JP5155909B2 - Operation monitoring system and operation monitoring program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an operation monitoring system for determining the possibility that any unauthorized operation is performed for each user from the operation history of a computer terminal. <P>SOLUTION: Allowable operation range information showing a standard operation in a terminal is generated by using operation log information showing the history of the operation of the terminal. Then operating situation information showing an operation in the specific period is generated. Then, whether the operating situation information is in the allowable operation range is determined, so that the possibility of the unauthorized operation is determined. Then, control corresponding to the possibility of the unauthorized operation is executed. <P>COPYRIGHT: (C)2010,JPO&amp;INPIT

Description

  The present invention relates to a technique for monitoring a user operation on a computer terminal. In particular, the present invention relates to a technique for monitoring whether an operation different from a normal operation is being performed.

  In many companies, confidential information used for business is managed by a computer system. Corporate employees use computer terminals to access and use confidential information when performing business. Since this confidential information is extremely important for companies, various measures are taken for access to confidential information from a computer terminal so that no information leakage occurs.

  There are a variety of reasons why confidential information leaks occur in companies. For example, there are information leakage that occurs due to unauthorized intrusion from an external network to a corporate network, and information leakage that occurs due to operation of a computer terminal within the enterprise. Especially in cases where information leakage occurs due to the operation of computer terminals in the company, there are various possible operations for computer terminals that may cause information leakage, so it is not possible to devise countermeasures focusing on one operation. For this reason, it is extremely difficult to take countermeasures and is a serious problem. For example, when an operation is performed by unauthorized software such as spyware, virus software, or file sharing software instead of an authorized user operation, or a malicious user illegally uses a computer terminal to access confidential information. The case where the operation to perform is performed is considered. Such operations related to information leakage are often performed by operations different from daily operations.

  In order to prevent leakage of confidential information caused by such an unauthorized operation of a computer terminal in a company, a system or apparatus for monitoring the operation of the computer terminal has been considered. For example, as disclosed in Patent Document 1, a technique for determining whether or not there is a divergence from a normal operation is disclosed by storing policy information on the operation for software and comparing the policy information with the operation of the monitored software. ing.

  In Patent Document 2, a frequent operation pattern is extracted using an operation history of the device, and the frequent operation pattern is compared with a subsequent operation to determine whether the operation is normal. Can do.

JP 2006-53788 A JP-A-2005-259160

In the above-mentioned Patent Document 1, it is necessary to generate an operation model using an environment in which policy information is set in advance and an environment in which normal operation is guaranteed in order to determine that the operation is normal. It has become. Furthermore, when the operation method differs for each user of the computer terminal, it cannot be accurately monitored. In addition, after the access rule to the system resource is determined, even if the operation is changed, it cannot be detected when the access is permitted.

Similarly, since the above-described Patent Document 2 is regarded as normal as long as it matches the frequent operation pattern, it can cope with a pattern change of an operation performed in the past, but detects a change related to other operations. I can't do anything.

It is an object of the present invention to solve the above-described problems of the prior art and to determine whether a user has performed an unauthorized operation from a change in operation on a computer terminal. Specifically, a technique is provided for generating an allowable operation range using the operation history of the computer terminal, and further determining whether the operation of the computer terminal performed by the user is an unauthorized operation using the generated operation range. The task is to do.

The present invention provides an operation log information storage unit that stores operation log information indicating a history of operation of the terminal, and an allowable operation range that indicates a standard operation in the terminal based on the operation log information of the operation log information storage unit. An operation range information that generates information, and operation log information for a specific period of the terminal is extracted from the operation log information storage unit, and operation status information that indicates the operation status of the terminal is generated according to the extracted operation log information An operation status generation unit that performs an illegal operation determination unit that determines the possibility of an unauthorized operation based on the allowable operation range information and the operation status information ,
The unauthorized operation determination unit integrates the degree of possibility of unauthorized operation and stores it in the determination point storage unit together with information indicating the determination timing as a determination point, based on information stored in the determination point storage unit A generation tendency calculating means for counting determination points for each unit time and calculating an occurrence tendency of an unauthorized operation; and a means for determining a possibility of an unauthorized operation according to the calculated occurrence tendency. it is an operation monitoring system that.

By configuring as in the present invention, it is possible to generate an allowable operation range from the operation performed on the terminal, and to determine the possibility of an illegal operation for an operation outside the allowable operation range. become able to. As a result, it is possible to determine the unauthorized operation in accordance with the daily operation of the terminal.

The allowable operation range information is information indicating an allowable range as a standard operation of the terminal.

The operation status information is information indicating the operation of the terminal within a specific period.

  The operation status generating unit in the operation monitoring system of the present invention is a predetermined based on the operation date and time of the operation log information indicating a specific operation among the operation log information of the specific period stored in the operation log information storage unit. It can also be configured as an operation monitoring system that generates operation status information indicating an operation status in a period.

By configuring the present invention as described above, an operation related to a specific operation (such as a high-risk operation) can be determined. Therefore, the possibility of an unauthorized operation related to the specific operation is possible. Can be determined.

The above-described invention can also be realized by reading and executing the program of the present invention on a computer terminal. That is, an operation monitoring program for an operation monitoring system including an operation log information storage unit that stores operation log information indicating a history of operation of the terminal, the terminal based on the operation log information of the operation log information storage unit An allowable operation range generation function for generating an allowable operation range information indicating a standard operation in the operation, and extracting operation log information for a specific period of the terminal from the operation log information storage unit, and the terminal according to the extracted operation log information comprising of an operation status generating function for generating an operation state information indicating the operation status, on the basis of the allowable operating range information and the said operation status information, and a tamper determination function of determining the possibility of unauthorized operation,
The unauthorized operation determination function is based on means for accumulating the degree of possibility of unauthorized operation and storing in the determination point storage unit together with information indicating the determination timing as a determination point, and information stored in the determination point storage unit An operation for causing a computer to generate an occurrence tendency calculation unit for calculating determination tendency of fraudulent operation and a means for determining possibility of fraudulent operation according to the calculated occurrence tendency. You may comprise as a monitoring program.

This operation monitoring program also has the same effects as the above-described operation monitoring program, and can also have the various feature configurations described above.

According to the present invention configured as described above, an allowable operation range is generated from the operation history of the terminal, and it is determined whether or not the operation of the terminal is within the allowable range. And the change of operation with respect to a terminal can be grasped | ascertained, the possibility that unauthorized operation is performed can be determined, and the effect which reduces information leakage can be acquired.

The figure which shows typically the concept of the system configuration | structure of this invention. The figure which shows typically the concept of the hardware constitutions of this invention. The figure which shows typically the functional block of the system of this invention. The flowchart which shows the processing process of this invention typically. The figure which shows an example of operation log information typically. The figure which shows typically the result (for allowable operation range information) which totaled operation log information. The figure which shows a tolerance | permissible_range setting value memory | storage part typically. The figure which shows a tolerance | permissible_range setting value memory | storage part typically. The figure which shows permissible operation range information typically. The figure which shows typically the result (for operation condition information) which totaled operation log information. The figure which shows typically the result of unauthorized operation determination, and the control content. The figure which shows the display of a display apparatus typically. The figure which shows typically the result (for allowable operation range information) which totaled operation log information. The figure which shows an example of operation log information typically. The figure which shows environmental information typically. The figure which shows typically the relationship between environmental information and a risk point. The figure which shows typically the result of having totaled the operation point. The figure which shows typically the relationship between reference | standard operation log information and a related operation acquisition period. The figure which shows typically the conditions of reference | standard operation log information, and the content of a related operation acquisition period. The figure which shows operation content and a point typically. The figure which shows typically the report display for every department of a display apparatus. The figure which shows typically the report display for every terminal of a display apparatus.

Example 1 Configuration
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows an overall configuration diagram of the operation monitoring system of the present invention. In the present invention, as shown in FIG. 1, a management server A is connected to a plurality of client terminals B (hereinafter referred to as “terminal B”) via a communication network N (hereinafter referred to as “network N”). It is composed of shapes.

  Network N is a CSMA / CD (Carrier Sense Multiple Access with Collision Detection) system with a cable that physically transmits information in a limited facility such as a company or school, and a relay device such as a LAN switch or hub. Although it is configured as an Ethernet (trademark) type LAN, the network N is constructed by an intranet using Internet technology in addition to the Ethernet type LAN, or a WAN (Wide Area Network). It may be constructed by the technology.

  FIG. 2 schematically shows an example of the hardware configuration of the management server A. The management server A includes an arithmetic device 1 such as a CPU that executes arithmetic processing of a program, a storage device 2 such as a RAM and a hard disk for storing information, processing results of the arithmetic device 1 and information stored in the storage device 2 on the Internet. And a communication device 5 that transmits and receives via a network such as a LAN, a display device 3 such as a display (operation screen), and an input device 4 such as a keyboard, a mouse, and a numeric keypad. Each function (each unit) realized on the terminal is executed when a unit (program, module, or the like) that executes the process is read into the arithmetic unit 1. When using the information stored in the storage device 2 in the processing, each function reads the corresponding information from the storage device 2 and uses the read information in the processing in the arithmetic device 1 as appropriate. Further, the management server A may have its functions distributed to a plurality of terminals.

  The hardware configuration of the terminal B is almost the same as that of the management server A. As shown in FIG. 2, the terminal B includes the arithmetic device 1, the storage device 2, the display device 3, the input device 4, and the communication device 5. Yes.

  FIG. 3 shows a functional block diagram of the management server A and terminal B constituting the file management system of the present invention. Each component and each means in the present invention are logically distinguished from each other in function, and may be physically or practically the same area.

  Inside the management server A, a network I / F 10 for transmitting and receiving various information to and from the terminal B via the network N, and operation log information acquisition for acquiring operation log information indicating operation / control performed by the terminal B Unit 11, an operation log information storage unit 12 that stores the acquired operation log information of terminal B, and an allowable operation range generation unit 13 that generates allowable operation range information indicating a standard operation allowable range of terminal B from the operation log information. An operation status generation unit 14 that generates operation status information indicating the operation status of the terminal B in a specific period, an unauthorized operation determination unit 15 that determines the possibility of an unauthorized operation based on the allowable operation range information and the operation status information, A control unit 16 that performs various controls based on the results is provided.

  In the terminal B, the network I / F 20 for transmitting / receiving various information to / from the management server A via the network N, the terminal control unit 21 for executing various operations / controls in the terminal B, and the terminal B are executed. An operation log information generation unit 22 that generates operation log information indicating an operation / control history, an operation log information transmission unit 23 that transmits the generated operation log information to the management server A, and receives various control instructions for the terminal B. A terminal instruction receiving unit 24 is provided.

  Normally, each component in the management server A and terminal B executes the processing by reading the hardware (program, module, etc.) that executes the processing into hardware. It may be configured by a combination of the above, or may be configured only by hardware combining logic and the like.

  The operation of each component will be described below based on the functional block diagram constituting the present invention shown in FIG.

  The terminal control unit 21 operates and controls various hardware and software in the terminal B. In this embodiment, the operation / control of the terminal refers to all operations executed by an application, OS, middleware, firmware, and the like.

  The operation log information generation unit 22 generates operation log information (described later) indicating the history of operation / control performed in the terminal B. The operation log information is generated based on the control performed by the terminal control unit 21.

  The operation log information transmission unit 23 transmits the operation log information generated by the operation log information generation unit 22 to the management server A. That is, the operation log information is transmitted to the management server A via the network I / F 20. Usually, the operation log information transmission unit 23 transmits operation log information generated every time operation or control is executed in the terminal control unit 21 to the management server A. Further, the operation log information may be transmitted to the management server at a predetermined timing or at a constant cycle, not limited to the above-described method, and the generation of the operation log information and the transmission to the management server A are not performed at the same timing. Also good.

  The operation log information is information indicating a history of operations / controls performed in the terminal B according to notifications / requests generated by user operations using the input device 4 and instructions from applications and the like. Specifically, it includes information including terminal identification information, user identification information, operation date / time, operation content, operation target information, additional information, and the like. The information included in the operation log information is an example and is not limited, and only a part of the information may be used as long as the object of the present invention is achieved. An example of operation log information is schematically shown in FIG.

  In the present embodiment, the operation date and time includes the date and time when the operation / control was executed. However, the operation date and time when the operation log information was generated or the date and time when the operation log information was transmitted to the management server A may be used. Further, the date and time may be converted into a numerical value.

  The above-described operation contents are contents executed in the terminal B, and are contents of operation / control of software or hardware executed in the middleware or OS. More specifically, key input, pointing device operation (button press, movement, etc.), external storage medium attachment / detachment (detection / deletion or connection / disconnection, etc.), connection with external output device (printer, etc.), file operation, etc. (Create, delete, duplicate, move, rename file, read file, write file, etc.), folder operations (create, delete, duplicate, move, rename folder, etc.), send / receive email, application operations (start, end, etc.) ), Add / delete / detect drive, connect / disconnect network, change IP address, change computer name, write storage media, print, create media (create CD-R, DVD-R, etc.), copy to clipboard , Web page access, file download, file upload, terminal activation / terminal termination, etc. . In addition, these are examples and are not limited.

  The above-described operation target information refers to a target to be executed according to the operation content. In this embodiment, the identification information (application identification information) of the application operated or controlled by the terminal B, the identification information of the file (file identification information), the folder information, the Web page address, and the mail address (transmission destination, transmission source) And network identification information (information that uniquely identifies the network such as a network domain name). Any information other than the above examples may be used as long as the purpose is achieved.

  The above-described application identification information refers to information that can uniquely identify an application. The above-described file identification information refers to information that can uniquely identify a file. The above folder information refers to information that can uniquely identify a folder. The above-described Web page address is generally a URL (abbreviation of Uniform Resource Locator), and refers to information indicating a location such as an information resource, a document, or an image on a network.

  The additional information mentioned above refers to information that is additionally acquired according to the operation content / operation target information, and the content of the information acquired as additional information varies depending on the operation content. More specifically, there are data amount, number of printed pages, file capacity, number of files, and the like. For example, if the operation content is a file download, it is the amount of data downloaded. In addition, these are examples and are not limited.

  The control instruction receiving unit 24 receives the control instruction determined by the control unit 16 of the management server A via the network I / F 20. The received control instruction is notified to the terminal control unit 21.

  The operation log information acquisition unit 11 acquires operation log information sent from the terminal B via the network I / F 10.

  The operation log information storage unit 12 stores the operation log information acquired by the operation log information acquisition unit 11. Operation log information may be stored for each terminal identification information or each user identification information. Furthermore, the operation log information may be stored and managed using a database or the like.

  The allowable operation range generation unit 13 generates allowable operation range information indicating a standard operation range of the terminal B from the operation log information stored in the operation log information storage unit 12. Then, the generated allowable operation range information is notified to the unauthorized operation determination unit 15. The generated result is preferably stored in an allowable operation range information storage unit (not shown) so that it can be read out and used at appropriate times.

The allowable operation range information described above refers to information including a value (allowable range value) obtained by quantifying the standard operation range of the terminal B based on the operation log information. This standard operation refers to an operation that becomes a daily example of a terminal user. The allowable operation range information includes terminal identification information, an allowable range value, and the like. The allowable range value includes operation details, operation target information, average number of executions of additional information, average execution time, average execution cycle, and the like. Specific examples of the allowable operation range information include a range of the number of times that an arbitrary operation indicated by the operation log information has been executed, a range of time of execution, a range of time intervals of execution, and the like. The range here includes at least a value indicating the maximum value or the minimum value.

A method for generating the above-described allowable operation range information will be described in detail. The allowable operation range generation unit 13 extracts operation log information of a specific terminal B from the operation log information storage unit 12, calculates an operation reference value (operation reference value) of the operation at the terminal B, And an allowable range value generating means for calculating an allowable range value indicating an allowable range of operation based on the reference value and using the allowable range value as allowable operating range information.

The above-mentioned operation reference value calculation means first extracts operation log information within a predetermined period for determining a standard operation output from the specific terminal B from the operation log information storage unit 12. The predetermined period for determining the standard operation may be an arbitrary period during which the user determines that the standard operation of the terminal B can be determined, or has a predetermined fixed value. May be. Alternatively, it may be a period in which all the operation log information of the terminal B stored in the operation log information storage unit 12 can be extracted. Further, in addition to the method of setting a predetermined period, two specific operation log information are determined in advance, and a period between the two operation log information is set as a predetermined period for extracting operation log information. A method is also conceivable.

Next, the operation reference calculation means calculates an operation reference value according to the extracted operation log information. As the operation reference value to be calculated, (1) an average value of execution times of arbitrary operations in a unit time (average execution time), (2) an average value of execution times of arbitrary operations (average execution time), (3 ) There is an average value of the time interval of execution of an arbitrary operation (average execution cycle). Each will be described below.

[Operation standard value 1 (Average number of executions)]
The average number of executions refers to an operation reference value obtained by calculating an average value of the number of executions executed per unit time for the same operation content using the extracted operation log information. For example, assume that the number of executions per day is calculated for the same operation content as shown in FIG. In the case of the operation content “duplicate”, the number of executions of each day from the first day to the tenth day is “5”, “4”, “4”, “5”, “6”, “7”, “6” ”,“ 4 ”,“ 5 ”,“ 4 ”. Then, an average execution count “5” for one day is calculated from the acquired execution count for 10 days.

[Operation standard value 2 (Average execution time)]
The average execution time is an operation reference value obtained by calculating an average value of execution times from the operation date and time when the operation content is executed for the same operation content using the extracted operation log information. For example, as shown in FIG. 6B, the execution time (“hour: minute”) of the operation contents “terminal activation” from the first day to the tenth day is set to “8:59”, “8:55”. ”,“ 9:06 ”,“ 8:56 ”,“ 9:02 ”,“ 9:04 ”,“ 8:58 ”,“ 9:01 ”,“ 9:05 ”,“ 9:05 ” Suppose you have acquired. Then, the average execution time “9:01” is calculated from the acquired execution time of 10 days.

[Operation standard value 3 (average execution cycle)]
The average execution cycle is an operation reference value obtained by calculating an average of time intervals in which the same operation content is executed using the extracted operation log information. In the present embodiment, the execution cycle of the operation content is calculated based on the number of executions executed during the operation time of the terminal, and the average value of the execution cycles is calculated. For example, as shown in FIGS. 6A and 6B, the execution cycle is calculated from the number of executions of the same operation content when the unit time is the operation time of the terminal B (time from start to end). In other words, the 10-day execution cycle (“hour: minute”) from the first day to the tenth day is “1:35”, “2:01”, “1:54”, “1:36”, “ 1:19 "," 1:08 "," 1:23 "," 1:59 "," 1:36 "," 2:00 ". Then, an average execution period “1:39” is calculated from the acquired execution period.

Although the calculation content of the operation reference value has been described above, the present invention is not limited to this, and any method and information may be used as long as the object of the present invention is achieved. In addition, in the calculation of the same operation content described above, a specific operation may be determined in advance, and the operation log information including the operation content may be calculated.

Subsequently, the calculated operation reference value is notified to the allowable range value generating means.

The allowable range value generation means generates an allowable range value using the acquired operation reference value. The generated allowable range value is notified to the unauthorized operation determination unit 16 as allowable operation range information.

As a method for generating an allowable range value, (1) a method for obtaining a fixed allowable range value from the operation reference value, (2) a method for calculating the allowable range value from the operation reference value, and (3) an allowable value based on a ratio to the operation reference value. There are methods for calculating the range value. Each will be described in detail below.

[Allowable range value calculation method 1]
The method of acquiring a fixed allowable range value from the operation reference value is that the allowable range value related to the operation reference value is stored in advance in an allowable range set value storage unit (not shown), and the allowable range according to the acquired operation reference value A method of obtaining a range value. For example, when FIG. 7A is stored in the allowable range setting value storage unit, if the operation reference value is the average execution count “5” in the operation content, the allowable range value is the maximum value “15”, the minimum value The value “0” is acquired.

[Allowable range value calculation method 2]
The method for calculating the allowable range value from the operation reference value is to store the range addition value and the range subtraction value for the operation reference value in the allowable range set value storage unit in advance and add the range addition value to the acquired operation reference value. This is a method of calculating the value obtained by performing the subtraction of the range subtraction value as the minimum value of the allowable range value. For example, when FIG. 8B is stored in the allowable range setting value storage unit, the operation reference value is the average execution time (“hour: minute”) “9:01” in the operation content “terminal activation”. As the allowable range value, the maximum value “9:11” and the minimum value “8:51” are acquired.

[Allowable range calculation method 3]
The method for calculating the allowable range value from the ratio to the operation reference value refers to a method of acquiring the allowable range value by multiplying the acquired operation reference value by the allowable ratio using the allowable ratio in advance. The allowable ratio is a ratio indicating the maximum value / minimum value within the allowable range with respect to the operation reference value. For example, when an allowable ratio in which 60% to 120% is an allowable range with respect to the operation reference value is defined in advance, if the operation reference value is the average execution count “5” in the operation content, the allowable range value is The maximum value “6” and the minimum value “3” are acquired.

The allowable range value calculated as described above is notified to the unauthorized operation determination unit 15 as allowable operation range information. Moreover, it is good to memorize | store in a permissible operation range information storage part (not shown) with a notification.

In addition, although the example with respect to average execution frequency and average execution time was demonstrated above, it is not restricted to this, For example, an average execution period, an average end time, an average operation time etc. can also be used.

Further, two or more allowable operation range information may be calculated and notified to the unauthorized operation determination unit 15.

The operation status generation unit 14 extracts the operation log information of the terminal B in a specific period in the operation log information storage unit 12, and generates operation status information indicating the operation status of the terminal B from the extracted operation log information. Then, the generated operation status information is notified to the unauthorized operation determination unit 15.

The above-described operation status information is information including a value (operation status value) obtained by quantifying the operation of the terminal B based on the operation log information within a specific period. The operation status information includes terminal identification information, an operation status value, and the like. The operation status value includes operation details, operation target information, number of executions of additional information, execution time, execution cycle, and the like.

The above-mentioned specific period is a period necessary for determining the operation tendency and situation of the terminal B. Specifically, a period such as one day or one hour is set. Further, a period such as business hours (for example, 8 hours from 9:00 to 17:00) and holidays (for example, Saturday and Sunday) may be used in a company or the like. Usually, the specific period is shorter than the period for generating the allowable operation range information. Further, the specific period is preferably a period that is not included in the period for generating the allowable operation range information, but may include the specific period.

The operation status value generated by the operation status generation unit 14 includes (1) the number of executions of a specific period, (2) the execution time of the specific period, and (3) the execution cycle of the specific period.

[Operation status value 1 (number of executions)]
The number of executions in a specific period is generated as an operation status value by calculating the number of times the same operation content was executed per unit time within the specific period using the extracted operation log information. As an example, when operation log information for one day on the 11th day is extracted as shown in FIG. 10A, an operation status value (number of executions) “10” of the operation content “duplicate” is generated.

[Operation status value 2 (execution time)]
The effective time of the specific period is generated as an operation status value by extracting the operation date and time when a predetermined operation content was executed within the specific period using the extracted operation log information. As an example, when operation log information for one day on the 11th day is extracted as shown in FIG. 10B, an operation status value (execution time) “10:30” of the operation content “terminal activation” is generated. . In addition, when operation log information including predetermined operation contents is extracted within a specific period, the average execution time may be used.

[Operation status value 3 (execution cycle)]
The execution cycle of the specific period is generated as the operation status value by calculating the execution cycle from the number of times the same operation content is executed per unit time within the specific period using the extracted operation log information. As an example, when operation log information for one day on the 11th day is extracted as shown in FIG. 10A, an operation status value (execution cycle) “00:39” of the operation content “duplicate” is generated.

In the present embodiment, the specific period and the unit time are described as being equal. However, the specific period may be different from the unit time. The operation status generation unit 16 calculates the operation status value by converting it per unit time.

The operation status value generated as described above is notified to the unauthorized operation determination unit 15 as operation status information. Further, the two or more pieces of generated operation status information may be notified to the unauthorized operation determination unit 15.

The unauthorized operation determination unit 15 acquires the allowable operation range information generated by the allowable operation range generation unit 13 and acquires the operation status information from the operation status generation unit 14. Then, using the acquired allowable operation range information and the operation status information, whether or not the operation status information is within the allowable operation range is compared to determine the possibility of an unauthorized operation. Then, the control unit 16 is notified of the determination result.

Specifically, the above-described processing is performed by extracting the maximum value and the minimum value of the allowable range value from the acquired allowable operation range information, and comparing whether the acquired operation status value is within the range. If the result of the comparison is within the range, the determination result is “no problem”, and if the result is out of the range, the determination result is “unauthorized operation”.

Further, the unauthorized operation determination unit 15 may determine the possibility of an unauthorized operation based on a comparison result of one information, or may perform based on a plurality of information. That is, the determination may be made based on only one of the number of executions, the execution cycle, the execution time, etc., or may be determined in combination.

For example, when making a determination with multiple pieces of information, it is compared whether each information is “in range” or “out of range”, and the number of “in range” information and the number of information “out of range” are used. judge. As a determination method, the determination result is “no problem” when the number of “in-range” information is larger than a predetermined value, and the determination result is “no problem” when the number of “out-of-range” information is less than a predetermined number The ratio of “within range” and “out of range” is calculated, and the determination result is set to “no problem” when “within range” is equal to or greater than a predetermined ratio. Moreover, you may make it notify the control part 16 of each information number or ratio as a determination result.

Moreover, you may make it acquire permissible operation range information from a permissible operation range information storage part (not shown). As a result, the allowable operation range information generated in advance by the allowable operation range generation unit 13 can be utilized, so that the processing can be reduced.

The control unit 16 acquires a determination result from the unauthorized operation determination unit 15 and determines the content of control according to the determination result. The determined control content is transmitted to terminal B as a control instruction. Specifically, the network I / F 10 indicates information for instructing the terminal B to display information indicating that the unauthorized operation has been performed on the display device 3 of the terminal B, or to restrict the operation of the terminal B. To send through.

Also, not a control instruction for the terminal B, but a notification to the administrator terminal (predetermined terminal B) is displayed on the display device of the management server A, and a determination result is stored in an operation determination result storage unit (not shown). Control such as display on a management terminal or printing in a report format may be executed.

Example 1 Treatment Process
Next, an example of the processing process of the operation monitoring system of the present invention will be described with reference to the functional block diagram of FIG. 3, the flowchart of FIG. In the following description, it is assumed that the determination target terminal B “ABC12345” is connected to the management server A via the network N, and the operation count “duplication” and the execution cycle are used for the operation determination.

The operation log information transmission unit 23 of the terminal B transmits operation log information indicating an operation executed on the terminal generated by the operation log information generation unit 22 to the management server A.

The management server A acquires the operation log information of the terminal B by the operation log information acquisition unit 11 and stores it in the operation log information storage unit 12 (S101).

  The allowable operation range generation unit 13 extracts the operation log information of the terminal B that is the determination target from the operation log information storage unit 12, and uses the operation log information to allow an allowable operation that is a standard operation of the terminal B that is the determination target. Generate range information. Then, the generated allowable operation range information is notified to the unauthorized operation determination unit 15 (S102).

  The above operation will be specifically described using a case where the period for determining a standard operation from the operation log information storage unit 12 is 10 days.

  The allowable operation range generation unit 13 extracts operation log information for 10 days of the terminal “ABC12345” from the operation log information. Then, using the extracted operation log information, an allowable operation range value related to the number of executions and the execution cycle for each day is calculated.

  First, calculation of the allowable operation range value related to the number of executions per day will be described. From the extracted operation log information, the number of times of operation log information indicating the operation content “duplicate” was executed every day is counted. As a result of the counting, the number of times the operation content “Duplicate” is executed every day from the first day to the tenth day is “5”, “4”, “4”, “5”, “6”, “7”, “6”, “4”, “5”, “4” (see FIG. 6A). Therefore, five times are calculated as the average number of executions (operation reference value) executed per day. Then, the allowable range value is calculated using a method of acquiring a fixed allowable range value from the operation reference value (allowable range value calculation method 2) (see FIG. 8A). Specifically, since the calculated average execution count is 5 and the execution count of FIG. 8A is in the range of 0 to 10, the range subtraction value “0” and the range addition value “2” are determined. When the allowable range value is calculated using the average number of executions and the range subtraction value / range addition value, the maximum value is “7” and the minimum value is “5” (see FIG. 9A).

  Next, calculation of the allowable operation range value related to the execution cycle will be described. Using the extracted operation log information, the operation time (time during which the terminal “ABC12345” is activated) is calculated for each day. The terminal operation time per day (“hour: minute”) is “7:56”, “8:07”, “7:39”, “8:03”, “7:58”, “7:56” “8:18”, “7:57”, “8:00”, and “8:00” (see FIG. 6B). When a value (execution cycle) obtained by dividing the extracted daily operation time by the number of executions per day counted above is calculated, “1:35”, “2:01”, “1:54”, “1:36” , “1:19”, “1:08”, “1:23”, “1:59”, “1:36”, “2:00” (see FIG. 6A). From this result, “1:39” is calculated as the average execution cycle (operation reference value). Then, the allowable range value is calculated using a method of acquiring a fixed allowable range value from the operation reference value (allowable range value calculating method 2) (see FIG. 8C). Specifically, since the average execution cycle is “1:39”, the execution cycle in FIG. 8C falls within the range of 1:00 to 2:00, and the range subtraction value “0:20” and the range addition value “0”. : 20 ”is determined, and when the allowable range value is calculated using the average execution period and the range subtraction value / range addition value, the maximum value is“ 1:59 ”and the minimum value is“ 1:19 ”(FIG. 9A )reference).

  The allowable operation values of the average execution count and the average execution cycle calculated as described above are set in the allowable operation range information, and the allowable operation range information is notified to the unauthorized operation determination unit 15.

  The operation status generation unit 13 extracts the operation log information of the terminal B to be determined in the specific period from the operation log information storage unit 12, and uses the operation log information to indicate the operation status of the terminal B to be determined Is generated. Then, the generated operation status information is notified to the unauthorized operation determination unit 15 (S103).

  The above operation will be specifically described using a case where the specific period is one day of the eleventh day.

  The operation status generation unit 13 extracts the operation log information on the 11th day of the terminal “ABC12345” from the operation log information. Then, using the extracted operation log information, the number of executions and the execution cycle regarding the operation content “duplication” on the 11th day are calculated. The calculation is performed in the same manner as the allowable operation range information generation unit 12. Accordingly, the calculated operation status value is the number of executions “10” and the execution cycle “0:39” (see FIG. 10A). Then, the calculated operation status value is notified to the unauthorized operation determination unit 15 as operation status information.

  The unauthorized operation determination unit 15 compares the operation status information with the allowable operation range information, and determines the possibility of an unauthorized operation depending on whether the operation status is within the allowable operation range (S104).

  The above operation will be specifically described. The unauthorized operation determination unit 15 acquires the number of executions “10” and the execution cycle “0:39” as the operation status information, and sets the maximum number of executions “7” and the minimum value “5” as the allowable operation range information. The maximum value “1:59” and the minimum value “1:19” of the execution cycle are acquired. Then, the comparison is performed for each of the number of executions and the execution cycle.

  The unauthorized operation determination unit 15 compares whether the number of executions of the operation status information is included in the range of the number of executions of the allowable operation range information. The result of the comparison is “out of range”. Next, it is compared whether the execution cycle of the operation status information is included in the execution cycle of the allowable operation range information. The result of the comparison is “out of range”.

  Subsequently, the unauthorized operation determination unit 15 calculates a ratio in which the comparison result is “out of range”. In this example, the ratio that the comparison result is “out of range” is 100%. Therefore, the determination result of the possibility of unauthorized operation is 100%, and this determination result is notified to the control unit 16.

  The control unit 16 performs control based on the determination result of the unauthorized operation determination unit 15 (S105).

  The control unit 16 acquires a ratio indicating the possibility of an unauthorized operation as a determination result, and executes control content determined from the determination result and a preset threshold value (see FIG. 11A). ). Further, the control is executed and the determination result is stored in an operation determination storage unit (not shown).

  Specifically, since the control unit 16 acquires 100% as the determination result from the unauthorized operation determination unit 15, the control content corresponding to the determination result notifies the terminal “ABC12345” of a control instruction for operation restriction (operation prohibition). Then, control such as displaying on the display device 3 on the management server A as a notification to the administrator is executed.

  When receiving the operation restriction (operation prohibition) from the management server A, the control instruction receiving unit 24 of the terminal “ABC12345” prohibits an input operation from the keyboard or pointing device of the input device connected to the terminal “ABC12345”. To the terminal control unit 21. And the terminal control part 21 prohibits input operation from an input device.

  Further, the control unit 16 displays a notification screen on the display device 3 on the management server A (see FIG. 12). The administrator who has confirmed the screen displayed on the display device 3 of the management server A can execute a desired process according to the content of the display screen. In this embodiment, it is possible to select power OFF of the terminal “ABC12345”, release of the operation restriction, display of a warning screen, and the like, and to transmit control corresponding to each to the terminal “ABC12345” as a control instruction.

  By configuring as in the present embodiment, even if the operation performed for each terminal B is different, it is possible to achieve high accuracy by changing the allowable operation range according to the operation for each terminal B. Thus, an operation monitoring system capable of determining the possibility of unauthorized operation can be realized. For example, in the terminal B in which only a routine operation is performed, the allowable operation range is narrowed, and in the other terminal B, the allowable operation range is widened. Is possible.

  Furthermore, in the present embodiment, the operation content is used in the generation of the allowable operation range information and the operation status information. However, the present invention is not limited to this, and the operation target and additional information of the operation log information may be used. For example, when the operation target is used, the determination can be made by using the browsing / browsing time of the website, the access / access time of the shared folder, the execution / execution time of the application (FIG. 6C, FIG. 7). (See (c), FIG. 8 (c), FIG. 9 (c), FIG. 10 (c)). Further, for example, when additional information is used, the determination can be made by using the data download amount, the number of printed pages, the number of files, the file size, and the like (FIGS. 6D, 7D, and 8). (See (d), FIG. 9 (d), and FIG. 10 (d)).

  Furthermore, in this embodiment, in the generation of the allowable operation range information and the operation status information, the operation log information that matches is determined using only the operation content, but not limited to this, the operation content and operation included in the operation log information are determined. A combination of target information and additional information may be used to extract and determine matching operation log information. Some examples of the matching operation log information are shown below. Operation log information including operation content “Duplicate” and operation target information “Destination folder is own terminal”, operation log information including operation content “Duplicate” and operation target information “Copy source folder is shared folder”, operation content “Replication” Operation log information including operation target information “external storage medium”, operation log information including operation content “mail transmission” and operation target information “destination mail address is other than a predetermined domain”, and the like. These are examples and are not limited, and may be in any combination.

  Furthermore, in this embodiment, the determination is made using only the operation content “duplicate”, but the processing may be performed by regarding a plurality of operation content as an operation that matches. That is, two or more operations may be grouped and the number of executions or the execution cycle of operations included in the operation group may be used. Further, it is naturally possible to perform grouping using not only the operation content but also operation target information and additional information.

  Furthermore, in the present embodiment, the description has been made using both the maximum value and the minimum value as the allowable operation range information. However, when either the maximum value or the minimum value is determined as a fixed value in advance, the allowable operation range information is described. Only the non-fixed value may be generated as the range information. That is, for example, when the execution count is used and the minimum value “0” is preset as a fixed value, only the maximum value may be generated and the minimum value may not be generated.

  Also, the determination result can be displayed or printed in a report format. For example, as shown in FIG. 21 and FIG. 22, the possibility of unauthorized operation of the terminal subject to determination can be displayed or printed in a visually understandable manner such as “◯”, “△”, and “×”. . Furthermore, as shown in FIG. 21, two or more terminals B are grouped in advance (for each department, etc.), and the control unit 16 automatically sums up the possibility of unauthorized operation of the terminals B in the group in a report format. It can also be displayed. In this case, terminal information in which terminal identification information and attribute information indicating affiliation and the like are associated in advance is stored in a terminal information storage unit (not shown).

  In this embodiment, a case will be described in which a standard deviation in a predetermined period for determining a standard operation of the terminal B is calculated, and allowable operation range information is generated using the standard deviation.

    Hereinafter, each component and the processing process will be described. Note that a description of the same configuration and operation as in the first embodiment will be omitted.

The allowable operation range generation unit 13 extracts operation log information of a specific terminal B from the operation log information storage unit 12, calculates a standard deviation and an average value of operations at the terminal B, and a standard deviation according to the standard deviation And an allowable range value generating means for calculating an allowable range value indicating an allowable range (maximum value / minimum value) of the operation and using the allowable range value as allowable operation range information.

  The standard deviation calculation means first extracts operation log information as in the first embodiment, and counts the total value for each unit time. Next, a standard deviation and an average value using the counted information as a population are calculated. For example, if the operation content in FIG. 13A is “duplicate”, the number of executions for 10 days from the first day to the tenth day is “5”, “4”, “4”, “5”, “ “6”, “7”, “6”, “4”, “5”, “4” are acquired. Therefore, the standard deviation “1.054 (rounded off to the fourth decimal place)” is calculated with the 10-day data as the population. Also, the average number of executions “5” for 10 days is calculated. Then, the calculated standard deviation and average are notified to the allowable range value generating means.

  The allowable range value generating means acquires the standard deviation and the average value from the standard deviation calculating means. Then, the maximum value is calculated from the predetermined upper limit deviation value, and the minimum value is calculated from the lower limit deviation value.

  For example, as described above, when the standard deviation “1.054” and the average number of executions “5” are acquired, the upper limit deviation value “70” and the lower limit deviation value “30” are set in advance. First, since the maximum value = {(upper limit deviation value−50) × standard deviation} ÷ 10 + average value is used as the maximum value calculation formula, the maximum value = 7 (rounded off after the decimal point). Similarly, since the minimum value = {(upper limit deviation value−50) × standard deviation} ÷ 10 + average value, the minimum value = 3 (rounded off after the decimal point). Therefore, the maximum value “7” and the minimum value “3” are generated as the allowable operation range information.

  By configuring as in the present embodiment, an operation monitoring system capable of performing an unauthorized operation determination according to a variation in operation is possible. That is, when the operation varies, the allowable range is set wide, and when the operation does not vary, the allowable range is set narrow.

  In the first embodiment, the operation reference value is generated when the allowable operation range information is generated, and the maximum value and the minimum value corresponding to the operation reference value are acquired from the allowable range setting value storage unit. In the present embodiment, a case will be described in which the maximum value and the minimum value in the period in which the operation log information of the terminal B is extracted are generated as the allowable operation range information using the values.

    Hereinafter, each component and the processing process will be described. Note that a description of the same configuration and operation as in the first embodiment will be omitted.

The allowable operation range generation unit 13 extracts operation log information of a specific terminal B from the operation log information storage unit 12, extracts the maximum value and minimum value of the operation at the terminal B, and allows the extracted maximum value and minimum value. An allowable range value extracting means for operating range information is provided.

  The allowable operation range extraction means first extracts operation log information as in the first embodiment, and counts the total value for each unit time. Next, the maximum value and the minimum value are extracted from the counted information. For example, in the case of the operation content “Duplicate” in FIG. 6A, the number of executions for 10 days from the first day to the tenth day is “5”, “4”, “4”, “5”, “6” ”,“ 7 ”,“ 6 ”,“ 4 ”,“ 5 ”,“ 4 ”. Therefore, the maximum value “7” and the minimum value “4” are extracted. The extracted maximum value and minimum value are set as allowable operation range information.

  By configuring as in the present embodiment, the procedure for obtaining the allowable operation range information from the operation reference value is omitted, so that an effect of reducing the processing load related to the determination can be obtained.

  In the present embodiment, a case will be described in which the maximum value and the minimum value within a specific period are extracted from the operation status values of the operation status information, and the maximum values and the minimum values are compared with each other.

  Hereinafter, each component and the processing process will be described. Note that a description of the same configuration and operation as in the first embodiment will be omitted.

  The operation status generation unit 14 extracts the operation log information of the terminal B in the specific period, and counts the maximum value and the minimum value as the operation status values indicating the operation status of the terminal B from the extracted operation log information. Then, the generated operation status value is notified to the unauthorized operation status determination unit 15 as operation status information.

  The unauthorized operation status information 15 acquires allowable operation information from the allowable operation range generation unit 13 and acquires operation status information from the operation status information determination unit 14. Then, the maximum value / minimum value of the allowable operation range information is compared with the maximum value / minimum value of the operation status information. Then, the comparison result is notified to the control unit 16.

  The above process will be specifically described with reference to FIGS. 9C and 10C. Note that the operation period value of the operation period “Web page access” and the operation target information “Web site D” is the number of executions (operation condition value 1) on the 11th and 12th days. Judgment shall be made.

  The allowable operation range generation unit 13 generates the allowable operation range information of the operation target “Web site D” using the same method as in the first embodiment, and the maximum value “6” and the minimum value “4” of the allowable operation range value. (See FIG. 9C). The generated allowable operation range value is notified to the unauthorized operation determination unit 15 as allowable operation range information.

  Next, the operation status generation unit 16 counts the number of executions of access to the operation target “Web site D” on the 11th day and the 12th day of the specific period. The number of executions “14” is acquired (see FIG. 10C). Therefore, the operation status value is the maximum value “14” and the minimum value “10”. Then, the generated operation status value is notified to the unauthorized operation determination unit 15 as operation status information.

  The unauthorized operation determination unit 15 acquires allowable operation range information and operation status information. Subsequently, the maximum value “6” of the allowable operation range information is compared with the maximum value “14” of the operation status information. As a result of the comparison, it is determined that the maximum value of the operation status information exceeds the allowable operation range information. Next, the minimum value “4” of the allowable operation range information is compared with the minimum value “5” of the operation status information. As a result of the comparison, since the minimum value of the operation status information is larger than the minimum value of the allowable operation range information, it can be determined that the allowable range is not exceeded.

  The unauthorized operation determination unit 15 can determine that the possibility of an unauthorized operation is 50% from the comparison result of the maximum value and the minimum value.

  By configuring as in this embodiment, it is not necessary to calculate the operation reference value when calculating the allowable operation range information, and the effect of reducing the processing load is obtained, and each terminal has the same effect as in the above embodiment. Determination based on the operation can be performed.

  The present invention can also be configured to make a determination in consideration of the environment information of the terminal B. In other words, the operation log information can be used to determine information related to the hardware / software environment of the terminal B and to generate allowable operation range information / operation status information in accordance with the environment of the terminal B.

  The above-mentioned environmental information refers to information related to the hardware or software of the terminal B, and specifically, is information related to the network connection status, external device connection status, software installation status, and the like. The network connection status is information such as a wired network connection (connection using a LAN cable), a wireless network connection, an intranet connection, an Internet connection, or no connection. The connection status of the external device is information indicating connection with an external storage medium, a printer, a scanner, or the like. The software installation status is installation information such as execution modules and execution programs in the terminal B.

    Hereinafter, each component and the processing process will be described. Note that a description of the same configuration and operation as in the first embodiment will be omitted.

Example 5 Configuration
The operation monitoring system of the present invention further includes an environment information generation unit (not shown) and an environment information storage unit (not shown).

  The environment information generation unit acquires operation log information from the operation log information acquisition unit 11 of the terminal B, generates environment information based on the acquired operation log information, and stores it in the environment information storage unit. This environment information is generated by determining information regarding the environment of the terminal B using the operation content, operation target information, additional information, and the like of the operation log information.

  When the operation log information acquisition unit 11 acquires operation log information from the terminal B, the operation log information storage unit 12 stores the environment information stored in the environment information storage unit in association with the operation log information.

  The allowable operation range generation unit 13 extracts operation log information for a period for determining a standard operation from the operation log information storage unit 12, and includes operation contents, operation target information, additional information, and the like included in each operation log information. The allowable operation range information is generated using the environment information. Specifically, risk points defined in advance for each environment information are determined according to the environment information included for each operation log information. Then, the operation point of the operation log information is calculated using the operation content / operation object information / additional information and the risk point, and an allowable operation range value is generated using a value obtained by collecting the operation points.

  The operation status generation unit 14 extracts operation log information for a specific period from the operation log information storage unit 12, and uses the operation content, operation target information, additional information, and environment information included in each operation log information as operation status information. Generate. Specifically, risk points defined in advance for each environment are determined according to the environment information included for each operation log information. Then, the operation point of the operation log information is calculated using the operation content / operation object information / additional information and the risk point, and an operation status value is generated using a value obtained by collecting the operation points.

Example 5-Treatment process
Next, an example of the processing process of the present embodiment will be described with reference to the functional block diagram of FIG. 3, the flowchart of FIG. In the following description, the determination target terminal B “ABC12345” is connected to the management server A via the network N, the operation content used for the determination of this operation is “copy”, and the operation status value is the number of executions (operation status The value 1) is used. The environment information uses the network connection status.

  When the operation log information acquisition unit 11 acquires the operation log information from the terminal B, the operation log information acquisition unit 11 notifies the environment information generation unit of the operation log information. Further, the environment information is extracted from the environment information storage unit, and stored in the operation log information storage unit 12 in association with the acquired operation log information (S101). The operation log information stored in the operation log information storage unit 12 is schematically shown in FIG.

  The environment information generation unit acquires operation log information from the operation log information acquisition unit 11, and acquires the network connection status extracted from the acquired operation log information as environment information. The network connection status, which is one of the environmental information, will be specifically described. For example, when operation log information including the operation content “network connection”, operation target information “wired connection”, and additional information “Internet connection” is acquired, it is determined that the network connection status is “wired network connection (Internet)”. Generate contents as environmental information. In addition, when operation log information including operation content “network disconnection”, operation target information “wired connection”, and additional information “Internet connection” is acquired, it is determined that the network connection status is “wired network not connected” and the content is Information is generated (see FIG. 15).

  The allowable operation range generation unit 13 extracts operation log information for a predetermined period for determining a standard operation, and calculates an operation point according to the operation log information and related environment information. Then, the allowable operation range information is generated using the operation point (S102).

  More specifically, the above processing is extracted from the acquired operation log information, operation log information having operation content “duplicate” and environment information (network connection status). Next, a risk point is acquired from the risk point table (see FIG. 16) according to the contents of the environment information (network connection status), and the risk point is set as an operation point of the operation log information. For example, if the operation log information is shown in FIG. 14A, the risk point is “2” because it is environment information (network connection) “wired network connection (Internet)” (see FIG. 16). Therefore, the operation point of the operation log information is “2”.

  Subsequently, after calculating the operation points for each operation log information, the operation points per unit time are totaled (see FIG. 17). Then, the average value of the daily operation points in 10 days is calculated as “6.4”. Then, allowable operation range information is calculated using this operation point.

  The operation status generation unit 14 acquires operation log information in a specific period, and calculates an operation point according to the operation log information and environment information. Then, operation status information is generated using the operation points (S103). The operation point on the 11th day which is the specific period is calculated as 10.

  By configuring as in the present embodiment, it is possible to more strictly determine whether the operation is an unauthorized operation according to the environment of the terminal B.

  In this embodiment, the operation point is calculated by reflecting the environment information in the allowable operation range information and the operation status information. However, the environment information is only applied to either the allowable operation range information or the operation status information. You may comprise so that it may reflect.

  In the present embodiment, the environment information is determined using the operation log information. However, the hardware / software information of the terminal B is acquired from the terminal B, and the environment information is generated based on the acquired information. It doesn't matter. This will be specifically described below.

  The terminal control unit 21 acquires information regarding the hardware configuration of the terminal B and installed software as asset information. Then, the acquired asset information is notified to the management server A via the network I / F 20. And the management server A acquires asset information from the terminal B, and memorize | stores it in an environmental information storage part as environmental information.

  Regarding the above-described processing, the management server A may be configured to acquire the asset information from the terminal B by instructing the terminal B to send the asset information transmission request, or the terminal B periodically sends the asset information to the management server A. You may comprise so that information may be notified.

  In this embodiment, the environment information is generated every time operation log information is acquired from the terminal B and stored in association with the operation log information. However, in the allowable operation range generation unit 13 and the operation status generation unit 14, Each time operation log information is acquired from the operation log information storage unit 12, environmental information may be generated and risk points may be acquired. Thus, it is not necessary to associate and store the environment information used for the determination in advance, the environment information used for the determination can be changed, and it is possible to determine various environment information.

  In the above-described embodiment, the generation of the allowable operation range information is an arbitrary period for determining a standard operation and the generation of the operation status information is an arbitrary specific period. However, in the present embodiment, predetermined operation log information A case will be described in which allowable operation range information and operation status information are generated and determined based on operation log information for a certain period based on the operation date and time of (reference operation log information).

  The above-mentioned reference operation log information is operation log information serving as a reference for determining a period for acquiring operation log information. This reference operation log information is operation log information that matches a predetermined condition.

Hereinafter, each component and the processing process will be described. Detailed descriptions of the same components or operations as those in the first embodiment will be omitted.

Example 6 Configuration
The allowable operation range information generation unit 13 sequentially acquires operation log information from the operation log information storage unit 12, and compares the acquired operation log information with reference operation log information. If it is determined as reference operation log information as a result of the comparison, a related operation acquisition period is determined, and operation log information included in the period is extracted from the operation log information storage unit 12. This series of processing is repeatedly executed for a predetermined period for determining a standard operation. Subsequently, tabulation is performed according to the extracted operation log information to generate allowable operation range information.

  The related operation acquisition period described above refers to a period or time range based on the operation date and time of the reference operation log information. That is, this is a period indicated by the date and time when acquisition of operation log information starts and the date and time when acquisition of operation log information ends from the operation date and time of the reference operation log information (see FIG. 19). The related operation acquisition period may be before or after the operation date and time of the reference operation log information. Furthermore, the related operation acquisition period may or may not include the date and time of specific operation log information.

  For example, it is assumed that the operation content of the reference operation log information is “detection of external storage medium” and the related operation acquisition period is “0 minutes before reference operation log information to 10 minutes after reference operation log information” (FIG. 19) and whether or not the operation content of the operation log information acquired from the operation log information storage unit 12 is “detection of external storage medium”. As a result of the determination, if they match, operation log information for 10 minutes after the operation log information is extracted. That is, in the case of FIG. 18, operation log information between “start A to end A” and “start B to end B” is extracted. Then, the allowable operation range information generation unit 13 aggregates operations according to the acquired operation log information, and generates allowable operation range information.

  The operation status information generation unit 14 acquires operation log information from the operation log information storage unit 12 and compares the operation content of the acquired operation log information with the operation content of the reference operation log information. If it is determined as the reference operation log information as a result of the comparison, the operation log information included in the related operation acquisition period defined in advance is extracted from the operation log information storage unit 12. Then, aggregation is performed based on the extracted operation log information, and operation status information is generated.

  For example, the operation status generation unit 14 determines whether the operation content of the operation log information sequentially acquired from the operation log information storage unit 12 is “detection of external storage medium”. As a result of the determination, if they match, operation log information for 10 minutes after the operation log information is extracted. That is, in the case of FIG. 18, the operation log information between “start C to end C” is extracted. Subsequently, the operation status generation unit 14 operates according to the acquired operation log information. The operation status information is generated.

  In this way, by extracting operation log information within a predetermined range based on predetermined operation log information, it is determined whether an operation performed in conjunction with the predetermined operation log information is an illegal operation. Will be able to.

  Further, in the present embodiment, the reference operation log information is obtained from the operation log information storage unit 12 as operation log information for generating allowable operation range information and operation status information in the allowable operation range generation unit 13 and the operation status generation unit 14. Although it was used as a reference for determining the period for extraction, the allowable operation range information and the operation status using the reference operation log information itself and the number of times the reference operation log information was output from the terminal B A configuration in which information is generated may be used.

  In this embodiment, a case will be described in which a determination point is generated from a result of comparing the allowable operation range information and the operation status information, and control is performed using the accumulation of the determination point.

  The above-described determination point refers to a value obtained by accumulating the degree of possibility of unauthorized operation for the operation performed on the terminal B. In other words, it is a value obtained by integrating the points obtained according to the comparison result between the allowable operation range information and the operation status information. In this embodiment, it is determined that the greater the value of the determination point, the higher the possibility of an unauthorized operation.

Hereinafter, each component and the processing process will be described. Detailed descriptions of the same components or operations as those in the first embodiment will be omitted.

Example 7-Configuration
In the present embodiment, the operation monitoring system of the present invention further includes a determination point storage unit (not shown).

  The operation point storage unit stores a determination point obtained by accumulating points according to the comparison result between the allowable operation information and the operation status information in the unauthorized operation determination unit 15.

  The unauthorized operation determination unit 15 compares the allowable operation range information with the operation status information. If the operation result information is outside the allowable operation range as a result of the comparison, points are determined according to the object used for the comparison determination (see FIG. 20). Then, the determined point is added to the determination point from the determination point storage unit. The target used for the determination here refers to the operation content, the operation target information, the number of executions for the additional information, the execution cycle, and the like included in the operation log information.

  The control unit 16 acquires a determination point from the determination point storage unit. Depending on the acquired determination point, operation control / warning notification for the terminal B and notification for the administrator terminal are performed (see FIG. 11B).

  Furthermore, it is preferable that the unauthorized operation determination unit 15 not only accumulates the determination points but also subtracts the determination points at a predetermined timing or periodically. That is, when the unauthorized operation determination unit 15 determines that the operation is an unauthorized operation, the determination point is added, and when it is determined that the operation is not an unauthorized operation (the operation status information is within the allowable operation range), it is used for the determination. The point may be determined according to the object, and the determined point may be subtracted from the determination point. As a result, it is possible to control only the terminal that is continuously performing unauthorized operations.

  In the present embodiment, it is preferable to periodically execute this system. Further, the present invention is not limited to this, and it may be executed at a predetermined timing such as an instruction from an administrator or predetermined operation log information.

  In this embodiment, the possibility of an unauthorized operation is higher as the determination point is larger. However, the present invention is not limited to this, and the possibility of an unauthorized operation may be higher as the determination point is smaller. In this case, the point that is a normal value (the highest point) is stored in the determination point storage unit, the determination point stored according to the result of the unauthorized operation determination unit 16 is subtracted, and the subtracted determination point is Of course, it is also possible to configure so as to perform control.

  In the above-described seventh embodiment, the method of providing the determination point and performing the control according to the integrated value of the determination point has been described. However, in this embodiment, the determination is performed every time the determination point is calculated by the unauthorized operation determination unit 15. A method of sequentially storing the data in the point storage unit, determining the possibility of an unauthorized operation according to the change with time of the value, and performing control will be described.

    The unauthorized operation determination unit 15 compares the allowable operation range information with the operation status information. As a result, when it is determined that the operation status information is outside the allowable operation range, a point is determined according to the target used for the determination (see FIG. 20). And the determined point is memorize | stored in the determination point memory | storage part with the information (For example, (circle) day, operation date, etc.) which shows the timing of determination.

  Next, the unauthorized operation determination unit 15 aggregates the points for each unit time based on the points stored for each piece of information indicating the determination timing in the determination point storage unit, and determines the occurrence tendency of the unauthorized operation. The possibility of unauthorized operation is determined according to the tendency.

  The above-mentioned tendency for the occurrence of unauthorized operations refers to the tendency that the unauthorized operations are increasing or decreasing.

  The unauthorized operation determination unit 15 includes an occurrence tendency calculation unit that calculates an occurrence tendency of an unauthorized operation, and a determination unit that determines the possibility of an unauthorized operation based on the occurrence tendency.

  The occurrence tendency calculation means acquires points from the determination point storage unit. Then, the points are totaled from the acquired points every unit time. Then, an approximate linear equation of the change of the aggregated points is calculated. The control unit is notified of the calculated inclination / cut line of the approximate linear equation. That is, for example, when the determination period is 10 days, the points are totaled for each day, and an approximate linear expression of the totaled points for each day of the 10 days is calculated. Then, the control unit is notified of the inclination / cut line of the approximate linear equation.

  For example, when the slope is a positive value, it can be determined that the trend is increasing, and when the slope is a negative value, it can be determined that the trend is decreasing. Further, when the absolute value of the slope is large (in either case of positive value / negative value), it indicates that the operation is changing rapidly. Therefore, it is determined that the possibility of the unauthorized operation is high. May be. Further, it may be assumed that unauthorized operations are continuously performed using the size of the cut line.

  Judgment means determines that there is a possibility of or high fraudulent operation when the tendency of fraudulent operation is increasing or the operation has changed abruptly. I do.

  In the above-described embodiment, the operation reference value is calculated using the operation log information, and the allowable operation range information and the operation status information are obtained. However, it is determined whether the acquired operation log information is a prohibited operation, and the prohibition is performed. An operation reference value may be calculated using the number of operations, etc., and the allowable operation range information and operation status information may be obtained to determine unauthorized operation.

  The above-described prohibited operation is an operation whose execution is prohibited or restricted at the terminal B.

  Specifically, it is determined whether the operation log information acquired by the operation log information acquisition unit 11 is a prohibited operation, and the determination result is stored in the operation log information storage unit 12. When storing in the operation log information storage unit 12, it is preferable to associate the prohibited operation information with the operation log information. Then, based on the information of the prohibited operation, allowable operation range information and operation status information are generated, and an unauthorized operation is determined (FIGS. 6E, 7E, 9E, and 10). e)).

  As for the conditions for the prohibited operation, it is preferable to define the prohibited operation content, operation target information, accompanying information, and the like in advance and store them in a storage unit or the like.

  In the present embodiment, a case will be described in which determination is performed using information indicating various data amounts included in operation log information. Specifically, information indicating various data amounts such as the amount of data, the number of printed pages, and the number of files included in the additional information of the operation log information is extracted, and the allowable operation is performed using the integrated value of the data amount per unit time. Generate range information and operation status information, and determine unauthorized operations.

  An example relating to the information indicating the data amount described above is shown below. Data amount when operation log information is operation content “file download” and additional information “data amount to be downloaded” (refer to FIG. 6D, FIG. 7D, FIG. 9D, and FIG. 10D) , The number of print pages when the operation log information is the operation content “print” and the additional information “number of print pages”, the number of files when the operation log information is the operation content “print” and the additional information “number of files”, the operation log information The number of files when the operation content is "Send mail" and the additional information "Number of attached files", the amount of attached file data when the operation content of the operation log information is "Send mail" and the additional information is "Attached file data amount", etc. There is. Note that these are examples and are not limited, and information indicating any data amount may be used.

  In the above-described embodiment, the terminal identification information is used to make the determination for each terminal. However, it is naturally possible to make the determination using the user identification information included in the operation log information. This makes it possible to determine an unauthorized operation when the user is using the terminal without specifying it.

Each function and each configuration of the operation monitoring system of the present invention may be appropriately distributed in the management server A and the terminal B.

  In addition to the above-described configuration, the management server A may not be provided, and a configuration unit necessary for the terminal B may be provided. Specifically, the terminal B includes a terminal control unit 21, an operation log information generation unit 22, an operation log information acquisition unit 11, an operation log information storage unit 12, an allowable operation range generation unit 13, an operation status generation unit 14, an unauthorized operation. By providing the determination unit 15 and the control unit 16, it is possible to perform operation monitoring only by the terminal B. As a result, there is no need to make an inquiry to the management server A, and processing can be performed at high speed.

Note that there are various patterns of dispersion arrangement, and any arrangement form may be used. As described above, in the processes in the management server A and the terminal B, when using functions of other terminals and servers, an information transmission / reception unit for transmitting / receiving information is appropriately provided to transmit an inquiry and receive an inquiry result. It is better to realize by doing so.

A: Management server B: Terminal C: Peripheral device 1: Computing device 2: Storage device 3: Display device 4: Input device 5: Communication device 11: Operation log information acquisition unit 12: Operation log information storage unit 13: Allowable operation range Generation unit 14: Operation status generation unit 15: Unauthorized operation determination unit:
16: Control unit 21: Terminal control unit 22: Operation log information generation unit 23: Operation log information transmission unit 24: Control instruction reception unit

Claims (3)

An operation log information storage unit for storing operation log information indicating a history of operation of the terminal;
Based on operation log information in the operation log information storage unit, an allowable operation range generation unit that generates allowable operation range information indicating a standard operation in the terminal;
An operation status generation unit that extracts operation log information in a specific period of the terminal from the operation log information storage unit, and generates operation status information indicating an operation status of the terminal according to the extracted operation log information;
An unauthorized operation determination unit that determines the possibility of an unauthorized operation based on the allowable operation range information and the operation status information ;
The unauthorized operation determination unit
Means for accumulating the degree of possibility of fraudulent operation and storing it in the determination point storage unit together with information indicating the determination timing as a determination point;
Based on the information stored in the determination point storage unit, the determination points for each unit time are totaled, and an occurrence tendency calculating means for calculating the occurrence tendency of unauthorized operations,
Means for determining the possibility of unauthorized operation according to the calculated occurrence tendency;
Operation monitoring system that, comprising a. The operation status generator is
Generating operation status information indicating an operation status in a predetermined period based on the operation date and time of the operation log information indicating a specific operation among the operation log information of the specific period stored in the operation log information storage unit; operation monitoring system according to claim 1, wherein. An operation monitoring program for an operation monitoring system including an operation log information storage unit that stores operation log information indicating a history of operation of a terminal,
Based on operation log information in the operation log information storage unit, an allowable operation range generation function for generating allowable operation range information indicating a standard operation in the terminal;
An operation status generation function for extracting operation log information in a specific period of the terminal from the operation log information storage unit, and generating operation status information indicating an operation status of the terminal according to the extracted operation log information ;
Based on the allowable operation range information and the operation status information, an unauthorized operation determination function that determines the possibility of unauthorized operation ,
The unauthorized operation determination function is
Means for accumulating the degree of possibility of fraudulent operation and storing it in the determination point storage unit together with information indicating the determination timing as a determination point;
Based on the information stored in the determination point storage unit, the determination points for each unit time are totaled, and an occurrence tendency calculating means for calculating the occurrence tendency of unauthorized operations,
Means for determining the possibility of unauthorized operation according to the calculated occurrence tendency;
An operation monitoring program that enables a computer to implement this function .