JP2019175045A - Information processing device, information processing method, information processing program, and storage device - Google Patents

Abstract

To detect abnormal data.SOLUTION: An information processing device acquires current data to be an object of backup, and acquires backup data of a generation traced back from the current data by a plurality of generations as reference data from a storage device for storing backup data of a plurality of generations. Then, the information processing device calculates a differential value between the current data and the reference data, and determines that abnormality exists in the current data when the differential value is equal to or more than a first threshold.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information processing device, an information processing method, an information processing program, and a storage device. In particular, the present invention relates to an information processing device that detects abnormal data, an information processing method, an information processing program, and a storage device to which this information processing is applied.

  A storage device having a deduplication function, so-called content address storage, has been developed. When this content address storage is used for backup, the amount of data is reduced by eliminating duplicate blocks between pre-update data and post-update data (that is, backup target data). Therefore, in the content address storage, the backup target data requires less storage capacity than the case where the entire backup target data is stored, and the data can be stored for a plurality of generations.

  By storing data for multiple generations, high resilience when abnormal data is detected is provided. For example, even when a virus infection is detected in the backup target data, the generation data before the infection can be restored as normal data.

  As a technique for detecting virus infection, for example, there is one disclosed in Patent Document 1. Specifically, in Patent Document 1, when the amount of difference between the pre-update data and the backup target data exceeds a predetermined threshold, it is determined that the backup target data is infected with a virus.

Japanese Patent No. 5124238

  The following analysis has been made from the viewpoint of the present invention. The disclosure of the above prior art document is incorporated herein by reference.

  Even with a backup mechanism using content address storage, normal data may not be restored. In other words, the technique described in Patent Document 1 cannot detect falsification of data less than a threshold value due to a virus. In other words, even if you are infected with a type of virus that alters data little by little every day, the virus infection is overlooked.

  In a state of being infected with such a type of virus, tampered blocks due to viruses, that is, abnormal data are accumulated in the content address storage. Even in the case of content address storage, since the storage capacity is limited, for example, processing such as deletion from old data is performed. Here, when all data of the generation before infection is deleted, normal data cannot be restored even in the content address storage.

  Therefore, an object of the present invention is to provide an information processing device, an information processing method, an information processing program, and a storage device to which this information processing is applied, which contribute to detecting abnormal data.

According to the first aspect of the present invention,
A current data acquisition unit for acquiring current data to be backed up;
A reference data acquisition unit that acquires, as reference data, backup data of a generation that is backed by a plurality of generations from the current data from a storage device that stores backup data of multiple generations;
A calculation unit for calculating a difference value between the current data and the reference data;
A determination unit that determines that the current data is abnormal when the difference value is equal to or greater than a first threshold;
Is provided.

According to a second aspect of the present invention,
A current data acquisition step for acquiring current data to be backed up;
A reference data acquisition step for acquiring, as reference data, backup data of a generation that is backed by multiple generations from the current data from a storage device that stores the backup data of a plurality of generations;
A calculation step of calculating a difference value between the current data and the reference data;
A determination step for determining that the current data is abnormal when the difference value is equal to or greater than a first threshold;
An information processing method is provided.

According to a third aspect of the present invention,
Current data acquisition process to acquire current data to be backed up,
A reference data acquisition process for acquiring, as reference data, backup data of a generation that is backed by multiple generations from the current data from a storage device that stores multiple generations of backup data;
A calculation step of calculating a difference value between the current data and the reference data;
A determination step of determining that the current data is abnormal when the difference value is equal to or greater than a first threshold;
An information processing program for causing a computer to execute is provided.

According to a fourth aspect of the present invention,
A storage unit for storing multiple generations of backup data;
A current data acquisition unit for acquiring current data to be backed up;
A reference data acquisition unit for acquiring, as reference data, backup data of a generation that is backed by a plurality of generations from the current data, from the storage unit;
A calculation unit for calculating a difference value between the current data and the reference data;
A determination unit that determines that the current data is abnormal when the difference value is equal to or greater than a first threshold;
A storage device is provided.

  According to each aspect of the present invention, an information processing device, an information processing method, an information processing program, and a storage device to which this information processing is applied are provided that contribute to detecting abnormal data.

It is a figure for demonstrating the outline | summary of this invention. It is a block diagram which shows an example of the information processing apparatus relevant to 1st Embodiment. It is a flowchart which shows an example of the flow of a process by information processing apparatus. It is a block diagram which shows an example of the storage apparatus relevant to 1st Embodiment. . It is a block diagram which shows an example of the information processing apparatus relevant to 2nd Embodiment. It is a figure for demonstrating an example of the model relevant to 2nd Embodiment. It is a figure for demonstrating an example of the model relevant to 2nd Embodiment. It is a figure for demonstrating an example of the model relevant to 2nd Embodiment. It is a flowchart which shows an example of the flow of a process by information processing apparatus. It is a block diagram which shows an example of the information processing apparatus relevant to 3rd Embodiment. It is a flowchart which shows an example of the flow of a process by information processing apparatus.

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Preferred embodiments of the invention will be described in detail with reference to the drawings. Note that the reference numerals of the drawings attached to the following description are added for convenience to each element as an example for facilitating understanding, and are not intended to limit the present invention to the illustrated embodiment. In addition, the connection lines between the blocks in each drawing include both bidirectional and unidirectional directions.

  First, one embodiment of the present invention will be described using the model shown in FIG. As shown in FIG. 1, the information processing apparatus 100 of the present invention is connected to a storage device 200 and a terminal device (for example, PC: personal computer) 300. Data is created and updated in the terminal device 300, and backup data is stored in the storage device 200. The storage device 200 stores multiple generations of backup data. In the model illustrated in FIG. 1, it is assumed that the 0th generation to the (n−1) th generation backup data is already stored in the storage device 200. Then, in the terminal device 300, it is assumed that the nth generation data obtained by modifying the n−1th generation data is created as the current data.

  In such a model, the information processing apparatus 100 of the present invention determines whether the current data has an abnormality such as data falsification due to a virus. Specifically, the information processing apparatus 100 includes a current data acquisition unit 121, a reference data acquisition unit 122, a calculation unit 123, and a determination unit 124. The current data acquisition unit 121 acquires current data to be backed up from the terminal device 300. The reference data acquisition unit 122 acquires, as reference data, backup data of a generation that is a plurality of generations later than the current data from the storage device 200. The calculation unit 123 calculates a difference value between the current data and the reference data. Then, the determination unit 124 determines that there is an abnormality in the current data when the difference value is equal to or greater than the first threshold value. Here, the difference value is, for example, the number of update blocks that differ between the current data and the reference data, the difference between the overall size of the current data and the overall size of the reference data, and / or the update to the total number of blocks of the reference data. For example, the ratio of the number of blocks.

  According to such an information processing apparatus 100, it is possible to detect an infection of a virus that falsifies data little by little every day. That is, in the technique described in Patent Document 1, virus infection is determined based on the difference value between the previous generation data and the current data, and even if the virus is infected, the difference value is the threshold value. If it is less than, virus infection will be overlooked. On the other hand, in the present invention, virus infection is detected based on a difference value between backup data of a generation that is several generations backward and current data. In other words, in the present invention, since the accumulation of data falsification due to viruses appears as a difference value, it is possible to detect the infection of a virus that falsifies data little by little every day.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
In the first embodiment, the information processing apparatus 100 shown in FIG. 1 will be specifically described.

  The information processing apparatus 100 is connected to the storage device 200 and the terminal device 300 as in FIG. Here, the storage device 200 is preferably a content address storage having a deduplication function, but may be a large-capacity storage capable of storing a plurality of generations of backup data. The terminal apparatus 300 may be an apparatus such as a PC for creating and updating data.

  As illustrated in FIG. 2, the information processing apparatus 100 includes a storage unit 110, a processing unit 120, and a transmission / reception unit 130. Each component is connected to each other via a bus or the like.

  The storage unit 110 is a ROM (read only memory), a RAM (random access memory), a cache memory, or the like that stores a program for controlling the information processing apparatus 100 as a whole.

  The processing unit 120 includes a CPU (Central Processing Unit) and a chip that read and execute a program stored in the storage unit 110. In particular, the processing unit 120 includes a current data acquisition unit 121, a reference data acquisition unit 122, a calculation unit 123, a determination unit 124, a notification unit 125, and a storage unit 126.

  The current data acquisition unit 121 acquires current data to be backed up. Here, the current data may be periodically acquired from the terminal device 300, for example, once a day, or may be received together with a backup command from a server (not shown).

  The reference data acquisition unit 122 acquires, from the storage device 200, backup data of generations that are backed by multiple generations from the current data as reference data. Here, the reference data may be the oldest backup data stored in the storage device 200, the generation designated by the administrator, or, for example, 10 generations It may be determined by the number of generations from the current data such as before.

  The calculation unit 123 calculates a difference value between the current data and the reference data, and the determination unit 124 determines that there is an abnormality in the current data when the difference value is equal to or greater than the first threshold value.

  Here, the difference value may be any value that is useful for detecting an abnormality. For example, the number of blocks that differ between the current data and the reference data, that is, the number of update blocks may be used. In this case, if the data is updated by humans, even if there are many generations between the current data and the reference data, the number of update blocks such as rewriting the same part many times (that is, re-updating the updated block) It tends to be difficult to accumulate. On the other hand, viruses that rewrite data tend to accumulate the number of updated blocks with each generation, such as gradually eroding data. Therefore, based on the number of update blocks, that is, by converting a qualitative difference into a quantitative difference or representing it as a difference value, it is possible to distinguish between normal data update by a human and data falsification by a virus. Is possible.

  Further, the difference value may be a difference (that is, a quantitative difference) between the entire size of the current data and the entire size of the reference data. In this case, as described above, the data update by a human also involves the work of rewriting the same portion many times (that is, the total size of the data is unchanged), so that the total size of the data tends not to increase. On the other hand, the type of virus that adds data increases the overall size of the data with each successive generation. Therefore, it is possible to discriminate between normal data update by a human and data alteration by a virus based on the difference in the overall data size.

  The difference value may be a ratio of the number of update blocks to the total number of blocks of the reference data. In general, backup data tends to be unupdated in a certain ratio of blocks even when the data has been updated over several generations. In other words, in the case of data updating by humans, the ratio of the number of update blocks to the total number of blocks in the reference data tends to be kept below a threshold value. On the other hand, since virus erodes without considering the contents of data, the ratio of the number of update blocks tends to be equal to or greater than a threshold value. Therefore, it is possible to discriminate between normal data update by a human and data alteration by a virus based on the ratio of the number of update blocks to the total number of blocks in the reference data.

  The threshold value is arbitrarily set in consideration of various qualitative and / or quantitative factors such as data type, data importance, backup frequency, reference data profile, human data update tendency, etc. Can do. Preferably, it is preferable to convert to a quantitative difference (increase value).

  When the determination unit 124 determines that there is an abnormality in the current data, the notification unit 125 notifies the administrator of the information processing device 100, the user of the terminal device 300, and the like, for example. For the notification, for example, various specifications such as display on a display, lighting of an alarm lamp, and transmission of mail can be applied.

  When the determination unit 124 determines that there is no abnormality in the current data, the storage unit 126 stores the current data in the storage device 200 as backup data. The storage unit 126 does not store the current data in the storage device 200 itself, but notifies the terminal device 300 that the current data is allowed to be stored, and notifies the terminal device 300 of the current data. Storage may be executed.

  The transmission / reception unit 130 is an interface for performing communication with the terminal device 300 or the like.

  Hereinafter, a flow of a series of processes performed by the information processing apparatus 100 will be described with reference to FIG. The information processing apparatus 100 acquires current data and reference data (step S11), and calculates a difference value between the current data and the reference data (step S12). Here, when the difference value is equal to or greater than the first threshold (step S13, Yes), the information processing apparatus 100 determines that there is an abnormality in the current data and gives an abnormality to the administrator of the information processing apparatus 100. Notification is made (step S14). On the other hand, when the difference value is less than the first threshold (step S13, No), the information processing apparatus 100 stores the current data in the storage device 200 (step S15).

  As described above, the information processing apparatus 100 according to the first embodiment can detect infection of a virus that falsifies data little by little every day.

  Note that the first embodiment can also be realized as a storage apparatus 1000 in which the information processing apparatus 100 and the storage apparatus 200 are integrated as shown in FIG. Here, the storage unit 1100 has a function as the storage device 200, and the processing unit 1200 executes processing by the information processing device 100.

  Further, the first embodiment can be realized by installing and executing the program of the present invention in an existing storage apparatus. The program of the present invention is stored in the storage unit of the storage device, and the functional unit such as the current data acquisition unit 121 is constructed by software when the CPU of the storage device reads the program. As a result, the storage apparatus in which the program of the present invention is installed has the same configuration as that shown in FIG.

[Second Embodiment]
When the information processing apparatus 100 according to the first embodiment detects that the current data is abnormal, the storage apparatus 200 stores at least one generation of abnormal data as backup data. Therefore, in the second embodiment, an information processing apparatus 100 having a function of specifying backup data having an abnormality from a plurality of generations of backup data stored in the storage device 200 will be described. In the following, differences from the first embodiment will be described.

  As illustrated in FIG. 5, the storage unit 110 according to the second embodiment is calculated by the calculation unit 123 when backup data of each generation is stored in the storage device 200 in association with the number of generations from the reference data. The log storage unit 111 stores the difference value as a log. In addition to the current data acquisition unit 121, the reference data acquisition unit 122, the calculation unit 123, the determination unit 124, the notification unit 125, and the storage unit 126, the processing unit 120 further includes a specifying unit 127.

  The identifying unit 127 refers to the log storage unit 111 when the determining unit 124 determines that there is an abnormality in the current data, and generates backup data of a generation in which an increase in the difference value equal to or greater than the second threshold appears continuously. Identify the backup data as abnormal. The notification unit 125 notifies the administrator of the information processing apparatus 100, the user of the terminal device 300, and the like as the backup data having an abnormality as the backup data of the generation specified by the specifying unit 127.

  Below, 2nd Embodiment is described using the model shown to FIGS. In the model shown in FIG. 6, a pattern in which abnormal data is detected based on the number of update blocks between current data and reference data will be described. In the model shown in FIG. 7, a pattern for detecting abnormal data based on the difference between the overall size of the current data and the overall size of the reference data (that is, the difference in data size) will be described. In the model shown in FIG. 8, a pattern for detecting abnormal data based on the overall size of the current data and the ratio of the number of updated blocks to the number of blocks of the reference data will be described.

<Pattern by number of update blocks>
As illustrated in FIG. 6, the log storage unit 111 stores log data in which the number of generations from the reference data and the difference value between the reference data and the backup data of each generation, that is, the number of update blocks are associated with each other. . In the model shown in FIG. 6, the number of generations of reference data is “0”, and the number of generations of current data is “n”. In the generation numbers “1” to “m−1”, normal data update of 100 blocks is performed by humans, and in the generation numbers “m” to “n”, the 100 block data is falsified by viruses. Note that the logs of the generation numbers “0”, “1”, and “n” are not included in the log data if originally intended, but are added for ease of explanation.

  Basically, when normal data update by a human or data alteration by a virus is performed, the number of update blocks is accumulated. In other words, the greater the number of generations from the reference data, the greater the number of update blocks. However, if the data is updated by humans, the number of updated blocks tends to be difficult to accumulate, such as rewriting the same part many times (that is, re-updating the updated block) (see generation numbers “2” to “4”). . For example, the number of generations “1” and the number of generations “2” are increased by 50 blocks, and in the data update of 100 blocks by humans, 50 blocks are newly updated and 50 blocks are re-updated. means.

  On the other hand, when data is altered by a virus, the number of update blocks exceeding a certain value tends to continue, such as eroding data gradually (see generation numbers “m” to “m + 2”). If a virus alters an updated block by a human, it does not appear as an increase in the number of updated blocks. However, since a certain percentage of blocks have not been updated in a human data update, the virus has a high probability of an unupdated block. Tamper with. For example, between the generation number “m + 1” and the generation number “m + 2”, it means that 90 blocks of unupdated blocks and 10 blocks of update blocks have been tampered with. This can occur when the ratio is about 10%.

  For example, the determination unit 124 determines that the difference value (that is, the number of update blocks) between the reference data (that is, the generation number “0”) and the current data (that is, the generation number “n”) is the first threshold ( For example, since it is 2000) or more, it is determined that there is an abnormality in the current data. Here, the identifying unit 127 refers to the log data and identifies the generation of backup data in which an increase in the difference value equal to or greater than the second threshold (for example, 70) continuously appears as backup data having an abnormality. As described above, the backup data of the generation numbers “m” to “n−1” is abnormal data that has been falsified by a virus, and an increase in the difference value equal to or greater than the second threshold value appears continuously. Is specified as backup data. The notification unit 125 transmits the backup data of the generation specified by the specifying unit 127 (that is, backup data of the number of generations “m” to “n−1”) to the administrator of the information processing apparatus 100, the user of the terminal apparatus 300, and the like. Inform.

<Pattern due to difference in data size>
As shown in FIG. 7, the log storage unit 111 stores log data in which the number of generations from the reference data and the difference value between the reference data and the backup data of each generation, that is, the difference in data size are associated with each other. Remember. The conditions such as data update are the same as those in the pattern shown in FIG. 6, but in the pattern in FIG. 7, the virus adds altered data 100 blocks at a time.

  Even if data is input by humans, the overall size of the data increases. However, as described above, updating the data by humans also involves rewriting the same part over and over (that is, the overall size of the data is unchanged). . For this reason, for example, an update in which the difference in data size is unchanged is performed as shown in FIG. 7 between the generation number “2” and the generation number “3”. On the other hand, when the data is altered by a virus, the overall size of the data increases uniformly.

  Here, for example, the determination unit 124 determines that the difference value (that is, the difference in data size) between the reference data (that is, the generation number “0”) and the current data (that is, the generation number “n”) is the first. Since it is a threshold value (for example, 1000) or more, it is determined that the current data has an abnormality. The identifying unit 127 refers to the log data, and identifies the generation of backup data in which an increase in the difference value equal to or greater than the second threshold (for example, 50) continuously appears as backup data having an abnormality. As described above, the backup data of the number of generations “m” to “n−1” is abnormal data that has been altered by a virus, but since an increase in the difference value equal to or greater than the second threshold appears continuously, Identified as backup data having an abnormality. The notification unit 125 transmits the backup data of the generation specified by the specifying unit 127 (that is, backup data of the number of generations “m” to “n−1”) to the administrator of the information processing apparatus 100, the user of the terminal apparatus 300, and the like. Inform.

<Pattern by ratio of number of update blocks>
As shown in FIG. 8, the log storage unit 111 associates the number of generations from the reference data with the difference value between the reference data and the backup data of each generation, that is, the ratio of the number of update blocks. Remember. Note that conditions such as data update are the same as the patterns shown in FIG.

  In normal data updating by humans, even when data is updated for several generations, certain blocks tend to be unupdated. For example, in the data for managing the deposit and withdrawal, the value such as the deposit and withdrawal amount is updated, but the calculation formula for calculating the profit rate and the like based on the item name and the deposit and withdrawal amount is less likely to be updated. For this reason, if the data is updated by a human, the ratio of the number of update blocks to the total number of blocks of the reference data tends to be kept below a threshold value. On the other hand, since virus erodes without considering the contents of the data, when the data is altered by the virus, the number of update blocks increases uniformly, and as a result, the ratio of the number of update blocks tends to exceed the threshold. is there.

  For example, as shown in FIG. 8, when the value of the amount of money is updated by a human between the generation number “0” and the generation number “1”, the ratio of the update block number increases. However, when the value of the deposit / withdrawal value is re-updated in the generations after the generation number “1”, the updated block is re-updated, so the ratio of the update block number does not increase. On the other hand, since the data other than the value of the deposit / withdrawal value is altered when the data is altered by the virus, the ratio of the number of update blocks continuously increases after the generation number “m”.

  Here, for example, the determination unit 124 determines that the difference value (that is, the ratio of the number of update blocks) between the reference data (that is, the generation number “0”) and the current data (that is, the generation number “n”) is the first. Since it is 1 threshold value (for example, 20%) or more, it is determined that there is an abnormality in the current data. The specifying unit 127 then refers to the log data and specifies the generation of backup data in which an increase in the difference value equal to or greater than the second threshold (for example, 1%) continuously appears as backup data having an abnormality. The notification unit 125 transmits the backup data of the generation specified by the specifying unit 127 (that is, backup data of the number of generations “m” to “n−1”) to the administrator of the information processing apparatus 100, the user of the terminal apparatus 300, and the like. Inform.

  Hereinafter, a flow of a series of processes performed by the information processing apparatus 100 will be described with reference to FIG. The information processing apparatus 100 acquires current data and reference data (step S21), and calculates a difference value between the current data and the reference data (step S22). Here, when the difference value is equal to or greater than the first threshold (step S23, Yes), the information processing apparatus 100 identifies backup data having an abnormality (step S24), and has an abnormality of the current data and an abnormality. The backup data is notified (step S25). On the other hand, when the difference value is less than the first threshold (step S23, No), the information processing apparatus 100 stores the current data in the storage device 200 (step S26).

  As described above, the information processing apparatus 100 according to the second embodiment can identify backup data having an abnormality from among a plurality of generations of backup data stored in the storage device 200.

[Third Embodiment]
In the information processing apparatus 100 according to the first and second embodiments, even when data is updated normally by a human, an error may be generated that determines that the current data is abnormal as a result of accumulating the update data. Therefore, in the third embodiment, an information processing apparatus 100 having a function of eliminating such errors will be described. In the following, differences from the first embodiment will be described.

  As illustrated in FIG. 10, the storage unit 110 of the third embodiment includes a coefficient storage unit 112 that stores a predetermined coefficient used when calculating the first threshold value. In addition to the current data acquisition unit 121, the reference data acquisition unit 122, the calculation unit 123, the determination unit 124, the notification unit 125, and the storage unit 126, the processing unit 120 further includes a threshold setting unit 128.

  The threshold setting unit 128 acquires the timing information of the current data and the timing information of the reference data, and sets a value calculated based on the difference between the timing information of the current data and the timing information of the reference data to the first threshold value. Set as. As a specific example, the threshold value setting unit 128 multiplies the difference in the number of generations between the current data and the reference data by the coefficient stored in the coefficient storage unit 112 and the basic threshold value. Is set as the first threshold value. Here, the difference in the number of generations between the current data and the reference data can be acquired by, for example, notifying the number of backup data generations after the reference data from the storage device 200.

  The basic threshold and coefficient will be described with reference to the model shown in FIG. In the model shown in FIG. 6, the number of update blocks gradually increases per generation even in the generation in which normal data update is performed by humans (that is, the number of generations “1” to “m−1”). Tend to. In such a case, if the first threshold value is a fixed value, the number of update blocks reaches the first threshold value in any generation. Therefore, the threshold setting unit 128 sets the first threshold to a value that takes into account the difference in the number of generations between the current data and the reference data.

  To explain with a specific example, it is assumed that the difference in generation number between the current data and the reference data is 200 (that is, the current data is the generation number “200”). In this case, the threshold setting unit 128 multiplies the generation number difference (200) by the number of update blocks (10 blocks) that will increase per generation as a coefficient to obtain a multiplication value (2000). Then, the threshold setting unit 128 adds the basic threshold (for example, 500) to the multiplication value to obtain the first threshold (2500). The current data of the generation number “200” is estimated to have an update block number of about 2100, but unlike the first embodiment in which the first threshold value is fixed at 2000, the first embodiment uses the first data in the third embodiment. Since the threshold is set to 2500, it is determined that the current data is normal.

  The basic threshold value is a buffer value that allows a change in increase / decrease in data update per generation by a human. If the basic threshold is high, the capacity for increase / decrease in data update is high, but virus infection cannot be detected until many generations of virus tampering. On the other hand, if the basic threshold value is low, there is a high possibility that an error that erroneously determines that there is an abnormality in the current data will occur. Therefore, the basic threshold is set in consideration of the type of data, the importance of data, and the like.

  The coefficient is preferably a value that takes into account changes in the data update per generation by humans. Such a change in increase / decrease in data update per generation by a human can be determined, for example, by collecting information regarding data update for a certain period and statistically determining it. Log data shown in FIGS. 6 to 8 can be used for information related to data update.

  Hereinafter, a flow of a series of processes performed by the information processing apparatus 100 will be described with reference to FIG. The information processing apparatus 100 acquires current data and reference data (step S31), and calculates a difference value between the current data and the reference data (step S32). Then, the information processing apparatus 100 acquires the timing information of the current data and the timing information of the reference data, and calculates a value calculated based on the difference between the timing information of the current data and the timing information of the reference data. One threshold is set (step S33). Here, when the difference value is equal to or greater than the first threshold (step S34, Yes), the information processing apparatus 100 determines that there is an abnormality in the current data and gives an abnormality to the administrator of the information processing apparatus 100. Notification is made (step S35). On the other hand, when the difference value is less than the first threshold (No at Step S34), the information processing apparatus 100 stores the current data in the storage device 200 (Step S36).

[Modification of Third Embodiment]
In the third embodiment described above, the case has been described in which the sum of the multiplication value obtained by multiplying the generation number difference between the current data and the reference data by the coefficient and the basic threshold is set as the first threshold. . However, the sum of a multiplication value obtained by multiplying a period between the time when the reference data is stored and the time when the current data is stored by a predetermined coefficient and the basic threshold is set as the first threshold. You may do it.

  More specifically, the threshold value setting unit 128 is obtained by multiplying the period between the time when the reference data is stored and the time when the current data is stored by the coefficient stored in the coefficient storage unit 112. The sum of the multiplied value and the basic threshold value is set as the first threshold value. The time at which the reference data is stored may be stored as a log when the reference data is stored in the storage device 200, or may be acquired from the storage device 200. As for the time when the current data is stored, the time when the processing of the present invention is performed is given as an example.

  In such an embodiment, it is possible to set a first threshold value that takes into account a change in data update that appears periodically. As a specific example, the data for managing the deposit and withdrawal is subjected to a periodic update process in which the number of update blocks and the data size are increased once a month, such as a data sheet for the next month is created at the end of the month. In such a case, the difference in the number of update blocks and the data size differs significantly depending on whether or not the end-of-month backup data is included between the reference data and the current data.

  Therefore, the threshold value setting unit 128 multiplies the value obtained by multiplying the coefficient stored in the coefficient storage unit 112 by the period between the time when the reference data is stored and the time when the current data is stored, and the basis. The total value with the threshold is set as the first threshold. The basic threshold is a buffer value that allows a change in increase / decrease in data update per generation by a human. Here, if a predetermined event (that is, end-of-month update) is included in a period between the time when the reference data is stored and the time when the current data is stored, the predetermined value corresponding to an increase in the difference value due to the predetermined event. The increase value is further added to the basic threshold. Note that the predetermined event is, for example, a periodic update process, and the predetermined increase value can be obtained by collecting, for example, information related to an increase in the number of update blocks or data size by the periodic update process.

  In this embodiment, it is possible to cope with a case where backup is performed irregularly. That is, when backups are performed irregularly, the number of update blocks and the increase in data size may be significantly different even if the number of generations is the same. Even in such a situation, the first threshold value is set to a value corresponding to the period between the time when the reference data is stored and the time when the current data is stored. It is possible to suppress erroneous determination errors.

  A part or all of the above embodiments can be described as in the following supplementary notes, but is not limited thereto.

(Appendix 1)
A current data acquisition unit for acquiring current data to be backed up;
A reference data acquisition unit that acquires, as reference data, backup data of a generation that is backed by a plurality of generations from the current data from a storage device that stores backup data of multiple generations;
A calculation unit for calculating a difference value between the current data and the reference data;
A determination unit that determines that the current data is abnormal when the difference value is equal to or greater than a first threshold;
An information processing apparatus including:
(Appendix 2)
A storage unit that stores the current data determined to be normal by the determination unit in the storage device as backup data;
In association with the number of generations from the reference data, a log storage unit that stores, as a log, a difference value calculated by the calculation unit when backup data of each generation is stored in the storage device;
When the determination unit determines that there is an abnormality in the current data, referring to the log storage unit, backup data of a generation in which an increase in the difference value equal to or greater than the second threshold continuously appears is abnormal A specific part identified as data,
The information processing apparatus according to appendix 1, further comprising:
(Appendix 3)
The time information of the current data and the time information of the reference data are acquired, and a value calculated based on a difference between the time information of the current data and the time information of the reference data is set as the first threshold value A threshold setting unit,
The information processing apparatus according to appendix 1 or 2, further including:
(Appendix 4)
The threshold value setting unit sets a total value of a multiplication value obtained by multiplying a generation coefficient difference between the current data and the reference data by a predetermined coefficient and a basic threshold value as the first threshold value. 3. The information processing apparatus according to 3.
(Appendix 5)
A sum of a multiplication value obtained by multiplying a period between the time when the reference data is stored and the time when the current data is stored by a predetermined coefficient and the basic threshold is set as the first threshold. The information processing apparatus according to appendix 3.
(Appendix 6)
When a predetermined event in which a difference value between the current data and the reference data increases is included in a period between the time when the reference data is stored and the time when the current data is stored, The information processing apparatus according to appendix 5, wherein a predetermined increase value corresponding to an increase in the difference value due to the predetermined event is added to the basic threshold value.
(Appendix 7)
The difference value is the number of update blocks that differ between the current data and the reference data, the difference between the overall size of the current data and the overall size of the reference data, and / or the total number of blocks of the reference data Is the ratio of the number of update blocks to
The information processing apparatus according to any one of supplementary notes 1 to 6.
(Appendix 8)
A current data acquisition step for acquiring current data to be backed up;
A reference data acquisition step for acquiring, as reference data, backup data of a generation that is backed by multiple generations from the current data from a storage device that stores the backup data of a plurality of generations;
A calculation step of calculating a difference value between the current data and the reference data;
A determination step for determining that the current data is abnormal when the difference value is equal to or greater than a first threshold;
An information processing method including:
(Appendix 9)
Current data acquisition process to acquire current data to be backed up,
A reference data acquisition step of acquiring, as reference data, backup data of a generation that is backed by multiple generations from the current data, from a storage device that stores backup data of multiple generations;
A calculation step of calculating a difference value between the current data and the reference data;
A determination step of determining that the current data is abnormal when the difference value is equal to or greater than a first threshold;
An information processing program that causes a computer to execute.
(Appendix 10)
A storage unit for storing multiple generations of backup data;
A current data acquisition unit for acquiring current data to be backed up;
A reference data acquisition unit for acquiring, as reference data, backup data of a generation that is backed by a plurality of generations from the current data, from the storage unit;
A calculation unit for calculating a difference value between the current data and the reference data;
A determination unit that determines that the current data is abnormal when the difference value is equal to or greater than a first threshold;
Including a storage device.

  The disclosure of the above patent document is incorporated herein by reference. Within the scope of the entire disclosure (including claims) of the present invention, the embodiments and examples can be changed and adjusted based on the basic technical concept. Further, various combinations or selections of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) within the scope of the claims of the present invention. Is possible. That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the entire disclosure including the claims and the technical idea.

DESCRIPTION OF SYMBOLS 100 Information processing apparatus 110 Storage part 111 Log storage part 112 Coefficient storage part 120 Processing part 121 Current data acquisition part 122 Reference data acquisition part 123 Calculation part 124 Judgment part 125 Notification part 126 Storage part 127 Identification part 128 Threshold setting part 200 Storage apparatus 300 Terminal device 1000 Storage device 1100 Storage unit 1200 Processing unit

Claims (10)

A current data acquisition unit for acquiring current data to be backed up;
A reference data acquisition unit that acquires, as reference data, backup data of a generation that is backed by a plurality of generations from the current data from a storage device that stores backup data of multiple generations;
A calculation unit for calculating a difference value between the current data and the reference data;
A determination unit that determines that the current data is abnormal when the difference value is equal to or greater than a first threshold;
An information processing apparatus including: A storage unit that stores the current data determined to be normal by the determination unit in the storage device as backup data;
In association with the number of generations from the reference data, a log storage unit that stores, as a log, a difference value calculated by the calculation unit when backup data of each generation is stored in the storage device;
When the determination unit determines that there is an abnormality in the current data, referring to the log storage unit, backup data of a generation in which an increase in the difference value equal to or greater than the second threshold continuously appears is abnormal A specific part identified as data,
The information processing apparatus according to claim 1, further comprising: The time information of the current data and the time information of the reference data are acquired, and a value calculated based on a difference between the time information of the current data and the time information of the reference data is set as the first threshold value A threshold setting unit,
The information processing apparatus according to claim 1, further comprising:   The threshold value setting unit sets, as the first threshold value, a total value of a multiplication value obtained by multiplying a generation coefficient difference between the current data and the reference data by a predetermined coefficient and a basic threshold value. Item 4. The information processing device according to Item 3.   A sum of a multiplication value obtained by multiplying a period between the time when the reference data is stored and the time when the current data is stored by a predetermined coefficient and the basic threshold is set as the first threshold. The information processing apparatus according to claim 3.   When a predetermined event in which a difference value between the current data and the reference data increases is included in a period between the time when the reference data is stored and the time when the current data is stored, The information processing apparatus according to claim 5, wherein a predetermined increase value corresponding to an increase in the difference value due to the predetermined event is added to a basic threshold value. The difference value is the number of update blocks that differ between the current data and the reference data, the difference between the overall size of the current data and the overall size of the reference data, and / or the total number of blocks of the reference data Is the ratio of the number of update blocks to
The information processing apparatus according to claim 1. A current data acquisition step for acquiring current data to be backed up;
A reference data acquisition step for acquiring, as reference data, backup data of a generation that is backed by multiple generations from the current data from a storage device that stores the backup data of a plurality of generations;
A calculation step of calculating a difference value between the current data and the reference data;
A determination step for determining that the current data is abnormal when the difference value is equal to or greater than a first threshold;
An information processing method including: Current data acquisition process to acquire current data to be backed up,
A reference data acquisition process for acquiring, as reference data, backup data of a generation that is backed by multiple generations from the current data from a storage device that stores multiple generations of backup data;
A calculation step of calculating a difference value between the current data and the reference data;
A determination step of determining that the current data is abnormal when the difference value is equal to or greater than a first threshold;
An information processing program that causes a computer to execute. A storage unit for storing multiple generations of backup data;
A current data acquisition unit for acquiring current data to be backed up;
A reference data acquisition unit for acquiring, as reference data, backup data of a generation that is backed by a plurality of generations from the current data, from the storage unit;
A calculation unit for calculating a difference value between the current data and the reference data;
A determination unit that determines that the current data is abnormal when the difference value is equal to or greater than a first threshold;
Including a storage device.

Images