JP7452849B2 - Abnormal operation detection device, abnormal operation detection method, and program - Google Patents

Description

The present invention relates to an abnormal operation detection device, an abnormal operation detection method, and a program for detecting an abnormal operation on a user terminal used in an information system within an organization such as a company.

Conventionally, various measures have been taken to prevent information leaks from user terminals used in information systems within organizations such as companies.

For example, Patent Document 1 discloses a technique in which an abnormal operation detection device detects an abnormal operation by acquiring the operation content of a user terminal and comparing it with a normal operation stored in advance.

Japanese Patent Application Publication No. 2010-250502

However, with the technology described in Patent Document 1, it is difficult to set normal operations that are stored in advance in the abnormal operation detection device, and there is a possibility that false detections may occur during the initial operation of the abnormal operation detection device. Ta.

An object of the present invention is to provide an abnormal operation detection device, an abnormal operation detection method, and a program that can facilitate settings for detecting abnormal operations on a user terminal.

An abnormal operation detection device according to one aspect of the present invention includes an operation log collected from a user terminal, a standard list according to an organization to which the user belongs, and a variable item corresponding to a normal operation at the user terminal and the above-described list. a detection means for detecting an operation that does not correspond to the variable item or corresponds to the immutable item by comparing it with the standard list that includes the immutable item that corresponds to an abnormal operation at the user terminal; and the standard list. and updating means for updating the variable items in accordance with an analysis result of the operation log.

An abnormal operation detection method according to one aspect of the present invention includes an operation log collected from a user terminal, which is a standard list according to the organization to which the user belongs, and includes variable items corresponding to normal operations at the user terminal and the a detection step of detecting an operation that does not correspond to the variable item or corresponds to the immutable item by comparing it with the standard list that includes the immutable item that corresponds to the abnormal operation at the user terminal; and the standard list and updating the variable items in accordance with an analysis result of the operation log.

A program according to one aspect of the present invention causes a computer to execute the above abnormal operation detection method.

According to the present invention, settings for detecting an abnormal operation on a user terminal can be easily made. Note that, according to the present invention, other effects may be achieved instead of or in addition to the above effects.

FIG. 1 is a diagram illustrating a configuration example of an information system according to a first embodiment. FIG. 2 is a functional block diagram of the abnormal operation detection device according to the first embodiment. FIG. 3 is a diagram illustrating the relationship between each component of the abnormal operation detection device shown in FIG. 2. FIG. FIG. 3 is a diagram illustrating a configuration example of a reference list and a reference list pattern according to the first embodiment. FIG. 3 is a diagram showing a flowchart of abnormal operation detection processing according to the first embodiment. FIG. 3 is a diagram showing a flowchart of alert notification processing according to the first embodiment. 1 is a diagram showing a hardware configuration of a computer that operates as an abnormal operation detection device according to a first embodiment; FIG. FIG. 2 is a functional block diagram of an abnormal operation detection device according to a second embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. Note that, in this specification and the drawings, elements that can be explained in the same manner may be designated by the same reference numerals, so that redundant explanation can be omitted.

The explanation will be given in the following order.
1. Overview of embodiments of the present invention 2. First embodiment 2.1. Information system configuration 2.2. Abnormal operation detection device 2.3. Operation example 2.4. Modification example 1
2.5. Modification example 2
2.6. Hardware configuration 2.7. Explanation of effects 3. Second embodiment 3.1. Abnormal operation detection device 3.2. Operation example 4. Other embodiments 5. Additional notes

<<1. Overview of embodiments of the present invention >>
In an embodiment of the present invention, for example, the abnormal operation detection device analyzes operation logs collected from each user terminal in the information system and a reference list based on the organization to which the user of the user terminal belongs. By doing so, the abnormal operation detection device can determine whether the user terminal is being used normally.

Note that the above-mentioned technical features are specific examples of the embodiments of the present invention, and the embodiments of the present invention are not limited to the above-mentioned technical features.

<<2. First embodiment >>
<2.1. Information system configuration>
FIG. 1 shows an example of the configuration of an information system according to the first embodiment. The information system according to this embodiment is an information system used within an organization such as a company, and includes an abnormal operation detection device 10, a plurality of user terminals 12, an external computer 14, a business system server 15, and a management system. terminal 1.

The abnormal operation detection device 10 is connected to a network 11 and detects operations of a plurality of user terminals 12 on the network 11, for example, operations on an external computer 14 such as a web server via the Internet 13, or a business system server 15. Detects actions performed when connected to etc. Then, if the detected operation is abnormal, the abnormal operation detection device 10 notifies each terminal to that effect. Further, the administrator of the information system can configure the abnormal operation detection device 10 using the administrator terminal 16 connected to the network 11.

<2.2. Abnormal operation detection device>
FIG. 2 shows a functional block diagram of the abnormal operation detection device according to this embodiment.

The abnormal operation detection device 10 includes a log collection unit 101, an abnormality detection level determination unit 102, an alert notification unit 103, an operation-standard list comparison unit 104, a standard list pattern determination unit 105, a variable item update unit 106, and a database (DB). It has 107. The database 107 includes an operation log DB 1071, a user DB 1072, a reference list DB 1073, a reference list pattern DB 1074, and a system definition DB 1075.
The relationship between the above-mentioned components will be described later with reference to FIG. 3.

FIG. 3 is a diagram illustrating the relationship between each component of the abnormal operation detection device shown in FIG. 2.

The log collection unit 101 collects user operations on each user terminal 12 as a log (hereinafter also referred to as an operation log), and stores the collected operation log in the operation log DB 1071. Further, the log collection unit 101 notifies the abnormality detection level determination unit 102 that the log collection has been performed.

The abnormality detection level determination unit 102 determines the abnormality detection level of user operations at each user terminal 12. Specifically, when the anomaly detection level determination unit 102 receives a notification from the log collection unit 101 that log collection has been performed, the anomaly detection level determination unit 102 accesses the user DB 1072 and acquires information on the user whose anomaly detection level is to be determined. . Furthermore, the abnormality detection level determination unit 102 acquires an operation log regarding the user from the operation log DB 1071, acquires reference list information from the reference list DB 1073, and performs analysis. When the abnormality detection level determination unit 102 issues an alert, it notifies the alert notification unit 103 to that effect. After the determination is completed, the abnormality detection level determination unit 102 notifies the operation-criteria list comparison unit 104 of the determination. In this way, the abnormality detection level determination unit 102 functions as a detection means for detecting an abnormal operation on the user terminal 12.

The alert notification unit 103 outputs an alert to the target user terminal 12. Specifically, upon receiving the notification from the abnormality detection level determination unit 102, the alert notification unit 103 acquires the alert notification method from the system definition DB 1075, and outputs the alert to the target user terminal 12. In this way, the alert notification unit 103 functions as an alert output means.

The operation-criteria list comparison unit 104 analyzes the operation log, the existing criteria list, and the criteria list pattern, and determines whether to update the criteria list. Specifically, upon receiving the notification from the abnormality detection level determination unit 102, the operation-standard list comparison unit 104 acquires the operation log from the operation log DB 1071 and transmits it to the reference list pattern determination unit 105. The operation-standard list comparison unit 104 analyzes the standard list pattern information and operation log returned from the standard list pattern determination unit 105 and the standard list information acquired from the standard list DB 1073. The operation-criteria list comparison unit 104 transmits information to the variable item updating unit 106 when it is necessary to modify the variable items in the criteria list. Further, the operation-criteria list comparison unit 104 acquires criterion list refining period information from the system definition DB 1075. The reference list refinement period information indicates a predetermined period for updating the variable items of the reference list and improving the detection accuracy of abnormal operations.

The reference list pattern determination unit 105 determines a reference list pattern necessary for refining the reference list based on the operation log. Specifically, upon receiving the operation log from the operation-reference list comparison unit 104, the reference list pattern determination unit 105 acquires necessary reference list pattern information from the reference list pattern DB 1074, and analyzes the result along with the operation log. is returned to the operation-reference list comparison unit 104.

The variable item update unit 106 updates the variable items in the existing reference list. In other words, the variable item updating unit 106 functions as a means for updating variable items. Specifically, upon receiving the notification from the operation-criteria list comparison unit 104, the variable item update unit 106 updates the criteria list information in the criteria list DB 1073.

The operation log DB 1071 stores operation logs collected by the log collection unit 101. The saved operation log is used by the abnormality detection level determination section 102 and the operation-criteria list comparison section 104.

User DB 1072 stores user information. The user information is used by the abnormality detection level determination unit 102. Further, the abnormality detection cumulative value calculated by the abnormality detection level determination unit 102 is also stored in the user DB 1072. Details of the abnormality detection cumulative value will be described later.

The standard list DB 1073 stores standard list information. The reference list information is used by the abnormality detection level determination section 102 and the operation-criteria list comparison section 104. Further, the reference list information is updated by the variable item updating unit 106.

The reference list pattern DB 1074 stores a plurality of reference list pattern information. The reference list pattern information is used by the reference list pattern determination unit 105.

The system definition DB 1075 stores information about the entire system. The information includes, for example, an alert notification method for the user terminal 12 and a reference list refinement period, and is referred to by the alert notification unit 103 and the operation-criteria list comparison unit 104.

FIG. 4 shows a configuration example of a reference list and a reference list pattern according to the first embodiment.

As illustrated, reference lists 1, 2, and 3 each include variable items and immutable items. The variable items serve as a whitelist and indicate operation items that correspond to normal operations. On the other hand, the immutable items serve as a blacklist and indicate operation items that correspond to abnormal operations. Further, variable item a, variable item b, and variable item c, which are different from each other, are prepared, and a combination of each with an immutable item is used as a reference list pattern. Examples of variable items include working hours, software normally used for work, usage time of the software, and time for accessing an accessible shared server. Examples of immutable items include installing software that is prohibited for business use, accessing websites that are prohibited from viewing, and accessing shared servers that are not normally used for business purposes. In this way, an abnormal operation refers to an operation that is prohibited on the user terminal and an operation outside a predetermined time.

Note that the number and configuration of the reference list and reference list pattern according to this embodiment are not limited to the illustrated example.

<2.3. Operation example>
An example of operation according to the first embodiment will be described. FIG. 5 shows a flowchart of abnormal operation detection processing according to the first embodiment.

First, the abnormal operation detection device 10 stores a reference list corresponding to the organization or department for each user in the reference list DB 1073 (S101).

Next, the log collection unit 101 collects operation logs from each user terminal 12, stores the collected operation logs in the operation log DB 1071, and notifies the abnormality detection level determination unit 102 (S102).

Upon receiving the notification from the log collection unit 101, the abnormality detection level determination unit 102 performs an alert notification process (S103). The alert notification process will be described later with reference to FIG. Thereafter, the operation-reference list comparison unit 104 transmits the operation log information to the reference list pattern determination unit 105 and requests determination of the reference list pattern.

The reference list pattern determination unit 105 extracts information regarding variable items from the operation log information received from the operation-reference list comparison unit 104. Thereafter, the reference list pattern determination unit 105 compares the information regarding the extracted variable items with the variable items in each reference list pattern in the reference list pattern DB 1074 (S104), and determines the error situation (S105). Reference list patterns with an extremely large or small number of errors will no longer be compared in the operation-reference list comparison unit 104 and will not be referenced (S106). In this way, the reference list pattern determination unit 105 functions as a selection unit that selects a reference list pattern in which the number of errors is within a predetermined threshold range from a plurality of reference list patterns.

Next, the reference list pattern determination unit 105 determines whether the next reference list exists (S107). If the next reference list exists, the process returns to S104 and repeats the process. That is, the reference list pattern determination unit 105 repeats the processes from S104 to S106 as many times as the number of reference lists (S107), and sends only information on each reference list pattern to be compared to the operation-reference list comparison unit 104.

Next, the operation-criteria list comparison unit 104 compares and analyzes the information on each comparison target criterion list pattern received from the criterion list pattern determination unit 105, the operation log, and the existing criterion list information (S108). If the variable item is different from the variable item in the existing standard list, the operation-standard list comparison unit 104 transmits new variable item information to the variable item updating unit 106. When receiving new variable item information, the variable item update unit 106 updates the variable items of the standard list stored in the standard list DB 1073 using the information, and sets a new standard list (S109). In this way, the variable item update unit 106 functions as an update unit that updates variable items according to the analysis result of the operation log.

In addition, the operation-criteria list comparison unit 104 acquires criterion list refinement period information from the system definition DB 1075, and if it is within the period, refines the criterion list based on the operation log newly collected by the log collection unit 101. (S110).

FIG. 6 shows a flowchart of alert notification processing according to the first embodiment. The alert notification process described below corresponds to S103 in FIG. 5.

First, upon receiving a notification from the log collection unit 101, the abnormality detection level determination unit 102 acquires information on the corresponding user from the user DB 1072 (S201).

Next, the abnormality detection level determination unit 102 acquires an operation log related to the user from the operation log DB 1071 based on the acquired user information. The abnormality detection level determination unit 102 compares the reference list information obtained in advance from the reference list DB 1073 with the operation log information, and determines whether or not an abnormal operation has been performed. Specifically, the abnormality detection level determination unit 102 extracts information regarding immutable items from the acquired operation log information, and compares the extracted immutable items with the immutable items in the reference list information (S202). . If there is even one matching item, the abnormality detection level determination unit 102 transmits information to the alert notification unit 103 (that is, proceeds to S207). On the other hand, if there is no matching item, the anomaly detection level determination unit 102 extracts information regarding the position, employment type, and department (i.e., user attributes) from the user information acquired from the user DB 1072, and extracts the variable item The abnormality detection level is acquired for each time (S203). The anomaly detection level determination unit 102 scores information such as position, employment type, and department as an anomaly detection level for each variable item, and makes it easier or harder to issue an alert according to the anomaly detection level. , to control the output of alerts. In this way, the abnormality detection level is set for each variable item. Examples of variable items include working hours, software normally used for work, time spent accessing accessible shared servers, and anomaly detection levels are set for each according to user information (department, position, etc.) be done. By analyzing user information, operation logs, and anomaly detection levels, an alert is issued when the cumulative number of abnormal operations detected for each variable item (i.e., judged to be outside the normal operation range) reaches a certain value. Output.

Next, the abnormality detection level determination unit 102 analyzes the extracted user information, operation log, and abnormality detection level (S204), calculates an abnormality detection cumulative value indicating the cumulative number of abnormal operations detected, and stores it in the user DB 1072. (S205).

Next, the abnormality detection level determining unit 102 determines whether the cumulative abnormality detection value exceeds a predetermined threshold (S206), and if an operation for which the cumulative abnormality detection value exceeds the predetermined threshold is detected, the abnormality detection level determining unit 102 sends an alert to the alert notification unit 103. Send the information (that is, proceed to S207). Note that if the abnormality detection cumulative value is less than or equal to the predetermined threshold, the process ends.

Upon receiving the information from the abnormality detection level determination unit 102, the alert notification unit 103 acquires the alert notification method to the corresponding user terminal 12 from the system definition DB 1075 (S207), and notifies the alert to the corresponding user terminal 12 (S208). ).

<2.4. Modification example 1>
According to the first modification of the present embodiment, the reference list may not include variable items. Depending on the organization or department, the standard list may be managed using only immutable items. Thereby, maintenance of the standard list stored in the standard list DB 1073 can be facilitated.

<2.5. Modification example 2>
According to the second modification of the present embodiment, the contents of the variable items and immutable items can be manually changed by the administrator of the abnormal operation detection device 10 after the reference list refinement period ends. For example, if a new cloud server is used in the information system after the refining period ends, if the standard list is re-refined to reflect information about the cloud server in the standard list, it will take some time before the operation is successfully detected. It takes time. Therefore, by allowing the administrator to make manual changes, information can be immediately reflected in the standard list.

<2.6. Hardware configuration>
FIG. 7 is a diagram showing the hardware configuration of a computer that operates as the abnormal operation detection device according to the first embodiment.

The computer 700 includes a CPU 701, a main storage device 702, an auxiliary storage device 703, an interface 704, and a communication interface 705.

The operations of the computer 700 are stored in the auxiliary storage device 703 in the form of a program. The CPU 701 reads the program from the auxiliary storage device 703, expands it to the main storage device 702, and executes the operation of the abnormal operation detection device described in this embodiment according to the program.

Auxiliary storage 703 is an example of a non-transitory tangible medium. Other examples of non-transitory tangible media include magnetic disks, magneto-optical disks, CD-ROMs (Compact Disk Read Only Memory), DVD-ROMs (Digital Versatile Disk Read Only Memory), etc. connected via the interface 704. Examples include semiconductor memory. Furthermore, when a program is distributed to the computer 700 via a communication line, the computer 700 that receives the program may load the program into the main storage device 702 and operate according to the program.

Further, some or all of the components of the abnormal operation detection device may be realized by a general-purpose or dedicated circuit, a processor, etc., or a combination thereof. These may be configured by a single chip or multiple chips connected via a bus. Part or all of each component may be realized by a combination of the circuits and the like described above and a program.

Note that not only the computer that implements the abnormal operation detection device, but also the computer that implements the user terminal 12, external computer 14, business system server 15, administrator terminal 16, etc. may be configured in the same manner.

<2.7. Effect explanation>
As described above, according to the present embodiment, settings for detecting abnormal operations on the user terminal can be made easy.

<<3. Second embodiment >>
The first embodiment described above is a specific embodiment, but the second embodiment is a more generalized embodiment. Note that the information system according to the second embodiment is the same as the information system according to the first embodiment, so a description thereof will be omitted.

<3.1. Abnormal operation detection device>
FIG. 8 shows a functional block diagram of an abnormal operation detection device according to the second embodiment. The abnormal operation detection device 800 detects an abnormal operation at a user terminal. The abnormal operation detection device 800 includes a detection section 801 and an update section 802.

The detection unit 801 and the update unit 802 may be implemented by one or more processors, memory (eg, non-volatile memory and/or volatile memory), and/or a hard disk. The detection unit 801 and the update unit 802 may be implemented by the same processor, or may be implemented by separate processors. The memory may be included within the one or more processors or external to the one or more processors.

The abnormal operation detection device 800 may include a memory that stores a program (instruction) and one or more processors that can execute the program (instruction). The one or more processors may execute the above program to perform the operations of the detection unit 801 and the update unit 802. The above program may be a program for causing a processor to execute the operations of the detection unit 801 and the update unit 802.

<3.2. Operation example>
An example of operation according to the second embodiment will be described.

According to the second embodiment, the abnormal operation detection device 800 (detection unit 801) collects operation logs collected from user terminals into a standard list according to the organization to which the user belongs, and determines whether the user terminal is normal. By comparing the variable items corresponding to the operations and the immutable items corresponding to the abnormal operations at the user terminal with a reference list, an operation that does not correspond to the variable items or corresponds to the immutable items is detected. Further, the abnormal operation detection device 800 (updating unit 802) updates the variable items of the reference list according to the analysis result of the operation log.

-Relationship with the first embodiment As an example, the abnormal operation detection device 800 according to the second embodiment is the abnormal operation detection device 10 according to the first embodiment. For example, the detection unit 801 may perform the operation of the abnormality detection level determination unit 102 according to the first embodiment. Furthermore, the updating unit 802 may perform the operations of the variable item updating unit 106 according to the first embodiment. In this case, the description of the first embodiment may also be applied to the second embodiment.

Note that the second embodiment is not limited to this example.

The second embodiment has been described above. According to the second embodiment, it is possible to easily configure settings for detecting abnormal operations on a user terminal.

<<4. Other embodiments >>
Note that the present invention is not limited to the embodiments described above. It will be understood by those skilled in the art that the embodiments described above are exemplary only and that various modifications can be made without departing from the scope and spirit of the invention.

For example, the steps in the process described herein do not necessarily have to be performed chronologically in the order described in the flowchart. For example, steps in a process may be performed in a different order than that described in the flowchart, or in parallel. Also, some of the steps in the process may be deleted, and additional steps may be added to the process.

In addition, a device comprising the components of the abnormal operation detection device described in this specification (for example, one or more devices (or units) of a plurality of devices (or units) constituting the abnormal operation detection device, or the above A module for one of a plurality of devices (or units) may be provided. Further, a method including processing of the above-mentioned components may be provided, and a program for causing a processor to execute the processing of the above-mentioned components may be provided. Further, a non-transitory computer readable medium may be provided that records the program. Of course, such devices, modules, methods, programs, and computer-readable non-transitory storage media are also included in the present invention.

<<5. Additional notes >>
Part or all of the above embodiments may be described as in the following additional notes, but are not limited to the following.

(Additional note 1)
Operation logs collected from user terminals are classified into a standard list according to the organization to which the user belongs, with variable items corresponding to normal operations at the user terminal and immutable items corresponding to abnormal operations at the user terminal. Detection means for detecting an operation that does not correspond to the variable item or corresponds to the immutable item by comparing with the reference list including;
An abnormal operation detection device comprising: an updating unit that updates the variable item of the reference list according to an analysis result of the operation log.

(Additional note 2)
Further comprising a selection means for selecting a reference list pattern in which the number of errors is within a predetermined threshold range from a plurality of reference list patterns combining different variable items and the non-variable items,
The abnormal operation detection device according to appendix 1, wherein the updating means updates the variable item according to an analysis result of the operation log using the selected reference list pattern.

(Additional note 3)
3. The abnormal operation detection device according to appendix 1 or 2, wherein the updating means repeatedly updates the variable items for a predetermined period according to the analysis results of newly collected operation logs.

(Additional note 4)
The abnormal operation detection device according to appendix 3, wherein after the predetermined period ends, the variable items and the immutable items in the reference list can be changed by an administrator.

(Appendix 5)
The abnormal operation detection device according to any one of Supplementary Notes 1 to 4, further comprising an output means for outputting an alert indicating that the operation has been detected to the user terminal.

(Appendix 6)
5. The abnormal operation detection device according to appendix 5, wherein the output means controls output of the alert according to an abnormality detection level for each of the variable items according to attributes of the user.

(Appendix 7)
The abnormal operation detection device according to appendix 6, wherein the attributes include information on the user's job title, employment type, and department.

(Appendix 8)
8. The abnormal operation detection device according to any one of Supplementary Notes 5 to 7, wherein the output means outputs the alert according to an alert notification method depending on the user.

(Appendix 9)
Operation logs collected from user terminals are classified into a standard list according to the organization to which the user belongs, with variable items corresponding to normal operations at the user terminal and immutable items corresponding to abnormal operations at the user terminal. a detection step of detecting an operation that does not correspond to the variable item or corresponds to the immutable item by comparing with the reference list including;
An abnormal operation detection method, comprising: an updating step of updating the variable item of the reference list according to an analysis result of the operation log.

(Appendix 10)
A program for causing a computer to execute the method described in Appendix 9.

INDUSTRIAL APPLICABILITY The present invention can be used in an information system within an organization such as a company to detect an abnormal operation on a user terminal. According to the present invention, it is possible to prevent information leakage outside the organization due to hacking or internal unauthorized operations. Further, by introducing the present invention, it is possible to expect the effect of deterring internal improprieties.

10 Abnormal operation detection device 101 Log collection unit 102 Abnormality detection level determination unit 103 Alert notification unit 104 Operation-standard list comparison unit 105 Standard list pattern determination unit 106 Variable item update unit 107 Database 1071 Operation log DB
1072 User DB
1073 Standard list DB
1074 Standard list pattern DB
1075 System definition DB

Claims (10)

Operation logs collected from user terminals are classified into a standard list according to the organization to which the user belongs, with variable items corresponding to normal operations at the user terminal and immutable items corresponding to abnormal operations at the user terminal. Detection means for detecting an operation that does not correspond to the variable item or corresponds to the immutable item by comparing with the reference list including;
An abnormal operation detection device comprising: an updating unit that updates the variable item of the reference list according to an analysis result of the operation log. Further comprising a selection means for selecting a reference list pattern in which the number of errors is within a predetermined threshold range from a plurality of reference list patterns combining different variable items and the non-variable items,
2. The abnormal operation detection device according to claim 1, wherein the updating means updates the variable item according to an analysis result of the operation log using the selected reference list pattern. 3. The abnormal operation detection device according to claim 1, wherein the updating means repeatedly updates the variable items for a predetermined period according to the analysis results of newly collected operation logs. 4. The abnormal operation detection device according to claim 3, wherein the variable items and the immutable items in the reference list can be changed by an administrator after the predetermined period ends. The abnormal operation detection device according to any one of claims 1 to 4, further comprising an output means for outputting an alert indicating that the operation has been detected to the user terminal. 6. The abnormal operation detection device according to claim 5, wherein the output means controls the output of the alert according to an abnormality detection level for each of the variable items according to an attribute of the user. 7. The abnormal operation detection device according to claim 6, wherein the attributes include information on the user's job title, employment type, and department. The abnormal operation detection device according to any one of claims 5 to 7, wherein the output means outputs the alert according to an alert notification method depending on the user. A method performed by a computer, the method comprising:
Operation logs collected from user terminals are classified into a standard list according to the organization to which the user belongs, with variable items corresponding to normal operations on the user terminal and immutable items corresponding to abnormal operations on the user terminal. a detection step of detecting an operation that does not correspond to the variable item or corresponds to the immutable item by comparing with the reference list including;
an updating step of updating the variable item of the reference list according to an analysis result of the operation log ,
The computer has a database having the operation log and the criteria list.
An abnormal operation detection method characterized by: A program for causing a computer to execute the method according to claim 9.

Images