JP2020181429A - Information analysis apparatus, information analysis method, program, and information analysis system - Google Patents

Abstract

To provide an information analysis apparatus, information analysis method, program, and information analysis system capable of grasping the status of utilization of a file.SOLUTION: The information analysis apparatus 13 in an information analysis system includes: input means for inputting an operation history of a user for each of a plurality of terminal apparatuses; calculation means for calculating a file creation time at which a file is created and a period of time during which the file has been used, from the operation history input by the input means; analysis means for analyzing a status of usage of the file based on the creation time and the period of usage calculated by the calculation means; and output means for outputting a result of the analysis performed by the analysis means.SELECTED DRAWING: Figure 1

Description

The present invention relates to an information analyzer, an information analysis method, an information analysis system and a program for analyzing a file usage status.

The work of white-collar employees is centered on the work done on the personal computer. In addition, in recent years, the digitization of information has progressed, and the distribution and distribution of information through networks has increased. When looking at productivity in personal computer business, it is necessary to consider the time spent creating and editing information (files) that is not used on the network as a "waste". Therefore, Patent Document 1 discloses a system that receives a file usage status from a terminal, calculates the amount of relationship with the file for each user based on the received file usage status information, and facilitates a file search. There is. Further, Patent Document 2 discloses a system for classifying each file into a plurality of work categories based on the operation history.

Japanese Unexamined Patent Publication No. 2014-13476 Japanese Unexamined Patent Publication No. 2012-14530

When distributing a file, if the file can be created in a short time and it is used for a long time by many users (viewing, editing, falsification, etc.), the usefulness of the file is high. I can say. However, in Patent Document 1, although it is possible to grasp the operation period such as copying of a file, it is not possible to grasp the time taken to create the file and the time used. Further, in Patent Document 2, although it is possible to grasp the working time for each file, it is not possible to grasp how much the file is used by other employees. That is, it was not possible to grasp the utilization status of the file by using the time required for creating the file and the time actually used.

The present invention has been made in view of the above problems, and an object of the present invention is to provide a technique for easily grasping the utilization status of a file.

The information analysis device of the present invention includes, for example, an input means for inputting a user's operation history in each terminal device of a plurality of terminal devices, a creation time for creating a file from the operation history input by the input means, and the above-mentioned A calculation means for calculating the usage time using a file, an analysis means for analyzing the utilization status of the file based on the creation time and the usage time calculated by the calculation means, and an analysis by the analysis means. It is provided with an output means for outputting the result.

According to the present invention, it is possible to provide a technique that makes it possible to grasp the utilization status of a file.

It is a figure which shows an example of an information analysis system. It is a figure which shows the hardware configuration of a terminal device. It is a figure which shows the hardware configuration of a log management server. It is a figure which shows the hardware configuration of an information analyzer. It is a figure which shows an example of the operation history of an application program. It is a figure which shows an example of the transmission / reception history of an e-mail. It is a figure which shows an example of the input history for an input device. It is a flowchart which shows an example of the information analysis processing. It is a flowchart which shows an example of the file creation table creation process. It is a flowchart which shows an example of the file duplication table creation process. It is a flowchart which shows an example of the file diffusion table creation process. It is a figure which shows an example of a file creation table. It is a figure which shows an example of a file duplication table. It is a figure which shows an example of a file diffusion table. It is a figure which shows an example of the analysis result. It is a figure which shows an example of the analysis result. It is a figure which shows an example of the analysis result.

Hereinafter, details of the embodiment according to the present invention will be described with reference to the accompanying drawings. However, the components described in this embodiment are merely examples, and the scope of the present invention is not limited to them. Moreover, not all combinations of features described in the present embodiment are essential for the means for solving the invention.

<First Embodiment>
(System configuration)
FIG. 1 is a diagram showing an example of an information analysis system. The information analysis system includes a plurality of terminal devices 11a and 11b, a log management server 12, and an information analysis device 13. The terminal devices 11a and 11b are examples of terminals arranged in a company. The log management server 12 manages the operation log (operation history) of the application program executed by the terminal device arranged in the company. The information analysis device 13 is an example of an information analysis device that analyzes the operation history of an application program in a terminal device arranged in a company. These devices are connected via various networks 50 such as an intranet including a LAN (Local Area Network) and the Internet. When the matters common to the terminal devices 11a and 11b are described, they will be simply referred to as the terminal device 11.

The log management server 12 may be arranged in the company where the terminal device 11 is installed, or may be arranged in another company. Similarly, the information analysis device 13 may be arranged in the company where the terminal device 11 is installed, or may be arranged in another company. Further, the log management server 12 and the information analysis device 13 may be managed by the same company, or may be managed by other companies, respectively.

The terminal device 11 includes a monitoring unit 14. The monitoring unit 14 uses the name of the application program operating in the terminal device 11, the title information displayed in the title display unit of the active window of the application program, and the user for the input device of the terminal device when the application program is operating. Monitor the operation manpower, etc., and record it as an operation history. These information regarding the operation history can be obtained from the operating system (OS), the window manager, and the like.
The operation history may include, for example, the following information.
-Terminal device identification information: Computer name, IP address, MAC address, etc.-User name: ID of the user logged in to the terminal device, etc.-Operation date and time: Date and time when the operation history was acquired-Active Window application name: process name, etc.-Active window title name: caption name (name of the file being edited, etc.)
-File operation name, file name, folder name-Keyboard keystrokes-Input character code: Full-width / half-width, 2-byte characters / 1-byte characters, Unicode
/ EUC / ISO / JIS, etc.-Input confirmed characters: Characters confirmed through the front-end processor (FEP) -Pointing device pointer movement distance-Pointing device clicks

The monitoring unit 14 of the terminal device 11 creates an operation history for each preset monitoring period (example: 1 minute) and transmits the operation history to the log management server 12. If the active window is switched in the middle of the monitoring period, the operation history for starting acquisition for one active window may include the operation history for another active window. In addition, the first active window may be switched to the second active window in the middle of the monitoring period, and the second active window may be switched to the third active window. In this case, the second active window may not be reflected in the operation history. This is because the active window at the start of the monitoring period is associated with the operation history. Therefore, the monitoring unit 14 of the terminal device 11 may create an operation history every time the active window is switched. Alternatively, when the active window is switched, or when a predetermined monitoring period is started, the monitoring unit 14 starts acquiring the operation history of the active window and switches to another active window. Alternatively, the acquisition of the operation history may be terminated when the predetermined monitoring period ends. As a result, each active window is reflected in the operation history. Further, since the operation start date and time described later is the time when the operation history acquisition starts, the operation time (creation time, usage time) for each active window can be calculated from the operation start date and time. For example, the operation time of the first active window when the first active window is switched to the second active window can be calculated as the time from the operation start date and time of the first active window to the operation start date and time of the second active window.

Further, the operation time (creation time, usage time) for each active window may be calculated to be counted as the operation time when the number of keystrokes and the pointer movement distance of the keyboard, which will be described later, are equal to or greater than a predetermined value.

Various conditions can be considered for the terminal device 11 to transmit the operation history to the log management server 12 with the operation history acquired in this way. For example, when a predetermined time has elapsed (example: every 2 hours), when a predetermined amount or more of operation history is accumulated, when the terminal device 11 is started, when the terminal device 11 is instructed to shut down, a log management server. For example, when the transmission of the operation history from 12 is requested.

The log management server 12 is an information processing device (computer) that accumulates operation histories collected from each of the plurality of terminal devices 11 and transmits the accumulated operation histories to the information analysis device 13. As shown in FIG. 1, the log management server 12 includes a log management DB 15. DB is an abbreviation for database. The log management server 12 records the operation history for each terminal device (or for each user) in the log management DB 15 based on the operation history received from the terminal device 11.

The information analysis device 13 is an information processing device including an analysis unit 18 and an analysis result DB 19. The information analysis device 13 analyzes and outputs operation contents (for example, file utilization status) for the application program and the OS based on the operation history received from the log management server 12 via the network 50. The network interface of the information analyzer 13 is an example of inputting the operation history of the terminal. The analysis unit 18 analyzes the utilization status of the file from the input operation history. The analysis unit 18 creates, for example, an analysis result for each user or each terminal device, and records the created analysis result in the analysis result DB 19. The analysis result recorded in the analysis result DB 19 is output to a display device as a graph or a table, is output to a recording medium by a printing device, is output as the body of an e-mail, or is output as a Web page of a website. You may.

In addition to using the network, the operation log of the user terminal device group collected by the log management server 12 can be delivered to the information analyzer 18 as an external storage medium (FD, MO, USB, CD-R, DVD). -It is also possible to use a medium that can send and receive operation logs such as (RAM, etc.).

(Hardware configuration)
FIG. 2A is a diagram showing a hardware configuration of the terminal device 11. The terminal device 11 is an information processing device such as a personal computer arranged in an office or the like. In the terminal device 11, the CPU 21 functions as various means according to the software stored in the hard disk drive (HDD 25). In particular, the CPU 21 functions as the monitoring unit 14 described above, monitors the name of the application program, the caption name, the operation date and time, the operation man-hours, and the like, creates an operation history, and transmits the operation history to the log management server 12. The display device 22 is a user interface for displaying information. The memory 23 includes a RAM, a ROM, and the like. The network interface 24 is a communication circuit for communicating with another computer through the network 50. The HDD 25 stores an application program 27, a monitoring program 28 that monitors operation man-hours and the like to create an operation history, and the like.

The input unit 26 (input device) is a pointing device (mouse or touch panel), a keyboard, or the like. The keyboard may be a software keyboard. Further, the input unit 26 may be a voice recognition input unit that recognizes the input operator's voice by the voice recognition function and inputs an instruction to the CPU 21. The input unit 26 is an example of an operation means for operating the application program corresponding to the active window among the plurality of application programs.

FIG. 2B is a diagram showing a hardware configuration of the log management server 12. The log management server 12 is also a type of computer. In the log management server 12, the CPU 31 functions as various means according to the software stored in the hard disk drive (HDD 35). The memory 33 includes a RAM, a ROM, and the like. The network interface 34 is a communication circuit for communicating with another computer through the network 50. The HDD 35 stores the log management program 36 and the log management DB 15.

FIG. 2C is a diagram showing a hardware configuration of the information analyzer 13. The information analyzer 13 is also a kind of computer. In the information analyzer 13, the CPU 41 functions as various means according to the software stored in the hard disk drive (HDD 45). The memory 43 includes a RAM, a ROM, and the like. The network interface 44 is a communication circuit for communicating with another computer through the network 50. The HDD 45 stores the information analysis program 47 and the analysis result DB 19. The output unit 46 is a display device, a printing device, or the like that outputs an analysis result.

(Log management database)
The operation history information transmitted from the terminal device 11 to the log management server 12 is recorded in the log management DB 15 of the log management server 12. The operation history includes the name (process name) of the application program and the title information (in association with the identification information of the terminal device 11 or the identification information of the user who was logged in to the terminal device 11 when the application program is operating. The title name of the active window) and the operation effort are recorded. The recorded contents of the log management DB 15 will be described with reference to FIGS. 3 to 5.

3 to 5 are diagrams showing an example of the recorded contents of the log management DB 15. FIG. 3 shows an example of the operation history of the application which is a part of the operation history received from the terminal device 11. In FIG. 3, the identification information of the terminal device is recorded in the PC name column 301. In the user name field 302, the identification information of the employee who is logged in to the terminal device is recorded. In the operation start date and time column 303, the data of the date and time when the monitoring unit 14 started recording the operation history is recorded. In the process name field 304, the process name (application name) of the process executed in the active window is recorded. Identification information for identifying the application (eg, the name of the editing work, the name of the file to be edited, etc.) is recorded in the window title column 305. For example, if the e-mail program (mailer) is an application, for example, the editing work name is "Create" and the title of the mail is "Re: Thank you". The name of the operation target file is recorded in the file name column 306. The operation content is recorded in the operation name column 307. In the path column 308, the current path or the path before the move or change is recorded. In the path 2 column 309, the moved or changed path is recorded. One record is created for each active window, and the operation history is recorded in chronological order according to the order in which the active windows are displayed.

FIG. 4 shows an example of the transmission / reception history of e-mail, which is a part of the operation history received from the terminal device 11. In FIG. 4, the identification information of the terminal device is recorded in the PC name column 401. In the user name field 402, the identification information of the employee who is logged in to the terminal device is recorded. In the operation start date and time column 403, the data of the date and time when the operation history recording is started is recorded. The subject of the email is recorded in the subject column 404. The attached file name is recorded in the attached file column 405. In the operation name field 406, information on whether the terminal device or the user has received or sent the mail is recorded. The sender of the email is recorded in the sender column 407. The address of the mail is recorded in the address field 408. One record is created for each mail, and the operation history is recorded in chronological order according to the order in which reception or transmission is performed.

FIG. 5 shows an example of the input history to the input device which is a part of the operation history received from the terminal device 11. The identification information of the terminal device is recorded in the PC name column 501. In the user name field 502, identification information of an employee who is logged in to the terminal device is recorded. In the operation start date and time column 503, the data of the date and time when the operation history recording is started is recorded. In the number of keystrokes column 504 of the keyboard, the number of times the keyboard is pressed during a predetermined monitoring period (eg: 1 minute) from the operation start date and time is recorded. In the pointer movement distance column 505, data on the distance that the pointer of the pointing device has moved during a predetermined monitoring period (eg: 1 minute) from the operation start date and time is recorded.

(Information analysis processing)
FIG. 6 is a flowchart showing an example of information analysis processing. The CPU 41 of the information analysis device 13 executes this information analysis process according to the information analysis program 47. As a result, the CPU 41 functions as the analysis unit 18. Before this process is executed, the log management server 12 receives the operation history (application operation history, e-mail transmission / reception history, input device input history) from the terminal device 11, and manages the log. Register in DB15.

In S601, the CPU 41 inputs the operation history to the memory 43. For example, the CPU 41 may receive the operation history from the log management DB 15 of the log management server 12, or may read it from a data storage medium such as a CD-ROM. Therefore, the network interface 44 or the drive device of the CD-ROM used for reception functions as an input means. The operation history reading unit can be freely set such as a user name, a PC name, and an operation start date and time. Correspondence of application operation history, e-mail transmission / reception history, and input history to the input device, which are a part of the operation history, is executed based on the user name, the PC name, and the operation start date and time.

In S602, the CPU 41 creates a file creation table (FIG. 10A), creates a file duplication table (FIG. 10B) in S603, and creates a file diffusion table (FIG. 10C) in S604. The method of creating the file creation table, the file duplication table, and the file diffusion table will be described later. The file creation table, the file duplication table, and the file diffusion table may be provided in the HDD 45 or the memory 43, for example.

In S605, the CPU 41 writes the analysis result in the analysis result DB 19 based on the file creation table, the file duplication table, and the file diffusion table, and in S606, outputs the analysis result from the output unit 46. FIG. 11A is a diagram showing an example of the analysis result. Each record is composed of a creation time and a usage time corresponding to the file name. FIG. 11B is a diagram showing an output example of the analysis result. The CPU 41 of the information analyzer 13 tabulates or graphs the analysis results and outputs the analysis results to the output unit 46. According to FIG. 11B, a bar graph showing the creation time and the usage time for each file is shown. In this example, the report file (report.xls) is used more time than the creation time, and the minutes file (minutes.xls) is used more time than the creation time. It is possible to visually grasp the small amount. In this way, the CPU 41 may create chart data in which the file usage status is charted based on the analysis result.

(File creation table creation process)
FIG. 7 is a flowchart showing an example of the file creation table creation process. In S701, the CPU 41 reads one operation history record from the memory 43, and in S702, determines whether or not there is a file operation. Specifically, it is determined that there is a file operation if the name of the file to be operated is recorded in the file name column (for example, 306, 405) of the operation history. If it is not recorded, it is judged that there is no file operation.

In S703, the CPU 41 determines whether or not the combination of the PC name (user name) and the file (path name / file name) of the read record is registered in the file creation table. FIG. 10A is a diagram showing an example of a file creation table.

When it is determined that the record is not registered in the file creation table (NO in S703), in S704, the CPU 41 registers the record in the file creation table and assigns an ID. If it is determined that the record is registered in the file creation table (YES in S703), in S705, the CPU 41 performs a process of counting up the creation time of the registered record. Record the calculated creation time in the file creation table.

In S706, the CPU 41 determines whether or not the analysis processing has been completed for all the records constituting the read operation history. If the analysis process is not completed, the process returns to S701 to analyze the next record. If the analysis process is completed, the process is terminated.

(File replication table creation process)
FIG. 8 is a flowchart showing an example of the file duplication table creation process. In S801, the CPU 41 reads one record in the file creation table, and in S802, determines whether or not a file duplication operation for the file (path name / file name) is in the operation history. To determine whether or not there is a file duplication operation, specifically, the operation name in which the target file is duplicated, such as copy / rename, is recorded in the operation name column (for example, 307, 406) of the operation history. If it is, it is determined that there is a file duplication operation, and if it is not recorded, it is determined that there is no file operation.

When it is determined that there is a file duplication operation (YES in S802), in S803, the CPU 41 assigns an ID associated with the ID of the record read in S801 and registers it in the file duplication table. FIG. 10B is a diagram showing an example of a file duplication table. For example, a copy of a file (path name: C \ book1.xls, file name: book1.xls) whose ID is "1" read from the file creation table is copied (path name: C \ copybook1.xls, file name: The record of the copy book1.xls) is registered in the file duplication table as the ID "1-1" as the ID associated with the ID "1".

In S804, it is determined whether or not the file duplication operation for the record file (path name / file name) registered in the file duplication table is in the operation history. When it is determined that there is a file duplication operation (YES in S804), an ID associated with the ID of the target record is assigned in S803, and the file is newly registered in the file duplication table. For example, a file (path name: C \ copybook.xls, file name: copybook1.xls) whose ID is "1-1" registered in the file duplication table is renamed (path name: C \ weekly report.xls). , File name: Weekly report.xls) is registered in the file duplication table as ID "1-2" as an ID associated with ID "1-1".

By such recursive processing, it is possible to comprehensively detect the file group spread on the tree for one record extracted from the file creation table and register it in the file replication table.

In S805, the CPU 41 determines whether or not the analysis processing has been completed for all the records. If the analysis process is not completed, the process returns to S801 to analyze the next record. If the analysis process is completed, the process is terminated.

(File diffusion table creation process)
FIG. 9 is a flowchart showing an example of the file diffusion table creation process. In S901, the CPU 41 reads one record of the file creation table and the file duplication table, and in S902, determines whether or not the file spreading operation for the file (path name / file name) is in the operation history.

Examples of the file spreading operation include sending an attached file by e-mail, uploading a file by a communication protocol such as FTP or HTTP, and uploading to a shared folder. For example, if the target file is recorded in the attached file name column (for example, 405) of the operation history, it is determined that there is a file spreading operation, and if it is not recorded, it is determined that there is no file spreading operation.

When it is determined that there is a file spreading operation (YES in S902), in S903, the CPU 41 assigns an ID associated with the ID of the record read in S901, and gives a file spreading table together with the spreading destination (for example, a mail destination). Register with. FIG. 10C is a diagram showing an example of a file diffusion table. For example, a record in which a file (path name: C \ book1.xls, file name: book1.xls) with an ID of "1" read from the file creation table is sent by e-mail to "PC10" by "PC1" is In the file spreading table, the ID "1-0-1" is registered as the ID associated with the ID "1", and the mail destination "PC10" which is the spreading destination is registered.

In S904, the CPU 41 calculates the usage time of the target file at each diffusion destination. Specifically, if the spreading destination of the operation target and the name of the file are recorded in the PC name column (for example, 301, 401) and the file name column (for example, 306, 405) of the operation history, the file Judge that there is a usage operation. Then, a process of counting up the used time is performed, and the calculated time is recorded in the file diffusion table.

In S905, the CPU 41 determines whether or not the analysis processing has been completed for all the records. If the analysis process is not completed, the process returns to S901 in order to analyze the next record. If the analysis process is completed, the process is terminated.

The usage time for a file can be calculated based on the file spread table. For example, the usage time of the file (path name: C \ book1.xls, file name: book1.xls) having the ID "1" in FIG. 10A is the IDs "1-0-1" to "1-2" in FIG. 10C. The total time (356 seconds) of "-1" may be calculated. That is, by managing the file creation table, the file duplication table, and the file diffusion table with the associated ID, the usage time of the file group spread on the tree is comprehensively applied to one record extracted from the file creation table. Can be calculated.

As described above, according to the present embodiment, the file creation time and the usage time can be calculated, and the user can grasp the usage status of the file. By grasping the utilization status of a file, for example, it is possible to grasp whether or not the time taken to create a certain file was appropriate, and it is possible to realize the efficiency of business.

It is also possible to perform a more detailed analysis of the analysis results. FIG. 11C is a diagram showing an output example of the analysis result. According to FIG. 11C, a bar graph showing the usage time of a specific file (for example, minutes.xls) for each user is shown. In this example, it is visually clear that "UserC" and "UserE" are used for the minutes file (minutes.xls), but "UserA", "UserB", and "UserD" are not used at all. You can see that you will grasp. That is, by displaying the usage time for each user for a specific file, the employee manager (boss, manager, etc.) or the creator of the file spreads the file to which user (for example, mail). It will be easier to understand whether it is better to send the attached file in. For example, the load on the mail server can be reduced by stopping the sending of attached files by e-mail to users who are rarely used. In addition, for users who use less, it is possible to reduce the reception of unnecessary attached file mails, and it is possible to improve the efficiency of business.

<Other embodiments>
The log management server 12 and the information analysis device 13 described above may be realized on the same server, or may be executed on different servers. In the former case, there is an advantage that the log management server 12 and the information analyzer 13 do not need to perform data communication through the network 50. In this case, the information analysis device 13 includes a log management DB 15, an analysis unit 18, and an analysis result DB 19. By realizing the log management server 12 and the information analysis device 13 on the same server in this way, it is possible to manage the operation history and the analysis result within the same company. Therefore, analysis that takes security into consideration becomes possible.

Claims (9)

An input means for inputting a user's operation history in each terminal device of a plurality of terminal devices,
A calculation means for calculating the creation time for creating a file and the usage time for using the file from the operation history input by the input means.
An analysis means for analyzing the utilization status of the file based on the creation time and the usage time calculated by the calculation means.
An information analyzer comprising an output means for outputting an analysis result by the analysis means. In addition
The first determination means for determining whether or not there is a file operation in the operation history,
The information analysis apparatus according to claim 1, further comprising a first recording means for recording a target file operation in a file creation table when it is determined by the determination means that there is a file operation. In addition
A second determination means for determining whether or not a file duplication operation for a file read from the file creation table is in the operation history,
When it is determined by the second determination means that there is a file duplication operation, the target file duplication operation is associated with the file read from the file creation table and recorded in the file duplication table with the second recording means. The information analyzer according to claim 2, further comprising: In addition
A third determining means for determining whether or not a file spreading operation for a file read from the file creation table and the file duplication table is in the operation history,
When it is determined by the above three determination means that there is a file spreading operation, the target file spreading operation is associated with the file read from the file creation table and the file duplication table and recorded in the file spreading table. The information analyzer according to claim 3, further comprising a recording means of the above. The information analysis apparatus according to claim 4, wherein the calculation means calculates the usage time from the file diffusion table associated with the file creation table. The calculation means calculates the file usage time for each user and calculates the file usage time.
The information analysis device according to claim 1 to 5, wherein the output means outputs the usage time of the file for each user for a specific file. An input process for inputting a user's operation history in each terminal device of a plurality of terminal devices,
A calculation process for calculating the creation time for creating a file and the usage time for using the file from the operation history input by the input process.
An analysis means for analyzing the utilization status of the file based on the creation time and the usage time calculated in the calculation process.
An information analysis method including an output means for outputting an analysis result by the analysis means. A program that causes a computer to function as each means of the information analyzer according to any one of claims 1 to 6. An information analysis system including an operation history management server that holds an operation history of a user in each terminal device of a plurality of terminal devices and an information analysis device that analyzes the operation history.
The information analyzer is
An input means for inputting the operation history of the user and
A calculation means for calculating the creation time for creating a file and the usage time for using the file from the operation history input by the input means.
An analysis means for analyzing the utilization status of the file based on the creation time and the usage time calculated by the calculation means.
An information analysis system including an output means for outputting an analysis result by the analysis means.

Images