# US 11,115,288 B2 · Parameter setting method, data analysis device and data analysis system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,288 B2 - Document ID: US11115288B2 - Status: Granted - Kind: B2 - Application number: 16/122,921 - Filed: 2018-09-06 - Published: 2019-05-23 - Granted: 2021-09-07 - Earliest claimed: 2017-11-17 - Assignees: Hitachi, Ltd. - Applicants: Hitachi, Ltd. - Inventors: Yuncheng Zhu; Yoshiteru Takeshima - Web page: https://patentgrep.com/patent/US11115288B2 ## CPC - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 41/0803: Configuration setting - H04L 41/082: the condition being updates or upgrades of network functionality - H04L 41/142: using statistical or mathematical methods - H04L 43/062: related to network traffic - H04L 41/16: using machine learning or artificial intelligence - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A data analysis device executes: acquiring time-series data including data of multiple items from an analysis target system; extracting data of at least, one first item from the time series data; calculating a feature of a temporal change of the data of the first item; extracting data of at least one second item from the time series data; calculating a feature of at least one of a relevance between the data of the first item and the data of the second item and a relevance between the data of the multiple second items; determining a model corresponding to the analysis target system on the basis of the feature of the temporal change and the change of the relevance; and setting the parameter in the analysis target system by using the parameter setting configuration of the model. ## Claims ### Claim 1 A method of setting a parameter by a data analysis device, wherein the data analysis device includes a computer that executes one or more predetermined processes, a storage device that is connected to the computer, and a communication interface that is connected to the computer, the storage device stores: a parameter setting configuration for each of a plurality of models corresponding to an analysis target system, and input data, the method comprising the steps of: acquiring time-series data including packets of network traffic as packets are transferred in the network and continuously and automatically storing a plurality of items of the acquired time-series of data in predetermined intervals as the input data in the storage device; extracting data of at least one first item from the input data and calculating a feature of a temporal change of the data of the first item by the computer; extracting data of at least one second item from the input data and calculating a feature of at least one of a relevance between the data of the first item and the data of the second item and a relevance between the data of a plurality of the second items by the computer; determining a model, of a plurality of models, that corresponds to the analysis target system based on the feature of the temporal change and the feature of the calculated relevance, wherein each model is an analysis method; setting the parameter in the analysis target system based on the parameter setting configuration of the determined model corresponding to the analysis target system by the computer; and analyzing the network traffic of the analysis target system using the set parameter, wherein in the step of calculating the feature of the temporal change, the computer calculates a statistical value for each predetermined time obtained by dividing the data of the first item on a time axis, and sets a normalized value of the statistical value as the feature of the temporal change of the first item. ### Claim 2 (depends on 1) The method according to claim 1, wherein in the step of calculating the feature of the temporal change, the computer includes a step of recording a normalization coefficient used when the statistical value is normalized, and in the step of setting the parameter, the computer performs an operation with the normalization coefficient as an argument, which is defined in the parameter setting configuration of the model corresponding to the analysis target system, calculates the parameter corresponding to a scale of the analysis target system, and sets the calculated parameter in the analysis target system. ### Claim 3 (depends on 1) The method according to claim 1, wherein in the step of calculating the feature of the relevance, the computer calculates the statistical value of the data of the first item, calculates the statistical value of the data of the second item, and sets a ratio between the statistical value of the first item and the statistical value of the second item as the feature of the relevance, or the computer calculates the statistical value of the data of the second item and sets the ratio of the statistical values of two second items as the feature of the relevance. ### Claim 4 (depends on 1) The method according to claim 1, wherein in the step of calculating the feature of the relevance, the computer sets a value indicating a correlation between the data of the first item and the data of the second item as the feature of the relevance, or the computer sets a value indicating a correlation between data of the two second items as the feature of the relevance. ### Claim 5 (depends on 1) The method according to claim 1, further comprising a step of correcting another parameter according to a ratio of the correction of the parameter upon receiving a requirement for correction of the parameter by the computer. ### Claim 6 A data analysis device that can set a parameter, the data analysis device comprising: a computer comprising a processor that executes one or more predetermined processes, a storage device that is connected to the computer, and a communication interface that is connected to the computer, wherein the storage device stores a parameter setting configuration for each of a plurality of models corresponding to an analysis target system, and input data; wherein the computer is programmed to: acquire time-series data including packets of network traffic as packets are transferred in the network and continuously and automatically stores a plurality of items of the acquired time-series of data in predetermined intervals as the input data in the storage device; extract data of at least one first item from the input data and calculate a feature of a temporal change of the data of the first item; extract data of at least one second item from the input data and calculate a feature of at least one of a relevance between the data of the first item and the data of the second item and a relevance between the data of a plurality of the second items; determine a model, of a plurality of models, corresponding to the analysis target system based on the feature of the temporal change and the feature of the calculated relevance, wherein each model is an analysis method; set the parameter in the analysis target system based on the parameter setting configuration of the determined model corresponding to the analysis target system; and analyzing the network traffic of the analysis target system using the set parameter, wherein the computer is further programmed to calculate a statistical value for each predetermined time obtained by dividing the data of the first item on a time axis, and sets a normalized value of the statistical value as the feature of the temporal change of the first item. ### Claim 7 (depends on 6) The data analysis device according to claim 6, wherein the computer is further programmed to: record a normalization coefficient used when the statistical value is normalized, and perform an operation with the normalization coefficient as an argument, which is defined in the parameter setting configuration of the model corresponding to the analysis target system, calculate the parameter corresponding to a scale of the analysis target system, and set the calculated parameter in the analysis target system. ### Claim 8 (depends on 6) The data analysis device according to claim 6, wherein the computer is further programmed to: calculate the statistical value of the data of the first item, calculate the statistical value of the data of the second item, and set a ratio between the statistical value of the first item and the statistical value of the second item as the feature of the relevance, or calculate the statistical value of the data of the second item and sets the ratio of the statistical values of two second items as the feature of the relevance. ### Claim 9 (depends on 6) The data analysis device according to claim 6, wherein the computer is further programmed to: set a value indicating a correlation between the data of the first item and the data of the second item as the feature of the relevance, or the computer stores a value indicating a correlation between data of the two second items as the feature of the relevance. ### Claim 10 (depends on 6) The data analysis device according to claim 6, wherein the computer is further programmed to correct, upon receiving a requirement for correction of the parameter, another parameter according to a ratio of the required correction of the parameter. ### Claim 11 (depends on 6) The data analysis device according to claim 6, wherein the computer executes a process of setting the parameter applied to the analysis target system at a predetermined timing.