JP6226847B2 - Access log monitoring apparatus, method, and program - Google Patents

Description

  The present invention relates to an access monitoring technique, and more particularly to an access log monitoring technique for monitoring access contents to a computer via a network and grasping the characteristics of the access contents.

Access to computers via the network is important for protecting the system from unauthorized access and taking appropriate security measures. Normally, such access contents are detected by a computer at the time of access and output as an access log, and these are sequentially stored in a log file.
Conventionally, the access route included in such an access log is monitored, and if it is not a regular access route, it is determined as an unauthorized access, and that fact is displayed on the screen, and a voice or alarm is output for management. There has been proposed a technique for notifying a person that an unauthorized access has occurred (see, for example, Patent Document 1).

JP 2002-084849 A

Normally, when a user accesses a computer from a user terminal via a network and browses or searches a Web page, in addition to the access route, the user terminal address, terminal type, access date, user ID, Various characteristics relating to access contents such as an access destination URL and character data input at the time of access are recorded as an access log.
Therefore, by using the characteristics of the access contents included in such an access log, it is possible to monitor a specific unauthorized access, which is extremely useful for taking appropriate security measures. In addition to monitoring unauthorized access, this type of access content is extremely useful for collecting and analyzing user interests and preferences, and for using it to devise content content and browsing / distribution technologies that are distributed to users. Useful.

  Here, as the number of accesses to the computer increases, the work required for monitoring the access log increases, resulting in a heavy work load. In addition, the method of visual confirmation by displaying the access log on the screen not only causes oversight and mistakes, but also requires manual operation to select the access log. Unusable for work. For this reason, a technique that can instantly grasp the characteristics of the access contents related to each access with a small work load is desired.

  However, since the above-described prior art is intended to detect the presence or absence of unauthorized access, when a detection result is notified, a voice or an alarm that is fixedly registered in advance is output. For this reason, the presence / absence of unauthorized access can be grasped by the presence / absence of voice or alarm output, but the content or difference of unauthorized access cannot be grasped by voice or alarm. Therefore, in order to monitor the contents and differences of unauthorized access, it is necessary to check the monitoring screen, and as described above, there is a problem that it is not possible to instantly grasp the characteristics of access contents related to each access with a small work load. there were.

  An object of the present invention is to provide an access log monitoring technique capable of instantaneously grasping the characteristics of access contents related to each access with a small work load.

  In order to achieve such an object, an access log monitoring apparatus according to the present invention includes an access log acquisition unit that acquires an access log that is recorded for each access to a computer and that indicates details of the access, and an acquisition Each of the access logs includes a sound source selection unit that selects sound source data corresponding to the recorded contents of the access log, and a sound processing unit that reproduces the selected sound source data.

  Also, in one configuration example of the access log monitoring device according to the present invention, the sound source selection unit extracts feature data related to the recorded content from the access log, and assigns it beforehand to a feature index value composed of the feature data. The selected sound source data is selected.

  Also, in one configuration example of the access log monitoring device according to the present invention, the sound source selection unit classifies the extracted feature data, and the sound source data preliminarily assigned to the feature index value composed of the classification is obtained. It is what you choose.

  Also, in one configuration example of the access log monitoring device according to the present invention, the access log acquisition unit sequentially acquires the access log related to the access according to the occurrence of the access, and the sound source selection unit acquires The sound source data is sequentially selected for each access log, and the sound processing unit sequentially reproduces the selected sound source data.

  Also, in one configuration example of the access log monitoring device according to the present invention, when the access log acquisition unit acquires the access log, the access log acquisition unit acquires a plurality of access logs as a single log file, and the sound source selection unit The sound source data is selected for each access log included in the acquired log file, and the sound processing unit sequentially reproduces the selected sound source data.

The configuration example of the access log monitoring device according to the present invention stores an allocation table indicating an allocation relationship between the feature index value related to the recorded contents of the access log and the sound source data for each access type of the access. An allocation table storage unit is further provided, and the sound source selection unit is previously allocated from the allocation table storage unit to the access type of the access to be recorded in the access log when selecting the sound source data. The sound source data corresponding to the feature index value is selected with reference to an allocation table.

  The configuration example of the access log monitoring apparatus according to the present invention further includes a sound source data generation unit that generates sound source data specific to a specified sound source parameter, and the sound source selection unit selects the sound source data. At this time, a feature index value related to the recorded content is extracted from the access log, and a sound source parameter obtained by converting the feature index value is output to the sound source data generation unit. Based on the sound source parameter, the sound source data generation unit Is selected as the sound source data.

  Also, in one configuration example of the access log monitoring device according to the present invention, the sound processing unit sequentially connects the sound source data and outputs it as one sound data, instead of reproducing the selected sound source data. It is a thing.

  The access log monitoring method according to the present invention includes an access log acquisition step for acquiring an access log indicating the details of the access, recorded for each access to the computer, and for each acquired access log. A sound source selecting step for selecting sound source data corresponding to the recorded content of the access log; and a sound processing step for reproducing the selected sound source data.

  The program according to the present invention is a program for causing a computer to function as each unit constituting the access log monitoring apparatus described above.

  According to the present invention, the contents of access to the computer from the user terminal are made audible rather than visualized and notified to the administrator. This eliminates the need for the administrator to visually check the access log on the screen, which not only reduces oversights and errors, but also eliminates the need for manual operation for selecting the access log. It can be used for work other than monitoring.

  For this reason, it becomes possible to grasp | ascertain the characteristic of the access content regarding each access instantly with little work burden. In particular, since the reproduction result of the sound source data has a certain degree of musicality, the monitoring work can be performed with enjoyment, and an effect of reducing the work burden on the administrator can be obtained. Also, reproduction of sound source data based on such an access log having random contents can be used for creating instructions with various patterns.

It is a block diagram which shows the structure of the access log monitoring apparatus concerning 1st Embodiment. It is an example of a structure of an access log. It is a structural example of an allocation table. It is a flowchart which shows the access log monitoring process concerning 1st Embodiment. It is explanatory drawing which shows the example of selection of the sound source data concerning 1st Embodiment. It is an example of an output of an audio signal concerning a 1st embodiment. It is a flowchart which shows the access log monitoring process concerning 2nd Embodiment. It is explanatory drawing which shows the example of selection of the sound source data concerning 2nd Embodiment. It is an example of an output of an audio signal concerning a 2nd embodiment. It is a structural example of an allocation table memory | storage part. It is a block diagram which shows the structure of the access log monitoring apparatus concerning 4th Embodiment. It is explanatory drawing which shows the production | generation process of sound source data.

Next, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
First, an access log monitoring device 10 according to the first exemplary embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram illustrating a configuration of an access log monitoring apparatus according to the first embodiment.

  The access log monitoring device 10 is composed of an information processing device such as a server device or a personal computer as a whole, is connected to a computer 20 to be monitored via a communication network NW, and is connected from a user terminal 30 via a communication network NW. Each access to the computer 20 has a function of acquiring and monitoring an access log recorded by the computer 20.

The computer 20 is composed of an information processing device such as a server device as a whole, and according to access from the user terminal 30, various network services such as information distribution such as news, advertisement distribution, Web search, shopping, auction, It has a function to be provided alone or in combination.
The user terminal 30 is composed of an information communication terminal such as a personal computer, a tablet, or a smart phone, and has a function of accessing the computer 20 according to a user operation and using various network services.

  In the invention according to the present embodiment, the access log monitoring apparatus 10 selects and reproduces sound source data corresponding to the contents of the access log for each access log acquired from the computer 20. In the present embodiment, a real-time monitoring operation in which, when an access log is recorded in response to the occurrence of an access in the computer 20, the access log is sequentially acquired and sound source data corresponding to the content is reproduced will be described as an example. To do.

[Access log monitoring device]
Next, the configuration of the access log monitoring apparatus 10 according to the present embodiment will be described in detail with reference to FIG.
The access log monitoring device 10 includes an access log acquisition unit 11, a log data storage unit 12, an allocation table storage unit 13, a sound source data storage unit 14, a sound source selection unit 15, and a sound processing unit 16 as main function units. Is provided.

  Among these functional units, the access log acquisition unit 11, the sound source selection unit 15, and the audio processing unit 16 are realized by an arithmetic processing unit that executes various processes by executing a program on the CPU. Further, the log data storage unit 12, the allocation table storage unit 13, and the sound source data storage unit 14 are configured by a storage device such as a hard disk or a semiconductor memory.

  The access log acquisition unit 11 is recorded for each access from the user terminal 30 to the computer 20 by performing data communication with the computer 20 set in advance as a monitoring target via the communication line L and the communication network NW. Each access log indicating the details of the access is acquired and stored in the log data storage unit 12.

The log data storage unit 12 has a function of storing the access log acquired by the access log acquisition unit 11.
FIG. 2 is a configuration example of an access log. The access log is data indicating details of access from the user terminal 30 to the computer 20. Here, an example is shown in which, when the access type is an advertisement, that is, the details of access related to the selection operation for the advertisement displayed on the screen viewed by the user are recorded as an access log.

  In the example of FIG. 2, the access date and time when the access occurred, the IP domain of the computer 20 as the access destination, the advertisement identification ID for identifying the advertisement that the user has selected (clicked or tapped), the user terminal User address indicating 30 addresses, user ID indicating user-specific ID, user gender indicating user gender, age, and location, user age, and user location, PC, tablet, smartphone, and other users Recording items such as a terminal type of the terminal 30 and a robot flag indicating whether or not the access is a robot type search are recorded as an access log.

The allocation table storage unit 13 has a function of storing an allocation table indicating the allocation relationship between the feature data extracted from the access log and the feature index value including the classification and the sound source data.
FIG. 3 is a configuration example of the allocation table. In the allocation table, for each selected advertisement ID included in the access log shown in the example of FIG. 2, a file name of sound source data to be output when an advertisement corresponding to the selected advertisement ID is selected is registered. Has been. The signal waveform is a reference example showing the signal waveform of the sound source data. Here, the file name of the sound source data to be output when the feature index value extracted from the access log and the corresponding feature index value are not registered in the allocation table is also registered.

  The sound source data storage unit 14 has a function of storing sound source data assigned to each feature index value. The sound source data is, for example, an audio file in wav format or mpg format, and is registered in advance.

  For each access log acquired by the access log acquisition unit 11 and stored in the log data storage unit 12, the sound source selection unit 15 has a function of extracting feature data related to recorded contents from the access log and a feature including the extracted feature data It has a function of selecting sound source data assigned in advance to the index value and outputting it to the sound processing unit 16.

  At this time, the sound source selection unit 15 may extract feature data related to the recorded contents from the access log, and select sound source data assigned in advance to a feature index value made up of the feature data. Alternatively, the extracted feature data may be classified, and sound source data assigned in advance to the feature index value composed of the classification may be selected.

  The audio processing unit 16 performs a decoding process for decoding the sound source data output from the sound source selection unit 15 into an audio signal, and a speaker or an earphone (both not shown) using the obtained audio signal as an access log monitoring result. Output function.

[Operation of First Embodiment]
Next, the operation of the access log monitoring apparatus 10 according to the present embodiment will be described with reference to FIG. FIG. 4 is a flowchart illustrating an access log monitoring process according to the first embodiment.

  The access log monitoring device 10 executes the access log monitoring process shown in FIG. 4 when monitoring the access log of the computer 20 that has been designated as a monitoring target in advance in accordance with an operation from the administrator. When executing the monitoring process, it is assumed that an allocation table is registered in advance in the allocation table storage unit 13 and various sound source data are registered in the sound source data storage unit 14 in advance.

  First, the access log acquisition unit 11 connects to the computer 20 and waits until a new access log is recorded (step 100), and according to the recording of the new access log (step 100: YES), the access log Is stored in the log data storage unit 12 (step 101).

  Next, the sound source selection unit 15 reads the access log stored in the log data storage unit 12, extracts feature data regarding the recorded contents from the access log (step 102), and is registered in the allocation table storage unit 13. With reference to the assignment table, sound source data assigned in advance to the feature index value composed of the extracted feature data is selected and output to the sound processing unit 16 (step 103).

Subsequently, the audio processing unit 16 decodes the sound source data output from the sound source selecting unit 15 into an audio signal, and reproduces and outputs this audio signal from a speaker or an earphone as an access log monitoring result (step 104).
Thereafter, it is confirmed whether or not the monitoring end is instructed by an operation from the administrator (step 105). If the monitoring end is not instructed (step 105: NO), the process returns to step 100 and a new access log is recorded. Wait until On the other hand, when the end of monitoring is instructed (step 105: YES), the series of monitoring processes is ended.

  FIG. 5 is an explanatory diagram of an example of selecting sound source data according to the first embodiment. First, when the access log LOG1 is acquired at time T1, the selected advertisement ID is “SIGxxx001”, and therefore the sound source data “ping.wav” is selected based on the allocation table of FIG. Next, when the access log LOG2 is acquired at time T2, since the selected advertisement ID is “SIGxxx003”, the sound source data “beep.wav” is selected in the same manner.

  Thereafter, when the access log LOG3 is acquired at time T3, the selected advertisement ID is “SIGxxx009” and the corresponding feature index value is not registered in the allocation table. “Peep.wav” is selected. Subsequently, when the access log LOG4 is acquired at time T4, since the selected advertisement ID is “SIGxxx002”, the sound source data “pong.wav” is selected in the same manner.

FIG. 6 is an example of an audio signal output according to the first embodiment. Here, an output example corresponding to the selection example of the sound source data in FIG. 5 is shown.
First, sound source data “ping.wav” is selected at time T1 and a corresponding audio signal is output, and sound source data “beep.wav” is selected at time T2 and a corresponding audio signal is output. . Thereafter, the sound source data “peep.wav” is selected at time T3 and the corresponding audio signal is output, and the sound source data “pong.wav” is selected at time T4 and the corresponding audio signal is output. Yes.

  Since these audio signals are reproduced almost in synchronization with access to the computer 20, the administrator can monitor the user's selection operation for a specific advertisement in real time. Note that the audio processing unit 16 may save the reproduction results of these audio signals as a single audio data “yahoo.xxx.mpg”. At this time, the silent interval between the audio signals may be stored as it is together with the audio signal, or only the audio signal may be stored at a fixed interval without the silent interval.

[Assign sound source data]
As for the allocation of sound source data to the characteristic index values in the allocation table, it is possible to improve the efficiency of monitoring work by the administrator by allocating characteristic sound source data for the access to be monitored.
For example, when it is desired to monitor that the user has selected and operated the advertisement A, the sound source data having a frequency lower to some extent than the other sound source data is assigned to the feature index value of the advertisement A. It can be easily distinguished from the selection operation for the advertisement.

  The sound source data may be any audio signal that can be identified by humans. For example, in addition to the sound frequency (scale), elements such as tone, time length, envelope, amplitude (volume), sweep (frequency change), chords, It may be used alone or in combination. At this time, as standard sound source data, it may be expressed by the difference in waveform shape such as sine wave, triangle wave, rectangular wave, noise, duty ratio, etc. More complicated difference in instruments such as piano, guitar, violin, flute But you can. Furthermore, a sampled audio signal may be used.

  Moreover, sound source data reminiscent of access to be monitored may be assigned. For example, when an advertisement selection operation is monitored, a part of the sound flowing on the television CM of the advertisement may be assigned. Alternatively, when it is desired to monitor a successful bid in an auction service, a sound of a successful bid hammer that is sounded at the time of an actual successful bid may be assigned. In addition, in order to monitor unauthorized access, different alarm sounds such as police cars and fire trucks may be assigned to the contents and differences of unauthorized access to be monitored.

[Effect of the first embodiment]
Thus, in the present embodiment, for each access log acquired by the access log acquisition unit 11, the sound source selection unit 15 selects sound source data corresponding to the recorded contents of the access log, and the audio processing unit 16 selects The generated sound source data is reproduced.

  As a result, the contents of access from the user terminal 30 to the computer 20 are made audible instead of being visualized and notified to the administrator. This eliminates the need for the administrator to visually check the access log on the screen, which not only reduces oversights and errors, but also eliminates the need for manual operation for selecting the access log. It can be used for work other than monitoring.

  For this reason, it becomes possible to grasp | ascertain the characteristic of the access content regarding each access instantly with little work burden. In particular, since the reproduction result of the sound source data has a certain degree of musicality, the monitoring work can be performed with enjoyment, and an effect of reducing the work burden on the administrator can be obtained. Also, reproduction of sound source data based on such an access log having random contents can be used for creating instructions with various patterns.

  Further, not only the reproduction of the sound source data based on the access log but also an image / video based on the access log may be combined. As a result, the content of access from the user terminal 30 to the computer 20 is made audible and visualized and notified to the administrator. Therefore, the administrator can monitor the access log with both ears and eyes, can easily identify more monitoring targets, and can create more diverse instructions.

  In the present embodiment, the sound source selection unit 15 may extract feature data related to the recorded content from the access log, and select sound source data that is assigned in advance to the feature index value composed of the feature data. Good. As a result, the sound source data corresponding to the recorded contents of the access log can be reproduced.

  In the present embodiment, the sound source selection unit 15 may classify the extracted feature data, and may select sound source data that has been assigned in advance to the feature index value including the classification. As a result, for access logs with similar feature data, the same sound source data is reproduced, so not only the number of sound source data required for monitoring can be reduced, but also the administrator can easily grasp the access contents. be able to.

Further, in the present embodiment, when an access log is recorded according to the occurrence of an access in the computer 20, a real-time monitoring operation in which the access log is sequentially acquired and sound source data corresponding to the content is reproduced is taken as an example. However, the sound source data may be batch-reproduced in batch processing instead of real-time reproduction.
In this case, instead of reproducing the sound source data selected by the sound source selection unit 15, the sound processing unit 16 may connect the sound source data in order and output it as one sound data (sound file). As a result, it is possible to monitor the contents of each access log collectively, not at the timing when access occurs, and it is not necessary for the administrator to continue to view the playback output in real time. Further, when reproducing sound source data, it is not necessary to be connected to the computer 20 via the communication network NW, and the sound source data can be reproduced by another device.

[Second Embodiment]
Next, an access log monitoring device 10 according to the second exemplary embodiment of the present invention will be described with reference to FIG. FIG. 7 is a flowchart illustrating an access log monitoring process according to the second embodiment.
In the first embodiment, the real-time monitoring operation has been described as an example. In this embodiment, batch monitoring is performed in which a log file in which a plurality of access logs are combined is acquired from the computer 20, and each access log included in the log file is sequentially monitored to reproduce sound source data. The operation will be described.

The overall configuration of the access log monitoring apparatus 10 according to the present embodiment is the same as that shown in FIG.
In the present embodiment, the access log acquisition unit 11 has a function of acquiring a plurality of access logs as a single log file and storing them in the log data storage unit 12 when acquiring an access log.

  The sound source selection unit 15 reads the log file acquired by the access log acquisition unit 11 and stored in the log data storage unit 12, and for each access log to be stopped included in the log file, feature data relating to the recorded contents from the access log. And a function of selecting sound source data previously assigned to the feature index value composed of the extracted feature data and outputting the selected sound source data to the sound processing unit 16.

[Operation of Second Embodiment]
Next, the operation of the access log monitoring device 10 according to this exemplary embodiment will be described with reference to FIG.
The access log monitoring apparatus 10 executes the access log monitoring process shown in FIG. 7 when monitoring the access logs of the computers 20 designated in advance as monitoring targets in response to an operation from the administrator. When executing the monitoring process, it is assumed that an allocation table is registered in advance in the allocation table storage unit 13 and various sound source data are registered in the sound source data storage unit 14 in advance.

First, the access log acquisition unit 11 is connected to the computer 20 to acquire a log file including a plurality of access logs and store it in the log data storage unit 12 (step 200).
Thereafter, the sound source selection unit 15 reads the log file stored in the log data storage unit 12, and selects one unprocessed access log from the top of the file (from the oldest access date and time) (step 201).

  Next, the sound source selection unit 15 extracts feature data related to the recorded contents from the selected access log (step 202), and refers to the assignment table registered in the assignment table storage unit 13 from the extracted feature data. The sound source data previously assigned to the feature index value is selected and output to the sound processing unit 16 (step 203).

Subsequently, the audio processing unit 16 decodes the sound source data output from the sound source selection unit 15 into an audio signal, and reproduces and outputs this audio signal from a speaker or an earphone as an access log monitoring result (step 204).
Thereafter, it is confirmed whether or not an unprocessed access log exists in the log file (step 205). If an unprocessed access log exists (step 205: YES), the process returns to step 201 and a new unprocessed access log is obtained. Select. On the other hand, when all the access log processes have been completed (step 205: NO), the series of monitoring processes is terminated.

  FIG. 8 is an explanatory diagram of an example of selecting sound source data according to the second embodiment. Here, the access logs LOG1, LOG2, LOG3, and LOG4 are read from the log file at regular intervals t. Here, since the selection advertisement IDs of the access logs LOG1, LOG2, LOG3, and LOG4 are “SIGxxx001”, “SIGxxx003”, “SIGxxxx009”, and “SIGxxx002”, these are selected based on the allocation table of FIG. The sound source data “ping.wav”, “beep.wav”, “peep.wav”, “pong.wav” corresponding to the advertisement ID are selected in order.

FIG. 9 is an example of an audio signal output according to the second embodiment. Here, an output example corresponding to the selection example of the sound source data in FIG. 8 is shown, and the sound source data “ping.wav”, “beep.wav”, “peep.wav”, “pong” is shown at regular intervals t. .Wav "is output.
Since these audio signals can be reproduced at regular intervals t and further in accordance with a preset rhythm, it is possible to exhibit higher musicality than the first embodiment. Note that the audio processing unit 16 may save the reproduction results of these audio signals as a single audio data “yahoo.xxx.mpg”.

[Effect of the second embodiment]
Thus, in this embodiment, when the access log acquisition unit 11 acquires an access log, a plurality of access logs are acquired as a single log file, and the sound source selection unit 15 is included in the acquired log file. The sound source data is selected for each access log, and the sound processing unit 16 sequentially reproduces the selected sound source data.

  As a result, even in the case of a batch monitoring operation instead of a real-time monitoring operation, the contents of access from the user terminal 30 to the computer 20 are made audible rather than visualized, as in the first embodiment. You will be notified. This eliminates the need for the administrator to visually check the access log on the screen, which not only reduces oversights and errors, but also eliminates the need for manual operation for selecting the access log. Cannot be used for work other than monitoring.

  In addition to this, it is possible to monitor the contents of each access log at a time, not at the timing when access occurs, and it is not necessary for the administrator to continue to view the playback output in real time. For this reason, the time required for monitoring can be shortened, and the work burden on the administrator can be greatly reduced.

[Third Embodiment]
Next, an access log monitoring device 10 according to the third exemplary embodiment of the present invention will be described. In the first and second embodiments, the case where there is one allocation table has been described as an example. In the present embodiment, a case will be described in which a plurality of allocation tables are used by being switched and selected according to the access type.

The computer 20 to be monitored is provided with various network services such as information distribution such as news, advertisement distribution, Web search, shopping, auction, etc. depending on access from the user terminal 30 singly or in combination. .
Therefore, since the access to be monitored is different for each service, it is necessary to switch the sound source data to be assigned to the feature index value even when the sound source data is assigned according to the recorded contents of the access log even if the feature index value is the same.

For example, when monitoring access to automobile advertisements, access by males is relatively likely to be a purchaser, so it is effective to assign sound source data that is easier to distinguish. Therefore, the effect of assigning sound source data that is easy to distinguish is low.
On the other hand, when monitoring access to advertisements on accessories, it is more effective to assign sound source data that is easier to distinguish because access by women is relatively likely to be a purchaser. Therefore, the effect of assigning sound source data that is easy to distinguish is low.

  In the present embodiment, the allocation table storage unit 13 stores an allocation table indicating the allocation relationship between feature index values and sound source data for each access type, and the sound source selection unit 15 selects sound source data. The sound source data corresponding to the feature index value is selected from the assignment table storage unit 13 by referring to the assignment table previously assigned to the access type of the access to be recorded in the access log. It is.

  FIG. 10 is a configuration example of the allocation table storage unit. Here, “cm_car.tbl”, “cm_accessory.tbl”, “search.tbl” for each access type such as “advertisement / automobile”, “advertisement / accessory”, “search”, “shopping”, “auction”, etc. , “Shopping.tbl”, “action.tbl” and the like are associated with each other.

[Effect of the third embodiment]
As described above, in the present embodiment, when the sound source selection unit 15 selects sound source data, the assignment table storage unit 13 assigns an assignment that is assigned in advance to the access type of the access to be recorded in the access log. The sound source data corresponding to the feature index value is selected with reference to the table.
As a result, the assignment of the sound source data to the feature index value can be switched according to the access type, and the access log can be monitored more efficiently.

[Fourth Embodiment]
Next, an access log monitoring device 10 according to the fourth exemplary embodiment of the present invention will be described with reference to FIG. FIG. 11 is a block diagram illustrating a configuration of an access log monitoring apparatus according to the fourth embodiment.
In the first to third embodiments, the case where a plurality of sound source data is registered in advance in the sound source data storage unit 14 has been described as an example. In the present embodiment, a case will be described in which sound source data is generated based on the recorded contents of an access log.

  In FIG. 11, instead of the allocation table storage unit 13 and the sound source data storage unit 14 shown in FIG. 1, a sound source data generation unit 17 that generates sound source data unique to the sound source parameter based on the specified sound source parameter. Is provided.

  FIG. 12 is an explanatory diagram showing a generation process of sound source data. The sound source data represents the amplitude of a signal waveform with a sound source parameter composed of a digital value. For example, FIG. 12 shows an example in which the amplitude of the signal waveform is expressed by a digital value by assigning a 16-bit code from 0 to f to the amplitude of the signal waveform, that is, by performing a decoding process. If the amplitude indicated by the digital value is converted into a sound signal and reproduced and output from a speaker or earphone, the sound is notified.

  On the other hand, the recorded contents of the access log include some items to be monitored, and the data of these items can be converted into fixed-length digital values. For example, a known hash function called MD5 (Message Digest Algorithm 5) is a summary function that summarizes and outputs a 128-bit hash value for a given input.

Therefore, the feature index value extracted from the access log can be converted into a sound source parameter composed of a fixed-length digital value by a summary function such as a hash function, and sound source data can be generated based on the sound source parameter.
Note that conversion to sound source parameters is not limited to a summary function that converts and outputs a fixed-length digital value. If the length of sound source data can be changed, a variable-length digital value is converted and output. It may be a function.

[Effect of the fourth embodiment]
As described above, the present embodiment includes the sound source data generation unit 17 that generates sound source data specific to the designated sound source parameter, and when the sound source selection unit 15 selects the sound source data, the recorded contents are obtained from the access log. Is extracted to the sound source data generation unit 17, and the sound source data generated by the sound source data generation unit 17 based on the sound source parameters is output as the sound source data. The data is selected.

  As a result, unique sound source data is generated and reproduced for each feature index value extracted from the access log. At this time, since the sound source data generation unit 17 can be realized by software, it is not necessary to provide the allocation table storage unit 13 and the sound source data storage unit 14, and the circuit scale can be reduced.

  At this time, as the sound source parameter, the sound source selection unit 15 may classify the feature data extracted from the access log, and use a value obtained by converting a feature index value including a classification value indicating the classification. As shown in FIG. 12, when the amplitude of the signal waveform is expressed by a digital value, a person may not be able to hear it with a slight difference in the signal waveform. For this reason, it is possible to easily distinguish target access by classifying each feature data into classification values that can be recognized to some extent by humans, rather than performing summary conversion on the feature data itself extracted from the access log.

[Extended embodiment]
The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. In addition, each embodiment can be implemented in any combination within a consistent range.

  DESCRIPTION OF SYMBOLS 10 ... Access log monitoring apparatus, 11 ... Access log acquisition part, 12 ... Log data storage part, 13 ... Allocation table storage part, 14 ... Sound source data storage part, 15 ... Sound source selection part, 16 ... Sound processing part, 17 ... Sound source Data generation unit, 20 ... computer, 30 ... user terminal, NW ... communication network, L ... communication line.

Claims (10)

An access log acquisition unit that acquires an access log indicating the details of the access recorded for each access to the computer;
A sound source selection unit that selects sound source data corresponding to the recorded contents of the access log for each acquired access log,
An access log monitoring device comprising: an audio processing unit that reproduces the selected sound source data. The access log monitoring device according to claim 1,
The sound source selection unit extracts feature data related to the recorded content from the access log, and selects sound source data pre-assigned to a feature index value made up of the feature data. . In the access log monitoring device according to claim 2,
The access log monitoring device, wherein the sound source selection unit classifies the extracted feature data, and selects sound source data assigned in advance to a feature index value including the classification. In the access log monitoring apparatus according to any one of claims 1 to 3,
The access log acquisition unit sequentially acquires the access log related to the access according to the occurrence of the access,
The sound source selection unit sequentially selects the sound source data for each acquired access log,
The audio processing unit sequentially reproduces the selected sound source data. An access log monitoring apparatus, wherein: In the access log monitoring apparatus according to any one of claims 1 to 3,
The access log acquisition unit acquires a plurality of access logs as a single log file when acquiring the access log,
The sound source selection unit selects the sound source data for each access log included in the acquired log file,
The audio processing unit plays back the selected sound source data in order. In the access log monitoring device according to any one of claims 2 to 5,
For each access type of access, an allocation table storage unit that stores an allocation table indicating an allocation relationship between the feature index value related to the recorded content of the access log and the sound source data is further provided,
When the sound source selection unit selects the sound source data, the allocation table storage unit refers to an allocation table previously allocated to the access type of the access to be recorded in the access log, with reference to the allocation table. An access log monitoring device, wherein the sound source data corresponding to a feature index value is selected. In the access log monitoring apparatus according to any one of claims 2 to 6,
A sound source data generation unit for generating sound source data specific to the specified sound source parameter;
When selecting the sound source data, the sound source selection unit extracts a feature index value related to the recorded content from the access log, and outputs a sound source parameter obtained by converting the feature index value to the sound source data generation unit And selecting the sound source data generated by the sound source data generation unit based on the sound source parameter as the sound source data. In the access log monitoring apparatus according to any one of claims 1 to 7,
The audio processing unit is characterized in that, instead of reproducing the selected sound source data, the sound source data is sequentially connected and output as one sound data. An access log acquisition step for acquiring each access log indicating the details of the access, recorded for each access to the computer;
For each acquired access log, a sound source selection step for selecting sound source data corresponding to the recorded content of the access log;
An access log monitoring method comprising: an audio processing step of reproducing the selected sound source data.   The program for functioning a computer as each part which comprises the access log monitoring apparatus as described in any one of Claims 1-8.

Images