Abstract: In an information processing apparatus, a first deletion unit deletes, from sets stored in a storage unit, sets having less than a threshold number of included elements and elements existing in only sets whose number is less than a threshold number of occurrences. A grouping unit generates a group of sets associated with each other in terms of commonality of elements out of the sets remaining in the storage unit. A second deletion unit deletes, with respect to each generated group, sets having less than the threshold number of included elements and elements existing in only sets whose number is less than the threshold number of occurrences, from the sets belonging to the group. An output unit outputs a list of elements included in the sets remaining in each group where there are no sets or elements that need to be deleted.

Abstract: A computer supports generating a model of transactions in which services are processed in multiple layers. The computer refers to start times and end times of processings, which are invoked and generated from another processing in the services, of the same server to calculate time intervals between the processings. The computer generates possible thresholds indicating thresholds that are possible criteria for grouping the processings according to the time intervals between the processings. The computer puts together, for each of the generated possible thresholds, consecutive processings, in which the time intervals between the processings are equal to or smaller than the possible threshold, into the same group to generate a group that the processings belong to. The computer divides a group, among the generated groups, without a processing serving as an invoker into processing-by-processing groups. The computer determines the possible threshold with the least number of groups as the threshold.

Abstract: When a second pattern is to be generated by adding an event to a first pattern including events, an extraction program causes a computer to execute the following process based on combinations of events. That is, the extraction program causes the computer to generate the second pattern when the number of occurrence, in the second pattern, of each of the events included in the combinations is not more than a threshold. The extraction program causes the computer to calculate, based on data including a plurality of events, a frequency at which one or more of the generated second patterns occur in the data. The extraction program causes the computer to extract the second pattern having the frequency satisfying a predetermined condition. The extraction program causes the computer to add a new event to the extracted second pattern.

Abstract: According to one aspect, a computer-readable recording medium stores therein an extracting program 330a causing a computer to execute a process. The process includes based on event data obtained by associating a plurality of events stored in a storage unit and an occurrence time of each event, sequentially adding an event to a first pattern obtained by associating the plurality of events and the occurrence order of each event, and sequentially generating a second pattern which includes the first pattern and occurs in the event data; and extracting a pattern which satisfies a predetermined condition from the generated second pattern.

Abstract: A method for detecting an abnormal transition pattern from a transition pattern includes: first extracting an episode pattern with an appearance frequency greater than or equal to a first frequency from an episode pattern represented with a description form so as to include a first transition pattern and a second transition pattern differing in an order of a part of items from the first transition pattern to have a complementary relation thereto; second extracting a third transition pattern with an appearance frequency greater than or equal to a second frequency from the transition pattern; and specifying a transition pattern other than the third transition pattern from transition patterns included in the extracted episode pattern, and determining an abnormal transition pattern based on the transition pattern specified in the specifying when the third transition pattern includes a fourth transition pattern corresponding to the extracted episode pattern in the first extracting.

Abstract: A computer-readable, non-transitory medium stores the system analysis program which can accurately analyze the operational status of a system without modifying functions of the system for providing services. A message analysis unit analyzes the contents of collected messages, and determines the times of occurrence of the messages, the process types requested by the messages, and whether or not each of the messages is a request message or a response message. In response to an instruction for model generation, a model generation unit generates a transaction model satisfying at least one limiting condition related to caller-called relationships between processes, based on a set of messages selected in accordance with a selection criterion based on the certainty of existence of caller-called relationships. Then, in response to an instruction for analysis, an analysis unit analyzes the processing status of a transaction based on a protocol log conforming to the transaction model.

Abstract: A collation device generates an NFA by generating an automaton corresponding to an event pattern, replicating an automaton part corresponding to the same series part in which events are connected in the same series in the generated automaton for a plurality of series, substituting each replicated automaton part with a transition that is received in an event of each series, and combining each substituted automaton part through an ? transition. In addition, the collation device collates whether or not the event pattern is included in an event stream by comparing the event stream and the NFA and receiving an event included in the event stream in an NFA part corresponding to a series in which the event occurs out of the replicated NFA parts and operating the NFA part.

Abstract: A trajectory interpolation apparatus is disclosed. The first storage part stores first time and first location information of a movable body at the first time. The second storage stores second time and second location information of the movable body at the second time. The calculation part calculates a first moving distance from the first time and a second moving distance from the second time based on a relationship between the time and the speed stored in the second storage part, regarding third time between the first time and the second time. The determination part determines, as the interpolation point, one of intersection points for a circle in which the first location is set as its center and the first moving distance is set as its radius, and another circle in which the second location is set as its center and the second moving distance is set as its radius.

Abstract: In an information processing apparatus, a first deletion unit deletes, from sets stored in a storage unit, sets having less than a threshold number of included elements and elements existing in only sets whose number is less than a threshold number of occurrences. A grouping unit generates a group of sets associated with each other in terms of commonality of elements out of the sets remaining in the storage unit. A second deletion unit deletes, with respect to each generated group, sets having less than the threshold number of included elements and elements existing in only sets whose number is less than the threshold number of occurrences, from the sets belonging to the group. An output unit outputs a list of elements included in the sets remaining in each group where there are no sets or elements that need to be deleted.

Abstract: A data partitioning apparatus receives stream data and stores with previous-and-subsequent information that specifies data previous and subsequent to the data. Then, for groups, each of which contains the data that are stored and that are partitioned into the number of the groups, the data partitioning apparatus stores top information specifying data located at the top in a corresponding group and end information specifying data located at the end in the corresponding group. Then, when new data is stored, the data partitioning apparatus specifies data previous and subsequent to the new data and stores the new data by associating it with the previous-and-subsequent information that specifies the data previous and subsequent to the new data. Then, when data is inserted, the data partitioning apparatus updates information for each group such that the difference between the number of data belonging to each group is equal to or less than one.

Abstract: An apparatus includes a unit dividing a region into blocks having a predetermined bit length and generating addition data having the predetermined bit length corresponding to coordinate data, a unit storing storage data having the predetermined bit length, a unit generating composite data having a bit length twice the length of the predetermined bit length by connecting the addition data to the storage data, and storing the composite data, and a unit repeating an operation of designating the bit length of the composite data as the predetermined bit length, instructing to generate the addition data, and instructing to generate and store the composite data. The number of different bits between a bit string of a location corresponding to the input coordinate data and a bit string of a reference location tends to increase as a distance between the location corresponding to the coordinate data and the reference location increases.

Abstract: The matching apparatus 100 stores, with respect to a branching pattern included in event patterns 140a, a reception time of an event that serves as the branching point in a source node that indicates the transition destination of the event, connects the source node to the branch node by a transition with an interval condition, connects the branch nodes to the link node that indicates the linking point at which these branch nodes are linked together, and thereby generates NFAs 140b. Then, the matching apparatus 100 compares event streams 140c with the NFAs 140b to determine whether the event streams 140c includes the event patterns 140a.

Abstract: A computer-readable, non-transitory medium stores the system analysis program which can accurately analyze the operational status of a system without modifying functions of the system for providing services. A message analysis unit analyzes the contents of collected messages, and determines the times of occurrence of the messages, the process types requested by the messages, and whether or not each of the messages is a request message or a response message. In response to an instruction for model generation, a model generation unit generates a transaction model satisfying at least one limiting condition related to caller-called relationships between processes, based on a set of messages selected in accordance with a selection criterion based on the certainty of existence of caller-called relationships. Then, in response to an instruction for analysis, an analysis unit analyzes the processing status of a transaction based on a protocol log conforming to the transaction model.

Abstract: A matching device builds a parse tree from an event pattern. The matching device builds an automaton by, while traversing the parse tree, joining child nodes of an AND node in parallel to the AND node and joining child nodes of an OR node in parallel to the OR node. The matching device performs matching of determining whether an event stream includes the event pattern by comparing the event stream with the automaton.

Abstract: A computer-readable, non-transitory medium stores the system analysis program which can accurately analyze the operational status of a system without modifying functions of the system for providing services. A message analysis unit analyzes the contents of collected messages, and determines the times of occurrence of the messages, the process types requested by the messages, and whether or not each of the messages is a request message or a response message. In response to an instruction for model generation, a model generation unit generates a transaction model satisfying at least one limiting condition related to caller-called relationships between processes, based on a set of messages selected in accordance with a selection criterion based on the certainty of existence of caller-called relationships. Then, in response to an instruction for analysis, an analysis unit analyzes the processing status of a transaction based on a protocol log conforming to the transaction model.

Abstract: An apparatus extracts an area having a highest score or a lowest score that is calculated based on evaluation values of points from a target area including a set of a plurality of points that can be distributed at two-dimensional coordinates. It determines whether the area extracted and an area overlapping a plurality of the target areas intersect with each other, and deletes an area having a lower score or a higher score out of the areas determined to intersect with each other. It selects an area having a highest score or a lowest score out of the areas extracted at the extracting and not deleted at the determining.

Abstract: In determining a condition of a case under which the occurrence rate of the performance abnormality is high based on information related to a resource utilization situation acquired in a resource utilization situation acquisition step and an occurrence frequency of a request acquired in a request occurrence frequency acquisition step, and information related to the existence/nonexistence of the performance abnormality determined in a performance abnormality existence/nonexistence determination step, when branching a parent node that represents a situation of a decision tree to two child nodes using the method of decision tree, the decision tree is generated using an evaluation function which performs branching such that most of normal samples which belong to the parent node are contained in the one child node, and most of abnormal values which belong to the parent node are contained in the other child node.

Abstract: A computer-readable, non-transitory medium stores the system analysis program which can accurately analyze the operational status of a system without modifying functions of the system for providing services. A message analysis unit analyzes the contents of collected messages, and determines the times of occurrence of the messages, the process types requested by the messages, and whether or not each of the messages is a request message or a response message. In response to an instruction for model generation, a model generation unit generates a transaction model satisfying at least one limiting condition related to caller-called relationships between processes, based on a set of messages selected in accordance with a selection criterion based on the certainty of existence of caller-called relationships. Then, in response to an instruction for analysis, an analysis unit analyzes the processing status of a transaction based on a protocol log conforming to the transaction model.

Abstract: A system analysis program which can accurately analyze the operational status of a system without modifying functions of the system for providing services. A message analysis unit analyzes the contents of collected messages, and determines the times of occurrence of the messages, the process types requested by the messages, and whether or not each of the messages is a request message or a response message. In response to an instruction for model generation, a model generation unit generates a transaction model satisfying at least one limiting condition related to caller-called relationships between processes, based on a set of messages selected in accordance with a selection criterion based on the certainty of existence of caller-called relationships. Then, in response to an instruction for analysis, an analysis unit analyzes the processing status of a transaction based on a protocol log conforming to the transaction model.

Abstract: Request grouping rules are maintained for grouping a system request based on information relating to a character string in the system request; call relation sets are created from the system requests sent and received among the servers and stored in the request history by associating the system requests by call relation; the call relation sets are converted into inter-request group call relation sets based on the maintained request grouping rules; along with a frequency of appearance of the request group in the request history, inter-request group call relation patterns are derived for each request group, each inter-request group call relation pattern consisting of the request group invoking and the request group invoked by the request group in question; a rating value is calculated for rating the request groups based on the derived inter-request group call relation pattern.