarity is described below.

[0031] The similarity calculation unit 52 first calculates the similarity between the operation log group α2 in the operation log DB 30A and the 1st to ith analysis target logs α1 in the analysis target log DB 10A. This is done by proceeding through the target analysis target logs α1 in the analysis target log DB 10A one by one, that is, by incrementing i by one each time, and calculating the similarity. Then, when the similarity decreases, for example, between the ith and (i+1)th logs, this is designated as the split point. Next, the same process is repeated from the (i+1)th log to the end of the analysis target logs α1. Figure 2 is an example of a program that implements such repetitive processing.

[0032] Furthermore, the similarity between the kth row to the (k+i)th row of the analysis target log α1 and the operation log group α2 of the operation log DB30A can be calculated using a general data similarity calculation method that has a specific order, such as the business improvement support technology described in Non-Patent Document 1.

[0033] The division determination unit 54 receives the analysis target log α1 and the similarity score output from the similarity calculation unit 52. Based on the change in similarity score, it determines the division point of the analysis target log α1, divides the analysis target log α1 at the division point, and outputs the divided analysis target log α3, which is the divided analysis target log α1, to the output unit 60.

[0034] The above-described processing performed by the similarity calculation unit 52 and the division determination unit 54 of the division processing unit 50 is repeated as needed, and each time, the divided analysis target log α3 is output to the output unit 60.

[0035] The output unit 60 receives the divided analysis target log α3 output from the division determination unit 54. Then, it outputs the divided analysis target log α3 to the divided analysis target log database storage unit 70.

[0036] The partitioned analysis target log DB storage unit 70 stores the partitioned analysis target log database 70A (hereinafter referred to as "partitioned analysis target log DB 70A") in which the partitioned analysis target log α3 is stored. When the partitioned analysis target log α3 is output from the output unit 60, the partitioned analysis target log DB storage unit 70 stores the partitioned analysis target log α3 in the partitioned analysis target log DB 70A.

[0037] Each line in the logs stored in the analysis target DB10A, operation log DB30A, and partitioned analysis target log DB70A contains, for example, time (operation time) and operation (operation details, such as the value of the GUI component operated on).

[0038] Such a log partitioning device 1 can be implemented using a computer such as a PC.

[0039] Figure 3 is a simplified diagram showing the hardware configuration of a typical computer.

[0040] Computer 100 receives some kind of input from the outside, processes it, and outputs the result to the outside. Input is handled by input device 120, and output is handled by output device 140. CPU (Central Processing Unit) 110 controls the entire flow of data and processing, and performs calculations and other processing. In Figure 3, solid arrows represent the flow of data, and dashed arrows represent the flow of control.

[0041] For computer 100 to perform processing, it needs a program that describes the processing procedure. The program contains a series of instructions and the data used by those instructions, all of which are temporarily stored in memory 130. CPU 110 retrieves the instructions from memory 130 one by one, interprets the instructions, and operates according to those instructions.

[0042] Therefore, the log partitioning device 1 in this embodiment is realized by the CPU 110 operating according to a program stored in the memory 130.

[0043] Although not shown in FIG. 3, the computer 100 can incorporate a storage device such as an SSD (Solid State Drive) or an HDD (Hard Disk Drive). The analysis target log DB storage unit 10, the operation log DB storage unit 30, and the divided analysis target log DB storage unit 70 can be realized by such an incorporated storage device. Further, the analysis target log DB storage unit 10, the operation log DB storage unit 30, and the divided analysis target log DB storage unit 70 are not limited to these incorporated storage devices, and can be realized, for example, in an area provided in an external storage medium such as a USB (Universal Serial Bus) memory or a storage system such as a database server arranged in the cloud. In FIG. 1, the analysis target log DB storage unit 10, the operation log DB storage unit 30, and the divided analysis target log DB storage unit 70 are shown as individual storage units for clarity, but these storage units may be physically the same storage device.

[0044] Next, an operation example of the log splitting device 1 according to the present embodiment will be described.

[0045] FIG. 4 is a diagram showing an operation example of the log splitting device 1 according to the present embodiment.

[0046] The analysis target log DB 10A is stored in the analysis target log DB storage unit 10. The analysis target log α1 is accumulated in the analysis target log DB 10A. The analysis target log α1 is provided as an input to the input unit 20.

[0047] The analysis target log α1 provided from the analysis target log DB 10A is received as an input by the input unit 20 and provided to the log DB reading unit 40.

[0048] The operation log DB 30A is stored in the operation log DB storage unit 30. In the operation log DB 30A, the operation logs α2 collected in the past are separated for each case and accumulated in units of cases.

[0049] The log α1 to be analyzed, provided from the input unit 20 to the log DB reading unit 40, is further output from the log DB reading unit 40 to the partitioning processing unit 50. The log DB reading unit 40 also reads operation logs α2 from the operation log DB storage unit 30 for each case and outputs them to the partitioning processing unit 50.

[0050] In the splitting processing unit 50, the analysis target log α1 and operation log α2 output from the log DB reading unit 40 are received by the similarity calculation unit 52. The similarity calculation unit 52 then calculates the similarity between a portion of the analysis target log α1 and the operation log α2, and outputs the calculated similarity along with the analysis target log α1 to the splitting determination unit 54.

[0051] The division determination unit 54 determines the division point of the analysis target log α1 based on the change in similarity. Then, at the division point, the analysis target log α1 is divided, and the divided analysis target log α3 is obtained. The divided analysis target log α3 is the analysis target log α1 divided into case units.

[0052] The segmented analysis target log α3 is output from the segmentation determination unit 54 to the output unit 60, and further output by the output unit 60 to the segmented analysis target log DB storage unit 70, where it is stored in the segmented analysis target log DB 70A.

[0053] As described above, according to the log splitting device 1 to which the log splitting method of this embodiment is applied, by repeatedly comparing a case in the set of operation logs α2 separated by case with a part of the log α1 to be analyzed, the device automatically extracts splitting points that indicate the case separation in the log α1 to be analyzed which are similar to the operation logs α2 stored for each case in the operation log DB 30A, and splits the log α1 to be analyzed at the extracted splitting points.

[0054] This is done by matching similar parts of the pre-stored operation log α2 with the log α1 to be analyzed from the top down, and then dividing the log α1 to be analyzed into individual cases.

[0055] This makes it possible to divide the process for each case, even for analysis target log α1 that does not satisfy the specific properties necessary for analysis using co-occurrence such as case repetition, without having to define prior rules for the start and end operations for each case.

[0056] Furthermore, the segmented analysis target log α3 obtained by segmentation by the log segmentation device 1 can be used to automatically generate the contents of the log DB, similar to the method using the operation process classification type business design support technology disclosed in Non-Patent Document 1.

[0057] The present invention is not limited to the embodiments described above, and in the implementation stage, the components can be modified and implemented without departing from the spirit of the invention. Furthermore, various inventions can be formed by appropriately combining the multiple components disclosed in the above embodiments. For example, some components may be deleted from all the components shown in the embodiments. Moreover, components from different embodiments may be appropriately combined.

[0058] 1 Log splitting device 10 Log database storage unit for analysis 10A Log database for analysis 20 Input unit 30 Operation log database storage unit 30A Operation log database 40 Log database reading unit 50 Splitting processing unit 52 Similarity calculation unit 54 Splitting determination unit 60 Output unit 70 Split log database storage unit for analysis 70A Split log database for analysis 100 Computer 120 Input device 130 Memory 140 Output device α1 Log for analysis α2 Operation log α3 Split log for analysis

Claims

1. A log splitting device comprising: an analysis target log database in which analysis target logs are stored; an operation log database in which operation logs collected in the past are stored on a case-by-case basis; a log database reading unit that reads the operation logs from the operation log database on a case-by-case basis; a similarity calculation unit that calculates the similarity between a portion of the analysis target logs and the operation logs; and a splitting determination unit that determines the splitting point in the analysis target logs based on the change in the similarity.

2. The log splitting device according to claim 1, wherein the splitting determination unit splits the analysis target log at the splitting point, and the log splitting device further comprises a split analysis target log database for storing the split analysis target logs which are the split analysis target logs.

3. A log splitting method in which a processor performs the following actions: read operation logs for each case from an operation log database in which operation logs collected in the past are stored on a case-by-case basis; calculate the similarity between a portion of the logs to be analyzed and the operation logs; and determine the splitting of the logs to be analyzed based on the change in the similarity.

4. A program for causing a computer to function as the log database reading unit, the similarity calculation unit, and the division determination unit of the log division device according to claim 1.

Images