JP2009176124A - Apparatus and system for monitoring, recording and reproducing communication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reproduce the screen of a terminal even if contents dynamically varied with a user operation are displayed in the terminal. <P>SOLUTION: A packet collecting and recording unit 22 collects packets on a network. An operation information receiving unit 21 receives operation information about operations that the user has performed using a terminal on the contents of communication displayed in the terminal. A packet analysis unit 24 reconstructs the contents of communication from the packets collected by the packet collecting and recording unit 22. The reconstructed contents of communication and the operation information received by the operation information receiving unit 21 are stored in association in an analysis result storage unit 26. An analysis result recording and reproducing unit 25 sends the reconstructed contents of communication stored in the analysis result storage unit 26 and the operation information stored in the analysis result storage unit 26 in association with the reconstructed contents of communication to a management server having the function of displaying the reconstructed contents of communication. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a communication monitoring / recording / reproducing apparatus and a communication monitoring record for reconstructing communication contents of communication between a terminal and a server, and reproducing a screen during communication of the terminal that has performed communication of the reconstructed communication contents. It relates to a playback system.

  Along with increasing interest in information leakage prevention solutions in recent years, for example, communication monitoring (data) collected and recorded on a network between a managed terminal and a Web server, and analyzing a plurality of recorded packets There is an increasing demand for recording and reproducing devices.

  This communication monitoring recording / reproducing apparatus intercepts a packet on a network segment to be monitored. This packet is, for example, a collection of data obtained by dividing the communication content of communication between the terminal and the Web server. The communication monitoring recording / reproducing apparatus restores (reconstructs) communication contents such as an HTTP (HyperText Transfer Protocol) request or an HTTP reply from one or more intercepted packets, for example. The communication monitoring / recording / reproducing apparatus has a function of searching the recorded communication content according to a search condition designated by the user, for example, and displaying the searched communication content to the user.

  In such a communication monitoring / recording / reproducing apparatus, the communication data passing through the target network is intercepted and classified according to the type of the intercepted communication data, and new search data is added to the analysis result database. A storing technique (hereinafter referred to as a first prior art) is disclosed (for example, see Patent Document 1). According to this technology, it is possible to easily and reliably confirm the progress of communication using the target network based on the analysis result data stored in the analysis result database.

  Incidentally, in recent years, Web pages using dynamic HTML (Dynamic HyperText Markup Language) and the like are increasing. Such a page has a feature that, for example, when a user performs an operation using a keyboard or a mouse on a browser operating on a terminal, a screen image displayed on the browser dynamically changes. Further, there is a feature that communication is performed between the browser and the Web server asynchronously with the key operation or the mouse operation by the user.

  When communication contents (contents) including a Web page using such dynamic HTML are to be reproduced, for example, a keyboard operation or a mouse operation performed on the Web page even if an intercepted packet is used. Without the operation information on the screen, it is not possible to reproduce even the dynamically changing screen image, and only the initial screen (image) of the Web page can be reproduced.

  For example, based on the analysis result of an HTML document, when a web page is composed of a plurality of frames, by acquiring image data for each frame, the dynamic change of the web page for each frame can be properly grasped. A technique (hereinafter referred to as second prior art) is disclosed (for example, see Patent Document 2).

  In addition, a macro is generated based on event information generated on an operation target (Web page) in response to a user's operation, and execution of a macro operation adapted to the operation target and operation status (Web page contents) is realized. Technology (hereinafter referred to as third prior art) is disclosed (for example, see Patent Document 3).

Further, for example, a technique for analyzing a change in a Web page using dynamic HTML (hereinafter referred to as a fourth prior art) is disclosed (for example, see Patent Document 4).
International Publication No. 02/29579 Pamphlet JP 2005-266554 A JP 2006-127117 A JP 2007-172377 A

  However, in the second prior art described above, since the operation information recording unit for recording the operation information is outside the browser, when the browser is operated alone by avoiding activation of the operation information recording unit. , Operation information for the browser cannot be recorded (collected). In the second prior art, since the operation information recording unit needs to analyze the HTML page in order to acquire information such as a frame, the operation information cannot be recorded for an unknown script.

  In the third prior art described above, since it is necessary for the event analysis unit to analyze the HTML page in order to obtain information about the object that is the execution destination of the event, event information cannot be recorded for an unknown script. Furthermore, in the third prior art, since the browsing operation recording / playback apparatus is configured integrally with a browser, it is necessary to change an existing browser when installing a different browser.

  In the fourth prior art described above, a JAVASCRIPT (registered trademark) variable or state is obtained in order to obtain a JAVASCRIPT specialized configuration. For this reason, state transition cannot be analyzed for an unknown script other than JAVASCRIPT. Further, in the fourth prior art, similarly to the third prior art described above, since the browser is built in and integrated, it is necessary to change the existing browser when installing a different browser. is there.

  An object of the present invention is to provide a communication monitoring / recording / reproducing apparatus and communication monitoring capable of reproducing the screen of the terminal even when content that dynamically changes in accordance with a user operation is displayed on the terminal. It is to provide a recording / reproducing system.

  According to one aspect of the present invention, there is provided a communication monitoring / recording / reproducing apparatus connected to a network capable of communicating a packet in which communication contents between a first terminal and a server are divided. The communication monitoring recording / reproducing apparatus relates to packet collection means for collecting packets on the network, and operations performed by a user using the first terminal for communication contents displayed on the first terminal. Operation information reception means for receiving operation information, packet analysis means for reconstructing the communication contents from the packets collected by the packet collection means, communication contents reconstructed by the packet analysis means, and reception of the operation information Analysis result storage means for storing the operation information received by the means in association with each other, the reconstructed communication content stored in the analysis result storage means and the analysis in association with the reconstructed communication content The operation information stored in the result storage means is transmitted to the second terminal having a function of displaying the reconstructed communication content. And means.

  ADVANTAGE OF THE INVENTION According to this invention, even if it is a case where the content which changes dynamically with a user's operation is displayed on a terminal, it becomes possible to reproduce the screen of the said terminal.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[First Embodiment]
FIG. 1 is a diagram for explaining a network system to which a communication monitoring recording / reproducing system according to a first embodiment of the present invention is connected.

  The communication monitoring recording / reproducing system according to the present embodiment includes a plurality of terminals (first terminals), a communication monitoring recording / reproducing apparatus 20, and a management server (second terminal) 30. The plurality of terminals includes the terminal 10. In FIG. 1, terminals other than the terminal 10 are omitted for convenience.

  The terminal 10 is connected to the Web server 50 via the Internet 40, for example. Communication between the terminal 10 and the Web server 50 is executed by, for example, HTTP (HyperText Transfer Protocol). In this case, an HTTP request is transmitted from the terminal 10 to the Web server 50, and a response (response) to the HTTP request is returned from the Web server 50 to the terminal 10. This series of processing (contents) is defined as one communication content (one session). Through such communication, the terminal 10 can read various contents from the Web server 50. Various contents read from the Web server 50 include a URL (Uniform Resource Locator) indicating the position of the content on the network and the content type of the content.

  For example, a browser is installed in the terminal 10, and content read from the Web server 50 is displayed by the browser.

  The communication monitoring recording / reproducing apparatus 20 is connected to the terminal 10 by a network (network segment) 60 to be monitored. The communication monitoring recording / reproducing apparatus 20 collects packets (packet data) obtained by dividing communication contents between a plurality of terminals including the terminal 10 and the Web server 50 from the network 60 to be monitored. At this time, the communication monitoring recording / reproducing apparatus 20 collects the packets via the switch 70. The communication monitoring recording / reproducing apparatus 20 reconstructs and records (stores) communication contents between the terminal 10 and the Web server 50 from the collected packets.

  For example, a browser is installed in the management server 30. In response to a request from a user (administrator) who uses the management server 30, the management server 30 displays communication contents (contents) reconstructed by the communication monitoring recording / reproducing device 20 to the user by a browser. . Thereby, for example, the content (screen) displayed on the terminal 10 is reproduced on the management server 30.

  FIG. 2 is a block diagram mainly showing a functional configuration of the terminal 10 shown in FIG. As illustrated in FIG. 2, the terminal 10 includes an operation information collection condition table 11, an operation information acquisition unit 12, an operation information management table 13, and an operation information transmission unit 14.

  Here, the operation information acquisition unit 12 and the operation information transmission unit 14 are dynamically incorporated as a plug-in in the browser installed in the terminal 10. That is, the browser installed in the terminal 10 is not specially prepared, and an existing browser can be used as it is. The plug-in can be easily incorporated into the browser by the user of the terminal 10 by downloading it from a web page using the browser of the terminal 10, for example.

  In the operation information collection condition table 11, conditions (information indicating) of contents (communication contents) that are targets for acquiring (collecting) operation information related to operations performed by the user using the terminal 10 are stored in advance. In the operation information collection condition table 11, a URL indicating the position of the content on the network and the content type of the content are stored in association with each other as a condition of the content for which the operation information is acquired. The conditions held in the operation information collection condition table 11 are updated at a time designated by the user or irregularly when the browser installed in the terminal 10 is activated. The operation information collection condition table 11 is updated by, for example, reading a URL specified by the user or receiving a URL specified by the user (administrator) using the management server 30 from the communication monitoring recording / reproducing apparatus 20. Executed.

  When the browser installed in the terminal 10 reads content such as a Web page from the Web server 50, the operation information acquisition unit 12 acquires the URL and content type included in the content. The operation information acquisition unit 12 determines whether or not the acquired URL and content type match the conditions held in the operation information collection condition table 11.

  When an operation (event) performed by the user using the terminal 10 with respect to the content read by the browser occurs, the operation information acquisition unit 12 acquires event information regarding the generated event. The operation information acquisition unit 12 acquires event information via a browser API (Application Program Interface). The generated events (operations performed by the user using the terminal 10) include, for example, mouse events and keyboard events, and the event information includes event types such as the mouse events and keyboard events, and the mouse cursor at the time of the event occurrence. Location etc. are included. The operation information acquisition unit 12 acquires operation information including the event information according to the acquired event information. The operation information acquisition unit 12 registers the acquired operation information in the operation information management table 13.

  The operation information management table 13 holds the operation information acquired by the operation information acquisition unit 12. The operation information held in the operation information management table 13 includes an event (operation) occurrence time, event information (event type, cursor position), DOM (Document Object Model) object (information), and the like. The DOM represents the structure of content (Web page) with a tree structure, and the DOM object specifies a position in the Web page. That is, the location (position) where the user has operated the terminal 10 (mouse or keyboard), for example, is specified by the DOM object.

  When a predetermined number of pieces of operation information are registered in the operation information management table 13, the operation information transmission unit 14 transmits the operation information held (registered) in the operation information management table 13 via the network 60. It transmits to the communication monitoring recording / reproducing apparatus 20.

  FIG. 3 is a block diagram mainly showing a functional configuration of the communication monitoring recording / reproducing apparatus 20 shown in FIG. As shown in FIG. 3, the communication monitoring recording / reproducing apparatus 20 includes an operation information receiving unit 21, a packet collection / recording unit 22, a packet storage unit 23, a packet analysis unit 24, an analysis result recording / reproduction unit 25, and an analysis result storage unit 26. Including.

  The operation information receiving unit 21 receives the operation information transmitted by the operation information transmitting unit 14 included in the terminal 10.

  The packet collection / recording unit 22 collects packets on the network 60 to be monitored by the communication monitoring recording / reproducing apparatus 20. The packet collection / recording unit 22 collects packets via the switch 70. This collected packet is a collection of data obtained by dividing the communication content of communication between the terminal 10 and the Web server 50. Note that the number of packets constituting one communication content varies depending on the communication content capacity, for example. Further, the packet collected from the network 60 includes a network address (IP address: Internet Protocol address) assigned to the terminal 10 that has transmitted or received the packet. With this network address, it is possible to identify a terminal that has transmitted or received a packet collected from the network.

  The packet collection / recording unit 22 stores the collected packets in the packet storage unit 23 together with the operation information received by the operation information receiving unit 21. The packet collection / recording unit 22 transmits the operation information received by the operation information receiving unit 21 and the collected packets to the packet analysis unit 24.

  The packet analysis unit 24 reconstructs one communication content from the one or more packets by analyzing the one or more packets transmitted by the packet collection and recording unit 22. At this time, the packet analysis unit 24 reconstructs the communication content based on the port number included in each packet. Thereby, the packet analysis unit 24 extracts, for example, an HTTP request or an HTTP reply (content), and transmits it to the analysis result recording / reproducing unit 25 together with the operation information transmitted by the packet collection / recording unit 22.

  The analysis result recording / playback unit 25 stores the content and operation information transmitted by the packet analysis unit 24 in association with each other in the analysis result storage unit 26. The analysis result recording / playback unit 25 has a function of searching the analysis result storage unit 26 for content that matches the search condition, for example, according to the search condition specified by the user. The analysis result recording / playback unit 25 transmits the content that is the search result and the operation information associated with the content to the management server 30 that has a function of displaying the content.

  FIG. 4 is a block diagram mainly showing a functional configuration of the management server 30 shown in FIG. As shown in FIG. 4, the management server 30 includes a content reception unit 31, an operation information reception unit 32, an event generation unit 33, and a communication content reproduction unit 34.

  Here, the content reception unit 31, the operation information reception unit 32, the event generation unit 33, and the communication content reproduction unit 34 are dynamically incorporated as plug-ins in the browser installed in the management server 30. That is, the browser installed in the management server 30 is not specially prepared, and an existing browser can be used as it is. This plug-in can be easily incorporated into a browser by the user of the management server 30 by downloading it from a Web page using the browser of the management server 30, for example.

  The content receiving unit 31 receives the content (reconstructed communication content) transmitted by the analysis result recording / reproducing unit 25 included in the communication monitoring recording / reproducing device 20.

  The operation information receiving unit 32 receives the operation information transmitted by the analysis result recording / reproducing unit 25 included in the communication monitoring recording / reproducing device 20.

  The event generation unit 33 generates an event corresponding to the event type included in the operation information received by the operation information reception unit 32.

  The communication content reproduction unit 34 displays an initial screen image on the browser installed in the management server 30 from the content received by the content reception unit 31. In addition, the communication content reproduction unit 34 transmits the event generated by the event generation unit 33 via the browser API to the browser DOM object included in the operation information received by the operation information reception unit 32. As a result, the communication content reproduction unit 34 generates an operation performed by the user using the terminal 10 on the displayed initial screen image, so that the screen displayed on the terminal 10 is displayed on the management server 30. Reproduce in the browser.

  FIG. 5 shows an example of the data structure of the operation information collection condition table 11 shown in FIG. As shown in FIG. 5, the operation information collection condition table 11 holds a URL and a content type.

  In the example illustrated in FIG. 5, the operation information collection condition table 11 holds a URL “http://aa.bb.cc” and a content type “application / javascript”. The operation information collection condition table 11 holds a URL “http: //dd.ee.ff/xx/yy” and a content type “application / javascript”.

  FIG. 6 shows an example of the data structure of the operation information held in the operation information management table 13 shown in FIG. As shown in FIG. 6, the operation information includes time, event type, cursor position, DOM object, and key code. The time indicates the time when the event occurred. The event type indicates the type of event such as a keyboard event or a mouse event. The cursor position indicates the mouse cursor position when the event occurs. The DOM object specifies a location where an event has occurred. The key code indicates a key code when the event type that has occurred is a keyboard event.

  In the example illustrated in FIG. 6, the operation information 131 includes the time “2007/09/03 9: 00: 00.1234”, the event type “right mouse click”, the cursor position “100, 200”, and the DOM object “div test”. "It is included. In this case, since the event type is “right mouse click”, the generated event is a mouse event. Therefore, the operation information 131 does not include a key code.

  Further, the operation information 132 includes a time “2007/09/03 9: 00: 01.3456”, an event type “key press”, a cursor position “100, 200”, a DOM object “div test”, and a key code “32”. "It is included.

  Next, the processing procedure of the terminal 10 will be described with reference to the flowchart of FIG. First, when the browser of the terminal 10 reads content from the Web server 50, the operation information acquisition unit 12 acquires the URL and content type included in the content (step S1).

  The operation information acquisition unit 12 determines whether or not the acquired URL and content type are held in the operation information collection condition table 11 (step S2).

  When it is determined that the acquired URL and content type are stored in the operation information collection condition table 11 (YES in step S2), the operation information acquisition unit 12 operates the operation information of the content read by the browser of the terminal 10 The collection selection flag is set to ON (step S3).

  Here, for example, an event occurs in the browser when the user performs an operation on the browser (content displayed in the browser) or when the reading of the Web page is completed. When an event occurs, the occurrence of the event is notified to the operation information acquisition unit 12 via the browser API (step S4).

  When the occurrence of the event is notified, the operation information acquisition unit 12 determines whether or not the operation information collection selection flag of the content in which the event has occurred is ON (step S5).

  If it is determined that the operation information collection selection flag is ON (YES in step S5), event information such as a keyboard event or a mouse event is acquired from the browser. This event information includes an event type indicating a keyboard event or a mouse event, and a cursor position.

  The operation information acquisition unit 12 acquires operation information including the event information according to the acquired event information (step S6). The operation information acquisition unit 12 acquires operation information via a browser API. For example, when the acquired event information is a keyboard event, the operation information acquisition unit 12 uses the event occurrence time, the keyboard press or release event, the key code information, the mouse cursor position when the keyboard event occurs, and the DOM object as the operation information. get. For example, when the acquired event information is a mouse event, the operation information acquisition unit 12 acquires an event occurrence time, a mouse click, a movement event, a mouse cursor position at the time of the mouse event occurrence, and a DOM object as operation information. . The mouse click includes, for example, double click or release. For example, when the acquired event information is an event other than a keyboard event and a mouse event, the operation information acquisition unit 12 acquires, for example, the event occurrence time and the event type as the operation information.

  The operation information acquisition unit 12 registers the acquired operation information in the operation information management table 13 (step S7). At this time, depending on the event type included in the operation information, the operation information acquisition unit 12 does not register all the operation information but registers a part of the operation information or collects a plurality of operation information into one. It is also possible to select to register. For example, in the case of a mouse movement event, a structure in which a movement distance is calculated from an event at the start point of movement and an end point event at the end of movement, and a plurality of movement events are collectively registered in the operation information management table 13 as one piece of operation information. It doesn't matter.

  Next, the operation information transmission unit 14 determines whether or not the number of registered operation information in the operation information management table 13 is equal to or greater than a threshold (step S8).

  When it is determined that the number of registered operation information is equal to or greater than the threshold (YES in step S8), the operation information transmitting unit 14 transmits the operation information registered (held) in the operation information management table 13 via the network 60. Then, the data is transmitted to the communication monitoring recording / reproducing apparatus 20 (step S9). When transmitting the operation information, the operation information can be compressed and transmitted in order to reduce the traffic volume. In addition, when transmission to the communication monitoring recording / reproducing apparatus 20 fails, a configuration may be adopted in which data is temporarily stored in a disk or the like of the terminal 10 and retransmitted later.

  When the operation information is transmitted to the communication monitoring recording / reproducing device 20, the operation information transmitting unit 14 deletes (clears) the operation information held in the operation information management table 13 from the operation information management table 13 (step S10). ).

  On the other hand, if it is determined in step S2 that the URL and content type are not held in the operation information collection condition table 11, the operation information collection selection flag of the content read by the browser of the terminal 10 is set to OFF (step S11). ). When the process of step S11 is executed, the process of step S4 is executed.

  If it is determined in step S5 that the operation information collection selection flag is not ON, that is, it is determined to be OFF, the process ends. If it is determined in step S8 that the registered number of operation information is not equal to or greater than the threshold value, the process ends.

  Next, the processing procedure of the communication monitoring recording / reproducing apparatus 20 will be described with reference to the flowchart of FIG.

  First, the packet collection recording unit 22 collects packets on the network 60 (step S21).

  Next, the operation information receiving unit 21 receives the operation information transmitted by the operation information transmitting unit 14 included in the terminal 10 (step S22).

  The packet collection recording unit 22 stores the collected packets in the packet storage unit 23 together with the operation information received by the operation information reception unit 21 (step S23). Further, the packet collection / recording unit 22 transmits the collected packets and the operation information received by the operation information receiving unit 21 to the packet analysis unit 24.

  Here, FIG. 9 is a diagram for explaining a packet and operation information stored in the packet storage unit 23.

  As shown in FIG. 9, the packet storage unit 23 stores an HTTP packet 231, operation information 232 to 234, and an HTTP packet 235. The HTTP packet 231 and the HTTP packet 235 are packets by HTTP communication and are packets collected by the packet collection recording unit 22. The operation information 232 to 234 is operation information received by the operation information receiving unit 21.

  As shown in FIG. 9, the packets (HTTP packet 231 and HTTP packet 235) collected by the packet collection and recording unit 22 and the operation information (operation information 232 to 234) received by the operation information receiving unit 21 are collected or The packets are stored in the packet storage unit 23 in the order received, that is, in time series.

  Returning to FIG. 8 again, the packet analysis unit 24 analyzes one or more packets transmitted by the packet collection / recording unit 22, and thereby transmits one communication content (content) from the one or more packets. Reconstruction is performed (step S24). At this time, the packet analysis unit 24 extracts an HTTP request or an HTTP reply from the reconstructed content. (Step S24). The packet analysis unit 24 transmits the reconstructed content (HTTP request or HTTP reply) and the operation information transmitted by the packet collection / recording unit 22 to the analysis result recording / playback unit 25. This operation information is operation information including event information generated for the reconstructed content.

  The analysis result recording / playback unit 25 stores the content and operation information transmitted by the packet analysis unit 24 in association with each other in the analysis result storage unit 26.

  Here, it is assumed that a search condition is specified by the user in order to search the content stored in the analysis result storage unit 26. This search condition is specified by, for example, a user using the management server 30 operating the management server 30. In this case, the analysis result recording / playback unit 25 searches the analysis result storage unit 26 for content that matches the search condition specified by the user (step S25). Further, the analysis result recording / reproducing unit 25 acquires operation information stored in the analysis result storage unit 26 in association with the searched content.

  The analysis result recording / playback unit 25 transmits the searched content and the acquired operation information to the management server 30 (step S26).

  Next, the processing procedure of the management server 30 will be described with reference to the flowchart of FIG.

  Here, when the communication content (content) is reproduced (reproduced) in the management server 30, the user using the management server 30 stores it in the analysis result storage unit 26 included in the communication monitoring recording / reproducing apparatus 20 as described above. Specify the search conditions for searching the content that has been added. In this case, the search condition specified by the user is notified to the communication monitoring recording / reproducing apparatus 20, and the content that matches the search condition and the operation information associated with the content are transmitted as a response to the search condition. In the management server 30, the reproduction process is executed based on the content and the operation information transmitted by the communication monitoring recording / reproducing apparatus 20.

  First, the content receiving unit 31 receives the content transmitted by the analysis result recording / reproducing unit 25 included in the communication monitoring recording / reproducing device 20 (step S31).

  Next, the communication content reproduction unit 34 displays an initial screen image on the browser of the management server 30 from the content received by the content reception unit 31 (step S32).

  The operation information receiving unit 32 receives the operation information transmitted by the analysis result recording / reproducing unit 25 included in the communication monitoring recording / reproducing device 20 (step S33).

  The event generation unit 33 reads the operation information received by the operation information reception unit 32, and generates an event corresponding to the event type included in the operation information (step S34). For example, when the event type is a keyboard event, an event is generated based on a keyboard press or release event and a key code included in the operation information received by the operation information receiving unit 32. On the other hand, for example, when the event type is a mouse event, an event is generated based on the mouse click, movement event, and mouse cursor position when the mouse event occurs included in the operation information received by the operation information receiving unit 32. . In the case of an event other than a keyboard event and a mouse event, an event corresponding to the event type included in the operation information received by the operation information receiving unit 32 is generated.

  Based on the DOM object included in the operation information received by the operation information reception unit 32, the communication content reproduction unit 34 generates an event generated by the event generation unit 33 for the target DOM object via the browser API. Transmit (step S35). When the event is transmitted, an operation (event) performed by the user using the terminal 10 can be generated with respect to the initial screen image (content) displayed in step S32 described above. Thereby, it is possible to reproduce a screen image that dynamically changes according to the event that has occurred.

  When the event is transmitted by the communication content reproduction unit 34, the next event is performed after the time interval (event interval) until the next event occurrence according to the time included in the operation information received by the operation information receiving unit 32. Send. Thereby, by causing an event to occur at the same interval as the event that occurred in the terminal 10, it is possible to reproduce the screen transition at the same speed as the content (communication content) displayed on the browser of the terminal 10.

  Note that when reproducing communication contents, it is not always necessary to reproduce at the same time (speed) as the time included in the operation information. For example, an event is transmitted at a time interval that is ½ of the recorded time interval. Thus, it is possible to reproduce the screen transition at twice the speed.

  As described above, in the present embodiment, the operation information related to the operation performed on the terminal 10 by the user is collected and recorded (stored) together with the packet. In the present embodiment, when the reconstructed communication content (content) is reproduced, the content and operation information are transmitted to the management server 30. Thereby, in the management server 30, since the event generated based on the operation information is transmitted to the DOM object included in the operation information, the event (at the location specified by the DOM object at the time of reproducing the content ( Operation) can be reproduced. Therefore, in this embodiment, content such as dynamic HTML in which the screen displayed on the browser is dynamically changed by the user's keyboard operation or mouse operation is displayed on the terminal 10 without analyzing the content or script. Even in such a case, the screen displayed on the browser of the terminal 10 can be reproduced.

[Second Embodiment]
Next, a communication monitoring recording / reproducing system according to the second embodiment of the present invention will be described with reference to FIGS.

  The communication monitoring recording / reproducing system according to the present embodiment replaces the terminal 10, the communication monitoring recording / reproducing apparatus 20, and the management server 30 of the first embodiment described above with a terminal (first terminal) 100, a communication monitoring recording / reproducing system. An apparatus 200 and a management server (second terminal) 30 are provided. The network system to which the communication monitoring recording / reproducing system according to the present embodiment is connected is the same as that of the first embodiment described above, and will be described with reference to FIG.

  FIG. 11 is a block diagram mainly showing a functional configuration of the terminal 100 constituting the communication monitoring recording / reproducing system according to the present embodiment. Note that, for example, a browser is installed in the terminal 100 as in the terminal 10 of the first embodiment described above, and content read from the Web server 50 is displayed by the browser.

  As illustrated in FIG. 11, the terminal 100 includes an image collection condition table 101, an image acquisition unit 102, an image management table 103, and an image transmission unit 104.

  Here, the image acquisition unit 102 and the image transmission unit 104 are dynamically incorporated as plug-ins in a browser installed in the terminal 100.

  In the image collection condition table 101, when content (communication content) is displayed on the terminal 10 (screen), the condition (information indicating the content) for which the screen image is to be acquired (collected) is stored in advance. Retained. In the image collection condition table 101, a URL indicating the position of the content on the network and the content type of the content are held in association with each other as a condition of the content for which the screen image is acquired. That is, since the data structure itself of the image collection condition table 101 is the same as the operation information collection condition table 11 of the first embodiment described above, detailed description thereof is omitted.

  When the browser installed in the terminal 100 reads content from the Web server 50, the image acquisition unit 102 acquires the URL and content type included in the content. The image acquisition unit 102 determines whether the acquired URL and content type match the conditions held in the image collection condition table 101.

  When an operation (event) performed by the user using the terminal 100 with respect to the content read by the browser occurs, the image acquisition unit 102 acquires event information regarding the generated event. The image acquisition unit 102 acquires screen image information indicating the screen image of the content displayed on the terminal 100 according to the acquired event information. That is, the image acquisition unit 102 acquires screen image information indicating a screen image that has dynamically changed (updated) according to the event that has occurred. This screen image information includes event information generated for the content. The image acquisition unit 102 acquires screen image information via the browser API. The image acquisition unit 102 registers the acquired screen image information in the image management table 103.

  The image management table 103 holds screen image information acquired by the image acquisition unit 102. The screen image information held in the image management table 103 includes an event occurrence time, event information, screen image coordinates, a screen image size, and an identifier for identifying the screen image.

  When a predetermined number of screen image information is registered in the image management table 103, the image transmission unit 104 performs communication monitoring recording / playback of the screen image information held in the image management table 103 via the network 60. To device 200.

  FIG. 12 is a block diagram mainly showing a functional configuration of the communication monitoring recording / reproducing apparatus 200 constituting the communication monitoring recording / reproducing system according to the present embodiment. As shown in FIG. 12, the communication monitoring recording / reproducing apparatus 200 includes an image receiving unit 201, a packet collection / recording unit 202, a packet storage unit 203, a packet analysis unit 204, an analysis result recording / reproduction unit 205, and an analysis result storage unit 206. .

  The image reception unit 201 receives screen image information transmitted by the image transmission unit 104 included in the terminal 100.

  The packet collection / recording unit 202 collects packets on the network 60 to be monitored by the communication monitoring recording / reproducing apparatus 200. The packet collection / recording unit 202 collects packets via the switch 70. The packet collection / recording unit 202 stores the collected packets in the packet storage unit 203 together with the image information received by the image reception unit 201. Further, the packet collection / recording unit 202 transmits the screen image information received by the image receiving unit 201 and the collected packets to the packet analysis unit 204.

  The packet analysis unit 204 reconstructs one communication content from the one or more packets by analyzing the one or more packets transmitted by the packet collection and recording unit 202. Thereby, the packet analysis unit 204 extracts, for example, an HTTP request or an HTTP reply (content), and transmits it to the analysis result recording / playback unit 205 together with the screen image information transmitted by the packet collection recording unit 202.

  The analysis result recording / playback unit 205 stores the content and screen image information transmitted by the packet analysis unit 204 in association with each other in the analysis result storage unit 206. Further, the analysis result recording / playback unit 205 has a function of searching the analysis result storage unit 206 for content that matches the search condition, for example, according to the search condition specified by the user using the management server 300. The analysis result recording / playback unit 205 transmits the content that is the search result and the screen image information associated with the content to the management server 300.

  FIG. 13 is a block diagram mainly showing a functional configuration of the management server 300 constituting the communication monitoring recording / reproducing system according to the present embodiment. The same parts as those in FIG. 4 are denoted by the same reference numerals, and detailed description thereof is omitted. Here, parts different from FIG. 4 will be mainly described. Further, similarly to the management server 30 of the first embodiment described above, for example, a browser is installed in the management server 300, and content read from the Web server 50 is displayed by the browser.

  As illustrated in FIG. 13, the management server 300 includes an image reception unit 301, an image generation unit 302, and a communication content reproduction unit 303.

  Here, the image reception unit 301, the image generation unit 302, and the communication content reproduction unit 303 are dynamically incorporated as plug-ins in the browser installed in the management server 300.

  The image receiving unit 301 receives the screen image information transmitted by the analysis result recording / reproducing unit 205 included in the communication monitoring recording / reproducing apparatus 200.

  The image generation unit 302 generates a screen image having the size of the screen image included in the screen image information at the coordinate position of the screen image included in the screen image information received by the image reception unit 301.

  The communication content reproduction unit 303 displays the screen image generated by the image generation unit 302 via the browser API. Thereby, the screen displayed on the browser of the terminal 100 is reproduced on the browser of the management server 300.

  FIG. 14 shows an example of the data structure of the screen image information held in the image management table 103 shown in FIG. As shown in FIG. 14, the screen image information includes time, event type, cursor position, screen image coordinates, screen image size, and screen image identifier. The time indicates the time when the event occurred. The event type indicates an event type such as a keyboard event or a mouse event. The cursor position indicates the mouse cursor position when the event occurs. The screen image coordinate indicates the coordinate position of the screen image. The screen image size indicates the size of the screen image. The screen image identifier is an identifier used for identifying a screen image.

  In the example shown in FIG. 14, the screen image information 103 a includes time “2007/09/03 9: 00: 00.1234”, event type “right mouse click”, cursor position “100, 200”, screen image coordinates “ 50, 200 ”, screen image size“ 100, 100 ”, and screen image identifier“ 1 ”are included. The screen image information 103b includes time “2007/09/03 9: 00: 01.3456”, event type “key press”, cursor position “100, 200”, screen image coordinates “50, 400”, screen The image size “100, 100” and the screen image identifier “2” are included.

  Next, the processing procedure of the terminal 100 will be described with reference to the flowchart of FIG. First, when the browser of the terminal 100 reads content from the Web server 50, the image acquisition unit 102 acquires the URL and content type included in the content (step S41).

  The image acquisition unit 102 determines whether the acquired URL and content type are stored in the image collection condition table 1 (step S42).

  When it is determined that the acquired URL and content type are held in the image collection condition table 11 (YES in step S42), the image acquisition unit 102 sets the image collection selection flag for the content read by the browser of the terminal 100. Is set to ON (step S43).

  Here, for example, an event occurs in the browser when the user performs an operation on the browser (content displayed in the browser) or when the reading of the Web page is completed. When an event occurs, the occurrence of the event is notified to the image acquisition unit 12 via the browser API (step S44).

  When the occurrence of the event is notified, the image acquisition unit 102 determines whether or not the image collection selection flag of the content in which the event has occurred is ON (step S45).

  If it is determined that the image collection selection flag is ON (YES in step S45), event information such as a keyboard event or a mouse event is acquired from the browser. This event information includes an event type indicating a keyboard event or a mouse event, and a cursor position.

  The image acquisition unit 102 acquires screen image information indicating the screen image of the content displayed on the terminal 100 (browser screen image) according to the acquired event information (step S46). The image acquisition unit 102 acquires screen image information via a browser API.

  At this time, for example, when the entire screen image of the browser of the terminal 100 is updated due to the generated event, the image acquisition unit 102 acquires screen image information indicating the full screen image of the browser. On the other hand, for example, when only a part of the browser screen image of the terminal 100 is updated due to an event that has occurred, the image acquisition unit 102 displays screen image information indicating only the updated part (difference) of the browser screen image. To get.

  In this case, whether the entire screen image has been updated by storing the screen image information before the update on the disk of the terminal 100 and comparing the screen image information before the update with the screen image information after the update, Alternatively, it can be determined whether a part has been updated.

  The image acquisition unit 12 registers the acquired screen image information in the image management table 103 (step S47).

  Next, the image transmission unit 104 determines whether or not the number of screen image information registrations in the image management table 103 is greater than or equal to a threshold (step S48).

  When it is determined that the registration number of the screen image information is equal to or greater than the threshold (YES in step S48), the image transmission unit 104 records the screen image information held in the image management table 103 via the network 60 for monitoring and recording. The data is transmitted to the playback device 200 (step S49). When transmitting the screen image information, the screen image information can be transmitted after being compressed in order to reduce the amount of traffic. Further, when transmission to the communication monitoring recording / reproducing apparatus 200 fails, a configuration may be adopted in which data is temporarily stored in the disk of the terminal 100 and retransmitted later.

  When the screen image information is transmitted to the communication monitoring recording / reproducing apparatus 200, the image transmission unit 104 deletes (clears) the screen image information held in the image management table 103 from the image management table 103 (step S50). .

  On the other hand, if it is determined in step S42 that the URL and content type are not held in the image collection condition table 101, the image collection selection flag of the content read by the browser of the terminal 100 is set to OFF (step S51). When the process of step S51 is executed, the process of step S44 is executed.

  If it is determined in step S45 that the image collection selection flag is not ON, that is, it is determined to be OFF, the process ends. If it is determined in step S48 that the number of registered screen image information is not greater than or equal to the threshold value, the process ends.

  Next, the processing procedure of the communication monitoring recording / reproducing apparatus 200 will be described with reference to the flowchart of FIG.

  First, the packet collection / recording unit 202 collects packets on the network 60 (step S61).

  Next, the image receiving unit 201 receives the screen image information transmitted by the image transmitting unit 104 included in the terminal 100 (step S62).

  The packet collection / recording unit 202 stores the collected packets in the packet storage unit 203 together with the screen image information received by the image reception unit 201 (step S63). Further, the packet collection / recording unit 202 transmits the collected packets and the screen image information received by the image reception unit 201 to the packet analysis unit 204.

  The packet analysis unit 204 reconstructs one communication content (content) from the one or more packets by analyzing the one or more packets transmitted by the packet collection and recording unit 202 (step S64). ). At this time, the packet analysis unit 204 takes out an HTTP request or an HTTP reply from the reconstructed content (step S64). The packet analysis unit 204 transmits the reconstructed content (HTTP request or HTTP reply) and the screen image information transmitted by the packet collection / recording unit 202 to the analysis result recording / playback unit 205. This screen image information is screen image information including event information generated for the reconstructed content.

  The analysis result recording / playback unit 205 stores the content and screen image information transmitted by the packet analysis unit 204 in association with each other in the analysis result storage unit 206.

  Here, it is assumed that a search condition is specified by the user in order to search the content stored in the analysis result storage unit 206. This search condition is specified by a user using the management server 300 operating the management server 300, for example. In this case, the analysis result recording / playback unit 205 searches the analysis result storage unit 206 for content that matches the search condition specified by the user (step S65). Also, the analysis result recording / playback unit 205 acquires screen image information stored in the analysis result storage unit 206 in association with the searched content.

  The analysis result recording / playback unit 205 transmits the searched content and the acquired screen image information to the management server 300 (step S66).

  Next, the processing procedure of the management server 300 will be described with reference to the flowchart of FIG.

  Here, when the communication contents (contents) are reproduced (reproduced) in the management server 300, the user using the management server 300 stores in the analysis result storage unit 206 included in the communication monitoring recording / reproducing apparatus 200 as described above. Specify the search conditions for searching the content that has been added. In this case, the search condition specified by the user is notified to the communication monitoring recording / reproducing apparatus 200, and the content that matches the search condition and the screen image information associated with the content are transmitted as a response to the search condition. . In the management server 300, the reproduction process is executed based on the content and screen image information transmitted by the communication monitoring recording / reproducing apparatus 200.

  First, the processing of step S71 and step S72 corresponding to step S31 and step S32 shown in FIG. 10 described above is executed.

  Next, the image receiving unit 301 receives the screen image information transmitted by the analysis result recording / reproducing unit 205 included in the communication monitoring recording / reproducing apparatus 200 (step S73).

  The image generation unit 302 reads the screen image information received by the image reception unit 301 and generates a screen image according to the screen image coordinates and the screen image size included in the screen image information (step S74). In other words, the image generation unit 302 applies a screen image (updated screen image) of the screen image size included in the screen image information to the position of the screen image coordinates included in the screen image information received by the image reception unit 301. Generate.

  The communication content reproduction unit 303 displays the screen image generated by the image generation unit 302 via the browser API (step S75). As a result, a screen image (updated screen image) that is dynamically changed by a user operating the terminal 10 on the initial screen image (content) displayed in step S72 described above is reproduced. be able to.

  Depending on the time included in the screen image information received by the image reception unit 301, the communication content reproduction unit 303 performs the next screen until the next event occurs, that is, after the time interval until the next screen image is updated. Display an image. As a result, screen transitions can be reproduced at the same speed as the content displayed on the browser of the terminal 100 by displaying the screen image at the same interval as the event that occurred in the terminal 100.

  When reproducing the content of communication, for example, screen images are reduced in thumbnail format in time series and displayed as a list, and the user is allowed to select a screen image, and the selected screen image is displayed in a specified size. It is also possible to make it.

  As described above, in this embodiment, screen image information indicating a screen image updated in accordance with an operation performed by the user on the terminal 100 is collected and recorded (stored) together with the packet. In the present embodiment, when the reconstructed communication content (content) is reproduced, the content and screen image information are transmitted to the management server 300. Thereby, in the management server 300, the screen image updated according to the screen image information according to the occurrence time of the event is displayed. Therefore, in the present embodiment, there is a case where content such as dynamic HTML in which the screen displayed on the browser is dynamically changed by the user's operation is displayed on the terminal 100 without analyzing the content or script. However, the screen displayed on the browser of the terminal 100 can be reproduced.

[Third Embodiment]
Next, a communication monitoring recording / reproducing system according to the third embodiment of the present invention will be described with reference to FIG.

  The communication monitoring recording / reproducing system according to the present embodiment includes a terminal 110 instead of the terminal 10 of the first embodiment described above.

  FIG. 18 is a block diagram mainly showing a functional configuration of the terminal 110 constituting the communication monitoring recording / reproducing system according to the present embodiment. The same parts as those in FIG. 2 described above are denoted by the same reference numerals, and detailed description thereof is omitted. Here, parts different from FIG. 2 will be mainly described.

  As illustrated in FIG. 18, the terminal 110 includes an operation information storage processing unit 111 and an operation information storage unit 112.

  Here, the operation information storage processing unit 111 is dynamically incorporated as a plug-in in a browser installed in the terminal 110.

  When a predetermined number of pieces of operation information are registered in the operation information management table 13, the operation information storage processing unit 111 stores the operation information held in the operation information management table 13 in the operation information storage unit 112 ( Save) is executed. The operation information storage unit 112 is a disk such as a hard disk drive (HDD).

  When the operation information is stored in the operation information storage unit 112, the configuration may be such that the operation information can be selected to be compressed and stored.

  When the operation information held in the operation information management table 13 by the operation information storage processing unit 111 is normally stored in the operation information storage unit 112, the operation information held in the operation information management table 13 is changed to the operation information. It is deleted (cleared) from the management table 13.

  That is, in the present embodiment, the operation monitoring information is not managed (stored) in the communication monitoring recording / reproducing apparatus 20. When a communication content reproduction process is executed in the management server 30, the communication monitoring recording / reproducing apparatus 20 reads operation information corresponding to the reproduced content from the operation information storage processing unit 111 via the network 60 and manages it. Send to server 30. Thereby, in the management server 30, the screen displayed on the browser of the terminal 10 is reproduced based on the transmitted operation information. In the present embodiment, operations other than this point are the same as those in the first embodiment described above, and a detailed description thereof will be omitted.

  In the first embodiment described above, all the collected (acquired) operation information is transmitted to the communication monitoring recording / reproducing apparatus 20 via the network 60. As described above, in the present embodiment, the management server 30 performs communication. When the content reproduction process is executed, only necessary operation information is read by the communication monitoring recording / reproducing apparatus 20 via the network 60, so that the amount of data required for communication between the terminal 10 and the communication monitoring recording / reproducing apparatus 20 ( Traffic volume) can be reduced.

[Fourth Embodiment]
Next, a communication monitoring recording / reproducing system according to the fourth embodiment of the present invention will be described with reference to FIG.

  FIG. 19 is a diagram for explaining a network system to which the communication monitoring recording / reproducing system according to the present embodiment is connected. Note that portions similar to those in FIG. 1 described above are denoted by the same reference numerals, and detailed description thereof is omitted. Here, parts different from FIG. 1 will be mainly described.

  The communication monitoring recording / reproducing system according to the present embodiment includes a communication monitoring recording / reproducing apparatus 210 instead of the communication monitoring recording / reproducing apparatus 20 of the first embodiment described above. This communication monitoring recording / reproducing apparatus 210 is connected to a proxy server (relay apparatus) 80 via a network 60. The proxy server 80 has a function of relaying communication between the terminal 10 and the Web server.

  FIG. 20 is a block diagram mainly showing a functional configuration of the communication monitoring recording / reproducing apparatus 210 shown in FIG. The same parts as those in FIG. 3 described above are denoted by the same reference numerals, and detailed description thereof is omitted. Here, a different part from FIG. 3 is described.

  The communication monitoring recording / reproducing apparatus 210 includes a detection unit 211 and a communication control instruction unit 212. The detecting unit 211 determines whether or not the packet collected by the packet collection and recording unit 22 is a packet transmitted from the terminal 10 having a function of collecting operation information. That is, the detection unit 211 determines whether the packet collected by the packet collection recording unit 22 is a packet transmitted from the terminal 10 in which the operation information acquisition unit 12 and the operation information transmission unit 14 are incorporated in the browser as plug-ins. Determine whether.

  Specifically, the detection unit 211 includes operation information including event information (hereinafter, operation information corresponding to a packet) generated for communication contents (contents) reconstructed from the packet collected by the packet collection and recording unit 22. ) Is received based on whether or not it is received by the operation information receiving unit 21.

  The detection unit 211 notifies the communication control instruction unit 212 whether or not the operation information corresponding to the packet collected by the packet collection and recording unit 22 has been received by the operation information reception unit 21.

  When the communication control instruction unit 212 is notified by the detection unit 211 that the operation information corresponding to the packet collected by the packet collection recording unit 22 has not been received by the operation information reception unit 21, for example, the communication control instruction unit 212 is included in the packet. The proxy server 80 is instructed to block communication between the terminal 10 to which the IP address is assigned and the Web server 50. By this instruction, the proxy server 80 is set so as not to respond even when an HTTP request is received from the terminal 10, for example. Thereby, the communication between the terminal 10 and the Web server 50 is blocked.

  On the other hand, when the communication control instruction unit 212 is notified that the operation information corresponding to the packet collected by the packet collection and recording unit 22 by the detection unit 211 is received by the operation information reception unit 21, for example, the communication control instruction unit 212 The proxy server 80 is instructed to enable communication between the terminal 10 to which the included IP address is assigned and the Web server 50. By this instruction, the proxy server 80 is set to respond to the request when an HTTP request is received from the terminal 10, for example.

  As described above, in this embodiment, when a packet transmitted from the terminal 10 that does not have a function of collecting operation information is collected by the packet collection recording unit 22, the terminal 10 that has transmitted the packet, the Web server 50, The proxy server 80 is instructed to block communication between the terminal 10 and the proxy server 80 blocks communication between the terminal 10 and the Web server 50.

  As described above, in the present embodiment, for example, a terminal that does not have a function of collecting operation information when trying to reproduce content such as dynamic HTML in which a screen displayed on a browser is dynamically changed by a user operation. Since the operation information cannot be collected from 10, the content cannot be reproduced. Therefore, in the present embodiment, communication from the terminal 10 that cannot reproduce the communication content (content) to the Web server 50 can be blocked.

  Note that the present invention is not limited to the above-described embodiments as they are, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the above embodiments. For example, some components may be deleted from all the components shown in each embodiment. Furthermore, you may combine the component covering different embodiment suitably.

The figure for demonstrating the network system to which the communication monitoring recording / reproducing system which concerns on the 1st Embodiment of this invention is connected. The block diagram which mainly shows the function structure of the terminal 10 shown in FIG. The block diagram which mainly shows the function structure of the communication monitoring recording / reproducing apparatus 20 shown in FIG. The block diagram which mainly shows the function structure of the management server 30 shown in FIG. The figure which shows an example of the data structure of the operation information collection condition table 11 shown in FIG. The figure which shows an example of the data structure of the operation information hold | maintained at the operation information management table 13 shown in FIG. 6 is a flowchart showing a processing procedure of the terminal 10. The flowchart which shows the process sequence of the communication monitoring recording / reproducing apparatus. The figure for demonstrating the packet and operation information which were stored in the packet storage part. 5 is a flowchart showing a processing procedure of the management server 30. The block diagram which mainly shows the function structure of the terminal 100 which comprises the communication monitoring recording / reproducing system which concerns on the 2nd Embodiment of this invention. 1 is a block diagram mainly showing a functional configuration of a communication monitoring recording / reproducing apparatus 200 constituting a communication monitoring recording / reproducing system according to the present embodiment. The block diagram which shows the function structure mainly of the management server 300 which comprises the communication monitoring recording / reproducing system which concerns on this embodiment. FIG. 12 is a diagram showing an example of a data structure of screen image information held in the image management table 103 shown in FIG. 11. The flowchart which shows the process sequence of the terminal 100. FIG. The flowchart which shows the process sequence of the communication monitoring recording / reproducing apparatus. 5 is a flowchart showing a processing procedure of the management server 300. The block diagram which mainly shows the function structure of the terminal 110 which comprises the communication monitoring recording / reproducing system which concerns on the 3rd implementation liquid of this invention. The figure for demonstrating the network system to which the communication monitoring recording / reproducing system which concerns on the 4th Embodiment of this invention is connected. FIG. 20 is a block diagram mainly showing a functional configuration of the communication monitoring recording / reproducing apparatus 210 shown in FIG. 19.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10,100,110 ... Terminal (1st terminal), 11 ... Operation information collection condition table, 12 ... Operation information acquisition part, 13 ... Operation information management table, 14 ... Operation information transmission part, 20, 200, 210 ... Communication Monitoring recording / reproducing apparatus, 21... Operation information receiving unit, 22, 202... Packet collection and recording unit, 23, 203... Packet storing unit, 24, 204 ... packet analyzing unit, 25, 205. ... Analysis result storage unit, 30, 300 ... Management server (second terminal), 31 ... Content reception unit, 32 ... Operation information reception unit, 33 ... Event generation unit, 34,303 ... Communication content reproduction unit, 40 ... Internet 50 ... Web server 60 ... Network 70 ... Switch 80 ... Proxy server 101 101 Image collection condition table 102 Image acquisition unit DESCRIPTION OF SYMBOLS 03 ... Image management table 104 ... Image transmission part 111 ... Operation information storage process part 112 ... Operation information storage part 201 ... Image reception part 211 ... Detection part 212 ... Communication control instruction | indication part 301 ... Image reception part 302 Image generating unit.

Claims (5)

In a communication monitoring recording / reproducing apparatus connected to a network capable of communicating packets in which communication contents between a first terminal and a server are divided,
Packet collection means for collecting packets on the network;
Operation information receiving means for receiving, from the first terminal, operation information related to an operation performed by a user using the first terminal for the communication content displayed on the first terminal;
Packet analysis means for reconstructing the communication content from the packets collected by the packet collection means;
Analysis result storage means for storing the communication contents reconstructed by the packet analysis means and the operation information received by the operation information receiving means in association with each other;
The reconstructed communication content stored in the analysis result storage unit is associated with the reconstructed communication content and the operation information stored in the analysis result storage unit in association with the reconstructed communication content. And a transmission means for transmitting to a second terminal having a function of displaying the communication monitoring recording / reproducing apparatus. In accordance with a search condition specified by the user, further comprising a search means for searching the reconstructed communication content that matches the search condition from the analysis result storage means,
The transmission means sends the reconstructed communication content searched by the search means and the operation information stored in the analysis result storage means in association with the reconstructed communication content to the second terminal. The communication monitoring recording / reproducing apparatus according to claim 1, wherein transmission is performed. A determination unit that determines whether the operation information transmitted from the first terminal is received by the operation information reception unit after the packet is collected by the packet collection unit;
When it is determined that the operation information is not received by the operation information receiving means, the communication between the first terminal and the server is interrupted with respect to the relay device that relays the communication between the first terminal and the server. The communication monitoring recording / reproducing apparatus according to claim 1, further comprising instruction means for instructing. In a communication monitoring recording / reproducing apparatus connected to a network capable of communicating packets in which communication contents between a first terminal and a server are divided,
Packet collection means for collecting packets on the network;
Image receiving means for receiving screen image information indicating a screen image of communication contents displayed on the first terminal;
Packet analysis means for reconstructing the communication content from the packets collected by the packet collection means;
Analysis result storage means for storing the communication contents reconstructed by the packet analysis means and the screen image information received by the image reception means in association with each other;
The reconstructed communication content stored in the analysis result storage means is associated with the reconstructed communication content and the screen image information stored in the analysis result storage means in association with the reconstructed communication content. And a transmission means for transmitting to a second terminal having a function of displaying contents. A communication monitoring recording / reproducing apparatus connected to a network capable of communicating a packet in which communication contents between the first terminal and the server are divided, and a first terminal connected to the communication monitoring recording / reproducing apparatus. In a communication monitoring recording / reproducing system comprising two terminals,
The first terminal is
An operation information collection condition table for preliminarily holding conditions of communication contents for collecting operation information related to operations performed by the user using the first terminal with respect to the communication contents displayed on the first terminal. When,
Determination means for determining whether the communication content between the first terminal and the server matches a condition held in the operation information collection condition table;
When it is determined that the condition held in the operation information collection condition table is met, the communication content displayed on the first terminal is related to the operation performed by the user using the first terminal. Operation information collecting means for collecting operation information;
An operation information management table for holding operation information collected by the operation information collecting means;
First transmission means for transmitting the operation information held in the operation information management table to the communication monitoring recording / reproducing apparatus,
The communication monitoring recording / reproducing apparatus comprises:
Packet collection means for collecting packets on the network;
Operation information receiving means for receiving operation information transmitted by the first transmission means;
Packet analysis means for reconstructing the communication content from the packets collected by the packet collection means;
Analysis result storage means for storing the communication contents reconstructed by the packet analysis means and the operation information received by the operation information receiving means in association with each other;
The reconstructed communication contents stored in the analysis result storage means and the operation information stored in the analysis result storage means in association with the reconstructed communication contents are transmitted to the second terminal. Second transmitting means for
The second terminal displays the communication content transmitted by the second transmission unit, and is executed on the displayed communication content based on the operation information transmitted by the second transmission unit. A communication monitoring recording / reproducing system comprising reproduction means for reproducing the communication content displayed on the first terminal by generating an operation.

Images