Method and apparatus for detecting causality

Abstract

A causality detection apparatus for detecting causality of events based upon a database provided with log of the events includes a sorter module for generating an event list by sorting in time sequence the events, and a frequency analysis module for calculating, based upon the event list, the number of appearance of an event set pair <X,Y> of a first event set X(={e.sub.x1,e.sub.x2, . . . ,e.sub.xn, . . . }, e.sub.xn indicates an event and n is a natural number) and a second event set Y(={e.sub.y1,e.sub.y2, . . . ,e.sub.yn, . . . }, e.sub.yn indicates an event), the number of appearance of the first event set X and the number of appearance of the second event set Y. The event set pair <X,Y> has co-occurrence so that the second event set Y occurs within a predetermined time period (window size W) after a time of occurrence of the first event set X. The apparatus further includes a causality detection module for detecting, based upon the number of appearance of the event set pair <X,Y>, upon the number of appearance of the first event set X and upon the number of appearance of the second event set Y, significance of causality caused by the first event set X to occur the second event set Y within the window size W.

Description

FIELD OF THE INVENTION

The present invention relates to a method and apparatus for detecting causality in data mining technology for discovering useful information in a database. Particularly, the present invention relates to a causality detection method and apparatus for automatically detecting a set of events concerning cause and effect from the event log. The invention may be applied to fault management for forecasting a fault or for identifying the cause of a fault in accordance with the system log, and to identification of causality between the environment factor and the amount sold of each item in a field of sales promotion.

DESCRIPTION OF THE RELATED ART

As for a fundamental technology with respect to the problem of discovering causality from a database of event log, an algorithm for discovering association rules is described in R. Agrawal and R. Srikant, "Fast Algorithms for Mining Association Rules", 20th VLDB, pp.487-499, 1994.

This known algorithm for mining association rules first finds sets of items (itemsets) that have transaction support equal to or above a predetermined threshold (minimum support called as minsup) from a database in which each transaction is constituted by several itemsets, and then using the found itemsets to generate association rules that have confidence equal to or above a predetermined threshold (minimum confidence called as minconf).

The support and the confidence of the association rule XY (X and Y are itemsets) are defined as follows.

Support=(the number of transactions including X.orgate.Y)/(the number of all transactions)

Confidence=(the number of transactions including X.orgate.Y)/(the number of all transactions including X)

The following is the itemsets generation algorithm.

L.sub.1 ={1-itemsets}; for (k=2; L.sub.k-1 .noteq.0; k++) do begin C.sub.k =apriori-gen(L.sub.k-1); forall transaction tr.di-elect cons.D do begin C.sub.tr =subset(C.sub.k,tr); forall candidates c.di-elect cons.C.sub.tr do c.count++; end L.sub.k ={c.di-elect cons.C.sub.k .vertline. c.count.gtoreq.minsup}; end Answer=.orgate..sub.k L.sub.k ;

This algorithm is one for generating itemsets having supports more than or equal to the minimum support (minsup). In the algorithm, L.sub.k represents a set of k-itemsets with the minimum support (minsup), and C.sub.k represents a set of candidate k-itemsets. Each member of the sets has two fields of item set and support count.

As will be understood, the first pass of this algorithm simply counts item occurrences to determine the single-itemsets (1-itemsets) L.sub.1. The subsequent pass k consists of two phases. First, the itemsets L.sub.k-1 found in the (k-1)th pass are used to generate the candidate k-itemsets C.sub.k using the apriori-gen function described in the aforementioned reference. Then, the database D is scanned and the support of candidates in C.sub.k that are contained in a given transaction tr is counted. Thus, a set of candidates C.sub.tr is obtained, and for each candidate c contained in C.sub.tr, a record of the number of appearance of the candidate c is incremented. After the above-mentioned process is executed for all the transactions, a set of candidates in C.sub.k that have the record of the number of appearance equal to or more than the minimum support (minsup) is determined to L.sub.k. If L.sub.k is an empty set, a union of L.sub.1 to L.sub.k is itemsets to be generated.

The following is an algorithm for mining an association rule that has a confidence equal to or more than the minimum confidence (minconf) from the itemsets generated by the above-mentioned itemsets generation algorithm.

Answer=0

forall I.di-elect cons..orgate..sub.k L.sub.k do forall J.di-elect cons. subset of I do if confidence of Rule "I-JJ"&gt;minconf then Answer=Answer .orgate. "I-JJ";

In this algorithm, a partial set J is derived from each of the generated itemsets I and outputted when a confidence of the association rule "I-JJ" is equal to or more than the minimum confidence (minconf).

Such conventional algorithm for discovering association rules can detect co-occurrence of items within a single transaction, but cannot detect co-occurrence of items between different transactions. Thus, it is impossible to detect causality between an event contained in one transaction and an event contained in another transaction.

In order to detect co-occurrence of the events, calculation of frequency of appearance of each pair of events is necessary. However, the calculation of the frequency of appearance for event pairs with respect to all appeared events, that calculation is necessary for detecting the co-occurrence contained in the different transactions, will invite explosive increase in the number of combination of events.

In addition, according to the conventional algorithm, a threshold value concerning confidence of the rule such as the minimum confidence (minconf) is required. However, this minconf threshold has to be, in fact, determined by experienced operator in consideration of contents in the database.

SUMMARY OF THE INVENTION

It is therefore an object of the present invention to provide a method and apparatus for detecting causality, whereby causality can be derived by detecting co-occurrence between different transactions.

Another object of the present invention is to provide a method and apparatus for detecting causality, whereby necessary calculation of frequency of appearance with respect to a pair of events can be effectively executed without using a threshold value concerning confidence of the causality.

According to the present invention, a causality detection apparatus for detecting causality of events based upon a database provided with log of the events is provided. This apparatus includes a sorter module for generating an event list by sorting in time sequence the events, and a frequency analysis module for calculating, based upon the event list, the number of appearance of an event set pair &lt;X,Y&gt; of a first event set X (={e.sub.x1,e.sub.x2, . . . ,e.sub.xn, . . . }, e.sub.xn indicates an event and n is a natural number) and a second event set Y (={e.sub.y1,e.sub.y2, . . . ,e.sub.yn, . . . }, e.sub.yn indicates an event), the number of appearance of the first event set X and the number of appearance of the second event set Y. The event set pair &lt;X,Y&gt; has co-occurrence so that the second event set Y occurs within a predetermined time period (window size W) after a time of occurrence of the first event set X. The apparatus further includes a causality detection module for detecting, based upon the number of appearance of the event set pair &lt;X,Y&gt;, upon the number of appearance of the first event set X and upon the number of appearance of the second event set Y, significance of causality caused by the first event set X to occur the second event set Y within the window size W.

Also according to the present invention, a causality detection apparatus for detecting causality of events based upon a database provided with log of the events is provided. This apparatus includes a sorter module for generating an event list by sorting in time sequence the events, and a frequency analysis module for calculating, based upon the event list, the number of appearance of an event pair &lt;e.sub.x,e.sub.y &gt; of a first event e.sub.x and a second event e.sub.y, the number of appearance of the first event e.sub.x and the number of appearance of the second event e.sub.y. The event pair &lt;e.sub.x,e.sub.y &gt; has co-occurrence so that the second event set e.sub.y occurs within a predetermined time period (window size W) after a time of occurrence of the first event set e.sub.x. The apparatus further includes a causality detection module for detecting, based upon the number of appearance of the event pair &lt;e.sub.x,e.sub.y &gt;, upon the number of appearance of the first event e.sub.x and upon the number of appearance of the second event e.sub.y, significance of causality caused by the first event e.sub.x to occur the second event e.sub.y within the window size W.

According to the present invention, furthermore, a causality detection method of detecting causality of events based upon a database provided with log of the events is provided. This method includes a sorting step of generating an event list by sorting in time sequence the events, and a frequency analysis step of calculating, based upon the event list, the number of appearance of an event set pair &lt;X,Y&gt; of a first event set X (={e.sub.x1,e.sub.x2, . . . ,e.sub.xn, . . . }, e.sub.xn indicates an event and n is a natural number) and a second event set Y (={e.sub.y1,e.sub.y2, . . . e.sub.yn, . . . }, e.sub.yn indicates an event), the number of appearance of the first event set X and the number of appearance of the second event set Y. The event set pair &lt;X,Y&gt; has co-occurrence so that the second event set Y occurs within a predetermined time period (window size W) after a time of occurrence of the first event set X. The method further includes a causality detection step of detecting, based upon the number of appearance of the event set pair &lt;X,Y&gt;, upon the number of appearance of the first event set X and upon the number of appearance of the second event set Y, significance of causality caused by the first event set X to occur the second event set Y within the window size W.

Also according to the present invention, a causality detection method of detecting causality of events based upon a database provided with log of the events is provided. This method includes a sorting step of generating an event list by sorting in time sequence the events, and a frequency analysis step of calculating, based upon the event list, the number of appearance of an event pair &lt;e.sub.x,e.sub.y &gt; of a first event e.sub.x and a second event e.sub.y, the number of appearance of the first event e.sub.x and the number of appearance of the second event e.sub.y. The event pair &lt;e.sub.x,e.sub.y &gt; has co-occurrence so that the second event set e.sub.y occurs within a predetermined time period (window size W) after a time of occurrence of the first event set e.sub.x. The method further includes a causality detection step of detecting, based upon the number of appearance of the event pair &lt;e.sub.x,e.sub.y &gt;, upon the number of appearance of the first event e.sub.x and upon the number of appearance of the second event e.sub.y, significance of causality caused by the first event e.sub.x to occur the second event e.sub.y within the window size W.

It is preferred that the numbers are calculated during intermediate period between a time of occurrence of the first event set X or the first event e.sub.x and a time of occurrence of the second event set Y or the second event e.sub.y when none of the first and second event sets X and Y or none of the first and second events e.sub.x and e.sub.y is occurring.

It is also preferred that, with respect to each event set pair &lt;X,Y&gt; or each event pair &lt;e.sub.x,e.sub.y &gt;, the values of information criteria of two models based upon log likelihoods of the models and upon the number of parameters used in the models, one of the models postulating the existence of causality and the other one of the models postulating no existence of causality are calculated, and significance of causality is detected by comparing the calculated values of information criteria. Thus, necessary calculation of frequency of appearance with respect to event set pair or event pair can be effectively executed without using parameters concerning confidence of the causality.

In this case, it is preferably decided that there exists significance of causality when the calculated value of information criteria of the model which postulates the existence of causality is smaller than the calculated value of information criteria of the model which postulates no existence of causality.

It is also preferred that a local list which is a part of the event list is generated, and then an event list is provides by updating in inverse time sequence the local list.

It is preferred that the number of appearance of an event set pair &lt;X,Y&gt; or an event pair &lt;e.sub.x,e.sub.y &gt; of a first event set X (={e.sub.x1,e.sub.x2, . . . ,e.sub.xn, . . . }, e.sub.xn indicates an event and n is a natural number) or a first event e.sub.x occurred at a time t.sub.i (i is an integer equal to or more than 0) and a second event set Y (={e.sub.y1,e.sub.y2, . . . ,e.sub.yn, . . . }, e.sub.yn indicates an event) or a second event e.sub.y occurred at a time t.sub.k (t.sub.i &lt;t.sub.k &lt;t.sub.i +w, i and k are integers equal to or more than 0, w is the predetermined time period) in the event list is calculated. The event set pair &lt;X,Y&gt; or the event pair &lt;e.sub.x,e.sub.y &gt; satisfies a sequence condition of .A-inverted.e.sub.x .di-elect cons.X, e.sub.y .di-elect cons.Y, e.sub.z .di-elect cons.Z, e.sub.x .noteq.e.sub.z and e.sub.y .noteq.e.sub.z with respect to the first event set X or the first event e.sub.x, the second event set Y or the second event e.sub.y and a third event set Z (={e.sub.z1,e.sub.z2, . . . ,e.sub.zn, . . . }, e.sub.zn indicates an event) or a third event e.sub.z occurred at an optional time t.sub.j which satisfies t.sub.i &lt;t.sub.j &lt;t.sub.k (j is an integer equal to or more than 0). The calculation of the number of appearance of the event set pair &lt;X,Y&gt; or the event pair &lt;e.sub.x,e.sub.y &gt; is executed by updating a set of events NB.sub.q occurred between a time t.sub.p+1 and a time t.sub.q (p&lt;q.ltoreq.m(p), m(p) is a natural number), and by updating a set of events H.sub.q which satisfy the sequence condition and are contained in a fourth event set E' (={e.sub.e1,e.sub.e2, . . . ,e.sub.en, . . . }, e.sub.en indicates an event) or a fourth event e.sub.e occurred at a time t.sub.q (p&lt;q&lt;m(p)) and in optional events at the time t.sub.p+1, with updating a local list which is a part of the event list (event list at times t.sub.p,t.sub.p+1, . . . t.sub.m(p), t.sub.m(p) &lt;t.sub.p +w&lt;t.sub.m(p)+1). Thus, the number of appearance of the event set pair &lt;X,Y&gt; or the event pair &lt;e.sub.x,e.sub.y &gt; can be effectively obtained.

Further objects and advantages of the present invention will be apparent from the following description of the preferred embodiments of the invention as illustrated in the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram showing a basic constitution of a causality detection apparatus according to the present invention;

FIG. 2 is a flow chart illustrating an algorithm for detecting causality according to the apparatus shown in FIG. 1;

FIG. 3 shows a model of event occurrence used for performance evaluation in a stochastic test according to the present invention;

FIG. 4 illustrates relationship of the number of rules to be tested with respect to period of log data;

FIG. 5 illustrates relationship of the number of the remaining rules with respect to period of log data; and

FIG. 6 illustrates relationship of miss detection ratio with respect to period of log data.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

Suppose that E represents a set of all events and T represents a time at which the last event occurred. A set of events E.sub.i ={e.sub.i1, e.sub.i2, . . . } (E.sub.i .OR right.E} occurred at a time t.sub.i (0.ltoreq.i.ltoreq.T) or occurred within a predetermined time period before and after the time t.sub.i are called as a transaction. Even if each of the events in the transaction occurs for a time period, the events in the different transactions will not occur to overlap with each other.

If an event e.sub.x occurred at a time t.sub.i and an event e.sub.y occurred at a time t.sub.k (t.sub.i &lt;t.sub.k .ltoreq.t.sub.i +w, where w is the maximum value of elapsed time between cause and result (window size)) satisfy the following conditions, there is the possibility that causality from e.sub.x to e.sub.y may exist. This causality is expressed by C.sub.w (e.sub.x,e.sub.y).

e.sub.x .noteq.e.sub.z and e.sub.y .noteq.e.sub.z, where e.sub.z is an event occurred at a time t.sub.j (t.sub.i &lt;t.sub.j &lt;t.sub.k).

Hereinafter, the causality rule that "the event e.sub.x occurred at a time t.sub.i causes the occurrence of the event e.sub.y at a time t.sub.k (t.sub.i &lt;t.sub.k .ltoreq.t.sub.i +w)" is indicated by the following expression.

e.sub.x e.sub.y (e.sub.x,e.sub.y .di-elect cons.E, e.sub.x .noteq.e.sub.y)

In order to discover this causality rule, according to the present invention, the number of appearance of all candidates which have the possibility of causality is detected and a stochastic test is used for confirming whether the causality rule is correct. The number of appearance of event pair &lt;x,y&gt; under the condition of Cw(e.sub.x,e.sub.y) and the number of appearance of the event x are indicated as n.sub.1 (x,y) and n(x), respectively. In this case, x is called as a body and y is called as a head.

FIG. 1 is a block diagram showing a basic constitution of a causality detection apparatus according to the present invention, and FIG. 2 is a flow chart illustrating an algorithm for detecting causality according to the apparatus of FIG. 1. The following is detection processes of the causality.

At a sorter module 11, an event list in which transactions are arranged in time sequence is produced from sequential data of events stored in a database 12 (step 101). This sorter module 11 can be realized by means of for example typical database control functions. The produced event list is, as shown in Table 1, a list of event sets E.sub.1 to E.sub.T at time t.sub.1 to t.sub.T.

TABLE 1______________________________________EVENT LISTTIME SET OF EVENTS______________________________________t.sub.1 E.sub.1 = {e.sub.11, e.sub.12, e.sub.13, . . . }t.sub.2 E.sub.2 = {e.sub.21, e.sub.22, e.sub.23, . . . }t.sub.3 E.sub.3 = {e.sub.31, e.sub.32, e.sub.33, . . . }t.sub..tau. E.sub..tau. = {e.sub..tau.1, e.sub..tau.2, e.sub..tau.3, . . . }______________________________________

If this event list is too large, it is impossible to store all the event list in a main memory module 13 in a computer, just as they are. To solve this problem, according to the present invention, a local list in which a part of the transactions in the event list, occurred within a window size W from a certain time t.sub.p, are arranged in time sequence is produced and stored in the main memory module 13 (step 102). The produced local list is, as shown in Table 2, a list of event sets E.sub.p to E.sub.p+m(p) at time t.sub.p to t.sub.p+m(p).

TABLE 2______________________________________LOCAL LISTTIME SET OF EVENTS______________________________________t.sub.p E.sub.p = {e.sub.p1, e.sub.p2, e.sub.p3, . . . }t.sub.p+1 E.sub.p+1 = {e.sub.(p+1)1, e.sub.(p+1)2, e.sub.(p+1)3, . . . }t.sub.p+2 E.sub.p+2 = {e.sub.(p+21, e.sub.(p+2)2, e.sub.(p+2)3, . . . }t.sub.p+m(p) E.sub.P+m(p) = e.sub.(p+m(p))1, e.sub.(P+m(p))2, e.sub.(P+m(p))3, . . . }______________________________________

Then, all data in the event list are scanned with updating the time of the top transaction and the time of the last transaction (step 103). It is important that the update of the local list is to be executed in inverse time sequence from the last time t.sub.T. A frequency analysis module 14 updates two kinds of frequency tables shown as Tables 3 and 4 with updating the local list (step 104). The frequency table of Table 3 records the number of appearance of each event in the event list and the frequency table of Table 4 records the number of appearance of each event pair.

TABLE 3______________________________________FREQUENCY TABLE THE NUMBER OFEVENT APPEARANCE______________________________________x n (x)y n (y)______________________________________ TABLE 4______________________________________FREQUENCY TABLE THE NUMBER OFPAIR OF EVENT APPEARANCE______________________________________(x, y) n.sub.1 (x, y)(x', y') n.sub.1 (x', y')______________________________________

Following is a frequency analysis algorithm executed in the frequency analysis module 14.

______________________________________NB.sub.T =E.sub.T ;H.sub.T =E.sub.T ;LocalList=E.sub.T ;for p=T-1,T-2, . . . ,0 / inverse sequence / {NB.sub.p =E.sub.p ;H.sub.p =E.sub.p ;LocalList=LocalList+E.sub.p -(eventsets after time (t.sub.p +w) in LocalList);forall e.sub.x .di-elect cons.E.sub.p doincrement of n(e.sub.x);for q=1,2,3, . . . ,m(p) {H.sub.p+q =H.sub.p+q -E.sub.p ;forall e.sub.x .di-elect cons.E.sub.p -NB.sub.p+q forall e.sub.y .di-elect cons.H.sub.p+q increment of n.sub.p (e.sub.x, e.sub.y)NB.sub.p+q =NB.sub.p+q .orgate.E.sub.p ;}______________________________________ where NB.sub.q represents a set of events appeared in transactions from a time t.sub.p+1 to a time t.sub.q (q&gt;p). This event set NB.sub.q has an attribute of "in case that an event x at a time t.sub.p is the body and an event y at a time t.sub.q is the head, if x.di-elect cons.NB.sub.q, no causality C.sub.w (x,y) exists". H.sub.q represents a set of events y with a causality C.sub.w (x,y) in case that a certain event at a time t.sub.p+1 is the body and an event at a time t.sub.p is head. This event set H.sub.q has an attribute of "in case that the body is an event x' at a time t.sub.p and the head is an event y' at a time t.sub.q, if x' H.sub.p -E.sub.p, a causality C.sub.w (x',y) exists". Furthermore, m(p) represents a number which is less than the number of transactions in the local list by one. Therefore, the last time appeared in the local list will be t.sub.p+m(p).

As aforementioned, the calculation is executed by updating the local list in inverse time sequence (p=T-1,T-2, . . . ,0). Therefore, NB.sub.q and H.sub.q will be already known at the time t.sub.p causing the calculation to be partially omitted. As a result, the number of appearance can be efficiently obtained.

A causality detection module 15 detects whether there is a causality or not in each of all the event pairs appeared in the frequency table (Table 4) by using a stochastic test strategy. In order to detect the causality of the event pair &lt;x,y&gt;, following four parameters n.sub.1, n.sub.2, n.sub.3 and n.sub.4 are used:

n.sub.1 is the number of transactions including events x with C.sub.w (x,y); n.sub.2 is the number of transactions excluding events y with C.sub.w (x,y) and also including events x; n.sub.3 is the number of transactions excluding events x with C.sub.w (x,y) and also including events y; and n.sub.4 is the number of transactions excluding events y nor events x. These numbers n.sub.1, n.sub.2, n.sub.3 and n.sub.4 are calculated from following equations, where n.sub.1 (x,y) is obtained from the frequency table (Table 4), n(x) is obtained from the frequency table (Table 3), and the number of all transactions is obtained by using database functions or by counting the transactions when the local list is updated. n.sub.1 =n.sub.1 (x,y) n.sub.2 =n(x)-n.sub.1 (x,y) n.sub.3 =n(y)-n.sub.1 (x,y) n.sub.4 =(the number of all transactions)-(n.sub.1,n.sub.2,n.sub.3,n.sub.4)

The stochastic test of the causality is executed by calculating both the value of information criteria I.sub.1 based upon a model which postulates the existence of causality and the value of information criteria I.sub.2 based upon a model which postulates no existence of causality, and by determining that the current event pair &lt;x,y&gt; has a causality if the model postulating the existence of causality is more appropriate than the other model.

The value of information criteria can be calculated by using Akaike's information criteria (AIC) or Baze's information criteria (BIC). The causality detection algorithm using AIC is described as follows. ##EQU1##

The value of information criteria I.sub.1 is calculated from log likelihood MLL.sub.1 where the existence of causality is postulated, and the value of information criteria I.sub.2 is calculated from log likelihood MLL.sub.2 where no existence of causality is postulated. Followings are equations for calculating the value of information criteria I.sub.1 and I.sub.2. ##EQU2##

Free parameters are three of n.sub.1, n.sub.2 and n.sub.3 when there exists a causality, whereas free parameters are two of a ratio of n.sub.1 and n.sub.2 and a ratio of n.sub.1 and n.sub.3 when there exists no causality. As described in the causality detection algorithm using AIC, if the value of information criteria I.sub.1 is less than the value of information criteria I.sub.2, it is judged that there exists a causality.

Hereinafter, the experiment result of performance evaluation by means of the aforementioned stochastic test with respect to causality of log data obtained by a simulation will be described.

As for a simulation which will generate a related event (result) when a time period depending upon Gaussian distribution is elapsed after a particular event (cause) is generated from an event generation source under the Poisson process, an event occurrence model (FIG. 3) with the following characteristics is considered.

(1) A system SYS.sub.A has symbol generation sources A.sub.1, A.sub.2, . . . , A.sub.N and a system SYS.sub.B has symbol generation sources B.sub.1, B.sub.2, . . . , B.sub.N (N=10,000). (2) The source A.sub.i generates symbols p.sub.i1, p.sub.i2, . . . , and the source B.sub.j generates symbols q.sub.j1, q.sub.j2, . . . . The number of the occurred symbols is pursuant to the binomial distribution B(n,p), where n=10, p=0.7. (3) c symbol generation sources within the SYS.sub.A are selected at random (c=1,000). Each of the selected symbol generation sources will generate additional symbols other than the symbols defined in (2). The number of the additional symbols is pursuant to the binomial distribution B(c.sub.1,p.sub.c1), where c.sub.1 =5, p.sub.c1 =0.7. (4) An interval between symbol occurrences in A.sub.i is pursuant to the Poisson distribution P(.lambda..sub.i). This .lambda..sub.i is pursuant to the Gaussian distribution N(.mu.,.sigma.), where .mu.=3,600, .sigma.=720. An interval between symbol occurrences of the sources in SYS.sub.B is similarly determined. (5) Suppose a causality that a particular symbol q.sub.lv is occurred from a particular symbol generation source B.sub.l in SYS.sub.B when the additional symbol defined in (3) is occurred from A.sub.j as p.sub.ju. The time interval between the generations of p.sub.ju and q.sub.lv is pursuant to the Gaussian distribution N(10,1).

The simulator provides time series symbols generated from the systems SYS.sub.A and SYS.sub.B as log data, and also provides a correspondence table between the symbols with the a causality, such as p.sub.ju and q.sub.lv, as verification data. In the log data, which system did each symbol generate is indicated, but which information source did the symbol generate and also whether there exists a causality are not indicated.

The number of combinations of events occurring within a predetermined period of time will be very large. Thus, in order to decrease a large number of candidate rules, decision of no causality (rejection test) between the event pair is executed. Following items are measured as for evaluation items:

the number of rules to be rejection-tested, and the number of remaining rules without rejection. It is important that the remaining rules without rejection have good quality. Thus, following items are measured with respect to the remaining rules: a miss detection ratio; a ratio of the number of candidates which in fact have causality but were not decided as causality rules with respect to the number of all causalities; and a fault detection ratio; a ratio of the number of causality rules which in fact do not have causality but were not rejected with respect to the number of all causality rules.

The number of rules to be rejection-tested and the number of remaining rules without rejection depend upon the window size W and upon time period of the log data. FIG. 4 illustrates relationship of the number of rules to be tested with respect to time period of the log data, and FIG. 5 illustrates relationship of the number of the remaining rules with respect to time period of the log data. As will be understood from these figures, according to the above-mentioned stochastic test, extremely many candidate rules can be rejected. In the simulation, since the time interval between the events having causality is determined to N(10,1), any correct rule will be hardly discovered at W=6 which is smaller than the average interval by 4.sigma. and also a correct rule which was not discovered at W=12 will be hardly discovered at W=15. Therefore, according to a proper rejection test, all rules will be rejected at W=6 and the number of remaining rules at W=12 will coincide with that at W=15. FIG. 5 shows such proper characteristics.

FIG. 6 illustrates relationship of a miss detection ratio with respect to time period of the log data. As will be understood from the figure, the longer the time period of the log data, the smaller the miss detection ratio (monotone decreasing). This characteristics indicates that co-occurrence with low frequency of appearance can be easily detected if the time period of log is long.

A fault detection ratio is always zero in the experiment embodiment (all candidates having no causality are rejected). Since this stochastic test of causality can reject a large number of rules and has a very low fault detection ratio, it will be verified that this stochastic test has a proper rejection ability with respect to incorrect rules.

The present invention is applicable to detect causality in data mining technology for discovering useful information in a database. For example, the present invention can be utilized in fault management for forecasting a fault or for identifying the cause of a fault in accordance with the system log, and in identification of causality between the environment factor and the amount sold of each item in a field of sales promotion.

Many widely different embodiments of the present invention may be constructed without departing from the spirit and scope of the present invention. It should be understood that the present invention is not limited to the specific embodiments described in the specification, except as defined in the appended claims.

Claims

1. A causality detection apparatus for detecting causality of events based upon a database provided with log of the events, comprising:

a sorter means for generating an event list by sorting in time sequence the events;

a frequency analysis means for calculating, based upon said event list, the number of appearances of an event set pair of a first event set and a second event set, the number of appearances of said first event set and the number of appearances of said second event set, said second event set occurring within a predetermined time period after a time of occurrence of said first event set; and

a causality detection means for detecting, based upon the number of appearances of said event set pair, upon the number of appearances of said first event set and upon the number of appearances of said second event set, significance of causality caused by said first event and said second event set occuring within said predetermined time period.

2. The apparatus as claimed in claim 1, wherein said frequency analysis means includes means for calculating said numbers during intermediate period between a time of occurrence of said first event set and a time of occurrence of said second event set when none of said first and second event sets is occurring.

3. The apparatus as claimed in claim 1, wherein said causality detection means includes means for calculating, with respect to each event set pair, the values of information criteria of two models based upon log likelihoods of the models and upon the number of parameters used in the models, one of said models postulating the existence of causality and the other one of said models postulating no existence of causality, and decision means for detecting significance of causality by comparing the calculated values of information criteria.

4. The apparatus as claimed in claim 3, wherein said decision means decides that there exists significance of causality when the calculated value of information criteria of the model which postulates the existence of causality is smaller than the calculated value of information criteria of the model which postulates no existence of causality.

5. The apparatus as claimed in claim 1, wherein said sorter means includes means for generating a local list which is a part of said event list, and means for generating an event list by updating in inverse time sequence said local list.

6. The apparatus as claimed in claim 1, wherein said frequency analysis means includes means for calculating the number of appearance of an event set pair &lt;X,Y&gt; of a first event set X(={e.sub.x1,e.sub.x2, . . . ,e.sub.xn, . . . }, e.sub.xn indicates an event and n is a natural number) occurred at a time t.sub.i (i is an integer equal to or more than 0) and a second event set Y(={e.sub.y1,e.sub.y2, . . . ,e.sub.yn, . . . }, e.sub.yn indicates an event) occurred at a time t.sub.k (t.sub.i &lt;t.sub.k &lt;t.sub.i +w, i and k are integers equal to or more than 0, w is said predetermined time period) in said event list, said event set pair &lt;X,Y&gt; satisfying a sequence condition of .A-inverted.e.sub.x .di-elect cons.X, e.sub.y .di-elect cons.Y, e.sub.z .di-elect cons.Z, e.sub.x .noteq.e.sub.z and e.sub.y.noteq.e.sub.z with respect to said first event set X, said second event set Y and a third event set Z(={e.sub.z1,e.sub.z2, . . . ,e.sub.zn, . . . }, e.sub.zn indicates an event) occurred at an optional time t.sub.j which satisfies t.sub.i &lt;t.sub.j &lt;t.sub.k (j is an integer equal to or more than 0), said calculation of the number of appearance of said event set pair &lt;X,Y&gt; being executed by updating a set of events NB.sub.q occurred between a time t.sub.p+1 and a time t.sub.q (p&lt;q.ltoreq.m(p), m(p) is a natural number), and by updating a set of events H.sub.q which satisfy said sequence condition and are contained in a fourth event set E' (={e.sub.e1,e.sub.e2, . . . ,e.sub.en, . . . }, e.sub.en indicates an event) occurred at a time t.sub.q (p&lt;q&lt;m(p)) and in optional events at the time t.sub.p+1, with reference to a local list which is a part of the event list (event list at times t.sub.p, t.sub.p+1, . . . ,t.sub.m(p), t.sub.m(p) &lt;t.sub.p +w&lt;t.sub.m(p)+1) and updated by said sorter means.

7. A causality detection apparatus for detecting causality of events based upon a database provided with log of the events, comprising:

a sorter means for generating an event list by sorting in time sequence the events;

a frequency analysis means for calculating, based upon said event list, the number of appearances of an event pair of a first event and a second event, the number of appearance of the said first event and the number of appearances of said second event, said second event occurring within a predetermined time period after a time of occurrence of said first event; and

a causality detection means for detecting, based upon the number of appearances of said event pair, upon the number of appearances of said first event and upon the number of appearances of said second event, significance of causality caused by said first event and said second event set occuring within said predetermined time period.

8. The apparatus as claimed in claim 7, wherein said frequency analysis means includes means for calculating said numbers during intermediate period between a time of occurrence of said first event and a time of occurrence of said second event when none of said first and second events is occurring.

9. The apparatus as claimed in claim 7, wherein said causality detection means includes means for calculating, with respect to each event pair, the values of information criteria of two models based upon log likelihoods of the models and upon the number of parameters used in the models, one of said models postulating the existence of causality and the other one of said models postulating no existence of causality, and decision means for detecting significance of causality by comparing the calculated values of information criteria.

10. The apparatus as claimed in claim 9, wherein said decision means decides that there exists significance of causality when the calculated value of information criteria of the model which postulates the existence of causality is smaller than the calculated value of information criteria of the model which postulates no existence of causality.

11. The apparatus as claimed in claim 7, wherein said sorter means includes means for generating a local list which is a part of said event list, and means for generating an event list by updating in inverse time sequence said local list.

12. The apparatus as claimed in claim 7, wherein said frequency analysis means includes means for calculating the number of appearance of an event pair &lt;e.sub.x,e.sub.y &gt; of a first event e.sub.x occurred at a time t.sub.i (i is an integer equal to or more than 0) and a second event e.sub.y occurred at a time t.sub.k (t.sub.i &lt;t.sub.k &lt;t.sub.i +w, i and k are integers equal to or more than 0, w is said predetermined time period) in said event list, said event pair &lt;e.sub.x,e.sub.y &gt; satisfying a sequence condition of e.sub.x .noteq.e.sub.z and e.sub.y .noteq.e.sub.z with respect to said first event e.sub.x, said second event e.sub.y and a third event e.sub.z occurred at an optional time t.sub.j which satisfies t.sub.i &lt;t.sub.j &lt;t.sub.k (j is an integer equal to or more than 0), said calculation of the number of appearance of said event pair &lt;e.sub.x,e.sub.y &gt; being executed by updating a set of events NB.sub.q occurred between a time t.sub.p+1 and a time t.sub.q (p&lt;q.ltoreq.m(p), m(p) is a natural number), and by updating a set of events H.sub.q which satisfy said sequence condition and are contained in a fourth event e.sub.e occurred at a time t.sub.q (p&lt;q&lt;m(p)) and in optional events at the time t.sub.p+1, with reference to a local list which is a part of the event list (event list at times t.sub.p,t.sub.p+1, . . . ,t.sub.m(p), t.sub.m(p) &lt;t.sub.p +w&lt;t.sub.m(p)+1) and updated by said sorter means.

13. A causality detection method for detecting causality of events based upon a database provided with log of the events, said method comprising:

a sorting step of generating an event list by sorting in time sequence the events;

a frequency analysis step of calculating, based upon said event list, the number of appearances of an event set pair of a first event set and a second event set, the number of appearances of said first event set and the number of appearances of said second event set, said second event set occurring within a predetermined time period after a time of occurrence of said first event set; and

a causality detection step of detecting, based upon the number of appearances of said event set pair, upon the number of appearances of said first event set and upon the number of appearances of said second event set, significance of causality caused by said first event and said second event set occuring within said predetermined time period.

14. The method as claimed in claim 13, wherein said frequency analysis step includes a step of calculating said numbers during intermediate period between a time of occurrence of said first event set and a time of occurrence of said second event set when none of said first and second event sets is occurring.

15. The method as claimed in claim 13, wherein said frequency analysis step includes a step of calculating, with respect to each event set pair, the values of information criteria of two models based upon log likelihoods of the models and upon the number of parameters used in the models, one of said models postulating the existence of causality and the other one of said models postulating no existence of causality, and a decision step of detecting significance of causality by comparing the calculated values of information criteria.

16. The method as claimed in claim 15, wherein said decision step decides that there exists significance of causality when the calculated value of information criteria of the model which postulates the existence of causality is smaller than the calculated value of information criteria of the model which postulates no existence of causality.

17. The method as claimed in claim 13, wherein said sorting step includes a step of generating a local list which is a part of said event list, and a step of generating an event list by updating in inverse time sequence said local list.

18. The method as claimed in claim 13, wherein said frequency analysis step includes a step of calculating the number of appearance of an event set pair &lt;X,Y&gt; of a first event set X(={e.sub.x1,e.sub.x2, . . . ,e.sub.xn, . . . }, e.sub.xn indicates an event and n is a natural number) occurred at a time t.sub.i (i is an integer equal to or more than 0) and a second event set Y(={e.sub.y1,e.sub.y2, . . . ,e.sub.yn, . . . }, e.sub.yn indicates an event) occurred at a time t.sub.k (t.sub.i &lt;t.sub.k &lt;t.sub.i +w, i and k are integers equal to or more than 0, w is said predetermined time period) in said event list, said event set pair &lt;X,Y&gt; satisfying a sequence condition of .A-inverted.e.sub.x .di-elect cons.X, e.sub.y .di-elect cons.Y, e.sub.z .di-elect cons.Z, e.sub.x .noteq.e.sub.z and e.sub.y .noteq.e.sub.z with respect to said first event set X, said second event set Y and a third event set Z(={e.sub.z1,e.sub.z2, . . . ,e.sub.zn, . . . }, e.sub.zn indicates an event) occurred at an optional time t.sub.j which satisfies t.sub.i &lt;t.sub.j &lt;t.sub.k (j is an integer equal to or more than 0), said calculation of the number of appearance of said event set pair &lt;X,Y&gt; being executed by updating a set of events NB.sub.q occurred between a time t.sub.p+1 and a time t.sub.q (p&lt;q.ltoreq.m(p), m(p) is a natural number), and by updating a set of events H.sub.q which satisfy said sequence condition and are contained in a fourth event set E' (={e.sub.e1,e.sub.e2, . . . ,e.sub.en, . . . }, e.sub.en indicates an event) occurred at a time t.sub.q (p&lt;q&lt;m(p)) and in optional events at the time t.sub.p+1, with reference to a local list which is a part of the event list (event list at times t.sub.p,t.sub.p+1, . . . ,t.sub.m(p), t.sub.m(p) &lt;t.sub.p +w&lt;t.sub.m(p)+1) and updated at said sorting step.

19. A causality detection method for detecting causality of events based upon a database provided with log of the events, comprising:

a sorting step of generating an event list by sorting in time sequence the events;

a frequency analysis step of calculating, based upon said event list, the number of appearances of an event pair of a first event and a second event, the number of appearance of the said first event and the number of appearance of said second event, said second event occurring within a predetermined time period after a time of occurrence of said first event; and

a causality detection step of detecting, based upon the number of appearance of said event pair, upon the number of appearances of said first event and upon the number of appearances of said second event, significance of causality caused by said first event and said second event set occuring within said predetermined time period.

20. The method as claimed in claim 19, wherein said frequency analysis step includes a step of calculating said numbers during intermediate period between a time of occurrence of said first event and a time of occurrence of said second event when none of said first and second events is occurring.

21. The method as claimed in claim 19, wherein said causality detection step includes a step of calculating, with respect to each event pair, the values of information criteria of two models based upon log likelihoods of the models and upon the number of parameters used in the models, one of said models postulating the existence of causality and the other one of said models postulating no existence of causality, and a decision step of detecting significance of causality by comparing the calculated values of information criteria.

22. The method as claimed in claim 21, wherein said decision step decides that there exists significance of causality when the calculated value of information criteria of the model which postulates the existence of causality is smaller than the calculated value of information criteria of the model which postulates no existence of causality.

23. The method as claimed in claim 19, wherein said sorting step includes a step of generating a local list which is a part of said event list, and a step of generating an event list by updating in inverse time sequence said local list.

24. The method as claimed in claim 19, wherein said frequency analysis step includes a step of calculating the number of appearance of an event pair &lt;e.sub.x,e.sub.y &gt; of a first event e.sub.x occurred at a time t.sub.i (i is an integer equal to or more than 0) and a second event e.sub.y occurred at a time t.sub.k (t.sub.i &lt;t.sub.k &lt;t.sub.i +w, i and k are integers equal to or more than 0, w is said predetermined time period) in said event list, said event pair &lt;e.sub.x,e.sub.y &gt; satisfying a sequence condition of e.sub.x .noteq.e.sub.z and e.sub.y .noteq.e.sub.z with respect to said first event e.sub.x, said second event e.sub.y and a third event e.sub.z occurred at an optional time t.sub.j which satisfies t.sub.i &lt;t.sub.j &lt;t.sub.k (j is an integer equal to or more than 0), said calculation of the number of appearance of said event pair &lt;e.sub.x,e.sub.y &gt; being executed by updating a set of events NB.sub.q occurred between a time t.sub.p+1 and a time t.sub.q (p&lt;q m(p), m(p) is a natural number), and by updating a set of events H.sub.q which satisfy said sequence condition and are contained in a fourth event e.sub.e occurred at a time t.sub.q (p&lt;q&lt;m(p)) and in optional events at the time t.sub.p+1, with reference to a local list which is a part of the event list (event list at times t.sub.p,t.sub.p+1, . . . ,t.sub.m(p), t.sub.m(p) &lt;t.sub.p +w&lt;t.sub.m(p)+1) and updated at said sorting step.