JP2010140249A - Input monitoring apparatus and input monitoring method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an input monitoring apparatus and an input monitoring method that reduce the processing load of monitoring input. <P>SOLUTION: The input monitoring apparatus 2 detects a change in the operation state of an application, and if the application conforms to a rule in which the necessity of monitoring is set, sets a monitoring flag indicating whether or not monitoring is necessary according each rule. If the set flag indicates that monitoring is necessary, content input by a user is sent to a list matching apparatus 3, which examines it. Only when the operation state of the application changes, the content of input is monitored without specifying the content input by the user, so that the number of list matching operations is reduced as compared with when monitoring all the input, thereby reducing the load of processing. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an input monitoring apparatus and an input monitoring method using the same.

  In recent years, with the spread of mobile phones and the development of the Internet environment, access to the Internet has become familiar regardless of age or location. For this reason, for example, in order to prevent (filter) in advance a search for a Web site with inappropriate content for children, it is necessary to monitor the content input when searching for information on the Internet.

  When monitoring the input content (characters) input from the user as described above, the input content is collated with a list in which a preset word is held, and the input content is set in the list. It is determined whether or not it is a word. As a method for acquiring the input content, for example, there is a method described in Patent Document 1.

However, when communication resources are limited as in the case of a cellular phone, the processing (transfer) load (overhead) is large and inefficient if the input contents are collated with the list one by one. Therefore, as described in Patent Document 2, for example, there is a technique that reduces the processing load by storing contents that have been input and verified once for each category.
JP 2008-181360 A JP 2001-14041 A

  However, the conventional technique has the following problems. That is, in the above technique, it is necessary to collate the inputted character with the list at least once. For this reason, it is effective when there is a bias in the content input by the user, but when there are a wide variety of input content, such as Web site search and email creation, the same processing as normal monitoring processing is performed. The load cannot be reduced. Therefore, in a cellular phone or the like with limited communication resources, it is an issue to reduce the processing load in monitoring input contents.

  Therefore, the present invention has been made in view of such problems, and an object thereof is to provide an input monitoring apparatus and an input monitoring method capable of reducing a processing load in monitoring input contents.

  In order to solve the above problems, an input monitoring apparatus according to the present invention is an input monitoring apparatus that acquires input contents input to a terminal by a user and monitors the input contents, and is an application executed on the terminal Monitoring setting means for holding a rule in which the presence or absence of monitoring is set for each type, and a change in the operating state of an application executed on the terminal is detected, and the application in which the change is detected corresponds to the rule of the monitoring setting means In the case of an application, a monitoring flag setting unit that sets a monitoring flag indicating whether monitoring is performed according to a rule, and a list in which predetermined contents are set in advance when a flag indicating monitoring is set by the monitoring flag setting unit The input content is sent to the list matching device that matches the input content based on the Characterized in that it and a test unit.

  Alternatively, the input monitoring method of the present invention is an input monitoring method by an input monitoring device that acquires input content input to a terminal by a user and executes monitoring of the input content, and includes an application executed on the terminal. When a change in the operating state is detected, and the application in which the change is detected is an application corresponding to a rule in which monitoring is set for each type of application, a monitoring flag indicating whether monitoring is set is set according to the rule. When the flag indicating that there is monitoring is set in the monitoring flag setting step and the monitoring flag setting step, the input content is transmitted to a list collation device that collates the input content based on a list in which predetermined content is set in advance. An inspection step for causing the list collating device to inspect the input contents.

  According to such an input monitoring device, when a change in the operating state of an application is detected and the application falls under a rule in which monitoring is set, a monitoring flag indicating whether monitoring is set is set according to the rule. The And when the flag which shows execution of an audit is set, the input content inputted from the user is transmitted to a list collation device, and the input content is examined. Therefore, since it is only necessary to monitor the input contents only when the operation state of the application is changed, the processing load can be reduced as compared with the case where all the input contents are monitored.

  Further, when a plurality of changes in the operating state of the application executed on the terminal are detected, the monitoring flag setting unit preferably sets the monitoring flag with priority on the application that is the operation target of the user. In this case, it is not necessary to perform background application determination processing that is not used by the user, so that the processing load can be reduced.

  In addition, when a plurality of changes in the operating state of the application executed on the terminal are detected, the monitoring flag setting means indicates that there is monitoring when there are one or more rules set to be monitored in the plurality of applications. It is preferable to set a monitoring flag. In this case, even when a plurality of applications corresponding to the rules of the monitoring setting unit are executed, it is possible to reliably prevent the inspection of the input content from being missed.

  The monitoring setting means holds a rule in which the presence or absence of monitoring is set for each attribute indicating the presence or absence of the communication function in the application, and the monitoring flag setting means is executed in the terminal based on the rule. It is preferable to set a monitoring flag indicating that there is monitoring when it is determined that the application has a communication function or another application that cooperates with the application executed on the terminal has the communication function. . In this case, even if the application being executed does not have a communication function, the application communicates with other applications in cooperation (via), so that the input content is in an unchecked state. It is possible to prevent the input contents from being used in the application.

  The monitoring setting means holds a rule in which monitoring is set according to the setting state of the filtering function for browsing the website when the terminal connects via the network. The monitoring flag setting means When it is determined that the website browsing filtering function is set, it is preferable to set a monitoring flag indicating no monitoring. In this case, when the filtering function for browsing the website is set, the inspection of the input content is not executed. Therefore, the number of inspections is larger than when the presence / absence of monitoring of the input content is set only at the terminal. Can be reduced. Therefore, the processing load can be further reduced.

  In addition, the information acquisition unit further acquires user information about the user, and the monitoring flag setting unit acquires the user attribute based on the user information acquired by the information acquisition unit, and determines a rule to be applied according to the attribute. Thus, it is preferable to set a monitoring flag indicating the presence or absence of monitoring. In this case, for example, by acquiring user information by a telephone number or the like, the user attribute is acquired, the rule to be applied is determined according to the attribute, and the presence or absence of monitoring is set. In addition to the above rules, it is possible to set rules adapted to the attributes and usage status of the user using the terminal.

  The monitoring setting means holds a rule in which whether or not to monitor is set according to the operation state of the application related to the user input operation, and the monitoring flag setting means sets the monitoring flag according to the rule. It is preferable. In this case, it is possible to set the inspection of the input contents of the user in more detail.

  The monitoring setting unit holds a rule in which monitoring is set for each function that assists the user's input called from the application. The monitoring flag setting unit sets the function called from the application to the terminal A function that outputs a word and a sentence set in advance, or a function that outputs a word and a sentence registered by the user, and a rule monitors the type of application used when registering the word and the sentence When it is set to “Yes”, it is preferable to set a monitoring flag indicating no monitoring. In this case, since the monitoring is not executed in the above case, the number of times of inspection of the input content can be reduced. Therefore, the processing load can be further reduced.

  The monitoring setting unit holds a rule in which monitoring is set for each input mode when the user inputs to the application, and the monitoring flag setting unit has a predetermined language input mode. In some cases, it is preferable to set a flag indicating the presence of monitoring. In this case, when the predetermined language is set to Japanese, monitoring is not performed when inputting alphanumeric characters or passwords, so that the number of times of inspection of input contents can be reduced. Therefore, the processing load can be further reduced.

  The monitoring setting means holds a rule in which the presence / absence of monitoring is set according to the communication destination with which the application communicates, and the monitoring flag setting means indicates a monitoring flag indicating no monitoring corresponding to the rule. Is preferably set. In this case, for example, when the reliability of the Web site that is the communication destination is high, the monitoring is not executed, so that the number of times of inspection of the input content can be reduced. Therefore, the processing load can be further reduced.

  In addition, when the confirming operation for confirming the input is performed by the user, the inspection unit stores the confirming operation as an operation history, and the confirming operation is performed a predetermined number of times or the confirming operation is performed for a predetermined time or more. If not, it is preferable to transmit the input content to the list collation device and to inspect the input content. In this case, since it is not necessary to transmit the input content to the list collation device every time a user input is performed, the number of times the input content is transmitted to the list collation device can be reduced. Therefore, the processing load can be further reduced.

  Further, in response to the transmission of the input content to the list collation device by the inspection unit, the collation result storage unit that receives the collation result of the input content transmitted from the list collation device and stores the input content corresponding to the collation result as a collation list Is preferably further provided. In this case, it is possible to grasp the input tendency of the user by using the input contents previously input by the user in the terminal.

  Further, the apparatus further comprises a collation result transmitting means for transmitting a collation result with the collation list to the external device, and the collation result storing means is connected to the external device in response to the collation result being transmitted to the external device by the collation result transmitting means. Preferably, the apparatus receives a list generated based on the matching result and updates the currently saved matching list using the list. In this case, by updating the current list to the list generated based on the collation result in the external device, it is possible to use the list according to the user's input tendency and improve the match rate between the user's input contents and the list. Can be achieved.

  The monitoring setting means receives a rule generated based on the collation result in the external device in response to the collation result being transmitted to the external device by the collation result transmitting means, and is currently held using the rule. It is preferable to update existing rules. In this case, it is possible to change the rule according to the input contents of the user.

  Further, the monitoring flag setting means refers to the collation list stored in the collation result storage means, and indicates that there is no monitoring for the input content when a predetermined input content is input more than a certain number of times in the collation list. It is preferable to set a flag. In this case, since the inspection is not performed when the predetermined content is input more than a certain number of times, the number of inspections of the input content can be reduced. Therefore, the processing load can be further reduced.

  In addition, the input content at the time of mail creation is transmitted to the list collation device, the list collation device performs the input content inspection, and when the mail is transmitted from the terminal, the input content inspection is completed. It is preferable to further include collation means for transmitting the completion information and the collation result together with the mail. In this case, when collation is completed in the terminal on the transmission side, it is possible to know from the completion information that it is not necessary to perform inspection in the terminal on the mail reception side. The number of inspections can be reduced. Therefore, the processing load can be further reduced.

  Further, the collation means preferably transmits information specifying the range of the input content that has not been inspected together with the collation result when the mail is transmitted before the input content inspection at the time of mail creation is completely completed. . In this case, the terminal that has received the mail need only check the range based on the information indicating the range of the input content that has not been collated, so that the processing time can be shortened and the processing load can be reduced. it can.

  According to the present invention, it is possible to reduce the processing load in monitoring input contents.

  DESCRIPTION OF EMBODIMENTS Hereinafter, preferred embodiments of an input monitoring apparatus and an input monitoring method according to the present invention will be described with reference to the drawings. In the description of the drawings, the same elements are denoted by the same reference numerals, and redundant description is omitted.

  FIG. 1 is a schematic configuration diagram of an input monitoring system including an input monitoring apparatus according to a preferred embodiment of the present invention. As shown in FIG. 1, the input monitoring system 1 includes an input monitoring device 2, a list matching device 3, and a server device 4. The input monitoring device 2 is provided in the mobile communication terminal 5, for example, and determines whether or not the input content input from the user of the mobile communication terminal 5 by using, for example, a keyboard is monitored based on an application executed in the mobile communication terminal 5. Only when it is determined that monitoring is necessary, the list collating device 3 checks the input content.

  The input monitoring apparatus 2 includes a monitoring setting unit (monitoring setting unit) 201, an information acquisition unit (information acquisition unit) 202, a monitoring flag setting unit (monitoring flag setting unit) 203, and an inspection instruction unit (inspection unit) 204. A collation result storage unit (collation result storage unit) 205, a collation result transmission unit (collation result transmission unit) 206, and a mail collation unit (collation unit) 207.

  The monitoring setting unit 201 holds a rule in which monitoring is set for each type of application executed on the mobile communication terminal 5. The application type is, for example, an application for creating an e-mail, a browser for browsing a Web site, or the like. In the rule, an application type and presence / absence of monitoring are associated with each other. The rules will be described with reference to FIG. FIG. 2 is a diagram illustrating an example of rules held in the monitoring setting unit 201. As shown in the figure, the rule is a table in which “application type” and “monitoring presence / absence” are associated with each other. More specifically, for example, “Application 1 (for example, a browser for browsing a website)” has “Yes” indicating whether or not there is monitoring of input contents in the application (hereinafter simply referred to as “monitoring”). “Application 2 (for example, schedule function)” is “None” in the presence / absence of monitoring.

  The monitoring setting unit 201 holds a rule in which the presence / absence of monitoring is set for each attribute indicating the presence / absence of the communication function in the application. Specifically, the monitoring setting unit 201 determines that the monitoring is “Yes” and the application communicates as described above when the application communicates with the attribute or the application cooperates with another communication application. If it is not an attribute for performing monitoring, a rule for which monitoring is set to “none” is held. Note that the classification of whether an application is an attribute for communication is determined, for example, by whether an i-appli (registered trademark) has a communication function with the outside. In addition, the classification of whether an application is an attribute that cooperates with an application that performs other communication is determined by whether or not the application is an application that cooperates with an application having a communication function such as a mailer. Specifically, for example, software that converts characters input when an email is input corresponds to an application that cooperates with another communication application.

  In addition, the monitoring setting unit 201 performs filtering related to browsing of websites in a server apparatus (apparatus) to which the mobile communication terminal 5 is connected via a network (evaluates websites on the Internet based on a predetermined standard, and does not satisfy the predetermined standard) A rule for setting the presence or absence of monitoring is held according to the implementation state of the function that disables access to the Web site. Specifically, the monitoring setting unit 201 has set monitoring as “present” when filtering is performed on the server device, for example, and “not present” when filtering is not performed. Holds rules.

  In addition, the monitoring setting unit 201 holds a rule in which the presence or absence of monitoring is set according to the operation state of the application related to the user input operation. Specifically, for example, when an application related to an input operation such as character conversion software that converts input characters is operating, the monitoring setting unit 201 monitors “Yes”, and the application operates. If not, a rule with monitoring set to “none” is held.

  The monitoring setting unit 201 holds a rule in which monitoring is set for each function that assists the user's input called from the application. Specifically, the monitoring setting unit 201 outputs a word or sentence (fixed sentence or template) preinstalled in the mobile communication terminal 5 or a word or sentence (user) registered in the mobile communication terminal 5 by the user. The rule is set to be monitored for the type of application that is used when inputting a word or a sentence with a function that outputs (for example, copying and pasting a word) If the function is called “None”, and the function is called from another application, the rule with “Yes” is set.

  In addition, the monitoring setting unit 201 holds a rule in which the presence or absence of monitoring is set for each input mode when the user inputs to the application. Specifically, when the input mode when the user inputs to the mobile communication terminal 5 is Japanese input (predetermined language input), the monitoring setting unit 201 monitors “Yes” and other modes (for example, In the case of the alphanumeric input mode or password mode), a rule in which monitoring is set to “none” is held.

  In addition, the monitoring setting unit 201 holds a rule in which the presence or absence of monitoring is set according to the communication destination with which the application communicates. Specifically, when the reliability of a terminal that is a transmission destination (communication partner) such as a website or mail as a communication destination is high (trustworthy), monitoring is “None” and the reliability of the communication destination is low. In this case, a rule for which monitoring is set as “present” is held. The monitoring setting unit 201 holds the above rules as a table as shown in FIG.

  The monitoring setting unit 201 receives a new rule transmitted from the server device 4 and updates the existing rule with this new rule. The new rule transmitted from the server device 4 will be described later. Note that the rules held in the completion setting unit 201 may be appropriately set or updated by the service provider.

  The information acquisition unit 202 acquires user information regarding the user of the mobile communication terminal 5. The information acquisition unit 202 acquires UIM information from a UIM (User Identity Module) card inserted into the mobile communication terminal 5, for example. In addition, when the mobile communication terminal 5 has a form in which a plurality of telephone numbers and mail addresses can be used, the information acquisition unit 202 displays attribute information regarding the attributes of the user currently used based on the telephone numbers and mail addresses. get. The attribute information is, for example, the age and sex of the user. The information acquisition unit 202 outputs the acquired user information (UIM information, attribute information) to the monitoring flag setting unit 203.

  The monitoring flag setting unit 203 detects a change in the operating state of an application executed on the mobile communication terminal 5, and when the detected application is an application corresponding to the above rule of the monitoring setting unit 201, the monitoring flag setting unit 203 follows the rule. Sets a monitoring flag indicating whether monitoring is performed. The change in the operation state of the application is when the application is activated, or when an application in the background becomes the operation target (foreground) of the user when a plurality of applications are activated.

  Specifically, the monitoring flag setting unit 203 acquires the content (type) of the application when the application is newly activated in the state where the application for which no monitoring is set is activated, for example. It is determined whether or not the application meets the above rules. When the application corresponds to the rule, the monitoring flag setting unit 203 determines whether monitoring is performed or not based on the rule, and sets a monitoring flag indicating whether monitoring is performed. When a change in the operating state of a plurality of applications is detected, the monitoring flag is set with priority given to the foreground application that is the user's operation target.

  More specifically, the monitoring flag setting unit 203 performs the filtering execution state in the server device for the Internet to which the mobile communication terminal 5 is connected when the newly started application (the operation state has changed) is, for example, a browser. If the access restriction (filtering) is performed by filtering in the form of, for example, a white list (list of objects that need not be warned) in the server device, monitoring without monitoring is performed according to the filtering rules described above. Set the flag. The implementation state of filtering may be sequentially acquired when connected to the server device, or may be previously stored in the mobile communication terminal 5 by a table or the like. If access restriction is implemented by filtering in the form of a blacklist (list of objects requiring caution), it is determined that the website is a new website, and the user accesses it without being registered in the blacklist. Assuming the case where the user has performed, a predetermined process may be performed using the user input content and the collation result by the list collation device 3, and the server device 4 may be notified as a blacklist candidate.

  Further, the monitoring flag setting unit 203 performs the determination of the reliability by the following method when setting the monitoring flag based on, for example, a rule regarding the communication destination. That is, the monitoring flag setting unit 203, for example, when a communication partner is registered in an address registered in a specific group of the telephone directory in the mobile communication terminal 5, or a white list (set and held in advance by the user) The reliability of the communication destination is determined by referring to the target not to be inspected). That is, it is determined that the communication destination that the user recognizes in advance has high reliability. Then, the monitoring setting flag unit 203 sets a monitoring flag based on the reliability.

  In addition, when receiving the user information from the information acquisition unit 202, the monitoring flag setting unit 203 determines a rule to be applied based on the user information, and sets a monitoring flag. Specifically, for example, when the user information indicates that the user is a predetermined age or less, the monitoring flag setting unit 203 relates to input monitoring using, for example, an input monitoring list adapted to the age. A rule is applied with priority, and a monitoring flag is set according to the rule. The monitoring flag setting unit 203 outputs flag setting information indicating that the monitoring flag has been set to the inspection instruction unit 204.

  Further, the monitoring flag setting unit 203 refers to a collation list (described later) stored in the collation result storage unit 205 for the input content input from the user to the application, and the input content is past in the collation list. When it is determined that the predetermined input content (inappropriate input content) has been input a predetermined number of times or more, a monitoring flag indicating that the input content is not monitored is set. Furthermore, the monitoring flag setting unit 203 outputs the input contents input a predetermined number of times or more to the matching result storage unit 205 as blacklist candidates.

  When the monitoring flag setting unit 203 sets a monitoring flag indicating that there is monitoring, the inspection instruction unit 204 sends the input content to the list collation device 3 that collates the input content based on a list in which predetermined content is set in advance. Send the list collation device to check the input contents. Specifically, when receiving the flag setting information from the monitoring flag setting unit 203, the inspection instruction unit 204 determines whether or not the set monitoring flag is monitored. Then, when the monitoring flag indicates that there is monitoring, and the confirmation operation for confirming the input of the input content input to the application is performed by the user, the inspection instruction unit 204 sets the confirmation operation as an operation history. Remember. Thereafter, the inspection instruction unit 204 uses, as input information, the input content input from the user to the application when the confirmation operation has been performed a predetermined number of times or when the confirmation operation has not been performed for a predetermined time or more. The data is transmitted to the list verification device 3 by the communication function of the mobile communication terminal 5. The confirming operation is an operation for selecting and determining a kanji character selected as a candidate when, for example, an input character is converted into a kanji character or the like.

  The collation result storage unit 205 receives the collation result of the input content transmitted from the list collation device 3 in response to the transmission of the input information to the list collation device 3 by the inspection instruction unit 204, and inputs the input content corresponding to the collation result. Save as a collation list. The collation list will be described with reference to FIG. FIG. 3 is a diagram illustrating an example of a collation list stored in the collation result storage unit 205. As shown in the figure, the collation list is a table in which “input contents” and “number of inputs” are associated with each other. For example, when “input content” is “word 2”, the number of times “10” in which “word 1” is input is stored in association with each other. The collation result storage unit 205 also receives the black list candidate from the monitoring flag setting unit 203 and stores the black list. The verification result storage unit 205 outputs the received verification result and blacklist candidates to the verification result transmission unit 206.

  The collation result storage unit 205 receives a new list (described later) transmitted from the server device 4 and updates the existing collation list based on the new list.

  The verification result transmission unit 206 transmits the verification result of the verification list and the black list candidate to the server device 4. When the verification result transmission unit 206 receives the verification result from the verification result storage unit 205, the verification result transmission unit 206 transmits the verification result as verification result information to the server device 4 by the communication function of the mobile communication terminal 5.

  The mail collation unit 207 transmits the input content at the time of mail creation to the list collation device 3, causes the list collation device 3 to check the input content, and when the mail is transmitted from the mobile communication terminal 5, Completion information indicating that the inspection is completed and a collation result are transmitted together with the mail. If the input content has not been checked, the mail collation unit 207 transmits unexecuted information indicating that to the mail together with the mail. Further, the mail collation unit 207 displays uncompleted range information for specifying the range of the input content that has not been inspected together with the collation result when the mail is transmitted before the collation of the input content at the time of creating the mail is completely completed. Send.

  Specifically, the mail collation unit 207 cuts the words and sentences based on the confirmation operation of the input operation, and buffers (stores) a certain amount of input content according to the breaks, and stores it in the list collation device 3. The input content is transmitted as input information, and the break is stored as log information. Then, when mail is transmitted before the inspection is completely completed in the list verification device 3, the mail verification unit 207 transmits the information up to the portion where the inspection is completed as information specifying the range of the input content together with the verification result To do. For example, morphological analysis is used as a technique for making a break.

  The list collation device 3 is a device that receives input information transmitted from the mobile communication terminal 5 and collates the list managed by the own device with the input content indicated by the input information. The list collation device 3 receives and inputs the input information transmitted from the mobile communication terminal 5, and collates the input content indicated by the input information with the list. The list is preliminarily set with predetermined contents (contents deemed inappropriate), and is updated as appropriate according to the tendency of input contents of the mobile communication terminal 5 and the like. The list matching device 3 transmits a matching result obtained by matching the input content transmitted from the mobile communication terminal 5 to the list to the mobile communication terminal 5. 1 shows only one list matching device 3, the list matching device 3 may be constituted by one list matching device or may be constituted by a plurality of list matching devices. .

  The server device 4 is a device that receives the collation result information transmitted from the mobile communication terminal 5 and generates a new list and a new rule based on the collation result information. When the server apparatus 4 receives the collation result information from the mobile communication terminal 5, the collation result indicated by the collation result information is input. For example, a new list and a new rule are selected according to the user's generation, gender and the latest input content tendency. Is generated. And the server apparatus 4 transmits a new list and a new rule to the mobile communication terminal 2, when a new list and a new rule are produced | generated. A method for generating a new list and a new rule of the server device 4 is appropriately set by the service provider.

  In addition, when the server apparatus 4 receives a blacklist candidate from the mobile communication terminal 5, the server apparatus 4 determines whether the site or mail to which the input content shown in the blacklist is input is a harmful site or a junk mail. . If it is determined to be a harmful site or spam, it is reflected as a blacklist. Although only one server device 4 is shown in FIG. 1, the server device 4 may be composed of one server device or a plurality of server devices.

  Next, the operation of the input monitoring apparatus 1, that is, the input monitoring method according to the present embodiment will be described with reference to FIG. 4. FIG. 4 is a flowchart showing the input monitoring method. Steps in this input monitoring method are abbreviated as S.

  First, the monitoring flag setting unit 203 determines whether or not the operation state of the application has changed (S01). If the operation state of the application has changed, the process proceeds to step 02. On the other hand, when the operation state of the application has not changed, the process is completed.

  In step 02, the monitoring flag setting unit 203 performs monitoring flag setting processing. The monitoring flag setting process will be described with reference to FIG. FIG. 5 is a flowchart showing monitoring flag setting processing.

  First, it is determined whether or not the application type corresponds to the rule for each application type held in the monitoring setting unit 201 (S11). If it is determined that the type of application corresponds to the rule, the process proceeds to step 12. On the other hand, if it is determined that the type of application does not correspond to the rule, the process proceeds to step 15.

  In step 12, it is determined whether or not the input content is monitored in the application. If it is determined that the input content is being monitored, the process proceeds to step 13. On the other hand, if it is determined that the input content is not monitored, the process proceeds to step 15.

  In step 13, whether to monitor the input contents of the application is determined according to other rules (for example, the operation status of the application and the function called) other than the above rules (rules for each type of application). If it is determined that the input content is monitored, a monitoring flag indicating monitoring is set (S14). On the other hand, if it is determined that the input content is not monitored, the process proceeds to step 15. In step 15, a monitoring flag indicating no monitoring is set.

  Returning to FIG. 4, when the monitoring flag is set as described above, it is determined based on the monitoring flag whether or not the input content is being monitored (S03). If it is determined that there is monitoring, the process proceeds to step 04. On the other hand, if it is determined that there is no monitoring, the process is completed.

  In step 04, the inspection instruction unit 204 performs a process of transmitting the input content to the list matching device 3. The input content transmission process will be described with reference to FIG. FIG. 6 is a flowchart showing input content transmission processing.

  First, it is determined whether or not the confirmation operation when the user inputs to the application is a predetermined number of times (S21). If the confirming operation is less than the predetermined number of times, the process proceeds to step 22. On the other hand, if the determination operation is greater than or equal to the predetermined number, the process proceeds to step 23.

  In step 22, it is determined whether or not a predetermined time has elapsed after the confirming operation has been performed. If it is determined that the predetermined time has elapsed, the process proceeds to step 22. If it is determined that the predetermined time has not elapsed, the same processing is repeated.

  In step 23, the input content is transmitted to the list collation device 3 in order to cause the list collation device 3 to check the input content.

  Next, the setting of the monitoring flag based on the collation list by the monitoring flag setting unit 203 will be described with reference to FIG. FIG. 7 is a flowchart for explaining the setting of the monitoring flag based on the collation list.

  First, it is determined whether or not the input content input from the user to the predetermined application is the content input a predetermined number of times or more in the verification list stored in the verification result storage unit 205 (S31). ). If it is determined that the input content has been input a predetermined number of times or more, the process proceeds to step 32. On the other hand, when it is determined that the input content is not the content input a predetermined number of times or more, the processing is completed.

  In step 32, the input content input a predetermined number of times or more is stored in the matching result storage unit 205 as a blacklist candidate. Then, the monitoring flag of the input content is set to no monitoring (S33).

  Next, with reference to FIG. 8, a method of transmitting the collation result of the mail transmission content by the mail collation unit 207 will be described. FIG. 8 is a flowchart for explaining the notification of the collation result at the time of mail transmission.

  First, when a mail is created by the user, it is determined whether or not the input content of the input mail is inspected (S41). If it is determined that the input content has been examined, the process proceeds to step 42. On the other hand, if it is determined that the input content is not inspected, the process proceeds to step 45.

  In step 42, it is determined whether or not the inspection has been completed for all the input contents. If it is determined that the inspection has been completed for all of the input contents, completion information and a collation result indicating that are transmitted to the terminal on the mail receiving side (S43). On the other hand, if it is not determined that the inspection has been completed for all of the input contents, incomplete range information specifying the range of the input contents that have not been inspected and the collation result are sent to the terminal on the mail receiving side. It is transmitted (S44).

  In step 45, the non-executed information indicating that the inspection is not performed on the input content and the collation result are transmitted to the terminal on the mail receiving side.

  According to the inspection instruction unit 1 according to the present embodiment described above, when a change in the operation state of an application is detected and the application corresponds to a rule in which monitoring is set, monitoring is performed according to each rule described above. The monitoring flag is set by determining whether or not there is. And when the flag which shows that an audit exists is set, the input content input from the user is transmitted to the list collation apparatus 3, and an input content is test | inspected. Therefore, since it is only necessary to monitor the input content when the operation state of the application has changed without specifying the user input content, the number of times of collation of the list is reduced compared to the case of monitoring all the input content. The processing load can be reduced.

  Moreover, the collation list can be created according to the input tendency of the user by notifying the server 4 of the collation result by the list collation device 3 and generating a new list. As a result, it is possible to improve the hit rate (degree of coincidence) at the time of matching the input content input from the user with inappropriate content.

  In addition, since the mobile communication terminal 5 on the mail transmission side inspects the input contents and transmits information indicating the inspection execution range together with the mail, the mobile communication terminal on the mail reception side inspects according to the execution range. Should be implemented. Therefore, when the input content is not completely inspected, it is only necessary to inspect the range where the input is not performed, and it is not necessary to inspect all the received input content. Therefore, the processing load and the processing time can be reduced.

  Although the present invention has been specifically described above based on the embodiment, the present invention is not limited to the above embodiment, and various modifications can be made. For example, in the above-described embodiment, the monitoring flag is set with priority on the foreground application. However, the monitoring flag may be set by determining whether all the applications are monitored.

1 is a schematic configuration diagram of an input monitoring system including an input monitoring device according to a preferred embodiment of the present invention. It is a figure which shows an example of the rule currently hold | maintained at the monitoring setting part. It is a figure which shows an example of the collation list | wrist currently preserve | saved at the collation result storage part. It is a flowchart which shows the input monitoring method. It is a flowchart which shows the setting process of a monitoring flag. It is a flowchart which shows the transmission process of input content. It is a flowchart explaining the setting of the monitoring flag based on a collation list. It is a flowchart explaining the notification of the collation result at the time of mail transmission.

Explanation of symbols

  2 ... input monitoring device, 3 ... list collating device, 4 ... server device (external device) 201 ..., monitoring setting unit (monitoring setting unit), 202 ... information acquisition unit (information acquisition unit), 203 ... monitoring flag setting unit ( (Monitoring flag setting means), 204 ... inspection instruction section (inspection means), 205 ... collation result storage section (collation result storage means), 206 ... collation result transmission section (collation result transmission means), 207 ... mail collation section (collation means) ).

Claims (18)

An input monitoring device that acquires input content input to a terminal by a user and executes monitoring of the input content,
Monitoring setting means for holding a rule in which presence or absence of monitoring is set for each type of application executed on the terminal;
A monitoring flag indicating whether or not monitoring is performed in accordance with the rule when the change in the operating state of the application executed on the terminal is detected and the detected application is an application corresponding to the rule of the monitoring setting unit Monitoring flag setting means for setting
When the flag indicating that monitoring is present is set by the monitoring flag setting means, the input content is transmitted to a list collation device that collates the input content based on a list in which predetermined content is set in advance, and the list collation Inspection means for causing the apparatus to inspect the input content;
An input monitoring device comprising:   When the monitoring flag setting unit detects a plurality of changes in the operating state of the application executed on the terminal, the monitoring flag setting unit sets the monitoring flag with priority on the application that is the operation target of the user. The input monitoring apparatus according to claim 1.   When the monitoring flag setting means detects a plurality of changes in the operating state of an application executed on the terminal and there is one or more rules set to be monitored in the plurality of applications, the monitoring flag setting means The input monitoring apparatus according to claim 1, wherein a monitoring flag is set. The monitoring setting means holds a rule in which the presence or absence of monitoring is set for each attribute indicating the presence or absence of a communication function in the application,
Based on the rule, the monitoring flag setting means is configured such that an application executed on the terminal has a communication function, or another application that cooperates with an application executed on the terminal has a communication function. The input monitoring device according to claim 1, wherein when it is determined that the monitoring flag is set, a monitoring flag indicating that monitoring is present is set. The monitoring setting means holds a rule in which monitoring is set according to a setting state of a filtering function for browsing a website when the terminal connects via a network,
The monitoring flag setting means sets a monitoring flag indicating no monitoring when it is determined that a filtering function for browsing the Web site is set. The input monitoring device described. Further comprising information acquisition means for acquiring user information relating to the user;
The monitoring flag setting means acquires the attribute of the user based on the user information acquired by the information acquisition means, sets a monitoring flag indicating whether monitoring is performed by determining a rule to be applied according to the attribute The input monitoring device according to any one of claims 1 to 5, wherein The monitoring setting unit holds a rule in which monitoring is set according to an operation state of an application related to the input operation of the user,
The input monitoring apparatus according to claim 1, wherein the monitoring flag setting unit sets the monitoring flag according to the rule. The monitoring setting unit holds a rule in which monitoring is set for each function that assists the user's input called from the application,
The monitoring flag setting means is a function in which the function called from the application is a function to output words and sentences preset in the terminal, or a function to output words and sentences registered by the user, and 8. A monitoring flag indicating that there is no monitoring is set when the rule is set to monitoring for the type of application used when registering the word and sentence. The input monitoring device according to any one of the above. The monitoring setting means holds a rule in which monitoring is set for each input mode when the user inputs to the application,
9. The input monitoring apparatus according to claim 1, wherein the monitoring flag setting unit sets a flag indicating that monitoring is present when the input mode is a predetermined language input. The monitoring setting means holds a rule in which presence / absence of monitoring is set according to a communication destination with which the application communicates,
The input monitoring apparatus according to claim 1, wherein the monitoring flag setting unit sets a monitoring flag indicating no monitoring corresponding to the rule.   When the confirming operation for confirming the input from the user is performed, the inspection unit stores the confirming operation as an operation history, and the confirming operation is performed a predetermined number of times or the confirming operation is performed for a predetermined time. The input monitoring apparatus according to any one of claims 1 to 10, wherein if the input is not performed, the input content is transmitted to the list matching device, and the input content is inspected.   In response to the transmission of the input content to the list collation device by the inspection means, the collation result of the input content transmitted from the list collation device is received, and the input content corresponding to the collation result is stored as a collation list. The input monitoring apparatus according to claim 1, further comprising a collation result storage unit. Further comprising collation result transmitting means for transmitting a collation result with the collation list to the external device;
The collation result storing unit receives a list generated based on the collation result in the external device in response to the collation result being transmitted to the external device by the collation result transmitting unit, and the list The input monitoring apparatus according to claim 12, wherein the collation list currently stored is updated using.   The monitoring setting unit receives a rule generated based on the collation result in the external device in response to the collation result being transmitted to the external device by the collation result transmission unit, and uses the rule 14. The input monitoring apparatus according to claim 13, wherein the rule currently held is updated.   The monitoring flag setting unit monitors the input content when a predetermined input content is input more than a predetermined number in the verification list with reference to the verification list stored in the verification result storage unit. 13. The input monitoring apparatus according to claim 12, wherein a flag indicating absence is set.   The input content at the time of mail creation is transmitted to the list collation device, the input content is inspected by the list collation device, and when the mail is transmitted from the terminal, the input content inspection is completed. The input monitoring apparatus according to claim 1, further comprising: a collating unit that transmits completion information indicating a collation result and a collation result together with the mail.   The collation means transmits information specifying a range of the input content that has not been inspected together with the collation result when the mail is transmitted before the input content inspection at the time of creating the mail is completely completed. The input monitoring device according to claim 16. An input monitoring method by an input monitoring device that acquires input contents input to a terminal by a user and executes monitoring of the input contents,
When a change in the operating state of an application executed on the terminal is detected, and the application in which the change is detected is an application corresponding to a rule in which monitoring is set for each type of the application, the rule A monitoring flag setting step for setting a monitoring flag indicating the presence or absence of monitoring according to
When the flag indicating the presence of monitoring is set in the monitoring flag setting step, the input content is transmitted to a list verification device that collates the input content based on a list in which predetermined content is set in advance, and the list verification An inspection step for causing the apparatus to inspect the input content;
An input monitoring method comprising:

Images