IP Library Granted Patent US 12,645,558
Granted Patent B2
US 12,645,558 · App. 18/277,464 · Granted Jun 2, 2026

Classification device, classification method, and classification program

Inventors: Yuki Urabe (Musashino, JP); Kimio Tsuchikawa (Musashino, JP); Fumihiro Yokose (Musashino, JP); Ryo Uchida (Musashino, JP); Sayaka Yagi (Musashino, JP)
Assignee: NTT, Inc.
G06F11/3476G06F18/2431
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,645,558
App. No.
18/277,464
Granted
Jun 2, 2026
Kind
B2
Abstract

A classification device includes processing circuitry configured to acquire an operation log related to operation information and identify each operation performed by a user using the operation log, create a vector of each operation based on a co-occurrence relationship between operations identified, calculate a similarity between a predetermined number of operations adjacent to each other in chronological order by using the vector of each operation created, determine a division point of operations by using the similarity calculated and divide a time-series operation into operation sets based on the division point, and classify the operation sets divided into classes based on a number of types of operations common to the operation sets.

Claims (30)

1 . A classification device comprising:

processing circuitry configured to:

acquire an operation log related to operation information and identify each operation performed by a user using the operation log;

create a vector of each operation based on a co-occurrence relationship between operations identified;

calculate a similarity between a predetermined number of operations adjacent to each other in chronological order by using the vector of each operation created;

determine a division point of operations by using the similarity calculated and divide a time-series operation into operation sets based on the division point; and

classify the operation sets divided into classes based on a number of types of operations common to the operation sets.

2 . The classification device according to claim 1 , wherein for each operation identified, the processing circuitry is further configured to count a number of times of other operations performed in a range of a predetermined number before and after the operation in an operation sequence performed in time series, create a co-occurrence matrix indicating a co-occurrence relationship between the operations by using the counted number of times, and create a vector of each operation based on the co-occurrence matrix.

3 . The classification device according to claim 2 , wherein for each operation identified, the processing circuitry is further configured to create the co-occurrence matrix by using values obtained by weighting the number of times of other operations performed in the range of the predetermined number before and after the operation in the operation sequence performed in time series, according to distances to the other operations, and create a vector of each operation based on the co-occurrence matrix.

4 . The classification device according to claim 2 , wherein for each operation identified, the processing circuitry is further configured to create the co-occurrence matrix by using values obtained by weighting the number of times of other operations performed in the range of the predetermined number before and after the operation in the operation sequence performed in time series, according to whether or not the other operations have been performed in a same window, and create a vector of each operation based on the co-occurrence matrix.

5 . The classification device according to claim 1 , wherein in a case where a type of operation identified is equal to or greater than a predetermined threshold, the processing circuitry is further configured to create a vector of each operation using a predetermined dimension reduction method.

6 . The classification device according to claim 1 , wherein the processing circuitry is further configured to calculate a centroid vector or a sum vector for a predetermined number of operation sequences adjacent to each other in chronological order using the vector of each operation created, and calculate a similarity between vectors.

7 . The classification device according to claim 1 , wherein the processing circuitry is further configured to:

calculate an evaluation value of a classification result by using the classification result of classification processing each time the classification processing is performed,

perform processing of creating a vector of each operation by using a parameter used for a classification result having a highest evaluation value calculated,

perform processing of calculating the similarity by using a parameter used for a classification result having a highest evaluation value calculated,

perform processing of dividing the operation set by using a parameter used for a classification result having a highest evaluation value calculated, and

perform the classification processing by using a parameter used for a classification result having a highest evaluation value calculated.

8 . A classification method executed by a classification device, the classification method comprising:

acquiring an operation log related to operation information and identifying each operation performed by a user using the operation log;

creating a vector of each operation based on a co-occurrence relationship between operations identified;

calculating a similarity between a predetermined number of operations adjacent to each other in chronological order by using the vector of each operation created;

determining a division point of operations by using the similarity calculated and dividing a time-series operation into operation sets based on the division point; and

classifying the operation sets divided into classes based on a number of types of operations common to the operation sets.

9 . A non-transitory computer-readable recording medium storing therein a classification program that causes a computer to execute a process comprising:

acquiring an operation log related to operation information and identifying each operation performed by a user using the operation log;

creating a vector of each operation based on a co-occurrence relationship between operations identified;

calculating a similarity between a predetermined number of operations adjacent to each other in chronological order by using the vector of each operation created;

determining a division point of operations by using the similarity calculated and dividing a time-series operation into operation sets based on the division point; and

classifying the operation sets divided into classes based on a number of types of operations common to the operation sets.

Assignments (2)
CHANGE OF NAME Recorded Aug 14, 2025
From: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
To: NTT, INC.
Reel/Frame 072471/0579 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 17, 2023
From: URABE, YUKI; TSUCHIKAWA, KIMIO; YOKOSE, FUMIHIRO; UCHIDA, RYO; YAGI, SAYAKA
To: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Reel/Frame 065597/0891 →
Priority Claims (1)
WO PCT/JP2021/006214 · Feb 18, 2021 · international
Continuity (1)
Related Publication 20240126675A1 · Apr 18, 2024
References Cited (10)
US 20060069955A1 · Oka et al. · 2006 [cited by applicant]
US 20060129547A1 · Yamamoto · 2006 [cited by examiner]
US 20200285737A1 · Kraus · 2020 [cited by examiner]
US 20230291743A1 · Shua · 2023 [cited by examiner]
JP 200931931A1 · 2009 [cited by applicant]
JP 4484643B2 · 2010 [cited by applicant]
WO WO2019060327A1 · 2019 [cited by applicant]
WO WO2021024145A1 · 2021 [cited by applicant]
Yokose et al., “Business visualization technology contributing to DX promotion,” NTT Technical Journal, Feb. 2020, 72-75, 12 pages (with machine translation). [cited by applicant]
Oka et al., “Anomaly Detection Using Layered Networks Based on Eigen Co-occurrence Matrix,” In Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID 2004), France, Sep. 15-17, 20… [cited by applicant]