JP2007304943A - Effective display method and system for detecting information file leak - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an effective display method and system for detecting information file leak, which is useful for preventive measures of information leak by acquiring a user's action in an information network. <P>SOLUTION: The file leak detection system comprises a user terminal device and a file leak analysis device which are connected through a network. The user terminal device forms use history data containing network address information, user identification information, computer resource information and use date information for the user terminal from the user identification information recorded in a portable storage medium and a history result of computer processing executing using computer resources and transmitting it to a file leak analysis device. The file leak analysis device extracts use history data of a predetermined condition from the received use history data, forms display data containing the user identification information, the computer resource information and the use data information, and displays a leak analysis screen including a computer resource display line and a date display line. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

The present invention relates to an effective display method and system for detecting information leakage by a user from an information file usage history.

  2. Description of the Related Art Conventionally, efforts have been made to prevent information leakage by analyzing usage history for computer network information management.

For example, in Patent Document 1, from a network user's usage history, the normal behavior form of the network user is analyzed, and if the behavior form is different from the normal behavior form, the change is captured, A technology for notifying an information manager of abnormal behavior of a user and calling attention is disclosed. (Prior art 1)
JP-A-2005-332345 (pages 19 to 20, FIGS. 7 and 8)

However, the prior art 1 has a drawback that it is difficult to investigate whether there is an illegal file operation because the usage history of the network user does not include information for tracking the file operation. . In addition, since the software that has operated the file cannot be specified, it is impossible to estimate what operation has been performed.

The present invention has been made in consideration of such a conventional technique, and an object of the present invention is to detect information file leakage useful for information leakage prevention measures by grasping information network user behavior. It is to provide an effective display method and system.

The present invention solves the above problems by the following means. That is, according to the first aspect of the present invention, a file leakage analysis apparatus that displays a leakage analysis screen in which screen cells are two-dimensionally arranged in a computer resource display row and a date / time display column, and a user terminal device are connected via a network. A file leakage detection system configured, wherein the user terminal device stores usage history data including network address information, user identification information, computer resource information, and usage date / time information of the user terminal device And using the portable storage medium reading means for reading the user identification information recorded in the portable storage medium and the history result of the computer processing execution using the computer resources, and creating the use history data and recording it in the storage means Usage history recording means, and usage history transmission means for transmitting usage history data to the file leakage analysis device. The file leakage analysis device is a usage history receiving means for receiving usage history data from the user terminal device, and a usage history for extracting usage history data of a predetermined condition from the received usage history data Extraction means, display data creation means for creating display data including user identification information, computer resource information, and use date and time information from the extracted use history data, and a computer resource display line using the display data Screen cell data creation means for creating screen cell data including information and date / time display column information, computer resource display row information and date / time display column information of the screen cell data are read, and computer resource display of a leak analysis screen Create and display a file leak analysis screen by arranging the screen cell data in association with the row and the date / time display column. And 析画 surface display unit, an analysis apparatus provided with a file leakage detection system characterized in that.

Here, the user identification information is information for identifying a user. The computer resource information is file name information and software name information used by the user.

That is, the file leak detection manager can detect the file leak by the user by analyzing the analysis screen created from the usage history data of the user terminal device.

In the invention of claim 2, the file leakage analysis apparatus is configured such that computer resource information and processing date / time information associated with computer resource display row information and date / time display column information of screen cell data from the extracted usage history data. Cell processing data creating means for creating cell processing data including, reading computer resource information and processing date and time information of the cell processing data, referring to the computer resource display row and date display column of the leakage analysis screen, The file leakage according to claim 1, further comprising: an analysis screen processing unit that selects a corresponding screen cell and processes the screen cell in accordance with an instruction of the cell processing data. It is a detection system.

In this way, display processing is performed using the cell processing data so that the file leakage analysis screen 100a is easy to see.

According to a third aspect of the present invention, in the file leakage analysis apparatus, the cell processing data is data including computer resource information, processing date information, cell symbol notation information, and cell coloring information, and the analysis screen processing means Read the computer resource information, the processing date / time information and the cell coloring information of the cell processing data, refer to the computer resource display row and date / time display column of the leakage analysis screen, select the corresponding screen cell, and color the cell According to the instruction of the information, the analysis screen coloring processing means for coloring the screen cell, the computer resource information of the cell processing data, the processing date and time information, and the cell symbol notation information are read, and the computer resource display line of the leakage analysis screen is read. And the date and time display column, select the corresponding screen cell, and follow the instructions in the cell symbol notation information to display the symbol notation in this screen cell. And analysis screen symbology processing means for an analysis apparatus having a, a file leakage detection system according to claim 2, characterized in that.

According to a fourth aspect of the present invention, there is provided usage history data including network address information, user identification information, computer resource information, and usage date information of a user terminal device, user identification information, computer resource information, and usage date information. A file leakage detection method using display data including, and screen cell data including computer resource display row information and date / time display column information, wherein the portable storage medium read reads user identification information recorded in the portable storage medium A usage history recording step that creates and records usage history data from the step and a history of execution of computer processing using computer resources, and a usage history extraction that extracts usage history data of a predetermined condition from the usage history data A display data creation step for creating display data from the extracted usage history data The screen cell data creation step for creating screen cell data using the display data, the computer resource information display row and the date / time information display column of the screen cell data are read, and the computer resource display row and date / time display of the leakage analysis screen are read. The file leakage detection method includes an analysis screen display step of arranging a screen cell data in association with a column to create and display a file leakage analysis screen and displaying the file leakage analysis screen.

The invention of claim 5 is a file leakage detection method using cell processing data including computer resource information and processing date information corresponding to computer resource display row information and date display column information of screen cell data, Cell processing data creation step for creating cell processing data from the extracted usage history data, computer resource information and processing date / time information of the cell processing data are read, computer resource display row and date / time display column of the leakage analysis screen, The analysis screen processing instruction step of selecting the corresponding screen cell and processing the screen cell in accordance with the instruction of the cell processing data is performed according to the procedure described above. The file leakage detection method described.

The invention of claim 6 uses cell processing data including computer resource information, processing date / time information, cell symbol notation information, and cell coloring information, and includes computer processing information of cell processing data, processing date / time information, and cell coloring information. An analysis screen coloring processing step for reading and referring to the computer resource display row and date / time display column of the leakage analysis screen, selecting the corresponding screen cell, and coloring the screen cell according to the instruction of the cell coloring information And reading the computer resource information and processing date and time information and cell symbol notation information of the cell processing data, refer to the computer resource display row and date and time display column of the leakage analysis screen, select the corresponding screen cell, In accordance with the instructions in the cell symbol notation information, this screen cell is processed in a procedure including an analysis screen symbol notation processing step for notation of symbols. A file leakage detection method according to claim 5, symptoms.

The invention of claim 7
A computer program that causes a computer to operate as the file leakage detection system according to any one of claims 1 to 4 by being incorporated in the computer.

The invention of claim 8
A computer-readable recording medium on which the computer program according to claim 7 is recorded.

According to the present invention, it is possible to identify a user and investigate whether there is an illegal file operation. It is also possible to identify the software that has operated the file and estimate what operation has been performed.

Hereinafter, embodiments of the present invention will be described in more detail with reference to the drawings. FIG. 1 is a schematic diagram of a file leakage detection system 1 using a user identification medium. In the file leakage detection system 1 using the user identification medium, the user terminal device 300 and the file leakage analysis device 100 are connected to a network. Here, the user identification medium 700 is, for example, an IC card or an IC tag.

The user terminal device 300 is a computer and includes a storage device and a user identification medium reader (for example, an IC card reader). The storage device stores usage history data 399.

The usage history data 399 is recorded data created from the processing results of the computer processing (computer program, file, etc.) executed by the user of the user terminal device 300 using the computer resources.

The file leakage analysis apparatus 100 is a computer, and includes a storage device and a display device. The storage device stores display data 195, screen cell data 199, usage history data 399, and cell processing data 197. The display device displays a file leakage analysis screen 100a.

The leak analysis screen 100a is a screen in which screen cells are two-dimensionally arranged in a computer resource display row and a date / time display column. The display data 195 is data selected from the history data 399 in order to create the screen cell data 199 and the cell processing data 197. The screen cell data 199 is data to be displayed on the leakage analysis screen 100a, and includes data specifying the screen cell of the leakage analysis screen 100a and information to be displayed on the screen cell. The cell processing data 197 is data composed of information specifying the screen cell of the file leakage analysis screen 100a and processing information (coloring, symbol notation, etc.) for making the screen cell easy to see.

FIG. 2 is an explanatory diagram of a rough processing flow of the file leakage detection system 11 using the user identification medium. The user terminal device 300 receives user identification information (for example, a user ID) stored in the IC card 700 (FIG. 2A). The user terminal device 300 records the use history data 399 (= use history information) including the user ID (same (b)). The user terminal device 300 transmits the usage history data 399. (Same (U)).

The file leakage analysis apparatus 100 receives the usage history data 399 (same as above). The file leakage analysis apparatus 100 extracts the usage history data 399 under a predetermined condition from the usage history data 399 (same (ki)). (Details will be described later.) The file leakage analysis apparatus 100 creates display data 195 from the extracted usage history data 399 (same as above). Screen cell data 199 is created from the display data 195 and displayed on the file leakage analysis screen 100a (same as above).

At this time, display processing may be performed using the cell processing data 197 so that the file leakage analysis screen 100a is easy to see.

The file leak detector analyzes the file leak analysis screen 100a and detects a file leak by the user 500 (same as above).

FIG. 3 is an example of usage history data 399 of the file leakage analysis apparatus 100. The usage history data 399 includes a data number, network address information, user identification information, date information, event operation information, and computer resource information.

The data number is a serial number. The network address information is an IP address. The user identification information is an employee ID. The date information is date and time. The event operation type is [COPY], [DEL], [READ], [WRITE], [Logout], or the like. The computer resource information is one of file name information and program name information.

In FIG. 3, the data number “3” exemplifies usage history data “a person whose employee ID is“ ID123456 ”logs in as“ user ””. The data number “5” exemplifies usage history data “copy file from server”. Furthermore, the data number “13” exemplifies the usage history data “copy the file copied from the server further”.

In addition, when the data number is “21”, the usage history data of “delete file” is used, and when the data numbers are “34” and “35”, the copied file is set to WINWORD (Microsoft (registered trademark)). Open “Used program”) and the data number “46”, “47” and “48”, open the file “123.txt” with NOTEPAD (Microsoft (registered trademark) program) and save it overwritten. “Use log data” and “No logout” use history data and data numbers 73 and 74 indicate that the person with “changed date and employee ID = ID123456 is“ user ” ”And write 123.txt to the floppy (registered trademark). "Usage history data is illustrated.

FIG. 4 shows the format and example of the display data 195. The display data 195 includes a data number, an IP address, user identification information (= employee ID), an event operation type, date information, and computer resource information.

The data number, IP address, employee ID, event operation type, and date / time information are the same as the data number, IP address, employee ID, event operation type, and date / time information in FIG. . The computer resource information includes a section describing a copy source file name or program name, and a section describing a copy destination file name when the event operation type is [COPY].

In FIG. 4, the data number is “13”, the IP address is “10.100.1.3”, the employee ID is “ID123456”, the event operation type is “COPY”, and the date / time information is “2005/3/22 9:18” The display data in which the copy source file name of the computer resource name is “//server/important.doc” and the copy destination file name of the computer resource name is “C: \ important.doc” is illustrated. In addition, the data number is “34”, the IP address is “10.100.1.3”, the employee ID is “ID123456”, the event operation type is “READ”, the date / time information is “2005/3/22 12:12”, the computer resource The display data whose information program name is "WINWORD.EXE (Microsoft (registered trademark) program)" is illustrated.

FIG. 5 shows a format and an example of the cell processing data 197. The cell processing data 197 includes an IP address, computer resource information, and processing date / time information.

The computer resource information includes a computer resource name and a confidential level. The IP address and computer resource name are the same as the IP address and computer resource information in FIG. The security level indicates the security level of the computer resource information. The processing date / time information includes cell coloring date / time information and cell symbol date / time information. Cell coloring date / time information includes cell coloring date / time information start 1, cell coloring date / time information end 1, cell coloring date / time information start 2, and so on. The cell symbol date / time information includes the start 1 of the cell symbol date / time information, the end 1 of the cell symbol date / time information, and so on.

FIG. 5 shows that the IP address is “10.100.1.3”, the confidentiality level is “confidential”, the computer resource name of the computer resource information is “C: \ Important.doc”, and the start date / time information for cell coloring 1/22/2005 The cell processing data 197 “9:01”, “End of cell coloring date / time information 12005/3/22 10:10” is illustrated. In addition, the IP address is “10.100.1.3”, the security level is “general”, the computer resource name of the computer resource information is “WINWORD.EXE (Microsoft (registered trademark) program)”, and the date and time information for the cell symbol of the computer resource information The cell processing data 197 in which the start 1 of “2005/3/22 12:12” and the end 1 of the cell symbol date / time information in the computer resource information is “2005/3/22 21:04” is illustrated. .

FIG. 6 shows a format and an example of the screen cell data 199. The screen cell data 199 includes an IP address, a computer resource security level, a computer resource display row name, date / time display column information, and cell display information.

The IP address and the computer resource security level are the same as the IP address and computer resource security level in FIG. The computer resource display line name is a computer resource name. The date / time display string information is date / time information. The cell display information is a predetermined symbol, time, and user identification information (= employee ID).

In FIG. 6, the IP address is “10.100.1.3”, the confidentiality level is “confidential”, the computer resource display row name is “//server/important.doc”, and the date / time display column information is “2005/3/22 9 o'clock”. ", The cell display information is"<< ↓ >> 09:01
The screen cell data 199 “ID123456” is illustrated.

Here, the predetermined symbols are, for example, << ↓ >>, << ◆ >>, << × >>, [R], [W], ⇒, and the like.

<< ↓ >> indicates that the file on the computer resource display line is a copy source file. << ◆ >> indicates that the file on the computer resource display line is a copy destination file. << × >> Indicates that the file of the computer resource display line has been deleted. [R] indicates that the file or program in the computer resource display line has read the file. [W] indicates that the file or program described in the computer resource display line has written out the file. ⇒ indicates that the program is running.

FIG. 7 is a file leakage analysis screen display example (IP = 10.100.1.3) based on the screen cell data 199.
The file leakage analysis screen 100a has a two-dimensional array of screen cells corresponding to a date / time display column and a computer resource display row. The upper end of the date / time display column displays time in units of one hour. The left end of the computer resource display line displays a file name of computer resource information or a program name of computer resource information.

Corresponding screen cells are arranged at positions where the date / time display column and the computer resource display row intersect. Each screen cell is colored in the instructed color by indicating a predetermined symbol generated from the screen cell data 199, a time, and an employee ID.

FIG. 7 illustrates a file leakage analysis screen when the IP address is “10.100.1.3”.

In the date / time display column at the top of the file leakage analysis screen, “3/22/9 o'clock”, “3/22/10 o'clock”, etc. are displayed.

The computer resource display line at the left end of the file leakage analysis screen shows "//server/important.doc" for confidential files, "C: /important.doc" for confidential files, and "C: /used.doc". , “C: /123.txt”, “A: /123.txt”, etc. of general files are displayed. Examples of the program include “WINWORD.EXE (Microsoft (registered trademark) program)” and “NOTPAD.EXE (Microsoft (registered trademark) program)”.

Here, the analysis method will be described.

First, "<< ↓ >> 09:01 ID123456" is displayed in the screen cell of "//server/important.doc" in the computer resource display row and "3/22/9 o'clock" in the date / time display column. In the screen cell of “C: /Important.doc” in the computer resource display row and “3/22/9 o'clock” in the date / time display column, “<< ◆ >> 09:01 ID123456 << ↓ >> 09:18 Note that “ID123456” is written.

From this, it can be seen that the employee of “employee ID = ID123456” copied the confidential file “//server/important.doc” to “C: /important.doc” at 09:01.

Next, “<< ◆ >> 09:18 ID123456” is displayed in the screen cell of “C: /private.doc” in the computer resource display row and “3/22/9 o'clock” in the date / time display column. Pay attention to what has been done.

In the same way, the employee with “Employee ID = ID123456” copied the confidential file copy “C: /Important.doc” to “C: /Private.doc” at 09:18. Recognize.

In addition, the screen cell “C: /Important.doc” in the computer resource display row and “3/22/10 o'clock” in the date / time display column displays ““ << × >> 10:10 ID123456 ”. Focus on being.

From this, it can be seen that the employee of “employee ID = ID123456” deleted the confidential file copy “C: /important.doc” at 10:10. At this time, the screen cells of “C: /Important.doc” in the computer resource display row and “3/22/9 o'clock” and “3/22/10 o'clock” in the date / time display column are colored, It can be seen that the file existed during this period.

In addition, the screen cell of “C: /Important.doc” in the computer resource display row and “3/22/9 o'clock” in the date / time display column shows “<< ◆ >> 09:01 ID123456 << ↓ >> 09:18 ID123456 Is displayed. The screen cell data 199a and screen cell data 199b shown in FIG. 6 are displayed together in the same screen cell.

Furthermore, another analysis will be described. "[R] 12:12 ID123456" is displayed in the screen cell "C: /private.doc" in the computer resource display row and "3/22/12 o'clock" in the date / time display column. Pay attention to. In addition, the screen cell of “WINWORD.EXE (Microsoft (registered trademark) program)” in the computer resource display line and “3/22/12 o'clock” in the date / time display column contains “[R] 12:12 ID123456”. Note that “

From this, it is assumed that “WINWORD.EXE (Microsoft (registered trademark) program)” has read a copy of the confidential file “C: /private.doc”.

In addition, in the screen cell of the computer resource display row “C: /private.doc” and the date / time display column “3/22/21 o'clock”, “[logout] 21:04 ID123456” is displayed, Note that the symbol “⇒” is written in the screen cell. However, note that the screen cells are still colored after “[logout]”.

From this, it can be seen that the copy of the confidential file “C: /private.doc” exists on the storage device (for example, hard disk) without being deleted.

FIG. 8 is a detailed configuration diagram of the file leakage detection system 11 using the user identification medium.
The file leakage detection system 11 using a user identification medium is configured by connecting a user terminal device 300 and a file leakage analysis device 100 to a network. The user terminal device 300 includes a user identification medium reading unit 310, a usage history recording unit 330, a usage history transmission unit 370, and a storage unit 390. The storage unit 390 stores usage history data 399.

The usage history data 399 includes network address information, user identification information (for example, user ID), computer resource information (for example, one of file name information or program name information), date / time information, and event operation information ( For example, [COPY], [DEL], [READ], [WRITE], or [logout]).

The user identification medium reading unit 310 reads user identification information recorded on a user identification medium (IC card, IC tag, mobile phone). The usage history recording means 330 creates usage history data from the history of computer processing execution using computer resources and records it in the storage means. The usage history transmission unit 370 transmits usage history data 399.

The file leakage analysis apparatus includes a usage history extraction unit 110, a display data creation unit 120, a cell processing data creation unit 125, a screen cell data creation unit 130, an analysis screen display unit 140, an analysis screen processing unit 155, A usage history receiving unit 170 and a storage unit 190 are provided. The analysis screen processing unit 155 includes an analysis screen coloring unit 150 and an analysis screen symbol notation unit 160. The storage unit 190 stores display data 195, cell processing data 197, screen cell data 199, and usage history data 399.

The display data 195 is data including user identification information, computer resource information, and date / time information. The cell processing data 197 is data including cell symbol notation information and cell coloring information by associating computer resource display row information, date / time display column information, computer resource information, and processing date / time information of the screen cell data 199. . The screen cell data 199 is data of a screen cell having computer resource display row information and date / time display column information in which computer resource information and date / time information are associated with each other.

The usage history receiving unit 170 receives usage history data 399.

The usage history extraction unit 110 extracts usage history data 399 that satisfies a predetermined condition from the usage history data. The predetermined condition is, for example, one that specifies event operation information (for example, [COPY], [DEL], [READ], [WRITE], [Logout], etc.).

The display data creation means 120 creates display data 195 including user identification information and associating computer resource information with date / time information from the extracted usage history data 399. The cell processing data creation means 125 creates cell processing data 197 including cell symbol notation information and cell coloring information from the extracted usage history data 399.

The screen cell data creating unit 130 creates screen cell data 199 using the display data 195.

The analysis screen display means 140 arranges and displays the screen cells generated from the screen cell data 199 on the file leakage analysis screen 100a that is two-dimensionally arranged in a computer resource display row and a date and time information display column. The screen cell data 199 is read, and the computer cell display row information and the date / time display column information of the screen cell data 199 are associated with the computer resource display row and the date / time display column of the leakage analysis screen 100a to arrange the screen cell data 199. Then, the file leakage analysis screen 100a is created and displayed.

The analysis screen processing means 155 reads the computer resource information and the processing date / time information of the cell processing data 197, refers to the computer resource display row and the date / time display column of the leakage analysis screen 100a, and selects the corresponding screen cell. Then, this screen cell is processed according to the instruction of the cell processing data.

The analysis screen coloring means 150 reads the computer resource information, the processing date / time information, and the cell coloring information of the cell processing data 197, refers to the computer resource display row and the date / time display column of the leakage analysis screen 100a, and corresponds to the screen. A cell is selected, and this screen cell is colored according to the instruction of the cell coloring information. The analysis screen symbol notation means 160 reads the computer resource information, the processing date / time information, and the cell symbol notation information of the cell processing data 197, and refers to the computer resource display row and the date / time display column of the leakage analysis screen 100a. The screen cell corresponding to is selected, and the symbol is displayed on this screen cell according to the instruction of the cell symbol description information.

Usage history extraction means 110, display data creation means 120, cell processing data creation means 125, screen cell data creation means 130, analysis screen display means 140, analysis screen processing means 155, usage history reception means 170, The analysis screen processing means 155, the analysis screen coloring means 150, the analysis screen symbol notation means 160, the user identification medium reading means 310, the usage history recording means 330, and the usage history transmission means 370 are computer programs. It is. The storage unit 190 and the storage unit 390 are memories. The display data 195, the cell processing data 197, the screen cell data 199, and the usage history data 399 are a collection of computer-readable data.

FIG. 9 is a flowchart of the file leakage analysis process.
(1) The usage history extraction unit 110 extracts usage history data 399 whose event operation information is [COPY], [DEL], [READ], [WRITE], [logout] from the usage history data 399. (Step S100)
(2) The display data creation means 120 creates display data 195 in which computer resource information and date information are associated with each other from the extracted usage history data 399. (Step S110)
(3) Cell processing data creation processing is performed. (Details will be described later.) (Step S130)
(4) The screen cell data creation means 130 reads the computer resource information and date / time information of the display data 195, uses the computer resource information as computer resource display row information, and uses the date / time information as date / time display column information. 199 is created. The analysis screen coloring means 150 reads the computer resource information, the processing date / time information, and the cell coloring information of the cell processing data 197 and refers to the computer resource display row information and the date / time display column information of the screen cell data. A corresponding screen cell is selected, and this screen cell is colored in a predetermined manner. Further, the analysis screen symbol notation means 160 reads the computer resource information, the processing date / time information, and the cell symbol notation information of the cell processing data 197, and refers to the computer resource display row information and date / time display column information of the screen cell data 199. Then, the screen cell corresponding to this is selected, and a predetermined symbol “⇒” is displayed on it. finish. (Step S150)

FIG. 10 is a flowchart of the screen cell data creation process.
(1) One IP address is selected from the display data 195. (Step S300)
(2) It is determined whether all display data 195 having the same IP address has been read.
If yes, exit. If NO, the process proceeds to step S320. (Step S310)
(3) Determine whether the operation information of the event is [COPY]. If YES, the process proceeds to step S325. If NO, the process proceeds to step S330. (Step S320)
(4) Perform [COPY] processing. Return to S310. (Step S325)
(5) Determine whether the operation information of the event is [READ]. If YES, the process proceeds to step S335. If no, the process proceeds to step S340. (Step S330)
(6) Perform [READ] processing. Return to S310. (Step S335)
(7) Determine whether the operation information of the event is [WRITE]. If YES, the process proceeds to step S345. If NO, the process proceeds to step S350. (Step S340)
(8) Perform [WRITE] processing. The process returns to step S310. ((Step S345)
(9) Determine whether the operation information of the event is [DEL]. If YES, the process proceeds to step S355. If NOS, go to step 360. (Step S350)
(10) Perform [DEL] processing. The process returns to step S310. (Step S355)
(11) It is determined whether the operation information of the event is [Logout]. If YES, the process proceeds to step S365. If NO, the process returns to step S310. (Step S360)
(12) Perform [logout] processing. The process returns to step S310. (Step S365)

FIG. 11 is a flowchart of the [COPY] process.
(1) It is determined whether cell processing data having a copy source file name and an IP address of the display data 195 exists. If it exists, the process proceeds to step S416. If not, the process proceeds to step S413. (Step S400)
(2) The cell processing data creation means 125 creates cell processing data 197 having a copy source file name and an IP address of the display data 195. Proceed to step S420. (Step S413)
(3) The cell processing data creation means 125 selects the cell processing data 197. Proceed to step S420. (Step S416)
(4) The cell processing data creating means 125 records the time in the predetermined cell coloring date / time information “start n” of the cell processing data 197. (Step S420)
(5) In the screen cell data 199, the screen cell data creation means 130 records “<< ↓ >>, time, employee ID” in the computer resource name and time cell corresponding to the computer resource name and date / time of the cell processing data. To do. (Step S430)
(6) It is determined whether or not cell processing data having a copy destination file name and an IP address of the display data 195 exists. If not, the process proceeds to step S453. If it exists, the process proceeds to step S456. (Step S440)
(7) The cell processing data creation unit 125 creates cell processing data 197 having a copy destination file name and an IP address of the display data 195. The process proceeds to step S460. (Step S453)
(8) The cell processing data creation means 125 selects the cell processing data 197 having the copy destination file name and IP address of the display data 195. The process proceeds to step S460. (Step S456)
(9) The cell processing data creation unit 125 records the time in the predetermined cell coloring date / time information “start n” of the cell processing data 197. (Step S460)
(10) The screen cell data creation means 130 reads the event operation type, the copy destination file name, the date / time information, and the employee ID of the display data 195, and includes the screen cell data including “<< ◆ >>, time, employee ID”. And 199. finish. (Step S470)

FIG. 12 is a flowchart of the [DEL] process.
(1) It is determined whether cell processing data having a copy source file name and an IP address of the display data 195 exists. If it exists, the process proceeds to step S520. If not, the process proceeds to step S510. (Step S500)
(2) The cell processing data creation means 125 creates cell processing data 197 having a copy source file name and an IP address of the display data 195. Proceed to step S530. (Step S510)
(3) The cell processing data creation means 125 selects the cell processing data 197 having the copy source file name and IP address of the display data 195. (Step S520)
(4) The cell processing data creation unit 125 records the time in predetermined cell coloring date / time information “end n” of the cell processing data 197. (Step S530)
(5) The screen cell data creation means 130 reads the display data 195 and creates screen cell data 199 including “<< × >>, time, employee ID”. finish. (Step S540)

FIG. 13 is a flowchart of the [READ] process.
(1) It is determined whether cell processing data having a copy source file name and an IP address of the display data 195 exists. If it exists, the process proceeds to step S620. If not, the process proceeds to step S610. (Step S600)
(2) The cell processing data creation means 125 creates cell processing data 197 having a copy source file name and an IP address of the display data 195. Proceed to step S630. (Step S610)
(3) The cell processing data creation means 125 selects the cell processing data 197 having the copy source file name and IP address of the display data 195. (Step S620)
(4) The cell processing data creation unit 125 records the time in the predetermined cell symbol date / time information “start n” of the cell processing data 197. (Step S630)
(5) The screen cell data creation means 130 reads the display data 195 and creates screen cell data 199 including “[R], time, employee ID”. (Step S640)

FIG. 14 is a flowchart of the [WRITE] process.
(1) It is determined whether cell processing data having a copy source file name and an IP address of the display data 195 exists. If it exists, the process proceeds to step S720. If not, the process proceeds to step S710. (Step S700)
(2) The cell processing data creation means 125 creates cell processing data 197 having a copy source file name and an IP address of the display data 195. Proceed to step S720. (Step S710)
(3) The cell processing data creation means 125 selects the cell processing data 197 having the copy source file name and IP address of the display data 195. (Step S720)
(4) The cell processing data creation unit 125 records the time in the predetermined cell symbol date / time information “start n” of the cell processing data 197. (Step S730)
(5) The screen cell data creation means 130 reads the display data 195 and creates screen cell data 199 including “[W], time, employee ID”. (Step S740)

FIG. 15 is a flowchart of the [logout] process.
(1) It is determined whether cell processing data having a copy source file name and an IP address of the display data 195 exists. If it exists, the process proceeds to step S820. If not, the process proceeds to step S810. (Step S800)
(2) The cell processing data creation means 125 creates cell processing data 197 having a copy source file name and an IP address of the display data 195. Proceed to step S830. (Step S810)
(3) The cell processing data creation means 125 selects the cell processing data 197 having the copy source file name and IP address of the display data 195. (Step S820)
(4) The cell processing data creation means 125 selects “start n” of the date and time after the previous logout before the logout date of each cell processing data 197 and records the time in the corresponding “end n”. To do. (Step S830)
(5) The screen cell data creation means 130 reads the display data 195 and creates screen cell data 199 including “[logout], time, employee ID”. (Step S840)

As described above in detail, according to the present invention, it is possible to identify a user and investigate whether there is an illegal file operation. In addition, the software that operated the file can be identified and the operation performed can be estimated.

Overall configuration of file leak detection system Rough process flow of file leak detection system 1 An example of usage history data of the file leakage analysis apparatus 100 Format and example of display data 195 Format and example of cell processing data 197 Format and example of screen cell data 199 File leak analysis screen display example using screen cell data 199 (IP = 10.100.1.3) Detailed configuration diagram of file leak detection system 1 File leakage analysis process flowchart Flow chart of screen cell data creation processing [COPY] Process flowchart [DEL] Processing flowchart [READ] Process flowchart [WRITE] Flowchart of processing [Logout] process flowchart

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 File leak detection system 100 using user identification medium File leak analysis apparatus 100a File leak analysis screen 110 Usage history extraction means 120 Display data creation means 125 Cell processing data creation means 130 Screen cell data creation means 140 Analysis screen display means 150 Analysis screen coloring means 155 Analysis screen processing means 160 Analysis screen symbol notation means 170 Usage history receiving means 190 Storage means 195 Cell processing data 199 Screen cell data 300 User terminal device 310 User identification medium reading means 330 Usage history recording Means 370 Usage history transmission means 390 Storage means 399 Usage history data 500 User 700 User identification medium 900 File leakage manager

Claims (8)

This is a file leak detection system in which a file leak analysis apparatus that displays a leak analysis screen in which screen cells are two-dimensionally arranged in a computer resource display row and a date / time display column and a user terminal device are connected to a network. And
The user terminal device
Storage means for storing usage history data including network address information of the user terminal device, user identification information, computer resource information, and usage date and time information;
Portable storage medium reading means for reading user identification information recorded on the portable storage medium;
Utilization history recording means for creating utilization history data from the result of the history of computer processing using computer resources and recording it in the storage means;
Usage history transmission means for transmitting usage history data to the file leakage analysis device;
A terminal device comprising:
The file leakage analysis apparatus
Usage history receiving means for receiving usage history data from the user terminal device;
Usage history extraction means for extracting usage history data of a predetermined condition from the received usage history data;
Display data creation means for creating display data including user identification information, computer resource information, and usage date and time information from the extracted usage history data;
Screen cell data creating means for creating screen cell data including computer resource display row information and date display column information using the display data;
The computer resource display row information and date / time display column information of the screen cell data are read, the screen cell data is arranged in association with the computer resource display row and date / time display column of the leakage analysis screen, and file leakage analysis is performed. Analysis screen display means for creating and displaying a screen;
Which is an analyzer equipped with
A file leakage detection system characterized by that. The file leakage analysis apparatus
Cell processing data creation means for creating cell processing data including computer resource information and processing date and time information corresponding to computer resource display row information and date and time display column information of screen cell data from the extracted usage history data; ,
Read the computer resource information and the processing date and time information of the cell processing data, refer to the computer resource display row and date and time display column of the leakage analysis screen, select the corresponding screen cell, and specify the cell processing data According to the analysis screen processing means for processing this screen cell,
Which is an analyzer equipped with
The file leakage detection system according to claim 1. The file leakage analysis apparatus
The cell processing data is
Data including computer resource information, processing date and time information, cell symbol notation information and cell coloring information,
The analysis screen processing means reads the computer resource information, the processing date / time information and the cell coloring information of the cell processing data, refers to the computer resource display row and the date / time display column of the leakage analysis screen, and selects the corresponding screen cell. Select and analyze screen coloring processing means for coloring this screen cell according to the instructions of the cell coloring information,
The computer resource information, the processing date / time information and the cell symbol notation information of the cell processing data are read, the computer resource display row and the date / time display column of the leakage analysis screen are referred to, the corresponding screen cell is selected, and the cell According to the instruction of the symbol notation information, in this screen cell, an analysis screen symbol notation processing means for notation of symbols,
Which is an analyzer equipped with
The file leakage detection system according to claim 2. User history data including user terminal device network address information, user identification information, computer resource information, and usage date and time information;
Display data including user identification information, computer resource information, and use date and time information;
Screen cell data including computer resource display row information and date display column information;
A file leakage detection method using
A portable storage medium reading step for reading user identification information recorded in the portable storage medium;
A usage history recording step of creating and recording usage history data from a history of computer processing execution using computer resources,
A usage history extraction step for extracting usage history data of a predetermined condition from usage history data;
A display data creation step of creating display data from the extracted usage history data;
Screen cell data creation step for creating screen cell data using display data;
The computer resource information display row and date / time information display column of the screen cell data are read, the screen cell data is arranged in correspondence with the computer resource display row and date / time display column of the leak analysis screen, and the file leak analysis screen is displayed. Analysis screen display step to create and display,
A file leakage detection method characterized by being performed in a procedure including: A file leakage detection method using cell processing data including computer resource information and processing date / time information corresponding to computer resource display row information and date / time display column information of screen cell data,
From the extracted usage history data, a cell processing data creation step of creating cell processing data;
Read the computer resource information and processing date and time information of the cell processing data, refer to the computer resource display row and date and time display column of the leakage analysis screen, select the corresponding screen cell, according to the instructions of the cell processing data, Analysis screen processing instruction step for processing this screen cell,
The file leakage detection method according to claim 4, wherein the file leakage detection method is performed by a procedure including: Using cell processing data including computer resource information, processing date and time information, cell symbol notation information and cell coloring information;
Read the computer resource information, the processing date / time information and the cell coloring information of the cell processing data, refer to the computer resource display row and date / time display column of the leakage analysis screen, select the corresponding screen cell, and select the cell coloring information. In accordance with the instructions of the analysis screen coloring processing step for coloring this screen cell,
The computer resource information, the processing date / time information, and the cell symbol notation information of the cell processing data are read, the computer resource display row and the date / time display column of the leakage analysis screen are referenced, the corresponding screen cell is selected, and the cell symbol is selected. In accordance with the instructions of the notation information, in this screen cell, an analysis screen symbol notation processing step for notation of symbols,
6. The file leakage detection method according to claim 5, wherein the file leakage detection method is performed by a procedure including: The computer program which makes a computer operate | move as a file leak detection system of any one of Claim 1 to 4 by incorporating in a computer. A computer-readable recording medium on which the computer program according to claim 7 is recorded.

Images