Patent ID: 7904330

Claim:
An event type estimation system including a processor comprising: a log aggregation unit implemented by the processor that reads log data showing access history from a user terminal to at least one site provided by a computer connected to a network, and outputs performance time-series data representing a fluctuation in traffic to the site based on the log data; a deviation testing unit implemented by the processor that extracts, from the performance time-series data, an interval showing an anomalous fluctuation in which the fluctuation in traffic deviates from a recorded reference fluctuation; a peak fluctuation pattern setting unit implemented by the processor that calculates a steepness and a time point of a peak that appears in the fluctuation in the traffic during all or part of the interval represented by the performance time-series data, generates peak fluctuation time-series data representing a fluctuation pattern that has the steepness and a peak at the time point and records the generated peak fluctuation time-series data in a fluctuation pattern recording unit; a normal fluctuation pattern setting unit implemented by the processor that generates, based on the performance time-series data or prerecorded data, normal fluctuation time-series data representing a fluctuation pattern, in the interval extracted by the deviation testing unit, of traffic under normal conditions, and records the generated normal fluctuation time-series data in the fluctuation pattern recording unit; a vertical fluctuation pattern setting unit implemented by the processor that generates, based on the performance time-series data, vertical fluctuation time-series data representing a fluctuation pattern in which traffic increases or decreases in an interval of part of the interval extracted by the deviation testing unit, and records the generated vertical fluctuation time-series data in the fluctuation pattern recording unit; a waveform decomposition unit implemented by the processor that calculates optimal values of components of the fluctuation patterns respectively represented by the peak fluctuation time-series data, the normal fluctuation time-series data and the vertical fluctuation time-series data, so that a combination of the fluctuation patterns approximates the fluctuation in traffic represented by the performance time-series data; a rule recording unit that records a rule showing a relation between a type of event that causes anomalous fluctuation and composition of the components of the fluctuation patterns respectively represented by the peak fluctuation time-series data, the normal fluctuation time-series data, and the vertical fluctuation time-series data; and an event determination unit implemented by the processor that determines a type of event that caused the anomalous fluctuation in the interval, based on the composition of the components shown by the rule recorded in the rule recording unit and the values of the components of the fluctuation patterns optimized by the waveform decomposition unit.