JP2012008688A - Associated information acquisition device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To avoid degradation in accuracy of association which is caused by associating information undesirable to associate.SOLUTION: Operation history collection means 2 collects an operation history on a user's computer, and stores it in an operation history DB3. An association source operation DB4 stores association source keywords. Associating means 7 searches the operation history including the association source keyword from the operation history DB3, associates the operation history of a search result and an operation history which is close to the operation history of the search result in time, and stores them in an associated information storage DB6.

Description

  The present invention relates to a related information acquisition apparatus that associates information updated or referred to by a user based on an operation history on the user's computer.

  When a user is editing a document on a computer such as a personal computer, if the reference information such as the URL or file of the referenced Web is associated with the editing operation of the document, for example, the editing of the document is performed. Useful information can be specified, and the same information can be presented as reference information when the document is re-edited later. In addition to the document editing work, it is also useful to associate a help file or the like referred to by the user when operating the executed application with the executed application.

  An example of a technique for associating information as described above based on an operation history on a user's computer is described in Patent Document 1.

  As shown in FIG. 33, the file-related acquisition device described in Patent Document 1 includes a file access device, a file access monitoring device, and a file storage device. The file access monitoring device collects file editing information including an editing start date and time, an editing end date and time, total visible time information, and a storage history for a file in a file storage device opened by the file access device. Next, a file having a storage history is extracted from the collected file editing information as an editing target file. For the extracted editing target file, based on the editing start time information and editing end time information, the file name and visible time of one or more other reference files that were open during the time that the editing target file was open Get cumulative information. Further, the file name of the acquired reference file and the total visible time information are registered as related file information in association with the file to be edited. In addition, it is assumed that a long-viewable cumulative time is strongly related.

JP 2006-293936 JP

  However, when the information of the operation history is associated using the technique of Patent Document 1, there is a problem that information that is not desired to be related is also related. This is because, in the operation history, files opened at the same time are all related to each other even if they are irrelevant files.

  An object of the present invention is to provide a related information acquisition apparatus that solves the above-mentioned problem, that is, the problem that information that is not desired to be related is related and the accuracy of the association is reduced.

  A related information acquisition apparatus according to an aspect of the present invention stores an operation history collection unit that collects an operation history on a user's computer, an operation history storage unit that records the collected operation history, and a related source keyword. The related source operation storage means and the operation history including the related source keyword are searched from the operation history storage means, and the operation history of the search result is associated with the operation history of the search result and the operation history close in time. An association unit; and an associated information storage unit that stores an operation history associated by the association unit.

  Since the present invention has the above-described configuration, it is possible to prevent information that is not desired to be related to each other, and to perform highly accurate association.

It is a block diagram of a 1st embodiment of the present invention. It is a block diagram of the 2nd Embodiment of this invention. It is a figure which shows the data which a file system monitoring means collects. It is a figure which shows the data which a network monitoring means collects. It is a figure which shows the data which a window operation monitoring means collects. It is a figure which shows the file operation history table preserve | saved at operation history DB. It is a figure which shows the network operation history table preserve | saved at operation history DB. It is a figure which shows the Window operation history table preserve | saved at operation history DB. It is a figure which shows the data table for file operation log | history table search preserve | saved at the related source work DB. It is a figure which shows the data table for network operation log | history table search preserve | saved at the related source work DB. It is a figure which shows the data table for window operation log | history table search preserve | saved at the related source work DB. It is a figure which shows the data table for file operation log | history table search preserve | saved at the related work DB. It is a figure which shows the data table for network operation history table search preserve | saved at the related work DB. It is a figure which shows the data table for window operation history table search preserve | saved at the related work DB. It is a figure which shows the data preserve | saved at related information preservation | save DB. It is a figure which shows the operation | movement flow of a file system monitoring means. It is a figure which shows the operation | movement flow of a network monitoring means. It is a figure which shows the operation | movement flow of a window operation monitoring means. It is a figure which shows the operation | movement flow of an operation history collection means. It is a figure which shows the operation | movement flow of a correlation means. It is a figure which shows the operation | movement flow of a correlation means. It is a figure which shows the flow which collects a log. It is a figure which shows the log aggregation table preserve | saved at operation history DB. It is a figure which shows an example of the data which a file system monitoring means collects. It is a figure which shows an example of the data which a network monitoring means collects. It is a figure which shows an example of the data which a window operation monitoring means collects. It is a figure which shows an example of the data of the file operation history table of operation history DB. It is a figure which shows an example of the data of the network operation history table of operation history DB. It is a figure which shows an example of the data of the Window operation history table of operation history DB. It is a figure which shows an example of the data of the log aggregation table of operation history DB. It is a figure which shows an example of the data preserve | saved in related source work definition DB. It is a figure which shows an example of the data preserve | saved in related destination work definition DB. It is a figure which shows an example of the data preserve | saved in related information preservation | save DB. It is a block diagram of the technique relevant to this invention.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

[First embodiment]
Referring to FIG. 1, the related information acquisition apparatus 1 according to the first embodiment of the present invention includes an operation history collection unit 2, an operation history DB (database) 3, a related source operation DB 4, a related information storage DB 6, and an association unit. Consists of seven.

  The operation history collection means 2 collects operation histories on the user's computer. The operation history collecting means 2 is, for example, a file operation history including a file name operated by a user, an operation content to the file, a file operation history including a process ID, a URL accessed by the user, HTTP header data, HTTP body data, and a network operation including a process ID. One, two, or three types of operation histories are collected from the window operation history including the history, the ID of the window operated by the user, the window operation, the data, the application name, and the process ID.

  The operation history DB 3 records the operation history collected by the operation history collection means 2.

  The related source operation DB 4 stores related source keywords. The related source operation DB4 is, for example, one or two types of keywords that characterize a search operation by a user, keywords that characterize a user's help or specification reference operation, keywords that characterize an operation related to a specific keyword by a user, or Memorize 3 types of keywords.

  The associating means 7 searches the operation history DB3 for an operation history including the related source keyword stored in the related source operation DB4, an operation history of the search result, an operation history close to the operation history of the search result, Associate. Further, the associating means 7 may extract predetermined information such as a file name, URL, data, and application name from the associated operation history and associate them with each other.

  The related information storage DB 6 stores the operation history and data associated by the association means 7.

  Next, the operation of the related information acquisition apparatus 1 according to the present embodiment will be described.

  The operation history collection means 2 collects the operation history on the user's computer and stores it in the operation history DB 3. Further, the related source operation DB 4 stores related source keywords in advance.

  The associating means 7 searches the operation history DB 3 for an operation history including the related source keyword stored in the related source operation DB 4. Then, the associating means 7 associates the operation history of the search result with the operation history of the search result and the operation history close in time, and stores them in the related information storage DB 6.

  As described above, according to the present embodiment, it is possible to prevent information that is not desired to be associated with each other, and to associate with high accuracy. The reason is that by registering related source keywords that characterize the information that you want to relate as related sources, related source information that does not include related source keywords, that is, related source information that you do not want to be related, is excluded from the association. is there. Another reason is that an operation history that is close in time is associated with the operation history.

  This embodiment can be variously added and changed as follows.

  For example, it may be configured to further include a related destination operation DB 5 that stores related destination keywords. The related destination operation DB5 is, for example, one or two types of keywords that characterize a document editing operation by a user, keywords that characterize an application setting change operation by a user, and keywords that characterize an operation related to a specific keyword by a user, Or memorize three kinds of keywords.

  In the configuration including the related operation DB4 in addition to the related source operation DB4, the associating means 7 searches the operation history DB3 for an operation history including the related source keyword, the operation history of the search result, and the search The operation history as a result and the operation history close in time and including the related keyword are associated with each other and stored in the related information storage DB 6. In this way, by registering related destination keywords that characterize the information to be related as related destinations, information on related destinations that do not include related destination keywords, that is, information on related destinations that do not want to be related to information including related source keywords. The association can be prevented, and the association can be performed with higher accuracy.

  Alternatively, in the configuration including the related source operation DB4 in addition to the related source operation DB4, the associating means 7 searches the operation history DB3 for an operation history including the related source keyword, and an operation history of the search result, An operation history close to the time before the operation history of the search result and an operation history close to the time later may be associated with an operation history including the same related keyword. In this way, by registering related destination keywords that characterize the information to be related as related destinations, information on related destinations that do not include related destination keywords, that is, information on related destinations that do not want to be related to information including related source keywords. It can prevent being associated. In addition, if the operation histories before and after the operation history including the related source keyword include the same related destination keyword, it is possible to associate with higher accuracy. The reason is as follows.

  Generally, when a user performs a certain work, for example, a document editing work, when another work related to the work, such as a document, is searched, the original work is often returned after the search. That is, in many cases, the flow is such that the document editing operation → the literature search → the document editing operation is resumed. On the other hand, when a user finishes a certain task and moves to another task that is not related, the user rarely returns to the original task. For this reason, by registering in advance the keywords that characterize the literature search as related source keywords and the keywords that characterize the document editing work as related destination keywords, from the operation history, document editing work → document research → document It is possible to detect a flow location such as an editing operation.

[Second Embodiment]
A second embodiment of the present invention will be described with reference to FIG. FIG. 2 is a block diagram of the second embodiment of the present invention.

  Referring to FIG. 2, the second embodiment includes a client 100 and a server 200. The client 100 is a computer such as a personal computer used by a user such as a company employee. The server 200 is a computer such as a personal computer installed in a management department of a company, for example. The client 100 and the server 200 are connected to be able to communicate with each other through a network 300 such as a LAN, a WAN, or the Internet. In FIG. 2, one client 100 is connected to the server 200, but two or more clients 100 may be connected.

  The client 100 includes PC operation monitoring means 10. The PC operation monitoring means 10 has a function of monitoring user operations on the client 100. The PC operation monitoring unit 10 includes a file system monitoring unit 11, a network monitoring unit 12, and a window operation monitoring unit 13.

  The server 200 includes an operation history collection unit 20, an association unit 30, an operation history DB 40, a related source operation DB 50, a related destination operation DB 60, and a related information storage DB 70.

  Each of these has the following functions.

  The file system monitoring unit 11 monitors user operations on the file system on the client 100, collects logs when files are opened, closed, read, and written, and transmits the logs to the operation history collection unit 20.

  FIG. 3 shows an example of a log collected by the file system monitoring means 11. Collected data by file system monitoring is composed of time, path, process ID, application name, operation content, and user ID. The time is the time when the log is collected. The path is a file path of a file operated by the user. The process ID is the ID of the process that operated the file. The application name is the application name of the process. The operation content is one of open, close, read, and write. The user ID is the ID of the user of the client 100.

  The network monitoring unit 12 monitors packets transmitted and received between the client 100 and the network 300. When there is HTTP communication, the network monitoring unit 12 collects the log and transmits it to the operation history collecting unit 20.

  FIG. 4 shows an example of data collected by the network monitoring means 12. Data collected by network monitoring consists of time, URL, HTTP Header, HTTP Body, process ID, application name, and user ID. The time is the time when HTTP communication is performed. URL is the URL of the access destination. HTTP Header is header data of HTTP communication. HTTP Body is body data of HTTP communication. The process ID is the ID of the process that communicated. The application name is the application name of the process. The user ID is the ID of the user of the client 100.

  The window operation monitoring means 13 monitors the window system of the client 100, collects the log when the user operates the window, and sends it to the operation history collecting means 30.

  FIG. 5 is an example of data collected by the window operation monitoring means 13. Data collected by window monitoring is composed of time, window ID, window operation, data, process ID, application name, and user ID. The time is the time when the user operates the window. WindowID is an ID that uniquely identifies the operated window. The window operation is an operation content performed by the user on the window, and is any of open, close, active, inactive, keyboard operation, and mouse operation. The data is data input / output in the window by the window operation. The process ID is the ID of the process that operated the window. The application name is the application name of the process. The user ID is the ID of the user of the client 100.

  The operation history collection unit 20 adds a unique ID for identification to the data sent from the PC operation monitoring unit 10 and stores it in the operation history DB 40. 6 to 8 are examples of data stored in the operation history DB 40. FIG. FIG. 6 is a file operation history table in which the log ID is added to the data shown in FIG. 3 sent from the file system monitoring unit 11 of the PC operation monitoring unit 10 and stored. FIG. 7 is a network operation history table in which the log ID is added to the data shown in FIG. 4 sent from the network monitoring unit 12 of the PC operation monitoring unit 10 and stored. FIG. 8 is a window operation history table in which the log ID is added to the data shown in FIG. 5 sent from the window operation monitoring means 13 of the PC operation monitoring means 10 and stored.

  The related source operation DB 50 and the related destination operation DB 60 hold keywords used when searching the operation history DB 40 for information to be related. The object of the present embodiment is to associate information referred to by a user with information such as a document edited with reference to the referred information and an executed application operation. The related source operation DB 50 holds keywords used when searching for information referred to by the user from the operation history DB 40, and the related destination operation DB 60 stores information such as edited documents and executed application operations from the operation history DB 40. The keyword when searching for is stored.

  9 to 11 are examples of data stored in the related source operation DB 50. FIG.

  FIG. 9 is an example of a search data table that holds keywords for searching for information referred to by the user from the file operation history table shown in FIG. 6 stored in the operation history DB 40. In this search data table, values are set for any one, two, three, or all of the path, application name, operation content, and user ID.

  FIG. 10 is an example of a search data table that holds keywords for searching for information referred to by the user from the network operation history table as shown in FIG. 7 stored in the operation history DB 40. In this search data table, values are set for any one, two, three, four, or all of URL, HTTP Header, HTTP Body, application name, and user ID.

  FIG. 11 is an example of a window monitoring table search data table that holds keywords for searching for information referred to by the user from the window monitoring table as shown in FIG. 8 stored in the operation history DB 40. In the window monitoring table search data table, values are set for any one, two, three, or all of the window operation, data, application name, and user ID.

  12 to 14 are examples of data stored in the related destination operation DB 60. FIG.

  FIG. 12 is an example of a search data table that holds keywords for searching for information edited or set by the user from the file operation history table shown in FIG. 6 stored in the operation history DB 40. In this search data table, values are set for any one, two, three, or all of the path, application name, operation content, and user ID.

  FIG. 13 is an example of a search data table that holds keywords for searching for information edited or set by the user from the network operation history table shown in FIG. 7 stored in the operation history DB 40. In this search data table, values are set for any one, two, three, four, or all of URL, HTTP Header, HTTP Body, application name, and user ID.

  FIG. 14 is an example of a window monitoring table search data table that holds keywords for searching for information edited or set by the user from the window monitoring table shown in FIG. 8 stored in the operation history DB 40. is there. In the window monitoring table search data table, values are set for any one, two, three, or all of the window operation, data, application name, and user ID.

The associating means 30 searches the operation history DB 40 for log candidates to be related source operations using the data stored in the related source operation DB 50 as keywords and related destination operations using the data stored in the related destination operation DB 60 as keywords. Search the operation history DB 40 for a candidate log. Then, when the log candidate that becomes the related source operation and the log candidate that becomes the related destination operation satisfy a predetermined condition, the associating unit 30 selects the log of the related source operation and the log of the related destination operation, Are stored in the related information storage DB 70. In the present embodiment, the associating unit 30 determines that the log of the related source operation and the related destination operation when the log candidate that is the related source operation and the log candidate that is the related destination operation satisfy the following conditions: Associate with other logs.
Condition 1: The relation source operation log and the relation destination operation log are continuous in time in the history of the operation history DB40.
Condition 2: A related destination operation in which the operation log executed immediately before the related source operation log and the operation log executed immediately after the related source operation log are searched from the related destination operation DB 60 with the same keyword. Log.

  That is, in the present embodiment, for example, in the process of creating the document X, when hitting a document on the Web, for example, it is common to return to the creation of the original document X immediately after referring to the document. If the operation history such as the creation operation of the document X → the browsing of the web → the creation operation of the document X is stored in the operation history DB 40, the creation of the document X and the browsing of the web are related to each other. It is related to the operation.

  FIG. 15 is an example of data stored in the related information storage DB. The related information includes a related source path, a related destination path, a user ID, related source data, related destination data, a related source aggregation ID, and a related destination aggregation ID.

  Next, the operation of each of the above means will be described with reference to FIGS.

  First, the operation of the file system monitoring means 11 will be described with reference to FIG. The file system monitoring means 11 is activated and resident when the client 100 is activated (step A001), and monitors the file system (step A002). Next, when a file operation of the process is detected (step A003), the data shown in FIG. 3 is collected and transmitted to the operation history collecting means 20 (step A004).

  Next, the operation of the network monitoring unit 12 will be described with reference to FIG. The network monitoring unit 12 is activated and resident when the client 100 is activated (step B001), and monitors network communication (step B002). Next, when network communication of the process is detected (step B003), the data shown in FIG. 4 is collected and transmitted to the operation history collecting means 20 (step B004).

  Next, the operation of the window operation monitoring unit 13 will be described with reference to FIG. The window operation monitoring means 13 is activated and resident when the client 100 is activated (step C001), and monitors the window system (step C002). Next, when a user window operation is detected (step C003), the data shown in FIG. 5 is collected and transmitted to the operation history collecting means 20 (step C004).

  Next, the operation of the operation history collection means 20 will be described with reference to FIG. The operation history collection means 20 is activated and resident when the server 200 is activated (step D001). When data is received from the PC operation monitoring means 13 (step D002), a unique identification ID is added to the received data and stored in the operation history DB 40 as the data shown in FIGS. 6 to 8 (D003).

  Next, the operation of the associating means 30 will be described with reference to FIG.

  The associating means 30 is activated in accordance with the determined rule (step E001). For example, it starts at a fixed time once a day.

  When the associating unit 30 is activated, it first reads data from the related source operation DB 50 and searches the operation history DB 40 for a log using the read data as a keyword (step E002). For example, when data for searching the file operation history table is used as a keyword, log data in which data matching the keyword is recorded in the corresponding column of the file operation history table is searched. When using data in multiple columns as keywords, search each with AND.

  Next, the associating means 30 extracts one or more window operation logs related to one or more logs retrieved from the operation history DB 40 using the data of the association source operation DB 50 as keywords from the window operation history table of the operation history DB 40, Are consolidated into one aggregated log and stored in the log aggregation table of the operation history DB 40 (step E003).

  FIG. 22 is an example of a log aggregation table. The log aggregation table includes an aggregation ID, a log ID, and a user ID. The same aggregation ID is added to the log IDs related to each other.

  Next, the associating means 30 reads data from the related destination operation DB 60, and searches the operation history DB 40 using the read data as a keyword (step E004). Next, one or more window operation logs related to one or more logs of the search results are extracted from the window operation monitoring table of the operation history DB 40, consolidated into one aggregate log, and the log aggregation table of the operation history DB 40 (Step E005).

  Next, the associating means 30 arbitrarily selects one aggregated log that has not been processed from step E007 among the aggregated logs aggregated in step E003 (step E006). If the processing for all the aggregate logs has already been completed, the entire processing is terminated. If there is an aggregate log that has not yet been processed (YES in step E007), the log of the window operation history table in the operation history DB 40 corresponding to the log ID added to the aggregate log is acquired. Next, from the acquired logs, a log whose window operation is active or open and which has not been processed after step E010 is extracted, and the log with the earliest time is selected (step E008). If an unprocessed log cannot be extracted, the process returns to the selection of the consolidated log in step E006.

  If the log can be extracted (YES in step E009), the log immediately before that log is extracted, and the log aggregation table of the operation history DB 40 is searched with the log ID (step E010). If the log is missing, the process returns to step E008. If the log is included in the log aggregation table (YES in step E011), the window operation at the earliest time after the time when the window operation extracted in E008 is active becomes inactive or closed. Log is extracted (step E012). Then, the log ID immediately after that log is extracted, the log aggregation table of the operation history DB 40 is searched, and it is checked whether the aggregation ID is the same as the aggregation ID extracted in step E010 ( Step E013). If they are not the same, the process returns to step E008.

  If they are the same (YES in step E014), the process ID of the Windows (registered trademark) operation history table corresponding to the aggregation ID selected in E006 is extracted, and the file operation history table and the network operation history table are extracted using the process ID. , And the path, URL, and data are extracted (step E015). Similarly, the file monitoring table and the network monitoring table are searched with the process ID included in the aggregation ID determined to be the same in E014, and the path and URL are extracted (step E016). The path and URL extracted in step E015 and the path and URL extracted in step E016 are associated with each other and stored in the related information storage DB. Then, the process returns to Step E008 (Step E017).

  With reference to FIG. 21, the log aggregation method in steps E003 and E005 will be described. If the detected log is a log in the network operation history table, a search is made for a log in which the URL of the log and the Referer of the HTTP header match (step F002). If found, it further searches for a Referer that matches the URL of the log (step F003). Steps F002 and F003 are recursively executed until they are not found. Next, the window operation history table is searched with the process ID of the detected network history log, and the window ID is acquired (steps F004 and F005). The same aggregation ID is added to all the found Window IDs and stored in the log aggregation table of the operation history DB 40 (step F006).

  If the detected log is a log of the file operation history table, the window operation history table is searched with the process ID of the detected log, and the window ID is acquired (steps F004 and F005). The logs are aggregated in the same way as the logs in the network operation history table.

  If the detected log is a log in the window operation history table, the log is collected by executing step F005 and subsequent steps in the same manner as the network operation history table and the file operation history table.

  Next, the operation of the present embodiment will be described in more detail with a specific example.

Assume that the user A of the client 100 sequentially performs the operations listed below on the PC constituting the client 100.
(1) Start document creation software (application name is wordprosessor.exe) to edit ABC design documents.
(2) Open the “ABC Design Document” on the window W1 of the above document creation software.
(3) Write certain contents to the “ABC design document” on the window W1.
(4) Write another content to the “ABC design document” on the above window W1.
(5) For work management, access www.kinmu.com with browsing software (application name is Webbrower.exe). Window is W2.
(6) Browse www.kinmu.com/input on the window W2.
(7) Resume editing of “ABC Design Document” in document creation software window W1.
(8) Launched browsing software in a separate window W3 for investigation related to "ABC design document".
(9) Browse www.kensaku.com from the above window W3.
(10) Enter the keyword aaa in the search screen displayed in the window W3.
(11) The search result by the keyword aaa is displayed in the window W3.
(12) The home page of the aaa company on the first page of search results is displayed in a separate window W4.
(13) Moved from aaa company home page to abc company page on window W4.
(14) Switching to the window W3 where the search result was displayed.
(15) Browse 2 pages of search results on window W3.
(16) Browse the second page of the search results on the home page of the aabbbb company in a separate window W7.
(17) The editing of the “ABC Design Document” resumed in the document creation software window W1.
(18) Write certain contents to the “ABC design document” on the window W1.
(19) Write another content to the “ABC design document” on the above window W1.
(20) Write further contents in the “ABC design document” on the window W1.
(21) Start the control software (application name is control.exe) to perform certain settings. Window is W5.
(22) Launch the help software (application name is help.exe) to check how to set. Window is W6.
(23) Switch to the control software window W5 and write to the setting file.
(24) Exit the control software.

  When the operation as described above is performed on the client 100, the PC operation monitoring unit 13 collects history as shown in FIGS. 23 to 25, for example, and transmits it to the server 200. Further, the operation history collection means 20 of the server 200 adds a log ID to the received operation history, and stores the operation history as shown in FIGS. 26 to 28 in the operation history DB 40, for example.

  Further, it is assumed that data as shown in FIG. 30 is registered in the related source operation DB 50 of the server 200, for example.

  In FIG. 30, the upper row shows a search table that holds keywords used when searching the file operation history table of FIG. In this search table, values are set only for the application name items, and other items are NULL. This search table defines that a history whose application name is reader.exe is searched as a related source operation from the file operation history table of FIG.

  In FIG. 30, the middle row shows a search table that holds keywords used when searching the network operation history table of FIG. This search table is composed of two rows. In the first line, values are set only for the URL and application name items, and the other items are NULL. The first line defines that a history with the URL www.kensaku.com and the application name Webbroser.exe is retrieved as a related source operation from the network operation history table of FIG. In the second line, values are set only for HTTP Body and application name items, and other items are NULL. This second line defines that, from the network operation history table of FIG. 27, a history whose keyword “aaa” is included in HTTP Body and whose application name is “Webbroser.exe” is searched as a related source operation.

  Further, in FIG. 30, the lower part shows a search table that holds keywords used when searching the window operation history table of FIG. In this search table, values are set only for the application name items, and other items are NULL. This search table defines that a history whose application name is help.exe is searched as a related source operation from the window operation history table of FIG.

  Further, it is assumed that data as shown in FIG. 31, for example, is registered in the related destination operation DB 60 of the server 200.

  In FIG. 31, the upper row shows a search table that holds keywords used when searching the file operation history table of FIG. This search table is composed of three rows. In each line, values are set only for the application name and operation content items, and the other items are NULL. The first line defines that, from the file operation history table of FIG. 26, a history in which the application name is wordprocessor.exe and the operation content is write is searched as a related destination operation. Further, the second line defines that a history in which the application name is presentation.exe and the operation content is “write” is searched as a related destination operation from the file operation history table of FIG. Also, the third line defines that a history in which the application name is “control.exe” and the operation content is “write” is searched as a related destination operation from the file operation history table of FIG.

  In FIG. 31, the middle row shows a search table that holds keywords used when searching the network operation history table of FIG. This search table is composed of two rows. In the first line, values are set only for the URL and application name items, and the other items are NULL. This first line defines that the history with the URL www.blogsite.co.jp and the application name Webbrower.exe is searched as the related destination operation from the network operation history table in FIG. Yes. In the second line, values are set only for HTTP Body and application name items, and other items are NULL. The second line defines that a history in which keywordbbb is included in HTTP Body and the application name is Webbroser.exe is searched as a related destination operation from the network operation history table of FIG.

  Further, in FIG. 31, the lower row shows a search table that holds keywords used when searching the window operation history table of FIG. In this search table, values are set only for the application name items, and other items are NULL. This search table defines that a history whose application name is logviewer.exe is searched as a related destination operation from the window operation history table of FIG.

  When the contents as described above are recorded in the operation history DB 40, the related source operation DB 50, and the related destination operation DB 60, the associating means 30 performs the following operation.

  When the associating means 30 is activated (E001), it reads data used as a search keyword from the related source operation DB 50 and searches the operation history DB 40 (E002). In the case of the related source operation DB 50 shown in FIG. 30, there are a total of four rows, so the operation history DB 40 is searched a total of four times using four keywords.

  Then, in the process of searching the history whose URL is www.kensaku.com and the application name is Webbroser.exe for the network operation history table of FIG. 27, a log (www.kensaku Logs that viewed .com) are detected. In addition, in the process of searching for a history whose application name is help.exe for the window operation history table of FIG. 28, logs with log IDs wlog0023, wlog0024, and wlog0025 (help screen logs) are detected.

  Next, the associating means 30 aggregates the logs of the window operation history table related to the search result logs for each search result (E003). For example, in the case of the log of nlog0003 detected from the network operation history table, the following processing is performed.

Since the log of nlog0003 is a log detected from the network operation history table (F001), the associating means 30 searches the network operation history table for a log in which the URL of the log of nlog0003 is set in the Referer of the HTTP header (F002 ). Then, nlog0004 is detected. Next, www.kensaku.com/?keyword=aaa&p=1 stored in the URL of this nlog0004 is HTTP
When the log set in the header Referrer is searched from the network operation history table, nlog0005 is detected. Similarly, when the Referer is recursively searched by URL, nlog0006, nlog0007, and nlog0008 are detected.

  Next, the associating means 30 searches the window operation history table of FIG. 28 using p0003, p0004, and p0007, which are the process IDs of the detected nlog0003, nlog0004, nlog0005, nlog0006, nlog0007, and nlog0008 (F004). Then, w0003, w0004, and w0007 are detected as WindowID. Next, log IDs corresponding to these Window IDs, wlog0008, wlog0009, wlog0028, wlog0010, wlog0011, wlog0012, wlog0013, wlog0014, wlog0015, wlog0016, wlog0017 are extracted (F005), and these are used as one aggregated log. Therefore, clog0002, which is an aggregation log ID, is added and stored in the log aggregation table (F006). This allows browsing software to browse www.kensaku.com, search by keyword aaa, browse the aaa company's home page in the search results, move from the aaa company's home page to the abc company's page, and the abbb company's page in the search results Individual logs, such as browsing home pages, are aggregated into one aggregated log as a series of related logs.

  Further, in the case of the logs of wlog0023, wlog0024, and wlog0025 detected from the window operation history table, the associating means 30 extracts their wlog0023, wlog0024, and wlog0025 as log IDs corresponding to this WindowID because their WindowID is w0006. (F005), clog0004 is added as the aggregation log ID and stored in the log aggregation table (F006). As a result, the individual logs referring to the help are aggregated into one aggregated log as a series of logs related to each other.

  Next, the associating means 30 reads data as a search keyword from the related destination operation DB 60 and searches the operation history DB 40 (E004). In the case of the related destination operation DB 60 shown in FIG. 31, there are a total of 6 rows, so the operation history DB 40 is searched a total of 6 times using 6 keywords.

  Then, in the process of searching for a history in which the application name is wordprocessor.exe and the operation content is write in the file operation history table of FIG. 26, the log IDs are flog0002, flog0003, flog0004, flog0005, flog0006 A certain log (log concerning editing ABC design document by editing software) is detected. In addition, in the process of searching for a history in which the application name is control.exe and the operation content is writing in the file operation history table of FIG. 26, the log with the log ID flog0009 (the setting file of the control software) Change log) is detected.

  Next, the associating means 30 aggregates the logs of the window operation history table related to the search result logs for each search result (E005). For example, in the case of the above logs flog0002, flog0003, flog0004, flog0005, and flog0006 detected from the file operation monitoring table, the following processing is performed.

  Since the log of flog0002, flog0003, flog0004, flog0005, flog0006 is a log detected from the file operation history table (F001), the associating means 30 extracts p0001 as a process ID from these logs, and this p0001 in FIG. Search the window operation history table (F004). Then, logs of wlog0001, wlog0002, wlog0003, wlog0006, wlog0007, wlog0018, wlog0019 are detected. Since the window ID of these logs is w0001, the associating means 30 extracts wlog001, wlog002, wlog003, wlog006, wlog007, wlog018, and wlog019 (F005), adds clog0001 as the aggregation ID, and stores them in the log aggregation table. As a result, individual logs such as the start of the document creation software, the opening of the ABC design document, and the writing to the ABC design document are aggregated into one aggregated log as a series of related logs.

  Further, in the case of the log of the above flog0009 detected from the file operation history table, the association means 30 extracts wlog0020, wlog0021, wlog0022, wlog0026, wlog0027 as the log ID corresponding to this process ID because the process ID is p0005. Then, in order to make these into one aggregated log, clog0004 is added as the aggregated log ID and stored in the log aggregation table. As a result, individual logs such as starting the control software and writing to the configuration file are aggregated into a single aggregate log as a series of related logs.

  Next, the associating means 30 selects one aggregated log from the aggregated log group (relevant source aggregated log group) aggregated in step E0003, for example, an aggregated log whose aggregation ID is clog0002 (viewing www.kensaku.com with browsing software) , Search by keyword aaa, browsing aaa company home page in search results, moving from aaa company home page to abc company page, browsing aabbbb company home page in search results as related logs (Aggregated logs) is selected (E006).

  Next, the associating unit 30 opens the log of wlog0008 (opens the browsing software window) as the earliest time log among the logs included in the aggregated log whose operation content is “active” or “open”. Selected log) (E008).

  Next, the associating means 30 extracts the log wlog0007 immediately before the log of the selected wlog0008 from the operation history DB 40, and the log of the wlog0007 is aggregated in step E005 (aggregated log of related destinations). In order to check whether or not it is included in (), the aggregate log table is searched (E010). Then, it is detected that the log of wlog0007 is included in the aggregation log of clog0001 (the aggregation log related to the editing of the ABC design document by the document editing software).

  Therefore, the associating means 30 next logs that have become the operation contents of “inactive” or “closed” at the earliest time after the log of the selected wlog 0008 (however, the log next to its own log is (excluding logs that are logs included in the aggregated log clog0002 to which wlog0008 belongs) (E012). Then, the log of wlog0017 (log that closes the window of the browsing software) is detected (E012). Next, the associating means 30 checks whether or not wlog0018, which is a log immediately after the detected wlog0017, is included in the aggregated log clog0001 extracted in step E010 (the aggregated log in which the log of wlog0007 is included). (E013). Then, since it is included, the associating unit 30 determines that the aggregate log clog0002 and the aggregate log clog0001 are related to each other, and stores them in the related source aggregate ID and the related destination aggregate ID of the related information storage DB.

Further, the associating means 30 searches the file operation history table and the network monitoring table with the process IDs corresponding to wlog0008, wlog0009, wlog0010, wlog0011, wlog0012, wlog0013, wlog0014, wlog0015, wlog0016, wlog0017 included in the aggregate log clog0002. URL, “www.kensaku.com/?keyword=aaa&p=1
"," Www.aaa.com "," www.abc.com ","www.kensaku.com/?keyword=aaa&p=2","www.aaabbb.com"are extracted (E015).

  Further, the associating means 30 searches the file operation history table and the network history table with the process IDs corresponding to wlog0001, wlog0002, wlog0003, wlog0006.wlog0007, wlog0018, wlog0019 included in the aggregate log clog0001, and passes the path “C: "ABC design document" is acquired (E016).

Then, the association means 30 adds “www.kensaku.com/?keyword=aaa&p=1” to the related source path of the related information storage DB 70.
"," Www.aaa.com "," www.abc.com ","www.kensaku.com/?keyword=aaa&p=2","www.aaabbb.com" : \ ABC design document ". The URL referenced in this way can be associated with the edited document.

  Similarly, the referenced help file can be associated with the setting file set based on the help file.

  As described above, according to the present embodiment, as in the first embodiment, it is possible to prevent information that is not desired to be associated with each other, and to associate with high accuracy.

  Although the embodiment of the present invention has been described above, the present invention is not limited to the above embodiment, and various other additions and modifications can be made. In addition, the related information acquisition apparatus of the present invention can be realized by a computer and a program as well as by realizing the functions of the related information acquisition apparatus by hardware. The program is provided by being recorded on a computer-readable recording medium such as a magnetic disk or a semiconductor memory, and is read by the computer at the time of starting up the computer, etc. It is made to function as a related information acquisition apparatus in the form.

  According to the present invention, the present invention can be applied to all operations performed on a PC.

1 related information acquisition device 2 PC operation monitoring means 7 association means 3 operation history DB
4 Related source operation DB
5 Related operation database
6 Related information storage DB
10 PC operation monitoring means 11 File system monitoring means 12 Network monitoring means 13 Window operation monitoring means 20 Operation history collecting means 30 Association means 40 Operation history DB
50 related source operation DB
60 related operation database
70 related information storage DB

Claims (10)

Operation history collection means for collecting operation history on a user's computer;
Operation history storage means for recording the collected operation history;
Related source operation storage means for storing related source keywords;
An operation history including the related source keyword is searched from the operation history storage means, an operation history of the search result, an association means for associating the operation history of the search result with an operation history close in time,
And a related information storage unit that stores an operation history associated by the association unit. Operation history collection means for collecting operation history on a user's computer;
Operation history storage means for recording the collected operation history;
Related source operation storage means for storing related source keywords;
Related destination operation storage means for storing related destination keywords;
An operation history including the related source keyword is searched from the operation history storage unit, and the operation history of the search result and the operation history of the search result close in time and including the related destination keyword An association means for associating with
And a related information storage unit that stores an operation history associated by the association unit. Operation history collection means for collecting operation history on a user's computer;
Operation history storage means for recording the collected operation history;
Related source operation storage means for storing related source keywords;
Related destination operation storage means for storing related destination keywords;
An operation history including the related source keyword is searched from the operation history storage means, the operation history of the search result, the operation history near the time before the operation history of the search result, and the operation history near the time after And an associating means for associating the operation history including the same related keyword with the same,
And a related information storage unit that stores an operation history associated by the association unit. The operation history collecting means includes
File name operated by the user, operation contents to the file, operation history including process ID,
Operation history including URL accessed by user, HTTP header data, HTTP body data, process ID,
The operation history of one type, two types, or three types of operation histories including a window ID, window operation, data, application name, and process ID operated by a user is collected. The related information acquisition apparatus according to any one of 3. The related source operation storage means is
Keywords that characterize search operations by users,
Keywords that characterize the user's help and specification browsing operations,
The related information acquisition apparatus according to claim 1, wherein one type, two types, or three types of keywords that characterize an operation related to a specific keyword by a user are stored. The related destination operation storage means includes
Keywords that characterize the user ’s editing of the document,
Keywords that characterize the user ’s ability to change application settings,
The related information acquisition apparatus according to claim 1, wherein one type, two types, or three types of keywords that characterize an operation related to a specific keyword by a user are stored. The association means includes
7. The related information acquisition apparatus according to claim 1, wherein a file name, URL, data, and application name included in the associated operation history are extracted and associated with each other. As the operation history on the user's computer, the file name operated by the user, the contents of the operation to the file, the file operation history including the process ID, the URL accessed by the user, HTTP header data, HTTP body data, and the network including the process ID Operation history collection means for collecting window operation history including operation history, window ID operated by the user, window operation, data, application name, process ID,
Operation history storage means for recording the collected operation history;
Related source operation storage means for storing related source keywords;
Related destination operation storage means for storing related destination keywords;
An association means,
The association means includes
The operation history including the related source keyword is searched from the operation history storage unit, and the window operation history related to the operation history of the search result is aggregated as a related source aggregation log,
The operation history including the related destination keyword is searched from the operation history storage unit, and the window operation history related to the operation history of the search result is aggregated as a related destination aggregation log,
Pay attention to one of the related source aggregation logs,
Extracting the operation history of the window operation as active or open from the related source aggregation log under attention as the attention related source operation history,
Whether the extracted operation history immediately before the extracted related source operation history of interest is extracted from the operation history storage means, and whether the extracted operation history is included in any of the related destination aggregation logs Investigate and
If it is included, the operation history immediately after the operation history that became inactive or closed after the extracted active or open operation history is an operation history that is not included in the related source aggregation log. A history is extracted from the related source aggregated log of interest,
The operation history immediately after the extracted operation history is extracted from the operation history storage means, and whether or not the extracted operation history is included in the same related destination aggregated log as the examined related destination aggregated log Investigate
If it is included, the related information acquisition apparatus associating the related source aggregated log and the related destination aggregated log. An operation history collecting unit that collects an operation history on a user's computer, an operation history storage unit that records the collected operation history, an associated source operation storage unit that stores an associated source keyword, and an association unit An information association method executed by a related information acquisition device,
The associating means searches the operation history storage means for an operation history including the related source keyword, and associates the operation history of the search result with the operation history of the search result that is close in time. Information association method. A computer having operation history collection means for collecting operation history on a user's computer, operation history storage means for recording the collected operation history, and related source operation storage means for storing related source keywords;
A program for retrieving an operation history including the related source keyword from the operation history storage unit, and causing the operation history of the search result and an operation history of the search result to be associated with an operation history close in time .

Images