JP2002359648A - Information management system, information management method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information management system that monitors file transmission reception and can detect transmission reception satisfying prescribed conditions. SOLUTION: The information management system is provided with an acquisition section 110 that acquires communication information associated with transmission or transmission reception of electronic mail, a transmission reception information storage section 160 that stores the communication information acquired by the acquisition section 110 in cross-reference with a user that transmits or transceives the electronic mail, and a transmitting receiving party detection section 170 that detects the user corresponding to the communication information when the communication information satisfies prescribed conditions.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to an information management system, an information management method, and a program. In particular, the present invention relates to an information management system, an information management method, and a program for managing file movement.

[0002]

2. Description of the Related Art Heretofore, a network administrator has checked a log of transmission / reception processing performed by a predetermined server to check whether or not there has been any access from an unauthorized user.

[0003]

However, with the generalization of means such as e-mail and the increase in transmission / reception of e-mail and the like, the volume of logs becomes enormous, and a great deal of labor is required to check the logs. there were.

Accordingly, an object of the present invention is to provide an information management system, an information management method, and a program that can solve the above-mentioned problems. This object is achieved by a combination of features described in the independent claims. The dependent claims define further advantageous embodiments of the present invention.

[0005]

In other words, according to an embodiment of the present invention, an information management system for managing e-mail transmission / reception processing includes an acquisition unit for acquiring communication information relating to transmission or transmission / reception of e-mail, A transmission / reception information storage unit that stores the acquired communication information in association with the user who transmitted or transmitted the e-mail, and a transmitter / receiver that detects a user corresponding to the communication information when the communication information satisfies a predetermined condition A detection unit.

The transmission / reception information storage unit stores, as communication information, information for specifying the number of transmitted or transmitted e-mails. The transmission / reception detector detects that the number of e-mails transmitted or transmitted within a predetermined period is predetermined. Exceeding the upper limit may be used as a predetermined condition. The transmission / reception information storage unit further stores, as communication information, information for specifying the transmission destination of the e-mail, and the transmission / reception detector detects that the number of e-mails transmitted to the specific transmission destination within a predetermined period is a predetermined number. Exceeding the upper limit may be used as a predetermined condition. The transmission / reception information storage unit further stores, as communication information, information for specifying a transmission / reception partner of the e-mail, and the transmission / reception detector detects that the number of e-mails transmitted / received to / from the specific transmission / reception partner within a predetermined period is a predetermined number. Exceeding the upper limit may be used as a predetermined condition.

[0007] The new transmission / reception information storage unit stores information for specifying the number of electronic mails and information for specifying the transmission destination or transmission / reception destination of the electronic mail in association with each other.
The upper limit may be set in association with the transmission destination or the transmission / reception partner. The transmission / reception destination detection unit may set the upper limit value in association with the user who has transmitted or transmitted the e-mail.

[0008] The transmission / reception information storage unit stores, as communication information, information for specifying the number of electronic mails to which a file is attached, and the sender / receiver detection unit transmits and receives or transmits or receives the file within a predetermined period. The condition that the number of mails is equal to or more than a predetermined upper limit value may be used as the predetermined condition. The transmission / reception destination detection unit may set the upper limit value in association with the user who transmitted or transmitted the e-mail attached with the file. The communication unit further includes a file identification unit that identifies the data format of the file attached to the e-mail using the communication information acquired by the acquisition unit, and the sender / receiver detection unit sets an upper limit in association with the data format of the file. You may.

The transmission / reception information storage unit stores, as communication information, information for specifying a transmission destination of an electronic mail. The transmission / reception detecting unit includes a group storage unit for pre-dividing the transmission destination into a plurality of groups and storing the group. Has, the sender and receiver detection unit,
A condition that the number of groups to which the destination of the e-mail transmitted in the same transmission process belongs is equal to or greater than a predetermined upper limit may be used as the predetermined condition. The acquisition unit acquires communication information that specifies transmission or transmission / reception of an e-mail using the mailing list, and the transmission / reception information storage unit calculates the number of e-mails calculated based on the communication information acquired by the acquisition unit,
The sender detecting unit uses the condition that the number of e-mails transmitted and received using the mailing list within a predetermined period is equal to or more than a predetermined upper limit as a predetermined condition. You may. The obtaining unit may include a mailing list detecting unit that obtains information for specifying the mailing list, and the sender detecting unit may set an upper limit in association with the mailing list.

[0010] The acquisition unit has a data amount detection unit that acquires the data amount of the text of the e-mail and the attached file as the communication information, and the transmission / reception information storage unit transmits the data amount of the e-mail and transmits the e-mail. Or, the sender and the associated user are stored in association with the transmission destination or the transmission / reception partner of the electronic mail, and the sender detection unit transmits the electronic mail transmitted to the specific transmission destination or transmitted / received to / from the specific transmission / reception partner within a predetermined period. Make sure that the total amount of email data is greater than or equal to the specified upper limit.
It may be used as a predetermined condition.

[0011] For the user detected by the sender detection unit,
A notification unit for notifying a warning by e-mail may be further provided. A warning history storage unit that stores the number of times the notification unit has notified the warning in association with the user who has been notified of the warning, and when the number of times in the warning history storage unit exceeds a predetermined upper limit,
A transmission function stopping unit for stopping a user's e-mail transmission function may be further provided.

According to another aspect of the present invention, an information management system for managing transmission / reception of a file includes a second information hidden in the file, which is different from the first information explicitly included in the file. An acquisition unit for acquiring concealment suggestion information indicating that the concealment suggestion has been performed;
A corresponding file detection unit that detects a file that is determined to have hidden data, and a sender / receiver detection unit that detects a user who has transmitted or transmitted the file detected by the corresponding file detection unit.

[0013] The acquisition unit includes, as the concealment suggestion information, information indicating the data amount of the file and information indicating the data amount corresponding to the content including the character, image, or sound explicitly output by the file. And the file detection unit may determine whether the second data is hidden by comparing the information indicating the data amount with the data amount corresponding to the content. The apparatus may further include a corresponding file storage unit that stores information for specifying only the file detected by the corresponding file detection unit.

According to another aspect of the present invention, an information management system for managing transmission and reception of a file includes: an acquisition unit for acquiring communication information on transmission or transmission / reception of a file; and a file management unit based on the communication information acquired by the acquisition unit. And a sender / reception detecting unit for detecting a user who has transmitted or transmitted a file whose type cannot be specified by the file identifying unit.

According to another aspect of the present invention, an information management system for managing transmission and reception of a file includes an acquisition unit for acquiring communication information on transmission or transmission and reception of a file, and a file management method based on the communication information acquired by the acquisition unit. A file identification unit that identifies the type of the file, an analysis unit that analyzes the contents of the file by using a process according to the type of the file identified by the file identification unit, and a file that detects that the analysis unit determines that the file cannot be analyzed. A file detection unit.

A language storage unit for storing information indicating a type of a character code of text data indicating the language, information on a grammar of the language, and a predetermined word of the language in correspondence with the predetermined language; Based on the communication information acquired by the acquisition unit, a character code detection unit that detects the type of the character code of the text data included in the file, and in the language storage unit, information indicating the type of the character code, information about the grammar of the language, A language identification unit that identifies a language indicated by the text data of the file using the predetermined word and the type of the character code detected by the character code detection unit; If the identified language is not the language specified in advance, it may be determined that the file cannot be analyzed.

The analysis unit has a compression method detection unit that detects a file compression method based on the transmission information acquired by the acquisition unit. The analysis unit determines whether the file compression method is not the compression method specified in advance. Then, it may be determined that the file cannot be analyzed. The analysis unit has an encryption method detection unit that detects the encryption method of the file using the transmission information acquired by the acquisition unit, and the analysis unit determines that the encryption method of the file is not the encryption method specified in advance. In this case, it may be determined that the file cannot be analyzed.

According to another aspect of the present invention, there is provided an information management method for managing electronic mail transmission / reception processing, wherein the computer acquires communication information relating to transmission or transmission / reception of electronic mail, and the communication information acquired by the computer comprises: The method includes a step of storing the electronic mail in association with a user who has transmitted or transmitted the electronic mail, and a step of detecting a user corresponding to the communication information when the communication information satisfies a predetermined condition.

According to another aspect of the present invention, a program for managing e-mail transmission / reception processing includes an acquisition module for acquiring communication information relating to transmission or transmission / reception of an e-mail, and an e-mail for acquiring communication information acquired by the acquisition module. And a transmission / reception information storage module for storing the transmission / reception information in association with the user who has transmitted or transmitted the communication information, and a transmission / reception party detection module for detecting a user corresponding to the communication information when the communication information satisfies a predetermined condition.

The above summary of the present invention does not list all of the necessary features of the present invention, and a sub-combination of these features may also be an invention.

[0021]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described through embodiments of the present invention. However, the embodiments do not limit the claimed invention, and all combinations of features described in the embodiments are described. Is not necessarily essential to the solution of the invention.

FIG. 1 schematically shows an entire network system including an information management system 100. The network system includes an internal network 50, an information management system 100, and an external network 200. In the network system, data is transmitted and received. Data is transmitted and received as a file in a predetermined format. The file is a collection of data in a predetermined format or meaning, and includes, for example, an e-mail file, an e-mail attached file, and the like. The data is transmitted and received using, for example, electronic mail. That is, data is transmitted and received as an e-mail format file using a protocol such as SMTP or POP. Data is,
It may be transmitted and received as a file in a format other than electronic mail based on a protocol such as HTTP or FTP. In the present embodiment, transmission and reception of data mainly using e-mail will be described.

The internal network 50 transmits and receives data to and from the external network 100. Internal network 5
0 is managed by the information management system 100 for data transmission and reception. The internal network 50 transmits predetermined data to the external network 100 by e-mail. The internal network 50 has a user terminal 52 and an administrator terminal 54. The user terminal 52 sends the data by e-mail. The user terminal 52 is connected to the internal network 50
When an e-mail is transmitted / received to / from another user terminal 52 or the external network 100, the information management system 100
Manages the sending and receiving of emails. Administrator terminal 54
Manages the internal network 50 together with the information management system 100. The information management system 100 is an example of the information management system according to the present invention.

The information management system 100 manages transmission / reception of e-mail by monitoring packets flowing in the internal network 50, for example. Information management system 1
00 may be used as a gateway to monitor transmission and reception of e-mail between the internal network 50 and the external network 100. Further, the information management system 100 may acquire information regarding transmission and reception of electronic mail from an electronic mail server used by the internal network 50 and manage transmission and reception of electronic mail.

FIG. 2 shows functional blocks of the information management system 100. The information management system 100 includes an acquisition unit 11
0, a file identification unit 120, an analysis unit 130, a corresponding file detection unit 140, and a corresponding file storage unit 150.
, Transmission / reception information storage section 160, transmission / reception person detection section 170
, A notification unit 180, a warning history storage unit 190, and a transmission function stop unit 194.

The acquisition unit 110 acquires communication information relating to data transmission or transmission / reception from the internal network 50,
The data is output to the file identification unit 120 and the transmission / reception information storage unit 160. That is, the acquisition unit 110 determines that the internal network 5
From 0, communication information about transmission or transmission / reception of an e-mail or communication information about transmission or transmission / reception of a file is acquired. The communication information is information relating to the transmission and reception of data, for example, the transmission date and time or reception date and time of the e-mail, information specifying the sender, information specifying the recipient, the data amount of the transmitted or received e-mail, and the attached file Information about the type of attached file, the title of the e-mail, concealment suggestion information indicating that concealment data is present in the file, information on the body of the e-mail, and the like. The hidden data is information hidden in the file, and is second information different from the first information explicitly included in the file.

The obtaining unit 110 has a mailing list detecting unit 112 and a data amount detecting unit 114. The mailing list detection unit 112 acquires information for specifying the mailing list, and outputs the information to the file identification unit 120 and the new transmission / reception information storage unit 160. That is, when the mailing list detection unit 112 determines that the transmitted or received e-mail is the transmission or reception using the mailing list,
Information that specifies the mailing list, such as the mailing list mail address and the mailing list-specific title, is obtained. The mailing list detection unit 112 determines transmission / reception using the mailing list by using, for example, the title of the received e-mail or receiving the same e-mail as the transmitted e-mail from the mailing list.

The data amount detection unit 114 acquires the data amount of the text of the e-mail and the attached file, and outputs them to the file identification unit 120 and the new transmission / reception information storage unit 160. If there is no attached file, the data amount detection unit 114 may acquire the data amount of the body of the e-mail.

FIG. 3 shows an example of communication information obtained by the obtaining unit 110. In this example, the acquisition unit 110 acquires the communication information of the e-mail transmitted or received during a predetermined period by a batch process. The obtaining unit 110 may obtain communication information of an e-mail to be transmitted or transmitted / received in real time. FIG. 3A shows an example of communication information regarding the transmitted e-mail. In this example, the acquisition unit 110 acquires the date and time when the e-mail was sent, the user who sent the e-mail, the destination, the data format of the attached file, the data amount of the e-mail, and the like. In this case, the acquiring unit 110 acquires the extension of the attached file as the data format of the attached file. FIG.
(B) shows an example of communication information regarding the received e-mail. In this example, the acquisition unit 110 acquires the date and time when the e-mail was received, the user who received the e-mail, the source of the e-mail, the data format of the attached file, the data amount of the e-mail, and the like.

Returning to FIG. The file identification unit 120 specifies the type of the file using the communication information received from the acquisition unit 110 and outputs the file type to the analysis unit 130. For example, when receiving the communication information of the e-mail from the acquisition unit 110, the file identification unit 120 specifies the data format of the file to which the e-mail is attached. For example, the communication information includes a file extension, and the file identification unit 120 specifies the type of the file by using the file extension. If the file identification unit 120 cannot identify the type of the file, that is, if the file is not a predetermined data format, the file is output to the corresponding file detection unit 140 as content analysis impossible. Further, the file identifying unit 120 outputs the communication information to the analyzing unit 130 or the corresponding file detecting unit 140.

The analysis unit 130 has a language storage unit 132, a character code detection unit 134, a language identification unit 135, a compression method detection unit 136, and an encryption method detection unit 138. When receiving the information indicating the file type from the file identification unit 120, the analysis unit 130 performs a process according to the file type. That is, the analysis unit 130, for example,
Upon receiving the information indicating the type of the file including the text data, the language storage unit 132, the character code detection unit 134,
Further, upon requesting the language identification unit 135 for processing and receiving information indicating the compressed file, it requests the compression method detection unit 136 for processing.

The language storage unit 138 stores, in association with a predetermined language, the type of character code of text data for displaying the language, information on grammar of the language, and predetermined words of the language.

FIG. 4 shows an example of a table stored in the language storage section 132. In this example, the language storage unit 132 stores a character code system, a grammar, and a word in association with a language. For example, the language storage unit 132 associates with the Japanese language, a character code system used for Japanese display such as a shift JIS code, information on a Japanese sentence structure,
Stores frequently used Japanese words.

Returning to FIG. The character code detection unit 134
When the communication information is received from the file identification unit 120, the type of the character code of the text data included in the file is detected based on the communication information, and output to the language identification unit 135. If the character code of the text data included in the file does not have a preset character code system, the character code detection unit 134 outputs the file to the file detection unit 140 as content analysis impossible.

The language identification section 135 stores information on the type of character code and grammar stored in the language storage section 138.
Further, the language of the text data in the file is identified using the predetermined word and the type of the character code detected by the character code detection unit 134. Language identification unit 135
If the language of the text data in the file cannot be detected, the file is output to the corresponding file detection unit 140 as the content cannot be analyzed. Thus, the language storage unit 1
By storing a character code, a grammar, and a word of a language specified in advance in 38 and identifying the language in the file by the language identification unit 135, a file described in a language other than the specified language can be detected.

Upon receiving the communication information from the file identification unit 120, the compression method detection unit 136 detects the file compression method based on the communication information. Compression method detector 1
36 detects a compression method of the file based on, for example, an extension of the file which is communication information. The compression method detection unit 136 may receive the file itself as the communication information, decompress the file using a preset compression method, and detect the file compression method using whether or not the file can be normally decompressed. . Also, the compression method detection unit 136
When the file compression method cannot be detected, the file is output to the corresponding file detection unit 140 as the content cannot be analyzed. By doing so, it is possible to detect a file compressed by a compression method other than the specified one.

Upon receiving the communication information from the file identification unit 120, the encryption system detection unit 138 detects the file encryption system using the communication information. The encryption method detection unit 138 may detect the encryption processing. in this case,
The encryption method detection unit 138 receives, for example, the file itself as communication information, performs a decryption process corresponding to the encryption process specified in advance on the file, and performs the encryption process based on whether the file can be decrypted normally. To detect. If the encryption scheme detection unit 138 cannot detect the encryption scheme of the file, it outputs the file to the file detection unit 140 as content analysis impossible. By doing this,
A file encrypted using an unspecified encryption method or an unspecified encryption key can be detected.

Upon receiving the file type from the file identification unit 120, the analysis unit 130 analyzes the contents of the file by using a process corresponding to the file type, and outputs the analysis result to the file detection unit 140. Analysis unit 130
For example, upon receiving information specifying the type of the e-mail and the attached file, that is, the data format from the file identification unit 120, the content of the e-mail text and the attached file is processed using a process corresponding to the data format. Is analyzed. The analysis unit 130 may decompress the file according to the compression method detected by the compression method detection unit 136 and then analyze the contents. In addition, the analysis unit 130, according to the encryption method detected by the encryption method detection unit 138,
The contents may be analyzed after decrypting the file. Furthermore, when the data format is text, the analysis unit 130
The meaning of a sentence represented by a text may be analyzed using a character string database, a sentence structure database, and an analysis algorithm according to the language detected by the language identification unit 135. When the data format is image data, the contents of the image data may be analyzed based on the similarity to a predetermined image detected using image matching. When the analysis unit 130 determines that the content of the file belongs to the predetermined classification, the analysis unit 130 outputs the file to the file detection unit 140 as an inappropriate file. Analysis unit 1
If it is determined that the content of the file cannot be analyzed, the file 30 is output to the corresponding file detection unit 140 as the content cannot be analyzed.

Upon receiving a file whose content cannot be analyzed or an inappropriate file from the file identifying unit 120 or the analyzing unit 140, the corresponding file detecting unit 140 detects the file, and the corresponding file storing unit 150 and the transmission / reception information storing unit 160 Output to For example, when at least one of the body of the e-mail and the attached file is incapable of analyzing the content or inappropriate, the corresponding file detection unit 140 detects the e-mail. Upon receiving the concealment suggestion information as communication information from the analysis unit 130, the corresponding file detection unit 140
Using the concealment suggestion information, a file that is determined that the concealment data is concealed is detected. Applicable file detection unit 14
0 receives, for example, information indicating the data amount and information indicating the data amount corresponding to the content as the concealment suggestion information, and uses the information indicating the data amount corresponding to the content to change the content of the file. The amount of data estimated from the content such as characters, images, and sounds that are explicitly output when the content is output is calculated. Then, the corresponding file detection unit 140 compares the data amount corresponding to the content with information indicating the data amount, and when an abnormal difference is found, determines that the hidden data is hidden in the file. I do. The corresponding file detection unit 140 may determine the presence or absence of the concealment data by comparing the content, for example, the size and resolution of the image included in the file, with the actual data amount of the file.

Upon receiving a file from the corresponding file detection unit 140, the corresponding file storage unit 150 stores the received file. The corresponding file storage unit 150 may store information for specifying the received file. Further, the corresponding file storage unit 150 may store the received file in association with the user who transmitted or transmitted / received the file. The file stored in the corresponding file storage unit 150 may be checked more strictly.

The transmission / reception information storage unit 160 includes the acquisition unit 110
When the communication information is received from, the received communication information is stored in association with the user who transmitted or transmitted the file. The transmission / reception information storage unit 160 stores the corresponding file detection unit 1
The file received from 40 may be stored in association with the user who transmitted or transmitted / received the file. The transmission / reception information storage unit 160 includes, as communication information, for example, information for specifying the number of transmitted or transmitted e-mails, information for specifying the transmission / reception partner of the e-mail, information for specifying the number of e-mails with attached files, transmission Alternatively, the data amount of the transmitted / received e-mail is stored.

FIG. 5 shows an example of a table in which the transmission / reception information storage section 160 stores communication information. In this example, the transmission / reception information storage unit 160 stores the communication information after performing predetermined statistical processing. FIG. 5A illustrates an example of a table in which the transmission / reception information storage unit 160 stores the number of electronic mails in association with the user. In this example, the transmission / reception information storage unit 160
The number of transmitted and received e-mails is stored in association with the user and the transmission / reception partner of the user. FIG. 5 (B)
6 shows an example of a table in which the transmission / reception information storage unit 160 stores the number of e-mails to which a file is attached in association with a user. In this example, the transmission / reception information storage unit 160 stores the number of e-mails transmitted and received with a file attached in association with the user and the type of the attached file. The type of the attached file is the data format of the attached file. In this example, the extension of the file indicating the data format is stored. FIG. 5C shows an example of a table in which the data amount of electronic mail transmitted and received by the transmission / reception information storage unit 160 is stored in association with the user. In this example, the transmission / reception information storage unit 160 stores the data amount of the body of the e-mail, the data amount of the attached file, and the total data amount obtained by adding the data amount of the body and the attached file, transmitted and received during a predetermined period.
The data is stored in association with the transmitted / received user and the transmission / reception partner. FIG. 5D illustrates an example of a table in which the transmission / reception information storage unit 160 stores the number of e-mails transmitted / received using the mailing list in association with the user. The transmission / reception information storage unit 160 stores the number of e-mails transmitted / received using the mailing list in association with the transmitted / received user and the mailing list.

Returning to FIG. When the communication information in the transmission / reception information storage unit 160 satisfies a predetermined condition, the sender / receiver detection unit 170 detects a user corresponding to the communication information,
Output to the notification unit 180. The predetermined condition is, for example, the number of e-mails transmitted or received within a predetermined period,
The number of e-mails with attached files, the amount of e-mail data, the number of e-mails transmitted and received using the mailing list, and the like exceed the upper limit set for each. That is, the sender / receiver detection unit 170 detects, from within the transmission / reception information storage unit 160, a user whose number of e-mails transmitted or transmitted within a predetermined period exceeds a predetermined upper limit. The upper limit may be set for each user. In addition, the sender / receiver detecting unit 170 determines that the number of e-mails transmitted to a specific destination within a predetermined period or the number of e-mails transmitted / received to / from a specific transmission / reception partner within a predetermined period has a predetermined upper limit. The number of users exceeding the number is detected from the transmission / reception information storage unit 160. That is, the sender / receiver detection unit 170 calculates the number of e-mails for each communication partner, and detects a user who has exceeded the upper limit set for each communication partner.

The sender / receiver detector 170 detects, from within the transmission / reception information storage 160, users whose number of e-mails transmitted or transmitted with attached files exceeds a predetermined upper limit within a predetermined period. The sender / receiver detector 170 may set the upper limit for each user who transmits or receives or for each data format of a file. Transmitter / receiver detector 170
Upon receiving the information specifying the data format of the file from the new transmission / reception information storage unit 160, the device detects a user whose number of emails transmitted or transmitted with the attached file exceeds the upper limit value according to the data format.

The sender / receiver detector 170 detects a user whose number of e-mails transmitted / received using the mailing list exceeds a preset upper limit from the transmission / reception information storage 160 within a predetermined period. Transmitter / receiver detector 170
May set an upper limit value in association with the mailing list. In this case, the sender / receiver detection unit 170 detects a user whose number of e-mails transmitted / received using the mailing list exceeds a maximum value set according to the mailing list within a predetermined period.

FIG. 6 shows an example of an upper limit table set by the sender / receiver detector 170. In this example, the users are divided into predetermined groups,
Sets an upper limit for each group of users. FIG. 6A shows an example of a table in which the sender / receiver detection unit 170 sets the number of electronic mails and the upper limit of the data amount. In this example, the sender / receiver detection unit 170 sets the upper limit value of the number of e-mails transmitted / received in the predetermined period and the total data amount of e-mails transmitted / received in the predetermined period for each user and each transmission / reception partner. Set. The upper limit is set for each group of users, and the upper limit is
This is a value set for a user belonging to a predetermined group. FIG. 6B shows an example of a table in which the sender / receiver detection unit 170 sets the upper limit of the number of emails with attached files. In this example, the sender / receiver detector 170 sets the upper limit of the number of electronic mails transmitted and received with a file attached within a predetermined period for each user and each type of attached file. FIG. 6C shows an example of a table in which the sender / receiver detector 170 sets an upper limit value of the number of electronic mails transmitted and received using the mailing list. In this example,
The sender / receiver detecting unit 170 sets an upper limit value of the number of electronic mails transmitted / received using the mailing list within a predetermined period for each mailing list.

Returning to FIG. The sender / receiver detection unit 170 includes a group storage unit 172. Group storage unit 172
Stores the e-mail destinations in a plurality of groups. The sender / receiver detection unit 170 determines that the number of groups to which the destination of the e-mail transmitted in the same transmission process belongs is equal to or greater than the upper limit value.
Detect from within.

FIG. 7 shows an example of a table in which the group storage unit 172 stores electronic mail transmission destinations in groups. In this example, the group storage unit 172 stores e-mail addresses as information for specifying a transmission destination, divided into groups. In the "Email address" column in this figure,
E-mail address is set. “*” In the mail address means an arbitrary character string. That is, in this example, the group storage unit 172 stores transmission destinations in groups on a domain basis. Information management system 1
In the case of 00, the destinations are stored in groups in the group storage unit 172, and the transmission of an e-mail in which destinations belonging to a plurality of groups are described at the same e-mail destination can be warned or prohibited. it can. That is, by warning or prohibiting the transmission of e-mail by carbon copy to a plurality of destinations belonging to different groups,
It is possible to prevent an e-mail destination from knowing an e-mail address of a destination belonging to another group.

Returning to FIG. The sender / receiver detector 170 detects a user who has transmitted or received a file whose content cannot be analyzed or an inappropriate file, from the new transmission / reception information storage 160.

The notifying section 180 notifies the user detected by the sender / receiver detecting section 170 of a warning by e-mail.
The information related to the warning and the information specifying the user are output to the warning history storage unit 190. The notifying unit 180 notifies, for example, a warning indicating transmission or transmission / reception of an illegal electronic mail.

Upon receiving the information about the warning and the information for specifying the user from the notification unit 180, the warning history storage unit 190 stores the number of times of warning notification in association with the user.

FIG. 8 shows an example of a table in which the warning history storage section 190 stores the number of warnings in association with the user.
In this example, the warning history storage unit 190 stores the number of warnings notified to the user within a predetermined period in association with the user who received the warning.

Returning to FIG. The transmission function stopping unit 194 stops the e-mail transmission function of the user who has been notified of the warning, when the number of times the warning has been notified from the warning history storage unit 190 exceeds a predetermined upper limit. Transmission function stop unit 194
Operates the internal network 50 to stop the e-mail transmission function of the user terminal 52, for example. The sending function stopping unit 194 may stop the sending function of the e-mail and also stop the receiving function of the e-mail at the same time.

FIG. 9 shows a processing flow in which the information management system 100 manages the file transmission / reception processing. The internal network 50 outputs to the information management system 100, for example, a log of a predetermined period of e-mail transmitted / received using the e-mail server. When acquiring the log as communication information from the internal network 50, the acquiring unit 110 extracts the communication information together with the mailing list detecting unit 112 and the data amount detecting unit 114. That is, the acquisition unit 110
Is the number of emails, the number of emails with attachments, the number of emails using mailing lists,
The data amount of the e-mail, the type of the attached file, the concealment suggestion information, the information specifying the sender, the recipient, the body, the attached file, etc. are extracted, and the file identification unit 120 is used as the communication information.
Is output to the transmission / reception information angle unit 160 (S50). The file identification unit 120 specifies the type of the attached file using the received communication information (S100). If the type of the attached file can be identified, the file identification unit 130 outputs the identification result and the communication information to the analysis unit 130. If the type of the attached file cannot be identified, the file identification unit 130 outputs the attached file to the file detection unit 140 as content analysis impossible. (S150).
The analysis unit 130 analyzes the body of the e-mail and the contents of the attached file using the received communication information and the type of the attached file, and outputs the analysis result and the communication information to the corresponding file detection unit 140 (S200). The corresponding file detection unit 140 checks whether or not there is a concealed file using the concealment suggestion information that is the communication information (S250). The corresponding file detection unit 140 receives the identification result, the analysis result,
Further, based on the inspection result of the presence / absence of hidden data, a file whose content cannot be analyzed and a file containing hidden data are detected, and the corresponding file storage unit 150 and the transmission / reception information storage unit 1 are detected.
60 (S300). Corresponding file storage unit 15
0 stores the received file in association with the user who transmitted and received, and the transmission / reception information storage unit 160 stores the received file and communication information in association with the user who transmitted and received (S350). The sender / receiver detection unit 170 detects a user whose communication information in the transmission / reception information storage unit 160 satisfies a predetermined condition (S400). Transmitter / receiver detector 17
In the case of 0, if a user who satisfies the condition is detected, information for specifying the detected user is output to the notifying unit 180, and if the user is not detected, the process is terminated (S450). Upon receiving the information specifying the user, the notifying unit 180 notifies the user terminal 52 of the user of a warning by e-mail, and outputs the notification to the warning history storage unit 190 (S500). The warning history storage unit 190 stores the number of times of warning notification in association with the notified user (S550). When the stored number of warnings is equal to or greater than the predetermined upper limit value, the alert history storage unit 190 outputs to the transmission function suspending unit 194 information identifying the user whose number of warnings is equal to or greater than the upper limit value. If there is no user whose value is equal to or greater than the value, the process ends (S600). Transmission function stop unit 1
Upon receiving the information specifying the user, the 94 stops the e-mail transmission function of the user terminal 52 of the user (S650).

FIG. 10 shows the flow of the processing (S200) in which the analysis unit 130 analyzes the contents of the file in more detail. In this example, only the attached file of the e-mail is described, but the content of the text of the e-mail and the file transmitted / received by another method are analyzed by the same processing. When the file identifying unit 120 determines that the attached file is a file that may include text data, the analyzing unit 130 compresses information specifying the attached file of the e-mail, the type of the attached file, and the like as communication information. The data is output to the method detection unit 136, and the analysis of the text data is started. The compression method detection unit 136 detects the compression method of the attached file using the communication information (S205).
When the attached file uses a compression method (including non-compression) specified in advance, the compression method detection unit 136 decompresses the attached file and outputs it to the encryption method detection unit 138 together with other communication information. On the other hand, when the compression method specified in advance is not used (including the case where the compression method cannot be detected)
Renders the file incapable of content analysis and outputs the file to the analysis unit 130 (S210). The encryption method detection unit 138 detects the encryption method of the attached file using the received communication information (S215). When the attached file uses an encryption method (including non-encryption) specified in advance, the encryption method detection unit 138 decrypts the attached file, and sends the character code detection unit 134 and the language together with other communication information. The file is output to the identification unit 135. On the other hand, when the encryption method specified in advance is not used (including the case where the encryption method cannot be detected), the file is determined to be incapable of analyzing the contents and the analysis unit 13
0 is output (S220). Character code detector 134
Detects the information indicating the type of the character code used for the attached file using the communication information. Further, the language identification unit 135 further includes information indicating the type of the character code detected by the character code detection unit 134, The language indicated by the text data included in the attached file is identified using the type, grammar, and word of the character code stored in the language storage unit 132 in association with the predetermined language (S225). When the identified language is a language specified in advance, the language identifying unit 135 determines the identified language together with other communication information by the analyzing unit 13.
0, on the other hand, if the language is not the language specified in advance (including the case where language identification is impossible), the file is output to the analysis unit 130 as content analysis impossible (S230). The analysis unit 130 performs content analysis according to the language identified by the language identification unit 135, and terminates the processing if the content of the attached file belongs to a predetermined classification, while the attached file falls into another predetermined classification. Belongs (including cases where content analysis is not possible)
Outputs the file to the analysis unit 130 as inappropriate or incapable of content analysis (S240). When the analysis unit 130 receives the file as content analysis impossible or inappropriate, it outputs the file to the file identification unit 140 as content analysis impossible or inappropriate (S245).

On the other hand, the file identification unit 120 determines that the attached file does not include text data (for example, M
If it is determined that the file is a PEG file, a JPEG file, or the like), the analysis unit 130 performs a content analysis according to the type of the file. For example, the analysis unit 130 is configured to
Detection of compression method using 36, encryption method detection section 138
After detecting the encryption method using, the content is analyzed by comparing the image data or audio data with the registered image data or audio data, etc. Corresponding file detection unit 1
Output to 40.

FIG. 11 shows in more detail the flow of the process (S400) in which the sender / receiver detecting section 170 detects a user satisfying a predetermined condition. The sender / receiver detection unit 170 searches the transmission / reception information storage unit 160 to detect a user who satisfies a predetermined condition. The sender / receiver detection unit 170 first searches the transmission / reception information storage unit 160 for the file (S4).
02). If the sender / receiver detecting unit 170 detects the file, the process proceeds to a process of detecting a user corresponding to the file. If the file is not detected, the process proceeds to a search process of the number of mails (S404). The sender / receiver detection unit 170 searches the transmission / reception information storage unit 160 for the number of e-mails transmitted and received within a predetermined period for each user and transmission / reception partner (S406). If the sender / receiver detection unit 170 detects in the search result that the number of e-mails is equal to or more than the preset upper limit, the process proceeds to a detection operation of a user having the upper limit or more, and cannot detect the user having the upper limit or more. In this case, the processing shifts to the search processing for the number of attached mails (S
408). The sender / receiver detection unit 170 searches the transmission / reception information storage unit 160 for the number of emails transmitted and received with a file attached within a predetermined period, for each user and the type of the attached file (S410). Transmitter / receiver detector 1
70, if the number of attached e-mails detected in the search result is equal to or greater than a preset upper limit, the process proceeds to the detection of users having the upper limit or more. The process proceeds to a search process (S412).
The sender / receiver detection unit 170 stores the group to which the destination described in the same e-mail destination belongs to in the group storage unit 1
The search is performed using the E.72 (S414). Transmitter / receiver detector 1
70, if the search result indicates that the number of groups is equal to or more than the preset upper limit, the process proceeds to a process of detecting a user whose number is equal to or more than the upper limit. The processing shifts to the transmission / reception number search process (S416). The sender / receiver detection unit 170 searches the transmission / reception information storage unit 160 for the number of electronic mails transmitted and received using the mailing list within a predetermined period for each user and mailing list (S418). If the sender / receiver detecting unit 170 detects in the search result that the number of e-mails is equal to or more than the preset upper limit value, the process proceeds to a detection operation of the user having the upper limit value or more, and does not detect the user having the upper limit value or more. In this case, the process proceeds to the accumulated data amount calculation process (S4).
20). The sender / receiver detection unit 170 searches the data amount of the e-mail transmitted / received within the predetermined period from the transmission / reception information storage unit 160 for each user (S455). If the sender / receiver detecting unit 170 detects that the sum of the searched data amounts is equal to or more than the preset upper limit value, the process shifts to the detection operation of the user having the upper limit value or more and does not detect the user whose data amount is equal to or more than the upper limit value. Ends the processing (S424). In the user detection work, the sender / receiver detection unit 170 determines whether the user has transmitted / received the corresponding file, has transmitted / received e-mails with the number of e-mails greater than or equal to the upper limit, the user who has transmitted / received e-mails with file attachments with the number of e-mails greater than the upper limit, Users whose destinations belong to the same group or more are listed in the same e-mail destination, users who sent and received e-mails with the number of mails exceeding the upper limit using the mailing list, and who sent and received e-mails with the data amount more than the upper limit The detected user is detected from the transmission / reception information storage unit 160, output to the notification unit 180, and the process ends (S426). Note that the processing described with reference to this drawing is not limited to the order of this example.

FIG. 12 is a block diagram showing a hardware configuration of the information management system 100. The information management system 100 includes a CPU 700, a ROM 702, a RAM
704 and a communication interface 706. C
The PU 700 operates based on programs stored in the ROM 702 and the RAM 704. The communication interface 706 communicates with the outside via the Internet. Hard disk drive 7 as an example of a storage device
Reference numeral 10 stores setting information and a program on which the CPU 700 operates.

The flexible disk drive 712 reads data or a program from the flexible disk 714 and provides it to the CPU 700. The CD-ROM drive 716 reads data or a program from the CD-ROM 718 and provides it to the CPU 700. The communication interface 706 transmits and receives data by connecting to the Internet.

The software executed by the CPU 700 is:
Flexible disk 714 or CD-ROM 718
And provided to the user. The software stored on the recording medium may be compressed or uncompressed. The software is installed from the recording medium to the hard disk drive 710 and the RAM 70
4 and executed by the CPU 700.

The software stored and provided on the recording medium, that is, the software installed on the hard disk drive 710 includes, as functional components, an acquisition module, a file identification module, an analysis module, a corresponding file detection module, a corresponding file storage module, It includes a transmission / reception information storage module, a transmitter / receiver detection module, a notification module, a warning history storage, and a transmission function stop module. Further, the acquisition module includes, as submodules, a mailing list detection module,
And a data amount detection module 114. The analysis module includes a language storage module, a character code detection module, a language identification module,
It has a compression method detection module and an encryption method detection module, and the sender / receiver detection module has a group storage module as a submodule. Each of these modules works on the computer, and the CPU 70
0 are the same as the functions and operations of the corresponding members in the information management system 100 according to the present embodiment, and a description thereof will be omitted.

A flexible disk 714 or a CD-ROM 718 as an example of a recording medium shown in FIG.
May store some or all of the functions of the operation of the information management system 100 in all embodiments described in the present application.

These programs are directly stored in R
The program may be read out to the AM and executed, or may be read out to the RAM and executed once after being installed in the hard disk drive. Further, the program may be stored on a single recording medium or a plurality of recording media. The modules stored in the recording medium may provide their respective functions in cooperation with the operating system. For example, the function may be requested to the operating system to perform a part or all of the function, and the function may be provided based on a response from the operating system.

As a recording medium, in addition to a flexible disk and a CD-ROM, an optical recording medium such as a DVD,
A magnetic recording medium such as an MD, a magneto-optical recording medium such as a PD, a tape medium, a magnetic recording medium, and a semiconductor memory such as an IC card or a miniature card can be used. or,
A storage device such as a hard disk or a RAM provided in a server system connected to a dedicated communication network or the Internet may be used as a recording medium, and the program may be provided to the information management system 100 via the communication network.

Such a recording medium is used only for producing the information management system 100, and the production and sale of such a recording medium as a business infringes the patent right based on the present application. It is clear to configure.

As described above, by using the information management system 100, the transfer of information between the internal network 50 and the external network 200 can be managed. For example, it is possible to detect a user whose number of electronic mail transmissions / receptions, number of file attachments, data amount, and the like are larger than necessary. For example, when the internal network 50 is a corporate LAN, it is considered that a user who transmits and receives files more than necessary is likely to use corporate resources for personal use purposes. be able to. Therefore, by giving a warning or stopping the transmission function to a user who sends and receives data more frequently than necessary, it is possible to prevent such illegal use of network resources. Further, by analyzing the contents of the file to be transmitted and received and detecting the file in which the hidden information is embedded, it is possible to prevent leakage of confidential information and personal information.

As described above, the present invention has been described using the embodiments. However, the technical scope of the present invention is not limited to the scope described in the above embodiments. Various changes or improvements can be added to the above embodiment. It is apparent from the description of the appended claims that embodiments with such changes or improvements can be included in the technical scope of the present invention.

[0068]

As is apparent from the above description, according to the present invention, transmission / reception of a file can be monitored and transmission / reception satisfying a predetermined condition can be detected.

[Brief description of the drawings]

FIG. 1 is a diagram schematically showing an entire network system including an information management system 100. FIG.

FIG. 2 is a functional block diagram of the information management system 100.

FIG. 3 is a diagram illustrating an example of communication information acquired by an acquisition unit 110;

FIG. 4 is a diagram illustrating an example of a table stored in a language storage unit 132;

FIG. 5 is a diagram illustrating an example of a table in which communication information storage section 160 stores communication information.

FIG. 6 is a diagram illustrating an example of a table of an upper limit value set by a sender / receiver detection unit 170;

FIG. 7 is a diagram illustrating an example of a table in which a group storage unit 172 stores e-mail destinations in groups.

FIG. 8 is a diagram illustrating an example of a table in which a warning history storage unit 190 stores the number of warnings in association with a user.

FIG. 9 is a diagram showing a processing flow in which the information management system 100 manages file transmission / reception processing.

FIG. 10 is a diagram showing in more detail the flow of processing (S200) in which the analysis unit 130 analyzes the contents of a file.

FIG. 11 is a diagram showing in more detail the flow of a process (S400) of detecting a user who satisfies a predetermined condition by the sender / receiver detection unit 170;

FIG. 12 is a block diagram illustrating a hardware configuration of the information management system 100.

[Explanation of symbols]

 Reference Signs List 50 internal network 52 user terminal 54 administrator terminal 100 information management system 110 acquisition unit 112 mailing list detection unit 114 data amount detection unit 120 file identification unit 130 analysis unit 132 language storage unit 134 character code detection unit 135 language identification unit 136 compression method detection Unit 138 Encryption method detection unit 140 Corresponding file detection unit 150 Corresponding file storage unit 160 Transmission / reception information storage unit 170 Transmitter / receiver detection unit 172 Group storage unit 180 Notification unit 190 Warning history storage unit 194 Transmission function stop unit 200 External network 700 CPU 702 ROM 704 RAM 706 Communication interface

Claims (25)

[Claims] 1. An information management system for managing an e-mail transmission / reception process, comprising: an acquisition unit for acquiring communication information relating to transmission or transmission / reception of the e-mail; A transmission / reception information storage unit that stores the mail in association with a user who has transmitted or transmitted the mail; and a transmission / reception unit that detects the user corresponding to the communication information when the communication information satisfies a predetermined condition. An information management system, characterized in that: 2. The transmission / reception information storage unit stores, as the communication information, information for specifying the number of the e-mails transmitted or transmitted, and the transmission / reception unit detecting unit transmits / receives the e-mail within a predetermined period. 2. The information management system according to claim 1, wherein the condition that the number of the e-mails exceeds a predetermined upper limit is used as the predetermined condition. 3. The transmission / reception information storage unit further stores, as the communication information, information specifying a transmission destination of the e-mail, and the transmission / reception detector detects the transmission destination specified within a predetermined period. 3. The information management system according to claim 2, wherein a condition that the number of the e-mails transmitted to the server exceeds a predetermined upper limit value is used as the predetermined condition. 4. The transmission / reception information storage unit further stores, as the communication information, information for specifying a transmission / reception partner of the e-mail, and the transmission / reception unit detecting unit specifies the transmission / reception partner within a predetermined period. 3. The information management system according to claim 2, wherein a condition that the number of the e-mails transmitted and received exceeds a predetermined upper limit value is used as the predetermined condition. 5. The transmission / reception new information storage unit stores information for specifying the number of the e-mails and information for specifying a transmission destination or a transmission / reception partner of the e-mail in association with each other. 5. The information management system according to claim 3, wherein the upper limit is set in association with the transmission destination or the transmission / reception partner. 6. 6. The transmission / reception destination detection unit sets the upper limit value as:
5. The information management system according to claim 3, wherein the information is set in association with a user who has transmitted or transmitted the electronic mail. 7. The transmission / reception information storage unit stores, as the communication information, information for specifying the number of electronic mails to which a file is attached, and the sender / receiver detection unit attaches the file within a predetermined period. 2. The information management system according to claim 1, wherein a condition that the number of e-mails transmitted or received by the electronic mail is equal to or more than a predetermined upper limit value is used as the predetermined condition. 8. The transmission / reception destination detection unit sets the upper limit value as:
The information management system according to claim 7, wherein the information is set in association with a user who has transmitted or transmitted the e-mail attached with the file. 9. The communication apparatus according to claim 1, further comprising: a file identification unit that identifies a data format of a file attached to the electronic mail using the communication information acquired by the acquisition unit. The information management system according to claim 7, wherein the information is set in association with a data format of the file. 10. The transmission / reception information storage unit stores, as the communication information, information for specifying a transmission destination of the e-mail. The transmission / reception unit detection unit divides the transmission destination into a plurality of groups in advance. The sender / receiver detecting unit, wherein the number of the groups to which the destination of the e-mail transmitted in the same transmission process belongs is equal to or greater than a predetermined upper limit, The information management system according to claim 1, wherein the information management system is used as a predetermined condition. 11. The acquisition unit acquires communication information specifying transmission or transmission / reception of the e-mail using a mailing list, and the transmission / reception information storage unit calculates based on the communication information acquired by the acquisition unit. The number of the e-mails
The sender detecting unit stores the number of the e-mails transmitted and received using the mailing list within a predetermined period is equal to or more than a predetermined upper limit value, The information management system according to claim 1, wherein the information management system is used as a predetermined condition. 12. The acquisition unit has a mailing list detection unit that acquires information for specifying the mailing list, and the sender detection unit sets the upper limit value in association with the mailing list. The information management system according to claim 11. 13. The transmission / reception information storage unit, wherein the acquisition unit includes a data amount detection unit that acquires a data amount of a text and an attached file of the e-mail as the communication information. The amount is stored in association with the user who has transmitted or transmitted the e-mail and the transmission destination or the transmission / reception destination of the e-mail, and the sender detection unit transmits the amount to the specific destination within a predetermined period. 2. The information management system according to claim 1, wherein a condition that a total of the data amount of the e-mail transmitted / received to / from a specific transmission / reception partner is equal to or more than a predetermined upper limit value is used as the predetermined condition. 14. The information management system according to claim 1, further comprising: a notifying unit that notifies a warning by e-mail to the user detected by the sender detecting unit. 15. A warning history storage unit for storing the number of times the notification unit has notified the warning in association with the user notified of the warning, and wherein the number of times in the warning history storage unit is a predetermined upper limit value. 15. The information management system according to claim 14, further comprising: a transmission function stopping unit that stops the user's e-mail transmission function when the number exceeds the limit. 16. An information management system for managing transmission and reception of a file, wherein second information different from the first information explicitly included in the file is hidden in the file. An acquisition unit that acquires concealment suggestion information that suggests, a corresponding file detection unit that detects the file that has been determined that the second data is hidden using the concealment suggestion information, and the corresponding file detection unit. An information management system, comprising: a sender / receiver detection unit that detects a user who has transmitted or transmitted the file detected by the user. 17. The acquisition unit, as the concealment suggestion information, information indicating a data amount of the file, and data corresponding to a content including a character, an image, or a sound explicitly output by the file. By obtaining information indicating the amount, the corresponding file detection unit compares the information indicating the data amount with the data amount corresponding to the content to determine whether the second data is hidden. The information management system according to claim 16, wherein the determination is made. 18. The information management system according to claim 17, further comprising a corresponding file storage unit for storing information for specifying only a file detected by the corresponding file detection unit. 19. An information management system for managing transmission / reception of a file, comprising: an acquisition unit configured to acquire communication information relating to transmission or transmission / reception of the file; An information management system comprising: a file identification unit that identifies a type; and a sender / receiver detection unit that detects the user who has transmitted or transmitted the file whose type cannot be identified by the file identification unit. 20. An information management system for managing transmission / reception of a file, comprising: an acquisition unit for acquiring communication information on transmission or transmission / reception of the file; and an acquisition unit for acquiring the communication information on the file based on the communication information acquired by the acquisition unit. A file identification unit that identifies a type, an analysis unit that analyzes the contents of the file by using a process according to the type of the file identified by the file identification unit, and a file that the analysis unit determines not to be analyzed. An information management system, comprising: a corresponding file detection unit for detecting. 21. The analysis unit stores information indicating a type of a character code of text data for displaying the language, information on a grammar of the language, and a predetermined word of the language corresponding to the predetermined language. A language storage unit to perform, a character code detection unit that detects a type of a character code of text data included in the file based on the communication information acquired by the acquisition unit; A language indicated by the text data of the file is identified by using information indicating a type, information on a grammar of the language, and the predetermined word and the type of the character code detected by the character code detection unit. A language identification unit, wherein the analysis unit, if the language identified by the language identification unit is not a language specified in advance, the file Information management system according to claim 20, characterized in that determines that it is unable to analyze. 22. The analysis unit, further comprising: a compression method detection unit that detects a compression method of the file based on the transmission information acquired by the acquisition unit. 21. The information management system according to claim 20, wherein it is determined that the file cannot be analyzed if the compression method is not specified in advance. 23. The analysis unit, further comprising: an encryption system detection unit that detects an encryption system of the file using the transmission information acquired by the acquisition unit, wherein the analysis unit encrypts the file. 21. The information management system according to claim 20, wherein it is determined that the file cannot be analyzed if the encryption scheme is not an encryption scheme specified in advance. 24. An information management method for managing an e-mail transmission / reception process, wherein a computer acquires communication information relating to the transmission or transmission / reception of the e-mail; Information that includes a step of storing in correspondence with a user who has transmitted or transmitted mail, and a step of detecting the user corresponding to the communication information when the communication information satisfies a predetermined condition. Management method. 25. A program for managing e-mail transmission / reception processing, comprising: an acquisition module for acquiring communication information on transmission or transmission / reception of the e-mail; A transmission / reception information storage module that stores the transmission / reception information in association with the user who transmitted / received the transmission / reception information; Features program.