JP2018132813A - Information management device, information management method and information management program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide background information of a past similar corresponding action helpful to examine a present state for an emergency response.SOLUTION: An information management device 10 comprises: an activity log management unit 122 which stores an activity log in an activity log storage unit 112 in association with a workflow and detects the activity log not corresponding to the workflow; an evaluation result storage unit 113 which stores an evaluation result of a past activity log; a similar activity log extraction unit 123 which extracts a past activities log similar to the activity log not corresponding to the workflow from the activity log storage unit 112; and an evaluation result management unit 124 which searches for external information around the date and time of occurrence of the extracted past activity log from the external information storage unit 114, and when the searched external information and the external information of the activity log not corresponding to the workflow are similar, displays the extracted past activity log, the external information around the date and time of occurrence, and the evaluation result of the past activity log searched from the evaluation result storage unit 113, on the screen of a client terminal.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information management apparatus, an information management method, and an information management program.

  In order to respond to crises such as natural disasters and cyber attacks, response plans and manuals are established in advance. This response plan and manual are often described mainly for routine work.

  For example, an electronic manual may be defined as a manual. This electronic manual is an electronic version of fixed action items. For this reason, in order to exchange detailed instruction commands and situations, another means such as a telephone or a fax is required, and instruction commands and situation exchanges using other means may not remain as a correspondence history. is there. Moreover, there is no mechanism for managing items other than predetermined execution items as an electronic manual, and it is difficult to manage a flexible response according to the situation. Therefore, there is a technology that provides a reference to past similar cases for items that cannot be kept up by manualization (see, for example, Patent Documents 1 and 2).

Japanese Patent No. 597714 JP 2014-229120 A

  Actually, the past response behavior is used as know-how when an event that does not exist in the preset workflow and has no experience has occurred. However, the conventional method that provides past similar cases as a reference only provides the past response actions that are layered. The coping person must understand the grounds and the situation of the situation and determine the quality of the response action simply by looking at such past response actions that are layered. Is difficult. For this reason, there is a need for a mechanism that provides background information on past similar response actions that are useful for studying the current situation, and supports efficient and accurate judgment by the coping person.

  The present invention has been made in view of the above, and provides an information management apparatus, an information management method, and an information management program capable of providing background information on past similar response actions that are useful for examination regarding crisis response. The purpose is to do.

  The information management device according to the present invention corresponds to an activity log storage unit that stores an activity log that is a group of messages exchanged between various places when executing a workflow that is a work item at the time of crisis response, and an activity log corresponding to the workflow In addition to recording in the activity log storage unit, an activity log management unit that detects an activity log that does not correspond to a workflow, an external information storage unit that stores external information, which is information obtained from the outside, along with its occurrence date and time information, Similar to the detected activity log from the activity log storage unit when the activity log management unit detects an activity log that does not correspond to the workflow, and an evaluation result storage unit that stores past activity log evaluation results in association with the activity log. Search past activity logs and extract past activity logs where the similarity between the detected activity log and the past activity log is greater than a predetermined value. The external information storage unit searches for external information near the occurrence date and time of past activity logs extracted by the similar activity log extraction unit, and the external information on the detected external information and the detected activity log Is similar to the detected activity log, it is determined that the extracted past activity log is a past activity log that is similar to the detected activity log. And an evaluation result management unit that displays the evaluation result of the past activity log extracted from the evaluation result storage unit on the screen of the client terminal.

  ADVANTAGE OF THE INVENTION According to this invention, the background information of the past similar response action useful for examination of the present condition can be provided regarding crisis response.

FIG. 1 is a diagram showing an example of the configuration of the information management system according to the present embodiment. FIG. 2 is a diagram illustrating an example of an activity log according to the present embodiment. FIG. 3 is a diagram illustrating an example of an evaluation result according to the present embodiment. FIG. 4 is a diagram showing an example of external information according to the present embodiment. FIG. 5 is a diagram for explaining a workflow display screen according to the present embodiment. FIG. 6 is a diagram for explaining the activity log association confirmation processing by the activity log management unit shown in FIG. FIG. 7 is a diagram illustrating processing for setting a step associated with an activity log by the activity log management unit illustrated in FIG. FIG. 8 is a diagram for explaining similar activity log extraction processing by the similar activity log extraction unit illustrated in FIG. 1. FIG. 9 is a diagram illustrating an evaluation result providing process performed by the evaluation result management unit illustrated in FIG. FIG. 10 is a diagram for explaining processing at the time of reflection after the crisis response by the information management apparatus shown in FIG. FIG. 11 is a sequence diagram showing a procedure of processing at the time of crisis response by the information processing apparatus shown in FIG. FIG. 12 is a sequence diagram illustrating a processing procedure after a crisis is handled by the information processing apparatus illustrated in FIG. FIG. 13 is a diagram illustrating an example of a computer in which a program protection device is realized by executing a program.

  Hereinafter, embodiments of an information management system, an information management method, and an information management program according to the present application will be described in detail with reference to the drawings. In addition, this invention is not limited by this embodiment. Moreover, in description of drawing, the same code | symbol is attached | subjected and shown to the same part.

[Embodiment]
[Configuration of Information Management System According to Embodiment]
First, the configuration of the information management system according to the embodiment will be described with reference to FIG. FIG. 1 is a diagram illustrating an example of a configuration of an information management system according to an embodiment. As illustrated in FIG. 1, the information management system 1 includes an information management device 10 and a client terminal 30. The information management apparatus 10 is connected to the client terminal 30 via the communication network 20.

  The information management system 1 is a system that supports management for the crisis management office of a local government or a company to respond to a crisis such as a disaster or a cyber attack. The information management system 1 is implemented, for example, at a countermeasure headquarters against natural disasters or cyber attacks. Moreover, the information management apparatus 10 may be provided in the same place as the countermeasure headquarters, or may be provided in a place different from the countermeasure headquarters. The client terminal 30 is provided in the countermeasure headquarters and each organization related to the countermeasure headquarters. Engines A and B in FIG. 1 are, for example, a subordinate organization or branch of the countermeasure headquarters.

  The information management device 10 is, for example, a server device. The information management device 10 manages crisis response information indicating the response status of the organization to the crisis. The information management apparatus 10 provides the crisis response information to each client terminal 1 by displaying various screens indicating the crisis response information on the client terminal 30 provided in the subordinate organization or branch of the countermeasure headquarters. The information management apparatus 10 registers the information transmitted from the client terminal 30 as crisis response information.

  The communication network 20 is an arbitrary type of communication network such as a wired or wireless LAN (Local Area Network), a WAN (Wide Area Network), and a VPN (Virtual Private Network).

  The client terminal 30 is a personal computer, a smartphone, a mobile phone, or the like, for example. It is. The client terminal 30 has an input unit such as a mouse and a keyboard. The client terminal 30 has a screen 31 such as a display. The coping person can refer to the crisis response information provided from the information management apparatus 10 or transmit information to the information management apparatus 10 via the Web browser displayed on the screen 31 of the client terminal 30. . Note that the number of client terminals 30 is not limited to the illustrated number, and may be an arbitrary number.

[Configuration of information management device]
Here, in the event of a crisis, the information management apparatus 10 has an activity log (described later) that is not in the workflow (described later), a past activity log similar to the activity log, external information in the vicinity of the occurrence date, and The evaluation result of the past activity log is displayed on the screen 31 of the client terminal 30. Also, the information management device 10 can provide information on activity logs that are not on the workflow after the crisis response, or activity logs that are different from other same timing chart activity logs, along with the activity logs, And the evaluation result of the past activity log is displayed on the screen of the client terminal, the entry of the evaluation result after crisis response is prompted, and the evaluation result is accumulated.

  In this way, the information management apparatus 10 provides background information on past similar response actions that are useful for examining the current situation, and supports efficient and accurate determination by the coping person. Therefore, the configuration of the information management apparatus 10 will be described in detail. First, the information management apparatus 10 includes a storage unit 11 and a control unit 12 as illustrated in FIG.

  The storage unit 11 is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), and an optical disk. Note that the storage unit 11 may be a semiconductor memory capable of rewriting data, such as a RAM (Random Access Memory), a flash memory, and a NVSRAM (Non Volatile Static Random Access Memory). The storage unit 11 stores an OS (Operating System) executed by the information management apparatus 10 and various programs. Furthermore, the storage unit 11 stores various information used in executing the program. The storage unit 11 includes a workflow storage unit 111, an activity log storage unit 112, an evaluation result storage unit 113, and an external information storage unit 114.

  The workflow storage unit 111 stores a workflow. The workflow is data defining the action items for crisis response. In other words, the workflow is a work item at the time of crisis response formulated in advance. The workflow is composed of a plurality of steps in which an activity executing entity and conditions for executing the activity are set.

  In the present embodiment, as an example, for each step of the workflow, the organization that performs the activity is set as the implementation subject, and the time from the occurrence of the crisis to the start of the activity is set as a condition I will do it. For example, the workflow storage unit 111 includes, as workflow steps, “steps in which the executing entity is“ General Affairs Group ”and time is“ immediately after the disaster ”, and“ the executing entity is “General Affairs Group”, and the time is “within one day”. "Steps", "steps in which the implementing entity is" information organizing team ", time is" within one day "", etc. are stored.

  Note that the execution subject and conditions in the workflow are not limited to the example of the present embodiment. For example, a role in the organization (for example, an operation manager or a leader) may be set as the implementation subject. Further, as a condition, a threshold value of a score representing the seriousness of damage caused by the crisis and the affected range may be set.

  The activity log storage unit 112 stores an activity log. The activity log is information including a message regarding an activity carried out in response to a crisis and a progress status of the activity. In other words, the activity log is a group of messages exchanged between various places when the workflow is actually executed, and is an instruction or a communication regarding correspondence at each organization. That is, the activity log is a message group in which a series of exchanges are performed as a lump of tasks. The activity log storage unit 112 stores past activity logs. The activity log is managed in a thread format until a corresponding status flag is given and the activity log is completed.

  FIG. 2 is a diagram illustrating an example of an activity log according to the present embodiment. As shown in the table T1 of FIG. 2, the items of the activity log include “ID”, “correspondence status”, “transmission source”, “transmission destination”, “title”, “content”, “draft date / time”, “Linked workflow steps” and the like are included. In the following description, “corresponding” may be replaced with “link”.

  In the item “ID” of the activity log, an ID for identifying the activity log is stored. The activity log item “response status” stores the progress status of the activity corresponding to the activity log. The progress status is represented by any one of, for example, unsupported, currently being handled, and completed.

  The activity log item “transmission source” stores the organization or the like that started the activity log. The activity log item “destination” stores an organization or the like targeted by the activity log. The activity log message “title” stores the title of the message in the activity log. In addition, the content of the message of the activity log is stored in the item “content” of the activity log. The message of the activity log is, for example, a report, a contact, an instruction, etc. generated by an activity in crisis response.

  In addition, the date and time when the activity log was drafted is stored in the item “draft date and time” of the activity log. The activity log item “workflow step to be associated” stores a workflow step associated with the activity log. In the information management system 1, a message can be transmitted from each step of the workflow, and a series of subsequent message exchanges are linked to the corresponding workflow step as an activity log. The association between the activity log and the step will be described later.

  For example, in the table T1 of FIG. 2, the activity log with the ID “1” is drafted by the general affairs team and covers the whole. The activity log with ID “1” includes a message “Preparation for installation of disaster response headquarters” titled “About installation of disaster response headquarters”. The activity log whose ID is “1” was created at “10:00 on January 30, 2017” and is associated with the workflow step “A-1”. As described above, in the information management apparatus 10, whether the contents of the workflow can be executed by managing (linking) the workflow and the activity log in association with each other, and whether something outside the workflow has occurred. To be able to grasp.

  The evaluation result storage unit 113 stores the evaluation result of the past activity log in association with the activity log. In other words, after the crisis response, the evaluation result storage unit 113 stores the evaluation result that the responder and the like looked back on the crisis response and evaluated the content of the crisis response in association with the activity log. FIG. 3 is a diagram illustrating an example of an evaluation result according to the present embodiment.

  As shown in the table T3 of FIG. 3, the items of the evaluation result include “ID”, “evaluation point”, “improvement point”, “remarks”, and the like. In the evaluation result item “ID”, an ID for identifying an activity log is stored. The item “evaluation score” of the evaluation result describes that, after the crisis response, the coping person looked back and evaluated that the coping person's own evaluation was good. In addition, it is described that the item “improvement point” of the evaluation result needs to be reviewed by the responder's own evaluation after the crisis response. The item “remarks” of the evaluation result describes other items that should be left as a memorandum. As a result, among the evaluation results, the “evaluation point” can be used as a good example (recommended case), and the “improvement point” can be used as a bad example (concerned matter candidate).

  The external information storage unit 114 stores external information, which is information obtained from the outside, along with the occurrence date / time information, separately from information related to crisis response activities. External information is information including an information source, an information type, and an occurrence date. FIG. 4 is a diagram showing an example of external information according to the present embodiment.

  As shown in Table T4 of FIG. 4, the items of external information include “information source”, “type”, “date / time”, “subject”, “content”, and the like. The item “information source” of the external information is a source of the external information. The item “type” of external information is a type of external information, and includes weather information, device vulnerability, and the like. The item “date and time” of the external information is the generation date and time of this external information. The external information item “subject” is the title of the external information. The item “content” of the external information is details of the external information.

  For example, the external information whose information source is “L center” has the type “vulnerability countermeasures overview”, and the occurrence date and time information of this external information is “20 January 2017, 12:00” It has the subject line "M's vulnerability".

  Next, the control unit 12 will be described. The control unit 12 controls the entire information management apparatus 10. The control unit 12 is, for example, an electronic circuit such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 12 has an internal memory for storing programs and control data that define various processing procedures, and executes each process using the internal memory. The control unit 12 functions as various processing units when various programs are operated. For example, the control unit 12 includes a workflow management unit 121, an activity log management unit 122, a similar activity log extraction unit 123, and an evaluation result management unit 114.

  The workflow management unit 121 reads a workflow from the workflow storage unit 111 and displays a workflow screen in which a step currently being executed is displayed in a predetermined color according to a corresponding situation, such as the screen 31 of the client terminal 30 or the screen of the information management apparatus 10. To display. Specifically, the workflow management unit 121 organizes the workflow by dividing the implementation items for the device into a condition axis (time, threshold, etc.) and an execution subject axis (role and group in the organization for organizational work contents). To do. Then, the workflow management unit 121 displays a workflow display screen in which each column is displayed in a color-coded manner on the screen 31 of the client terminal 30 according to the activity log correspondence status. Therefore, an example of an actual workflow display screen will be described.

  FIG. 5 is a diagram for explaining a workflow display screen according to the present embodiment. As shown in Table T2 of FIG. 5, the items on the workflow screen include “ID”, “organization name / organization label”, and “general affairs team / A” to “medical relief team / K” corresponding to the actual organization. And the like.

  In the workflow screen, elements whose progress statuses of the activity logs associated with the corresponding steps are all “completed” are filled with green. In the workflow screen, there is no activity log with the progress status “completed” in the activity log associated with the corresponding step, and the element with “work in progress” is yellow. Filled. In addition, elements for which there is no activity log associated with the corresponding step and elements for which the progress status of the activity log associated with the corresponding step is all “unsupported” are painted in red. In other words, if there is an action item for which an activity log has not yet been issued, this item is filled in red. In the workflow screen, when the progress statuses of the activity logs associated with the steps corresponding to all the elements included in the row are all “completed”, the row is filled with gray.

  The activity log management unit 122 records the activity log in association with the workflow. The activity log management unit 122 records the instruction and report contents related to the crisis response, the step ID of the associated workflow, and the response status in the activity log storage unit 112 together with the time. In other words, the activity log management unit 122 obtains an activity log, which is information including a message related to an activity performed at the time of crisis response and the progress of the activity, as an activity implementation entity and a condition for the activity to be implemented. It is registered in the activity log storage unit 112 of the storage unit 11 in association with a predetermined step of the set workflow. The activity log management unit 122 detects an activity log that does not correspond to a workflow.

  The similar activity log extraction unit 123 searches for past similar activity logs at positions outside the steps on the workflow when an activity log outside the steps of the workflow is registered during crisis response. In other words, when the activity log management unit 122 detects an activity log that does not correspond to a workflow, the similar activity log extraction unit 123 searches the activity log storage unit 112 for past activity logs similar to the detected activity log. Then, only past activity logs in which the similarity between the detected activity log and the past activity log is larger than a predetermined value are extracted.

  In addition, the similar activity log extraction unit 123 calculates the similarity of activity logs in the same step at the time of review, and extracts activity logs that are equal to or less than a threshold value. That is, the similar activity log extraction unit 123 extracts an activity log having a similarity that is equal to or lower than a predetermined value from a plurality of activity logs corresponding to the same workflow after the crisis response. The similar activity log extraction unit 123 calculates an approximate value of the detected activity log context and the past activity log context as the similarity between the detected activity log and the past activity log.

  The evaluation result management unit 124 transmits to the client terminal 30 an evaluation entry request made by a coping person of the activity log extracted by the similar activity log extraction unit 123. Then, the similar activity log extraction unit 123 stores the evaluation result entered by the coping person in response to the entry request in the evaluation result storage unit 113 in association with the extracted activity log. The evaluation result management unit 124 searches the external information storage unit for external information in the vicinity of the occurrence date and time of the past activity log. Then, when the retrieved external information is similar to the external information about the detected activity log, the evaluation result management unit 124 selects the past past activity log that is similar to the detected activity log. It is determined that it is an activity log. Subsequently, the evaluation result management unit 124 uses the extracted past activity log, the external information in the vicinity of the occurrence date and the evaluation result of the extracted past activity log retrieved from the evaluation result storage unit 113, to the client terminal 30. It is displayed on the screen 31.

  When the evaluation result management unit 124 searches the evaluation result storage unit 113 for an evaluation result for a past activity log similar to the detected activity log, the past activity log, external information in the vicinity of the occurrence date and time, and the evaluation result Evaluation results of past activity logs retrieved from the storage unit 113 are displayed on the screen 31 of the client terminal 30. In other words, if the evaluation result is not described, the evaluation result management unit 124 assumes that the importance of the past activity log is low and does not display it on the screen 31 of the client terminal 30.

  The evaluation result management unit 124 extracts the past activity extracted when the external information near the occurrence date and time of the extracted past activity log and the external information about the detected activity log are the same information source and the same information type. It is determined that the log and the detected activity log are similar.

[Activity Log Management Department Processing]
Next, processing of the activity log management unit will be described. Here, the step of the workflow associated with the activity log may or may not be specified by the coping person. When the step corresponding to the activity log is designated by the coping person, the activity log management unit 122 registers the activity log in association with the designated step. On the other hand, when the step corresponding to the activity log is not designated by the coping person, the activity log management unit 122 adds the step corresponding to the activity log to the workflow, and associates the activity log with the added step. sign up. In this case, the activity log management unit 122 causes the screen 31 of the client terminal 30 to display a confirmation screen for prompting the coping person to confirm the association.

  First, taking the case of crisis response as an example, the processing of the activity log management unit 122 when the activity log is drafted without being associated with the workflow will be described. FIG. 6 is a diagram for explaining activity log association confirmation processing by the activity log management unit 122 shown in FIG. FIG. 6A is an activity log drafting screen M1 that is drafted without being associated with a workflow. FIG. 6B shows a confirmation screen M2 for an activity log created without being linked to a workflow.

  As shown in the draft screen M1 in FIG. 6A, the activity log management unit 122 responds when an activity log is drafted without being associated with a workflow, that is, as shown in a frame C1. A case will be described where an activity log with no steps set is issued. In this case, the activity log management unit 122 causes the screen 31 of the client terminal 30 operated by the coping person to display a screen that allows the coping person to check whether there is no omission of association with the step. Specifically, the workflow management unit 121 prompts confirmation to the coping person like the confirmation screen M2 in FIG. 6B, “This activity log is not linked to the workflow, Is it? ”(See frame C2).

  Furthermore, the activity log management unit 122 presents the past status of the activity log that is similar to the contents of the draft, and makes it easy to make a comparison by comparing the specific contents. The similar activity log extraction unit 123 searches the activity log storage unit 112 for past activity logs similar to the contents of the draft.

  Specifically, the activity log management unit 122, as shown in the confirmation screen M2, “For the similar cases in the past, the following is linked, so I will inform you for reference.” (Frame C3 Message), and a table T1 indicating the linked status of the searched similar past activity logs is displayed below this message.

  Alternatively, if the activity log having the similarity greater than or equal to a predetermined threshold value with the contents of the draft can be retrieved from the activity log storage unit 121, the activity log management unit 122 automatically makes the steps of the activity log the same and similar. It may be linked to an activity log step.

  On the other hand, when the activity log management unit 122 determines that there is no step associated with the issued activity log, the activity log management unit 122 sets the position between the steps. FIG. 7 is a diagram illustrating processing for setting a step associated with an activity log by the activity log management unit 122 illustrated in FIG.

  If the activity log management unit 122 determines that there is no step associated with the activity log shown in the draft screen M1, the draft date and time in this activity log is near, and the activity of the organization that drafted the activity log The log is searched from the activity log storage unit 112. Then, the activity log management unit 122 is the most advanced among the activity logs of the organization (general affairs team) that issued the activity log at the nearby date and time as shown in Table T2. The step after step A-1 (see frame C3) is set as the step of this activity log. In the example of FIG. 7, the activity log management unit 122 sets the step of the activity log as “After A-1” (see the frame C1 ′ in the draft screen M1 ′).

  As described above, when the activity log is created without being associated with the workflow, the activity log management unit 122 confirms with the cooperator whether the association is necessary, and then the activity log already associated in the vicinity. The position on the workflow is specified from the log, and the step position of the activity log is set between steps.

[Process of similar activity log extractor]
Next, processing of the similar activity log extraction unit 123 will be described with reference to FIG. FIG. 8 is a diagram for explaining similar activity log extraction processing by the similar activity log extraction unit 123 illustrated in FIG. 1. FIG. 8A shows an activity log draft screen M1 ′ to be processed, and FIG. 8B shows a list of past search results of similar activity logs.

  The similar activity log extraction unit 123 first searches an activity log having a context similar to that of the drafted activity log from past activity logs linked to the corresponding position in the workflow. The similar activity log extraction unit 123 calculates an approximate value between the context of the drafted activity log and the context of the past activity log as the similarity between the drafted activity log and the past activity log. Then, the similar activity log extraction unit 123 extracts a past activity log having a similarity greater than a predetermined threshold from the activity log storage unit 112.

  For example, a case where the threshold is 0.6 will be described. In this case, as shown in the table T5 of FIG. 8B, the similar activity log extracting unit 123 sets the similarity as “0..0” as an activity log similar to the activity log created on the draft screen M1 ′. The activity log of ID “11” being “7” and the activity log of ID “23” having a similarity of “0.6” are extracted from the activity log storage unit 112.

  Note that the similar activity log extraction unit 123 may expand the search target to activity logs at other step positions on the workflow when there is nothing that is equal to or higher than the threshold value that is the similarity in this search. Alternatively, the similar activity log extraction unit 123 causes the client terminal 30 to display a summary value of activity logs at the workflow corresponding position (total number of cases, evaluation points of evaluation results, breakdown of the number of entries of improvement points, etc.) and a list of subject names. Thus, the operator may be prompted to confirm whether the work is likely to proceed smoothly at this point in time, whether a problem is likely to occur, or whether other work is not necessary.

[Process of evaluation result management department]
Next, processing of the evaluation result management unit 124 will be described. When there is an activity log extracted from the similar activity log extraction unit 123 and an evaluation result by looking back on the activity log at the time of crisis response, the evaluation result management unit 124 generates an evaluation result and an activity log. The external information near the vote date and time is compared with the external information near the current activity log, and similar parts are displayed on the screen 31 of the client terminal 30 or the like. Further, the evaluation result management unit 124 provides the client terminal 30 with a format for inputting the evaluation result when looking back at the crisis response, and stores the input result for the evaluation result transmitted from the client terminal 30 in the evaluation result storage unit 123. To do.

  Processing of the evaluation result management unit 124 will be described. FIG. 9 is a diagram for explaining the evaluation result providing process by the evaluation result management unit 124 shown in FIG. FIG. 9A shows an activity log draft screen M1 ′ to be processed, and FIG. 9B shows a list of past similar cases.

  In this case, the evaluation result management unit 124 searches the external information storage unit 114 for external information in the vicinity of the issue date and time of the activity log to be processed and external information in the vicinity of the issue date and time of the past similar activity log. To do. Then, the evaluation result management unit 124 compares the external information in the vicinity of the voting date and time of the activity log to be processed with the external information in the vicinity of the voting date and time of the past similar activity log, and compares the similar information in each item. To extract. For example, the evaluation result management unit 124 has the same information source and type for the external information in the vicinity of the voting date and time of the activity log to be processed and the external information in the vicinity of the voting date and time of the past similar activity log. In the case, it is judged that they are similar. Or, compare the similarity of sentences in the subject and content of external information in the vicinity of the date and time of the activity log to be processed and external information in the vicinity of the date and time of the previous similar activity log. You may judge that it is similar when the degree is more than a certain threshold.

  The evaluation result management unit 124 searches the evaluation result storage unit 113 for an evaluation result based on a review of similar past activity logs extracted from the similar activity log extraction unit 123. Then, when the evaluation result management unit 124 can search the evaluation result of the similar past activity log for the corresponding activity log shown in the draft screen M1 ′ (see FIG. 9A), FIG. The list of past similar cases as shown in Table T6 in (b) of FIG.

  Table T6 shows a list of activity logs similar to the activity log issued on the drafting screen M1 ′ (table T5 ′), evaluation results (table T4 ′) of each similar activity log, and external information (table T3 ′). ) Are arranged so that they can be compared. By confirming this table T6, the coping person can compare the past similar cases together with the evaluation result and the similarity of the situation, and can refer to future correspondence. As described above, the evaluation result management unit 124 combines the result of comparing the difference between the current situation and the current situation with external information or the like when there is a similar activity log between the same steps in the past. To the client terminal 30.

[Evaluation result acquisition process during reflection]
The evaluation result acquisition process at the time of reflection after crisis response will be described. Here, there is no significant difference between the main part of the process at the time of crisis response and the main part of the process at the time of reflection after the crisis response. That is, the information management apparatus 10 presents similar past cases similar to those at the time of responding to the responder to the activity log that is not linked to the workflow step after the crisis response, and sets the activity log evaluation format. provide. Then, the information management apparatus 10 compares the degree of similarity within the step with respect to the activity log associated with the step of the workflow, and provides an activity log evaluation format for items below a certain threshold.

  FIG. 10 is a diagram for explaining processing at the time of reflection after crisis response by the information management apparatus 1 shown in FIG. A case where the contents of the frame C11 are described in a different context from the same other activity log in the table T1 in FIG. In this case, the control unit 12 acquires the same other activity log list (table T5 in FIG. 10B) as indicated by an arrow Y11 in FIG. 10 (see (1) in FIG. 10). Then, as shown by an arrow Y12 in FIG. 10, the review input screen M3 ((d) in FIG. 10) is displayed on the screen 31 of the client terminal 30 of the responder belonging to the corresponding organization, and the responder describes Encourage reflection.

  On the other hand, the case where there is an activity log not associated with a workflow in the table T2 in FIG. In this case, as shown by an arrow Y21 in FIG. 10, the evaluation result management unit 124 includes a table T7 indicating the corresponding activity log, a table T3 indicating external information in the vicinity of the corresponding activity log, and a table indicating past similar cases. T6 (see (c) in FIG. 10) is acquired as one set (see (2) in FIG. 10). Then, as shown by an arrow Y22 in FIG. 10, the evaluation result management unit 124, based on the acquired information, a retrospective input screen M3 (FIG. 10) showing past similar activity logs, activity log evaluation results, and external information comparison results. 10 (see (d)) is displayed on the screen 31 of the client terminal 30 of the coping person belonging to the corresponding organization, and the coping person is encouraged to look back on the description.

  The evaluation result management unit 124 receives the evaluation result described by the coping person from the client device 30 and registers it in the evaluation result storage unit 113. The information management system 1 can accumulate evaluation results for activity logs by performing such processing. Further, in the information management system 1, after responding to a crisis, the cooperator performs objective evaluation by extracting the activities not in the workflow and providing the cooperator with a comparison result between the past similar cases and the evaluation. be able to.

[Flow of processing during crisis response]
Next, the flow of processing when the information processing apparatus 10 responds to a crisis will be described. FIG. 11 is a sequence diagram illustrating a processing procedure when the information processing apparatus 10 illustrated in FIG. 1 responds to a crisis.

  As shown in FIG. 11, first, the workflow management unit 121 reads a workflow from the workflow storage unit 111 (step S1), and performs color-coded display of the workflow based on the correspondence status (step S2). Subsequently, the activity log management unit 122 creates an activity log from the workflow steps (step S3), and registers the created activity log in the activity log storage unit 112 (step S4).

  The activity log management unit 122 adds an activity log and changes the status (step S5). The activity log management unit 122 outputs the activity log addition and status change, and also registers the activity log addition and status change in the activity log storage unit 112 (step S6).

  On the other hand, the activity log management unit 122 searches for similar linked activity logs from the workflow storage unit 111 and the activity log storage unit 112 (step S7), and performs linkage confirmation with the workflow when the activity log is issued (step S7). S8). If the activity log is created without being associated with the workflow, the activity log management unit 122 displays a confirmation screen on the client terminal 30 to confirm to the coordinator whether the association is necessary (step S9). ).

  And the activity log management part 122 judges whether the confirmation result was input by the coping person (step S10). If the activity log management unit 122 determines that the confirmation result has been input by the coping person (step S10: Yes), the activity log management unit 122 proceeds to step S5, and adds an activity log to reflect the confirmation result.

  On the other hand, when it is determined that the confirmation result is not input by the coping person (step S10: No), the activity log management unit 122 sets the position of this activity log (step S11). Then, the similar activity log extraction unit 123 searches the activity log storage unit 112 for past activity logs similar to the activity log (step S12), thereby searching for the same similar past case (step S13).

  The evaluation result management unit 124 searches the external information storage unit 114 (step S14), the external information in the vicinity of the similar past activity log extracted by the similar activity log extraction unit 123, and the external in the vicinity of the current registration target activity log. The information is compared (step S15). Then, the evaluation result management unit 124 determines whether the external information in the vicinity of the similar past activity log is similar to the external information in the vicinity of the current registration target activity log (step S16).

  When the evaluation result management unit 124 determines that the external information in the vicinity of the similar past activity log and the external information in the vicinity of the current registration target activity log are not similar (step S16: No), the evaluation result management unit 124 extracts the similar information. The determined past activity log is determined not to be similar to the currently registered activity log, and the process returns to step S13.

  On the other hand, when the evaluation result management unit 124 determines that the external information in the vicinity of the similar past activity log and the external information in the vicinity of the current registration target activity log are similar (step S16: Yes), the evaluation result management unit 124 extracts this as similar. The determined past activity log is determined to be similar to the current registration target activity log, and the evaluation result for the similar past activity log is searched from the evaluation result storage unit 113 (step S17). The evaluation result management unit 124 determines whether or not an evaluation result for the similar past activity log has been retrieved (step S18).

  If the evaluation result management unit 124 determines that the evaluation result for the similar past activity log can be searched (step S18: Yes), the current registration target activity log, the similar past activity log, and the evaluation of the activity log are evaluated. As a result, the client terminal 30 is instructed to display the comparison result with external information (step S19). If the evaluation result management unit 124 determines that the evaluation result for the similar past activity log could not be searched (step S18: No), the display result of the evaluation result related to the similar past activity log is issued. Absent.

  Subsequently, in the client terminal 30, in response to a display instruction from the evaluation result management unit 124, a screen showing a comparison result between the current registration target activity log, similar past activity logs, activity log evaluation results, and external information Is displayed (step S20).

  In response to the comparison result by the evaluation result management unit 124, the activity log management unit 122 refers to a similar activity log and registers the activity log to be currently registered in the activity log storage unit 112 (steps S21 and S22). ). Then, the activity log management unit 122 adds the activity log to be registered to the activity log storage unit 112 and changes the status so as to reflect the registration result (steps S23 and S24), and performs the activity log registration process. finish.

[Processing flow when reviewing after device support]
The flow of processing when the information processing apparatus 10 looks back after crisis response will be described. FIG. 12 is a sequence diagram illustrating a processing procedure after crisis response by the information processing apparatus 10 illustrated in FIG. 1.

  As shown in FIG. 12, first, the workflow management unit 121 inputs a workflow to the activity log management unit 122 (step S31), and the activity log management unit 122 extracts an activity log associated with the workflow (step S32). ).

  Then, the similar activity log extraction unit 123 calculates the similarity between the extracted activity logs (step S33). Subsequently, the similar activity log extraction unit 123 extracts an activity log whose similarity is equal to or less than a predetermined threshold value, and provides the input form of the evaluation result to the client terminal 30 (step S34). In response to this, a screen for inputting an evaluation result is displayed on the screen 31 of the client terminal 30 (step S35).

  When the evaluation result is transmitted from the client terminal 30 (step S36), the evaluation result management unit 124 stores the evaluation result in the evaluation result storage unit 113 in association with the target activity log (step S37). .

  Subsequently, the activity log management unit 122 extracts (detects) an activity log that is not associated with the workflow (step S38). Then, the similar activity log extraction unit 123 receives the extraction result of the activity log management unit 122 and searches the activity log storage unit 112 for similar past cases (similar activity logs) that are the same as the activity log not associated with the workflow. (Steps S39 and S40).

  Subsequently, the evaluation result management unit 124 searches for external information in the vicinity of the similar activity log extracted by the similar activity log extraction unit 123 (step S41). Then, the evaluation result management unit 124 compares the external information in the vicinity of the similar activity log with the external method in the vicinity of the current registration target activity log (step S42), and the external information in the vicinity of the similar activity log and the current registration target activity. It is determined whether or not the external information in the vicinity of the log is similar (step S43).

  When the evaluation result management unit 124 does not determine that the external information in the vicinity of the similar activity log and the external information in the vicinity of the current registration target activity log are similar (No in step S43), the evaluation result management unit 124 returns to step S41 and searches for the next external information. I do.

  On the other hand, when the evaluation result management unit 124 determines that the external information in the vicinity of the similar activity log is similar to the external information in the vicinity of the current registration target activity log (step S43: Yes), the evaluation result management unit 124 is similar to the current registration target activity log. The client terminal 30 is instructed to display the activity log, the evaluation result of the similar activity log, and the external information comparison result (step S44). In response to this, the client terminal 30 displays a comparison introduction screen showing the similar activity log, the evaluation result of the similar activity log, and the external information comparison result in accordance with the display instruction from the evaluation result management unit 124 (step S45). ).

  Further, the evaluation result management unit 124 provides the client terminal 30 with an evaluation result input format for the activity log to be registered (step S46). In response to this, the client terminal 30 displays a screen for inputting an evaluation result for the current registration target activity log (step S47). When the evaluation result is transmitted from the client terminal 30 by the evaluation result input process by the coping person (step S48), the evaluation result management unit 124 stores the evaluation result in the evaluation result storage unit 113 (step S49), and the process Exit.

[Effect of the embodiment]
As described above, in the present embodiment, the activity log to be registered is provided to the cooperator together with the past action history of the similar activity log, the situation at that time, and the evaluation result by the cooperator. Therefore, the coping person can make use of the provided information for the current examination after understanding the background information of the corresponding action. In other words, in the present embodiment, the coping person can use the evaluation results of similar past activity logs as know-how at the time of crisis response.

  For this reason, according to the present embodiment, by providing an evaluation result of an activity log similar to the coping person at the time of crisis response, the coping person can experience a pseudo action even for an inexperienced event. It is possible to quickly determine the content of countermeasures. As described above, according to the present implementation, when responding to a crisis, by providing background information on past similar response actions that are useful for reviewing the current situation, it is possible for the responder to make an efficient and accurate decision. Can provide support.

  Moreover, in this Embodiment, the evaluation result of the response is acquired from the coping person after the crisis response. At this time, in this embodiment, when the responder looks back after the crisis response is finished, the same information (past similar response history, the situation at that time, the evaluation result) is provided, Supports efficient and objective reflections.

  In other words, in the present embodiment, after the crisis response, past review cases are provided to the coping person as background information of past similar response actions that are useful for examining the current situation. Thereby, the coping person can easily grasp the difference between the activity log to be dealt with and the past similar activity log, and can perform objective evaluation.

  In this embodiment, even if manual maintenance is not in time, the evaluation results are accumulated in accordance with the current manual and used as know-how. Manual conversion is possible.

[System configuration, etc.]
Each component of each illustrated device is functionally conceptual and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or a part of the distribution / integration is functionally or physically distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. Further, all or a part of each processing function performed in each device can be realized by a CPU and a program that is analyzed and executed by the CPU, or can be realized as hardware by wired logic.

  In addition, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or the processes described as being performed manually All or a part of the above can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified.

[program]
FIG. 13 is a diagram illustrating an example of a computer in which the information management apparatus 10 is realized by executing a program. The computer 1000 includes a memory 1010 and a CPU 1020, for example. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to the display 1130, for example.

  The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the information management apparatus 10 is implemented as a program module 1093 in which a code executable by the computer 1000 is described. The program module 1093 is stored in the hard disk drive 1090, for example. For example, a program module 1093 for executing processing similar to the functional configuration in the information management apparatus 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

  The setting data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 and executes them as necessary.

  The program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN, WAN, etc.). Then, the program module 1093 and the program data 1094 may be read by the CPU 1020 from another computer via the network interface 1070.

  Although the embodiment to which the invention made by the present inventor is applied has been described above, the present invention is not limited by the description and the drawings that form part of the disclosure of the present invention according to this embodiment. That is, other embodiments, examples, operation techniques, and the like made by those skilled in the art based on the present embodiment are all included in the scope of the present invention.

DESCRIPTION OF SYMBOLS 1 Information management system 10 Information management apparatus 11 Storage part 12 Control part 20 Communication network 30 Client terminal 31 Screen 111 Workflow storage part 112 Activity log storage part 113 Evaluation result storage part 114 External information storage part 121 Workflow management part 122 Activity log management part 123 Similar Activity Log Extraction Unit 124 Evaluation Result Management Unit

Claims (7)

An activity log storage unit that stores an activity log that is a collection of messages exchanged between various places when executing a workflow that is a work item at the time of crisis response;
An activity log management unit that detects the activity log that does not correspond to the workflow, and records the activity log in the activity log storage unit in association with the workflow;
An external information storage unit for storing external information, which is information obtained from the outside, together with its occurrence date and time information;
An evaluation result storage unit for storing past evaluation results of the activity log in association with the activity log;
When the activity log management unit detects the activity log that does not correspond to the workflow, the activity log storage unit searches the activity log storage unit for the past activity log similar to the detected activity log, and the detected activity log A similar activity log extracting unit that extracts the past activity log having a similarity with the past activity log greater than a predetermined value;
The external information storage unit retrieves external information in the vicinity of the occurrence date and time of the past activity log extracted by the similar activity log extraction unit, and the retrieved external information and the external information about the detected activity log are similar. If it is determined that the extracted past activity log is the past activity log similar to the detected activity log, the extracted past activity log and external information in the vicinity of the occurrence date and time are determined. And an evaluation result management unit that displays the evaluation result of the extracted past activity log retrieved from the evaluation result storage unit on the screen of the client terminal;
An information management apparatus comprising: The similar activity log extraction unit extracts an activity log whose similarity is equal to or less than a predetermined value from a plurality of activity logs corresponding to the same workflow after crisis response,
The evaluation result management unit transmits an evaluation entry request by a cooperator of the activity log extracted by the similar activity log extraction unit to the client terminal, and the evaluation result entered in response to the entry request is extracted. The information management apparatus according to claim 1, wherein the information management apparatus is stored in the evaluation result storage unit in association with an activity log.   When the evaluation result management unit retrieves an evaluation result for a past activity log similar to the detected activity log from the evaluation result storage unit, the past activity log, external information in the vicinity of the occurrence date and time, and The information management apparatus according to claim 1, wherein an evaluation result of the past activity log retrieved from the evaluation result storage unit is displayed on a screen of the client terminal.   The similar activity log extraction unit calculates an approximate value between a context of the detected activity log and a context of the past activity log as a similarity between the detected activity log and the past activity log. The information management device according to any one of claims 1 to 3. The external information includes an information source, an information type, and an occurrence date and time,
The evaluation result management unit extracts the external information in the vicinity of the date and time of occurrence of the extracted past activity log and the external information about the detected activity log from the same information source and the same information type. The information management apparatus according to claim 1, wherein the past activity log and the detected activity log are determined to be similar to each other. An information management method executed by the information management device,
The information management device includes an activity log storage unit that stores an activity log that is a group of messages exchanged between places when executing a workflow that is a work item at the time of crisis response, and an external that is information obtained from the outside An external information storage unit that stores information together with its occurrence date and time information, and an evaluation result storage unit that stores past evaluation results of the activity log in association with the activity log,
Recording the activity log in the activity log storage unit in association with the workflow;
Detecting an activity log that does not correspond to the workflow;
When the activity log that does not correspond to the workflow is detected, the past activity log similar to the detected activity log is searched from the activity log storage unit, and the detected activity log and the past activity log are Extracting the past activity log whose similarity is greater than a predetermined value;
When the external information near the occurrence date and time of the extracted past activity log is searched from the external information storage unit, and the searched external information and the external information about the detected activity log are similar, It is determined that the extracted past activity log is the past activity log similar to the detected activity log, the extracted past activity log, external information in the vicinity of the occurrence date and time, and the evaluation result Displaying the evaluation result of the extracted past activity log retrieved from the storage unit on the screen of the client terminal;
Information management method characterized by including   An information management program for causing a computer to function as the information management device according to any one of claims 1 to 5.

Images