Abstract
We had proposed a rule-extraction method from computer log files using Automatically Defined Groups. In this method, agents search multiple rules cooperatively based on the difference between normal state log files and abnormal state log files. The more frequently used and the more reliable rule is, the more agents are allotted to the rules. Therefore, the number of agents for each rule can represent the importance of the rule. However, when the rule-extraction method is applied to the large-scale log files, which may contain a number of rules, a problematical situation on the number of agents could be observed. In the previous proposed method, the number of agents is fixed, so the number of agents may be lack for evaluating the each rule's importance minutely. In this paper, an improved method is proposed, where the number of agents is adaptively increased depending on the number of discovered rules. As a result, by increasing the number of agents, the importance of respective rules could be evaluated minutely. In addition, the proposed method could acquire more rules than those by the method with the fixed number of agents.
