# US 2022/0035906 A1 · Information processing apparatus, control method, and program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0035906 A1 - Document ID: US20220035906A1 - Status: Published application - Kind: A1 - Application number: 17/290,458 - Filed: 2018-11-12 - Published: 2022-02-03 - Earliest claimed: 2018-11-12 - Assignees: NEC Corporation - Applicants: NEC Corporation - Inventors: Etsuko ICHIHARA; Yoshiaki SAKAE; Kazuhiko ISOYAMA; Jun NISHIOKA - Web page: https://patentgrep.com/patent/US20220035906A1 ## CPC - G06F 21/54: by adding security routines or objects to programs - G06F 21/554: {involving event detection and direct action} - G06F 11/32: with visual {or acoustical} indication of the functioning of the machine - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/44: Program or device authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An information processing apparatus (2000) acquires an event graph (10) to be output. In the event graph (10), an activity content in an event related to an activity of a program is represented as an edge, and each of a subject and an object of the event is represented as a node. By using score information, the information processing apparatus (2000) determines a subgraph that matches an event graph (10) having a score equal to or higher than a threshold value from the event graphs (10) to be output. The score information associates each of a plurality of event graphs (10) with a score based on the number of occurrences of an event sequence represented by the event graph (10). The information processing apparatus (2000) outputs the event graph (10) to be output in a mode in which the determined subgraph and the other portion can be discriminated from each other. ## Claims ### Claim 1 An information processing apparatus comprising: a determination unit that determines, by using score information in which each of a plurality of event graphs and a score based on the number of occurrences of an event sequence represented by the event graph are associated with each other, a subgraph that matches the event graph having the score equal to or higher than a threshold value, from among subgraphs constituting an event graph to be output; and an output unit that outputs the event graph to be output in a mode in which the determined subgraph and the other portion are discriminable from each other, wherein the event graph represents an activity content in an event related to an activity of a program as an edge and represents each of a subject and an object of the event as a node. ### Claim 2 (depends on 1) The information processing apparatus according to claim 1, wherein the output unit outputs the event graph emphasizing the other portion more than the determined subgraph. ### Claim 3 (depends on 1) The information processing apparatus according to claim 1, wherein the output unit outputs the event graph aggregating the determined subgraph. ### Claim 4 (depends on 1) The information processing apparatus according to claim 1, further comprising: a generation unit that acquires an event graph, and generates or updates the score information of the event graph by computing the score of the event graph. ### Claim 5 (depends on 4) The information processing apparatus according to claim 4, wherein the generation unit computes the score of the event graph such that the score of the event graph and the number of occurrences of the event sequence represented by the event graph have a positive correlation. ### Claim 6 (depends on 4) The information processing apparatus according to claim 4, wherein the generation unit computes the score of the event graph based on the number of apparatuses in which the event sequence represented by the event graph occurs. ### Claim 7 (depends on 4) The information processing apparatus according to claim 4, wherein the generation unit computes the score of the event graph based on a weight assigned to a user of a target apparatus in which the event sequence represented by the event graph occurs. ### Claim 8 (depends on 4) The information processing apparatus according to claim 4, wherein the event graph is generated by both a first generation process that is executed in response to an input operation by a user and a second generation process that is periodically executed, and the generation unit computes the score of the event graph as a linear sum of the number of times the event graph is generated by the first generation process and the number of times the event graph is generated by the second generation process. ### Claim 9 (depends on 1) The information processing apparatus according to claim 1, wherein the determination unit acquires an event graph representing an event sequence that includes the node representing the subject or the object of the event that is specified by an input operation as the event graph to be output. ### Claim 10 A control method executed by a computer, the method comprising: determining, by using score information in which each of a plurality of event graphs and a score based on the number of occurrences of an event sequence represented by the event graph are associated with each other, a subgraph that matches the event graph having the score equal to or higher than a threshold value, from among subgraphs constituting an event graph to be output; and outputting the event graph to be output in a mode in which the determined subgraph and the other portion are discriminable from each other, wherein the event graph represents an activity content in an event related to an activity of a program as an edge and represents each of a subject and an object of the event as a node. ### Claim 11 (depends on 10) The control method according to claim 10, wherein in the outputting, the event graph is output emphasizing the other portion more than the determined subgraph. ### Claim 12 (depends on 10) The control method according to claim 10, wherein in the outputting, the event graph is output aggregating the determined subgraph. ### Claim 13 (depends on 10) The control method according to claim 10, further comprising: a generation step of acquiring an event graph, and generating or updating the score information of the event graph by computing the score of the event graph. ### Claim 14 (depends on 13) The control method according to claim 13, wherein in the generating, the score of the event graph is computed such that the score of the event graph and the number of occurrences of the event sequence represented by the event graph have a positive correlation. ### Claim 15 (depends on 13) The control method according to claim 13, wherein in the generating, the score of the event graph is computed based on the number of apparatuses in which the event sequence represented by the event graph occurs. ### Claim 16 (depends on 13) The control method according to claim 13, wherein in the generating, the score of the event graph is computed based on a weight assigned to a user of a target apparatus in which the event sequence represented by the event graph occurs. ### Claim 17 (depends on 13) The control method according to claim 13, wherein the event graph is generated by both a first generation process that is executed in response to an input operation by a user and a second generation process that is periodically executed, and in the generating, the score of the event graph is computed as a linear sum of the number of times the event graph is generated by the first generation process and the number of times the event graph is generated by the second generation process. ### Claim 18 (depends on 10) The control method according to claim 10, wherein in the determining, an event graph representing an event sequence that includes the node representing the subject or the object of the event that is specified by an input operation is acquired as the event graph to be output. ### Claim 19 (depends on 10) A non-transitory computer-readable storage medium storing a program that causes a computer to execute the control method according to claim 10.