JP2020068019A - Information analyzer, method for analyzing information, information analysis system, and program - Google Patents

Abstract

To provide grasping of a more minute regular operation.SOLUTION: The information analyzer includes: input means for inputting an operational history of a user in a terminal device; analysis means for analyzing the type of a regular operational pattern from the operational history input by the input means; and output means for outputting the analysis result obtained by the analysis means.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information analysis device, an information analysis method, an information analysis system and a program for collecting and analyzing a history of operations of an operator on a computer to be monitored.

  In recent years, RPA (Robotics Process Automation) has attracted attention as a method for improving white-collar work efficiency. The work efficiency improvement by RPA is established as a means to realize the work quality improvement, the work time reduction, and the labor saving of manual work by automating routine work (routine work).・ Large-scale organizations had a problem that it was difficult to select the scope of RPA introduction and the areas to be introduced.

  Patent Document 1 discloses a system that monitors an operation to a computer system, extracts a routine process from the operated content, and can utilize the extracted operation pattern. Patent Document 2 discloses a device that analyzes an operation input pattern for operating an application from an operation history of a terminal.

JP-A-2002-7020 JP, 2010-224979, A

  However, in Patent Document 1, the operation pattern is only activation of a mailer, reading of a new mail, activation of a web browser, and the like. For example, a mail with the same subject is delivered to a plurality of addresses. The operation cannot be grasped. Further, in Patent Document 2, the operation input pattern is only analyzed, and the routine operation cannot be grasped.

  Then, this invention aims at solving at least 1 of such a subject and other subjects. For example, the present invention provides for understanding more detailed routine operations.

The information analysis device of the present invention includes an input unit for inputting a user's operation history in the terminal device,
An analysis unit that analyzes the type of the routine operation pattern from the operation history input by the input unit and an output unit that outputs the analysis result by the analysis unit are provided.

  According to the present invention, it is provided to grasp a more detailed routine operation.

It is a figure which shows an example of an information analysis system. It is a flow chart which shows an example of information analysis processing. It is a flow chart which shows an example of pattern analysis. It is a flow chart which shows an example of pattern analysis. It is a flow chart which shows an example of pattern analysis. It is a figure which shows an example of the recorded content of log management DB. It is a figure which shows an example of a connection key total. It is a figure which shows an example of a routine operation calculation table. It is a figure which shows an example of a routine operation calculation table. It is a figure which shows an example of a routine operation calculation table. It is a figure which shows an example of a routine operation calculation table. It is a figure which shows an example of the recorded content of log management DB. It is a figure which shows an example of the recorded content of log management DB. FIG. 16 is a block diagram illustrating a hardware configuration example of a computer. It is a figure which shows an example of an analysis result. It is a flow chart which shows scenario creation. It is a flow chart which shows an example of pattern analysis. It is a figure which shows an example of the recorded content of log management DB. It is a figure which shows an example of a threshold value. It is a figure which shows an example of a threshold value.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. However, the constituent elements described in this embodiment are merely examples, and the scope of the present invention is not intended to be limited thereto. Further, not all of the combinations of features described in the embodiments are essential to the solving means of the invention.

[First embodiment]
(System configuration)
FIG. 1 is a diagram showing an example of the information analysis system of the present invention. The information analysis system includes a plurality of client terminals (information processing devices) 11A and 11B and a log management server 12. The client terminal 11 is connected to the log management server 12 via the network 14.

  The client terminals 11A and 11B are examples of terminals arranged in a company. The log management server 12 manages the operation history (log) of the application program executed by the client terminal 11 arranged in the company. In addition, the log management server 12 is an example of an information analysis device that analyzes the operation history of the application programs in the client terminals 11A and 11B arranged in the company. These devices are connected via various networks 14 such as an intranet including a LAN (Local Area Network) and the Internet. When describing matters common to the client terminals 11A and 11B, they will be simply referred to as the client terminal 11.

  The client terminal 11 includes a monitoring unit 11a. The monitoring unit 11a monitors the operation on the client terminal 11 (for example, Web usage status, application usage status, mail usage status, user's operation man-hours for the input device), and records it as an operation history.

The operation history includes, for example, the following.
-Operation date and time-Machine name-User name-File name-Operation type (reference, overwrite, delete, move, copy, rename, move, change active window, download, upload, etc.)
-Window title-Process name-Mouse-Keyboard operation status-Mail subject, mail send / receive address, attachment file name-URL (Uniform Resource Locator)

  The client terminal 11 transmits the operation history to the log management server 12. The operation history is transmitted to the log management server 12 at a predetermined time unit (for example, every 4 hours: set on the log management server 12 side). Other than that, various conditions can be set, for example, when a predetermined amount or more of log data is accumulated, when the client 11 is restarted, when a request is received from the log management server 12, and the like.

  The log management server 12 is an information processing device (computer) including a log management DB (database) 12a, a routine operation calculation table 12b, a routine operation determination unit 12c, a routine operation result DB (database) 12d, and a routine operation exclusion table 12e. .

  The log management server 12 analyzes and outputs the routine work based on the operation history received from the client terminal 11 via the network 14. The network interface of the log management server 12 is an example of an input unit that inputs the operation history of the client terminal (terminal device).

  The operation history can be transferred from the client terminal 11 to the log management server 12 via the network 14 or an external storage medium (FD, MO, USB memory, CD-R, DVD-RAM, etc.). . The log management server 12 includes a drive device for such an external storage medium, and functions as an input unit for inputting the operation history in the client terminal.

  The log management server 12 receives the operation history from each client terminal 11 connected via the network 14 and registers it in the log management DB 12a. Each record is recorded in the log management DB 12a in chronological order according to the access date and time.

  The routine operation determination unit 12c refers to the routine operation calculation table 12b (FIGS. 8A, 8B, 8C, and 8D) to determine the routine operation (standard operation), and stores it in the routine operation determination result DB 12d. The routine operation calculation table 12b manages the evaluation of routine operations when accessing information assets. This evaluation is determined according to the company, organization, individual, etc. Therefore, even if the same operation is performed, the evaluation of the routine operation does not always match, but may be different depending on the type of business and the type of work.

  In addition, the routine operation calculation table 12b may be managed by further associating with a weighting coefficient for adjustment when the operation time period or the number of times the window title appears is large in order to perform more detailed analysis.

  The routine operation exclusion table 12e is a table managed for adjustment of the determination result of the routine operation determination unit 12c. For example, a record in which "Format cell" is recorded in the window title (for example, 91 in FIG. 9) is a record that is unnecessary for routine operation, and therefore, the keyword "cell format" is excluded from the routine operation. Is registered in the routine operation exclusion table 12e.

  If the number of records per unit time is equal to or greater than the predetermined number, it is highly likely that the operation is mechanized rather than the user operation. Therefore, the criterion for indicating the predetermined number or more is registered in the routine operation exclusion table 12e. May be. In addition, since there is a high possibility that a record with no operation history of mouse / keyboard operations within the number of records per unit time is not a user operation but a mechanized operation, a judgment criterion indicating a predetermined number or more is set as a routine. It may be registered in the operation exclusion table 12e.

  The log management server 12 may be installed in the company in which the client terminal 11 is installed, or may be installed in another company. Similarly, the log management server 12 may be arranged in the company in which the client terminal 11 is installed, or may be arranged in another company. Further, the log management DB 12a of the log management server 12 may be managed on a server different from the log management server 12.

(Hardware configuration)
FIG. 11 is a block diagram showing a hardware configuration example of a computer applicable to the client terminal 11 and the log management server 12. The CPU 111 controls the entire computer using computer programs and data stored in the ROM 112 and the RAM 113. When the present computer is applied to the client terminal 11, the CPU 111 executes each process described below as what the client terminal 11 does. Further, when the computer is applied to the log management server 12, the CPU 111 executes each process described below as being performed by the log management server 12.

  The ROM 112 stores setting data of the computer, a boot program, and the like. The RAM 113 has an area for temporarily storing a computer program and data loaded from an HDD (hard disk drive) 114, data received from the outside via the interface 117, and the like. Further, the RAM 113 has a work area used when the CPU 111 executes various processes. That is, the RAM 113 can appropriately provide various areas.

  The HDD 114 stores an OS (operating system) and computer programs and data for causing the CPU 111 to execute various types of processing performed by an apparatus to which the present computer is applied. When the present computer is applied to the client terminal 11, the computer program includes a computer program for causing the CPU 111 to execute each process described below as being executed by the client terminal 11.

  When the computer is applied to the log management server 12, the computer program includes a computer program for causing the CPU 111 to execute each process described below as being performed by the log management server 12. The computer programs and data stored in the HDD 114 are appropriately loaded into the RAM 113 under the control of the CPU 111, and are processed by the CPU 111. Further, the log management DB 12a and the routine operation result DB 12d are also provided in the HDD 114.

  The input device 115 is composed of a keyboard, a mouse, and the like, and the operator of the computer can input various instructions to the CPU 111 by operating the input device 115. The display device 116 is composed of a CRT, a liquid crystal screen, or the like, and can display the processing result by the CPU 111 as an image or characters.

  The interface 117 is composed of various interfaces. For example, when the computer is applied to the client terminal 11, the interface 117 includes a network interface for connecting the computer to the network.

  When this computer is applied to the log management server 12, the interface 117 is composed of a network interface for connecting this computer to the network 118. A bus 118 connects the above-mentioned units.

  In the present embodiment, for simplification of description, it is assumed that both the client terminal 11 and the log management server 12 are computers having the configuration shown in FIG. 11, but the configuration of the computer is limited to such a configuration. Not a thing. Also, a computer having different configurations for the client terminal 11 and the log management server 12 may be applied.

(Information analysis processing)
The information analysis process executed by the log management server 12 will be described with reference to the flowchart of FIG. Before this process is executed, the log management server 12 receives the operation history from the client terminal 11 and registers it in the log management DB 12a.

  FIG. 2 is a flowchart showing an example of the information analysis process. In step S201, the CPU 111 of the log management server 12 reads the operation history (operation log) of the target client terminal 11 from the log management DB 12a.

  In step S202, the CPU 111 extracts the number of records (for example, 100 records) preset by the administrator from the operation history read in step S201. The CPU 111 may refer to the routine operation exclusion table 12e, exclude the target record registered in the routine operation exclusion table 12e, and extract the number of records preset by the administrator. Alternatively, the target record registered in the routine operation exclusion table 12e may be excluded after extracting the number of records set in advance by the administrator.

  In step S203, CPU 11 performs pattern analysis. As will be described in detail later, the routine operation includes a repetitive operation (for example, a plurality of processes is repeatedly operated), a long-time operation (for example, a specific process is operated for a long time), and an individual delivery operation ( For example, there are a plurality of patterns such as delivering mails having the same subject to a plurality of addresses) and passing operations (for example, passing specific data). Therefore, the pattern analysis is performed on a plurality of patterns.

  In step S204, as a result of the pattern analysis in step S203, it is determined whether the target routine operation exists. When it is determined that the target routine operation exists (YES in step S204), the determination result is written in the routine operation result DB 12d in step S205. FIG. 12 is a diagram showing an example of the analysis result. In FIG. 12, it is understood that the production management software and the spreadsheet software are repeatedly operated, the data output by the production management software is copied, and the copied data is pasted into the spreadsheet software and input. Further, the CPU 111 can not only detect the routine operation but also calculate and visualize the time spent in the routine operation. As shown in FIG. 12, by referring to the time spent for the repetitive operation or the routine operation, the user can study the RPA implementation target area.

  In step S206, it is determined whether pattern analysis of all operation histories has been completed. If not completed (NO in step S206), the process returns to step S202 to repeat the process. Even if it is determined that the target routine operation does not exist (NO in step S204), the process ends if it is determined that the pattern analysis of all operation histories is completed.

(Pattern analysis 1: Repeated operation)
In pattern analysis 1, as shown in FIG. 6, a process of determining a pattern in which a plurality of processes are repeatedly operated will be described. For example, in the routine work in which the user visually confirms the data output by the production management software and inputs the data to the spreadsheet software, the production management software and the spreadsheet software are repeatedly operated. Therefore, in pattern analysis 1, a pattern in which a plurality of processes are repeatedly operated is analyzed.

  Details of the processing executed in the pattern analysis in step S203 will be described with reference to FIGS. 3, 6, 7, and 8A. FIG. 3 is a flowchart showing an example of pattern analysis. In step S301, the CPU 11 creates a concatenated key that combines the window title and process name of each record from the operation history extracted in step S202. For example, in the case of the record indicated by 61 in FIG. 6, it is “Process1WindowTitle1”.

  In step S302, the CPU 11 totalizes the number of appearances for each concatenated key created in step S301. Then, in step S303, the CPU 11 refers to the routine operation calculation table 12b shown in FIG. 8A, and determines whether or not there are two or more linked keys that exceed a threshold value (for example, 30%) that is an arbitrary numerical value. judge.

  FIG. 7 is a diagram showing an example of concatenated keys. For example, if the number of records extracted in step S202 is 100 and the threshold used in step S303 is 30%, the concatenated key "Process2WindowTitle2" and the concatenated key "Process3WindowTitle3" exceed the threshold. To determine.

  When it is determined that there are two or more link keys (YES in step S303), the process proceeds to step S304, and it is determined that the operation is repeated. If it is determined that there are not two or more (NO in step S303), the process ends. The CPU 111 can refer to the routine operation exclusion table 12e and exclude the operation determined as the repeated operation in step S304 if the registered determination criteria are satisfied. For example, a record having no operation history of mouse / keyboard operation is likely to be a mechanized operation, not a user operation. Therefore, a criterion indicating a predetermined number or more (for example, keyboard keystroke: less than 10 times, mouse movement (Distance: less than 10 pixels) is not determined as a repeated operation.

  Further, in step S302, not only the number of appearances for each concatenated key but also the operation time for each unit record may be totaled. By totaling the operation time for each unit number of records, for example, even when it is determined that there are two or more linked keys that exceed the threshold value, if the total operation time is within a predetermined time (for example, 1 minute) It can be determined that there is a high possibility that RPA has already been introduced. Further, it is also possible to use it as a material for determining the priority of the work efficiency improvement by the RPA, based on the aggregation result of the operation time for each unit record number of the operation determined to be the repeated operation.

(Pattern analysis 2: long-time operation)
In the pattern analysis 2, as shown in FIG. 9, a process of determining a pattern in which only a specific process is operated for a long time will be described.

  Details of another process executed in the pattern analysis in step S203 will be described with reference to FIGS. 4, 8B, and 9. FIG. 4 is a flowchart showing an example of pattern analysis. In step S401, the number of times the process has appeared and the operation time are totalized from the operation history extracted in step S202. For example, in the case of the operation history shown in FIG. 9, the total operation time of Process1 is 1 hour.

  In step S402, the routine operation calculation table 12b shown in FIG. 8B is referred to, and it is determined whether or not it exceeds a threshold value defined in advance as a long-time operation. If it exceeds the threshold value (YES in step S402), the process proceeds to step S403, and it is determined that the operation has been performed for a long time. If it is below the threshold value (NO in step S402), the process ends.

  In step S401, the number of appearances of a specific window title may be aggregated as well as the number of appearances of processes and operation times. By counting the number of appearances of a specific window title, it is possible to grasp the operation in which the operation is performed for a long time in more detail. Further, from the operation history of the mouse / keyboard, only the operating time may be totaled as the operating time.

(Pattern analysis 3: Individual distribution)
In pattern analysis 3, as shown in FIG. 10, a process of determining a pattern in which mails having the same subject are delivered to a plurality of addresses will be described.

  The process executed in the pattern analysis in step S203 will be described with reference to FIGS. 5, 8C, and 10. FIG. 5 is a flowchart showing an example of pattern analysis. In step S501, a concatenation key that combines the mail subject and the attached file name is created from the operation history extracted in step S202. For example, in the case of the record 101 shown in FIG. 10, it is “contact regarding survey results. Contact regarding survey results.doc”.

In step S502, the number of appearances of the concatenated key is totalized from the concatenated keys created in step S501. In step S503, referring to the routine operation calculation table 12b shown in FIG. 8C, it is determined whether or not the counting result of S502 exceeds a threshold value defined in advance as individual mail delivery. If it exceeds the threshold value (YES in step S503), the flow advances to step S504 to determine that the mail individual delivery operation is performed. If it is below the threshold value (YES in step S503), the process ends.

(Pattern analysis 4: Hand-over operation)
In the pattern analysis 4, as shown in FIG. 15, a process of determining a pattern in which specific data (for example, a process or a file) is transferred will be described. For example, in the routine work in which the user visually confirms the data downloaded from the accounting software and uploads the data after processing the accounting software, the downloading and uploading from the accounting software is repeatedly performed. Therefore, in pattern analysis 4, a pattern in which specific data is transferred is analyzed.

  FIG. 14 is a flowchart showing an example of pattern analysis. In step S1401, the CPU 11 creates a concatenation key that combines the operation name of each record and the file name from the operation history extracted in step S202. For example, in the case of the record 151 in FIG. 15, it is “.xls for checking download expense payment”. The concatenation key may be a concatenation key that combines the operation name and window title of each record, the operation name and URL of each record, and the operation name and process name of each record.

  In step S1402, the CPU 11 determines whether or not the link key created in step S1401 is a transfer operation target. For example, in the concatenation key, a predefined operation name (eg, download, upload, read, write, email, etc.), a predefined file name, a predefined window title, a predefined URL, a predefined If the process name and the like are included, it is determined that the process is a transfer operation target.

  In step S1403, the CPU 11 totalizes the number of appearances for each concatenated key determined to be the transfer operation in step S1402. In step S1404, with reference to the routine operation calculation table 12b shown in FIG. 8D, it is determined whether or not the number of times the paired concatenated keys appear exceeds a threshold value that is an arbitrary numerical value. The term “pair” refers to file operations such as file download / upload, file download / mail transmission, file read / write from device, and data transfer. Therefore, for example, in the case of the concatenated key "xls for download expense payment check" of the record 151 shown in FIG. 15, the paired concatenated key is the record "xls for upload expense payment check .152" of FIG. Become.

  If it exceeds the threshold value (YES in step S1404), the process advances to step S1405 to determine a hand-over operation. If it is below the threshold value (NO in step S1404), the process ends.

  In the above description, the routine operation calculation table 12b (FIG. 8A, FIG. 8B, FIG. 8C, FIG. 8D) uses a predetermined arbitrary value as the threshold value to analyze the routine operation pattern. However, it is not limited to this. For example, an arbitrary value may be set for each client terminal 11.

  Further, as shown in FIG. 16, it may be the average value of the department in the company in which the client terminal 11 is installed, or, as shown in FIG. 17, it is the average value excluding statistical outliers. It may be a statistically significant value. Similarly, it may be the average value for each department in the company in which the client terminal 11 is installed, or the average value in the department in the company for which the client terminals arranged in other companies are installed, It may be a statistically significant value. In addition, the statistically significant value may be subjected to a rejection test in a department in the company in which the client terminal 11 is installed.

  As described above, according to the present embodiment, the operation history recorded in each client terminal 11 is collected by the log management server 12, and the routine operation determination unit 12c collects the collected operation history. The type of routine operation pattern (routine operation pattern) can be detected / analyzed. By detecting / analyzing, the routine operation pattern can be detected, and the RPA introduction range and the introduction target area can be easily selected.

[Second embodiment]
In the present embodiment, a process of creating a scenario for the RPA tool by performing conversion corresponding to the RPA tool for an operation in which a routine operation pattern is detected will be described.

  FIG. 13 is a flowchart showing scenario creation. In step S1301, the CPU 111 executes the RPA tool stored in the HDD 114. Since the RPA tool is a general technique, its explanation is omitted.

  In step S1302, the CPU 111 performs pattern analysis of the operation history (operation log) with the RPA tool executed in step S1301. The pattern analysis takes as an example the information analysis processing shown in the flowchart of FIG.

  In step S1303, the CPU 111 creates a scenario that matches the routine operation pattern obtained in step S1302. Since the scenario is generated by the executed RPA tool, the scenario of the RPA can be easily created.

  As described above, according to the present embodiment, it is possible to create a scenario of the RPA tool by using the analyzed routine operation pattern (routine operation pattern) and automate the routine operation.

[Other Embodiments]
The present invention supplies a program that realizes one or more functions of the above-described embodiments to a system or apparatus via a network or a storage medium, and one or more processors in a computer of the system or apparatus read and execute the program. It can also be realized by the processing. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

Claims (10)

Input means for inputting a user's operation history in the terminal device,
From the operation history input by the input means, analysis means for analyzing the type of routine operation pattern,
An information analysis apparatus, comprising: an output unit that outputs an analysis result of the analysis unit. The information analysis apparatus according to claim 1, wherein the type of the standard operation pattern is any one of repetitive operation, long-time operation, individual delivery operation, and hand-over operation, or a combination thereof. In the operation history, the process name and window title are recorded,
The analysis means is
The information analysis apparatus according to claim 1, wherein the information analysis device is specified as a repetitive operation based on a concatenated key formed by combining a process name of the operation history and a window title. A process name is recorded in the operation history,
The analysis means is
The information analysis device according to claim 1, wherein the information analysis device is specified as a long-time operation based on the process name of the operation history. In the operation history, the subject of the email and the name of the attached file are recorded.
The analysis means is
The information analysis apparatus according to claim 1 or 2, wherein the operation is specified as a long-time operation based on a concatenated key that combines a subject of the operation history mail and an attachment file name. In the operation history, operation names and file names, window titles, URLs, or process names are recorded.
The analysis means is
2. The transfer operation is specified on the basis of an operation name and file name in the operation history, an operation name and window title, an operation name and URL, or a concatenation key that combines an operation name and a process name. Alternatively, the information analysis device described in 2. Furthermore,
The information analysis apparatus according to any one of claims 1 to 6, further comprising: a creating unit that creates a scenario of the standard operation pattern based on the standard operation pattern analyzed by the analyzing unit. An input step in which the input means inputs the operation history of the user in the terminal device;
An analyzing step, in which the analyzing means analyzes the type of the standard operation pattern from the operation history input in the input step,
And an output step of outputting the analysis result of the analysis step. An information analysis system comprising a terminal device and an information analysis device,
The terminal device,
A recording means for monitoring user operations and recording them as operation history,
The information analysis device,
Input means for inputting the operation history,
From the operation history input by the input means, analysis means for analyzing the type of routine operation pattern,
An information analysis system, comprising: an output unit that outputs an analysis result of the analysis unit. On the computer,
Input means for inputting a user's operation history in the terminal device,
From the operation history input by the input means, analysis means for analyzing the type of routine operation pattern,
A program characterized by causing it to function as output means for outputting an analysis result by the analysis means.

Images