JP2007213521A - Monitoring result recording system, common log generation device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technique for easily integrating monitoring results on a plurality of kinds of monitoring logs into one log. <P>SOLUTION: A CPU of a log agent server 7 acquires monitoring logs from respective monitoring devices on the basis of log identification information acquired from an HDD of the log agent server 7 and reads out a mapping table corresponding to log identification information of acquired monitoring logs, from the HDD of the log agent server 7 and then records monitoring results on respective monitoring logs, into arrangement destinations on a common log to generate the common log (S100 to S125). <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a technique for recording a monitoring result for a specific area as a monitoring area.

  Conventionally, it consists of multiple types of monitoring devices that individually monitor entry / exit to the section where the computer is installed and monitor the login status of the computer, and each of these monitoring devices records the monitoring results There is a monitoring system that individually generates logs (see, for example, Patent Document 1).

According to this monitoring system, the administrator of the monitoring system refers to each of a plurality of types of monitoring logs generated by each monitoring device, and there is inconsistency between the monitoring results on each monitoring log. By analyzing whether or not there is, it is possible to find a trace of unauthorized access to a computer that could not be found by each monitoring device alone.
JP 2005-328478 A

  However, in the conventional monitoring system, as described above, in order to find the evidence of unauthorized access to the computer, the administrator has to refer to a plurality of types of monitoring logs individually. It was complicated.

  Therefore, if the monitoring results on a plurality of types of monitoring logs are integrated into one log, the administrator can refer to the plurality of types of monitoring results at a time, thereby simplifying the task of finding a trace of unauthorized access.

However, in the conventional monitoring system, since the recording format of the monitoring result on the monitoring log is different for each monitoring device, it is difficult to integrate the monitoring result into one log.
Therefore, an object of the present invention is to provide a technique capable of easily integrating monitoring results on a plurality of types of monitoring logs onto one log.

  In order to achieve the above object, the invention according to claim 1 is a monitoring result recording system that records a monitoring result for a specific area as a monitoring area, and monitors different monitoring targets in the monitoring area. To identify a plurality of types of monitoring devices that respectively monitor and generate a monitoring log that records the monitoring result of the monitoring target, a monitoring log acquisition unit that acquires a monitoring log from each of the monitoring devices, and a type of the monitoring log Monitoring information acquired by the monitoring log acquisition means based on a mapping table that associates log identification information of the monitoring information with the array destination on the common log that records and integrates the monitoring results on the monitoring log generated by each monitoring device And a common log generation unit configured to record a monitoring result on the log in an array destination on the common log and generate a common log.

  In this monitoring result recording system, a plurality of types of monitoring devices monitor different monitoring targets in the monitoring area and generate a monitoring log in which the monitoring results of the monitoring targets are recorded. The monitoring log is acquired from each of them, and the common log generation unit records the monitoring result on the monitoring log acquired by the monitoring log acquisition unit in the array destination on the common log based on the mapping table to generate the common log .

  In other words, according to this monitoring result recording system, as long as the arrangement destination of the monitoring results on each monitoring log is associated with the log identification information of each monitoring log and set in advance on the mapping table, Based on this, the monitoring result on each monitoring log can be easily integrated on the common log.

That is, according to the present invention, the monitoring results on a plurality of types of monitoring logs can be easily integrated on one log.
The above-mentioned “monitoring area” corresponds to a physical area such as a building or facility, an area on a computer or a network (for example, a data area or a service area), or a combination thereof ( The same applies hereinafter).

  By the way, in the monitoring result recording system according to claim 1, if the arrangement destination is preset on the mapping table, the monitoring result on the monitoring log can be easily integrated on the common log. Like the monitoring log generated by the added monitoring device, the monitoring result on the monitoring log whose arrangement destination is not set in advance on the mapping table cannot be integrated on the common log.

  Therefore, as described in claim 2, the monitoring result recording system according to claim 1 is arranged such that the array destination on the common log associated with the log identification information of the monitoring log acquired by the monitoring log acquisition means is on the mapping table. Array destination existence determining means for determining whether or not an array destination exists, and when the array destination existence determining means determines that the array destination on the common log does not exist on the mapping table, a preset array destination setting When there is provided, based on the pattern, array identification setting means for setting log identification information of a monitoring log whose arrangement destination on the common log does not exist on the mapping table and arrangement destination on the common log in association with each other on the mapping table Good.

  In the monitoring result recording system configured as described above, the array destination existence determining unit has an array destination on the common log associated with the log identification information of the monitoring log acquired by the monitoring log acquiring unit on the mapping table. If it is determined by the array destination existence determining means that the array destination on the common log does not exist on the mapping table, the array destination setting means, based on the preset array destination setting pattern, The log identification information of the monitoring log whose arrangement destination on the common log does not exist on the mapping table and the arrangement destination on the common log are set in association with each other on the mapping table.

  In other words, according to this monitoring result recording system, as long as the arrangement destination setting pattern is appropriately set, even if the arrangement destination is not set in advance on the mapping table, the monitoring log in which the arrangement destination does not exist on the mapping table. Can be properly integrated on the common log.

  The array destination setting means may set the array destination on the mapping table in any array destination setting pattern. For example, as the array destination setting pattern, the array destination setting pattern may be set by the monitoring log acquisition means. Compare the acquired characteristics of the monitoring results on the monitoring log whose arrangement destination on the common log does not exist on the mapping table with the characteristics of the monitoring results on the past monitoring log acquired by the monitoring log acquisition means Then, the arrangement destination on the common log associated with the comparison result and the log identification information of the monitoring log whose arrangement destination on the common log does not exist on the mapping table may be set in association with each other on the mapping table. .

  If the array destination setting means is set in this way, even if the array destination is not set in advance on the mapping table, the more monitoring logs acquired in the past, the higher the accuracy of appropriately setting the array destination. As a result, even if the arrangement destination is not set in advance on the mapping table, the monitoring results on a plurality of types of monitoring logs can be easily and appropriately integrated on the common log.

  The “characteristics of the monitoring result” include, for example, an array pattern of the monitoring result, a character string included in the monitoring result, the number of monitoring results recorded per unit time, and the like (hereinafter the same).

  Further, in the monitoring result recording system according to claim 1, when the mapping table is associated with the log identification information and exists individually for each type of monitoring log, for example, a monitoring newly generated by the monitoring device is generated. Like logs, monitoring results on monitoring logs that do not have a mapping table cannot be integrated on a common log.

  Therefore, in this case, the monitoring result recording system according to claim 1 is, as described in claim 4, whether or not there is a mapping table associated with the log identification information of the monitoring log acquired by the monitoring log acquisition means. Corresponding to log identification information of a monitoring log in which no mapping table exists based on a preset generation pattern when the table existence determining unit determines that the mapping table does not exist. It is preferable to include mapping table generation means for generating the mapping table.

  In the monitoring result recording system configured as described above, the table presence determination unit determines whether there is a mapping table associated with the log identification information of the monitoring log acquired by the monitoring log acquisition unit, and the table exists When the determination unit determines that the mapping table does not exist, the mapping table generation unit generates a mapping table corresponding to the log identification information of the monitoring log for which no mapping table exists based on a preset generation pattern.

  In other words, according to this monitoring result recording system, as long as the generation pattern is set appropriately, an appropriate mapping table can be generated in a monitoring log that does not have a mapping table even if the mapping table does not exist. The monitoring results on the monitoring log without the table can be appropriately integrated on the common log.

  Note that the mapping table generation unit may generate the mapping table in any generation pattern. For example, as described in claim 5, there is a mapping table acquired by the monitoring log acquisition unit as the generation pattern. Compare the characteristics of the monitoring result on the monitoring log not to be compared with the characteristics of the monitoring result on the past monitoring log acquired by the monitoring log acquisition means, and the array destination on the common log associated with the comparison result And the mapping table that associates the log identification information of the monitoring log with no mapping table.

  If the mapping table generation means is set in this way, even if there is no mapping table, the more monitoring logs acquired in the past, the higher the accuracy of generating an appropriate mapping table. Even if a table does not exist, the monitoring results on a plurality of types of monitoring logs can be easily and appropriately integrated on a common log.

By the way, when the user identification information for identifying the user who has accessed the monitoring target is included in at least a part of the plurality of types of monitoring logs, the monitoring result recording system according to any one of claims 1 to 5 is provided. According to the sixth aspect of the present invention, personal information corresponding to user identification information included in the monitoring log acquired by the monitoring log acquisition unit is obtained based on a user database in which user personal information is associated with user identification information. Personal information setting means for setting on the common log may be provided.

  If the monitoring result recording system is configured in this way, each user's personal information and the corresponding monitoring result on the common log can be referred to at one time. By analyzing whether or not, it is possible to find evidence of fraudulent activity in the monitoring area.

  Furthermore, since personal information can be set on the common log without including personal information of the user in the monitoring log itself, even if the monitoring log leaks to the outside, even personal information is prevented from leaking to the outside. it can.

The “personal information” corresponds to, for example, the name of the user, the department to which the user belongs (hereinafter the same).
Here, when the user identification information for the same user is different for each type of monitoring log, the user database is different for each type of monitoring log for the same personal information as described in claim 7. The user identification information may be associated.

  If the user database is set in this way, the personal information of the same user can be set on the common log even if the user identification information for the same user is different for each type of monitoring log.

  The monitoring result recording system according to claim 6 and claim 7 determines whether or not the user identification information included in the monitoring log is registered in advance in the user database as described in claim 8. And a personal information setting unit that, when the user registration determination unit determines that the user identification information is not registered in the user database, indicates that the user is a new user. Set it above.

  In this case, even if the user is not registered in the user database, as a new user, by analyzing whether the user's behavior is inconsistent as a normal new user, Can find evidence of fraudulent activity.

  Next, according to the ninth aspect of the present invention, a plurality of types of monitoring are performed in which a specific area is set as a monitoring area, different monitoring targets in the monitoring area are monitored, and a monitoring log in which the monitoring result of the monitoring target is recorded is generated. Monitoring log acquisition means for acquiring a monitoring log from each device, log identification information for identifying the type of monitoring log, and a common log that records the monitoring results on the monitoring log generated by each monitoring device in an integrated manner Based on a mapping table that associates the above array destinations with each other, a common log generation unit that generates a common log by recording a monitoring result on the monitoring log acquired by the monitoring log acquisition unit in an array destination on the common log It is a common log generation device characterized by comprising.

  That is, this common log generation device constitutes a part of the monitoring result recording system according to claim 1, and constitutes the monitoring result recording system according to claim 1 by combining with a plurality of types of monitoring devices. Can do.

  The invention described in claim 10 is the common log generation device according to claim 9, wherein the arrangement destination on the common log associated with the log identification information of the monitoring log acquired by the monitoring log acquisition means is on the mapping table. Array destination existence determining means for determining whether or not an array destination exists, and when the array destination existence determining means determines that the array destination on the common log does not exist on the mapping table, a preset array destination setting Based on the pattern, it is provided with log identification information of a monitoring log whose arrangement destination on the common log does not exist on the mapping table, and arrangement destination setting means for setting the arrangement destination on the common log in association with each other on the mapping table It is characterized by.

  That is, the common log generation device constitutes a part of the monitoring result recording system according to claim 2, and constitutes the monitoring result recording system according to claim 2 by combining with a plurality of types of monitoring devices. Can do.

  The invention according to claim 11 is the common log generation device according to claim 10, wherein the array destination setting means maps the array destination on the common log acquired by the monitoring log acquisition means as the array destination setting pattern. Compare the characteristics of the monitoring result on the monitoring log that does not exist on the table with the characteristics of the monitoring result on the past monitoring log acquired by the monitoring log acquisition means, and associate the comparison log with the common log The above arrangement destination and log identification information of a monitoring log in which the arrangement destination on the common log does not exist on the mapping table are set in association with each other on the mapping table.

  That is, this common log generation device constitutes a part of the monitoring result recording system according to claim 3, and constitutes the monitoring result recording system according to claim 3 by combining with a plurality of types of monitoring devices. Can do.

  The invention according to claim 12 is the common log generation device according to claim 9, wherein the mapping table is associated with the log identification information and exists individually for each type of the monitoring log. A table presence determination unit that determines whether or not a mapping table associated with the log identification information of the acquired monitoring log exists; and when the table presence determination unit determines that the mapping table does not exist, And mapping table generation means for generating a mapping table corresponding to the log identification information of the monitoring log for which no mapping table exists based on the set generation pattern.

  In other words, the common log generation device constitutes a part of the monitoring result recording system according to claim 4, and the monitoring result recording system according to claim 4 is configured by combining with a plurality of types of monitoring devices. Can do.

  The invention according to claim 13 is the common log generation device according to claim 12, wherein the mapping table generation means monitors the monitoring log acquired by the monitoring log acquisition means as a generation pattern, on which there is no mapping table. Compare the characteristics of the results with the characteristics of the monitoring results on the past monitoring log acquired by the monitoring log acquisition means, and there is an array destination and mapping table on the common log associated with the comparison result The mapping table is generated by associating the log identification information of the monitoring log not to be generated.

  That is, this common log generation device constitutes a part of the monitoring result recording system according to claim 5, and constitutes the monitoring result recording system according to claim 5 by combining with a plurality of types of monitoring devices. Can do.

  The invention described in claim 14 is the common log generation device according to any one of claims 9 to 13, wherein at least a part of the plurality of types of monitoring logs includes user identification for identifying a user who has accessed the monitoring target. The personal information corresponding to the user identification information included in the monitoring log acquired by the monitoring log acquisition unit is stored on the common log based on the user database in which the information is included and the user personal information is associated with the user identification information. Personal information setting means for setting is provided.

  That is, this common log generation device constitutes a part of the monitoring result recording system according to claim 6, and constitutes the monitoring result recording system according to claim 6 by combining with a plurality of types of monitoring devices. Can do.

  According to a fifteenth aspect of the present invention, in the common log generation device according to the fourteenth aspect, the user identification information for the same user differs for each type of monitoring log, and the user database contains the same personal information. Different user identification information is associated with each type of monitoring log.

  That is, this common log generation device constitutes a part of the monitoring result recording system according to claim 7, and constitutes the monitoring result recording system according to claim 7 by combining with a plurality of types of monitoring devices. Can do.

  The invention described in claim 16 determines whether or not the user identification information included in the monitoring log is registered in advance in the user database in the common log generation device according to claims 14 and 15. And a personal information setting unit that, when the user registration determination unit determines that the user identification information is not registered in the user database, indicates that the user is a new user. It is characterized by being set above.

  That is, this common log generation device constitutes a part of the monitoring result recording system according to claim 8, and constitutes the monitoring result recording system according to claim 8 by combining with a plurality of types of monitoring devices. Can do.

The invention according to claim 17 is a program for causing a computer to function as each means in the common log generation device according to any one of claims 9 to 16.
That is, according to this program, it is possible to cause the computer to function as each unit of the common log generation device according to claims 9 to 16 and, as a result, to each unit of the monitoring result recording system according to claims 1 to 8. it can.

  Note that this program may be recorded in a ROM or backup RAM, and loaded into the computer from the ROM or backup RAM, or loaded into the computer via a network and used. Further, the present invention may be used by being recorded on a computer-readable recording medium such as a flexible disk (FD), an optical disk (MO), a DVD, a CD-ROM, a Blu-Ray disk, an HD-DVD, a hard disk, or a memory card. Good.

Embodiments of the present invention will be described below with reference to the drawings.
First, FIG. 1 is a configuration block diagram of a monitoring system 1 to which the present invention is applied.
As shown in FIG. 1, the monitoring system 1 includes a computer operation management system 2, an entrance / exit management system 3, a location information management system 4, a CCTV (Closed Circuit Television) camera monitoring system 5, and an external sensor system 6. A plurality of types of monitoring devices consisting of the above and a client terminal 8 are connected to the log agent server 7, and the inside of the office 10 in which these devices are installed is used as a monitoring area.

  Here, the computer operation management system 2 records computers (not shown) in the office 10 as monitoring targets and records monitoring results including login information to the computers, usage history, operation history, user authentication, and file usage history. Configured to generate monitored logs.

  The entrance / exit management system 3 monitors entry / exit to / from the compartment where the computer is installed, and enters / exits the compartment where the computer is installed by IC card, biometric authentication, multi-factor authentication based on a combination of these. And a monitoring log in which the monitoring result is recorded is generated.

  The location information management system 4 monitors the location (position) of each user who has the authority to access the computer, and uses wireless communication technology such as an IC tag, GPS (Global Positioning System), and PHS (Personal Handyphone System). The location of the user in the office 10 is monitored, and a monitoring log in which the monitoring result is recorded is generated.

  The CCTV camera monitoring system 5 targets a person in a specific section in the office 10 as a monitoring target, and the appearance and movement of the person in the specific section by an image monitoring system, a monitoring camera recording system, a face authentication / appearance authentication system, or the like. And a monitoring log in which the monitoring result is recorded is generated.

  The external sensor system 6 monitors the entire office 10 and monitors the presence of intruders in the office 10 using vibration sensors, infrared sensors, voice sensors, etc., and generates a monitoring log recording the monitoring results. Is configured to do.

  Of the monitoring logs generated by these monitoring devices, the monitoring logs generated by the monitoring devices other than the external sensor system 6 include user identification information (hereinafter referred to as “user ID”) for identifying the user. It is. However, in this embodiment, the user ID is different for each monitoring log (that is, for each monitoring device).

The client terminal 8 is a well-known personal computer, and notifies a manager in the office 10 of a notification transmitted from the log agent server 7.
In addition, the log agent server 7 acquires the monitoring log generated by each of the monitoring devices described above, and generates a common log that integrates the monitoring results on the acquired monitoring log. However, an Internet VPN (Virtual Private Network) using the Internet 9 is constructed between the log agent server 7 and the center system 20 outside the office 10, and the log agent server 7 is connected to the center system 20. It is set to send the common log.

The center system 20 is provided with a user database (DB) 21 in which a user ID is associated with a user's personal information (here, the user's name and company name to which the user belongs). However, in the user DB 21 of the present embodiment, different user IDs are associated with the same personal information for each type of monitoring log. More specifically, the log agent server 7 is shown in FIG. Such a function is provided. FIG. 2 is a functional block diagram of the log agent server 7.

  As shown in FIG. 2, the log agent server 7 includes a log converter module 71 that is a function for generating a common log from a monitoring log, a filter module 72 that is a function for deleting unnecessary information from the common log, and a common log. A detection module 73 that is a function of detecting an abnormality, a notification module 74 that is a function of transmitting a detection result by the detection module 73 to the client terminal 8, and a function of controlling an external device according to the detection result by the detection module 73 And a transmission module 76 which is a function for transmitting the common log to the center system 20.

  However, the log agent server 7 is configured as a known server device including a CPU, a ROM, a RAM, a hard disk drive (HDD), a network interface, and the like, and the various functions described above are realized by software. More specifically, the log converter module 71 corresponds to the processing of S100 to S125 in the common log generation processing described later, and the filter module 72 corresponds to the processing of S130 and S135 in the common log generation processing described later. The detection module 73 corresponds to the processing of S140 to S165 in the common log generation processing described later, the notification module 74 corresponds to the processing of S170 in the common log generation processing described later, and the device control module 75 is described later. This corresponds to the processes of S175 and S180 in the common log generation process, and the transmission module 76 corresponds to the process of S185 in the common log generation process described later.

Hereinafter, among the various processes executed by the CPU of the log agent server 7, the process according to the present invention will be described in detail.
First, FIG. 3 is a flowchart showing a flow of common log generation processing executed by the CPU of the log agent server 7. Note that the CPU of the log agent server 7 executes this process every time a predesignated time elapses or every time a predesignated time comes.

  As shown in FIG. 3, in this process, first, the log identification information for identifying the type of the monitoring log to be acquired, which is preset in the HDD of the log agent server 7, is referred to, and the monitoring log to be acquired Log identification information is acquired (S100). In this embodiment, a path to the monitoring log file and an identifier given to the monitoring log file are set as the log identification information.

  Subsequently, based on the acquired log identification information, after acquiring a monitoring log from each of the monitoring devices described above (S105), a mapping table corresponding to the log identification information of the acquired monitoring log is obtained from the HDD of the log agent server 7. Read (S110). However, the mapping table of this embodiment is associated with the log identification information of the monitoring log, and is set in the HDD individually for each type of monitoring log. Each mapping table is associated with log identification information and an array destination on a common log of monitoring results on the monitoring log.

  Then, it is determined whether or not a mapping table exists for all of the monitoring logs acquired in S105 (S115). If there is a monitoring log for which no mapping table exists (S115: No), it will be described later. After executing the mapping table generation process (S120), the process proceeds to S125 described later.

  On the other hand, if the mapping table exists for all the monitoring logs acquired in S105 (S115: Yes), the monitoring result on each monitoring log is displayed on the common log based on the read mapping table. A common log is generated by recording in the array destination (S125). Note that the common log of the present embodiment includes a fixed-length portion in which the array of monitoring results is fixed and a variable-length portion in which the array of monitoring results can be arbitrarily changed (see FIG. 7).

  When the generation of the common log is finished, the filter condition data indicating the unnecessary monitoring result condition (filter condition) to be deleted from the common log is read from the HDD of the log agent server 7 and matches the filter condition on the common log. It is determined whether a monitoring result exists (S130).

  If there is a monitoring result that matches the filter condition (S130: Yes), the monitoring result that matches the filter condition is deleted from the common log (S135), and the process proceeds to S140, which will be described later. If there is no monitoring result that matches the condition (S130: No), whether or not there is a monitoring result indicating that an illegal act has occurred in the office 10 with reference to each monitoring result on the common log. Is determined (S140).

  If there is a monitoring result indicating that an illegal act has occurred (S140: Yes), the process immediately proceeds to S165 described later, whereas if there is no monitoring result indicating that an illegal act has occurred (S140: No) After executing the personal information setting process described later (S145), it is confirmed whether or not the personal information corresponding to the user ID included in the acquired monitoring result is registered in the user DB 21. It is determined whether recognition is necessary (S150).

  Here, when it is determined that recognition of an unregistered user is necessary (S150: Yes), after executing an unregistered user recognition process described later (S155), the process proceeds to S160 described later, while an unregistered user Is determined to be unnecessary (S150: No), detection condition data indicating a pattern of monitoring results indicating a trace of fraud in the office 10 preset in the HDD of the log agent server 7 And whether or not the monitoring result pattern that matches the read detection condition data exists on the common log is determined (S160).

If there is no monitoring result pattern that matches the detection condition data (S160: No), the process immediately proceeds to S185 described later.
On the other hand, if there is a monitoring result pattern that matches the detection condition data (S160: Yes), the fact that a trace of fraud has been detected is recorded in a detection log preset in the HDD of the log agent server 7 ( S165) Notifying the client terminal 8 that a trace of fraud has been detected (S170), and operating an external device (for example, an electromagnetic lock) for preventing fraud based on the pattern of monitoring results It is determined whether or not it is necessary to do so (S175).

  If it is determined that the external device needs to be operated (S175: Yes), a control signal corresponding to the monitoring result pattern is transmitted to the corresponding external device (S180) to activate the external device. On the other hand, when it is determined that it is not necessary to operate the external device (S175: No), the common log is transmitted to the center system 20 (S185), and this process is terminated.

Next, FIG. 4 is a flowchart showing a flow of the above-described mapping table generation process (S120).
As shown in FIG. 4, in this process, first, the mapping analysis logic that extracts the characteristics of the monitoring result on the monitoring log acquired in the past, set in the HDD of the log agent server 7 is read (S200). Based on a preset generation pattern, a mapping table corresponding to a monitoring log for which no mapping table exists is generated (S205). In the present embodiment, as a generation pattern, a feature of a monitoring result on a monitoring log having no mapping table is compared with a feature of a monitoring result on a monitoring log acquired in the past, and the comparison result is supported. A mapping table is generated by associating the array destination on the attached common log with the log identification information of the monitoring log for which no mapping table exists. More specifically, it compares the array pattern of monitoring results, the character strings included in the monitoring results, the number of monitoring results recorded per unit time, etc., and identifies the log of the past monitoring log that has the closest characteristics. A new mapping table is generated by associating the array destination associated with the information with the log identification information of the monitoring log for which no mapping table exists.

  Then, the newly generated mapping table is set in the HDD of the log agent server 7 (S210), the feature of the monitoring result on the monitoring log newly generating the mapping table is extracted, and the extracted feature is subjected to the mapping analysis. Registration is made in the logic (S215), the registration content is transmitted to the center system 20 (S220), and this process is terminated.

Next, FIG. 5 is a flowchart showing the flow of the personal information setting process (S145).
As shown in FIG. 5, in this process, first, the user ID included in the acquired monitoring log is transmitted to the center system 20 (S300), and personal information associated with each user ID in the user DB 21 is transmitted to the center system. 20 (S305).

Then, the acquired personal information is set on the common log (S310), and this process ends.
Next, FIG. 6 is a flowchart showing the flow of the above-described unregistered user recognition process (S155).

  As shown in FIG. 6, in this process, first, new user information, which is personal information indicating a new user, is queried to the center system 20 (S400), and a new user associated with the new user in the user DB 21 is obtained. Information is acquired from the center system 20 (S405).

Then, the acquired new user information is set on the common log (S410), and this process is terminated.
As described above, in the monitoring system 1 of the present embodiment, based on the mapping table, the monitoring result on each monitoring log is recorded in the array destination on the common log to generate a common log. The monitoring results on the monitoring log can be easily integrated on one log.

  In the monitoring system 1 of the present embodiment, a mapping table corresponding to the monitoring log is newly generated even if there is no mapping table corresponding to the acquired monitoring log. Monitoring results can be integrated on a common log.

  Moreover, in the monitoring system 1 of this embodiment, the mapping table according to the comparison result of the characteristic which the monitoring result on the monitoring log which does not have a mapping table has with the characteristic which the monitoring result on the monitoring log acquired in the past has. The more monitoring logs acquired in the past, the higher the accuracy of generating an appropriate mapping table. As a result, even if there is no mapping table, the monitoring results on multiple types of monitoring logs Can be easily and appropriately integrated on a common log.

  Moreover, in the monitoring system 1 of this embodiment, since the personal information of the user is set on the common log, the personal information of each user and the monitoring result on the common log can be referred to at one time. By analyzing whether or not there is an inconsistent action, it is possible to find a trace of fraudulent activity in the office 10.

  Further, in the monitoring system 1 of the present embodiment, personal information can be set on the common log without including the user's personal information in the monitoring log itself. It is possible to prevent leakage to the outside.

  Moreover, in the monitoring system 1 of this embodiment, even if the user identification information is not registered on the user DB 21, the new user information is set on the common log. By analyzing whether or not there is a consistent action, it is possible to find a trace of fraudulent activity in the office 10.

  In this embodiment, the computer operation management system 2, the entrance / exit management system 3, the location information management system 4, the CCTV camera monitoring system 5, and the external sensor system 6 correspond to the monitoring apparatus of the present invention, and the common log generation processing is performed. S105 corresponds to the monitoring log acquisition means in the present invention, and S110 and S125 of the common log generation processing correspond to the common log generation means in the present invention.

  In this embodiment, S115 of the common log generation process corresponds to the table presence determination unit in the present invention, and S200 and S205 of the mapping table generation process correspond to the mapping table generation unit in the present invention.

  In this embodiment, S300 to S310 of personal information setting processing and S400 to S410 of unregistered user recognition processing correspond to personal information setting means in the present invention, and S150 of common log generation processing is user in the present invention. This corresponds to registration determination means.

  Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and it goes without saying that various forms can be taken as long as they belong to the technical scope of the present invention. .

  For example, in the above embodiment, the mapping table is associated with the log identification information and exists individually for each type of monitoring log. However, the mapping table is commonly associated with the monitoring log identification information on the same mapping table. An array destination on the log may be set.

  In this case, in S115 of the common log generation process, it is determined whether or not the array destination on the common log is set on the mapping table for all the log identification information of the acquired monitoring log (array in the present invention). If there is a monitoring log in which the array destination on the common log is not set, the array destination on the common log does not exist on the mapping table in S120 of the common log generation process. The log identification information of the monitoring log and the array destination on the common log may be newly set on the mapping table (corresponding to the array destination setting means in the present invention).

  More specifically, the feature of the monitoring result on the monitoring log for which the array destination does not exist on the mapping table is compared with the feature of the acquired monitoring result on the past monitoring log, and is associated with the comparison result. The arrangement destination on the common log and the log identification information of the monitoring log whose arrangement destination on the common log does not exist on the mapping table may be newly set in association on the mapping table.

  By using such a method, the more monitoring logs acquired in the past, the higher the accuracy of appropriately setting the array destination, and as a result, the array destination is not set in advance on the mapping table. However, monitoring results on a plurality of types of monitoring logs can be easily and appropriately integrated on a common log.

1 is a configuration block diagram of a monitoring system 1 to which the present invention is applied. 3 is a functional block diagram of a log agent server 7. FIG. 7 is a flowchart showing a flow of common log generation processing executed by the CPU of the log agent server 7. It is a flowchart which shows the flow of the mapping table production | generation process which CPU of the log agent server 7 performs. It is a flowchart which shows the flow of the personal information setting process (S145) which CPU of the log agent server 7 performs. It is a flowchart which shows the flow of the unregistered user recognition process which CPU of the log agent server 7 performs. It is explanatory drawing which shows the outline | summary of a common log.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Monitoring system, 2 ... Computer operation management system, 3 ... Entrance / exit management system, 4 ... Location information management system, 5 ... CCTV camera monitoring system, 6 ... External sensor system, 7 ... Log agent server, 8 ... Client terminal , 9 ... Internet, 10 ... Office, 20 ... Center system, 21 ... User DB, 71 ... Log converter module, 72 ... Filter module, 73 ... Detection module, 74 ... Notification module, 75 ... Device control module, 76 ... Transmission module .

Claims (17)

A monitoring result recording system that records a monitoring result for a specific area as a monitoring area,
A plurality of types of monitoring devices that monitor different monitoring targets in the monitoring area, and generate monitoring logs each recording a monitoring result of the monitoring target;
Monitoring log acquisition means for acquiring the monitoring log from each of the monitoring devices;
A mapping table that associates log identification information for identifying the type of the monitoring log with an array destination on the common log that records the monitoring results on the monitoring log generated by each of the monitoring devices in an integrated manner. Based on the monitoring log obtained by the monitoring log obtaining means, and records the monitoring result on the array destination on the common log to generate the common log. Recording system. Array destination existence determining means for determining whether an array destination on the common log associated with the log identification information of the monitoring log acquired by the monitoring log acquisition means exists on the mapping table;
When the arrangement destination on the common log is determined not to exist on the mapping table by the arrangement destination existence determination means, the arrangement destination on the common log is changed to the mapping based on a preset arrangement destination setting pattern. The arrangement destination setting means for setting the log identification information of the monitoring log that does not exist on the table and the arrangement destination on the common log in association with each other on the mapping table. Monitoring result recording system. The array destination setting means includes:
As the arrangement destination setting pattern, the monitoring destination on the common log acquired by the monitoring log acquisition unit has a monitoring result on the monitoring log that does not exist on the mapping table, and the monitoring log acquisition unit The characteristics of the monitoring results on the acquired past monitoring log are compared, and the arrangement destination on the common log and the arrangement destination on the common log associated with the comparison result are displayed on the mapping table. The monitoring result recording system according to claim 2, wherein the log identification information of the monitoring log that does not exist is set in association with the mapping table. The mapping table is
Corresponding to the log identification information, exists individually for each type of the monitoring log,
The monitoring result recording system
Table presence determination means for determining whether or not the mapping table associated with the log identification information of the monitoring log acquired by the monitoring log acquisition means exists;
Generates the mapping table corresponding to the log identification information of the monitoring log in which the mapping table does not exist based on a preset generation pattern when the table existence determining unit determines that the mapping table does not exist The monitoring result recording system according to claim 1, further comprising: a mapping table generating unit that performs the following. The mapping table generation means includes
As the generation pattern, the characteristics of the monitoring result on the monitoring log acquired by the monitoring log acquisition unit that does not have the mapping table, and the monitoring on the past monitoring log acquired by the monitoring log acquisition unit Compare the characteristics of the result, and generate the mapping table associating the array destination on the common log associated with the comparison result with the log identification information of the monitoring log for which the mapping table does not exist The monitoring result recording system according to claim 4, wherein: At least some of the plurality of types of monitoring logs include
User identification information for identifying a user who has accessed the monitoring target is included,
The monitoring result recording system
Based on a user database in which the personal information of the user is associated with the user identification information, the personal information corresponding to the user identification information included in the monitoring log acquired by the monitoring log acquisition unit is stored in the common log. The monitoring result recording system according to claim 1, further comprising: a personal information setting unit that is set on the monitoring information. The user identification information for the same user is different for each type of the monitoring log,
In the user database,
The monitoring result recording system according to claim 6, wherein different user identification information is associated with the same personal information for each type of the monitoring log. User registration determination means for determining whether or not the user identification information included in the monitoring log is registered in advance on the user database;
The personal information setting means includes:
When the user registration determination unit determines that the user identification information is unregistered on the user database, the fact that the user is a new user is set as the personal information on the common log. The monitoring result recording system according to claim 6 or 7. Monitoring that obtains the monitoring log from each of a plurality of types of monitoring devices that use a specific area as a monitoring area, monitor different monitoring targets in the monitoring area, and generate a monitoring log that records the monitoring results of the monitoring target, respectively. Log acquisition means;
A mapping table that associates log identification information for identifying the type of the monitoring log with an array destination on the common log that records the monitoring results on the monitoring log generated by each of the monitoring devices in an integrated manner. And a common log generation unit that records the monitoring result on the monitoring log acquired by the monitoring log acquisition unit in an array destination on the common log and generates the common log. Generator. Array destination existence determining means for determining whether an array destination on the common log associated with the log identification information of the monitoring log acquired by the monitoring log acquisition means exists on the mapping table;
When the arrangement destination on the common log is determined not to exist on the mapping table by the arrangement destination existence determination means, the arrangement destination on the common log is changed to the mapping based on a preset arrangement destination setting pattern. The array destination setting unit that sets the log identification information of the monitoring log that does not exist on the table and the array destination on the common log in association with each other on the mapping table. Common log generator. The array destination setting means includes:
As the arrangement destination setting pattern, the monitoring destination on the common log acquired by the monitoring log acquisition unit has a monitoring result on the monitoring log that does not exist on the mapping table, and the monitoring log acquisition unit The characteristics of the monitoring results on the acquired past monitoring log are compared, and the arrangement destination on the common log and the arrangement destination on the common log associated with the comparison result are displayed on the mapping table. The common log generation device according to claim 10, wherein the log identification information of the monitoring log that does not exist is set in association with the mapping table. The mapping table is
Corresponding to the log identification information, exists individually for each type of the monitoring log,
The common log generation device
Table presence determination means for determining whether or not the mapping table associated with the log identification information of the monitoring log acquired by the monitoring log acquisition means exists;
Generates the mapping table corresponding to the log identification information of the monitoring log in which the mapping table does not exist based on a preset generation pattern when the table existence determining unit determines that the mapping table does not exist The common log generation device according to claim 9, further comprising: a mapping table generation unit that performs mapping. The mapping table generation means includes
As the generation pattern, the characteristics of the monitoring result on the monitoring log acquired by the monitoring log acquisition unit that does not have the mapping table, and the monitoring on the past monitoring log acquired by the monitoring log acquisition unit Compare the characteristics of the result, and generate the mapping table associating the array destination on the common log associated with the comparison result with the log identification information of the monitoring log for which the mapping table does not exist The common log generation device according to claim 12, wherein: At least some of the plurality of types of monitoring logs include
User identification information for identifying a user who has accessed the monitoring target is included,
The common log generation device
Based on a user database in which the personal information of the user is associated with the user identification information, the personal information corresponding to the user identification information included in the monitoring log acquired by the monitoring log acquisition unit is stored in the common log. The common log generation device according to claim 9, further comprising: a personal information setting unit that is set above. The user identification information for the same user is different for each type of the monitoring log,
In the user database,
15. The common log generation device according to claim 14, wherein different user identification information is associated with the same personal information for each type of the monitoring log. User registration determination means for determining whether or not the user identification information included in the monitoring log is registered in advance on the user database;
The personal information setting means includes:
When the user registration determination unit determines that the user identification information is unregistered on the user database, the fact that the user is a new user is set as the personal information on the common log. The common log generation device according to claim 14 or 15.   A program for causing a computer to function as each unit in the common log generation device according to any one of claims 9 to 16.

Images