JP2010218333A - Analysis rule generation device, analysis rule generation method, analysis rule generation program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an analysis rule generation device and the like for automatically generating an analysis rule for analyzing the operation of a device to be analyzed from a log of the device. <P>SOLUTION: The analysis rule generation device for generating an analysis rule for analyzing the operation of a device to be analyzed includes: an acquisition means which obtains an execution pattern log generated by executing the operation of the device to be analyzed in the analysis rule generation device; an abstraction means which converts a character string on the execution pattern log by a variable conversion rule showing a character string to be abstracted as variable to generate a pattern variable-converted log; and a rule generation means which generates the analysis rule based on a plurality of pattern variable-converted logs generated by executing the acquisition processing by the acquisition means and the generation processing by the abstraction means a plurality of times on the analysis rule generation device. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an analysis rule generation device and the like, and more particularly to an analysis rule generation device and the like that automatically generate an analysis rule for analyzing an operation of the analysis target device from a log of the analysis target device.

  In order to trace the operation of the device / device performed by the user using information such as a log obtained from the device / device, it is necessary to create an analysis rule for analyzing the log. For example, Patent Document 1 discloses a method for generating a simulation model file using an operation history file that can be easily and accurately executed regardless of the operator. Japanese Patent Application Laid-Open No. 2004-228561 discloses that user operation errors can be reduced, and that a quick recovery can be performed when a problem occurs. Further, Patent Document 3 discloses that the next operation can be accurately predicted and the operator can be released as much as possible from a complicated menu selection operation.

JP 2004-164268 A Japanese Patent Laid-Open No. 6-324779 JP-A-10-27089

  However, in the above technique, when the number of operations to be detected increases, it is necessary to analyze and abstract a huge log obtained by operation in order to create the analysis rule and register it as an analysis rule. In addition, when an operation actually performed is specified from an enormous log generated from a device / apparatus, it is necessary to manually create an analysis rule for pattern matching. Further, even in the case of manual creation, there has been an inconvenience that an enormous log must be followed in order to create based on the log as the output result so far.

  Accordingly, the present invention has been made in view of the above problems, and an example of the purpose thereof is to automatically generate an analysis rule for analyzing the operation of the analysis target device from the log of the analysis target device. It is to provide an analysis rule generation device or the like.

  In order to solve the above-described problem, an analysis rule generation device according to the present invention is an analysis rule generation device that generates an analysis rule for analyzing an operation of an analysis target device. An acquisition means for acquiring an execution pattern log generated by executing in the apparatus, and a character string on the execution pattern log is converted by a variable rule indicating a character string to be abstracted as a variable, and a pattern variable log is obtained. Based on a plurality of the pattern variableization logs generated by executing the abstraction means to be generated, the acquisition processing by the acquisition means and the generation processing by the abstraction means a plurality of times on the analysis rule generation device, And a rule generation means for generating an analysis rule.

  In order to solve the above problems, an analysis rule generation method of the present invention is an analysis rule generation method of an analysis rule generation device that generates an analysis rule for analyzing an operation of an analysis target device. Is obtained by executing an execution pattern log generated by executing the analysis rule generation apparatus, and a character string on the execution pattern log is converted by a variable rule indicating a character string to be abstracted as a variable. A plurality of the pattern variableization logs generated by executing the abstraction process for generating a pattern variable log, the acquisition process in the acquisition process, and the generation process in the abstraction process a plurality of times on the analysis rule generation device And a rule generation step of generating the analysis rule based on the above.

  In order to solve the above problems, an analysis rule generation device program according to the present invention provides a computer included in an analysis rule generation device that generates an analysis rule for analyzing an operation of an analysis target device. An acquisition means for acquiring an execution pattern log generated by executing an operation in the analysis rule generation device, a character string on the execution pattern log is converted by a variable rule indicating a character string to be abstracted as a variable Abstraction means for generating a pattern variableization log, and a plurality of pattern variableizations generated by executing the acquisition processing by the acquisition means and the generation processing by the abstraction means a plurality of times on the analysis rule generation device It is made to function as a rule production | generation means which produces | generates the said analysis rule based on a log.

  According to the present invention, by repeatedly performing the operation of the analysis target device to be detected on the analysis rule generation device, logs generated due to operations other than the operation such as the state of the analysis rule generation device and the capacity of the file are analyzed from the analysis rule. Therefore, it is possible to automatically generate a highly accurate analysis rule.

It is a figure which shows an example of schematic structure of the rule production | generation apparatus 1 which concerns on embodiment of this invention. 3 is a diagram illustrating an example of a variable rule 21. FIG. 3 is a diagram illustrating an example of an execution pattern log 22. FIG. FIG. 4 is a diagram illustrating an example of a result obtained by converting an execution pattern log 22 in FIG. 3 is a diagram illustrating an example of an execution pattern log 22. FIG. FIG. 6 is a diagram illustrating an example of a result obtained by converting an execution pattern log 22 in FIG. 4 is a diagram illustrating an example of an analysis rule 24. FIG. It is a figure which shows an example of the analysis rule 25 after edit. 3 is a diagram illustrating an example of an analysis target log 31. FIG. It is a flowchart which shows an example of operation | movement of the rule production | generation apparatus 1 which concerns on embodiment of this invention.

  Next, preferred embodiments of the present invention will be described with reference to the drawings. The embodiment described below is an embodiment when the present invention is applied to a rule generation device.

  First, the configuration and function of the rule generation device 1 according to the embodiment of the present invention will be described with reference to FIG.

  1 is a diagram illustrating an example of a schematic configuration of the rule generation device 1 according to the embodiment of the present invention, FIG. 2 is a diagram illustrating an example of a variable rule 21, and FIG. 3 is a diagram of sourcefile 001. FIG. 4 is a diagram illustrating an example of an execution pattern log 22 obtained by an operation for generating a target file 001 using FIG. 4, and FIG. 4 is a diagram illustrating an example of a result obtained by converting the execution pattern log 22 using a variable rule 21; FIG. 5 is a diagram showing an example of the execution pattern log 22 obtained by creating the target file 002 by performing the same operation using the source file 002. FIG. 6 shows the result of converting the execution pattern log 22 by the variable rule 21. FIG. 7 is a diagram illustrating an example of the analysis rule 24, and FIG. 8 is a diagram of the analysis rule 25 after editing. It is a diagram illustrating a FIG. 9 is a diagram illustrating an example of an analysis target log 31.

  As shown in FIG. 1, a rule generation device 1 (an example of an analysis rule generation device) according to the present embodiment includes a variable rule registration unit 11, an execution pattern acquisition unit 12 (an example of an acquisition unit), an abstraction unit 13 (an example of an abstraction unit) and a rule generation unit 14 (an example of a rule generation unit).

  The variableization rule registration unit 11 stores a character string such as a file name or a directory name to be abstracted depending on the environment of the rule generation device 1 as a variableization rule 21 when executing an operation to be generated as an analysis rule. Register to 2.

  The execution pattern acquisition unit 12 executes an operation desired to be generated as an analysis rule, and stores a log generated during execution in the storage unit 2 as an execution pattern log 22.

  The abstraction unit 13 reads the execution pattern log 22, converts the character string on the execution pattern log 22 by the variable rule 21, and stores it as the pattern variable log 23 in the storage unit 2. Note that the rule generation apparatus 1 executes the same pattern operation a plurality of times, and generates the pattern variable log 23 obtained by the above-described processes.

  The rule generation unit 14 extracts a log sequence that is output in the same way from the pattern variableization log 23 generated by the pattern operation similar to the above, edits and assigns information such as a management name, and then stores it as an analysis rule 24 Register with Part 2.

  The storage unit 2 stores a variable rule 21, an execution pattern log 22, a pattern variable log 23, an analysis rule 24, and a post-edit analysis rule 25.

  The variable rule 21 includes a character string that is abstracted as a variable when generating an analysis rule based on the environment of the rule generation device 1 and a variable that replaces the character string. For example, as a log related to file operation, as shown in FIG. 2, a character string as a key is handled as an input file, an output file, a temporary directory, and a character string name. And the variable name to be replaced.

  As shown in FIGS. 3 and 5, the execution pattern log 22 is a log acquired by the execution pattern acquisition unit 12 as a result of performing the operation of the analysis target device 3 to be detected by the log analysis device 4 in the rule generation device 1. . Even if the same operation is performed in the rule generation device 1, the state of the device is not necessarily the same, and even if the same operation is performed due to the difference in the capacity and format of the file to be used, the same operation is performed. It is not always possible to obtain logs.

  The analysis target apparatus 3 has an analysis target log 31 output from the analysis target apparatus 3 itself that is desired to detect an operation.

  The log analysis device 4 includes an analysis rule conversion unit 41 and an analysis unit 42.

  The analysis rule conversion unit 41 reads the analysis rule 24, and the management name of the operation to be analyzed specified from the outside with respect to the analysis target log 31 is defined by the variable rule 21 specified from outside. Is substituted in the storage unit 2 as the analysis rule 25 after editing.

  The analysis unit 42 reads the analysis target log 31, performs pattern matching between the analysis target log 31 and the edited analysis rule 25, and outputs an analysis result. At this time, if a variable remains in the post-edit analysis rule 25, it is interpreted as an arbitrary value.

  Specifically, when pattern matching is performed on the contents of the post-edit analysis rule 25 shown in FIG. 8 and the contents of the analysis target log 31 shown in FIG. 9, the same pattern as the content of the post-edit analysis rule 25 is analyzed. Since it exists in the contents of the target log 31, it can be detected that a similar operation that has been performed in the rule generation device 1 has occurred in the analysis target device 3 when the execution pattern log 22 is generated.

  Next, an example of the operation of the rule generation device 1 according to the present embodiment will be described with reference to FIG. FIG. 10 is a flowchart showing an example of the operation of the rule generation device 1 according to the embodiment of the present invention.

  First, when executing an operation to be generated as an analysis rule, the variable rule registration unit 11 depends on the environment of the rule generation device 1 and uses a character string such as a file name or directory name to be abstracted as a variable rule 21. Register in the storage unit 2 (step S101).

  Next, the execution pattern acquisition unit 12 executes an operation desired to be generated as an analysis rule (step S102), and stores a log generated during the execution in the storage unit 2 as an execution pattern log 22 (step S103).

  Next, the abstraction unit 13 reads the execution pattern log 22 stored in the storage unit 2 (step S104), converts the character string on the execution pattern log 22 using the variable rule 21 (step S105), and the pattern variable. It stores in the storage unit 2 as the conversion log 23 (step S106). The rule generation device 1 generates the pattern variable log 23 by executing the processes of the execution pattern acquisition unit 12 and the abstraction unit 13 a plurality of times.

  Next, the rule generation unit 14 reads a plurality of pattern variable conversion logs 23 stored in the storage unit 2 (step S107), and logs that are output in the same manner from the pattern variable conversion log 23 generated by the same pattern operation as described above. After extracting a sequence (step S108) and editing and assigning information such as a management name, the sequence is registered in the storage unit 2 as the analysis rule 24 (step S109), and the operation ends.

  As described above, according to the present embodiment, the operation of the analysis target device 3 desired to be detected by analyzing the log is repeatedly performed on the rule generation device 1, so that the operation of the rule generation device 1, the file capacity, etc. Logs generated due to other than the above can be excluded from the analysis rule, and a highly accurate analysis rule can be automatically generated.

  In addition, this invention is not limited to the said embodiment, It can change in the range which does not deviate from the summary.

DESCRIPTION OF SYMBOLS 1 Rule generator 11 Variable rule registration part 12 Execution pattern acquisition part 13 Abstraction part 14 Rule generation part 2 Memory | storage part 21 Variable rule 22 Execution pattern log 23 Pattern variableization log 24 Analysis rule 25 Edited analysis rule 3 Analysis object Device 31 Analysis target log 4 Log analysis device 41 Analysis rule conversion unit 42 Analysis unit

Claims (5)

In the analysis rule generation device that generates an analysis rule for analyzing the operation of the analysis target device,
An acquisition means for acquiring an execution pattern log generated by executing an operation of the analysis target device in the analysis rule generation device;
Abstraction means for converting a character string on the execution pattern log by a variableization rule indicating a character string to be abstracted as a variable and generating a pattern variableization log;
Rule generation for generating the analysis rule based on a plurality of pattern variableization logs generated by executing the acquisition process by the acquisition unit and the generation process by the abstraction unit a plurality of times on the analysis rule generation device Means,
An analysis rule generation device comprising: The analysis rule generation device according to claim 1,
The analysis rule generation device, wherein the rule generation unit generates the analysis rule by extracting a common part of each log from the plurality of generated pattern variable logs. In the analysis rule generation method of the analysis rule generation device that generates an analysis rule for analyzing the operation of the analysis target device,
An acquisition step of acquiring an execution pattern log generated by executing the operation of the analysis target device in the analysis rule generation device;
An abstraction step of generating a pattern variableization log by converting a character string on the execution pattern log by a variableization rule indicating a character string to be abstracted as a variable;
Rule generation for generating the analysis rule based on a plurality of pattern variableization logs generated by executing the acquisition process in the acquisition step and the generation process in the abstraction step a plurality of times on the analysis rule generation device Process,
An analysis rule generation method characterized by comprising: A computer included in the analysis rule generation device that generates an analysis rule for analyzing the operation of the analysis target device,
An acquisition unit for acquiring an execution pattern log generated by executing the operation of the analysis target device in the analysis rule generation device;
Abstraction means for converting a character string on the execution pattern log by a variableization rule indicating a character string to be abstracted as a variable and generating a pattern variableization log; and
Rule generation for generating the analysis rule based on a plurality of pattern variableization logs generated by executing the acquisition process by the acquisition unit and the generation process by the abstraction unit a plurality of times on the analysis rule generation device means,
A program for an analysis rule generation device, characterized in that the program is made to function as:   5. A recording medium in which the analysis rule generation device program according to claim 4 is recorded in a computer-readable manner.

Images