Implementation flow analysis device, implementation flow analysis method and implementation flow analysis program

Abstract

To enable presentation of an element of an implementation flow that is a candidate for automation.SOLUTION: An implementation flow analysis unit 110 extracts multiple character strings described for multiple flow elements in an implementation flow as multiple pickup words. An implementation flow matching unit 120 performs a search against a flow database 191 using the above-mentioned multiple pickup words as search words, and obtains search results including matching results for each search word for multiple tag information. The implementation flow analysis unit 110 selects one or more flow elements corresponding to one or more tasks that are candidates for automation as one or more candidate elements from the plurality of flow elements in the implementation flow based on the matching results contained in the above-mentioned search results. The implementation flow analysis unit 110 creates an emphasized flow that is the implementation flow with the above-mentioned one or more candidate elements highlighted.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to operational flow analysis for the automation of operational flows. [Background technology]

[0002] SOAR automates operational tasks related to responding to cyber attacks. SOAR is an abbreviation for Security Orchestration, Automation & Response. When introducing SOAR, it is necessary to create a playbook in advance to identify routine tasks that can be automated in the operational tasks related to responding to cyber attacks. A playbook is a flow for automating operations using SOAR. However, for users with little knowledge of SOAR, creating playbooks is a high hurdle, and it is unclear how to identify routine tasks suitable for automating maintenance operations and how to create playbooks.

[0003] Patent Document 1 discloses an operation task automation system. However, Patent Document 1 does not disclose a method for identifying routine tasks suitable for automating maintenance operations or a method for creating a playbook. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2014-48860 A Summary of the Invention [Problem to be solved by the invention]

[0005] The present disclosure aims to make it possible to present elements of operational flows that are candidates for automation. [Means for solving the problem]

[0006] The operational flow analysis device of the present disclosure is a word extraction unit that extracts, from operational flow data indicating an operational flow, a plurality of character strings described for a plurality of flow elements in the operational flow as a plurality of picked-up words; an operational flow matching unit that performs a search using each of the plurality of pick words as a search word in a flow database in which a plurality of tag information corresponding to a plurality of automated flows each indicating an automated task is registered, and obtains a search result including a matching result of each search word against the plurality of tag information; a candidate selection unit that selects, from the plurality of flow elements in the operational flow based on the matching result included in the search result, one or more flow elements corresponding to one or more tasks that are candidates for automation as one or more candidate elements; an emphasis flow creating unit that creates emphasis flow data indicating an emphasis flow, which is the operational flow in which the one or more candidate elements are emphasized; Equipped with. Effect of the Invention

[0007] According to the present disclosure, it is possible to create an emphasis flow in which elements of an operational flow that are candidates for automation are emphasized. Therefore, by displaying the emphasis flow, it is possible to present elements of the operational flow that are candidates for automation. [Brief description of the drawings]

[0008] [Figure 1] 1 is a configuration diagram of an operation flow analysis apparatus 100 according to a first embodiment. [Diagram 2] FIG. 2 is a functional configuration diagram of an operation flow analysis apparatus 100 according to the first embodiment. [Diagram 3] FIG. 1 is a configuration diagram of an operation flow analysis system 200 according to a first embodiment. [Figure 4] FIG. 1 shows an example of a flow database 191 according to the first embodiment. [Diagram 5] 4 is a flowchart of an operation flow analysis method according to the first embodiment. [Figure 6] FIG. 11 is a diagram showing an example of operational flow data 192 according to the first embodiment. [Figure 7] FIG. 13 shows an example of a picked word list 193 according to the first embodiment. [Figure 8] FIG. 11 is a diagram showing an example of a search result 194 according to the first embodiment. [Figure 9] FIG. 11 is a diagram showing an example of a search result 195 according to the first embodiment. [Figure 10] FIG. 13 shows an example of emphasis flow data 196 according to the first embodiment. [Figure 11] FIG. 11 shows an example of reference information 197 according to the first embodiment. [Figure 12] FIG. 13 shows an example of an analysis result screen 198 according to the first embodiment. [Figure 13] FIG. 13 shows an example of an analysis result screen 198 according to the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] In the embodiments and drawings, the same or corresponding elements are denoted by the same reference numerals. Descriptions of elements denoted by the same reference numerals as those of elements described above will be omitted or simplified as appropriate. Arrows in the drawings primarily indicate data flow or processing flow.

[0010] Embodiment 1 The operational flow analysis apparatus 100 will be described with reference to FIGS.

[0011] ***Configuration Description*** The configuration of the operational flow analysis apparatus 100 will be described with reference to FIG. The operational flow analysis device 100 is a computer including hardware such as a processor 101, a memory 102, an auxiliary storage device 103, a communication device 104, and an input / output interface 105. These pieces of hardware are connected to each other via signal lines.

[0012] The processor 101 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 101 is a CPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit.

[0013] The memory 102 is a volatile or non-volatile storage device. The memory 102 is also called a primary storage device or a main memory. For example, the memory 102 is a RAM. Data stored in the memory 102 is saved in the secondary storage device 103 as necessary. RAM is an abbreviation for Random Access Memory.

[0014] The auxiliary storage device 103 is a non-volatile storage device. For example, the auxiliary storage device 103 is a ROM, a HDD, a flash memory, or a combination of these. Data stored in the auxiliary storage device 103 is loaded into the memory 102 as needed. ROM is an abbreviation for Read Only Memory. HDD is an abbreviation for Hard Disk Drive.

[0015] The communication device 104 is a receiver and a transmitter. For example, the communication device 104 is a communication chip or a NIC. The communication of the operational flow analysis device 100 is performed using the communication device 104. NIC is an abbreviation for Network Interface Card.

[0016] The input / output interface 105 is a port to which an input device and an output device are connected. For example, the input / output interface 105 is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display. Input and output of the operation flow analysis device 100 is performed using the input / output interface 105. USB is an abbreviation for Universal Serial Bus.

[0017] The operational flow analysis device 100 comprises elements such as an operational flow analysis unit 110, an operational flow comparison unit 120, and a display unit 130. These elements are realized by software.

[0018] The auxiliary storage device 103 stores an operation flow analysis program for causing a computer to function as an operation flow analysis unit 110, an operation flow comparison unit 120, and a display unit 130. The operation flow analysis program is loaded into the memory 102 and executed by the processor 101. The auxiliary storage device 103 further stores an OS. At least a part of the OS is loaded into the memory 102 and executed by the processor 101. The processor 101 executes an operation flow analysis program while executing the OS. OS is an abbreviation for Operating System.

[0019] Input and output data of the operational flow analysis program is stored in the storage unit 190 . The auxiliary storage device 103 functions as the storage unit 190. However, a storage device such as the memory 102, a register in the processor 101, or a cache memory in the processor 101 may function as the storage unit 190 instead of the auxiliary storage device 103 or together with the auxiliary storage device 103.

[0020] The operational flow analysis program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or a flash memory.

[0021] The functional configuration of the operation flow analysis apparatus 100 will be described with reference to FIG. The operational flow analysis unit 110 includes elements such as an operational flow reception unit 111 , a word extraction unit 112 , a search result editing unit 113 , a candidate selection unit 114 , and an emphasis flow creation unit 115 . The display unit 130 includes elements such as an analysis result display unit 131, an operation reception unit 132, an emphasis flow output unit 133, and an execution file output unit 134.

[0022] The configuration of the operation flow analysis system 200 will be described with reference to FIG. The operation flow analysis system 200 comprises an input terminal 201 , an operation flow analysis device 100 , and an output terminal 202 . The operation flow analysis apparatus 100 communicates with an input terminal 201 and an output terminal 202 via a network. The input terminal 201 and the output terminal 202 are terminals used by users. The input terminal 201 is a computer for input. The output terminal 202 is a computer for output. The input terminal 201 and the output terminal 202 may be realized by a single computer. The operational flow analysis apparatus 100 may be used as an input terminal 201 and an output terminal 202 .

[0023] In the flow database 191, a plurality of pieces of tag information corresponding to a plurality of automatic flows are registered. An automated flow is a procedure for automating work. An automated flow corresponds to a program for executing a SOAR playbook. Types of automated flows include subflows. The tag information includes various information related to the automatic flow. A plurality of pieces of tag information are created by experts and registered in advance in the flow database 191 . The flow database 191 may be provided in the operational flow analysis device 100 or in an external device.

[0024] The tag information registered in the flow database 191 will be described in detail with reference to FIG. The tag information includes a flow name, a work content, a product name, and an execution file name, all of which are associated with each other. The flow name column indicates the name of the automatic flow (flow name). The flow name identifies the automatic flow. The work content column shows, in text form, the content of the work to be automated by the automated flow. The product name column indicates the name of the product that automates the task. The product name identifies the product. Specifically, the product name column indicates the name of each manufacturer's SOAR product. The Executable Name column indicates the name of the file (executable file name) that is executed to automate the task of the task. The Executable File Name identifies the executable file. Specifically, the Executable File Name column indicates the name of the file that is executed by the SOAR product.

[0025] ***Explanation of Operation*** The operational flow analysis device 100 operates in a manner that corresponds to an operational flow analysis method, and the operational flow analysis device 100 operates in a manner that corresponds to a processing procedure performed by an operational flow analysis program.

[0026] The operation flow analysis method will be described with reference to FIG. In step S 110 , the user inputs the operation flow data 192 into the operation flow analysis device 100 using the input terminal 201 . The operational flow receiving unit 111 receives the input operational flow data 192 .

[0027] The operational flow data 192 indicates an operational flow. An operational flow shows an operational procedure using multiple flow elements. The operational procedure is expressed as a flow diagram.

[0028] The details of the operation flow will be explained based on FIG. An operational flow is a document that contains a flow diagram. The flow diagram shows the work procedures and criteria required for a worker to perform a specific task in the order of the tasks. An operational flow includes a number of flow elements such as a title, a start point, an end point, an action, and a conditional branch. Each flow element includes a character string indicating the content of the flow element.

[0029] 6 shows an operation flow relating to an intrusion detection investigation using an IDS. IDS is an abbreviation for Intrusion Detection System. The title is information that corresponds to the name of the operational flow. For example, the title of a document or the name of a flow diagram is the title. The character string written at the top of the operational flow is the title. A start point indicates the start of an operational flow. A finish point indicates the completion of an operational flow. A rectangle with rounded corners indicates a start point or an end point. Inside the start point shape is a description of the conditions for starting the operational flow. Inside the end point shape is a description of the completion of the operational flow. An action is a behavior that a worker performs. A rectangle represents an action. The specific action content is written inside the action shape. A conditional branch is a branching point where a worker can carry out the next task depending on the conditions. A diamond shape indicates a conditional branch. The specific criteria for making a conditional branch are written inside the conditional branch shape. The arrows between the shapes indicate the flow of work.

[0030] Returning to FIG. 5, the description will continue from step S120. In step S120, the word extraction unit 112 extracts a plurality of character strings described for a plurality of flow elements in the operational flow from the operational flow data 192. The extracted character strings are called pick-up words. Then, the word extraction unit 112 creates a picked word list 193. The pick-up word list 193 shows the extracted character strings as pick-up words.

[0031] The pick word list 193 will be described in detail with reference to FIG. The word extraction unit 112 reads figures in the operational flow, character strings in the figures, and the title of the operational flow, and creates a picked word list 193. There is no restriction on the means for reading the figures and character strings.

[0032] The picked word list 193 in FIG. 7 is created based on the operational flow data 192 in FIG. Picked word list 193 shows the type and picked word associated with each other for each flow element in the operational flow. The type column indicates the title, start point, end point, action, or condition branch. The pick-up word column shows a character string indicating a title or a character string written within a graphic.

[0033] Returning to FIG. 5, the description of step S120 will continue. The word extraction unit 112 passes the picked word list 193 to the operational flow collation unit 120 .

[0034] In step S130, the operational flow collation unit 120 searches the flow database 191 using each of the pickup words shown in the pickup word list 193 as a search word. Then, the operational flow collation unit 120 acquires the search result 194 from the flow database 191 .

[0035] The search result 194 includes a result of matching each search word with a plurality of pieces of tag information registered in the flow database 191. The result of matching each search word indicates the degree of match of the search word with respect to the plurality of pieces of tag information (the plurality of work contents indicated in the plurality of pieces of tag information). The search result 194 indicates the number of hit words for each search word. The number of hit words is the number of work contents that were hit by the search word. The search result 194 indicates the number of hit flows for each search word. The number of hit flows is the number of automated flows associated with the work contents that match the search word. The search results 194 show, for each search word, the product name associated with the work content hit by the search word. The search results 194 show, for each search word, the executable file name associated with the work content hit by the search word.

[0036] The search algorithm used can be of any type, for example a linear search or a binary search.

[0037] The search result 194 will be described in detail with reference to FIG. The search results 194 show the search word, the match result, the number of hit words, the number of hit flows, the product name, and the execution file name in association with each other for each search word. The search word column shows the character strings of picked up words. The column for the matching results shows the degree of match between the picked words and the work content in the tag information. There are no restrictions on the type of algorithm for determining the degree of match and the value that represents the degree of match. For example, the higher the number of hit words, the higher the degree of match. For example, the degree of match is shown in four ranks: high, medium, low, and not applicable. The number of hit words column shows the number of search contents (number of hit words) that were found when searching for work contents in the tag information using the picked words. The method of counting the number of hits complies with the search algorithm. The number of hit flows column shows the number of automated flows (number of hit flows) linked to the work contents hit when searching for work contents in tag information with the picked word. The number of hit flows corresponds to the number of executable file names linked to the work contents hit when searching for work contents in tag information with the picked word. The product name column shows the product name associated with the work content that is found when the work content in the tag information is searched for using the picked word. The execution file name column shows the execution file name associated with the work content that is found when the work content in the tag information is searched for using the picked word.

[0038] Returning to FIG. 5, the description of step S130 will continue. The operational flow collation unit 120 passes the search result 194 to the operational flow analysis unit 110 .

[0039] In step S 140 , the search result editing unit 113 edits the search result 194 . The edited search results 194 are referred to as search results 195. The search results 195 are also referred to as analysis results.

[0040] The search result 195 will be described with reference to FIG. Search result 195 corresponds to search result 194 with the addition of a type field. The type column indicates the type of the picked word that became the search word. For each search word shown in search result 194, search result editing unit 113 extracts a type associated with the same pick-up word as the search word from pick-up word list 193, and sets the extracted type in search result 195 in association with the search word.

[0041] Returning to FIG. 5, the description will continue from step S150. In step S150, the candidate selection unit 114 selects one or more candidate elements from among the multiple flow elements in the operational flow, based on the matching result included in the search result 195. A candidate element is a flow element that corresponds to a task that is a candidate for automation.

[0042] Candidate elements are selected as follows. First, the candidate selection unit 114 selects, from the search results 195, a search word associated with a matching result higher than the reference rank. For example, the candidate selection unit 114 selects each search word for which the matching result is "high", "medium", or "low" from the search result 195 in FIG. Then, the candidate selection unit 114 selects a flow element from the operational flow in which the selected search word has been extracted as a picked word. The selected flow element is a candidate element.

[0043] The candidate selection unit 114 passes information (selection result) indicating the one or more selected candidate elements to the emphasis flow creation unit 115.

[0044] In step S 160 , the emphasis flow generating unit 115 generates the emphasis flow data 196 . The emphasis flow data 196 is data indicating an operational flow in which one or more selected candidate elements are emphasized.

[0045] The enhanced flow data 196 is generated as follows. The emphasis flow creating unit 115 emphasizes each candidate element in an emphasis form that matches the result of matching the search word corresponding to the candidate element. An example of the emphasis form is color coding.

[0046] The emphasis flow creating unit 115 adds reference information 197 to each candidate element. The reference information 197 includes various information included in the search result 195 as follows. The reference information 197 includes the number of hit words of the search words corresponding to the candidate elements. The reference information 197 includes the number of hit flows for the search words corresponding to the candidate elements. The reference information 197 includes product names associated with search words that correspond to the candidate elements. The reference information 197 includes executable file names associated with search words corresponding to candidate elements.

[0047] The emphasis flow data 196 will be described in detail with reference to FIG. The emphasis flow data 196 shows an operational flow equivalent to the operational flow of FIG. 6 in which emphasis processing has been performed on one or more candidate elements selected based on the matching result included in the search result 195 of FIG. The emphasis flow creating unit 115 performs emphasis processing on the operational flow input to the operational flow analyzing apparatus 100 based on the search result 195 and the selection result. The emphasis flow creation unit 115 colors the corresponding character strings in the operation flow, that is, the character strings that correspond to the search words corresponding to the selection candidates, according to the rank of the degree of match shown in the column of the matching result in the search result 195. Regarding color coding, the color used for the emphasis process is not important. In Figure 10, the bold characters are the highlighted characters. The characters in the thickest frame represent the highlighted characters in red, the characters in the medium-bold frame represent the highlighted characters in yellow, and the characters in the thick frame represent the highlighted characters in blue. Character strings that match search words with a "high" match result are highlighted in red, character strings that match search words with a "medium" match result are highlighted in yellow, and character strings that match search words with a "low" match result are highlighted in blue. Character strings that match search words with a "no match" match result are not highlighted.

[0048] The reference information 197 will be described in detail with reference to FIG. Reference information 197 indicates various information for "ticket system: correspondence content registration" in FIG. The emphasis flow creating unit 115 creates a link related to the reference information 197 for the character string that has been subjected to emphasis processing. The reference information 197 includes the number of hit words, the number of hit flows, the product name, and the execution file name. The number of hit words column indicates the number of hit words of character strings that correspond to the search words corresponding to the candidate elements. The number of hit flows column indicates the number of hit flows of character strings that correspond to the search words corresponding to the candidate elements. The product name column lists the product names associated with the search words corresponding to the candidate elements. The execution file name column lists the execution file names associated with the search words corresponding to the candidate elements.

[0049] Returning to FIG. 5, the description of step S160 will continue. The emphasis flow generating unit 115 passes the emphasis flow data 196 to the display unit 130 .

[0050] In step S 170 , the analysis result display unit 131 displays the analysis result screen 198 based on the emphasis flow data 196 . The analysis result screen 198 is a screen showing the emphasis flow. The analysis results screen 198 further shows a download button for the highlighted flow and a download button for the executable file.

[0051] The analysis result screen 198 is displayed as follows: The analysis result display unit 131 creates screen data for an analysis result screen 198 based on the emphasis flow data 196 , and transmits the screen data to the output terminal 202 . The output terminal 202 receives the screen data and displays the analysis result screen 198 on the display based on the screen data.

[0052] The analysis result screen 198 will be described in detail with reference to FIG. The analysis result display unit 131 creates an analysis result screen 198 for outputting the emphasis flow to the output terminal 202 . The analysis result screen 198 includes an image of the emphasis flow, a button for requesting download of the emphasis flow, and a button for requesting download of an executable file identified by the executable file name in the reference information 197.

[0053] Returning to FIG. 5, step S180 will be described. In step S180, the operation receiving unit 132 receives an operation on the analysis result screen 198 by the user. Then, the display unit 130 operates in accordance with the accepted operation.

[0054] The display unit 130 operates as follows. When any candidate element in the emphasis flow displayed on the analysis result screen 198 is specified, the analysis result display unit 131 displays reference information 197 of the specified candidate element.

[0055] The operation of the display unit 130 will be described in detail with reference to FIG. The analysis result screen 198 shows reference information 197 for the candidate element "ticket system: response content registration" in the emphasis flow. The user uses the mouse to perform an operation of placing the cursor on the candidate element for which the user wishes to display reference information 197. The operation reception unit 132 communicates with the output terminal 202 and receives this operation. The analysis result display unit 131 generates screen data for an analysis result screen 198 showing reference information 197 of the specified candidate element, and transmits the screen data to the output terminal 202 . The output terminal 202 receives the screen data and displays the analysis result screen 198 based on the screen data.

[0056] The explanation of step S180 will be continued. When the emphasis flow download button in the analysis result screen 198 is pressed, the emphasis flow output unit 133 outputs emphasis flow data 196 .

[0057] The operation of the display unit 130 will be described in detail with reference to FIG. The user uses the mouse to press the "download operation flow" button. The operation reception unit 132 communicates with the output terminal 202 and receives this operation. The emphasis flow output unit 133 transmits the emphasis flow data 196 to the output terminal 202 .

[0058] The explanation of step S180 will be continued. When the executable file download button in the analysis result screen 198 is pressed, the executable file output unit 134 outputs an executable file identified by the executable file name included in the reference information 197 of the candidate element for each candidate element.

[0059] The operation of the display unit 130 will be described in detail with reference to FIG. The user uses the mouse to press the "Download executable file" button. The operation reception unit 132 communicates with the output terminal 202 and receives this operation. The executable file output unit 134 refers to the reference information 197 of the candidate element for each candidate element in the emphasis flow, and acquires an executable file identified by the executable file name included in the reference information 197. For example, each executable file is associated with the executable file name and stored in the flow database 191, and the executable file is acquired from the flow database 191. Link information indicating the storage destination of each executable file may be associated with the executable file name and stored in the flow database 191, and the executable file may be acquired from the storage destination indicated by the link information. The executable file output unit 134 transmits the obtained executable file to the output terminal 202 .

[0060] After step S180, the process ends.

[0061] ***Main points of the first embodiment*** The operational flow analysis device 100 assists in creating SOAR playbooks. For users who are considering using SOAR but cannot imagine how to use it systematically, the operational flow analysis device 100 can present areas where SOAR can be used using the user's operational flow. A user inputs their company's operation flow into the operation flow analysis device 100. The operation flow analysis device 100 then analyzes the parts of the operation flow that can be turned into playbooks, that is, the parts that can be automated using SOAR. The operation flow analysis device 100 then outputs, as the analysis result, a procedure manual that highlights the parts of the operation flow that can be automated using SOAR. In addition, the operation flow analysis device 100 presents the user with information on the flow that corresponds to the parts that can be turned into playbooks as reference information. The flow is independent of the manufacturer.

[0062] ***Advantages of the First Embodiment*** According to the first embodiment, for users who cannot visualize how to utilize SOAR, it is possible to visually show the parts that can be automated with SOAR through the operation flow. Furthermore, it is possible to show reference information. Therefore, it is possible to support the creation of SOAR playbooks.

[0063] ***Addition to the first embodiment*** The first embodiment is an example of a preferred embodiment, and is not intended to limit the technical scope of the present disclosure. The first embodiment may be implemented partially or in combination with other embodiments. The procedure described using the flow chart, etc. may be modified as appropriate.

[0064] Each element of the operational flow analysis apparatus 100 may be realized as software, hardware, firmware, or a combination of these. The "part" of each element of the operational flow analysis apparatus 100 may be read as a "process," a "step," a "circuit," or a "circuitry."

[0065] Various aspects of the present disclosure are described below as appendices. (Appendix 1) a word extraction unit that extracts, from operational flow data indicating an operational flow, a plurality of character strings described for a plurality of flow elements in the operational flow as a plurality of picked-up words; an operational flow matching unit that performs a search using each of the plurality of pick words as a search word in a flow database in which a plurality of tag information corresponding to a plurality of automated flows each indicating an automated task is registered, and obtains a search result including a matching result of each search word against the plurality of tag information; a candidate selection unit that selects, from the plurality of flow elements in the operational flow based on the matching result included in the search result, one or more flow elements corresponding to one or more tasks that are candidates for automation as one or more candidate elements; an emphasis flow creating unit that creates emphasis flow data indicating an emphasis flow, which is the operational flow in which the one or more candidate elements are emphasized; An operational flow analysis device comprising:

[0066] (Appendix 2) the matching result of each search word indicates a degree of match of the search word with respect to the plurality of tag information; The emphasis flow creation unit emphasizes, for each of the candidate elements, the candidate elements in an emphasis form that matches the matching result of the search word corresponding to the candidate element. 2. The operational flow analyzer of claim 1.

[0067] (Appendix 3) Each of the plurality of pieces of tag information includes a character string indicating a task content, the search results indicate, for each of the search words, the number of work contents hit by the search words as a hit word count; The emphasis flow creation unit adds, to each of the candidate elements, reference information including the number of hit words of the search word corresponding to the candidate element. 3. The operational flow analyzer of claim 1 or 2.

[0068] (Appendix 4) Each of the plurality of pieces of tag information includes a flow name for identifying an automated flow and a character string indicating a task content of the automated flow, the character string being associated with each other; The search results indicate, for each of the search words, the number of automated flows associated with the work contents hit by the search words as a hit flow number; The emphasis flow creation unit adds, to each of the candidate elements, reference information including the number of hit flows of the search word corresponding to the candidate element. 4. An operational flow analysis apparatus according to any one of claims 1 to 3.

[0069] (Appendix 5) Each of the plurality of pieces of tag information includes a character string indicating a task and a product name of a product that automates the task of the task, in association with each other; The search results indicate, for each of the search words, a product name associated with a task content hit by the search word, The emphasis flow creation unit adds, to each of the candidate elements, reference information including the product name of the search word corresponding to the candidate element. 5. The operational flow analysis apparatus of claim 1 .

[0070] (Appendix 6) each of the plurality of pieces of tag information includes a character string indicating a task and an execution file name of an execution file to be executed to automate the task of the task, the character string being associated with the execution file; the search results indicate, for each of the search words, executable file names associated with the work contents hit by the search words; The emphasis flow creation unit adds, to each of the candidate elements, reference information including the execution file name of the search word corresponding to the candidate element. 6. An operational flow analysis apparatus according to any one of claims 1 to 5.

[0071] (Appendix 7) an analysis result display unit that displays an analysis result screen showing the emphasis flow based on the emphasis flow data; 3. The operational flow analyzer of claim 1 or 2.

[0072] (Appendix 8) an analysis result display unit that displays an analysis result screen showing the emphasis flow based on the emphasis flow data; 6. An operational flow analysis apparatus according to any one of appendix 3 to appendix 5.

[0073] (Appendix 9) When any candidate element in the emphasis flow shown on the analysis result screen is designated, the analysis result display unit displays the reference information of the designated candidate element. 9. The operational flow analyzer of claim 8.

[0074] (Appendix 10) an analysis result display unit that displays an analysis result screen showing the emphasis flow based on the emphasis flow data; 7. The operational flow analyzer of claim 6.

[0075] (Appendix 11) When any candidate element in the emphasis flow shown on the analysis result screen is designated, the analysis result display unit displays the reference information of the designated candidate element. 11. The operational flow analyzer of claim 10.

[0076] (Appendix 12) The operational flow analysis device includes an executable file output unit, the analysis result screen further shows a download button for an executable file; The executable file output unit outputs, for each of the candidate elements, the executable file identified by the executable file name included in the reference information of the candidate element when the download button for the executable file in the analysis result screen is pressed. 12. The operational flow analyzer of claim 10 or 11.

[0077] (Appendix 13) The operational flow analysis device includes an emphasis flow output unit, The analysis result screen further shows a download button for the emphasized flow, The emphasis flow output unit outputs the emphasis flow data when a download button for the emphasis flow in the analysis result screen is pressed. 13. The operational flow analysis apparatus of claim 7.

[0078] (Appendix 14) extracting, from operational flow data indicating an operational flow, a plurality of character strings described for a plurality of flow elements in the operational flow as a plurality of pick-up words; A search is performed using each of the plurality of pick words as a search word in a flow database in which a plurality of tag information corresponding to a plurality of automated flows each indicating a task to be automated is registered, and a search result including a matching result of each search word against the plurality of tag information is obtained; selecting, from the plurality of flow elements in the operational flow based on the matching result included in the search result, one or more flow elements corresponding to one or more tasks that are candidates for automation as one or more candidate elements; Create emphasized flow data indicating an emphasized flow, which is the operational flow in which the one or more candidate elements are emphasized Operational flow analysis method.

[0079] (Appendix 15) A word extraction process for extracting, from operational flow data indicating an operational flow, a plurality of character strings described for a plurality of flow elements in the operational flow as a plurality of picked-up words; an operational flow matching process for performing a search using each of the plurality of pick words as a search word in a flow database in which a plurality of tag information corresponding to a plurality of automated flows each indicating an automated task is registered, and obtaining a search result including a matching result of each search word against the plurality of tag information; a candidate selection process for selecting, from the plurality of flow elements in the operational flow based on the matching result included in the search result, one or more flow elements corresponding to one or more tasks that are candidates for automation as one or more candidate elements; an emphasis flow creation process for creating emphasis flow data indicating an emphasis flow, which is the operational flow in which the one or more candidate elements are emphasized; An operational flow analysis program for causing a computer to execute the above. [Explanation of symbols]

[0080] 100 operational flow analysis device, 101 processor, 102 memory, 103 auxiliary storage device, 104 communication device, 105 input / output interface, 110 operational flow analysis unit, 111 operational flow reception unit, 112 word extraction unit, 113 search result editing unit, 114 candidate selection unit, 115 emphasis flow creation unit, 120 operational flow matching unit, 130 display unit, 131 analysis result display unit, 132 operation reception unit, 133 emphasis flow output unit, 134 executable file output unit, 190 memory unit, 191 flow database, 192 operational flow data, 193 picked word list, 194 search result, 195 search result, 196 emphasis flow data, 197 reference information, 198 analysis result screen, 200 operational flow analysis system, 201 input terminal, 202 output terminal.

Claims

1. a word extraction unit that extracts, from operational flow data indicating an operational flow, a plurality of character strings described for a plurality of flow elements in the operational flow as a plurality of picked-up words; an operational flow matching unit that performs a search using each of the plurality of pick words as a search word in a flow database in which a plurality of tag information corresponding to a plurality of automated flows each indicating an automated task is registered, and obtains a search result including a matching result of each search word against the plurality of tag information; a candidate selection unit that selects, from the plurality of flow elements in the operational flow based on the matching result included in the search result, one or more flow elements corresponding to one or more tasks that are candidates for automation as one or more candidate elements; an emphasis flow creating unit that creates emphasis flow data indicating an emphasis flow, which is the operational flow in which the one or more candidate elements are emphasized; An operational flow analysis device comprising:

2. the matching result of each search word indicates a degree of match of the search word with respect to the plurality of tag information; The emphasis flow creation unit emphasizes, for each of the candidate elements, the candidate elements in an emphasis form that matches the matching result of the search word corresponding to the candidate element. The operational flow analysis device according to claim 1 .

3. Each of the plurality of pieces of tag information includes a character string indicating a task content, the search results indicate, for each of the search words, the number of work contents hit by the search words as a hit word count; The emphasis flow creation unit adds, to each of the candidate elements, reference information including the number of hit words of the search word corresponding to the candidate element. The operational flow analysis device according to claim 1 .

4. Each of the plurality of pieces of tag information includes a flow name for identifying an automated flow and a character string indicating a task content of the automated flow, the character string being associated with each other; The search results indicate, for each of the search words, the number of automated flows associated with the work contents hit by the search words as a hit flow number; The emphasis flow creation unit adds, to each of the candidate elements, reference information including the number of hit flows of the search word corresponding to the candidate element. The operational flow analysis device according to claim 1 .

5. Each of the plurality of pieces of tag information includes a character string indicating a task and a product name of a product that automates the task of the task, in association with each other; The search results indicate, for each of the search words, a product name associated with a task content hit by the search word, The emphasis flow creation unit adds, to each of the candidate elements, reference information including the product name of the search word corresponding to the candidate element. The operational flow analysis device according to claim 1 .

6. each of the plurality of pieces of tag information includes a character string indicating a task and an execution file name of an execution file to be executed to automate the task of the task, the character string being associated with the execution file; the search results indicate, for each of the search words, executable file names associated with the work contents hit by the search words; The emphasis flow creation unit adds, to each of the candidate elements, reference information including the execution file name of the search word corresponding to the candidate element. The operational flow analysis device according to claim 1 .

7. an analysis result display unit that displays an analysis result screen showing the emphasis flow based on the emphasis flow data; The operational flow analysis device according to claim 1 or 2.

8. an analysis result display unit that displays an analysis result screen showing the emphasis flow based on the emphasis flow data; The operational flow analysis device according to any one of claims 3 to 5.

9. When any candidate element in the emphasis flow shown on the analysis result screen is designated, the analysis result display unit displays the reference information of the designated candidate element. The operational flow analysis device according to claim 8 .

10. an analysis result display unit that displays an analysis result screen showing the emphasis flow based on the emphasis flow data; The operational flow analysis device according to claim 6 .

11. When any candidate element in the emphasis flow shown on the analysis result screen is designated, the analysis result display unit displays the reference information of the designated candidate element. The operational flow analysis device according to claim 10.

12. The operational flow analysis device includes an executable file output unit, the analysis result screen further shows a download button for an executable file; The executable file output unit outputs, for each of the candidate elements, the executable file identified by the executable file name included in the reference information of the candidate element when the download button for the executable file on the analysis result screen is pressed. The operational flow analysis device according to claim 10 or 11.

13. The operational flow analysis device includes an emphasis flow output unit, The analysis result screen further shows a download button for the emphasized flow, The emphasis flow output unit outputs the emphasis flow data when a download button for the emphasis flow in the analysis result screen is pressed. The operational flow analysis device according to claim 7 .

14. extracting, from operational flow data indicating an operational flow, a plurality of character strings described for a plurality of flow elements in the operational flow as a plurality of pick-up words; A search is performed using each of the plurality of pick words as a search word in a flow database in which a plurality of tag information corresponding to a plurality of automated flows each indicating a task to be automated is registered, and a search result including a matching result of each search word against the plurality of tag information is obtained; selecting, from the plurality of flow elements in the operational flow based on the matching result included in the search result, one or more flow elements corresponding to one or more tasks that are candidates for automation as one or more candidate elements; Create emphasized flow data indicating an emphasized flow, which is the operational flow in which the one or more candidate elements are emphasized Operational flow analysis method.

15. A word extraction process for extracting, from operational flow data indicating an operational flow, a plurality of character strings described for a plurality of flow elements in the operational flow as a plurality of picked-up words; an operational flow matching process for performing a search using each of the plurality of pick words as a search word in a flow database in which a plurality of tag information corresponding to a plurality of automated flows each indicating an automated task is registered, and obtaining a search result including a matching result of each search word against the plurality of tag information; a candidate selection process for selecting, as one or more candidate elements, one or more flow elements corresponding to one or more tasks that are candidates for automation from the plurality of flow elements in the operational flow based on the matching result included in the search result; an emphasis flow creation process for creating emphasis flow data indicating an emphasis flow, which is the operational flow in which the one or more candidate elements are emphasized; An operational flow analysis program for causing a computer to execute the above.

Images