JP7304196B2 - Information analysis device, information analysis method, program and information analysis system - Google Patents

Description

The present invention relates to an information analysis device, an information analysis method, an information analysis system, and a program for analyzing file usage situations.

The work of white-collar employees is centered on working at a computer. In addition, in recent years, the digitization of information has progressed, and the distribution and distribution of information through networks has increased. When looking at the productivity of personal computer work, it is necessary to regard the time spent on creating and editing information (files) that are not used on the network as "waste". Therefore, Patent Document 1 discloses a system that receives file usage status from a terminal and calculates the amount of relationship with a file for each user based on the received file usage status information, thereby facilitating a file search. there is Further, Patent Literature 2 discloses a system that classifies each file into a plurality of work categories based on the operation history.

JP 2014-13476 A Japanese Patent Application Laid-Open No. 2012-14530

When distributing a file, if the file can be created in a short time and is used by many users for a long time (viewing, editing, falsification, etc.), the usefulness of the file is high. I can say. However, in Japanese Patent Application Laid-Open No. 2002-200013, although it is possible to grasp the period during which the file was manipulated, such as copying, it was not possible to grasp the time taken to create the file or the time the file was used. Further, in Patent Document 2, although it is possible to grasp the work time for each file, it is not possible to grasp how long the file is used by other employees. In other words, it is not possible to ascertain how a file is used by using the time taken to create the file and the time actually used.

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and it is an object of the present invention to provide a technique for easily grasping the usage status of files.

The information analysis apparatus of the present invention includes, for example, input means for inputting a user's operation history in each terminal device of a plurality of terminal devices, creation time at which a file was created from the operation history input by the input means, Calculation means for calculating a usage time using a file; Analysis means for analyzing the utilization status of the file based on the creation time and the usage time calculated by the calculation means; output means for outputting an analysis result, wherein the output means outputs, as the analysis result, data displayed by contrasting the creation time and the use time for the file.

According to the present invention, it is possible to provide a technology that makes it possible to grasp the usage status of files.

It is a figure which shows an example of an information analysis system. It is a figure which shows the hardware constitutions of a terminal device. 3 is a diagram showing the hardware configuration of a log management server; FIG. It is a figure which shows the hardware constitutions of an information-analysis apparatus. FIG. 4 is a diagram showing an example of an operation history of an application program; FIG. FIG. 10 is a diagram showing an example of transmission/reception history of e-mails; It is a figure which shows an example of the input log with respect to an input device. It is a flow chart which shows an example of information analysis processing. 9 is a flowchart showing an example of file creation table creation processing; FIG. 11 is a flowchart showing an example of file replication table creation processing; FIG. 9 is a flowchart showing an example of file diffusion table creation processing; FIG. 11 is a diagram showing an example of a file creation table; FIG. FIG. 10 is a diagram showing an example of a file replication table; FIG. It is a figure which shows an example of a file spreading|diffusion table. It is a figure which shows an example of an analysis result. It is a figure which shows an example of an analysis result. It is a figure which shows an example of an analysis result.

Hereinafter, details of embodiments according to the present invention will be described with reference to the accompanying drawings. However, the components described in this embodiment are merely examples, and the scope of the present invention is not intended to be limited to them. Also, not all combinations of features described in the present embodiment are essential for the solution of the invention.

<First embodiment>
(System configuration)
FIG. 1 is a diagram showing an example of an information analysis system. The information analysis system includes a plurality of terminal devices 11 a and 11 b, a log management server 12 and an information analysis device 13 . The terminal devices 11a and 11b are an example of terminals located within a company. The log management server 12 manages operation logs (operation histories) of application programs executed on terminal devices located within the company. The information analysis device 13 is an example of an information analysis device that analyzes the operation history of an application program in a terminal device located within a company. These devices are connected via various networks 50 such as an intranet including a LAN (Local Area Network) and the Internet. When describing items common to the terminal devices 11a and 11b, they are simply referred to as the terminal device 11. FIG.

The log management server 12 may be located within the company in which the terminal device 11 is installed, or may be located within another company. Similarly, the information analysis device 13 may be located within the company in which the terminal device 11 is installed, or may be located within another company. Also, the log management server 12 and the information analysis device 13 may be managed by the same company, or may be managed by different companies.

The terminal device 11 has a monitoring unit 14 . The monitoring unit 14 monitors the name of the application program running on the terminal device 11, the title information displayed in the title display portion of the active window of the application program, and the user input device of the terminal device when the application program is running. Monitor the number of man-hours required for operation, etc., and record it as an operation history. These pieces of information about the operation history can be acquired from an operating system (OS), window manager, or the like.
The operation history may include, for example, the following information.
・ Identification information of the terminal device: computer name, IP address, MAC address, etc. ・ User name: ID of the user logged in to the terminal device, etc. ・ Operation date and time: date and time when the operation history was acquired ・ Active Window application name: process name, etc. Active window title name: caption name (name of the file being edited, etc.)
・ File operation name, file name, folder name ・ Number of keystrokes on the keyboard ・ Input character code: full-width/half-width, double-byte characters/single-byte characters, Unicode
/EUC/ISO/JIS, etc. ・Determined input characters・・・Characters determined through the front-end processor (FEP) ・Distance moved by the pointer of the pointing device ・Number of clicks on the pointing device

The monitoring unit 14 of the terminal device 11 creates an operation history for each preset monitoring period (eg, 1 minute) and transmits it to the log management server 12 . If the active window is switched in the middle of the monitoring period, there is a possibility that the operation history acquired for a certain active window may include the operation history for another active window. In addition, the first active window may be switched to the second active window in the middle of the monitoring period, and the second active window may be switched to the third active window. In this case, the second active window may not be reflected in the operation history. This is because the active window at the start of the monitoring period is associated with the operation history. Therefore, the monitoring unit 14 of the terminal device 11 may create an operation history each time the active window is switched. Alternatively, when the active window is switched or when a predetermined monitoring period starts, the monitoring unit 14 starts acquiring the operation history of the active window, and switches to another active window. Alternatively, acquisition of the operation history may end when a predetermined monitoring period ends. As a result, each active window is reflected in the operation history. Furthermore, since the operation start date and time, which will be described later, is the time when the acquisition of the operation history is started, the operation time (creation time, use time) for each active window can be calculated from the operation start date and time. For example, the operation time of the first active window when switched from the first active window to the second active window can be calculated as the time from the operation start date and time of the first active window to the operation start date and time of the second active window.

Further, the operation time (creation time, usage time) for each active window may be calculated so as to be counted as the operation time when the number of keystrokes on the keyboard and the pointer movement distance (to be described later) are equal to or greater than a predetermined value.

Various conditions are conceivable for the terminal device 11 to transmit the operation history acquired in this manner to the log management server 12 . For example, when a predetermined period of time has passed (eg, every two hours), when a predetermined amount or more of operation history is accumulated, when the terminal device 11 is started, when the terminal device 11 is instructed to shut down, the log management server 12 is requested to send the operation history.

The log management server 12 is an information processing device (computer) that accumulates operation histories collected from each of the plurality of terminal devices 11 and transmits the accumulated operation histories to the information analysis device 13 . As shown in FIG. 1 , the log management server 12 has a log management DB 15 . DB is an abbreviation for database. The log management server 12 records the operation history for each terminal device (or for each user) in the log management DB 15 based on the operation history received from the terminal device 11 .

The information analysis device 13 is an information processing device that includes an analysis unit 18 and an analysis result DB 19 . Based on the operation history received from the log management server 12 via the network 50, the information analysis device 13 analyzes and outputs the operation contents (for example, file utilization status) for the application programs and the OS. The network interface of the information analysis device 13 is an example of inputting the operation history in the terminal. The analysis unit 18 analyzes the usage status of files from the input operation history. The analysis unit 18 creates an analysis result for each user or each terminal device, for example, and records the created analysis result in the analysis result DB 19 . The analysis results recorded in the analysis result DB 19 are output as graphs and tables to a display device, output to a recording medium by a printing device, output as the text of an e-mail, or output as a web page on a website. You may

It should be noted that the operation logs of the user terminal devices collected by the log management server 12 can be transferred to the information analysis device 18 in addition to using a network, external storage media (FD, MO, USB, CD-R, DVD -RAM, etc.), etc., which can transmit and receive operation logs.

(Hardware configuration)
FIG. 2A is a diagram showing the hardware configuration of the terminal device 11. As shown in FIG. The terminal device 11 is an information processing device such as a personal computer installed in an office or the like. In the terminal device 11, the CPU 21 functions as various means according to software stored in the hard disk drive (HDD 25). Among other things, the CPU 21 functions as the monitoring unit 14 described above, monitors the application program name, caption name, operation date and time, operation man-hours, and the like, creates an operation history, and transmits it to the log management server 12 . The display device 22 is a user interface for displaying information. The memory 23 includes RAM, ROM, and the like. Network interface 24 is a communication circuit for communicating with other computers over network 50 . The HDD 25 stores an application program 27, a monitoring program 28 that monitors the number of man-hours for operation and creates an operation history, and the like.

The input unit 26 (input device) is a pointing device (mouse or touch panel), keyboard, or the like. The keyboard may be a software keyboard. Further, the input unit 26 may be a voice recognition input unit that recognizes the input voice of the operator with a voice recognition function and inputs an instruction to the CPU 21 . The input unit 26 is an example of operation means for operating an application program corresponding to an active window among a plurality of application programs.

FIG. 2B is a diagram showing the hardware configuration of the log management server 12. As shown in FIG. The log management server 12 is also a type of computer. In the log management server 12, the CPU 31 functions as various means according to software stored in the hard disk drive (HDD 35). The memory 33 includes RAM, ROM, and the like. Network interface 34 is a communication circuit for communicating with other computers over network 50 . HDD 35 stores log management program 36 and log management DB 15 .

FIG. 2C is a diagram showing the hardware configuration of the information analysis device 13. As shown in FIG. The information analysis device 13 is also a type of computer. In the information analysis device 13, the CPU 41 functions as various means according to software stored in the hard disk drive (HDD 45). The memory 43 includes RAM, ROM, and the like. Network interface 44 is a communication circuit for communicating with other computers over network 50 . The HDD 45 stores the information analysis program 47 and analysis result DB 19 . The output unit 46 is a display device, a printer, or the like that outputs analysis results.

(log management database)
The operation history information transmitted from the terminal device 11 to the log management server 12 is recorded in the log management DB 15 of the log management server 12 . In the operation history, the name (process name) of the application program, title information ( name of the active window) and man-hours for operation are recorded. Contents recorded in the log management DB 15 will be described with reference to FIGS. 3 to 5. FIG.

3 to 5 are diagrams showing examples of recorded contents of the log management DB 15. FIG. FIG. 3 shows an example of an application operation history that is part of the operation history received from the terminal device 11 . In FIG. 3, the identification information of the terminal device is recorded in the PC name column 301 . In the user name column 302, the identification information of the employee who has logged in to the terminal device is recorded. In the column 303 of operation start date and time, data of the date and time when the monitoring unit 14 started recording the operation history is recorded. The process name column 304 records the process name (application name) of the process executed in the active window. In the window title column 305, identification information for identifying the application (eg, name of editing work, name of file to be edited, etc.) is recorded. For example, if the application is an e-mail program (mailer), the editing work name is "Create" and the title of the mail is "Re: Thank you". The file name column 306 records the name of the operation target file. In the operation name column 307, operation details are recorded. A current path or a path before movement or change is recorded in the path column 308 . A path after movement or change is recorded in the path 2 column 309 . As for the operation history, one record is created for one active window and recorded in chronological order according to the order in which the active windows were displayed.

FIG. 4 shows an example of an e-mail transmission/reception history, which is part of the operation history received from the terminal device 11 . In FIG. 4, the identification information of the terminal device is recorded in the PC name column 401 . The user name column 402 records the identification information of the employee who has logged in to the terminal device. In the operation start date and time column 403, data of the date and time when recording of the operation history is started is recorded. The subject of the mail is recorded in the subject column 404 . The attached file name is recorded in the attached file column 405 . In an operation name column 406, information is recorded as to whether the terminal device or the user has received or sent the mail. The sender column 407 records the sender of the mail. The address column 408 records the address of the mail. In the operation history, one record is created for each mail and recorded in chronological order according to the order of reception or transmission.

FIG. 5 shows an example of the input history to the input device, which is a part of the operation history received from the terminal device 11 . The identification information of the terminal device is recorded in the PC name column 501 . In the user name column 502, the identification information of the employee who has logged in to the terminal device is recorded. In the operation start date and time column 503, data of the date and time when recording of the operation history is started is recorded. The keyboard keystroke count column 504 records the number of keyboard keystrokes during a predetermined monitoring period (for example, one minute) from the operation start time. A pointer movement distance column 505 records data on the distance that the pointer of the pointing device has moved during a predetermined monitoring period (for example, one minute) from the operation start date and time.

(Information analysis processing)
FIG. 6 is a flowchart showing an example of information analysis processing. The CPU 41 of the information analysis device 13 executes this information analysis processing according to the information analysis program 47 . Thereby, the CPU 41 functions as the analysis unit 18 . Before this process is executed, the log management server 12 receives operation histories (application operation histories, e-mail transmission/reception histories, input device input histories) from the terminal device 11 and stores them in log management. Register in DB15.

In S<b>601 , the CPU 41 inputs the operation history to the memory 43 . For example, the CPU 41 may receive the operation history from the log management DB 15 of the log management server 12, or read it from a data storage medium such as a CD-ROM. Therefore, the network interface 44 and the CD-ROM drive used for reception function as input means. It should be noted that the read unit of the operation history can be freely set, such as user name, PC name, operation start date and time. The correspondence between the application operation history, e-mail transmission/reception history, and input device input history, which are part of the operation history, is performed based on the user name, PC name, and operation start date and time.

In S602, the CPU 41 creates a file creation table (FIG. 10A), creates a file replication table (FIG. 10B) in S603, and creates a file diffusion table (FIG. 10C) in S604. Methods for creating the file creation table, file replication table, and file diffusion table will be described later. Note that the file creation table, file duplication table, and file diffusion table may be provided in the HDD 45 or may be provided in the memory 43, for example.

At S605, the CPU 41 writes the analysis result to the analysis result DB 19 based on the file creation table, the file duplication table, and the file diffusion table, and outputs the analysis result from the output unit 46 at S606. FIG. 11A is a diagram showing an example of analysis results. Each record consists of creation time and usage time corresponding to the file name. FIG. 11B is a diagram showing an output example of analysis results. The CPU 41 of the information analysis device 13 charts or graphs the analysis results and outputs them to the output unit 46 . FIG. 11B shows a bar graph showing creation time and usage time for each file. In this example, the report file (report.xls) is used more than the time it was created, and the minutes file (minutes.xls) is used more than the time it was created. It becomes possible to visually grasp things that are small. In this manner, the CPU 41 may create chart data that charts the file usage status based on the analysis results.

(File creation table creation processing)
FIG. 7 is a flowchart showing an example of file creation table creation processing. In S701, the CPU 41 reads out one operation history record from the memory 43, and in S702, determines whether or not there is a file operation. Determination of whether or not there is a file operation is specifically made when the name of the file to be operated is recorded in the file name column (for example, 306, 405) of the operation history. , if not recorded, it is determined that there is no file operation.

In S703, the CPU 41 determines whether the combination of the PC name (user name) and file (path name/file name) of the read record is registered in the file creation table. FIG. 10A is a diagram showing an example of a file creation table.

If it is determined that the record is not registered in the file creation table (NO in S703), in S704 the CPU 41 registers the record in the file creation table and assigns an ID. If it is determined that the record is registered in the file creation table (YES in S703), in S705 the CPU 41 counts up the creation time of the registered record. Record the calculated creation time in the file creation table.

In S<b>706 , the CPU 41 determines whether or not analysis processing has been completed for all the records forming the read operation history. If the analysis processing has not ended, the process returns to S701 to analyze the next record. If the analysis processing has ended, the processing ends.

(File replication table creation processing)
FIG. 8 is a flowchart showing an example of file replication table creation processing. In S801, the CPU 41 reads one record of the file creation table, and in S802, determines whether or not there is a file duplication operation for that file (path name/file name) in the operation history. Specifically, whether or not there is a file duplication operation is recorded in the operation name column (for example, 307, 406) of the operation history. If it is recorded, it is determined that there is a file duplication operation, and if it is not recorded, it is determined that there is no file operation.

If it is determined that there is a file duplication operation (YES in S802), in S803 the CPU 41 assigns an ID associated with the ID of the record read out in S801 and registers it in the file duplication table. FIG. 10B is a diagram showing an example of a file replication table. For example, a file (path name: C\book1.xls, file name: The record of copybook1.xls) is registered in the file replication table as ID "1-1" as an ID associated with ID "1".

In S804, it is determined whether or not there is a file duplication operation for the file (path name/file name) of the record registered in the file duplication table in the operation history. If it is determined that there is a file duplication operation (YES in S804), an ID associated with the ID of the target record is assigned in S803 and newly registered in the file duplication table. For example, a file (path name: C\weekly report.xls) obtained by renaming a file (path name: C\copybook1.xls, file name: copybook1.xls) whose ID is "1-1" registered in the file replication table , file name: weekly report.xls) is registered in the file replication table as ID "1-2" as an ID associated with ID "1-1".

Such recursive processing makes it possible to exhaustively detect a group of files spread in a tree- like manner for one record extracted from the file creation table and register them in the file replication table.

In S805, the CPU 41 determines whether or not analysis processing has been completed for all records. If the analysis processing has not ended, the process returns to S801 to analyze the next record. If the analysis processing has ended, the processing ends.

(File diffusion table creation processing)
FIG. 9 is a flowchart showing an example of file diffusion table creation processing. In S901, the CPU 41 reads one record of the file creation table and the file duplication table, and in S902 determines whether or not the file diffusion operation for that file (path name/file name) is in the operation history.

The file diffusion operation includes sending an attached file by e-mail, uploading a file using a communication protocol such as FTP or HTTP, uploading to a shared folder, and the like. For example, if the target file is recorded in the attached file name column (for example, 405) of the operation history, it is determined that there is a file diffusion operation, and if not recorded, it is determined that there is no file diffusion operation.

If it is determined that there is a file diffusion operation (YES in S902), in S903 the CPU 41 assigns an ID associated with the ID of the record read out in S901, and the file diffusion table together with the diffusion destination (e.g., mail destination). to register. FIG. 10C is a diagram showing an example of a file spread table. For example, the record in which "PC1" sent the file with the ID "1" read from the file creation table (path name: C\book1.xls, file name: book1.xls) to "PC10" by e-mail is In the file diffusion table, the ID "1-0-1" is registered as the ID associated with the ID "1", and the destination "PC10" of the mail that is the diffusion destination is registered.

In S904, the CPU 41 calculates the usage time of the target file at each diffusion destination. Specifically, if the PC name column (for example, 301, 401) and the file name column (for example, 306, 405) of the operation history record the diffusion destination and file name of the operation target, the file It is determined that there is a use operation. Then, a process of counting up the used time is performed, and the calculated time is recorded in the file diffusion table.

In S905, the CPU 41 determines whether or not analysis processing has been completed for all records. If the analysis processing has not ended, the process returns to S901 to analyze the next record. If the analysis processing has ended, the processing ends.

The usage time for a file can be calculated based on the file spread table. For example, the usage time of the file with ID "1" (path name: C\book1.xls, file name: book1.xls) in FIG. -1" total time (356 seconds). That is, by managing the IDs associated with the file creation table, the file replication table, and the file diffusion table, the utilization time of the file group spread in a tree for one record extracted from the file creation table can be comprehensively managed. can be calculated.

As described above, according to the present embodiment, it is possible to calculate the creation time and the usage time of a file, and it is possible for the user to grasp the usage status of the file. By grasping the usage status of files, for example, it is possible to grasp whether or not the time taken to create a certain file was appropriate, and it is possible to improve the efficiency of operations.

Moreover, it is also possible to perform a more detailed analysis on the analysis results. FIG. 11C is a diagram showing an output example of analysis results. According to FIG. 11C, there is shown a bar graph showing usage time of a specific file (for example, minutes.xls) for each user. In this example, "UserC" and "UserE" are using the minutes file (minutes.xls), but "UserA", "UserB", and "UserD" are not using it visually. know to comprehend. In other words, by displaying the usage time of a specific file for each user, an employee's manager (supervisor, manager, etc.) or the creator of the file can spread the file to any user (e.g., by e-mail). It will be easier to understand whether it is better to send an attached file with For example, the load on the mail server can be reduced by not sending attached files to users who use the service less often. In addition, for users who do not use the service frequently, it is possible to reduce the number of unnecessary e-mails with attached files, thereby improving the efficiency of operations.

<Other embodiments>
The log management server 12 and the information analysis device 13 described above may be realized on the same server, or may be executed on different servers. In the former case, there is an advantage that the log management server 12 and the information analysis device 13 do not need to perform data communication through the network 50 . In this case, the information analysis device 13 is provided with a log management DB 15 , an analysis unit 18 and an analysis result DB 19 . By implementing the log management server 12 and the information analysis device 13 on the same server in this way, it becomes possible to manage the operation history and analysis results within the same company. Therefore, it is possible to perform an analysis that takes security into consideration.

Claims (9)

input means for inputting a user's operation history in each terminal device of a plurality of terminal devices;
a calculation means for calculating a creation time when a file is created and a usage time when the file is used from the operation history input by the input means;
analysis means for analyzing the utilization status of the file based on the creation time and the use time calculated by the calculation means;
output means for outputting an analysis result by the analysis means, wherein the output means outputs, as the analysis result, data displayed by comparing the creation time and the use time of the file with respect to the file. information analysis device. Furthermore,
a first determination means for determining whether or not there is a file operation in the operation history;
2. The information analysis apparatus according to claim 1, further comprising first recording means for recording a target file operation in a file creation table when said determining means determines that there is a file operation. Furthermore,
a second determination means for determining whether or not a file duplication operation for the file read from the file creation table is included in the operation history;
When the second determination means determines that there is a file duplication operation, the target file duplication operation is associated with the file read out from the file creation table, and a tree-structured ID is assigned to the file duplication table. 3. The information analysis apparatus according to claim 2, further comprising second recording means for recording. Furthermore,
a third determination means for determining whether or not a file diffusion operation for a file read from the file creation table and the file replication table is included in the operation history;
When the third determination means determines that there is a file diffusion operation, the target file diffusion operation is associated with the files read out from the file creation table and the file replication table , and a tree-structured ID is assigned. 4. The information analyzing apparatus according to claim 3, further comprising: a third recording means for recording in a file diffusion table. 5. The information analysis apparatus according to claim 4, wherein said calculation means comprehensively calculates said usage time from said file diffusion table associated with said file creation table in a tree structure . The calculation means calculates the usage time of the file for each user,
6. The information analysis apparatus according to claim 1, wherein said output means outputs a usage time of a specific file for each user. An information analysis method executed by an information analysis device communicating with a plurality of terminal devices,
an input step of inputting a user's operation history in each terminal device of a plurality of terminal devices;
a calculation step of calculating a creation time of creating a file and a usage time of using the file from the operation history input in the input step;
an analysis step of analyzing the utilization status of the file based on the creation time and the usage time calculated in the calculation step;
an output step of outputting an analysis result obtained by the analysis step , wherein the output step outputs, as the analysis result, data displayed by comparing the creation time and the usage time of the file with respect to the file. information analysis method. A program that causes a computer to function as each means of the information analysis apparatus according to any one of claims 1 to 6. An information analysis system comprising: an operation history management server that holds a user's operation history in each terminal device of a plurality of terminal devices; and an information analysis device that analyzes the operation history,
The information analysis device is
input means for inputting the operation history of the user;
a calculation means for calculating a creation time when a file is created and a usage time when the file is used from the operation history input by the input means;
analysis means for analyzing the utilization status of the file based on the creation time and the use time calculated by the calculation means;
output means for outputting an analysis result by the analysis means, wherein the output means outputs, as the analysis result, data displayed by comparing the creation time and the use time of the file with respect to the file. information analysis system.

Images