Information processing apparatus, control method, and program

A control method executed by a computer, the method comprising:

• acquiring first event information, which indicates information on an event caused by a process in a standard apparatus, and second event information, which indicates information on an event caused by a process in a target apparatus to be determined;
• classifying, by using the first event information, each event being indicated by the second event information, either as an event of a first class, which is an event that occurs also in the standard apparatus, or as an event of a second class, which is an event that does not occur in the standard apparatus;
• performing a first learning of a first model for determining whether an event classified as the first class is a target event for warning, by using the second event information on an event classified as the first class;
• and
• performing a second learning of a second model for determining whether an event classified as the second class is a target event for warning, by using the second event information on an event classified as the second class.

A non-transitory computer readable medium storing a program that causes a computer to execute each of the steps of a control method, the method comprising:

• acquiring first event information, which indicates information on an event caused by a process in a standard apparatus, and second event information, which indicates information on an event caused by a process in a target apparatus to be determined;
• classifying, by using the first event information, each event being indicated by the second event information, either as an event of a first class, which is an event that occurs also in the standard apparatus, or as an event of a second class, which is an event that does not occur in the standard apparatus;
• performing learning of a first model for determining whether an event classified as the first class is a target event for warning, by using the second event information on an event classified as the first class;
• and
• performing learning of a second model for determining whether an event classified as the second class is a target event for warning, by using the second event information on an event classified as the second class.