JP7180073B2 - Judgment program, judgment method, and judgment device - Google Patents

Description

The present invention relates to a determination program, a determination method, and a determination device.

Conventionally, security administrators monitor unauthorized operations by employees, and when detecting unauthorized operations, take countermeasures against the unauthorized operations. For example, a security manager collects a history of operations performed by an employee on a PC (Personal Computer), evaluates the legitimacy of the operation based on the collected operation history, and takes countermeasures when an unauthorized operation is discovered. implement. An illegal operation is, for example, the taking out of confidential information.

As a prior art, for example, there is a technique that estimates a user characteristic indicating a user's action pattern or thought pattern based on a history of personal information generated based on data obtained from user's actions or operations. Also, for example, there is a technique for determining whether security inventory information or operation log information conforms to a preset security policy. In addition, for example, during the transition from thinking to action, low-erosion history information in which there is no intra-thought reconstruction of behavior assuming a third-person perspective is obtained from observed action history records that include state sets and transition sets. There are techniques to acquire and create thought models.

JP 2014-002441 A Japanese Patent Application Laid-Open No. 2008-304968 JP 2012-053716 A

However, the conventional technology increases the burden on security administrators for evaluating specific operations. For example, security administrators will evaluate the legitimacy of officially permitted operations in line with the diversification of business forms and business environments, and may conduct interviews with employees. There is

In one aspect, an object of the present invention is to reduce the burden of evaluating specific operations.

According to one embodiment, referring to a storage unit that stores a history of user operations in association with attributes of the user, generating evaluation criteria for specific operations for each attribute of the user, Based on the attributes, identifying the evaluation criteria related to the specific operation by any of the users among the generated evaluation criteria, and detecting the specific operation by any of the users, any of the user A determination program, a determination method, and a determination device for determining whether or not the specified operation by satisfies the specified evaluation criteria are proposed.

According to one aspect, it is possible to reduce the evaluation burden for a specific operation.

FIG. 1 is an explanatory diagram of an example of a determination method according to an embodiment. FIG. 2 is an explanatory diagram showing an example of the determination system 200. As shown in FIG. FIG. 3 is a block diagram showing a hardware configuration example of the determination device 100. As shown in FIG. FIG. 4 is an explanatory diagram showing an example of the contents of the personnel information DB 400. As shown in FIG. FIG. 5 is an explanatory diagram showing an example of the contents stored in the business behavior pattern information DB 500 for job responsibilities. FIG. 6 is an explanatory diagram showing an example of the contents stored in the business behavior pattern information DB 600 for affiliation. FIG. 7 is an explanatory diagram showing an example of the contents stored in the work behavior pattern information DB 700 for work patterns. FIG. 8 is an explanatory diagram showing an example of the contents stored in the business behavior pattern information DB 800 for job types. FIG. 9 is an explanatory diagram showing an example of the contents stored in the business behavior pattern information DB 900 for persons in charge. FIG. 10 is an explanatory diagram showing an example of the contents stored in the property information DB 1000. As shown in FIG. FIG. 11 is an explanatory diagram showing an example of the contents stored in the work environment pattern information DB 1100 for affiliation. FIG. 12 is an explanatory diagram showing an example of the contents stored in the work environment pattern information DB 1200 for work patterns. FIG. 13 is an explanatory diagram showing an example of the contents of the operation history 1300. As shown in FIG. FIG. 14 is a block diagram showing a hardware configuration example of the terminal device 201. As shown in FIG. FIG. 15 is a block diagram showing a functional configuration example of the determination device 100. As shown in FIG. FIG. 16 is an explanatory diagram (part 1) showing an embodiment of the determination system 200. As shown in FIG. FIG. 17 is an explanatory diagram (part 2) showing an embodiment of the determination system 200. As shown in FIG. FIG. 18 is an explanatory diagram (part 3) showing an embodiment of the determination system 200. As shown in FIG. FIG. 19 is an explanatory diagram (part 4) showing an embodiment of the determination system 200. As shown in FIG. FIG. 20 is an explanatory diagram (No. 5) showing an embodiment of the determination system 200. As shown in FIG. FIG. 21 is an explanatory diagram (No. 6) showing an embodiment of the determination system 200. As shown in FIG. FIG. 22 is an explanatory diagram (No. 7) showing an embodiment of the determination system 200. As shown in FIG. FIG. 23 is an explanatory diagram (No. 8) showing an embodiment of the determination system 200. As shown in FIG. FIG. 24 is an explanatory diagram (No. 9) showing an embodiment of the determination system 200. As shown in FIG. FIG. 25 is an explanatory diagram (No. 10) showing an embodiment of the determination system 200. As shown in FIG. FIG. 26 is an explanatory diagram (No. 11) showing an embodiment of the determination system 200. As shown in FIG. FIG. 27 is a flowchart illustrating an example of an overall processing procedure; FIG. 28 is a flowchart illustrating an example of a business behavior determination processing procedure. FIG. 29 is a flowchart illustrating an example of a business environment determination processing procedure.

Exemplary embodiments of a determination program, a determination method, and a determination device according to the present invention will be described below in detail with reference to the drawings.

(One example of the determination method according to the embodiment)
FIG. 1 is an explanatory diagram of an example of a determination method according to an embodiment. In FIG. 1, a determination device 100 is a computer that determines whether a specific user operation satisfies evaluation criteria for a specific user operation. A user is a person who uses a device different from the determination device 100 . A device different from the determination device 100 is, for example, a PC. A user is, for example, an employee belonging to an organization such as a company or government office.

Certain operations are operations that are preferable for security monitoring. A specific operation may be, for example, a business-unauthorized operation. The specific operation is specifically an operation of bringing out information. The specific operation may specifically be the operation of decrypting encrypted information. Specifically, the specific operation may be an operation of accessing information via a network, an operation of handling information outside the company, or the like. Evaluation criteria are criteria for evaluating the correctness of a specific operation. An evaluation criterion is, for example, a criterion for evaluating whether a specific operation is a legitimate operation in terms of the user's business or an illegal operation.

Here, if a user belonging to the organization performs a specific operation such as taking out confidential information illegally in the course of business, there is a risk that damage will occur to the organization and the credibility of the organization will be damaged. be. For this reason, there is a tendency to desire to improve security by implementing measures in advance or after the fact with respect to specific operations that are illegal in business.

On the other hand, there may be a case where a specific operation by the user is fundamentally prohibited. For example, it is conceivable that a specific operation on a PC by a user is prohibited using software to improve security. However, in this case, due to the diversification of business forms and business environments, it cannot be applied to situations where some users formally want to perform specific operations on business, and user convenience is reduced. invites

On the other hand, it is conceivable that a specific operation by a user is basically prohibited, and a specific operation by some users is uniformly permitted as an exception. However, in this case, if some users perform unauthorized operations in the course of business, it will be difficult to implement countermeasures in advance or after the fact, and security will be compromised. I invite you.

For this reason, a security administrator collects the history of operations performed by the user on the PC, and based on the collected operation history, evaluates whether or not a specific operation by the user is legitimate in business, It is conceivable that countermeasures may be implemented when a specific operation is discovered. The evaluation is made, for example, based on interviews with users. However, in this case, the security administrator's burden is increased.

For example, some users may formally perform specific operations in the course of business, so the collected history of operations includes a mixture of records related to specific formal operations and records related to specific unauthorized operations. It will be. In addition, the security administrator will have to evaluate the formal specific operation and interview the user, which will increase the burden on the security administrator. In addition, an increase in the burden on the user who conducts the interview survey is also invited.

Therefore, in the present embodiment, an evaluation criterion for a specific operation is generated for each user attribute based on the user's operation history. A determination method for determining whether the criteria are met will be described. According to this, the determination method can support the evaluation of the specific operation by the security administrator, and can reduce the evaluation burden of the specific operation.

(1-1) The determination device 100 refers to the storage unit and generates evaluation criteria regarding specific operations for each attribute of the user. Attributes are, for example, job duties, affiliations, and work styles. The specific operation is, for example, an operation of taking out confidential information. Evaluation criteria are criteria for evaluating the correctness of a specific operation. The evaluation criteria represent, for example, time slots during which specific operations are permitted.

The storage unit stores a history 110 of user operations in association with user attributes. The operation history is a DB (Data Base) that collects records for each operation. The storage unit stores, for example, an operation history 1300, which will be described later with reference to FIG. A record is set with information related to the operation by the user. The information about the user's operation includes, for example, information representing the point in time when the user's operation was performed. The determination device 100 may generate and store one or more evaluation criteria 120, for example.

(1-2) The determination device 100 identifies, from among the generated evaluation criteria, evaluation criteria relating to a specific operation by one of the users, based on one of the user's attributes. For example, when detecting a specific operation by any user, the determination device 100 specifies an evaluation criterion related to the specific operation associated with each attribute of any user. Specifically, the determination device 100 identifies, from among the evaluation criteria 120, an evaluation criterion that represents a time period during which a specific operation is permitted, which is associated with one of the attributes of the user.

(1-3) When detecting a specific operation by any user, the determination device 100 determines whether or not the specific operation by any user satisfies the specified evaluation criteria. The determination device 100, for example, extracts a history 130 of specific operations by the user stored in the storage unit. Then, when the determination device 100 detects a record related to a specific operation by any user from the history 130 of the specific operation by the extracted user, the determination device 100 determines whether the specific operation by any user satisfies the evaluation criteria. judge.

Specifically, the determination device 100 determines whether or not the time when the specific operation by the user “Mr. B” is performed is included in the time zone in which the specific operation represented by the evaluation criteria is permitted. In the example of FIG. 1 , the determination device 100 determines that the time when the specific operation by the user “Mr. It is determined that the specific operation by "Mr. B" is illegal in business.

After that, the determination device 100 may output the determined result. The output format is, for example, display on a display, print output to a printer, transmission to an external device, storage in a storage area, or the like. For example, the determination device 100 associates the determination result with the user's operation history and displays it on the display, and associates the determination result with the user's operation history so that the security administrator can grasp it.

As a result, the determination device 100 can reduce the burden of evaluating a specific operation. The determination device 100 can, for example, allow the security administrator to refer to the result of determining whether or not a specific operation satisfies the evaluation criteria, which represents the result of evaluating the validity of a specific operation. For this reason, the security administrator should give priority to investigating and evaluating the legitimacy of any specific operation among the specific operations performed by multiple users, which has a relatively high probability of being performed illegally. is preferable.

As a result, the security administrator can reduce the burden of evaluating specific operations by multiple users. In addition, if there is a specific illegal operation in business, the security administrator can take measures against the specific illegal operation in business and efficiently improve security. In addition, if the burden of evaluating specific operations by multiple users is reduced, security administrators will be more likely to focus on evaluating specific operations that are more likely to have been performed fraudulently. Accuracy can be improved, and unauthorized operations can be hardly overlooked.

In addition, the determination device 100 can be applied to a situation in which some users formally desire to perform a specific operation on business due to the diversification of business forms and business environments, and the user's convenience can be improved. can be maintained. In addition, the determination device 100 can reduce the possibility that some users who formally perform specific operations in the course of business will be interviewed by the security administrator. Therefore, the determination device 100 can reduce the burden on the user who conducts the interview survey.

Here, a case where the determination device 100 generates evaluation criteria for a specific operation for each user attribute has been described, but the present invention is not limited to this. For example, the determination device 100 may store in advance evaluation criteria regarding specific operations for each attribute of the user. Specifically, the determination device 100 receives input of evaluation criteria regarding specific operations for each attribute of the user, and stores evaluation criteria regarding specific operations for each attribute of the user. Also, the determination device 100 may use both the generated evaluation criteria and the pre-stored evaluation criteria.

Here, a case has been described where the determination device 100 generates evaluation criteria for a specific operation for each user attribute, regardless of whether it is before or after detecting a specific operation by any user. do not have. For example, after detecting a specific operation by any user, the determination device 100 may generate evaluation criteria regarding the specific operation for each attribute of any user.

(Example of determination system 200)
Next, an example of a determination system 200 to which the determination device 100 shown in FIG. 1 is applied will be described using FIG.

FIG. 2 is an explanatory diagram showing an example of the determination system 200. As shown in FIG. In FIG. 2 , the determination system 200 includes a determination device 100 , an information storage device 203 , a security administrator's terminal device 201 , and a user's terminal device 202 .

In the determination system 200 , the determination device 100 , the information storage device 203 , the terminal device 201 of the security administrator, and the terminal device 202 of the user are connected via a wired or wireless network 210 . The network 210 is, for example, a LAN (Local Area Network), a WAN (Wide Area Network), or the Internet.

The determination device 100 is a computer that refers to information on user operations accumulated in the information storage device 203 and determines whether or not a specific user operation satisfies evaluation criteria. The determination device 100 outputs the determination result to the terminal device 201 of the security administrator. The determination device 100 is, for example, a server, a PC, or the like.

The information storage device 203 is a computer that collects information about user operations on the terminal device 202 and stores the information using an operation history 1300 described later with reference to FIG. 13 . The information storage device 203 enables the determination device 100 to refer to information regarding the user's operation on the terminal device 202 . The information storage device 203 is, for example, a server or a PC.

The security administrator's terminal device 201 is a computer used by the security administrator of the determination system 200 . A security administrator is, for example, a person who belongs to an organization such as a company or government office. The terminal device 201 of the security administrator receives the result of determination by the determination device 100 and allows the security administrator to refer to the result of determination by the determination device 100 . The security administrator's terminal device 201 is, for example, a PC, a tablet terminal, a smart phone, or the like.

The user's terminal device 202 is a computer that accepts user's operations and outputs information about the user's operations to the information storage device 203 . A user is, for example, a person who belongs to an organization such as a company or government office. The user specifically belongs to the same organization as the security administrator. A user's terminal device 202 is, for example, a PC, a tablet terminal, a smartphone, or the like.

Although the case where the security administrator and the user belong to the same organization has been described here, the present invention is not limited to this. For example, the security administrator may be a person who belongs to an organization different from the user, receives a request from the organization, and works to improve the security of the organization.

Here, a case where the determination device 100 is a device different from the information storage device 203, the security administrator's terminal device 201, the user's terminal device 202, etc. has been described, but the present invention is not limited to this. For example, the determination device 100 may be integrated with the information storage device 203 . Further, for example, the determination device 100 may be integrated with the terminal device 201 of the security administrator. Further, for example, the determination device 100 may be integrated with the terminal device 202 of the user.

(Hardware configuration example of determination device 100)
Next, a hardware configuration example of the determination device 100 included in the determination system 200 shown in FIG. 2 will be described using FIG.

FIG. 3 is a block diagram showing a hardware configuration example of the determination device 100. As shown in FIG. In FIG. 3 , the determination device 100 has a CPU (Central Processing Unit) 301 , a memory 302 , a network I/F (Interface) 303 , a recording medium I/F 304 and a recording medium 305 . Also, each component is connected by a bus 300 .

Here, the CPU 301 controls the overall determination device 100 . The memory 302 has, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), a flash ROM, and the like. Specifically, for example, a flash ROM or ROM stores various programs, and a RAM is used as a work area for the CPU 301 . A program stored in the memory 302 is loaded into the CPU 301 to cause the CPU 301 to execute coded processing. The memory 302 stores various tables described later with reference to FIGS. 4 to 13. FIG.

Network I/F 303 is connected to network 210 through a communication line, and is connected to other computers via network 210 . A network I/F 303 serves as an internal interface with the network 210 and controls input/output of data from other computers. For the network I/F 303, for example, a modem, LAN adapter, etc. can be adopted.

A recording medium I/F 304 controls reading/writing of data from/to the recording medium 305 under the control of the CPU 301 . The recording medium I/F 304 is, for example, a disk drive, an SSD (Solid State Drive), a USB (Universal Serial Bus) port, or the like. A recording medium 305 is a nonvolatile memory that stores data written under control of the recording medium I/F 304 . The recording medium 305 is, for example, a disk, a semiconductor memory, a USB memory, or the like. The recording medium 305 may be removable from the determination device 100 . The recording medium 305 may store various tables described later with reference to FIGS. 4 to 13. FIG.

The determination device 100 may have, for example, a keyboard, a mouse, a display, a printer, a scanner, a microphone, a speaker, etc., in addition to the components described above. Further, the determination device 100 may have a plurality of recording medium I/Fs 304 and recording media 305 . Further, the determination device 100 may not have the recording medium I/F 304 and the recording medium 305 .

(Stored content of personnel information DB 400)
Next, an example of contents stored in the personnel information DB 400 will be described with reference to FIG. The personnel information DB 400 is implemented, for example, by a storage area such as the memory 302 or the recording medium 305 of the determination device 100 shown in FIG.

FIG. 4 is an explanatory diagram showing an example of the contents of the personnel information DB 400. As shown in FIG. As shown in FIG. 4, the personnel information DB 400 has fields for user, job responsibility, department, and working style. The personnel information DB 400 stores personnel information by setting information in each field.

Information for identifying a user is set in the user field. Information representing the responsibility, which is a user attribute, is set in the responsibility field. The information representing job responsibilities is, for example, manager, section manager, general, and the like. Information representing the affiliation, which is a user attribute, is set in the affiliation field. The information representing the affiliation is, for example, the general affairs department, the sales department, the development department, and the like. Information representing a work style, which is a user attribute, is set in the work style field.

Here, the case where the personnel information DB 400 has the fields of user, job responsibility, department, and work pattern has been described, but the present invention is not limited to this. For example, the personnel information DB 400 may further have fields for occupation and work in charge. Also, for example, the personnel information DB 400 may not have at least one of the job responsibility, affiliation, work type, job type, and work in charge fields.

Information representing a job type, which is a user attribute, is set in the job type field. The information representing the job type is, for example, a sales job, a CE (Customer Engineer), a development job, and the like. Information representing the user's assigned task is set in the assigned task field. The information representing the task in charge is, for example, the name of the project. Specifically, the information representing the work in charge is manufacturer A Prj, overseas B Prj, government office C Prj, and the like.

(Contents stored in the business behavior pattern information DB 500 for job responsibilities)
Next, with reference to FIG. 5, an example of the contents stored in the business behavior pattern information DB 500 for job responsibilities will be described. The job behavior pattern information DB 500 for job responsibilities is implemented by a storage area such as the memory 302 or the recording medium 305 of the determination device 100 shown in FIG. 3, for example.

FIG. 5 is an explanatory diagram showing an example of the contents stored in the business behavior pattern information DB 500 for job responsibilities. As shown in FIG. 5, the job action pattern information DB 500 for job responsibilities has fields for job responsibilities and outside business hours. The job action pattern information DB 500 for job responsibilities stores job action pattern information for job responsibilities by setting information in each field.

Information representing the user's responsibility is set in the responsibility field. The information representing job responsibilities is, for example, manager, section manager, general, and the like. Information representing the number of operations for taking out information outside business hours is set in the outside business hours field. Business hours are, for example, 9:00 to 18:00. Non-business hours are, for example, from 18:00 to 9:00 the next day. Information indicating the number of take-out operations is, for example, many, few, or none. For example, the information indicating the number of take-out operations may be present or absent.

(Contents stored in the business behavior pattern information DB 600 for affiliation)
Next, an example of the contents stored in the business behavior pattern information DB 600 for affiliation will be described with reference to FIG. The business behavior pattern information DB 600 for affiliation is implemented by a storage area such as the memory 302 or recording medium 305 of the determination device 100 shown in FIG. 3, for example.

FIG. 6 is an explanatory diagram showing an example of the contents stored in the business behavior pattern information DB 600 for affiliation. As shown in FIG. 6, the business behavior pattern information DB 600 for affiliation has fields for affiliation and confidential information taking-out. The business behavior pattern information DB 600 for affiliation stores the business behavior pattern information for affiliation by setting information in each field.

Information representing the user's affiliation is set in the affiliation field. The information representing the affiliation is, for example, the general affairs department, the sales department, the development department, and the like. Information representing the number of confidential information take-out operations is set in the confidential information bring-out field. Information indicating the number of take-out operations is, for example, many, few, or none. For example, the information indicating the number of take-out operations may be present or absent.

(Contents stored in the work behavior pattern information DB 700 for work patterns)
Next, an example of the contents stored in the work behavior pattern information DB 700 for work patterns will be described with reference to FIG. The work behavior pattern information DB 700 for work patterns is realized by a storage area such as the memory 302 or the recording medium 305 of the determination device 100 shown in FIG. 3, for example.

FIG. 7 is an explanatory diagram showing an example of the contents stored in the work behavior pattern information DB 700 for work patterns. As shown in FIG. 7, the work behavior pattern information DB 700 for work style has fields of work style and access permission. The work behavior pattern information DB 700 for work patterns stores work behavior pattern information for work patterns by setting information in each field.

Information representing the user's work style is set in the work style field. The information representing the work style is, for example, normal work, outside permanent work, telework work, and the like. Information representing a storage area to which the user is permitted to access is set in the access permission field. The information representing the storage area is, for example, all file servers, resident file servers, telework file servers, and the like.

(Contents stored in the business behavior pattern information DB 800 for occupation)
Next, an example of the contents stored in the business behavior pattern information DB 800 for job types will be described with reference to FIG. The job behavior pattern information DB 800 for job types is implemented by a storage area such as the memory 302 or the recording medium 305 of the determination device 100 shown in FIG. 3, for example.

FIG. 8 is an explanatory diagram showing an example of the contents stored in the business behavior pattern information DB 800 for job types. As shown in FIG. 8, the business behavior pattern information DB 800 for occupation has fields of occupation and means of carrying out. The business behavior pattern information DB 800 for job types stores the business behavior pattern information for job types by setting information in each field.

Information representing the user's occupation is set in the occupation field. The information representing the job type is, for example, a sales job, a CE, a development job, and the like. In the bring-out means field, information is set that indicates a recording medium that is permitted to be used for the information take-out operation. Information representing a recording medium is, for example, a DVD (Digital Versatile Disc), a HDD (Hard Disk Drive), a USB memory, or the like.

(Stored content of business behavior pattern information DB 900 for person in charge)
Next, an example of the contents stored in the business behavior pattern information DB 900 for the person in charge will be described with reference to FIG. The business behavior pattern information DB 900 for the person in charge is implemented by, for example, a storage area such as the memory 302 or the recording medium 305 of the determination device 100 shown in FIG.

FIG. 9 is an explanatory diagram showing an example of the contents stored in the business behavior pattern information DB 900 for persons in charge. As shown in FIG. 9, the business behavior pattern information DB 900 for charge has fields of charge work and take-out permitted period. The business behavior pattern information DB 900 for the person in charge stores the business behavior pattern information for the person in charge by setting information in each field.

Information representing the user's assigned task is set in the assigned task field. The information representing the task in charge is, for example, the name of the project. Specifically, the information representing the work in charge is manufacturer A Prj, overseas B Prj, government office C Prj, and the like. Information indicating a period during which the take-out operation of the information related to the task in charge can be performed is set in the field of the take-out permitted period.

(Contents stored in asset information DB 1000)
Next, an example of the contents stored in the asset information DB 1000 will be described with reference to FIG. 10 . The asset information DB 1000 is implemented by, for example, a storage area such as the memory 302 or the recording medium 305 of the determination device 100 shown in FIG.

FIG. 10 is an explanatory diagram showing an example of the contents stored in the property information DB 1000. As shown in FIG. As shown in FIG. 10, the asset information DB 1000 has fields for asset name, installation location, patch application status, and HDD encryption. Asset information DB 1000 stores asset information by setting information in each field.

Information for identifying the terminal device 202, which is an asset, is set in the asset name field. Information for identifying the terminal device 202 is, for example, PC001. In the installation location, information representing the location where the terminal device 202 is installed is set. The information representing the location is, for example, the home or office. Information indicating the application status of security patches to the terminal device 202 is set in the patch application status field. For HDD encryption, information indicating whether or not the information in the HDD of the terminal device 202 is encrypted is set.

(Contents stored in the work environment pattern information DB 1100 for affiliation)
Next, an example of the contents stored in the business environment pattern information DB 1100 for affiliation will be described with reference to FIG. The work environment pattern information DB 1100 for affiliation is implemented, for example, by a storage area such as the memory 302 or the recording medium 305 of the determination device 100 shown in FIG.

FIG. 11 is an explanatory diagram showing an example of the contents stored in the work environment pattern information DB 1100 for affiliation. As shown in FIG. 11, the work environment pattern information DB 1100 for affiliation has fields of affiliation and installation location. The work environment pattern information DB 1100 for affiliation stores work environment pattern information for affiliation by setting information in each field.

Information representing the user's affiliation is set in the affiliation field. The information representing the affiliation is, for example, the general affairs department, the sales department, the development department, and the like. Information indicating the location where the terminal device 202 permitted to be used by the user is installed is set in the installation location. The information representing the location is, for example, the home or office.

(Contents stored in the work environment pattern information DB 1200 for working styles)
Next, an example of the contents stored in the work environment pattern information DB 1200 for work styles will be described with reference to FIG. The work environment pattern information DB 1200 for work styles is implemented by, for example, a storage area such as the memory 302 or the recording medium 305 of the determination device 100 shown in FIG.

FIG. 12 is an explanatory diagram showing an example of the contents stored in the work environment pattern information DB 1200 for work patterns. As shown in FIG. 12, the work environment pattern information DB 1200 for work style has fields of work style, operating environment (patch application status), and operating environment (HDD encryption). The work environment pattern information DB 1200 for work styles stores work environment pattern information for work styles by setting information in each field.

Information representing the user's work style is set in the work style field. The information representing the work style is, for example, normal work, outside permanent work, telework work, and the like. In the operating environment (patch application state) field, information indicating the application state of security patches for the terminal device 202 is set as a condition for permitting operation by the user. Information indicating whether information in the HDD of the terminal device 202 is encrypted is set in the field of operation environment (HDD encryption) as a condition for permitting operation by the user.

(Stored content of operation history 1300)
Next, an example of the contents of the operation history 1300 will be described with reference to FIG. 13 . The operation history 1300 is realized, for example, by a storage area such as the memory 302 or recording medium 305 of the determination device 100 shown in FIG.

FIG. 13 is an explanatory diagram showing an example of the contents of the operation history 1300. As shown in FIG. As shown in FIG. 13, the operation history 1300 has fields of user name, asset name, date and time, and operation log. The operation history 1300 stores operation information by setting information in each field.

A user name is set in the user name field as information for identifying a user. An asset name is set in the asset name field as information for identifying the terminal device 202, which is an asset. The date and time when the terminal device 202 was operated by the user is set in the date and time field. The contents of the operation performed by the user are set in the operation log field.

(Hardware Configuration Example of Information Storage Device 203)
A hardware configuration example of the information storage device 203 included in the determination system 200 shown in FIG. 2 is the same as the hardware configuration example of the determination device 100 shown in FIG. 3, so description thereof will be omitted. The operation history 1300 shown in FIG. 13 is generated, for example, by the information storage device 203 , transmitted from the information storage device 203 to the determination device 100 , and stored in the determination device 100 .

(Hardware Configuration Example of Terminal Devices 201 and 202)
Next, a hardware configuration example of the terminal devices 201 and 202 included in the educational system shown in FIG. 2 will be described with reference to FIG. In the example of FIG. 14, specifically, the terminal device 201 among the terminal devices 201 and 202 will be described as an example.

FIG. 14 is a block diagram showing a hardware configuration example of the terminal device 201. As shown in FIG. 14, terminal device 201 has CPU 1401 , memory 1402 , network I/F 1403 , recording medium I/F 1404 , recording medium 1405 , display 1406 , and input device 1407 . Also, each component is connected by a bus 1400 .

Here, the CPU 1401 controls the entire terminal device 201 . The memory 1402 has, for example, ROM, RAM and flash ROM. Specifically, for example, a flash ROM or ROM stores various programs, and a RAM is used as a work area for the CPU 1401 . A program stored in the memory 1402 is loaded into the CPU 1401 to cause the CPU 1401 to execute coded processing.

Network I/F 1403 is connected to network 210 through a communication line, and is connected to other computers via network 210 . A network I/F 1403 serves as an internal interface with the network 210 and controls input/output of data from other computers. For the network I/F 1403, for example, a modem or LAN adapter can be adopted.

A recording medium I/F 1404 controls reading/writing of data from/to the recording medium 1405 under the control of the CPU 1401 . A recording medium I/F 1404 is, for example, a disk drive, an SSD, a USB port, or the like. A recording medium 1405 is a nonvolatile memory that stores data written under control of the recording medium I/F 1404 . A recording medium 1405 is, for example, a disk, a semiconductor memory, a USB memory, or the like. The recording medium 1405 may be removable from the terminal device 201 .

The display 1406 displays data such as documents, images, function information, as well as cursors, icons or toolboxes. The display 1406 can employ, for example, a CRT (Cathode Ray Tube), a liquid crystal display, an organic EL (Electroluminescence) display, or the like. The input device 1407 has keys for inputting characters, numbers, various instructions, etc., and inputs data. The input device 1407 may be a keyboard, a mouse, or the like, or may be a touch panel type input pad or numeric keypad.

The terminal device 201 may have, for example, a printer, a scanner, a microphone, a speaker, etc., in addition to the components described above. Also, the terminal device 201 may have a plurality of recording medium I/Fs 1404 and recording media 1405 . Also, the terminal device 201 may not have the recording medium I/F 1404 and the recording medium 1405 .

(Example of functional configuration of determination device 100)
Next, a functional configuration example of the determination device 100 will be described with reference to FIG. 15 .

FIG. 15 is a block diagram showing a functional configuration example of the determination device 100. As shown in FIG. Determination device 100 includes storage unit 1500 , acquisition unit 1501 , generation unit 1502 , identification unit 1503 , determination unit 1504 , and output unit 1505 .

The storage unit 1500 is implemented by, for example, a storage area such as the memory 302 or recording medium 305 shown in FIG. A case where the storage unit 1500 is included in the determination device 100 will be described below, but the present invention is not limited to this. For example, the storage unit 1500 may be included in a device different from the determination device 100 , and the storage content of the storage unit 1500 may be referenced from the determination device 100 .

Acquisition unit 1501 to output unit 1505 function as an example of a control unit. Specifically, the acquisition unit 1501 to the output unit 1505, for example, by causing the CPU 301 to execute a program stored in a storage area such as the memory 302 or the recording medium 305 shown in FIG. to realize its function. The processing result of each functional unit is stored in a storage area such as the memory 302 or recording medium 305 shown in FIG. 3, for example.

The storage unit 1500 stores various information that is referred to or updated in the processing of each functional unit. The storage unit 1500 stores, for example, a history of user operations in association with attributes of the user. The operation history is a DB that collects records for each operation. A record is set with information related to the operation by the user. The information about the user's operation includes, for example, information representing the point in time when the user's operation was performed. A user may have multiple attributes of different types. Storage unit 1500 specifically stores operation history 1300 illustrated in FIG. 13 .

The storage unit 1500 stores, for example, information representing user attributes. The storage unit 1500 stores, for example, evaluation criteria regarding specific operations. Evaluation criteria are criteria for evaluating the correctness of a specific operation. An evaluation criterion is, for example, a criterion for evaluating whether a specific operation is a legitimate operation in terms of the user's business or an illegal operation. Specifically, the evaluation criteria are generated by the generation unit 1502 or stored in advance. The storage unit 1500 specifically stores various tables shown in FIGS. 4 to 12. FIG.

Acquisition unit 1501 acquires various types of information used for processing of each functional unit from storage unit 1500 and outputs the information to each functional unit. For example, the acquisition unit 1501 may acquire various types of information used for processing of each functional unit from the storage unit 1500 and output the information to each functional unit. For example, the acquisition unit 1501 may acquire various types of information used for processing of each functional unit from a device different from the determination device 100 and output the information to each functional unit. Specifically, the acquisition unit 1501 acquires the operation history 1300 from the information storage device 203 and stores it in the storage unit 1500 .

The generation unit 1502 generates evaluation criteria for specific operations. The generation unit 1502, for example, refers to the storage unit 1500 and generates evaluation criteria regarding specific operations for each attribute of the user. Specifically, the generation unit 1502 generates an evaluation criterion representing a time period during which a specific operation is permitted for each attribute of the first type. The first type is, for example, duties. Specifically, the generation unit 1502 generates a business behavior pattern information DB related to job responsibilities, as will be described later with reference to FIG. 16 .

Specifically, the generation unit 1502 may generate information representing a target type for which a specific operation is permitted for each attribute of the second type. The second type is, for example, affiliation. Specifically, the generation unit 1502 generates a business behavior pattern information DB related to affiliation, as will be described later with reference to FIG. 16 . Thereby, the generation unit 1502 can evaluate the validity of a specific operation by the user.

The generation unit 1502 may, for example, monitor a specific operation by any user and detect a specific operation by any user. Then, when a specific operation by any user is detected, the generation unit 1502 refers to the storage unit 1500 and generates evaluation criteria regarding the specific operation for each attribute of any user.

Specifically, the generation unit 1502 detects a specific operation by any user by searching the storage unit 1500 for records related to the specific operation by any user. Then, in response to detecting a specific operation by any user, the generation unit 1502 refers to the storage unit 1500 and generates evaluation criteria for the specific operation for each attribute of any user.

As a result, the generation unit 1502 makes the evaluation criteria for the detected specific operation correspond to the latest state of the determination system 200, thereby improving the determination accuracy of the determination unit 1504. FIG. In addition, since the generation unit 1502 does not have to generate evaluation criteria for all attributes, it is possible to reduce the burden of generation processing.

The specifying unit 1503 specifies, from among the generated evaluation criteria, evaluation criteria related to a specific operation by one of the users based on one of the user's attributes. As a result, the identifying unit 1503 can identify the evaluation criteria used to determine the validity of a specific operation, and provide the evaluation criteria to the determining unit 1504 .

A determination unit 1504 determines whether a specific operation by any user satisfies the evaluation criteria. For example, when a specific operation by any user is detected, the determining unit 1504 determines whether the specific operation by any user satisfies the evaluation criteria specified by the specifying unit 1503 .

Specifically, the determination unit 1504 detects a specific operation by any user by searching the storage unit 1500 for records related to the specific operation by any user. Then, in response to detecting a specific operation by any user, the determination unit 1504 determines whether or not the record of the detected specific operation satisfies the evaluation criteria for each attribute of any user. .

As a result, the determination unit 1504 can reduce the burden of evaluating specific operations. The determination unit 1504 can, for example, allow the security administrator to refer to the result of determining whether a specific operation satisfies the evaluation criteria, which represents the result of evaluating the validity of a specific operation.

For example, the determination unit 1504 refers to the history of operations by any user, and determines the evaluation criteria based on other operations performed by any user before or after a specific operation by any user. It may be determined whether or not the condition is satisfied. Another operation is, for example, an operation of reading the information to be brought out from the storage area if the specific operation is an operation of bringing out information. Other operations may be, for example, operations that modify the information to be brought out. Specifically, the determination unit 1504 determines whether or not the evaluation criteria are satisfied, as described later with reference to FIG. 23 . As a result, the determination unit 1504 can improve determination accuracy.

The output unit 1505 outputs the result determined by the determination unit 1504 . The output format is, for example, display on a display, print output to a printer, transmission to an external device via the network I/F 303, or storage in a storage area such as the memory 302 or recording medium 305. The output unit 1505 outputs, for example, the result determined by the determination unit 1504 to a specific terminal. The specific terminal is, for example, the terminal device 201 of the security administrator.

The output unit 1505 may output the processing result of each functional unit. The output unit 1505 outputs, for example, the processing result of each functional unit to a specific terminal. As a result, the output unit 1505 can notify the user of the processing result of each functional unit, and can support the management and operation of the determination device 100, for example, updating the setting values of the determination device 100. 100 convenience can be improved.

(Example of determination system 200)
Next, an example of the determination system 200 will be described with reference to FIGS. 16 to 26. FIG.

16 to 26 are explanatory diagrams showing an embodiment of the determination system 200. FIG. In FIG. 16, the determination device 100 includes a job action pattern information DB 500 and an affiliation job action pattern information DB 500 and a job action pattern information DB 600 representing evaluation criteria for evaluating the validity of a specific operation by a user, based on an operation history 1600 for learning. and

The operation history 1600 for learning is the same information as the operation history 1300 which is the target for evaluating the correctness of the information take-out operation. The learning operation history 1600 is, for example, a history of operations by users a to f for whom the security administrator has confirmed that there are no unauthorized operations. Further, the determination device 100 may use the operation history 1300 itself as the operation history 1600 for learning.

For example, the determination device 100 refers to the personnel information DB 400 and extracts records of users who have the same job responsibility from the operation history 1600 . Next, the determination device 100 evaluates the frequency of taking out after business hours based on the extracted records. Then, the determination device 100 stores the evaluation result in the job action pattern information DB 500 for job responsibilities.

In the example of FIG. 16, the determination device 100 extracts the records of the user c and the user e who have the same job title "section manager". Among the extracted records of user c and user e, who are job responsibilities “section manager,” the determination device 100 determines that since the ratio of records related to operations outside business hours is less than or equal to the threshold value, there are “few operations outside business hours.” ”is evaluated. Then, the determination device 100 stores the evaluation result in the job action pattern information DB 500 for job responsibilities.

As a result, the determination device 100 can thereafter evaluate the validity of the operation of taking out information by the user who has the job responsibility “section manager”. For example, if the ratio of records related to outside working hours out of the records of any user who has the job title “section manager” is greater than a threshold value, the determination device 100 evaluates that the out of hours taking out operation is “many”. do. Then, the determination apparatus 100 determines that a user who tends to perform "few" operations outside business hours has a relatively high possibility of being an unauthorized operation because the user has been evaluated as having "many" operations outside business hours. can be evaluated.

The determination device 100 similarly refers to the personnel information DB 400 and extracts records of users belonging to the same department from the operation history 1600 . Next, the determination device 100 evaluates how often confidential information is taken out based on the extracted records. The determination device 100 stores the evaluation result in the business behavior pattern information DB 600 for the affiliation.

When generating the job action pattern information DB 500 for job responsibilities and the job action pattern information DB 600 for affiliations, the determination device 100 may evaluate the frequency of taking out of office hours and confidential information by statistical processing. . For example, if there are a certain number of take-out operations outside business hours, the determination device 100 may evaluate that there are no take-out operations outside business hours.

The determination device 100 may update the job action pattern information DB 500 for job responsibilities and the job action pattern information DB 600 for affiliations at regular intervals. As a result, the determination device 100 can update the business behavior pattern information DB 500 for duties and the business behavior pattern information DB 600 for affiliations to the latest state.

Similarly, the determination device 100 may generate various types of business behavior pattern information DBs other than the business behavior pattern information DB 500 for duties and the business behavior pattern information DB 600 for affiliations. 17 to 25, an example in which the determination device 100 determines whether a specific operation by the user satisfies the evaluation criteria will be described. In the following, the determination device 100 specifically determines, based on the operation history 1300, whether a specific operation by users A to F different from users a to f satisfies the evaluation criteria.

In FIG. 17 , the determination device 100 extracts an operation history 1700 related to the operation of bringing out information from the operation history 1300 . In the following, for example, a case where records 1701 to 1703 of the operation history 1700 are operations for bringing out unauthorized information will be described. Accordingly, the determination device 100 can detect that the user has performed an operation to bring out information. Next, the description of FIG. 18 will be described.

18, the determination device 100 stores, from the operation history 1700, information combining a user name representing a user who performed a specific operation and an asset name representing the terminal device 202 on which the specific operation was performed. Identify list 1800 . Next, the description of FIG. 19 will be described.

In FIG. 19 , the determination device 100 refers to the personnel information DB 400 , extracts attributes of users whose user names are stored in the combination list 1800 , and stores them using the attribute list 1900 . Thereby, the determination device 100 can acquire information for specifying the evaluation criteria. Next, the description of FIG. 20 will be described.

In FIG. 20 , the determination device 100 acquires a business behavior pattern information DB 500 for duties, a business behavior pattern information DB 600 for affiliations, and a business behavior pattern information DB 700 for work styles. Various business behavior pattern information DBs are generated by the determination device 100, for example. Various business behavior pattern information DBs may be created in advance by a security administrator and stored in the determination device 100, for example.

The determination device 100 refers to the attribute list 1900, collects the information stored in the acquired various business behavior pattern information DBs in association with the attributes of each user, and stores them using the business behavior evaluation criteria list 2000. . Thereby, the determination device 100 can acquire evaluation criteria from the viewpoint of work behavior for evaluating the validity of the operation of bringing out information. Next, the description of FIG. 21 will be described.

In FIG. 21, the determination device 100 acquires a work environment pattern information DB 1100 for affiliations and a work environment pattern information DB 1200 for work styles. Various business environment pattern information DBs are generated by the determination device 100, for example. Various work environment pattern information DBs may be created in advance by a security administrator and stored in the determination device 100, for example.

The determination device 100 refers to the attribute list 1900 , collects the information stored in the acquired various work environment pattern information DBs in association with the attributes of each user, and stores them using the work environment evaluation criteria list 2100 . Accordingly, the determination device 100 can acquire evaluation criteria from the viewpoint of the work environment for evaluating the validity of the operation of bringing out information. Next, the description of FIG. 22 will be described.

22, the determination device 100 refers to the asset information DB 1000, extracts information about the terminal device 202 whose asset name is stored in the combination list 1800, and stores it using the work environment list 2200. FIG. As a result, the determination device 100 can identify the business environment in which the operation of bringing out information has been performed. Next, the description of FIG. 23 will be described.

In FIG. 23 , the determination device 100 refers to the work behavior evaluation criteria list 2000 and identifies records in the operation history 1700 that do not satisfy the evaluation criteria from the viewpoint of work behavior. Here, for example, the evaluation criteria for user A indicate "no" taking out of confidential information. On the other hand, User A's record 1701 indicates taking out confidential information. For this reason, the determination device 100 identifies the record 1701 of the user A as the record regarding the operation outside of the work activity that does not satisfy the evaluation criteria.

Further, the determination device 100 acquires, from the operation history 1300, records 2301 and 2302 of operations performed by the same user D immediately before and after the record 1703 of the operation of bringing out information by the user D, for example. Here, the user D's evaluation criteria represent the "telework file server" as an access permission target. On the other hand, the immediately preceding operation record 2301 represents the “internal file server” as the access target when the taken-out information is read. For this reason, the determination device 100 identifies the record 1703 of the user D as the record regarding the operation outside of the work activity that does not satisfy the evaluation criteria.

Here, the case where it is determined that the evaluation criteria are not satisfied is explained because the record of the immediately preceding operation represents a storage area to which access is not permitted as the target of access when reading out the information brought out. , but not limited to this. For example, when it is judged that the evaluation criteria are not met because the record of the operation immediately after the brought-out information indicates that the brought-out information has been changed, even though the information is not permitted to be changed by the user. and so on.

Here, one of the user's evaluation criteria indicates that confidential information is taken out "small". Conceivable. In such a case, the determination device 100 may determine that the evaluation criteria are not satisfied. Next, the description of FIG. 24 will be described.

In FIG. 24, the determination apparatus 100 refers to the operation history 1700 regarding the information bring-out operation and the business environment list 2200, and generates an operation environment list 2400 representing the business environment for each information bring-out operation. Next, the determination device 100 refers to the work environment evaluation criteria list 2100 and identifies records in the operating environment list 2400 that do not satisfy the evaluation criteria from the viewpoint of the work environment.

For example, the user A's evaluation criteria represent the location where the terminal device 202 is installed, “inside the company only”. On the other hand, the record 2401 representing the business environment corresponding to taking out of information represented by the record 1701 of the user A represents the installation location of the terminal device 202 used by the user A, "home".

In addition, the evaluation criteria for user A indicate that HDD encryption of the terminal device 202 is “yes”. On the other hand, the record 2401 indicates that the HDD encryption of the terminal device 202 used by the user A is "none". Therefore, the determination device 100 identifies the record 1701 of the user A as the record regarding the operation outside the work environment that does not satisfy the evaluation criteria.

For example, user C's evaluation criteria represent the patch application status of the terminal device 202 of “all applied”. On the other hand, the record 2402 representing the work environment corresponding to the take-out of the information represented by the record 1702 of the user C represents the patch application status of the terminal device 202 used by the user C "not yet applied". Therefore, the determination device 100 identifies the record 1702 of the user C as a record relating to operations outside the work environment that do not satisfy the evaluation criteria.

For example, user D's evaluation criteria indicate that HDD encryption of terminal device 202 is “yes”. On the other hand, the record 2403 representing the business environment corresponding to taking out of information represented by the record 1703 of the user D indicates that the HDD encryption of the terminal device 202 used by the user D is "none". Therefore, the determination device 100 identifies the record 1703 of the user D as a record relating to operations outside the work environment that do not satisfy the evaluation criteria. Next, the description of FIG. 25 will be described.

In FIG. 25 , the determination device 100 summarizes the results identified in FIGS. 23 and 24 and stores them using a list of identification results 2500 . The determination device 100 collectively stores, for example, whether each user has performed an operation outside the work behavior that does not satisfy the evaluation criteria and whether or not the user has performed an operation outside the work environment that does not satisfy the evaluation criteria. As a result, the determination device 100 can evaluate which information take-out operation has a relatively high possibility of being an unauthorized operation, and which should be investigated preferentially and evaluated for validity. can. Next, the description of FIG. 26 will be described.

In FIG. 26, the determination device 100 causes the display 1406 of the security administrator's terminal device 201 to display a notification screen 2600 including the operation history 1700 in which the specified records 1701 to 1703 are marked as "suspicious removal". . The determination device 100 assigns to the specified records 1701 to 1703 a determination result as to whether or not the evaluation criteria from the viewpoint of work behavior and whether or not the evaluation criteria from the viewpoint of the work environment are satisfied, and displays them. You may let

As a result, even if there is an operation that is likely to be overlooked by a security administrator and has a relatively high possibility of being performed fraudulently, the determination apparatus 100 can evaluate the operation based on evaluation criteria from various viewpoints. Based on evaluation criteria from various viewpoints, the determination device 100 can enable the security administrator to grasp operations that have a relatively high possibility of being performed fraudulently.

For this reason, the security administrator should give priority to investigate any of the information export operations by a plurality of users that have a relatively high possibility of being carried out illegally, and investigate the legitimacy. It is possible to grasp whether it is preferable to evaluate In addition, the security administrator can reduce the possibility of overlooking an operation that has a relatively high possibility of being performed illegally. As a result, the security administrator can efficiently improve security.

(Overall processing procedure)
Next, an example of the overall processing procedure executed by the determination device 100 will be described with reference to FIG. 27 . The overall processing is realized by, for example, the CPU 301, storage areas such as the memory 302 and the recording medium 305, and the network I/F 303 shown in FIG.

FIG. 27 is a flowchart illustrating an example of an overall processing procedure; In FIG. 27, the determination device 100 extracts the operation history 1300 related to taking out information from the operation history 1300 of the terminal device 202 (step S2701).

Next, the determination device 100 acquires the personnel information DB 400, the business behavior pattern information DB, the business environment pattern information DB, and the property information DB 1000 (step S2702). Then, the determination device 100 refers to the acquired various DBs, and generates the business behavior pattern evaluation criteria and the business environment pattern evaluation criteria of the user who performed the operation of bringing out the information (step S2703).

Next, the determination apparatus 100 selects a record of an information bring-out operation from the acquired operation history 1300 relating to information bring-out (step S2704). Then, the determination device 100 determines whether or not the selected record satisfies the generated work behavior pattern evaluation criteria and work environment pattern evaluation criteria (step S2705).

Here, if the record does not satisfy the business behavior pattern evaluation criteria or the business environment pattern evaluation criteria (step S2705: No), the determination device 100 proceeds to the process of step S2706. On the other hand, if the record satisfies the business behavior pattern evaluation criteria and the business environment pattern evaluation criteria (step S2705: Yes), the determination device 100 proceeds to the process of step S2707.

In step S2706, the determination device 100 stores the selected record in association with information indicating that there is a possibility of unauthorized operation (step S2706). Then, the determination device 100 proceeds to the process of step S2708.

In step S2707, the determination device 100 stores the selected record in association with information indicating a normal operation (step S2707). Then, the determination device 100 proceeds to the process of step S2708.

In step S2708, the determination device 100 determines whether or not all records have been selected (step S2708). Here, if there is an unselected record (step S2708: No), the determination device 100 returns to the process of step S2704. On the other hand, if all records have been selected (step S2708: Yes), the determination device 100 proceeds to the process of step S2709.

In step S2709, the determination apparatus 100 stores the record of the information take-out operation and the information indicating the possibility of an unauthorized operation stored in association with the record of the information take-out operation, or the information indicating the normal operation. are associated with each other and displayed (step S2709). Then, the determination device 100 ends the overall processing.

Here, the case where the determination device 100 determines whether or not the business behavior pattern evaluation criteria and the business environment pattern evaluation criteria are satisfied has been described. In this case, the processing of steps S2703 to S2708 is specifically realized by combining the work action determination processing described later with reference to FIG. 28 and the work environment determination processing described later with reference to FIG.

On the other hand, for example, the determination device 100 may not use either the work behavior pattern evaluation criteria or the work environment pattern evaluation criteria. In this case, the processing of steps S2703 to S2708 is specifically realized by the business action determination processing described later with reference to FIG. 28 or the work environment determination processing described later with reference to FIG.

(Business behavior judgment processing procedure)
Next, an example of the business behavior determination processing procedure executed by the determination device 100 will be described with reference to FIG. 28 . The business behavior determination process is realized by, for example, the CPU 301, storage areas such as the memory 302 and the recording medium 305, and the network I/F 303 shown in FIG.

FIG. 28 is a flowchart illustrating an example of a business behavior determination processing procedure. In FIG. 28, the determination device 100 acquires the job responsibilities, affiliation, and work style for each user who has performed the operation of bringing out information from the personnel information DB 400 (step S2801).

Next, the determination device 100 refers to the business behavior pattern information DB, and acquires business behavior pattern information corresponding to the acquired job responsibilities, affiliations, and work styles for each user who performed the operation of bringing out information ( step S2802). Then, the determination apparatus 100 generates a business behavior pattern evaluation criterion based on the business behavior pattern information acquired for each user who has performed the information bring-out operation (step S2803).

Next, the determination device 100 selects a record of an information bring-out operation from the operation history 1700 relating to information bring-out (step S2804). Then, the determination device 100 determines whether or not the selected record satisfies the business behavior pattern evaluation criteria corresponding to the selected record (step S2805).

Here, if the business behavior pattern evaluation criteria are not satisfied (step S2805: No), the determination apparatus 100 proceeds to the process of step S2806. On the other hand, if the business behavior pattern evaluation criteria are satisfied (step S2805: YES), the determination device 100 proceeds to the process of step S2807.

In step S2806, the determination device 100 stores the selected record in association with information indicating the possibility of unauthorized operation (step S2806). Then, the determination device 100 proceeds to the process of step S2808.

In step S2807, the determination device 100 stores the selected record in association with information indicating a normal operation (step S2807). Then, the determination device 100 proceeds to the process of step S2808.

In step S2808, the determination device 100 determines whether or not all records have been selected (step S2808). Here, if there is an unselected record (step S2808: No), the determination apparatus 100 returns to the process of step S2804. On the other hand, if all records have been selected (step S2808: Yes), the determination device 100 terminates the business behavior determination process.

(Business environment judgment processing procedure)
Next, an example of the work environment determination processing procedure executed by the determination device 100 will be described with reference to FIG. 29 . The work environment determination process is realized by, for example, the CPU 301, storage areas such as the memory 302 and the recording medium 305, and the network I/F 303 shown in FIG.

FIG. 29 is a flowchart illustrating an example of a business environment determination processing procedure. In FIG. 29, the determination device 100 acquires the affiliation and work style of each user who performed the operation of bringing out information from the personnel information DB 400 (step S2901).

Next, the determination apparatus 100 refers to the asset information DB 1000 and acquires asset information for each business environment in which the operation to take out information has been performed (step S2902). Then, the determination apparatus 100 refers to the work environment pattern information DB, and acquires work environment pattern information corresponding to the acquired affiliation and work pattern for each user who performed the operation of bringing out information (step S2903). .

Next, the determination device 100 generates a business behavior pattern evaluation criterion based on the business behavior pattern information acquired for each user who has carried out the information bring-out operation (step S2904). Then, the determination device 100 selects a record of an information bring-out operation from the operation history 1700 relating to information bring-out (step S2905).

Next, the determination device 100 refers to the asset information corresponding to the selected record, and determines whether or not the selected record satisfies the work environment pattern evaluation criteria corresponding to the selected record (step S2906).

Here, if the work environment pattern evaluation criteria are not satisfied (step S2906: No), the determination apparatus 100 proceeds to the process of step S2907. On the other hand, if the work environment pattern evaluation criteria are satisfied (step S2906: YES), the determination apparatus 100 proceeds to the process of step S2908.

In step S2907, the determination device 100 stores the selected record in association with information indicating that there is a possibility of unauthorized operation (step S2907). Then, the determination device 100 proceeds to the process of step S2909.

In step S2908, the determination device 100 stores the selected record in association with information indicating a normal operation (step S2908). Then, the determination device 100 proceeds to the process of step S2909.

In step S2909, the determination device 100 determines whether or not all records have been selected (step S2909). Here, if there is an unselected record (step S2909: No), the determination apparatus 100 returns to the process of step S2905. On the other hand, if all records have been selected (step S2909: YES), the determination apparatus 100 terminates the work environment determination process.

As described above, according to the determination device 100, referring to the storage unit that stores the history of user operations in association with user attributes, it is possible to generate evaluation criteria for specific operations for each user attribute. can. According to the determination device 100, it is possible to specify an evaluation criterion related to a specific operation by one of the users among generated evaluation criteria based on one of the user's attributes. According to the determination device 100, when a specific operation by any user is detected, it is possible to determine whether or not the specific operation by any user satisfies the specified evaluation criteria. As a result, the determination device 100 can reduce the burden of evaluating a specific operation. The determination device 100 can, for example, allow the security administrator to refer to the result of determining whether or not a specific operation satisfies the evaluation criteria, which represents the result of evaluating the validity of a specific operation.

According to the determination device 100, it is possible to refer to a storage unit that stores a history of operations by a user in association with a plurality of attributes of different types of users, and generate evaluation criteria for specific operations for each attribute of the user. can. Accordingly, the determination device 100 can generate evaluation criteria for each of a plurality of attributes of different types, and can evaluate the validity of an operation from a plurality of viewpoints.

According to the determination device 100, it is possible to generate an evaluation criterion representing a time period during which a specific operation is permitted for each attribute of the first type. Thereby, the determination device 100 can evaluate the legitimacy of a specific operation from the time when the specific operation is performed.

According to the determination device 100, it is possible to generate information representing a target type for which a specific operation is permitted for each attribute of the second type. Thereby, the determination device 100 can evaluate the legitimacy of a specific operation from the target type on which the specific operation is performed.

According to the determination device 100, the history of operations by any user is referred to, and evaluation criteria are determined based on other operations performed by any user before or after a specific operation by any user. It can be determined whether or not the conditions are satisfied. As a result, the determination device 100 can consider other operations related to the specific operation, and improve the evaluation accuracy of the validity of the specific operation.

According to the determination device 100, it is possible to output the result of determining whether or not the specified evaluation criteria are satisfied to a specific terminal. As a result, the determination device 100 can refer to the result of the evaluation of the validity of a specific operation by a security administrator other than the determination device 100 .

According to the determination device 100, when a specific operation by any user is detected, the storage unit can be referred to, and evaluation criteria regarding the specific operation can be generated for each attribute of any user. As a result, the determination device 100 makes the evaluation criteria for the detected specific operation correspond to the latest state of the determination system 200, thereby improving the determination accuracy. In addition, since the determination device 100 does not need to generate evaluation criteria for all attributes, it is possible to reduce the burden of generation processing.

According to the determination device 100, it is possible to specify an evaluation criterion regarding a specific operation by one of the evaluation criteria regarding a specific operation generated for each attribute of the user, based on one of the attributes of the user. can. According to the determination device 100, when a specific operation by any user is detected, it is possible to determine whether or not the specific operation by any user satisfies the specified evaluation criteria. Accordingly, the determination device 100 does not need to generate evaluation criteria, and can reduce the amount of processing.

The determination method described in this embodiment can be realized by executing a prepared program on a computer such as a personal computer or a workstation. The determination program described in the present embodiment is recorded in a computer-readable recording medium such as a hard disk, flexible disk, CD-ROM, MO, DVD, etc., and executed by being read from the recording medium by a computer. Also, the determination program described in the present embodiment may be distributed via a network such as the Internet.

Further, the following additional remarks are disclosed with respect to the above-described embodiment.

(Appendix 1) to the computer,
referring to a storage unit that stores a history of user operations in association with attributes of the user, generating evaluation criteria for specific operations for each attribute of the user;
Based on the attribute of any user, among the generated evaluation criteria, identify the evaluation criteria related to the specific operation by any of the users,
When the specific operation by any of the users is detected, determining whether the specific operation by any of the users satisfies the specified evaluation criteria,
A determination program characterized by causing a process to be executed.

(Supplementary Note 2) The generating process refers to a storage unit that stores a history of user operations in association with a plurality of user attributes of different types, and determines evaluation criteria for specific operations for each user attribute. The determination program according to Supplementary Note 1, characterized by:

(Supplementary note 3) The determination program according to Supplementary note 1 or 2, wherein the generating process generates an evaluation criterion representing a time zone in which the specific operation is permitted for each attribute of the first type.

(Appendix 4) Any one of Appendices 1 to 3, wherein the generating process generates information representing a target type for which the specific operation is permitted for each attribute of the second type. judgment program.

(Supplementary Note 5) The determination process refers to a history of operations by any of the users, and performs other operations by any of the users before or after the specific operation by any of the users. 5. The determination program according to any one of appendices 1 to 4, characterized in that it determines whether or not the evaluation criteria are satisfied based on.

(Appendix 6) In the computer,
6. The determination program according to any one of appendices 1 to 5, characterized by outputting a result of determining whether or not the specified evaluation criteria are satisfied to a specific terminal, and executing a process.

(Supplementary Note 7) In the generating process, when the specific operation by any of the users is detected, the storage unit is referred to, and evaluation criteria for the specific operation are generated for each of the attributes of the user. The determination program according to any one of Appendices 1 to 6, characterized by:

(Appendix 8) The computer
referring to a storage unit that stores a history of user operations in association with attributes of the user, generating evaluation criteria for specific operations for each attribute of the user;
Based on the attribute of any user, among the generated evaluation criteria, identify the evaluation criteria related to the specific operation by any of the users,
When the specific operation by any of the users is detected, determining whether the specific operation by any of the users satisfies the specified evaluation criteria,
A determination method characterized by executing a process.

(Appendix 9) referring to a storage unit that stores a history of operations by a user in association with attributes of the user, and generating evaluation criteria for specific operations for each attribute of the user;
Based on the attribute of any user, among the generated evaluation criteria, identify the evaluation criteria related to the specific operation by any of the users,
When the specific operation by any of the users is detected, determining whether the specific operation by any of the users satisfies the specified evaluation criteria,
A determination device, comprising a control unit.

(Appendix 10) to the computer,
Based on any user attribute, identifying the evaluation criteria for the specific operation by any of the users among the evaluation criteria for the specific operation generated for each user attribute,
When the specific operation by any of the users is detected, determining whether the specific operation by any of the users satisfies the specified evaluation criteria,
A determination program characterized by causing a process to be executed.

(Appendix 11) The computer
Based on any user attribute, identifying the evaluation criteria for the specific operation by any of the users among the evaluation criteria for the specific operation generated for each user attribute,
When the specific operation by any of the users is detected, determining whether the specific operation by any of the users satisfies the specified evaluation criteria,
A determination method characterized by executing a process.

(Supplementary Note 12) Based on any of the attributes of the user, among the evaluation criteria for the specific operation generated for each attribute of the user, identify the evaluation criteria for the specific operation by any of the users,
When the specific operation by any of the users is detected, determining whether the specific operation by any of the users satisfies the specified evaluation criteria,
A determination device, comprising a control unit.

100 Determination Device 110, 130 History 120 Evaluation Criteria 200 Determination System 201, 202 Terminal Device 203 Information Storage Device 210 Network 300, 1400 Bus 301, 1401 CPU
302, 1402 memory 303, 1403 network I/F
304, 1404 recording medium I/F
305, 1405 Recording medium 400 Personnel information DB
500, 600, 700, 800, 900 Business behavior pattern information DB
1000 Asset information DB
1100, 1200 Business environment pattern information DB
1300, 1600, 1700 operation history 1406 display 1407 input device 1500 storage unit 1501 acquisition unit 1502 generation unit 1503 identification unit 1504 determination unit 1505 output unit 1701 to 1703, 2301, 2302, 2401 to 2403 record 1800 combination list 19000 attribute list 2 Action evaluation criteria list 2100 Work environment evaluation criteria list 2200 Work environment list 2400 Operating environment list 2500 Identification result list 2600 Notification screen

Claims (7)

to the computer,
referring to a storage unit that stores information about the user's work environment in association with the user's attributes, generating evaluation criteria regarding the work environment for each user's attribute;
Identifying a first evaluation criterion related to the work environment of the one of the users among the generated evaluation criteria based on the attributes of any of the users;
determining whether or not the work environment in which the information take -out operation by any of the users is performed satisfies the identified first evaluation criteria ,
By statistically processing the history of operations by a plurality of users who have the same attributes of job responsibilities, affiliations, or work styles, generating evaluation criteria corresponding to the frequency of information take-out operations in association with the attributes,
A second evaluation criterion regarding the information bring-out operation of any of the users among generated evaluation criteria regarding the information bring-out operations based on the job responsibilities, affiliation, or work type attributes of the any of the users. identify,
Determining whether the operation of bringing out the information by any of the users satisfies the specified second evaluation criteria;
A determination program characterized by causing a process to be executed. 2. The information relating to the business environment is information relating to at least one of an installation location, a batch application status, and HDD encryption status of the terminal device owned by the user. Determination program as described. The generating process refers to the storage unit that stores information about the work environment of the user in association with a plurality of attributes of different types of the user, and generates evaluation criteria about the work environment for each attribute of the user. 3. The determination program according to claim 1 or 2, characterized by: The determination process refers to the history of operations by any of the users, and based on other operations by any of the users performed before or after the operation of bringing out the information by any of the users 4. The determination program according to any one of claims 1 to 3, characterized in that it determines whether or not the specified second evaluation criterion is satisfied. to the computer;
Outputting the result of determining whether the specified first evaluation criterion is satisfied and the result of determining whether the specified second evaluation criterion is satisfied to a specific terminal, and causing the processing to be executed. The determination program according to any one of claims 1 to 4. the computer
referring to a storage unit that stores information about the user's work environment in association with the user's attributes, generating evaluation criteria regarding the work environment for each user's attribute;
Identifying a first evaluation criterion related to the work environment of the one of the users among the generated evaluation criteria based on the attributes of any of the users;
determining whether or not the work environment in which the information take-out operation by any of the users is performed satisfies the identified first evaluation criteria,
By statistically processing the history of operations by a plurality of users who have the same attributes of job responsibilities, affiliations, or work styles, generating evaluation criteria corresponding to the frequency of information take-out operations in association with the attributes,
A second evaluation criterion regarding the information bring-out operation of any of the users among generated evaluation criteria regarding the information bring-out operations based on the job responsibilities, affiliation, or work type attributes of the any of the users. identify,
Determining whether the operation of bringing out the information by any of the users satisfies the specified second evaluation criteria;
A determination method characterized by executing a process. referring to a storage unit that stores information about the user's work environment in association with the user's attributes, generating evaluation criteria regarding the work environment for each user's attribute;
Identifying a first evaluation criterion related to the work environment of the one of the users among the generated evaluation criteria based on the attributes of any of the users;
determining whether or not the work environment in which the information take-out operation by any of the users is performed satisfies the identified first evaluation criteria,
By statistically processing the history of operations by a plurality of users who have the same attributes of job responsibilities, affiliations, or work styles, generating evaluation criteria corresponding to the frequency of information take-out operations in association with the attributes,
A second evaluation criterion regarding the information bring-out operation of any of the users among generated evaluation criteria regarding the information bring-out operations based on the job responsibilities, affiliation, or work type attributes of the any of the users. identify,
Determining whether the operation of bringing out the information by any of the users satisfies the specified second evaluation criteria;
A determination device, comprising a control unit.

Images