Information processing system, information processing method and storage medium

• US 9,666,064 B2
• Filed: 04/15/2014
• Issued: 05/30/2017
• Est. Priority Date: 04/23/2013
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Nakazawa, Satoshi, Ishizawa, Yoshio
• Primary Examiner(s): Bugg, George
• Assistant Examiner(s): Akki, Munear
• Application Number:
  US14/782,373
• Publication Number:
  US 20160063852A1
• Time in Patent Office: 1,141 Days
• Field of Search: 3405731, 340506, 340 51, 340 553, 386261, 348143, 348E07085, 348162, 348152, 348150, 382100, 382103, 382107, 382155, 382173, 382224
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06V 20/52 Surveillance or monitoring of activities, e.g. for recognising suspicious objects recognising microscopic objects G06V20/69
• CPC Class Codes: G08B 21/02 Alarms for ensuring the safety of persons
• CPC Class Codes: G08B 31/00 Predictive alarm systems characterised by extrapolation or other computation using updated historic data

Abstract

To support work of an operator of a monitoring system to set a monitoring rule depending on an environment to be monitored. An information processing system includes an environment expression extracting unit which extracts environment expressions from incident information expressing a certain incident, which includes the environment expressions expressing environments to be monitored and action expressions expressing actions performed in the environments; an action expression extracting unit which extracts the action expressions from the incident information; and an information collecting unit which generates information in which the extracted action expressions are associated with the environment expressions expressing the environments when the actions expressed by the action expressions have been performed among the extracted environment expressions, conducts a search with respect to the generated information, with the action expressions as a key, and calculates, on the basis of the search, frequency at which the environment expressions have been extracted.

Claims

1. An information processing system comprising circuitry configured to:

extract environment expressions from incident information, which describes an incident in which what abnormal action was performed in what environment, and which includes

the environment expressions expressing the environments to be monitored and

action expressions expressing actions performed in the environments;

extract the action expressions from the incident information;

generate information in which the extracted action expressions are associated with the environment expressions expressing the environments when the actions expressed by the action expressions have been performed among the extracted environment expressions, conducts a search with respect to the generated information, with the action expressions as a key, and calculates, on the basis of the search, frequency at which the environment expressions have been extracted;

store the action expressions and the associated environment;

refer to the stored expressions, and, when the frequency at which the environment expressions associated with a specific action expression among the stored action expressions have been extracted is higher than a predetermined threshold value, associates the specific action expression with the environment expressions having high frequency of extraction and outputs the associated expressions; and

generate a monitoring rule for monitoring occurrence of an abnormal circumstance, on the basis of the outputted environment expressions and action expression, the monitoring rule having a conditional clause in which the environments expressed by the environment expressions are satisfied and the action expressed by the action expression is detected.

2. The information processing system according to claim 1, the circuitry further configured to

in the outputting, output information indicating that the actions expressed by the action expressions are abnormal actions in the environments expressed by the environment expressions.

3. The information processing system according claim 1, the circuitry further configured to

associate an action expression with an environment expression extracted from the same incident information.

4. The information processing system according to claim 2, the circuitry further configured to

associate an action expression with an environment expression extracted from the same incident information.

5. The information processing system according to claim 1, the circuitry further configured to

associate an action expression with an environment expression extracted from the same sentence included in the incident information.

6. The information processing system according to claim 2, the circuitry further configured to

associate an action expression with an environment expression extracted from the same sentence included in the incident information.

7. The information processing system according to claim 3, the circuitry further configured to

associate an action expression with an environment expression extracted from the same sentence included in the incident information.

8. The information processing system according to claim 1, the circuitry further configured to

for an action expression having frequency of extraction exceeding a predetermined threshold value, in the outputting, output the action expression and an environment expression associated with the action expression.

9. The information processing system according to claim 2, the circuitry further configured to

for an action expression having frequency of extraction exceeding a predetermined threshold value, in the outputting, output the action expression and an environment expression associated with the action expression.

10. The information processing system according to claim 3, the circuitry further configured to

for an action expression having frequency of extraction exceeding a predetermined threshold value, in the outputting, output the action expression and an environment expression associated with the action expression.

11. The information processing system according to claim 4, the circuitry further configured to

for an action expression having frequency of extraction exceeding a predetermined threshold value, in the outputting, output the action expression and an environment expression associated with the action expression.

12. The information processing system according to claim 1, the circuitry further configured to

associate a plurality of expressions expressing the same or similar actions or environments with a typical expression which is a typical expression of the plurality of expressions, and stores the associated expressions;

and

refer to the stored typical expression, on the basis of the environment expressions or the action expressions, to replace the environment expressions or the action expressions with the typical expression.

13. The information processing system according to claim 2, the circuitry further configured to

associate a plurality of expressions expressing the same or similar actions or environments with a typical expression which is a typical expression of the plurality of expressions, and stores the associated expressions;

and

refer to the stored typical expression, on the basis of the environment expressions or the action expressions, to replace the environment expressions or the action expressions with the typical expression.

14. The information processing system according to claim 3, the circuitry further configured to

associate a plurality of expressions expressing the same or similar actions or environments with a typical expression which is a typical expression of the plurality of expressions, and stores the associated expressions;

and

refer to the stored typical expression, on the basis of the environment expressions or the action expressions, to replace the environment expressions or the action expressions with the typical expression.

15. The information processing system according to claim 4, the circuitry further configured to

associate a plurality of expressions expressing the same or similar actions or environments with a typical expression which is a typical expression of the plurality of expressions, and stores the associated expressions;

and

refer to the stored typical expression, on the basis of the environment expressions or the action expressions, to replace the environment expressions or the action expressions with the typical expression.

16. The information processing system according to claim 5, the circuitry further configured to

associate a plurality of expressions expressing the same or similar actions or environments with a typical expression which is a typical expression of the plurality of expressions, and stores the associated expressions;

and

refer to the stored typical expression, on the basis of the environment expressions or the action expressions, to replace the environment expressions or the action expressions with the typical expression.

17. An information processing method executed by a computer, comprising processes of:

extracting environment expressions from incident information, which describes an incident in which what abnormal action was performed in what environment, and which includes

the environment expressions expressing the environments to be monitored and

action expressions expressing actions performed in the environments;

extracting the action expressions from the incident information;

generating information in which the extracted action expressions are associated with the environment expressions expressing the environments when the actions expressed by the action expressions have been performed among the extracted environment expressions, conducts a search with respect to the generated information, with the action expressions as a key, and calculates, on the basis of the search, frequency at which the environment expressions have been extracted;

storing the action expressions and the associated environment expressions;

referring to the stored expressions, and, when the frequency at which the environment expressions associated with a specific action expression among the stored action expressions have been extracted is higher than a predetermined threshold value, associates the specific action expression with the environment expressions having high frequency of extraction and outputs the associated expressions; and

generating a monitoring rule for monitoring occurrence of an abnormal circumstance, on the basis of the outputted environment expressions and action expression, the monitoring rule having a conditional clause in which the environments expressed by the environment expressions are satisfied and the action expressed by the action expression is detected.

18. A non-transitory computer-readable storage medium storing a program which causes a computer to execute processing for:

extracting environment expressions from incident information, which describes an incident in which what abnormal action was performed in what environment, and which includes

the environment expressions expressing the environments to be monitored and

action expressions expressing actions performed in the environments;

extracting the action expressions from the incident information;

generating information in which the extracted action expressions are associated with the environment expressions expressing the environments when the actions expressed by the action expressions have been performed among the extracted environment expressions, conducts a search with respect to the generated information, with the action expressions as a key, and calculates, on the basis of the search, frequency at which the environment expressions have been extracted;

storing the action expressions and the associated environment expressions;

referring to the stored expressions, and, when the frequency at which the environment expressions associated with a specific action expression among the stored action expressions have been extracted is higher than a predetermined threshold value, associates the specific action expression with the environment expressions having high frequency of extraction and outputs the associated expressions; and

generating a monitoring rule for monitoring occurrence of an abnormal circumstance, on the basis of the outputted environment expressions and action expression, the monitoring rule having a conditional clause in which the environments expressed by the environment expressions are satisfied and the action expressed by the action expression is detected.