JP2010205081A - Device, method, and program for managing integrated log - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To integrally manage log information managed in respective devices to effectively use the log information and to determine necessity of security. <P>SOLUTION: An integrated log management device which integrates log information of a plurality of different management target devices and which determines whether or not security is necessary in accordance with integrated log information, includes: a log information obtaining means which obtains log information of the management target devices; an integrated log management means which integrates a plurality of pieces of log information obtained by the log information obtaining means, on the basis of a prescribed condition and manages a series of actions in time series; a security detection and determination means which detects a suspicious person from actions obtained by the integrated log management means and determines whether or not security is necessary by detected contents and a priority; a screen generation means which generates a screen on which a determination result obtained by the security detection and determination means is displayed using the plurality of pieces of log information; and a notification means which notifies situations in accordance with the determination result of the security detection and determination means and the priority. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an integrated log management apparatus, an integrated log management method, and an integrated log management program, and in particular, manages log information managed by each device in an integrated manner and effectively uses it, and ensures security. The present invention relates to an integrated log management apparatus, an integrated log management method, and an integrated log management program for determining necessity.

  Conventionally, in order to carry out sound corporate activities, internal control systems have to be built in-house, but as technical requirements related to this, various system operation histories and operation histories (hereinafter referred to as “logs”) Must be collected. Here, the purpose of log collection is, for example, in the work carried out by utilizing a certain system, whether proper work is being carried out, fraudulent acts are not carried out, information leakage etc. is prevented. Check if it is. In addition, in the event of fraud, appropriate measures must be taken immediately.

  In addition, at the time of an audit conducted by a company, it is necessary to submit the collected logs as an audit trail, so that management must be performed in addition to the collection. Furthermore, there is a tendency that major manufacturers and the like do not outsource their business to contractors who have neglected appropriate measures for handling information. For these various reasons, there are many companies that are trying to collect logs as a first countermeasure.

  However, the current situation is that, for the business consignees, the majority of which are SMEs, personnel cannot be allocated for log collection and management from the viewpoint of labor costs. In many cases, it is difficult to secure human resources with IT (Information Technology) skills.

  In addition, even with the cooperation of IT vendors and the like, log collection products can be introduced or mechanisms can be constructed, but there are many cases where management has not yet been performed. Therefore, there is a need for a log collection mechanism that can be managed properly even in small and medium-sized enterprises and can be appropriately dealt with when an accident occurs.

  In addition, as a prior art, the firewall packet on the network is monitored, advice on the detected problem is notified (for example, refer to Patent Document 1), or the monitoring result of the facility information is used as a report, and the parties concerned (For example, refer to Patent Document 2), or there is a technique for controlling logon / logoff of a terminal (PC (Personal Computer) or the like) in association with user entry / exit management ( (For example, see Patent Document 3.)

JP 2006-295232 A JP 2005-142754 A JP 2004-302875 A

  However, the techniques disclosed in Patent Documents 1 and 2 described above cannot be monitored according to entrance / exit information or work information, and cannot be monitored according to ON / OFF of the security system. Specifically, for example, when the security system is OFF, access to the internal terminal is permitted. Conversely, when the security system is ON, it means that there is no person in the monitoring area. Flexible monitoring such as prohibiting access to the network cannot be performed, and abnormalities and fraudulent activities cannot be accurately detected unless judgment is made together with other monitoring information such as a person's occupancy status and security system status.

  Also, the technique disclosed in Patent Document 3 described above cannot be monitored according to the ON / OFF state of the security system, and an abnormality or fraud cannot be accurately detected unless it is determined together with other monitoring information. . Specifically, for example, only with the control “cannot log in to the PC without entering the room”, the person who entered the room illegally by sharing (without entering the room from behind the user who entered the room) It is not possible to correctly monitor abnormalities such as the presence of defects.

  In addition, the operation log for each device may have been acquired accurately, but when referring to the integrated log from the viewpoint of personal behavior management, it is never effective because it is not enough to grasp the situation. It is not a good log.

  The actual log content is complicated, and the log format varies from system to system. Therefore, in order to integrate and use logs, for example, prepare a standard format in advance, investigate which part of the log to extract for each device that constitutes the system, and log according to it. An integrated system needs to be developed. As a result, the system to be constructed is sophisticated and expensive, and it is difficult to introduce it into small and medium-sized enterprises. Currently, logs are managed for each device after all.

  The present invention has been made in view of the above-described problems, and comprehensively manages and effectively uses log information managed by each device, and reliably determines the necessity of security. It is an object to provide an integrated log management device, an integrated log management method, and an integrated log management program.

  In order to solve the above problems, the present invention employs means for solving the problems having the following characteristics.

  In the present invention, log information for acquiring log information of the management target device in an integrated log management device for integrating log information for each of a plurality of different management target devices and determining the necessity of security from the integrated log information An acquisition unit, an integrated log management unit that integrates a plurality of log information obtained by the log information acquisition unit based on a predetermined condition and manages a series of actions in a time series, and an action obtained by the integrated log management unit A suspicious person is detected from the detected information and a security detection determination means for determining the necessity of security from the detected content and priority, and a screen for displaying the determination result obtained by the security detection determination means using a plurality of log information is generated. Screen generating means for performing the notification, and notifying means for notifying the fact in accordance with the determination result in the security detection determining means and the priority. As a result, log information managed by each device can be managed in an integrated manner and used effectively, and the necessity of security can be reliably determined.

  In the present invention, the integrated log management means integrates the log information for each managed device individually based on personal identification information. Thereby, it is possible to grasp in advance the suspicious behavior pattern of an individual and prevent the occurrence of an accident due to an illegal act or the like.

  In the present invention, the screen generating means generates a suspicious person list from suspicious person information obtained by the security detection determining means. Thereby, it is possible to easily and accurately grasp the suspicious person, which is important information for security.

  Furthermore, in the present invention, in an integrated log management method for integrating log information for a plurality of different managed devices and determining whether or not security is required from the integrated log information, a log for acquiring log information of the managed devices Obtained by an information acquisition step, an integrated log management step for integrating a plurality of log information obtained by the log information acquisition step based on a predetermined condition and managing a series of actions in a time series, and the integrated log management step A screen for detecting a suspicious person from the behavior and displaying the determination result obtained by the security detection determination step using a plurality of log information, and determining the necessity of security from the detected content and priority. A screen generation step for generating, and a notification step for notifying that in accordance with the determination result in the security detection determination step and the priority Characterized in that it has a. As a result, log information managed by each device can be managed in an integrated manner and used effectively, and the necessity of security can be reliably determined.

  In the present invention, the integrated log management step is characterized in that log information for each managed device is individually integrated based on personal identification information. Thereby, it is possible to grasp in advance the suspicious behavior pattern of an individual and prevent the occurrence of an accident due to an illegal act or the like.

  Moreover, in this invention, the said screen production | generation step produces | generates a suspicious person list | wrist from the suspicious person information obtained by the said security detection determination step, It is characterized by the above-mentioned. Thereby, it is possible to easily and accurately grasp the suspicious person, which is important information for security.

  Furthermore, in the present invention, in an integrated log management program for integrating log information for a plurality of different managed devices and determining whether or not security is required from the integrated log information, the computer stores the log information of the managed devices. Log information acquisition means to acquire, integrated log management means for integrating a plurality of log information obtained by the log information acquisition means based on predetermined conditions and managing a series of actions in time series, obtained by the integrated log management means A screen for displaying a determination result obtained by the security detection determination means, the security detection determination means for detecting the suspicious person from the detected action and determining the necessity of security from the detected content and priority, using a plurality of log information It functions as a screen generating means to be generated and a notification means for notifying that in accordance with the determination result in the security detection determining means and the priority.Thereby, the log information managed by each device can be managed in an integrated manner and used effectively. Further, by installing the program, the integrated log management in the present invention can be easily realized by a general-purpose personal computer or the like.

  Further, the present invention is characterized in that the integrated log management means integrates the log information for each managed device individually based on personal identification information. Thereby, it is possible to grasp in advance the suspicious behavior pattern of an individual and prevent the occurrence of an accident due to an illegal act or the like.

  Further, the present invention is characterized in that the screen generating means generates a suspicious person list from suspicious person information obtained by the security detection determining means. Thereby, it is possible to easily and accurately grasp the suspicious person, which is important information for security.

  ADVANTAGE OF THE INVENTION According to this invention, while managing the log information managed by each apparatus in an integrated manner and using it effectively, the necessity of guarding can be determined reliably.

It is a figure which shows an example of schematic structure of the integrated log management system in 1st Embodiment. It is a figure which shows an example of a function structure of a statistics log management apparatus. It is a figure which shows an example of the hardware constitutions which can implement | achieve the statistics log management in this embodiment. It is a figure which shows an example of the log information obtained from each management object apparatus in a statistics log management system. It is a figure which shows an example of the log integrated in the integrated log management means. It is a figure which shows an example of the screen generation of log information in this embodiment. It is a figure shown as an example of the integrated log information used for security detection determination. It is a figure which shows an example of a suspicious person list. It is a flowchart which shows an example of the integrated log management process sequence in this invention. It is a figure which shows an example of schematic structure of the integrated log management system in 2nd Embodiment.

  Hereinafter, embodiments in which an integrated log management apparatus, an integrated log management method, and an integrated log management program according to the present invention are suitably implemented will be described with reference to the drawings.

<First Embodiment: Schematic Configuration Example of Integrated Log Management System>
FIG. 1 is a diagram illustrating an example of a schematic configuration of an integrated log management system according to the first embodiment. In the example shown in FIG. 1, for example, integration using log information in security systems such as crime prevention and security installed in each company and OA (Office Automation) equipment generally used in companies. The management system will be described.

  The integrated log management system 10 shown in FIG. 1 is configured to have a company 11 that is a security target range and a security company 12 that is a security monitoring system. The company 11 and the security company 12 are a telephone line or a dedicated line. The communication networks 13-1 and 13-2 such as Internet lines are connected in a state where data and the like can be transmitted and received.

  In the integrated log management system 10, the company 11 has a security system 21, an entry / exit management system 22, a PC (Personal Computer) 23, a multifunction device 24, a cabinet 25, and a network connection device 26 on the same floor, for example. It is comprised so that. Each managed device in the company 11 (the security system 21, the entry / exit management system 22, the PC 23, the multi-function device 24, the cabinet 25, and the network device 26 in FIG. 1) is connected via a line or wireless LAN (Local Area Network) or the like. Connected in a state where data can be sent and received.

  In FIG. 1, the security system 21, the entrance / exit management system 22, the PC 23, the multifunction device 24, and the cabinet 25 in the company 11 include identification information such as personal information, IDs, and passwords in order to clarify the users. An authentication card 27 is provided. Further, the security company 12 is configured to have a network connection device 31 and an integrated log management device 32.

  The security system 21 is a security control device that controls the security of the entire floor shown in FIG. 1 and is detected during security by turning on / off the security system, a plurality of cameras and person detection sensors installed in the floor, etc. Is acquired as log information together with the date and time information. In addition, the security system 21 has a function of performing personal authentication by reading the personal identification information using an authentication card 27 to which personal identification information (for example, user ID, name, affiliation, authority information, etc.) is given at the time of use. You may do it. In this case, the security system 21 also accumulates personal information acquired from the authentication card 27 as log information. The security system 21 transmits the recorded log information to the network connection device 26 via the LAN, and causes the network connection device 26 to transmit the log information to the security company 12 via the communication network 13-1.

  The security system 21 is connected to the security company 12 directly in a state where data can be transmitted and received via the communication network 13-2, and security system signals (intrusion alarm, fire alarm, various reports, etc.) In the event of an emergency such as the occurrence of an abnormality, it is possible to promptly notify the security company 12 and to promptly receive appropriate instructions from the security company 12 so as to respond to the emergency. The security system 21 may perform encryption to improve security when transmitting the above-described security signal.

  The entry / exit management system 22 is a system that manages entry / exit with respect to a security target area or the like set in advance. Specifically, when opening the door, the entrance / exit management system 22 performs authentication by reading the personal identification information of the identification card 27, for example, and manages the authentication result as log information together with date information and personal identification information, for example. To do. Further, the entry / exit management system 22 transmits the acquired log information to the network device 26 via the LAN, and transmits it to the security company 12 via the communication network 13-1.

  The PC 23 accumulates the activation status of the application, the content displayed on the screen, the content of the key input from the keyboard and the like as log information together with the date and time information when used. The PC 23 may be restricted so as not to operate unless user authentication is performed, for example. In that case, on the initial screen of the PC 23, who is using the PC 23 by manually entering personal identification information and a password for identifying the user directly or by reading the personal identification information of the authentication card 27? Can be easily grasped. The PC 23 also stores personal identification information (for example, user ID, password, etc.) obtained at the time of activation as log information together with date / time information and the like. Further, the PC 23 transmits the acquired log information to the network device 26 via the LAN, and transmits it to the security company 12 via the communication network 13-1.

  The multi-function device 24 stores the print output of data on paper or the like and the execution results when various functions as a multi-function device such as a FAX and a scanner are executed together with the date and time information as log information. Note that the multi-function device 24 may have a function that prevents use of personal information without performing personal authentication at the time of use from the viewpoint of preventing leakage of confidential information and the like. In that case, the multifunction device 24 can manage which user is using the personal identification information by reading the personal identification information of the authentication card 27, and accumulates the log information together with the date and time information. . The multifunction device 24 transmits the acquired log information to the network device 26 via the LAN, and transmits the log information to the security company 12 via the communication network 13-1.

  The cabinet 25 accumulates information on opening / closing of doors as log information when taking out or returning stored confidential documents, various recording media such as books, CD-ROMs, and DVDs. Specifically, when the cabinet 25 is used, personal authentication is performed by inputting a user ID, a password, or the like assigned for each individual set in advance or by reading the personal identification information of the authentication card 27 as described above. In the case of a usable user, it may have a function that can be used. In that case, the cabinet 25 accumulates the personal authentication information together with the date information. Further, the cabinet 25 transmits the acquired log information to the network device 26 via the LAN, and transmits it to the security company 12 via the communication network 13-1.

  The network device 26 outputs log information sent from each managed device on the entire floor to the security company 12 set in advance via the communication network 13-1. Here, it is preferable that the network device 26 encrypts the obtained information using a VPN (Virtual Private Network) or the like and then transmits the encrypted information. By performing VPN communication, a public network such as the Internet can be used as if it were a dedicated line, and a virtual private network can be constructed. Thereby, the security between the communication networks between the company 11 and the security company 12 can be improved.

  In addition, the security company 12 acquires log information transmitted from one or more companies via the communication networks 13-1 and 13-2. Specifically, the network device 31 such as a router or a gateway transmits / receives data to / from the network device 26 provided on the company side via the communication network 13-1, so that data can be transmitted / received. it can.

  Further, the network device 31 outputs the obtained information to the statistical log management device 32, and the statistical log management device 32 performs various processes such as statistics of log information by a monitor or the like.

  Here, each log information accumulated for each device described above is a log acquisition request from the security company 12 (integrated log management device 32), or at a preset timing such as every predetermined time, log information update, or the like. Sent from the company 11 to the security company 12.

  Further, log information transmitted from each apparatus / device from the company 11 is transmitted to the integrated log management apparatus 32 through communication such as VPN from the communication network 13-1 via a server such as a firewall in the server room shown in FIG. May be sent.

  In the first embodiment, it is conceivable that the security signal is similarly transmitted to the security company 12 having the security monitoring system via a general communication route (communication network 13-1). However, since a high degree of reliability is required for the security signal, it is preferable to transmit the signal through a predetermined communication route (for example, the communication network 13-2) by encryption or the like, and the two communication routes described above. It is more preferable to use together.

  Note that a plurality of devices to be managed in the company 11 (the security system 21, the entry / exit management system 22, the PC 23, the multifunction device 24, the cabinet 25, and the network device 26 in FIG. 1) may be installed. Can manage log information identified by device identification information or the like.

<Statistics log management device 32: functional configuration example>
Next, a functional configuration example in the functional configuration example in the statistical log management device 32 will be described with reference to the drawings.

  FIG. 2 is a diagram illustrating an example of a functional configuration of the statistical log management apparatus. The statistical log management device 32 shown in FIG. 2 includes an input unit 41, an output unit 42, a storage unit 43, a log information acquisition unit 44, a statistical log management unit 45, a security detection determination unit 46, and a screen generation unit. 47, a notification unit 48, a transmission / reception unit 49, and a control unit 50.

  The input unit 41 receives various instructions such as a log information acquisition instruction, an integrated log management instruction, a security detection determination instruction, a screen generation instruction, a notification instruction, and a transmission / reception instruction from a user or the like. Note that the input unit 41 includes, for example, a keyboard, a pointing device such as a mouse, a voice input device such as a microphone, and the like.

  The output means 42 generates the instruction contents inputted by the input means 41, the control data generated based on each instruction contents, the log information obtained from the company 11, the statistical results and various images for security, and generates the statistics. The contents such as the result are displayed and the sound is output. The output means 42 has a screen display function such as a display and a sound output function such as a speaker.

  The storage unit 43 stores log information obtained from each company, screen contents generated by the screen generation unit 47, notification contents set in advance, security detection determination parameters, security detection determination results, and the like. Reading and writing are performed accordingly. The storage unit 43 can also acquire the various data described above from an external device or the like connected to the communication networks 13-1, 13-2, and the like.

  The log information acquisition unit 44 acquires the log information necessary for the integrated log management device 32, so that the security system 21, the entry / exit management system 22, the PC 23, the multifunction device 24, the cabinet via the communication networks 13-1 and 13-2. 25 and the network device 26, a log information acquisition request signal is transmitted, and necessary log information is acquired from the log information accumulated in each managed device. The log information acquisition unit 44 stores the acquired log information in the storage unit 43.

  The integrated log management unit 45 integrates the acquired log information on the basis of conditions that are considered to be necessary on the security set in advance in the log information acquisition unit 44, and a series of actions from the integrated log information in time series To manage the integrated log management system in general. That is, the integrated log management means 45 manages the acquired log information in association with user information or the like. Thereby, data can be managed in an integrated manner. In addition, since history information and the like in each configuration can be managed, highly accurate analysis can be performed using statistical information. Further, the integrated log management means 45 generates a statistical log information by combining a plurality of log information. As a result, simple log information also becomes meaningful information for security purposes.

  The security detection determination unit 46 detects a suspicious person from the action pattern obtained by the integrated log management unit 45 based on the integrated log information obtained by the integrated log management unit 45, and the detected content and a preset priority level. Determine whether security is needed. Here, the determination in the security detection determination unit 46 is set in advance to perform security based on a detection condition set in advance, using at least one of the detection condition and log information respectively acquired from each device. Compared with the combination of log information, it is determined that security is necessary if it matches the detection condition, and it is determined that security is not required if it does not match.

  The screen generation unit 47 generates a screen that is easy for the user to understand the log information acquired by the log information acquisition unit 44, the integrated log information acquired by the integrated log management unit 45, and the determination result obtained by the security detection determination unit 46. The generated screen is output together with sound and the like by the output means 42 having a display, a speaker, and the like.

  The notification unit 48 determines the result of the determination by the security detection determination unit 46, for example, when it is necessary to have security. Has an alert function to notify the person in charge.

  The transmission / reception means 49 acquires log information from each managed device provided in one or a plurality of companies via the communication network 13-1 or 13-2. The log information acquisition request in the log information acquisition unit 44 is output to each terminal via the communication networks 13-1 and 13-2, and the log information is output at an arbitrary timing. The transmission / reception means 49 can be used as a communication interface for transmitting to other terminals constituting the integrated log management system 10 and for receiving various data from other terminals.

  The control unit 50 controls the entire functional configuration in the integrated log management system 10. Specifically, the control unit 50 acquires log information based on input information from the user input by the input unit 41, manages an integrated log, performs security detection determination processing, and generates a screen. Various kinds of data such as output, notification, extraction of various corresponding data stored in the storage means 43 in response to requests from other terminals, and transmission to other terminals via the transmission / reception means 49 Take control.

  As described above, according to the present embodiment, log information managed by each device can be managed in an integrated manner and used effectively.

<Statistics log management device: hardware configuration example>
Here, the statistical log management device 32 described above can be controlled by a dedicated device configuration having the above-described functions, but generates an execution program (statistics log management program) that can cause the computer to execute each function. For example, the statistical log management processing in the present invention can be realized by installing the execution program in a general-purpose personal computer, server, or the like.

  A hardware configuration example of a computer capable of realizing statistical log management in this embodiment will be described with reference to the drawings. FIG. 3 is a diagram illustrating an example of a hardware configuration capable of realizing statistical log management in the present embodiment.

  3 includes an input device 61, an output device 62, a drive device 63, an auxiliary storage device 64, a memory device 65, a CPU (Central Processing Unit) 66 that performs various controls, and a network connection device. 67, which are connected to each other by a system bus B.

  The input device 61 has a pointing device such as a keyboard and a mouse operated by a user or the like, and inputs various operation signals such as execution of a program from the user or the like.

  The output device 62 has a monitor for displaying various windows and data necessary for operating the computer main body for performing the processing in the present invention, and displays the program execution progress, results, etc. by the control program of the CPU 66. can do.

  The input device 61 and the output device 62 may be integrated input / output means such as a touch panel. In this case, the input device 61 and the output device 62 are predetermined using a finger of a user, a pen-type input device, or the like. The position can be touched to input.

  Here, the execution program installed in the computer main body in the present invention is provided by, for example, a portable recording medium 68 such as a USB (Universal Serial Bus) memory or a CD-ROM. The recording medium 68 on which the program is recorded can be set in the drive device 63, and the execution program included in the recording medium 68 is installed from the recording medium 68 to the auxiliary storage device 64 via the drive device 63.

  The auxiliary storage device 64 is a storage means such as a hard disk, and can store an execution program according to the present invention, a control program provided in a computer, and the like, and can perform input / output as necessary.

  The memory device 65 stores an execution program read from the auxiliary storage device 64 by the CPU 66. The memory device 65 includes a ROM (Read Only Memory), a RAM (Random Access Memory), and the like.

  The CPU 66 performs various operations and data input / output with each hardware component based on a control program such as an OS (Operating System) and an execution program read and stored by the memory device 65. Each process in statistical log management or the like can be realized by controlling the process. Various kinds of information such as log information necessary during the execution of the program can be acquired from the auxiliary storage device 64, and the execution results and the like can also be stored.

  The network connection device 67 is obtained by connecting to a communication network or the like to obtain an execution program from another terminal or the like connected to the communication networks 13-1 and 13-2, or by executing the program. The execution result or the execution program itself in the present invention can be provided to another terminal or the like. With the hardware configuration as described above, the statistical log management processing in the present invention can be executed. Further, by installing the program, the statistical log management processing in the present invention can be easily realized by a general-purpose personal computer or the like. Next, specific contents of statistical log management will be described.

<Statistics log management example>
Next, an example of statistical log management in the present embodiment will be described with reference to the drawings. FIG. 4 is a diagram illustrating an example of log information related to an operation history and the like obtained from each guard target device in the statistical log management system. 4A shows an example of a log in the entry / exit management system 22, FIG. 4B shows an example of a log in the PC 23, FIG. 4C shows an example of a log in the multifunction device 24, FIG. 4D shows an example of the log in the cabinet 25, and FIG. 4E shows an example of the log in the network device 26.

  In FIG. 4A, the log items acquired by the entry / exit management system 22 include, for example, “ID (user ID)”, “user”, “time”, “target (area)”, “content”, and the like. is there. Here, “content” in FIG. 4A includes various contents such as operation, status, purpose, and the like for entering and leaving, such as “entering room” and “leaving room”. The information is authenticated by using the authentication card 27 in which personal identification information for authentication is recorded in a memory or the like when the entry / exit management system 22 is used, and reading the information of the authentication card 27 at the time of use. And the result is accumulated as log information.

  In FIG. 4B, the log items acquired by the PC 23 include, for example, “ID”, “user”, “time”, “location”, “content”, and the like. Here, “content” in FIG. 4B includes, for example, “login”, “logoff”, “open”, “close”, “print”, and “copy” to a storage medium such as a USB memory. These are various operation contents of the PC 23 that can be acquired by the PC 23 such as “e-mail attachment transmission”.

  In FIG. 4C, the log items acquired by the multifunction device 24 include, for example, “ID”, “user”, “time”, “target”, “content”, and the like. Here, the “content” in FIG. 4C is, for example, the content acquired by the multi-function device 24, for example, the multi-function device 24 such as “printout” or “copy (number of copies)”. Various operation contents of the multifunction device 24 that can be performed.

  In FIG. 4D, the log items acquired by the cabinet 25 include, for example, “ID”, “user”, “time”, “target”, and the like. Here, the “target” in FIG. 4D is, for example, what of the cabinets 25 among the cabinets 25 such as “cabinet number (for example, Cabinet 1)” to be taken out or returned.

  In FIG. 4E, the log items acquired by the network device 26 include, for example, the network device 26 such as “IP address (connection source)”, “time”, “connection destination”, and “content”. Various contents that can be acquired. It should be noted that the items obtained from each managed device described above are not limited to this in the present invention, and the contents contained in the same item are for associating log information of each device such as “ID”. A different input (for example, “Ikeda” and “Ikeda”) may be made for each piece of log information except for specific items.

<Example of integrated log information>
Next, an example of integrated log information will be described with reference to the drawings. FIG. 5 is a diagram illustrating an example of an integrated log in the integrated log management unit. As an example, FIG. 5A shows an example when the logs of the entry / exit management system 22 and the PC 23 are integrated, and FIG. 5B shows an example of an integrated image of IDs between the target devices. ing.

  The log items shown in FIG. 5A include “ID”, “user”, “time”, “target” extracted from the log information shown in FIGS. 4A and 4B described above. And “content”. Here, the “content” in FIG. 5A is information accumulated in the above-described FIGS. 4A and 4B.

  Here, the integrated log management shown in FIG. 5 (a) is for simplification of management, reduction of labor for preparing audit materials, and the like. For logs respectively acquired from a plurality of devices, for example, user information or the like. Is integrated as a key information and managed as one log file.

  In addition, regarding the ID integration shown in FIG. 5B, the registration format of each information of “ID” and “user” differs depending on the system, so that the IDs are integrated and the logs are integrated.

  In this way, the merit of integrated ID management is not only easy to realize log integration, but also can be linked to ID information of each system. For example, when the number of employees increases due to joining, ID If the ID information is added to the ID integrated management system that integrally manages the information, it can be automatically reflected in other systems. Also, when you retire, if you delete the ID information of the corresponding person in the ID integrated management system, the IDs of other systems are automatically deleted, so the ID is illegally used due to forgetting to delete the ID information. Can be prevented.

  In the present embodiment, there is an alert function in the communication unit 48, and depending on the system, when a log indicating that a specific action has been taken is acquired, a notification mail or the like is transmitted to the administrator. For example, when a confidential material is copied to a USB memory, there is a possibility of taking out confidential information. Therefore, a notification to that effect is transmitted to an administrator or the like.

<About the security detection determination in the security detection determination means 46>
Next, security detection determination in the security detection determination means 46 will be described. The security detection determination means 46 determines security detection using the result of integrating a plurality of logs.

  For example, regarding the log in FIG. 4B described above, the user “Ikeda” logs in to the PC 2 or copies the material 3 to the USB memory, but does not record that the user has entered the room. Therefore, when the user “Ono” enters the room, “co-accompaniment” (“Ikeda” or someone illegally invades without performing entry / exit operation) occurs, or the person who entered / combined illegally A rough guess can be made as to whether or not the user is logged in to Ikeda's PC2.

  Similarly, the fact that the user “Ikeda” has copied confidential information to the USB memory may be detected by log collection software installed in the PC 2 in advance. As shown in FIG. 4 (b), what is being done in the monitoring area for 1 hour and 50 minutes until the PC 2 is logged off at 11:00 (11:00) as shown in FIG. 4 (b). Looking at the log of the cabinet 25, since it has been opened and closed twice, there is a risk of taking out documents in the cabinet such as confidential documents.

  As described above, the operation log can be accurately acquired in each system, and the history of each operation content may be recorded, but this information is used when referring to the integrated log from the viewpoint of personal behavior management. It may not be possible to grasp the situation sufficiently, and it cannot be said that the log is effectively used.

  In addition, the actual log information of the acquired log information is complicated, and the log format may be different for each system. Therefore, in this embodiment, a standard format is prepared in advance, and logs are integrated according to the standard format. Further, the screen generation unit 47 generates a screen that is visually easy for the user to manage the log and displays it on the screen. . Thereby, log information can be used effectively and high-precision integrated log management can be realized.

  Here, an example of a log display screen generated by the screen generation unit 47 will be described with reference to the drawings. FIG. 6 is a diagram illustrating an example of log information screen generation in the present embodiment.

  6A to 6C show an example of the integrated log result for each individual. Specifically, FIG. 6 (a) shows the behavior of the user “Ono”, FIG. 6 (b) shows the behavior of the user “Ikeda”, and FIG. 6 (c) considers the log of the security system 21. Shows the behavior of the user “Ono”. Each point in FIG. 6 indicates a point in time when the log is accumulated. Further, for example, “08: 00-10: 30” of the entrance / exit management system in FIG. 6A indicates that the user “Ono” was in the room (area), and “08: 10-10: “00” indicates the time from “login” to “logoff”.

  Here, as described above, the communication between the company 11 and the security company 12 uses the Internet or VPN communication network 13-1, and the operation of each system uses a common authentication card (IC card) 27, Log information is output in real time. In consideration of the real-time nature of detection of fraud, etc., the security company 12 side receives log information of each managed device on the company 11 side, and performs integration and analysis. This is because when integration is performed locally, it may take a waiting time such as waiting until all the logs of other systems are available.

  Moreover, the screen generation means 47 can be shown as shown in FIGS. 6A to 6C by the integrated log check mechanism by the security detection determination means 46. Here, considering the log of the security system 21, considering the combination of the diagram shown in FIG. 6A and the status of the security system (information such as ON / OFF of the security system) that can be acquired on the security company 12 side, An integrated log check mechanism will be constructed. Since the security system 21 is usually operated when entering a building or leaving the building (the last person leaving the building) to switch the security state, the operation time is before the entrance / exit management system 22. Or behind.

  By generating the screen as shown in FIG. 6 described above, the integrated log management unit 45 can manage a series of actions in a time series from the integrated log information. It should be noted that the security detection determination means 46 can perform the following illegal actions that can be detected by each security target device alone without referring to the integrated log, for example, a security release operation of an unauthorized person in each system, or in a PC It is assumed that data copy to a USB memory or the like, data attachment by e-mail, etc. are not considered in the present check mechanism.

  In addition, as an example of fraud that can be detected from the integrated log, the security detection determination unit 46, for example, intrudes based on detection information other than a sensor that detects a person when the security system is in an ON (= guarding) state. It is determined that the person may have existed. Moreover, the security detection determination means 46 determines with the possibility of intrusion to a building, when some operation history in an entrance / exit management system is acquired. Furthermore, when the security detection determination unit 46 acquires some operation history for the PC 23, there is a possibility of intrusion into the room or intrusion from the network. Moreover, the security detection determination means 46 determines that there is a possibility of a link to log data and intrusion into the network when a log of network passage from the outside is acquired.

  The security detection determination means 46 determines that there is a possibility of entering the room when any operation history in the multifunction device 24 is acquired. The security detection determination means 46 determines that there is a possibility of entering the room when any operation history in the cabinet 25 is acquired.

  In addition, the security detection determination means 46 can acquire a certain amount of time after the entry / exit management system 22 has acquired a history of entry operation (entrance state) when the security system is OFF (= security is being released). Even if other operation histories are not acquired, it is determined that there is a possibility that there is something that has entered the room without a purpose, or that the behavior after entering the room may be unknown.

  Further, the security detection determination unit 46 determines that there is a possibility of intrusion on the network when the operation history in the PC 23 is acquired even though the history of login to the PC 23 is not acquired. Further, the security detection determination unit 46 determines that there is a possibility that the wrong multifunction device 24 has been instructed to print if the log is not output to the multifunction device only by performing the print execution operation on the PC 23. In addition, when the security detection determination means 46 does not operate anything on the PC 23 and acquires a log such as mail transmission in the network device, the possibility of virus infection or network such as “zero day attack” It is determined that there is a possibility that a malicious attack that was performed before the countermeasure for the above problem was announced. In addition, when the security detection determination unit 46 acquires a multifunction machine (copy) or cabinet log having the same personal identification information as the person operating the PC 23 during the operation of the PC 23, Judge that there is a possibility. The security detection determination unit 46 determines that there is a possibility of copying or taking out confidential information when a log that repeatedly opens and closes the cabinet 25 and uses the multifunction device 24 is acquired.

  In addition, the security detection determination means 46 has entered the room together with the room when it has not acquired the history of entering the room in the entrance / exit management system (leaving the room) and has acquired any operation history in the PC 23. It is determined that there is a possibility that the person has illegally operated the PC 23 without leaving the room or that there is a possibility of intrusion from the network. The security detection determination unit 46 determines that there is a possibility of intrusion into the network when an external network passage log is acquired. Further, when any operation history in the multifunction peripheral is acquired, it is determined that there is a possibility of sharing with the room. Moreover, the security detection determination means 46 determines with the possibility of accompanying to a room, when some operation history in the cabinet 25 is acquired.

  Further, as an integrated log check mechanism, the notification means 48 provides a system for automatically detecting the frauds listed above and incorporating them into the integrated log system, and detecting the possibility of fraud etc. Sending notification emails to the administrator on the user side, or emergency response (providing emergency reports including response methods, telephone contact, etc.) by monitoring personnel.

  Further, the screen generation means 47 periodically reports the accumulated integrated log and provides it to an administrator or the like as provision of a regular report based on the integrated log analysis result. The contents of the report are not limited to simply totaling the logs, but are provided with contents including, for example, log analysis results by a supervisor, security advice based on the analysis results, and the like.

<Security detection judgment example>
Here, a security detection determination example in the security detection determination means 46 will be described with reference to the drawings. FIG. 7 is a diagram illustrating an example of the integrated log information used for security detection determination. The items used in FIG. 7 include, for example, “security”, “sensor (intrusion alarm)”, “entrance / exit information”, “terminal such as PC”, “cabinet”, “network”, “detection content”, “priority” Degree "," correspondence "and so on. Here, “security” means “ON” indicates the security set status, “OFF” indicates the security release status, “other” indicates any security status, and “OFF → ON” indicates the security set status. “ON → OFF” indicates when the security is released.

  In addition, in “sensor (intrusion alarm)”, “entrance / exit information”, “terminal such as PC”, “cabinet”, “network”, for example, acquisition of a log with a regular procedure indicates “O”, Acquiring logs that are not accompanied indicates "△", indicates that there is no acquired log, indicates "x", and indicates whether or not there is an acquired log, indicates "-", and comprehensively determines multiple acquired logs In this case, “*” is shown.

  Examples of “detected contents” include “possibility of intrusion”, “possibility of network intrusion”, “unclear behavior (no log acquisition for a predetermined time)”, “possibility of erroneous operation”, “ The detection contents as shown in FIG. 7 such as “possibility of taking out confidential information”, “possibility of system down”, etc., or the detection contents necessary for security are not limited to this.

  In addition, as an example of “priority”, when there are multiple detections or when there is multiple detections, the security response is set or executed according to its importance. It is. As a specific example of “priority”, for example, important, large, medium, small, etc. are stored.

  Examples of “response” include “rushing”, “preventing access to other assets”, “blocking the network”, “administrator emergency contact or system management company emergency contact”, “registrant list” ”And the like, and the correspondence contents necessary for the other guards as shown in FIG. 7 are managed. Note that the screen of FIG. 7 is generated by the screen generation unit 47, and an administrator or the like can arbitrarily add or change settings.

  FIG. 8 is a diagram illustrating an example of a suspicious person list. 8, the integrated log management unit 45 extracts the suspicious information as shown in FIG. 8 from the determination result in the security detection determination unit 46 shown in FIG. 7, and the screen generation unit 47 displays the list. Generate. The list shown in FIG. 8 is added to the list at the time of log information acquisition, for example, as a suspicious person list outline for a person who has performed an action that cannot be determined whether it is fraudulent or not.

  Further, the items of the suspicious person list include, for example, “No.”, “ID”, “Behavior content subject to list addition”, “Count”, and the like. Thereby, the monitoring person can watch the user who exists in a suspicious person list | wrist, and can raise the accident prevention effect by a fraud etc., and the crime before crime prevention.

  Also, in the integrated log management means 45, for example, if the same suspicious behavior is performed twice or another suspicious behavior is performed three times, an alarm is output and an emergency contact from the supervisor to the administrator on the user side, etc. I do. Thereby, security can be performed with higher accuracy, and crimes and the like can be prevented before major crimes occur.

<Integrated log management processing procedure>
Here, the integrated log management processing procedure executed by the execution program (integrated log management program) in the present invention will be described with reference to a flowchart. FIG. 9 is a flowchart showing an example of the integrated log management processing procedure in the present invention.

  In FIG. 9, it is first determined whether or not to acquire log information from all managed devices that perform security detection (S01). Here, log information is not acquired from all managed devices. In the case (NO in S01), a log information acquisition request is output to the managed device (S02), and the corresponding log information is acquired (S03).

  Further, in the process of S01, when log information is acquired from all managed devices that perform security detection (YES in S01), or after the process of S03 is completed, the logs are integrated and managed (S04). ). Moreover, security detection determination is performed using the integrated log (S05).

  Also, as a result of the security detection determination, it is determined whether or not a response by a security guard or the like is necessary (S06). If a response is required (YES in S06), the security company, the administrator, the security guard according to a predetermined condition. The person in charge is notified (S07). Further, in the process of S06, when a response by a guard or the like is not necessary (NO in S06), or after the process of S07 is completed, a screen is generated as necessary (S08). Also, it is determined whether or not to end the integrated log management process (S09). If the integrated log management process is not ended (NO in S09), the process returns to the process of S01, and the conditions of the management target device are changed. The processing described later is repeated. If the integrated log management process is terminated in S09 (YES in S09), the integrated log management process is terminated.

<Integrated Log Management System: Second Embodiment>
Next, a second embodiment of the integrated log management system described above will be described with reference to the drawings. FIG. 10 is a diagram illustrating an example of a schematic configuration of the integrated log management system according to the second embodiment. In the example shown in FIG. 10, as in the first embodiment, for example, security systems such as crime prevention and security installed for each company, and OA (Office Automation) generally used in companies. An integrated management system using log information in a device or the like will be described. In addition, the same reference numerals are assigned to the configurations and the like that are substantially the same as those in the first embodiment described above, and a specific description thereof is omitted here.

  In the second embodiment, the security system 21 acquires log information from the entry / exit management system 22, the PC 23, the multifunction device 24, the cabinet 25, and the network device 26 via the LAN, and acquires the acquired log information as a security system. Is output to the security company 12 via the communication network 13 that is transmitting the above signal.

  That is, in the second embodiment shown in FIG. 10, for example, when the security system 21 as a security control device on the company 11 side has a function of performing large-capacity communication, a log transmitted from each managed device Information can be transmitted to the integrated log management system via the security system 21 by communication such as VPN. In addition, when the security company 12 also acquires log information of each managed device, it does not transmit an acquisition request for each managed device, but only transmits it to the security system 21 via the communication network 13, and requests the requested management. Log information from only the target device can be acquired. Thereby, a security signal and log information can be transmitted to the security company 12 through one line, and management of security and transmission / reception can be easily performed.

  As described above, according to the present invention, log information managed by each device can be managed in an integrated manner and used effectively. Specifically, consider each operation order for all logs from physical space (security system, access control system, PC, multifunction device, cabinet, network connection device, etc.) to virtual space (PC operation, network, etc.). By effectively analyzing the log information from various viewpoints, it becomes possible to clarify new problems that could not be grasped from the logs that have been managed separately by each managed device so far. In other words, it becomes possible to grasp the situation of problematic situations that were difficult to discriminate only by log information that was managed separately, and it is possible to ensure thorough compliance of companies.

  Further, according to the present invention, by providing as an ASP (Application Service Provider) model service, it is not necessary to require the user to introduce an advanced integrated system. It is possible to introduce a mechanism (service).

  As another application example, for example, by associating managed devices as follows, security and accuracy of log information can be improved. For example, when an abnormality occurs in the security system 21, other devices to be managed (input / output management system 22, multifunction device 24, etc.) and the entire system are disabled. Further, if the room entry operation is not performed in the entrance / exit management system 22, the PC 23, the multifunction device 24, the cabinet 25, etc. cannot be used. Also, for example, when a surveillance camera is installed in the system and an illegal act is performed, the surveillance camera captures the current in cooperation with the acquisition of the unauthorized log, and the log and image data are linked and managed. To do. As a result, it is possible to acquire images and videos including before and after the time of the log information in which there is a problem.

  In the present invention, the integrated log management system can have a learning function. Specifically, in the integrated log formed from log information obtained from all managed devices, in order to manage the log for each individual, the daily behavior history is accumulated and learned, and the behavior pattern of that person is constructed. be able to. Note that each individual's behavior is always compared with the behavior pattern and learns about unique behavior (behavior that is not usually performed) so that suspicious behavior can be detected. Thereby, it is possible to prevent the occurrence of an accident due to an illegal act or the like.

  The preferred embodiments of the present invention have been described in detail above, but the present invention is not limited to such specific embodiments, and various modifications, within the scope of the gist of the present invention described in the claims, It can be changed.

10, 70 Integrated log management system 11 Company 12 Security company 13 Communication network 21 Security system 22 Entrance / exit management system 23 PC (Personal Computer)
24 MFP 25 Cabinet 26, 31 Network connection device 27 Authentication card 32 Integrated log management device 41 Input means 42 Output means 43 Storage means 44 Log information acquisition means 45 Statistics log management means 46 Security detection judgment means 47 Screen generation means 48 Notification means 49 Transmission / Reception Unit 50 Control Unit 61 Input Device 62 Output Device 63 Drive Device 64 Auxiliary Storage Device 65 Memory Device 66 CPU (Central Processing Unit)
67 Network connection device 68 Recording medium

Claims (9)

In an integrated log management device for integrating log information for a plurality of different managed devices and determining whether or not security is required from the integrated log information,
Log information acquisition means for acquiring log information of the managed device;
Integrated log management means for integrating a plurality of log information obtained by the log information acquisition means based on a predetermined condition and managing a series of actions in time series;
Detecting a suspicious person from the action obtained by the integrated log management means, security detection determination means for determining the necessity of security from the detected content and priority,
Screen generation means for generating a screen for displaying the determination result obtained by the security detection determination means using a plurality of log information;
An integrated log management apparatus, comprising: a notification unit that performs a notification to that effect in accordance with a determination result in the security detection determination unit and the priority. The integrated log management means includes
The integrated log management apparatus according to claim 1, wherein log information for each managed device is individually integrated based on personal identification information. The screen generation means includes
The integrated log management apparatus according to claim 1, wherein a suspicious person list is generated from suspicious person information obtained by the security detection determination unit. In the integrated log management method for integrating the log information for multiple different managed devices and determining the necessity of security from the integrated log information,
A log information acquisition step of acquiring log information of the managed device;
An integrated log management step of integrating a plurality of log information obtained by the log information acquisition step based on a predetermined condition and managing a series of actions in time series;
A security detection determination step of detecting a suspicious person from the action obtained by the integrated log management step, and determining the necessity of security from the detected content and priority;
A screen generation step for generating a screen for displaying the determination result obtained by the security detection determination step using a plurality of log information;
An integrated log management method comprising: a notification step of performing notification according to the determination result in the security detection determination step and the priority. The integrated log management step includes:
3. The integrated log management method according to claim 2, wherein log information for each managed device is individually integrated based on personal identification information. The screen generation step includes
6. The integrated log management method according to claim 4, wherein a suspicious person list is generated from suspicious person information obtained by the security detection determination step. In the integrated log management program for integrating log information for multiple different managed devices and determining the necessity of security from the integrated log information,
Computer
Log information acquisition means for acquiring log information of the managed device;
Integrated log management means for integrating a plurality of log information obtained by the log information acquisition means based on a predetermined condition and managing a series of actions in time series,
Detecting a suspicious person from the action obtained by the integrated log management means, and security detection determination means for determining whether or not security is necessary from the detected contents and priority,
Screen generation means for generating a screen for displaying the determination result obtained by the security detection determination means using a plurality of log information; and
The integrated log management program for functioning as a notification means for performing a notification to that effect according to the determination result in the security detection determination means and the priority. The integrated log management means includes
8. The integrated log management program according to claim 7, wherein log information for each managed device is individually integrated based on personal identification information. The screen generation means includes
The integrated log management program according to claim 7 or 8, wherein a suspicious person list is generated from suspicious person information obtained by the security detection determining means.

Images