JP7773319B2 - Analysis device, analysis method, and analysis program - Google Patents

Description

The present invention relates to an analysis device, etc.

Companies create support sites to handle problems and other issues for users of their products and services. For example, it is common for support sites to provide a list of frequently asked questions (FAQs) that compiles frequently asked questions and their answers, along with examples of past problems and failures.

When a problem occurs, users refer to the FAQ on the support site to try to resolve the issue, and if the FAQ does not resolve the problem, they contact a support center operator by phone or email. Operators may also refer to log data recorded when the service is provided to consider how to deal with the problem.

Sumitomo Electric Information Systems, "Call Center Efficiency Improvement," [online], [searched June 23, 2021], Internet <URL: https://www.sei-info.co.jp/quicksolution/case-studies/cases/crm.html>

However, because log data contains a variety of information, it is not easy for operators to refer to the log data as is and use it to help with troubleshooting. For this reason, there is a need to identify information that is useful for troubleshooting based on the log data and support operators.

In one aspect, the present invention aims to provide an analysis device, analysis method, and analysis program that can identify information from log data that is useful for dealing with problems and support operators.

In the first proposal, the analysis device has a memory unit and an identification unit. The memory unit stores a model trained based on training data in which the features of the log data are used as input data and the symptoms of the problem are used as correct labels. The identification unit inputs the features extracted from the log data to be analyzed into the model, thereby identifying the symptoms of the problem corresponding to the log data to be analyzed.

Log data can be used to identify information that is useful for dealing with problems and assist operators.

FIG. 1 is a functional block diagram showing the configuration of an analysis device according to this embodiment. FIG. 2 is a diagram illustrating an example of a data structure of the learning data. FIG. 3 is a diagram illustrating an example of the data structure of the evaluation data. FIG. 4 is a flowchart showing the processing procedure of the learning phase of the analysis device according to this embodiment. FIG. 5 is a flowchart showing the processing procedure of the evaluation phase of the analysis device according to this embodiment. FIG. 6 is a diagram showing an example of the hardware configuration of a computer that realizes the same functions as the analysis device of the embodiment.

The following describes in detail exemplary embodiments of the analysis device, analysis method, and analysis program disclosed herein, with reference to the accompanying drawings. Note that the present invention is not limited to these exemplary embodiments.

The configuration of the analysis device according to this embodiment will now be described. Figure 1 is a functional block diagram showing the configuration of the analysis device according to this embodiment. As shown in Figure 1, this analysis device has a communication unit 110, an input unit 120, a display unit 130, a memory unit 140, and a control unit 150.

The communication unit 110 sends and receives information to and from external devices via wired or wireless communication. For example, the communication unit 110 is implemented by a NIC (Network Interface Card) or the like. The analysis device 100 may receive the knowledge DB 141 and log data 145 (described below) via the communication unit 110.

The input unit 120 is an input device for inputting various types of information to the control unit 150 of the analysis device 100. The input unit 120 corresponds to a keyboard, mouse, touch panel, etc. An operator may operate the input unit 120 to input log data 145, which will be described later.

The display unit 130 is a display device that displays information output from the control unit 150. The display unit 130 corresponds to an organic EL (Electro Luminescence) display, a liquid crystal display, a touch panel, etc.

The storage unit 140 includes a knowledge database (DB) 141, detailed question data 142, learning data 143, models 144, log data 145, and evaluation data 146. The storage unit 140 is realized, for example, by a semiconductor memory element such as RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or optical disk.

Knowledge DB141 is a database that stores knowledge information related to past troubleshooting. For example, knowledge DB141 contains incident numbers for identifying information linked to troubleshooting that occurred in the past, and log data (system logs) of troubleshooting history.

Question detail data 142 is an extracted portion of the data contained in knowledge DB 141. For example, question detail data 142 includes an incident number and text data of the trouble response history corresponding to this incident number.

The training data 143 is data used to train the model 144. Figure 2 is a diagram showing an example of the data structure of the training data. As shown in Figure 2, this training data 143 includes an incident number, correct label data, and input data. The incident number is a number that identifies information linked to responses to problems that occurred in the past.

The correct label data includes the OS (Operating System) code, product code, product component, close code, and symptom name. The OS code is information that identifies the OS. The product code is information that identifies the product. The product component is information that identifies the parts included in the product. Each piece of information included in the correct label data corresponds to a symptom of the problem.

The closure code is information that indicates the reason for the conclusion of the troubleshooting. For example, closure codes may include hardware failure, software failure, operation error, configuration error, etc.

The phenomenon name is information that indicates the name of the problem phenomenon. For example, phenomenon names include system shutdown, processing shutdown, abnormal processing result, etc.

For example, the OS code corresponding to incident number "0001" in Figure 2 is "OS-A", product code "Product-A", product component "Component-A", closure code "Hardware failure", and phenomenon name "System shutdown".

The input data includes the number of occurrences of messages M1 to Mn detected from the log data. Each message is a unique character string that is set in advance. The number of occurrences of messages M1 to Mn detected from the log data is an example of a feature of the log data.

For example, the log data corresponding to incident number "0001" in Figure 2 is set to show that the number of occurrences of message M1 is "1", the number of occurrences of message M2 is "0", the number of occurrences of message M3 is "3", and the number of occurrences of message Mn is "1".

Model 144 is a machine learning model such as a decision tree. In this embodiment, model 144 is described as a decision tree, but it may also be realized as an NN (Neural Network) or the like.

Log data 145 is the log data to be evaluated and contains a history of when a problem occurred. A unique incident number is assigned to log data 145.

Evaluation data 146 holds feature quantities extracted from log data 145. Figure 3 shows an example of the data structure of evaluation data. As shown in Figure 3, this evaluation data 146 contains the incident number and the number of occurrences of messages M1 to Mn detected from log data 145 corresponding to the incident number.

For example, in the example shown in Figure 3, the incident number "9999" is set in log data 145. It is also set that the number of occurrences of message M1 included in log data 145 is "1", the number of occurrences of message M2 is "0", the number of occurrences of message M3 is "3", and the number of occurrences of message Mn is "1".

Returning to the explanation of Figure 1, the control unit 150 has a preprocessing unit 151, a learning processing unit 152, an extraction unit 153, and an identification unit 154. For example, the control unit 150 is realized by a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). The control unit 150 may also be executed by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

The preprocessing unit 151 receives data from the knowledge DB 141 from an external device and registers it in the storage unit 140. The preprocessing unit 151 scans the knowledge DB 141 to extract information related to troubleshooting, and registers the extracted information in the storage unit 140 as detailed question data 142. For example, it extracts text data associated with a specific item from the knowledge DB 141, or a certain range of text data including an incident number (trouble handling history), and sets this as detailed question data 142.

The preprocessing unit 151 generates learning data 143 based on the detailed question data 142. For example, the preprocessing unit 151 scans the text data of the detailed question data 142 corresponding to the incident number, identifies a specific message, and counts the number of times it appears. The preprocessing unit 151 associates the incident number with the number of times the message appears, and uses this as input data.

The preprocessing unit 151 also acquires correct label data (OS code, product code, product component, close code, and phenomenon name) associated with the incident number from an external device. If correct label data associated with the incident number is registered in the knowledge DB 141, the preprocessing unit 151 may detect the correct label data from the knowledge DB 141.

As described above, the preprocessing unit 151 obtains the correct label data and input data corresponding to the incident number and registers them in the training data 143. The preprocessing unit 151 repeatedly performs the above process for each incident number.

The learning processing unit 152 performs machine learning on the model 144 using the training data 143. For example, the learning processing unit 152 adjusts the parameters of the model 144 so that the output when input data is input to the model 144 is the output result of the correct label data. Any conventional technology may be used as a method for learning a decision tree using the training data 143.

The extraction unit 153 acquires log data 145 from an external device or the input unit 120, and registers the acquired log data 145 in the storage unit 140. The extraction unit 153 generates evaluation data 146 by extracting features from the log data 145, and registers the evaluation data 146 in the storage unit 140. For example, the extraction unit 153 scans the log data 145 and counts the number of occurrences of multiple pre-set messages. The extraction unit 153 sets the incident number set in the log data 145 and the number of occurrences of each message in the evaluation data 146.

The identification unit 154 identifies the symptoms of the problem by inputting the evaluation data 146 into the trained model 144. For example, the OS code, product code, product component, close code, and phenomenon name related to the log data 145 are output from the model 144 as the symptoms of the problem.

The identification unit 154 outputs product code information to an external device and queries manual information related to the product code and the incident number of a problem related to the product code. In this way, the identification unit 154 obtains the incident number and manual information corresponding to the product code. In the following explanation, the incident number of a problem related to the product code will be referred to as the "related incident number."

The identification unit 154 generates screen information that associates the trouble symptoms (e.g., OS code, product code, product component, close code, phenomenon name), related incident number, and manual information, and outputs and displays it on the display unit 130. If the identification unit 154 has acquired the log data 145 from an external device, it may also send the screen information to the external device.

Next, an example of the processing procedure of the analysis device 100 according to this embodiment will be described. FIG. 4 is a flowchart showing the processing procedure of the learning phase of the analysis device according to this embodiment. As shown in FIG. 4, the preprocessing unit 151 of the analysis device 100 extracts detailed question data 142 from the knowledge DB 141 (step S101).

The preprocessing unit 151 generates training data 143 based on the question detail data 142 and the correct answer label data obtained from the external device (step S102).

The learning processing unit 152 of the analysis device 100 learns the model 144 using the learning data 143 (step S103). The learning processing unit 152 registers the learned model 144 in the memory unit (step S104).

Figure 5 is a flowchart showing the processing steps of the evaluation phase of the analysis device according to this embodiment. The extraction unit 153 of the analysis device 100 receives input of log data 145 (step S201). The extraction unit 153 extracts features from the log data 145 to generate evaluation data 146 (step S202).

The identification unit 154 of the analysis device 100 inputs the evaluation data 146 into the trained model 144 and identifies the symptoms of the problem (OS code, product code, product component, closed code, and phenomenon name) (step S203).

The identification unit 154 acquires the incident number and manual information corresponding to the symptoms of the trouble (step S204). The identification unit 154 generates screen information that associates the incident number and manual information with the symptoms of the trouble (step S205). The identification unit 154 displays the screen information on the display unit 130 (step S206).

Next, the effects of the analysis device 100 according to this embodiment will be described. The analysis device 100 inputs the features of the log data 145 to be analyzed into a model 144 trained using training data 143 in which the features of log data such as detailed question data 142 are used as input data and the symptoms of the problem are used as correct answer labels, and presents the output results. This makes it possible to extract information that is useful for troubleshooting and support the operator.

The analysis device 100 uses the OS code, product code, product component, closed code, and phenomenon name as trouble symptoms to be used as learning data 143. This allows the operator to obtain information that is useful in dealing with the trouble they are currently dealing with.

The analysis device 100 extracts features (number of times a message appears) from the log data 145 and inputs them into the model 144. This makes it possible to narrow down the data to be input into the model 144.

The analysis device 100 further identifies the incident number associated with the information about the product in which the problem occurred. This makes it possible to easily collect information related to the log data 145 in which the problem occurred using the incident number.

Next, we will explain an example of the hardware configuration of a computer that realizes the same functions as the analysis device 100 shown in the above embodiment. Figure 6 is a diagram showing an example of the hardware configuration of a computer that realizes the same functions as the analysis device of the embodiment.

As shown in FIG. 6, computer 200 has a CPU 201 that executes various types of arithmetic processing, an input device 202 that accepts data input from the user, and a display 203. Computer 200 also has a communication device 204 that exchanges data with external devices via a wired or wireless network, and an interface device 205. Computer 200 also has a RAM 206 that temporarily stores various types of information, and a hard disk drive 207. Each of devices 201 to 207 is connected to a bus 208.

The hard disk drive 207 stores a preprocessing program 207a, a learning processing program 207b, an extraction program 207c, and a specific program 207d. The CPU 201 also reads each of the programs 207a to 207d and stores them in the RAM 206.

The pre-processing program 207a functions as the pre-processing process 206a. The learning processing program 207b functions as the learning processing process 206b. The extraction program 207c functions as the extraction process 206c. The identification program 207d functions as the identification process 206d.

The processing of the pre-processing process 206a corresponds to the processing of the pre-processing unit 151. The processing of the learning processing process 206b corresponds to the processing of the learning processing unit 152. The processing of the extraction process 206c corresponds to the processing of the extraction unit 153. The processing of the identification process 206d corresponds to the processing of the identification unit 154.

Note that each of the programs 207a to 207d does not necessarily have to be stored on the hard disk drive 207 from the beginning. For example, each program can be stored on a "portable physical medium" such as a flexible disk (FD), CD-ROM, DVD, magneto-optical disk, or IC card that is inserted into the computer 200. The computer 200 can then read and execute each of the programs 207a to 207d.

100 Analysis device 110 Communication unit 120 Input unit 130 Display unit 140 Storage unit 141 Knowledge DB
142 Question detail data 143 Learning data 144 Model 145 Log data 146 Evaluation data 150 Control unit 151 Preprocessing unit 152 Learning processing unit 153 Extraction unit 154 Identification unit

Claims (4)

a storage unit that stores a model trained based on training data in which input data is a feature amount including the number of occurrences of a unique message included in log data when a problem occurs, and in which correct labels are a product code of a product related to the problem, an OS code of a product related to the problem, a part of a product related to the problem, the phenomenon of the problem, and symptoms of the problem including information on a closed code;
an identification unit that generates features by counting the number of occurrences of the unique messages based on the log data to be analyzed, inputs the generated features into the model, thereby identifying a symptom of the trouble corresponding to the log data to be analyzed , identifies incident information and manual information related to a product code of a product related to the trouble, generates screen information that associates the log data to be analyzed, the symptom of the trouble, the incident information, and the manual information, and outputs the generated screen information ;
An analysis device comprising: The analysis device according to claim 1, further comprising an extraction unit that extracts the number of occurrences of a predetermined message included in the log data to be analyzed as the feature. Based on the log data to be analyzed, features are generated by counting the number of times each unique message appears.
The feature amount including the number of occurrences of the unique message included in the log data when a problem occurs is used as input data, and the generated feature amount is input to a model trained based on training data in which the product code of the product related to the problem, the OS code of the product related to the problem, the part of the product related to the problem, the phenomenon of the problem, and the symptom of the problem including information on the closed code are used as correct answer labels, thereby identifying the symptom of the problem corresponding to the log data to be analyzed ;
Identifying incident information and manual information related to the product code of the product related to the trouble;
generating screen information that associates the log data to be analyzed, the symptom of the trouble, the incident information, and the manual information, and outputting the generated screen information ;
An analysis method characterized in that the processing is executed by a computer. Based on the log data to be analyzed, features are generated by counting the number of times each unique message appears.
The feature amount including the number of occurrences of the unique message included in the log data when a problem occurs is used as input data, and the generated feature amount is input to a model trained based on training data in which the product code of the product related to the problem, the OS code of the product related to the problem, the part of the product related to the problem, the phenomenon of the problem , and the symptom of the problem including information on the closed code are used as correct answer labels, thereby identifying the symptom of the problem corresponding to the log data to be analyzed ;
Identifying incident information and manual information related to the product code of the product related to the trouble;
generating screen information that associates the log data to be analyzed, the symptom of the trouble, the incident information, and the manual information, and outputting the generated screen information ;
An analysis program that causes a computer to execute processing.