Program, information processing device and information processing method

Abstract

To provide a program, an information processing device, and an information processing method with which it is possible to perform processing for estimating with good accuracy a user who is using network services by impersonation.SOLUTION: Provided is a program for causing an information processing device to execute: processing for acquiring the operation log of a first user for a network service provided via a terminal device accompanying log-in; processing for acquiring the operation feature vector of the first user obtained by inputting input data based on the operation log of the first user to a trained model having been trained using data based on operation logs of a plurality of second users as learning data and information indicating which of second users has performed operation as teaching data, with regard to the network service; and processing for deriving information representing whether the first user has fraudulently logged in by impersonation, on the basis of the operation feature vector of the first user.SELECTED DRAWING: Figure 7

Description

[Technical field]

[0001] The present invention relates to a program, an information processing device, and an information processing method. [Background technology]

[0002] Various attempts have been made to detect fraudulent use of network services. In this regard, a computerized risk management method and a risk management system for facilitating analysis and quantification of risks associated with financial transactions have been disclosed (Patent Document 1). The system generates a risk index or other rating based on a weighted algorithm applied to criteria. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Special Publication No. 2005-509196 Summary of the Invention [Problem to be solved by the invention]

[0004] In conventional techniques, there are cases where a process for accurately estimating a user who is using a network service due to spoofing cannot be performed.

[0005] The present invention has been made in consideration of the above circumstances, and one of its objectives is to provide a program, an information processing device, and an information processing method that can perform processing to accurately estimate users who are using network services through impersonation. [Means for solving the problem]

[0006] One aspect of the present invention is a program for causing an information processing device to execute the following processes: acquiring an operation log of a first user for a network service provided via a terminal device involving login; acquiring an operation feature vector of the first user by inputting input data based on the operation log of the first user into a trained model trained using data based on the operation logs of a plurality of second users for the network service as learning data and information indicating which second user performed the operation as teacher data; and deriving information indicating whether the first user has performed an unauthorized login by impersonation based on the operation feature vector of the first user. Effect of the Invention

[0007] According to one aspect of the present invention, it is possible to provide a program, an information processing device, and an information processing method that can perform processing for accurately estimating a user who is using a network service by spoofing. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing an example of a configuration for realizing an electronic payment service. [Diagram 2] This is a sequence diagram (part 1) illustrating the general flow of electronic payment. [Diagram 3] This is a sequence diagram (part 2) illustrating the general flow of electronic payment. [Figure 4] 1 is a configuration diagram of a payment server 100 according to a first embodiment. [Diagram 5] FIG. 13 is a diagram showing an example of the contents of user information 172. [Figure 6] FIG. 13 is a diagram showing an example of the contents of affiliated store / store information 176. [Figure 7] FIG. 2 is a diagram illustrating a configuration of an information processing device 200. [Figure 8] FIG. 13 is a diagram illustrating an example of the contents of an operation log. [Figure 9] FIG. 4 is a diagram showing an example of processing contents of a first pre-processing unit 220. [Figure 10] FIG. 2 is a diagram showing an example of a trained model 274. [Figure 11] 10 is a diagram for explaining the function of a learning unit 250. FIG. [Figure 12] 13 is a diagram showing an example of an image that the derivation unit 240 causes the input / output device 260 to display. FIG. [Figure 13] 13 is a diagram for explaining a process in which a derivation unit 240 automatically displays a warning. FIG. [Figure 14] 1 is a histogram showing experimental results. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, with reference to the drawings, an embodiment of the program, information processing device, and information processing method of the present invention will be described. Various devices for providing services to users and performing internal analysis, such as the "server", "management device", and "information providing device" that will appear below, may be realized by a distributed device group, and each device may be operated by a different business operator. In addition, the owner of the hardware of the device (the cloud server provider) and the business operator that actually operates the device may also be different. First, an electronic payment service, which is an example of a network service, will be described. Note that the present invention is not limited to electronic payment services, and can be applied to any network service that is provided with login.

[0010] [Electronic payment service] FIG. 1 is a diagram showing an example of a configuration for realizing an electronic payment service. The electronic payment service is realized mainly by a payment server 100. The payment server 100 communicates with, for example, one or more user terminal devices 10, one or more first store terminal devices 50, and one or more second store terminal devices 70 via a network NW. The network NW includes, for example, the Internet, a LAN (Local Area Network), a wireless base station, a provider device, and the like. An information processing device 200 is capable of communicating with the payment server 100, for example. Alternatively, the information processing device 200 may be an internal function of the payment server 100.

[0011] The user terminal device 10 is, for example, a portable terminal device such as a smartphone or a tablet terminal. The user terminal device 10 is a computer device having at least an optical reading function, a communication function, a display function, an input acceptance function, and a program execution function. In the following description, components for realizing these functions are referred to as a camera, a communication device, a touch panel, a CPU (Central Processing Unit), and the like. In the user terminal device 10, a processor such as a CPU executes a payment application 20, and the user terminal device 10 operates to provide an electronic payment service to a user in cooperation with a payment server 100. The payment application 20 is installed in the user terminal device 10 from, for example, an application store, and controls a camera, a communication device, a touch panel, and the like. When the payment application 20 is started for the first time, the user enters an account ID (phone number) and a password to log in to the electronic payment service, and from the next time onwards, the user automatically logs in with the account ID and password stored in the user terminal device 10. For this reason, if an account ID and password are stolen, for example by a method called ATO (Account Take Over), which involves having a user enter an account ID and password on a fake site and then obtaining that information illegally, then unauthorized login through impersonation may occur. In particular, in financial network services such as electronic payment services, since there are many actions (events) that involve the transfer of money, such as remittances and purchases, it is highly necessary to detect and deal with unauthorized logins as early as possible. Note that, although it is possible that a genuine user can become aware of an unauthorized login by performing SMS (Short Message Service) authentication when a login occurs from a new user terminal device, it cannot be denied that this can be circumvented by a phishing site that requires the user to enter a one-time code in a short message.

[0012] The first store terminal device 50 is installed, for example, in a store. The first store terminal device 50 is a computer device having at least a product price acquisition function, an optical reading function, a program execution function, and a communication function. The first store terminal device 50 includes a so-called POS (Point of Sale) device, and the product price acquisition function and the optical reading function may be realized by the POS device. The store code image 60 is placed in the store, and is a code image such as a QR code (registered trademark) printed on a paper or plastic medium. The store code image 60 may be displayed on a display placed in the store (which may be the display of a terminal device such as a smartphone).

[0013] The second store terminal device 70 is used by the operator of the affiliated store. The second store terminal device 70 is a smartphone, a tablet terminal, a personal computer, or the like. An interface 72 for affiliated stores runs on the second store terminal device 70. The interface 72 for affiliated stores may be an app for affiliated stores or a browser. The interface 72 for affiliated stores accepts coupon settings and the like made by the operator of the affiliated store and transmits them to the payment server 100. The second store terminal device 70, which is a smartphone, has the function of displaying a code image corresponding to a store code image and reading a code image displayed by the user terminal device 10 by executing the app for affiliated stores.

[0014] The payment server 100 realizes electronic payment based on payment information received from the user terminal device 10 or the first store terminal device 50. The first store terminal device 50 may include a POS device and an affiliated store server, in which case the payment information is sent from the POS device via the affiliated store server to the payment server 100. In the following explanation, no distinction is made between these two and it is assumed that the payment information is sent from the first store terminal device 50.

[0015] 2 and 3 are sequence diagrams illustrating the general flow of electronic payment. There may be two patterns of electronic payment: pattern 1 and pattern 2.

[0016] In the case of pattern 1 (hereinafter referred to as user scan) shown in FIG. 2, the user terminal device 10 with the payment application 20 activated decodes the store code image 60 by the optical reading function (S1). The store code image 60 includes store URL (Uniform Resource Locator) information. This store URL is an electronic payment service domain to which store-identifying information is added, and is associated with an affiliated store ID, a store ID, etc. in the payment server 100 (described later). The payment application 20 transmits the first payment information including the store URL and the account ID to the payment server 100 (S2). The payment server 100 searches for store information (described later) from the affiliated store ID and the store ID corresponding to the store URL, acquires the affiliated store name and the store name information (S3), and transmits it to the payment application 20 (S4). The user inputs the payment amount into the user terminal device 10 on the screen on which the affiliated store name and the store name are displayed (S5). Then, the user terminal device 10 generates second payment information including at least the payment amount, and transmits it to the payment server 100 (S6). The payment server 100 performs electronic payment based on the received second payment information (S7). The payment server 100 then transmits a payment completion notice (information for displaying a payment completion screen) to the payment application 20 (S8), and the payment application 20 displays the payment completion screen (S9). Note that when the store code image 60 is displayed on a display installed in the store, the store code image 60 may include not only the store URL but also information on the payment amount. In this case, the step of the user inputting the payment amount is omitted, and the information on the payment amount is included in the first payment information and transmitted to the payment server 100. Information on the affiliated store name and the store name may be included in the payment completion screen and displayed.

[0017] In the case of pattern 2 (hereinafter referred to as store scan) shown in FIG. 3, when the payment application 20 is started, when a payment operation is performed in the payment application 20, when an automatic update timing (e.g., every minute) occurs, and at other timings, the payment application 20 transmits a request for issuing a one-time code to the payment server 100 (S11). The payment server 100 generates a one-time code (S12) and transmits it to the payment application 20 (S13). The payment application 20 displays a code image such as a QR code or a barcode generated based on the one-time code (S14). The user holds (presents) the display surface of the user terminal device 10 over the first store terminal device 50, and the first store terminal device 50 decodes the code image by an optical reading function and obtains the one-time code, etc. (S15). The first store terminal device 50 then generates payment information including the one-time code, payment amount, affiliated store ID, store ID, etc., and transmits it to the payment server 100 (S16). The payment amount information is acquired in advance by reading a barcode or manually entering it. The payment server 100 identifies the user corresponding to the one-time code based on the received information and performs electronic payment (S17). The payment server 100 then transmits a payment completion notice to the payment application 20 (S18), and the payment application 20 displays a payment completion screen (S19).

[0018] Note that electronic payment may be performed using only one of the above patterns. Furthermore, the "account ID" described in FIG. 2 may be other information (e.g., a phone number) that can be used as user identification information. Furthermore, issuance of a one-time code may be omitted in the store scan, and the payment application 20 may display a code image generated based on the user's account ID. In this case, the payment server 100 identifies the user corresponding to the account ID instead of identifying the user corresponding to the one-time code.

[0019] [Payment server] FIG. 4 is a configuration diagram of the payment server 100. The payment server 100 includes, for example, a communication unit 110, a payment content providing unit 120, a payment processing unit 130, an information management unit 140, and a storage unit 170. The components other than the communication unit 110 and the storage unit 170 are realized by, for example, a hardware processor such as a CPU executing a program (software). Some or all of these components may be realized by hardware (including circuitry) such as an LSI (Large Scale Integration), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a GPU (Graphics Processing Unit), or may be realized by cooperation between software and hardware. The program may be stored in advance in a storage device such as an HDD (Hard Disk Drive) or a flash memory (a storage device having a non-transient storage medium), or may be stored in a removable storage medium such as a DVD or a CD-ROM (a non-transient storage medium), and may be installed in the storage device by mounting the storage medium in a drive device.

[0020] The storage unit 170 is a HDD, a flash memory, a RAM (Random Access Memory), etc. The storage unit 170 may be a NAS (Network Attached Storage) device that the payment server 100 can access via a network. The storage unit 170 stores information such as user information 172, payment content information 174, and affiliated store / shop information 176.

[0021] The communication unit 110 is a communication interface for connecting to the network NW. The communication unit 110 is, for example, a network interface card.

[0022] The payment content providing unit 120 has, for example, a function of a Web server, and provides information (content) for displaying various screens of the electronic payment service to the user terminal device 10. The payment content providing unit 120 appropriately reads necessary content from the payment content information 174 and provides it to the user terminal device 10. The user terminal device 10 accepts various inputs by the user while the content is being played by the payment application 20, and transmits the above-mentioned payment information and the like to the payment server 100.

[0023] The payment processing unit 130 performs payment processing based on the payment information transmitted by the user terminal device 10 or the first store terminal device 50. The payment processing unit 130 performs payment processing while referring to the user information 172.

[0024] FIG. 5 is a diagram showing an example of the contents of the user information 172. The user information 172 is an example of the registration information of a user. The user information 172 is, for example, a user URL, an account ID, a telephone number, a password, as well as information associated with an email address, a user ID, a name, an address, a date of birth, a registration date, a charge balance, a post-payment setting, a post-payment limit, a post-payment usage amount, a post-payment available amount, a payment method setting, a bank account, a credit card number, a charge history information, and a payment history information. The user URL is used for a remittance process between users. When registering for the electronic payment service, it is necessary to register a telephone number and a password. The account ID is issued to the user by the payment server 100, and the user ID is an ID that can be set by the user at will (does not have to be set). Similarly, the email address, and the name, address, and date of birth are information that can be set by the user at will (does not have to be set). The registration date is the date on which the user registered for the electronic payment service (the date on which the account was created). Hereinafter, the user's instance (electronic payment account) to which this information is associated will be referred to as an account.

[0025] The charge balance is information indicating the balance of electronic money that is set by a user by transferring money to an account in advance. Methods of transfer include transfer from an ATM (Automatic Teller Machine) of a designated business (bank) and transfer from a registered bank account. The deferred payment setting is information indicating whether or not the setting for enabling deferred electronic payment has been completed, and is set to either "completed" or "not completed." The payment method setting is setting information indicating whether the user will make electronic payment from the charge balance or deferred payment at that time. The bank account and credit card number are information on a bank account or credit card number (account number, card number) that can be deposited into an electronic payment service. The charge history information is a history of the user transferring money to an electronic payment service in advance to increase the charge balance. The payment history information is information indicating the details of the payment made by the user (date and time, store ID of the store where the purchase was made, payment amount, payment method, etc.) for each payment.

[0026] 6 is a diagram showing an example of the contents of affiliated store / store information 176. The affiliated store / store information 176 includes, for example, a first table 176A in which an affiliated store ID and a store ID are associated with a store URL, a second table 176B in which an affiliated store name and sales amount (described above) are associated with an affiliated store ID, and a third table 176C in which a store ID is associated with a store name. In addition to this information, the affiliated store / store information 176 may also include information such as the category of the affiliated store or store, the location of the store, and payment patterns.

[0027] The information management unit 140 manages user information 172 and affiliated store / store information 176 based on information acquired from the user terminal device 10 and the second store terminal device 70. The information management unit 140 adds new records to, edits, and deletes the user information 172 and affiliated store / store information 176.

[0028] [Electronic payment] When payment information is acquired from the user terminal device 10 or the first store terminal device 50, the payment processing unit 130 refers to the user information 172 to acquire the "payment method setting" of the user. For a user whose "payment method setting" is set to "charge balance", the payment processing unit 130 performs electronic payment as follows. For example, the payment processing unit 130 performs electronic payment by decreasing the charge balance managed in association with the user ID and increasing the item value of the affiliated store's sales. The item value of the affiliated store's sales is not used as electronic money itself, for example, and an amount corresponding to the item value of the sales is transferred to a bank account in a cycle according to an agreement between the affiliated store and the electronic payment service.

[0029] The payment processing unit 130 performs electronic payments as follows for users whose "setting information" is set to "deferred payment." Deferred payment is set separately from "credit payment" in cooperation with a credit card company, which is a separate entity from the operator of the electronic payment service, and the operator of the electronic payment service acts as the creditor, allowing electronic payments that are not dependent on the charge balance within the deferred payment limit. In order to receive the deferred payment service, it may be necessary to obtain a credit card provided by the operator of the electronic payment service. In this case, the payment processing unit 130 requests the relevant processing from the operator of the credit card company.

[0030] [Information processing device] The information processing device 200 will be described below. The information processing device 200 includes a processor such as a CPU and a storage device storing a program executed by the processor, similar to the payment server 100. FIG. 7 is a configuration diagram of the information processing device 200. The information processing device 200 includes, for example, an operation log acquisition unit 210, a first pre-processing unit 220, an operation feature vector acquisition unit 230, a derivation unit 240, and a learning unit 250. The learning unit 250 includes a second pre-processing unit 252. These components are realized by, for example, a hardware processor such as a CPU executing a program (software). These components may be replaced with hardware such as an LSI. The information processing device 200 also includes an input / output device 260 and a storage unit 270. The input / output device 260 is a display device, a speaker, a mouse, a keyboard, a touch panel, or the like. The input / output device 260 may be another computer device capable of communicating with the information processing device 200. The storage unit 270 stores information such as a program 272 and a trained model 274. The program 272 causes the information processing device 200 to function as each functional unit.

[0031] The operation log acquisition unit 210 acquires an operation log of a user for an electronic payment service. Hereinafter, a user in the inference stage is referred to as a first user, and a user in the learning stage is referred to as a second user. FIG. 8 is a diagram showing an example of the contents of an operation log. In the figure, user_id is user identification information, event_date_jst is the date on which the operation was performed, event_time_jst is the time, screen is the application screen on which the operation was performed, event_name is the outline of the operation, event_category is the category of the operation, event_action is the operation content, action_time is the elapsed time from the previous operation, and action_time_log is the logarithmic value of the elapsed time.

[0032] The first pre-processing unit 220 generates input data to be input to the trained model 274 by converting the operation log of the first user into a distributed representation. FIG. 9 is a diagram showing an example of the processing contents of the first pre-processing unit 220. For example, the first pre-processing unit 220 extracts the items event_action and action_time_log from the first pre-processing unit 220 and converts them into text. Then, the first pre-processing unit 220 generates input data by concatenating a vector of several hundred dimensions in which the event_action (operation contents) is converted into a distributed representation and a statistical value. Since the operation contents are described in text containing semantic information, the processing can be realized by using an existing distributed representation engine. The distributed representation vector derived from the pair of the operation contents and action_time_log becomes the input data.

[0033] The operation feature vector acquisition unit 230 acquires an operation feature vector of the first user, which is obtained by inputting input data based on the operation log of the first user to the trained model 274. FIG. 10 is a diagram showing an example of the trained model 274. In FIG. 10, the trained model 274 is shown in a fully connected form, but the form of the trained model 274 is not limited to this, and may be another form such as a Transformer. In addition, although the hidden layer is shown to include three layers, this is merely an example, and the hidden layer may have any number of layers.

[0034] The trained model 274 outputs values ​​in a hidden layer HL3 that exists between the input layer IL and the output layer OL in the training stage as an operation feature vector. The hidden layer HL3 is, for example, a layer immediately before the output layer OL (on the input layer IL side). In the inference stage, this hidden layer HL3 functions as an output layer, and the output layer OL in the training stage is originally supposed to output a probability indicating whether or not an operation was performed by each user, but is excluded from the configuration of the trained model 274.

[0035] Here, the learning unit 250 will be described. In this embodiment, the learning unit 250 is a function of the information processing device 200, but the learning unit 250 may be a function of another device (learning device). The learning unit 250 performs learning based on the operation logs of a small number (e.g., several hundred) of second users compared to the number (e.g., several hundred to tens of millions) of first users. This is because if the number of second users is excessively large, there may be cases where the operation feature vector cannot be suitably extracted.

[0036] The second pre-processing unit 252 of the learning unit 250 generates learning data by converting the operation logs of multiple second users into a distributed representation. The function of the second pre-processing unit 252 is similar to that of the first pre-processing unit 220, except for the target users.

[0037] FIG. 11 is a diagram for explaining the function of the learning unit 250. The learning unit 250 inputs the processing result of the second preprocessing unit 252 (data based on the operation logs of multiple second users) as learning data to the input layer IL of the machine learning model 276 that is the basis of the learned model 274, and inputs information indicating which second user performed the operation corresponding to each learning data as teacher data to the output layer OL of the machine learning model 276, performs backpropagation, and finally deletes the output layer OL to generate the learned model 274. Since the hidden layer HL3 is a layer immediately before the output layer OL, it is expected to be a layer that most clearly expresses the characteristics (habits) of the user's operation. The operation feature vector is, for example, a vector of several hundred dimensions, and each element of the vector can take a value from minus 1 to plus 1, for example.

[0038] The derivation unit 240 derives information indicating whether or not the first user has performed unauthorized login by impersonation, based on the operation feature vector of the first user (obtained by inputting input data obtained from the operation log of the first user into the learned model 274). The derivation unit 240 causes the operation log acquisition unit 210, the first preprocessing unit 220, and the operation feature vector acquisition unit 230 to repeatedly execute a process of acquiring the operation feature vector of the first user during the first observation period, and performs statistical processing on the operation feature vector (hereinafter, comparison source vector) during the first observation period (e.g., one year) to calculate a statistically processed vector. The statistical processing is, for example, a process of calculating an average vector by finding the average of each element of the vector. In the following description, it is referred to as an average vector.

[0039] Then, the derivation unit 240 compares the operation feature vector of the first user (hereinafter, the comparison vector) acquired during a second observation period (for example, a desired period immediately after the first observation period) with the average vector, and derives information indicating whether or not the first user has performed an unauthorized login by impersonation during the second observation period.

[0040] For example, the derivation unit 240 obtains the cosine similarity between the average vector and each of the multiple comparison source vectors, generates a graph visualizing the distribution of the cosine similarity, and displays it on the input / output device 260. The derivation unit 240 may obtain other index values ​​indicating the similarity instead of the cosine similarity. Furthermore, the derivation unit 240 obtains the cosine similarity between the average vector and the comparison target vector, and plots the position of the cosine similarity by superimposing it on the above graph. FIG. 12 is a diagram showing an example of an image that the derivation unit 240 causes the input / output device 260 to display. As shown in the figure, the comparison target vector usually shows the same tendency as the average vector, so that the cosine similarity with the average vector is distributed in a place close to 1, but when a user other than the original user performs an operation due to spoofing, the cosine similarity between the comparison target vector and the average vector is distributed far from 1. A supervisor who visually checks such a graph can recognize that there is a possibility that an unauthorized login has been performed due to spoofing.

[0041] Instead of (or in addition to) displaying the relationship between the comparison source vector, the average vector, and the comparison target vector in a graph or the like as shown in FIG. 12, the derivation unit 240 may automatically detect that there is a high possibility that an unauthorized login has been performed by spoofing and display a warning or the like. FIG. 13 is a diagram for explaining a process in which the derivation unit 240 automatically displays a warning. For example, the derivation unit 240 may calculate a threshold Th of cosine similarity at which the result of accumulating the frequency in order from 1 becomes a predetermined percentage (e.g., 80 to 90%) of the whole, and may display a warning or the like when the similarity between the comparison target vector and the average vector is less than the threshold. In addition to the above method, the derivation unit 240 may roughly detect that there is a high possibility that an unauthorized login has been performed by spoofing, and when it is detected, may display a graph as exemplified in FIG. 12 and ultimately leave it to the discretion of the monitor.

[0042] The average vector described above appropriately indicates the operation habits of users. The inventor of the present invention conducted an experiment (simulation) to obtain the distribution of cosine similarity between average vectors while changing the combination of users in a brute force manner. FIG. 14 is a histogram showing the experimental results. As described above, it was found that the average vectors are not similar between most users, and the combination of users whose average vectors have a cosine similarity of 0.6 or more accounts for less than 1% of the total. Therefore, by looking at the distribution of cosine similarity between average vectors, it is possible to accurately estimate users who are using network services by spoofing. The cosine similarity between the average vector and the comparison target also significantly indicates the difference between users, so by looking at this, it is possible to accurately estimate users who are using network services by spoofing.

[0043] According to the embodiment described above, it is possible to perform processing for accurately estimating a user who is using a network service by spoofing.

[0044] The above describes the form for carrying out the present invention using an embodiment, but the present invention is not limited to such an embodiment, and various modifications and substitutions can be made within the scope that does not deviate from the gist of the present invention. [Explanation of symbols]

[0045] 10 User terminal device 20. Payment App 100 Payment Server 120 Payment Contents Provider 130 Payment processing unit 140 Information Management Department 200 Information processing device 210 Operation log acquisition unit 220 First pre-processing section 230 Operation feature vector acquisition unit 240 Derivation part 250 Learning Department 252 Second pre-processing section 260 I / O device 270 Storage section 272 Programs 274 trained models

Claims

1. In the information processing device, A process of acquiring an operation log of a first user for a network service provided via a terminal device accompanied by login; a process of acquiring an operation feature vector of the first user by inputting input data based on the operation log of the first user into a trained model trained using data based on operation logs of a plurality of second users for the network service as learning data and information indicating which second user performed the operation as teacher data; A process of deriving information indicating whether or not the first user has performed an unauthorized login by impersonation based on an operation feature vector of the first user; A program for executing the above.

2. The learned model outputs a value in a hidden layer between an input layer and an output layer as the operation feature vector. The program according to claim 1.

3. The hidden layer is the layer immediately before the output layer. The program according to claim 2.

4. The information processing device includes: repeatedly executing a process of acquiring an operation feature vector of the first user; a statistically processed vector obtained by performing statistical processing on the operation feature vector of the first user acquired during a first observation period and a comparison with the operation feature vector of the first user acquired during a second observation period, thereby deriving information indicating whether or not the first user has engaged in unauthorized login by impersonation during the second observation period; The program according to claim 1.

5. The information processing device further includes: executing a process of generating the input data by converting the operation log of the first user into a distributed representation; The program according to claim 1.

6. The information processing device further includes: executing a process of generating the trained model using data based on operation logs of a plurality of second users for the network service as learning data and information indicating which second user performed the operation as teacher data; The program according to claim 1.

7. The information processing device further includes: executing a process of generating the learning data by converting operation logs of the plurality of second users into a distributed representation; The program according to claim 6.

8. an operation log acquisition unit that acquires an operation log of a first user for a network service provided via a terminal device accompanied by login; an operation feature vector acquisition unit that acquires an operation feature vector of the first user by inputting input data based on the operation log of the first user into a trained model trained using data based on operation logs of a plurality of second users for the network service as training data and information indicating which second user performed the operation as teacher data; a derivation unit that derives information indicating whether or not the first user has performed unauthorized login by impersonation based on the operation feature vector of the first user; An information processing device comprising:

9. An information processing device, A process of acquiring an operation log of a first user for a network service provided via a terminal device accompanied by login; a process of acquiring an operation feature vector of the first user by inputting input data based on the operation log of the first user into a trained model trained using data based on operation logs of a plurality of second users for the network service as learning data and information indicating which second user performed the operation as teacher data; A process of deriving information indicating whether or not the first user has performed an unauthorized login by impersonation based on an operation feature vector of the first user; An information processing method for performing the above.

Images