JP7104376B2 - Inference rule generation support device, inference rule generation support method, and program - Google Patents

Description

The present invention relates to an inference rule generation support device that supports the generation of inference rules, an inference rule generation support method, and a program for realizing these.

In recent years, inference techniques have been developed to improve the efficiency of decision-making by presenting hypotheses of possible events and their grounds in an easy-to-understand manner using a wide variety of information. The inference technique is a technique for executing inference based on predicate logic (inference rule) composed of a premise part and a consequent part, and presenting a process from a fact to a conclusion, or a basis, or both.

In such inference techniques, it is desired to establish a method for efficiently generating high-quality inference rules. The reason is that, at present, stable generation of high-quality inference rules is not guaranteed because it requires manual labor to generate inference rules. Furthermore, it is not possible to efficiently generate inference rules due to human intervention.

Non-Patent Document 1 and Non-Patent Document 2 are known as related techniques. Non-Patent Document 1 discloses a method of deriving an implication relationship between language patterns from a large-scale document handled on the Web or the like by using machine learning. Further, Non-Patent Document 2 discloses a method of deriving a causal relationship from a large-scale document by using machine learning.

Julien Kloetzer, 3 outsiders, “Large-Scale Acquisition of Entailment Pattern Pairs by Exploiting Transitivity”, Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing, pages 1649-1655, Lisbon Portugal 17-21 September 2015, Association for Computational Linguistics Chikara Hashimoto, 3 outsiders, “Generating Event Causality Hypotheses through Semantic Relations”, [online], February 19, 2015, Proceedings of the Twenty-Ninth AAAI Conference on Artificial Intelligence, [Search June 5, 2018 ], Internet <URL: https://www2.kbs.uni-hannover.de/fileadmin/institut/pdf/webscience/2015-16/papers/9854-44405-1-PB.pdf>

However, although there is a disclosure in the techniques disclosed in Non-Patent Documents 1 and 2 that derives the relationship between a single premise part and a single consequent part, a single consequent part is derived from a plurality of premise parts. There is no disclosure. Further, in the inference rule, the relationship between the premise part and the consequent part must be a relationship in which the consequent part can be derived from the premise part, so that it is probabilistic as disclosed in the techniques of Non-Patent Documents 1 and 2. Relationship scores cannot be applied to inference rules.

In addition, the reason why it is difficult to manually create an inference rule that covers the premise part is, for example, "when premise A and premise B are satisfied (premise part), the activity of a certain malware W is recognized. (Consequent part) ”is supposed to be created, but the creator may mistakenly lack the description of“ Assumption B ”. That is, the following erroneous inference rule that "when the premise A is satisfied, the activity of a certain malware W is recognized" may be created. Then, if such an erroneous inference rule is used, an erroneous inference result will be derived.

Furthermore, it is assumed that the creator creates an inference rule "when the attached file is opened (premise part), malware W is activated (result part)". However, in reality, there are malware other than malware W that infects and acts by opening an attached file. Therefore, the premise part in the above-mentioned inference rule does not satisfy the sufficient condition for deriving the consequent part. That is, the premise part in the above-mentioned inference rule is correct as a necessary condition, but does not satisfy the precondition for deriving the consequent part, and is inaccurate as an inference rule.

In this way, when the inference rule is automatically created manually or by machine, the premise part may not meet the sufficient conditions for deriving the consequent part, so a high-quality inference rule can be efficiently generated. Can not do it.

An example of an object of the present invention is to provide an inference rule generation support device, an inference rule generation support method, and a program for efficiently generating high-quality inference rules.

In order to achieve the above object, the inference rule generation support device in one aspect of the present invention is used.
Event-related dictionary information composed of a plurality of event-related information in which the front event information and the rear event information are associated with each other by the relationship name information using the rule information representing the rule relationship between the preceding information and the following information. To obtain the event-related information to be used for constructing an event path from the front event information that is the starting point that matches the preceding information to the rear event information that is the ending point that matches the following information. A generation unit that generates the previous event information by concatenating the event-related information other than the event-related information having the rear event information that is the end point that matches the subsequent event information among the acquired event-related information. When,
It is characterized by having.

Further, in order to achieve the above object, the inference rule generation support method in one aspect of the present invention is provided.
(A) An event relationship composed of a plurality of event relationship information in which the front event information and the rear event information are associated with each other by the relationship name information using the rule information representing the rule relationship between the preceding information and the following information. Referencing the dictionary information, the event-related information used for constructing an event path from the front event information that is the starting point that matches the preceding information to the rear event information that is the ending point that matches the following information. Of the steps to be acquired and (b) the acquired event-related information, the event-related information other than the event-related information having the rear event information that is the end point that matches the subsequent information is concatenated to obtain the previous event information. Generate, step and
It is characterized by having.

Further, in order to achieve the above object, the program in one aspect of the present invention is:
On the computer
(A) An event relationship composed of a plurality of event relationship information in which the front event information and the rear event information are associated with each other by the relationship name information using the rule information representing the rule relationship between the preceding information and the following information. Referencing the dictionary information, the event-related information used for constructing an event path from the front event information that is the starting point that matches the preceding information to the rear event information that is the ending point that matches the following information. Of the steps to be acquired and (b) the acquired event-related information, the event-related information other than the event-related information having the rear event information that is the end point that matches the subsequent information is concatenated to obtain the previous event information. Generate, step and
Is characterized by executing.

As described above, according to the present invention, high-quality inference rules can be efficiently generated.

FIG. 1 is a diagram showing an example of an inference rule generation support device. FIG. 2 is a diagram showing an example of a system having an inference rule generation support device. FIG. 3 is a diagram for explaining the acquisition unit. FIG. 4 is a diagram showing an example of conversion information. FIG. 5 is a diagram showing an example of the operation of the inference rule generation support device. FIG. 6 is a diagram showing an image of the event path. FIG. 7 is a diagram showing an example of a computer that realizes an inference rule generation support device.

(Embodiment)
Hereinafter, embodiments of the present invention will be described with reference to FIGS. 1 to 7.

[Device configuration]
First, the configuration of the inference rule generation support device according to the present embodiment will be described with reference to FIG. FIG. 1 is a diagram showing an example of an inference rule generation support device.

The inference rule generation support device 1 according to the present embodiment shown in FIG. 1 is an apparatus for efficiently generating high-quality inference rules. As shown in FIG. 1, the inference rule generation support device 1 has an acquisition unit 2 and a generation unit 3.

Of these, the acquisition unit 2 uses the rule information representing the rule relationship between the previous case information and the latter case information, and uses a plurality of event-related information in which the front event information and the rear event information are associated with each other by the relationship name information. Event-related information used to construct an event path from the front event information, which is the starting point that matches the previous information, to the rear event information, which is the ending point that matches the subsequent information, by referring to the configured event-related dictionary information. To get. The generation unit 3 generates new antecedent information by concatenating the event-related information other than the event-related information having the rear event information that is the end point that matches the consequent information among the acquired event-related information.

The rule information is information representing an inference rule expressed by predicate logic or the like, and can be expressed as, for example, "antecedent information => consequent information". The antecedent information represents the premise part in the inference rule expressed by predicate logic and the like, and the consequent information represents the consequent part in the inference rule expressed by predicate logic and the like. The symbol "=>" is a symbol representing an implication relationship. Specifically, the rule information can be expressed as the following predicate logic.
exists (″ Attachment ″) => act (″ Malware W ″)

The form of predicate logic is not limited to the above-mentioned form.

The event-related information is information representing a relationship between two events (entities), and can be expressed as, for example, "" front event information "<relationship name information>" rear event information "". .. The front event information and the rear event information represent two different events. The relationship name information represents the relationship between the antecedent event and the consequent event. Specifically, a plurality of event-related information can be expressed as follows. The details will be described later.

"Kaminsky Attack"<synonym>"KaminskyAttack"
"KaminskyAttack"<p:cause>"InformationLeakage"
″ DNSSEC ″ <p: prevents> ″ Kaminsky Attack ″
″ Attachment ″ <hasInstance> ″ Hoge.docx ″
″ Attachment ″ <hasInstance> ″ Hoge.xlsx ″
″ Hoge.docx ″ <p: drop> ″ tasksche.exe ″
″ Hoge.xlsx ″ <p: drop> ″ eviltask.exe ″
″ Tasksche.exe ″ <p: connect> ″ fuga.com ″
″ Eviltask.exe ″ <p: connect> ″ malware.com ″
″ Fuga.com ″ <isIndicationOf> ″ Malware W ″
″ Malware.com ″ <isIndicationOf> ″ Malware Z ″

Further, the plurality of event-related information is stored in a storage unit provided inside the inference rule generation support device 1, a storage unit provided outside the inference rule generation support device 1, or the like.

The event path is based on the front event information, the relation name information, and the rear event information acquired from the event relation information using the target rule information, and is from the front event information which is the starting point that matches the front event information. This is the event path leading to the consequent event information, which is the end point that matches the matter information. Specifically, when the target rule information is the above-mentioned "exists (" attachment ") => act (" malware W ")" and the event-related information is the above-mentioned plurality of event-related information, it is shown below. Acquire event-related information used to construct such an event path. The details will be described later.

″ Attachment ″ <hasInstance> ″ Hoge.docx ″
″ Hoge.docx ″ <p: drop> ″ tasksche.exe ″
″ Tasksche.exe ″ <p: connect> ″ fuga.com ″
″ Fuga.com ″ <isIndicationOf> ″ Malware W ″

The new antecedent information is information that replaces the antecedent information of the target rule information. Specifically, first, each of the event-related information acquired for constructing the event path is converted into the following antecedent information format. The details will be described later.

″ Attachment ″ <hasInstance> ″ Hoge.docx ″
→ exists (″ Hoge.docx ″)
″ Hoge.docx ″ <p: drop> ″ tasksche.exe ″
→ drop (″ Hoge.docx ″, ″ tasksche.exe ″)
″ Tasksche.exe ″ <p: connect> ″ fuga.com ″
→ connect (″ tasksche.exe ″, ″ fuga.com ″)
″ Fuga.com ″ <isIndicationOf> ″ Malware W ″
→ act ("Malware W")

Next, among the converted event-related information, the event-related information other than the event-related information having the rear event information that is the end point that matches the consequent information is concatenated by using a logical product "^" or the like to create a new antecedent. Generate matter information.
exists (″ Hoge.docx ″)
^ Drop ("Hoge.docx", "tasksche.exe")
^ Connect (″ tasksche.exe ″, ″ fuga.com ″)

After that, rule information based on the new antecedent information is generated.
exists (″ Hoge.docx ″)
^ Drop ("Hoge.docx", "tasksche.exe")
^ Connect ("tasksche.exe", "fuga.com") => act ("Malware W")

As described above, in the present embodiment, new information is obtained based on the front event information, the relation name information, and the rear event information used for constructing the event path, which are acquired from the event relation information using the target rule information. By generating the previous information, it is possible to efficiently generate a high-quality inference rule that satisfies the sufficient conditions for the premise part to derive the consequent part.

[System configuration]
Subsequently, with reference to FIG. 2, the configuration of the inference rule generation support device 1 in the present embodiment will be described more specifically. FIG. 2 is a diagram showing an example of a system having an inference rule generation support device.

As shown in FIG. 2, the inference rule generation support device 1 in the present embodiment has a normalization unit 21, an expression extension unit 22, and a logic conversion unit 23 in addition to the acquisition unit 2 and the generation unit 3. Further, the system having the inference rule generation support device 1 has, for example, a storage unit 20 that stores a plurality of event-related information and the like.

When the normalization unit 21 acquires rule information represented by a natural sentence (text data in a natural language, etc.), the normalization unit 21 applies analysis processing such as morphological analysis and predicate term structure analysis to the acquired natural sentence. Converts (normalizes) the acquired natural sentence into rule information in a preset format. Specifically, the normalization unit 21 describes the above-mentioned "exists (" attachment file ") when the natural sentence is" when the attachment file is opened (premise part) and the malware W is active (result part) ". => Rule information in the form of "act ("malware W ")" is generated. The format of the rule information is not limited to the above-mentioned format.

The expression extension unit 22 applies the expression extension process using the implication expression dictionary information and the synonymous expression dictionary information stored in the storage unit 20 to the expressions of the premise part and the consequent part of the normalized rule information. Extend the representation of rule information. Specifically, the expression extension unit 22 extends the expression of the rule information by using the technique disclosed in Japanese Patent Application Laid-Open No. 2016-164708.

For example, as an extended expression for the above-mentioned "exists (" attachment ") => act ("malware W ")", "exists (" attachment ") => attack ("malware W ")" "execute (" attachment) Generate files such as ") => act ("malware W ")" and "execute (" attachment ") => attack ("malware W ")".

The implication expression dictionary information and the synonymous expression dictionary information are stored in a storage unit provided inside the inference rule generation support device 1, a storage unit 20 provided outside the inference rule generation support device 1, and the like.

The acquisition unit 2 uses the rule information obtained by applying normalization and expression extension to the natural sentence, or the event-related dictionary information composed of a plurality of event-related information by using the rule information that has already been normalized. To acquire the event-related information used to construct the event path by referring to.

This will be specifically described with reference to FIG. FIG. 3 is a diagram for explaining the acquisition unit. The acquisition unit 2 first acquires the rule information 31. Subsequently, the acquisition unit 2 extracts the event-related information related to the event path by referring to the event-related dictionary information 32 composed of a plurality of event-related information stored in the storage unit 20 by using the rule information 31. do.

Here, the event-related dictionary information is information that can be regarded as an ontology in a broad sense, and can be assumed to be an ontology specialized in the target field. In addition, event-related dictionary information is generated using a wide variety of information. The event-related dictionary information 32 shown in FIG. 3 is intended for the cyber security field, and includes common sense knowledge information, conceptual dictionary information (semantic dictionary information), and IOC (Indicator Of Compromise: trace information of attacks). , Vulnerability information, log data output from security devices provided by various vendors, and a wide variety of information that is updated daily.

Further, the event-related dictionary information is stored in a storage unit provided inside the inference rule generation support device 1, a storage unit 20 provided outside the inference rule generation support device 1, and the like. The event-related dictionary information may be divided and stored.

An example of acquisition of event-related information related to the event path will be described. The acquisition unit 2 uses the rule information 31 to refer to the event-related dictionary information 32, and obtains the event-related information having the front event information ("attached file") which is the starting point that matches the antecedent information of the rule information 31. get. In addition, the acquisition unit 2 acquires the event-related information having the posterior event information that is the end point that matches the consequent information ("malware W") of the rule information 31 (first acquisition unit).

Specifically, in the example of FIG. 3, the acquisition unit 2 includes "" attachment "<hasInstance>" Hoge.docx "", "" attachment "<hasInstance>" Hoge.xlsx "", and "" fuga. Get .com ″ <isIndicationOf> ″ Malware W ″ ”.

Subsequently, the acquisition unit 2 refers to the event-related dictionary information 32 by using the rear event information possessed by each of the event-related information having the front event information as the acquired start point, and the front portion that matches the rear event information. Acquires new event-related information having event information (second acquisition unit).

Specifically, the acquisition unit 2 obtains the front event information that matches the rear event information "" Hoge.docx "" and "" Hoge.xlsx "" that each event-related information having the front event information as the starting point has. The event-related information to be possessed is acquired from the event-related dictionary information 32. That is, in the example of FIG. 3, the acquisition unit 2 acquires "" Hoge.docx "<p: drop>" tasksche.exe "" and "" Hoge.xlsx "<p: drop>" eviltask.exe "". do.

Subsequently, the acquisition unit 2 refers to the event-relationship dictionary information 32 by using the rear-end event information of the acquired event-relationship information, and acquires new event-related information having the front-end event information that matches the rear-end event information. The process is repeated until no more is obtained (third acquisition unit).

Specifically, the acquisition unit 2 refers to the event-related dictionary information 32 by using the rear event information "" tasksche.exe "" and "" eviltask.exe "" of the acquired event-related information, and refers to the rear event information. This is repeated until new event-related information having the front event information that matches with is no longer acquired. That is, the acquisition unit 2 acquires "" fuga.com "<isIndicationOf>" malware W "" and "" malware.com "<isIndicationOf>" malware Z "".

Subsequently, the acquisition unit 2 detects the event route in the order shown in (1) to (8) shown in 33 of FIG. 3, for example. That is, it is used to construct an event path from the front event information "" attachment "" which is the starting point that matches the antecedent information to the rear event information "" malware W "" which is the ending point that matches the consequent information. Acquire event-related information. See 34 in FIG.

The logical conversion unit 23 converts the event-related information into a predetermined format based on the conversion set in the relationship name information included in each of the event-related information acquired by the acquisition unit 2. A specific description will be given with reference to FIG. FIG. 4 is a diagram showing an example of conversion information. The logical conversion unit 23 applies the conversion information 41 shown in FIG. 4 to the event-related information (34 in FIG. 3) used for constructing the event path shown in FIG. 3, and determines the information as shown in 42 shown in FIG. Convert to the format of.

The conversion information 41 will be described. In the case of event-related information represented by "A <p: ○○○> B", the logic that uses the relation name information "○○○" starting with "p:" as the predicate name and each event information as a term. Convert to an expression.

Next, in the case of the event-related information represented by "A <hasInstance> B", it means that B is an instance of A. It should be noted that A may be replaced with B as an operation for refining and individualizing the event information. For example, in the case of "exists (" attachment ")", replace "attachment" with "Hoge.docx" according to the definition of hasInstance.

In the case of the event-related information represented by "A <synonym> B", it means that A and B have a synonymous relationship, and that A and B can be replaced with each other.

It should be noted that undefined relationships cannot be converted into logical expressions, so they are considered unnecessary.

The generation unit 3 matches the consequent information of the rule information 31 among the event-related information (43 in FIG. 4) obtained by converting the acquired event-related information (34 in FIG. 3) into a predetermined format. Event-related information "exists ("Hoge.docx ")" "drop ("Hoge.docx "," tasksche.exe "" other than event-related information that has consequent event information "act (" malware W ")" ) ”And“ connect (″ tasksche.exe ″, ″ fuga.com ″)” to generate new consequent information.

Specifically, new antecedent information (premise part) “exists (″ Hoge.docx ″) ^ drop (″ Hoge.docx ″, ″ tasksche.exe ″) ^ connect (″) as shown in FIG. 443. Generate tasksche.exe ″, ″ fuga.com ″) ”. The generation unit 3 uses the logical product "^" to concatenate the event-related information other than the event-related information having the rear event information that is the end point that matches the consequent information.

Subsequently, the generation unit 3 generates new rule information (inference rule) using the newly generated antecedent information. Specifically, the rule information “exists (″ Hoge.docx ″) ^ drop (″ Hoge.docx ″, ″ tasksche.exe ″) ^ connect (″ tasksche.exe ″, ″ fuga ″, as shown in FIG. 443. Generate .com ″) => act (″ malware W ″) ”.

[Device operation]
Next, the operation of the inference rule generation support device according to the embodiment of the present invention will be described with reference to FIG. FIG. 5 is a diagram showing an example of operation of the inference rule generation support device. In the following description, FIGS. 2 to 4 and 6 will be referred to as appropriate. Further, in the present embodiment, the inference rule generation support method is implemented by operating the inference rule generation support device. Therefore, the description of the inference rule generation support method in the present embodiment is replaced with the following operation description of the inference rule generation support device.

In step A1, the inference rule generation support device 1 acquires a natural sentence (text data in natural language, etc.). In step A2, when the normalization unit 21 acquires the rule information represented by the natural sentence, the acquired natural sentence is subjected to analysis processing such as morphological analysis and predicate argument structure analysis. Is converted (normalized) to the rule information in the preset format.

Specifically, in step A2, when the natural sentence is "when the attached file is opened (premise part), the malware W is active (result part)", the normalization unit 21 described above "exists (" Rule information in the form of "attached file") => act ("malware W") "is generated. The format of the rule information is not limited to the above-mentioned format.

In step A3, the expression extension unit 22 applies the expression extension process using the implied expression dictionary information, the synonymous expression dictionary information, and the like to the expressions of the premise part and the consequent part of the normalized rule information to obtain the rule information. Extend the expression. Specifically, in step A3, the expression extension unit 22 extends the expression of the rule information by using the technique disclosed in Japanese Patent Application Laid-Open No. 2016-164708.

In step A4, the event relationship having a plurality of event relationship information by the acquisition unit 2 using the rule information obtained by applying normalization and expression extension to the natural sentence or the rule information that has already been normalized. Refer to the dictionary information and acquire the event-related information used to construct the event path.

Specifically, in step A4, as shown in FIG. 3, the acquisition unit 2 refers to the event-related dictionary information 32 using the rule information 31, and becomes a starting point that matches the consequent information of the rule information 31. The front event information ("attached file") and the event-related information having the rear event information at the end point that matches the consequent information ("malware W") of the rule information 31 are acquired. For example, get "" Attachment "<hasInstance>" Hoge.docx "", "" Attachment "<hasInstance>" Hoge.xlsx "", and "" fuga.com "<isIndicationOf>" Malware W "".

Subsequently, the acquisition unit 2 refers to the event-related dictionary information 32 by using the rear event information possessed by each of the event-related information having the front event information as the acquired start point, and the front portion that matches the rear event information. Acquire new event-related information having event information.

Specifically, in step A4, before the acquisition unit 2 matches the rear event information "" Hoge.docx "" and "" Hoge.xlsx "" of each of the event-related information having the front event information as the starting point. Part Event-related information having event information is acquired from the event-related dictionary information 32. For example, get "" Hoge.docx "<p: drop>" tasksche.exe "" and "" Hoge.xlsx "<p: drop>" eviltask.exe "".

Subsequently, the acquisition unit 2 refers to the event-relationship dictionary information 32 by using the rear-end event information of the acquired event-relationship information, and acquires new event-related information having the front-end event information that matches the rear-end event information. Repeat until no more.

Specifically, in step A4, the acquisition unit 2 refers to the event-related dictionary information 32 by using the rear event information "" tasksche.exe "" and "" eviltask.exe "" of the acquired event-related information. This is repeated until new event-related information having front event information that matches the rear event information is no longer acquired. That is, the acquisition unit 2 acquires "" fuga.com "<isIndicationOf>" malware W "" and "" malware.com "<isIndicationOf>" malware Z "".

Subsequently, in step A4, the acquisition unit 2 detects the event route in the order shown in (1) to (8) shown in 33 of FIG. That is, it is used to construct an event path from the front event information "" attachment "" which is the starting point that matches the antecedent information to the rear event information "" malware W "" which is the ending point that matches the consequent information. Acquire event-related information.

FIG. 6 is a diagram showing an image of the event path. The event route information 61 shown in FIG. 6 is an event route constructed in the order shown in (1) to (8) shown in 33 of FIG. 3 described above. Further, the event route information 62 is an event route from the front event information "" attachment "" which is the starting point corresponding to the antecedent information to the rear event information "" malware Z "" which is the ending point. However, the event route information 62 is not adopted because it does not reach the rear event information "" malware W "".

In step A5, the logical conversion unit 23 converts the event-related information into a predetermined format based on the conversion set in the relationship name information included in each of the event-related information acquired in step A4. Specifically, in step A5, the logical conversion unit 23 applies the conversion information 41 shown in FIG. 4 to the event-related information (34 in FIG. 3) used for constructing the event path shown in FIG. It is converted into a predetermined format as shown in FIG. 42. It should be noted that undefined relationships cannot be converted into logical expressions, so they are considered unnecessary.

In step A6, among the event-related information (42 in FIG. 4) converted into the predetermined format by the generation unit 3, the rear event information "act (" Event-related information other than event-related information with "malware W") "" exists ("Hoge.docx") "" drop ("Hoge.docx", "tasksche.exe") "" connect ("tasksche.exe", " "Fuga.com") "is concatenated to generate new consequent information.

Specifically, the new antecedent information is the antecedent information (premise part) "exists (" Hoge.docx ") ^ drop (" Hoge.docx "," tasksche.exe "" as shown in 42 of FIG. ) ^ Connect ("tasksche.exe", "fuga.com") "is generated. In step A6, the generation unit 3 concatenates the event-related information other than the event-related information having the rear event information that is the end point that matches the consequent information by using the logical product “^”.

In step A7, the generation unit 3 generates new rule information (inference rule) using the newly generated antecedent information. Specifically, the rule information “exists (″ Hoge.docx ″) ^ drop (″ Hoge.docx ″, ″ tasksche.exe ″) ^ connect (″ tasksche.exe ″, ″ fuga ″, as shown in FIG. Generate .com ″) => act (″ malware W ″) ”.

[Effect of this embodiment]
As described above, according to the present embodiment, based on the front event information, the relation name information, and the rear event information used for constructing the event path, which are acquired from the event relation information using the target rule information. By generating new previous information, it is possible to efficiently generate high-quality inference rules that satisfy the sufficient conditions for the premise part to derive the consequent part.

In addition, by combining various types of information sources and ontology specialized in the target field, incomplete rule information is expanded and corrected as input, and inference rules that satisfy the premise part are comprehensively and continuously constructed. can do.

Furthermore, by continuously accumulating inference rules, more rules are applied to newly observed events, which has the effect of enabling appropriate hypothesis formulation.

By refining the antecedent information of the inference rule, the hypothesis that holds can be narrowed down, so that the calculation cost can be reduced and the amount of memory for holding the hypothesis can be reduced.

In addition, if there are only ambiguous inference rules with few predicates that make up the previous information, the inference rules are likely to be applied excessively, so a large number of hypotheses, including hypotheses with low accuracy, are generated from the observed events. In many cases, even if there is not enough data, it tends to be unverifiable. However, according to the present embodiment, unnecessary calculation cost can be reduced.

[program]
The program according to the embodiment of the present invention may be any program that causes a computer to execute steps A1 to A7 shown in FIG. By installing this program on a computer and executing it, the inference rule generation support device and the inference rule generation support method according to the present embodiment can be realized. In this case, the computer processor functions as a normalization unit 21, an expression extension unit 22, an acquisition unit 2, a logic conversion unit 23, and a generation unit 3 to perform processing.

Further, the program in the present embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any of the normalization unit 21, the expression extension unit 22, the acquisition unit 2, the logic conversion unit 23, and the generation unit 3, respectively.

[Physical configuration]
Here, a computer that realizes an inference rule generation support device by executing the program in the embodiment will be described with reference to FIG. 7. FIG. 7 is a diagram showing an example of a computer that realizes an inference rule generation support device.

As shown in FIG. 7, the computer 110 includes a CPU 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. Each of these parts is connected to each other via a bus 121 so as to be capable of data communication. The computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to the CPU 111 or in place of the CPU 111.

The CPU 111 expands the programs (codes) of the present embodiment stored in the storage device 113 into the main memory 112 and executes them in a predetermined order to perform various operations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). Further, the program according to the present embodiment is provided in a state of being stored in a computer-readable recording medium 120. The program in the present embodiment may be distributed on the Internet connected via the communication interface 117.

Further, as a specific example of the storage device 113, in addition to the hard disk drive, a semiconductor storage device such as a flash memory can be mentioned. The input interface 114 mediates data transmission between the CPU 111 and an input device 118 such as a keyboard and mouse. The display controller 115 is connected to the display device 119 and controls the display on the display device 119.

The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, reads a program from the recording medium 120, and writes a processing result in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and another computer.

Specific examples of the recording medium 120 include a general-purpose semiconductor storage device such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), a magnetic recording medium such as a flexible disk, or a CD-. Examples include optical recording media such as ROM (Compact Disk Read Only Memory).

[Additional Notes]
The following additional notes will be further disclosed with respect to the above embodiments. A part or all of the above-described embodiments can be expressed by the following descriptions (Appendix 1) to (Appendix 15), but the present invention is not limited to the following description.

(Appendix 1)
Event-related dictionary information composed of a plurality of event-related information in which the front event information and the rear event information are associated with each other by the relationship name information using the rule information representing the rule relationship between the preceding information and the following information. To obtain the event-related information to be used for constructing an event path from the front event information that is the starting point that matches the preceding information to the rear event information that is the ending point that matches the following information. A generation unit that generates the previous event information by concatenating the event-related information other than the event-related information having the rear event information that is the end point that matches the subsequent event information among the acquired event-related information. When,
Inference rule generation support device with.

(Appendix 2)
The inference rule generation support device described in Appendix 1.
Using the rule information, the event-related dictionary information is referred to, and event-related information having a front event information that is a starting point that matches the previous-case information of the rule information, and the subsequent-case information of the rule information. The first acquisition unit that acquires the event-related information having the rear event information that is the end point that coincides with
Using the acquired rear event information having each event-related information having the front event information as the starting point, the event-related dictionary information is referred to, and a new front event information having the same front event information as the rear event information is obtained. The second acquisition unit that acquires event-related information,
Using the acquired rear event information, the event relation dictionary information is referred to, and the process is repeated until new event relation information having the front event information matching the rear event information is not acquired. An inference rule generation support device characterized by having a third acquisition unit.

(Appendix 3)
The inference rule generation support device described in Appendix 2, which is the inference rule generation support device.
Based on the logical conversion set in the relationship name information included in each of the event-related information acquired by the first to third acquisition units, the event-related information is logically converted into a predetermined format. An inference rule generation support device characterized by having a logic conversion unit.

(Appendix 4)
The inference rule generation support device described in Appendix 3, which is the inference rule generation support device.
The acquisition unit uses the logically converted event-related information to reach the rear event information that is the start point that matches the consequent information to the rear event information that is the end point that matches the consequent information. An inference rule generation support device characterized by generating event route information representing an elephant route.

(Appendix 5)
The inference rule generation support device according to any one of Appendix 1 to 4.
The generation unit is an inference rule generation support device that concatenates event-related information other than event-related information having rear event information that is an end point that matches the consequent information by using a logical product.

(Appendix 6)
(A) An event relationship composed of a plurality of event relationship information in which the front event information and the rear event information are associated with each other by the relationship name information using the rule information representing the rule relationship between the preceding information and the following information. Referencing the dictionary information, the event-related information used for constructing an event path from the front event information that is the starting point that matches the preceding information to the rear event information that is the ending point that matches the following information. Of the steps to be acquired and (b) the acquired event-related information, the event-related information other than the event-related information having the rear event information that is the end point that matches the subsequent information is concatenated to obtain the previous event information. Generate, step and
Inference rule generation support method with.

(Appendix 7)
The inference rule generation support method described in Appendix 6
(C) Using the rule information, the event-related dictionary information is referred to, and the event-related information having the front event information that is the starting point that matches the preceding information of the rule information, and the above-mentioned rule information. The step of acquiring the event-related information having the rear event information that is the end point that matches the subsequent information,
(D) Using the acquired event-related information having the front event information as the starting point, the event-related dictionary information is referred to, and the front event information that matches the rear event information is obtained. Steps to acquire event-related information that you have,
(E) Using the acquired consequent information of the event-related information, the event-related dictionary information is referred to, and new event-related information having the front event information that matches the rear event information is not acquired. An inference rule generation support method characterized by having steps and steps that repeat up to.

(Appendix 8)
The inference rule generation support method described in Appendix 7.
(F) Based on the logical conversion set in the relationship name information included in each of the event-related information acquired in the steps (c) to (e), the event-related information is stored in a predetermined format. An inference rule generation support method characterized by having a step that logically transforms into.

(Appendix 9)
The inference rule generation support method described in Appendix 8.
In the step (a), the logically converted event-related information is used to change from the front event information that is the start point that matches the antecedent information to the rear event information that is the end point that matches the consequent information. An inference rule generation support method characterized by generating event route information representing an event route to reach.

(Appendix 10)
The inference rule generation support method described in any one of Appendix 6 to 9.
Inference characterized in that, in the step (b), the concatenation of the event-related information other than the event-related information having the rear event information which is the end point matching the consequent information is performed by using a logical product. Rule generation support method.

(Appendix 11)
On the computer
(A) An event relationship composed of a plurality of event relationship information in which the front event information and the rear event information are associated with each other by the relationship name information using the rule information representing the rule relationship between the preceding information and the following information. Referencing the dictionary information, the event-related information used for constructing an event path from the front event information that is the starting point that matches the preceding information to the rear event information that is the ending point that matches the following information. Of the steps to be acquired and (b) the acquired event-related information, the event-related information other than the event-related information having the rear event information that is the end point that matches the subsequent information is concatenated to obtain the previous event information. Generate, step and
A program that executes.

(Appendix 12)
The program described in Appendix 11
On the computer
(C) Using the rule information, the event-related dictionary information is referred to, and the event-related information having the front event information that is the starting point that matches the preceding information of the rule information, and the above-mentioned rule information. The step of acquiring the event-related information having the rear event information that is the end point that matches the subsequent information,
(D) Using the acquired event-related information having the front event information as the starting point, the event-related dictionary information is referred to, and the front event information that matches the rear event information is obtained. Steps to acquire event-related information that you have,
(E) Using the acquired consequent information of the event-related information, the event-related dictionary information is referred to, and new event-related information having the front event information that matches the rear event information is not acquired. A program characterized by executing steps and steps that repeat up to.

(Appendix 13)
The program described in Appendix 12
On the computer
(F) Based on the logical conversion set in the relationship name information included in each of the event-related information acquired in the steps (c) to (e), the event-related information is stored in a predetermined format. A program characterized by executing steps that logically convert to.

(Appendix 14)
The program described in Appendix 13
In the step (a), the logically converted event-related information is used to change from the front event information that is the start point that matches the antecedent information to the rear event information that is the end point that matches the consequent information. A program characterized by generating event route information representing an event route to reach.

(Appendix 15)
The program described in any one of Appendix 11 to 14.
In the step (b), the program is characterized in that the connection of each of the event-related information other than the event-related information having the rear event information which is the end point corresponding to the consequent information is performed by using a logical product. Mu.

Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made within the scope of the present invention in terms of the structure and details of the present invention.

As described above, according to the present invention, a new method is obtained based on the front event information, the relationship name information, and the rear event information used for constructing the event path, which are acquired from the event relationship information using the target rule information. By generating the previous information, it is possible to efficiently generate a high-quality inference rule that satisfies the sufficient conditions for the premise part to derive the consequent part. The present invention is useful in fields that require high quality inference rules.

1 Inference rule generation support device 2 Acquisition unit 3 Generation unit 20 Storage unit 21 Normalization unit 22 Expression expansion unit 23 Logical conversion unit 110 Computer 111 CPU
112 Main memory 113 Storage device 114 Input interface 115 Display controller 116 Data reader / writer 117 Communication interface 118 Input device 119 Display device 120 Recording medium 121 Bus

Claims (10)

Using the rule information indicating the rule relationship between the preceding information and the following information, refer to the event relationship dictionary information having a plurality of event relationship information in which the front event information and the rear event information are associated with each other by the relationship name information. , An acquisition means for acquiring the event-related information used for constructing an event path from the front event information that is the start point that matches the preceding information to the rear event information that is the end point that matches the subsequent information. Among the acquired event-related information, the generation means for generating the preceding event information by concatenating the event-related information other than the event-related information having the rear event information that is the end point that matches the subsequent event information.
A logical conversion means for converting the event-related information into a predetermined format based on the logical conversion set in the relationship name information included in each of the event-related information.
Inference rule generation support device with. The inference rule generation support device according to claim 1.
Using the rule information, the event-related dictionary information is referred to, and event-related information having a front event information that is a starting point that matches the previous-case information of the rule information, and the subsequent-case information of the rule information. The first acquisition means for acquiring the event-related information having the rear event information that is the end point that coincides with
Using the acquired rear event information having each event-related information having the front event information as the starting point, the event-related dictionary information is referred to, and a new front event information having the same front event information as the rear event information is obtained. A second acquisition method for acquiring event-related information,
Using the acquired rear event information, the event relation dictionary information is referred to, and the process is repeated until new event relation information having the front event information matching the rear event information is not acquired. An inference rule generation support device characterized by having a third acquisition means. The inference rule generation support device according to claim 2.
The logical conversion means determines the event-related information based on the logical conversion set in the relationship name information included in each of the event-related information acquired by the first to third acquisition means. An inference rule generation support device characterized by converting to the format of. The inference rule generation support device according to claim 3.
The acquisition means uses the logically converted event-related information to reach the rear event information that is the end point that matches the consequent information from the front event information that is the start point that matches the consequent information. An inference rule generation support device characterized by generating event route information representing an elephant route. The inference rule generation support device according to any one of claims 1 to 4.
The generation means is an inference rule generation support device characterized in that each of event-related information other than event-related information having rear event information that is an end point that matches the consequent information is concatenated by using a logical product. The computer
(A) An event relationship composed of a plurality of event relationship information in which the front event information and the rear event information are associated with each other by the relationship name information using the rule information representing the rule relationship between the previous case information and the subsequent case information. Referencing the dictionary information, the event-related information used for constructing an event path from the front event information that is the starting point that matches the preceding information to the rear event information that is the ending point that matches the following information. Get, step and
(B) Among the acquired event-related information, the step of generating the antecedent information by concatenating the event-related information other than the event-related information having the rear event information that is the end point that matches the consequent information. ,
(C) A step of converting the event-related information into a predetermined format based on the logical conversion set in the relationship name information included in each of the event-related information.
ofexecutionInference rule generation support method. On the computer
(A) An event relationship composed of a plurality of event relationship information in which the front event information and the rear event information are associated with each other by the relationship name information using the rule information representing the rule relationship between the preceding information and the following information. Referencing the dictionary information, the event-related information used for constructing an event path from the front event information that is the starting point that matches the preceding information to the rear event information that is the ending point that matches the following information. Of the steps to be acquired and (b) the acquired event-related information, the event-related information other than the event-related information having the rear event information that is the end point that matches the subsequent information is concatenated to obtain the previous event information. Generate, step and
(F) A step of converting the event-related information into a predetermined format based on the logical conversion set in the relationship name information included in each of the event-related information.
A program that executes. The program according to claim 7.
On the computer
(C) Using the rule information, the event-related dictionary information is referred to, and the event-related information having the front event information that is the starting point that matches the preceding information of the rule information, and the above-mentioned rule information. The step of acquiring the event-related information having the rear event information that is the end point that matches the subsequent information,
(D) Using the acquired event-related information having the front event information as the starting point, the event-related dictionary information is referred to, and the front event information that matches the rear event information is obtained. Steps to acquire event-related information that you have,
(E) Using the acquired consequent information of the event-related information, the event-related dictionary information is referred to, and new event-related information having the front event information that matches the rear event information is not acquired. A program characterized by executing steps and steps that repeat up to. The program according to claim 8.
In the step (f), the event is based on the logical conversion set in the relation name information included in each of the event relation information acquired in the steps (c) to (e). A program characterized by converting related information into a predetermined format. The program according to claim 9.
In the step (a), the logically converted event-related information is used to change from the front event information that is the start point that matches the antecedent information to the rear event information that is the end point that matches the consequent information. A program characterized by generating event route information representing an event route to reach.

Images