JP5654105B1 - Behavior analysis system, behavior analysis method, and behavior analysis program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To automatically determine the possibility of occurrence of a specific action. A behavior analysis system according to the present invention includes a model storage unit that stores a behavior generation model created based on a transmission / reception history of a message file on a network of an action subject who has performed a specific action, and a network on the subject's network. Based on the message file transmission / reception history, a profile creation unit that creates a profile of the subject, a score calculation unit that calculates a score indicating the suitability between the profile information and the behavior occurrence model, and a specification based on the score result A determination unit that automatically determines the possibility of occurrence of the action is provided. [Selection] Figure 1

Description

  The present invention relates to a behavior analysis system, a behavior analysis method, and a behavior analysis program, and more particularly to a behavior analysis system, a behavior analysis method, and a behavior analysis program that can automatically determine the possibility that a specific behavior will occur.

  In recent years, a technique for discovering a specific action performed by a human by analyzing data on a network, electronic records, and the like has been proposed.

  For example, Patent Document 1 discloses a technique related to a system for detecting unauthorized behavior. The technology includes a network layer having at least one telecommunications network, a service control layer for managing the network layer and generating a service record including data representing an instance of telecommunications in the network layer, and a service control layer A telecommunications system comprising a data management layer for receiving service records from various components and processes, reducing data by removing redundancy and integrating multiple records into a network event record; and from the data management layer A detection layer for receiving a network event record to test the network event record for possible fraud and generating an alarm instructing the occurrence of an inferred fraud; and an alarm generated by the detection layer; Analysis layer for receiving and integrating alarms into fraud cases, and analysis layer Relates multilayer fraud detection system comprising an expert system layer acting to some receive al fraud case and fraud case.

  However, in the technique described in Patent Document 1, since deviation from the normal behavior executed on the network is determined and illegal behavior is detected, illegality in an event where it is difficult to set the regular behavior. It is difficult to discover specific actions or specific actions that take place outside the network.

Special table 2001-516107 gazette

  In view of the above circumstances, an object of the present invention is to create an action occurrence model and automatically determine the possibility of occurrence of a specific action using the action occurrence model.

  The behavior analysis system according to the present invention includes a model storage unit that stores a behavior generation model created based on a transmission / reception history of a message file on a network of an action subject that has performed a specific action, and a message file on the network of the subject. Based on the transmission / reception history, a profile creation unit that creates a profile of the subject, a score calculation unit that calculates a score indicating compatibility between the profile information and the behavior generation model, and a specific action occurs based on the score result It is characterized by including a determination unit that automatically determines the possibility to do.

  The behavior subject is an individual, and the behavior generation model may be an individual personality pattern model.

  The personality pattern model can be created based on the content of the text described in the message file and / or the tendency of the text described in the message file.

  The behavior subject is an individual, and the behavior generation model may be an individual behavior pattern model.

  The behavior pattern model can be created based on the content of the text described in the message file and / or the metadata of the message file.

  The action subject is a community composed of a plurality of individuals, and the action generation model can be a group pattern model of a community.

  The group pattern model can be created based on the text content described in the message file and / or the metadata of the message file.

  The metadata of the message file may include transmission / reception time information and / or transmission / reception target information of the message file.

  The determination unit can determine that the subject may perform a specific action when the score exceeds a predetermined threshold.

  The behavior analysis system of the present invention may further include a warning unit that transmits a warning and a subject profile to the administrator when the score exceeds a predetermined threshold.

  The message file may be an email and / or instant message.

  The behavior analysis method of the present invention is a behavior analysis method for analyzing a specific behavior, and the behavior analysis method is created based on a message file transmission / reception history on a network of an action subject who has performed a specific behavior. A model storing step for storing the behavior generation model, a profile creation step for creating a profile of the subject based on the transmission / reception history of the message file on the network of the subject, and a score indicating compatibility between the profile information and the behavior generation model And a determination step of automatically determining the possibility of occurrence of a specific action based on the score.

  The behavior analysis program of the present invention is a behavior analysis program for analyzing a specific behavior, and the behavior analysis method is based on a message file transmission / reception history on a network of an action subject who has performed a specific behavior on a computer. The model storage function for storing the action occurrence model created in the above, the profile creation function for creating the subject profile based on the transmission and reception history of the message file on the subject network, and the compatibility between the profile information and the action occurrence model It is characterized by realizing a score calculation function for calculating a score indicating the above and a determination function for automatically determining the possibility of occurrence of a specific action based on the score.

  According to the behavior analysis system, behavior analysis method, and behavior analysis program of the present invention, a behavior occurrence model is created, and by using this behavior occurrence model, the possibility of occurrence of a specific behavior is automatically determined. Can do.

Configuration diagram of a behavior analysis system in an embodiment of the present invention The chart which showed the processing flow of the action analysis system in the embodiment of the present invention The chart which showed the processing flow of the profile creation part in the embodiment of the present invention The chart which showed the processing flow of the score calculation part in embodiment of this invention The chart which showed the processing flow of the judgment part in the embodiment of the present invention The chart which showed the processing flow of the warning part in the embodiment of the present invention The chart which showed the processing flow of the model storage part in embodiment of this invention

  A behavior analysis system according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

  As shown in FIG. 1, the behavior analysis system 1 includes a model storage unit 11, a profile creation unit 12, a score calculation unit 13, a determination unit 14, and a warning unit 15.

  The behavior analysis system 1 includes a computer and / or a server, and operates as various functional units when the CPU executes a program recorded in the ROM based on various inputs.

  The model storage unit 11 stores an action occurrence model created based on a transmission / reception history of a message file on a network of an action subject who has performed a specific action.

  The action subject means a community composed of an individual who has performed the specific action or a plurality of individuals.

  The network refers to a communication network between computers in the company to which the action subject belongs, or a computer in the company and a computer outside the company or the Internet.

  The message file refers to a file transmitted / received by e-mail, instant message, or the like.

  The transmission / reception history refers to information such as the content of a transmitted / received file recorded in the text and metadata of the file, the time of transmission / reception, the object of transmission / reception, and the like.

  The behavior generation model may be a model of an element that causes a specific behavior from a transmission / reception history of a message file. The behavior generation model is, for example, a personality pattern model, a behavior pattern model, a group pattern model, or the like.

  The profile creation unit 12 creates the profile information of the subject based on the transmission / reception history of the message file on the subject's network. The profile information of the subject is, for example, a personality pattern profile, a behavior pattern profile, a group pattern profile, and the like.

  The above-mentioned subject means a community composed of an individual or a plurality of individuals.

  The score calculation unit 13 calculates a score indicating the compatibility between the profile information created by the profile creation unit 12 and the behavior generation model stored in the model storage unit. For example, the case where the profile information and the behavior occurrence model completely match can be represented as 100, and the case where the profile information does not coincide can be represented as 0.

  The determination unit 14 automatically determines the possibility that a specific action occurs based on the score result calculated by the score calculation unit 13.

  When the action subject is an individual, the behavior generation model can be an individual personality pattern model.

  The personality pattern model is preferably created based on the content of the text described in the message file and / or the tendency of the text described in the message file. Specifically, it can be created based on a message writing method, a theme, or the like.

  When the action subject is an individual, the behavior generation model can be an individual behavior pattern model.

  It is preferable that the behavior pattern model is created based on the content of text described in the message file and / or the metadata of the message file. Specifically, it can be created based on the message theme, transmission / reception time, number of transmission / reception targets, transmission / reception targets, and the like.

  When the action subject is a community composed of a plurality of individuals, the behavior generation model may be a community group pattern model.

  The group pattern model is preferably created based on the content of text described in the message file and / or the metadata of the message file. Specifically, it can be created based on the time of occurrence of the community, the subject handled by the community, the activity time zone of the community, the message transmission / reception target, and the like.

  The metadata of the message file may include transmission / reception time information and / or transmission / reception target information of the message file.

  The determination unit 14 can determine that the subject may perform a specific action when the score exceeds a predetermined threshold.

  The behavior analysis system 1 according to the present invention preferably further includes a warning unit 15 that transmits a warning and a subject profile to the administrator when the score exceeds a predetermined threshold.

  The warning unit 15 can also transmit to the model storage unit 11 and learn the profile information determined that there is a possibility that a specific action will occur. In this case, the transmitted profile information can be stored and used as a behavior generation model.

  The model storage unit 11 can also automatically store profile information that is highly likely to generate a specific action as an action generation model from past determination results. Further, the model storage unit 11 can estimate a tendency of a specific action from a past action generation model and store it as a new action generation model. At that time, a plurality of models related to a plurality of elements may be created from the transmission / reception history of one specific action.

  The message file may be e-mail and / or instant message, for example. Instant messaging refers to the exchange of messages sent and received between computers in a network using a dedicated application.

  The specific action can be a legitimate action. Legitimate actions include, for example, contract actions based on legitimate procedures, and network registration actions based on legitimate procedures. It also includes actions.

  The specific action can be an illegal act. Unauthorized acts include, for example, acts such as tying cartels with multiple people and actions that leak confidential document data, but are not limited to this, and include acts that violate any provisions. Shall be.

  Furthermore, according to the behavior analysis system of the present invention described above, for example, the person A who has many contacts with the upper level of the company to which he belongs, the person B who has many contacts with the competitors of the company to which he belongs, and many contacts with the customer. It can be determined that there is a high possibility that a price cartel will occur when three people C, who have a lot of information regarding the price, exchange messages.

  In other words, in the price cartel, the people in charge of a competitor X and Y in a certain product communicate to collect information about the price, make contact for price adjustment, lead to the adjustment, and the information is It can be determined that there is a high possibility that a price cartel will be generated.

  Further, according to the behavior analysis system of the present invention described above, for example, a person D who has many contact points with a person outside the company to which he belongs belongs to create a specific document (such as a document related to secret management technology). In this case, it can be determined that there is a high possibility of information leakage.

  Next, an example of the behavior analysis method according to the embodiment of the present invention will be described with reference to the drawings.

  As shown in FIG. 2, the behavior analysis method of the present invention includes a model storage step (S110), a profile creation step (S120), a score calculation step (S130), and a determination step (S140). FIG. 2 shows a case where the behavior analysis method of the present invention further includes a warning step (S150).

  In the model storing step (S110), an action occurrence model created based on the transmission / reception history of the message file on the network of the action subject who performed the specific action is stored. This step can be processed by the model store described above.

  In the profile creation step (S120), a profile of the subject is created based on the transmission / reception history of the message file on the subject's network. This step can be processed by the profile creation unit described above.

  In the score calculation step (S130), a score indicating the compatibility between the profile information and the behavior generation model is calculated. This step can be processed by the score calculation unit described above.

  In the determination step (S140), the possibility that a specific action occurs is automatically determined based on the result of the score. This step can be processed by the determination unit described above.

  In the warning step (S150), when the score calculated by the score calculation unit exceeds a predetermined threshold, a warning and a profile of the subject are transmitted to the administrator. This process can be processed by the warning unit described above.

  FIG. 3 is a flowchart specifically showing an example of processing in the profile creation step (S120). As shown in FIG. 3, in the profile creation step (S120), first, the text and metadata are acquired from the message file (S121). Next, the acquired text and metadata are classified for each message address (S122), and a personality pattern profile is created from the sorted text, metadata writing method, theme, and the like (S123).

  Also, an action pattern profile can be created from the message theme, transmission / reception time, number of transmission / reception targets, transmission / reception targets, etc. (S124).

  On the other hand, the address group of the message is identified and classified for each group (S125). For each address group of the message, the generation time of the community to which the address group belongs, the subject handled by the community, the activity time zone of the community, the community It is also possible to create a community profile from the transmission / reception targets of messages from S (S126). The address group of the message is identified from, for example, transmission / reception time, transmission / reception target, and the like.

  FIG. 4 is a flowchart specifically showing an example of processing in the score calculation step (S130). As shown in FIG. 4, the score calculation step (S130) acquires a personality pattern profile and a personality pattern model (S131), quantitatively evaluates the respective similarities, and calculates a score (S132).

  The score calculation unit 13 can also acquire a behavior pattern profile and a behavior pattern model (S133), quantitatively evaluate each similarity, and calculate a score (S134).

  Further, the score calculation unit 13 can acquire a community profile and a group pattern model (S135), quantitatively evaluate each similarity, and calculate a score (S136).

  FIG. 5 is a flowchart specifically showing an example of the process in the determination step (S140). As shown in FIG. 5, in the determination step (S140), it is determined for each profile whether the score exceeds a threshold value (S141), and if the score exceeds a predetermined threshold value, there is a possibility of performing a specific action. If it is determined that there is a score (S142) and the score does not exceed the threshold, the process is terminated.

  FIG. 6 is a flowchart specifically showing an example of processing in the warning step (S150). As shown in FIG. 6, in the warning step (S150), it is determined whether or not it is determined that a specific action may occur (S151). If it is determined, a warning is determined for the system administrator. The transmitted profile information is transmitted (S152). If not determined, the process is terminated.

  FIG. 7 is a flowchart specifically showing an example of the process in the model storing step (S110). As shown in FIG. 7, for example, the model storage unit 11 determines whether or not it is determined that a specific action may occur in the warning step (S150) (S111). The profile information can be acquired from (S112) and stored as a behavior generation model (S113). If not determined, the process is terminated.

  Next, an example of a behavior analysis program according to the embodiment of the present invention will be described.

  The behavior analysis program of the present invention is a behavior analysis program for analyzing a specific behavior, and causes a computer to realize a model storage function, a profile creation function, a score calculation function, and a determination function. And

  The model storage function stores an action occurrence model created based on a transmission / reception history of a message file on a network of an action subject who has performed a specific action. This function can be realized by the model storage unit described above.

  A profile of the subject is created based on the profile creation function and the transmission / reception history of the message file on the subject's network. This function can be realized by the profile creation unit described above.

  The score calculation function calculates a score indicating the compatibility between the profile information and the behavior generation model. This function can be realized by the score calculation unit described above, and the details are as described above.

  The determination function automatically determines the possibility that a specific action will occur based on the score result. This function can be realized by the determination unit described above, and the details are as described above.

  As described above, the behavior analysis system, the behavior analysis method, and the behavior analysis program of the present invention have been described in detail. Various improvements and changes may be made.

DESCRIPTION OF SYMBOLS 1 Action analysis system 11 Model storage part 12 Profile creation part 13 Score calculation part 14 Determination part 15 Warning part

Claims (15)

A behavior analysis system for analyzing a specific behavior,
A model storage unit that stores a behavioral generation model created based on the reception history of the message file on the network of actors performing the action specific,
A profile creation unit that creates profile information of the subject based on a transmission / reception history of the message file on the subject's network;
A score calculation unit for calculating a score indicating compatibility between the profile information and the behavior occurrence model;
A determination unit that automatically determines the possibility of occurrence of a specific action based on the score ;
A warning unit that transmits profile information that is determined to cause a specific action ,
The model storage unit stores the transmitted profile information as a behavior generation model, estimates a tendency of a specific behavior from a past behavior generation model, and stores it as a new behavior generation model . The action subject is an individual,
The action generated model, Ri Oh by the individual's personality pattern model,
The profile creation unit creates the personality pattern model as the behavior occurrence model by obtaining a body and metadata from the message file and separating the obtained body and metadata for each address of the message file. The behavior analysis system according to claim 1.   The behavior analysis system according to claim 2, wherein the personality pattern model is created based on a content of a sentence described in the message file and / or a tendency of a sentence described in the message file. The action subject is an individual,
The behavior analysis system according to claim 1, wherein the behavior generation model is a behavior pattern model of the individual.   5. The behavior analysis system according to claim 4, wherein the behavior pattern model is created based on text content and / or metadata of the message file described in the message file. The action subject is a community composed of a plurality of individuals,
The action generated model, Ri Oh by the community of the group pattern model,
The profile creation unit identifies an address group of the message file, and creates the group pattern model as the behavior generation model for each address group by identifying the message file for each address group. The behavior analysis system according to claim 1.   The behavior analysis system according to claim 6, wherein the group pattern model is created based on text content and / or metadata of the message file described in the message file.   The behavior analysis system according to claim 5 or 7, wherein the metadata of the message file includes transmission / reception time information and / or transmission / reception target information of the message file.   The behavior according to any one of claims 1 to 8, wherein the determination unit determines that the subject may perform a specific behavior when the score exceeds a predetermined threshold. Analysis system. The warning unit, when the score exceeds a predetermined threshold value, to the administrator, to any one of claims 1 to 9, further transmitted to feature a benzalkonium profile information warnings and the metallic The behavior analysis system described. The said model storage part stores automatically the profile information with high possibility that a specific action will generate | occur | produce as said action generation model from the past determination result, The Claim 1 characterized by the above-mentioned. The behavior analysis system described.   The behavior analysis system according to claim 1, wherein the specific behavior is a legitimate act.   The behavior analysis system according to claim 1, wherein the specific behavior is an illegal act. A behavior analysis method for analyzing a specific behavior,
A model storage step of storing the action generation model created based on the reception history of the message file on the network of actors performing the action specific,
A profile creation step for creating a profile of the principal based on a transmission / reception history of the message file on the network of the principal;
A score calculating step for calculating a score indicating compatibility between the profile information and the behavior occurrence model;
A determination step of automatically determining the possibility of occurrence of a specific action based on the score ;
A warning step for transmitting profile information determined to have a specific action that may occur ,
In the model storing step, the transmitted profile information is stored as a behavior occurrence model, and a tendency that a specific behavior is performed from a past behavior occurrence model is estimated and stored as a new behavior occurrence model. Method. A behavior analysis program for analyzing a specific behavior,
On your computer,
A model storage function for storing an action occurrence model created based on a message file transmission / reception history on a network of an action subject who has performed a specific action;
A profile creation function for creating a profile of the principal based on a transmission / reception history of a message file on the network of the principal;
A score calculation function for calculating a score indicating compatibility between the profile information and the behavior occurrence model;
A determination function that automatically determines the possibility of occurrence of a specific action based on the score ;
A warning function that sends profile information that has been determined to cause a specific action ,
The model storage function stores the transmitted profile information as an action occurrence model, estimates a tendency of a specific action from a past action occurrence model, and stores it as a new action occurrence model .

Images