Information processing device, control method for information processing device, and program

Abstract

To appropriately estimate the usage environment of an information processing device by using different models based on the number of acquired packets.SOLUTION: An information processing device has acquisition means for acquiring a plurality of packets transmitted and received by the information processing device, and estimation means for inputting data based on the acquired plurality of packets into a model to estimate the usage environment of the information processing device. If the number of the acquired plurality of packets is equal to or greater than a threshold, the estimation means inputs the data based on the plurality of packets into a first model to make an estimation, and if the number of the acquired plurality of packets is less than the threshold, the estimation means inputs the data based on the plurality of packets into a second model different from the first model to make an estimation.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] The present invention relates to a technique for estimating a usage environment of an information processing device. [Background technology]

[0002] As a security measure, it is necessary for the various security-related functions of information devices to be properly configured. If an information device is used in a single, fixed environment, by applying settings tailored to that single environment at the time of shipment, users can use the information device with appropriate security measures implemented without having to be aware of anything.

[0003] For example, when we look at the usage environments of multifunction devices, they are not limited to office environments, but are now diversified to include telecommuting, use in public spaces shared by an unspecified number of people, etc. Appropriate security settings differ depending on the usage environment, so it is necessary to set appropriate settings for the usage environment.

[0004] Patent Document 1 proposes a technology that collects the operating status of a test network, creates a policy, and supports updating the policy of each network. In Patent Document 1, the technology compares the feature values ​​extracted from communication packets with the policy to detect network anomalies. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2019-22099 Summary of the Invention [Problem to be solved by the invention]

[0006] However, Patent Document 1 does not anticipate using different models or algorithms for estimating the usage environment based on the number of packets used when estimating the usage environment.

[0007] The present invention aims to appropriately estimate the usage environment of an information processing device by using different models based on the number of acquired packets. [Means for solving the problem]

[0008] In order to achieve the above object, the information processing device of the present invention is an information processing device having an acquisition means for acquiring a plurality of packets transmitted and received by the information processing device, and an estimation means for inputting data based on the acquired plurality of packets into a model to estimate the usage environment of the information processing device, wherein the estimation means, when the number of the acquired plurality of packets is equal to or greater than a threshold, inputs the data based on the plurality of packets into a first model to make an estimation, and when the number of the acquired plurality of packets is less than the threshold, inputs the data based on the plurality of packets into a second model different from the first model to make an estimation. [Effects of the Invention]

[0009] According to the information processing device of the present invention, it is possible to appropriately estimate the usage environment of the information processing device by using different models based on the number of acquired packets. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a block diagram showing a connection configuration between an MFP and a management cloud system according to the present invention. [Figure 2] 2 is a diagram showing the internal configuration of a controller unit of the MFP according to the present invention; [Figure 3] FIG. 2 is a diagram showing the internal configuration of a learning server according to the present invention. [Figure 4] FIG. 2 is a block diagram of software executed by a controller of the MFP according to the present invention. [Figure 5] FIG. 2 is a block diagram of software executed on a learning server according to the present invention. [Figure 6] FIG. 2 is a diagram illustrating a screen configuration related to security use environment setting according to the present invention. [Figure 7] FIG. 1 is a conceptual diagram of the use of a learning model according to the present invention. [Figure 8] FIG. 1 is a conceptual diagram showing the operation of a system using a learning model according to the present invention. [Figure 9] FIG. 10 is a flow chart of estimation and data transmission in the MFP according to the present invention. [Figure 10] FIG. 10 is a data reception flow diagram of the learning server in the learning phase according to the present invention. [Figure 11] FIG. 2 is a diagram illustrating a screen configuration related to security use environment setting according to the present invention. [Figure 12] FIG. 10 is a flow chart of estimation and data transmission in the MFP according to the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0011] First Embodiment Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0012] FIG. 1 is a block diagram showing the connection topology of an MFP, gateway, and learning server according to the present invention. MFP 100 and learning server 121 are connected via LAN 110, gateway 111, and Internet 120. Similarly, MFPs 132, 133, and 134 are connected via LAN 130, gateway 131, and Internet 120 to learning server 121. Hereinafter, MFP 100 will be described as the MFP directly used by the user of interest in this embodiment, and MFPs 132, 133, and 134 will be described as MFPs used elsewhere by other users. Learning server 121 is a server managed by an MFP vendor and shared by users of the same vendor, and each MFP is managed for each user. For the sake of explanation, three MFPs, MFP 132, MFP 133, and MFP 134, are used as examples in this embodiment. However, in reality, millions of MFPs are in operation worldwide, and individual LANs 130 and gateways 131 are used for each user.

[0013] The MFP 100 has an operation unit 102 that inputs and outputs data to and from the user. The MFP 100 has a printer unit 103 that outputs electronic data to paper media. The MFP 100 has a scanner unit 104 that reads paper media and converts it into electronic data. The operation unit 102, printer unit 103, and scanner unit 104 are connected to a controller unit 101, and function as a multifunction peripheral under the control of the controller unit 101. Although not shown in the figure for simplicity, the MFPs 132, 133, and 134 also have an operation unit 102, printer unit 103, and scanner unit 104 as part of their internal structure.

[0014] The gateway 111 and the gateway 131 are network routers that relay communication between the MFP and the Internet 120. The learning server 121 collects information about the MFP and learns its trends.

[0015] FIG. 2 is a detailed block diagram of the controller unit 101 of the MFP. The CPU 201 performs the main arithmetic processing within the controller. The CPU 201 is connected to a DRAM 202 via a bus. The DRAM 202 is used by the CPU 201 as a working memory for temporarily storing program data representing arithmetic instructions and data to be processed during the CPU 201's calculations. The CPU 201 is connected to an I / O controller 203 via a bus. The I / O controller 203 performs input and output to various devices according to instructions from the CPU 201. A SATA (Serial Advanced Technology Attachment) I / F 205 is connected to the I / O controller 203, and a Flash ROM 211 is connected to the SATA I / F 205. The CPU 201 uses the Flash ROM 211 to permanently store programs for implementing the MFP's functions and document files. A network I / F 204 is connected to the I / O controller 203. A wired LAN device 210 is connected to the network I / F 204. The CPU 201 controls the wired LAN device 210 via the network I / F 204 to realize communication on the LAN 110. A panel I / F 206 is connected to the I / O controller 203, and the CPU 201 realizes user-oriented input and output to the operation unit 102 via the panel I / F 206. A printer I / F 207 is connected to the I / O controller 203, and the CPU 201 realizes output processing for paper media using the printer unit 103 via the printer I / F 207.

[0016] For example, when a copy function is to be performed, the CPU 201 loads program data from the Flash ROM 211 into the DRAM 202 via the SATA I / F 205. The CPU 201 detects a copy instruction from the user via the panel I / F 206 on the operation unit 102 in accordance with the program loaded into the DRAM 202. When the CPU 201 detects a copy instruction, it receives an original as electronic data from the scanner unit 104 via the scanner I / F 208 and stores the data in the DRAM 202. The CPU 201 performs color conversion processing suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 103 via the printer I / F 207, and performs output processing onto paper media.

[0017] FIG. 3 is a detailed block diagram of the server 250 that implements the learning server 121. The CPU 251 performs the main arithmetic processing. The CPU 251 is connected to a DRAM 252 via a bus. The DRAM 252 is used by the CPU 251 as a working memory for temporarily storing program data representing arithmetic instructions and data to be processed during the CPU 251's calculations. The CPU 251 is connected to an I / O controller 253 via a bus. The I / O controller 253 performs input and output to various devices according to instructions from the CPU 251. A SATA (Serial Advanced Technology Attachment) I / F 254 is connected to the I / O controller 253, which is further connected to an HDD 255. The CPU 251 uses the HDD 255 to permanently store programs for implementing various server functions and setting values. In this way, the hardware, including the CPU 251, DRAM 252, and HDD 255, constitutes what is known as a computer. In this embodiment, for the sake of explanation, a case is illustrated in which one CPU 251 executes each process shown in the flowcharts described below using one memory (DRAM 252), but other modes are also possible. For example, each process shown in the flowcharts described below can be executed by multiple processors, RAMs, ROMs, and storages working together. Each process can also be executed using multiple server computers. The server 250 can provide the management cloud system 121 to multiple different tenants by using containerization and virtualization technology.

[0018] 4 is a block diagram showing the structure of software executed by the controller unit 101 of the MFP. All software executed by the controller unit 101 is executed after the CPU 201 reads a program stored in the flash ROM 211 into the DRAM 202.

[0019] The operation control unit 301 displays a screen image for the user on the operation unit 102, detects user operations, and executes processing associated with screen components such as buttons displayed on the screen. The data storage unit 302 stores and reads data in the Flash ROM 211 in response to requests from other control units. For example, if a user wants to change some device settings, the operation control unit 301 detects the content entered by the user on the operation unit 102, and in response to a request from the operation control unit 301, the data storage unit 302 saves the content as setting values ​​in the Flash ROM 211. The job control unit 303 controls job execution in response to instructions from other control units. The image processing unit 304 processes image data into a format appropriate for each application in response to instructions from the job control unit 303. The print processing unit 305 prints and outputs an image on paper media via the printer I / F 207 in response to instructions from the job control unit 303. The read control unit 306 reads a placed document via the scanner I / F 208 in response to instructions from the job control unit 303.

[0020] The network control unit 307 sets network settings such as an IP address in the TCP / IP control unit 308 at system startup or when a setting change is detected, in accordance with the setting values ​​stored in the data storage unit 302. The TCP / IP control unit 308 performs network packet transmission and reception processing via the network I / F 204 in accordance with instructions from other controls. The network packets transmitted and received by the network control unit 307 via the network I / F 204 include packets related to jobs executed in the printer unit 103 and the scanner unit 104.

[0021] The security setting control unit 309 manages the correspondence between usage environments, such as an internal LAN, a home, or a public space, and the corresponding security-related setting items, and can set corresponding security-related settings in a lump when a user specifies a usage environment. The security setting control unit 309 uses the data storage unit 302 to refer to and change setting values. The security setting control unit 309 sets setting values ​​in the MFP 100 that correspond to the usage environment selected by the user via the operation unit 102. For example, the operation control unit 301 displays the result of estimation by the estimation processing unit 312 on the operation unit 102, and the user confirms the display and selects the usage environment of the estimated result. The security setting control unit 309 may also automatically set setting values ​​corresponding to the usage environment obtained as a result of estimation by the estimation processing unit 312 in the MFP 100 without user operation.

[0022] The learning server communication unit 310 uses the network control unit 307 to exchange information between the learning server 121 and the MFP 100. The communication data extraction unit 311 transmits the extracted communication data to the learning server 121.

[0023] The communication log extraction unit 311 uses the network control unit 307 to extract communication logs sent and received by the MFP 100. The extraction process extracts the IP addresses of the destination and source, the TCP / UDP type, the port number, and the IP header information from the information accompanying the network packet. This extraction process excludes the content portion of the packet, called the payload.

[0024] The estimation processing unit 312 performs estimation processing when a screen is displayed or when a network function is initialized.

[0025] 5 is a block diagram showing the structure of the software executed by the learning server 121. All software executed by the learning server 121 is executed by the CPU 251 after reading a program stored in the HDD 255 into the DRAM 252.

[0026] The MFP communication unit 401 controls communication with the MFP 100 , and stores information received from the MFP 100 , such as a communication log and the usage environment, in a data storage unit 402 .

[0027] The data storage unit 402 stores and reads data in distributed resources on the cloud in response to requests from other control units.

[0028] The learning unit 403 generates a learning model of the tendency of the communication log relative to the usage environment from the association between the communication log and the usage environment stored in the data storage unit 402. The generated learning model is held in the data storage unit 402.

[0029] FIG. 6 shows a recommended security settings screen 701 displayed on the operation unit 102. The usage environment corporate LAN button 702 is a button for setting a series of security settings that are appropriate when the usage environment is a corporate LAN in one go. The usage environment at home button 703 is a button for setting a series of security settings that are appropriate when the usage environment is at home in one go. The usage environment public space button 704 is a button for setting a series of security settings that are appropriate when the usage environment is a public space in one go. The isolated network button 705 is a button for setting a series of security settings that are appropriate when the usage environment is an isolated network in one go. The direct internet connection button 709 is a button for setting a series of security settings that are appropriate when the usage environment is directly connected to the internet in one go. The highly confidential information management button 710 is a button for setting a series of security settings that are appropriate when the usage environment is highly confidential information management in one go. When the security setting control unit 309 detects that the user has selected one usage environment on the recommended security setting screen 701, it sets the setting values ​​corresponding to the selected usage environment in the MFP 100. Specifically, it collectively sets multiple setting values ​​recommended for the selected usage environment in the MFP 100.

[0030] The selected usage environment display 706 displays the usage environment set using buttons 702, 703, 704, 705, 709, and 710. Information on which pattern was selected as this usage environment is stored in the data storage unit 302 along with date and time information indicating when the corresponding button was pressed. The usage environment estimation result 707 displays the usage environment estimated by estimation processing based on the trends in communication data. The information display unit 708 is a surface area that notifies the user of various information. In the display example of FIG. 6, since the user's selection is likely to be inappropriate, the user is urged to review the settings using the recommended security settings screen 701.

[0031] Here, the usage environment has been shown as an example for different usage scenarios such as telecommuting, but it is also possible to simply prepare several variations in strength such as security level 1 and security level 2. In that case, learning and estimation of communication logs will be performed for security strength, but since security strength is essentially linked to the usage scenario, they are essentially doing the same thing.

[0032] 7 is a conceptual diagram showing an input / output structure using the learning model of embodiment 1. In the estimation process, the learning model receives a communication log 801 as input and outputs a usage environment 802.

[0033] The usage environment 802 is specifically configured according to the patterns shown in Table 1.

[0034] [Table 1]

[0035] An internal LAN is a typical office environment where many people gather and some devices are connected to the Internet to use cloud services. The number of connected devices is greater than in other usage environments. In such environments, a managed firewall is generally installed at the boundary with the external network, and access is restricted to employees only. A good balance is maintained between security measures implemented in the usage environment and on each device.

[0036] An isolated network is an environment where connections to the Internet are blocked as a network topology due to the use of outdated protocols for some reason, and the network is used in an isolated manner. The number of connected information devices is relatively small. By taking strong security measures in the usage environment, the level of security measures required on the terminal side can be relaxed.

[0037] The home network scenario is designed for working from home, and assumes an environment where the small-scale LAN used at home is used for working from home. The number of connected information devices is the smallest. It is assumed that security measures implemented in the usage environment cannot be relied upon to that extent, and security measures on the device side must be implemented in a balanced manner.

[0038] Public spaces are assumed to be open spaces where an unspecified number of people come and go and share networks. These include airport lounges and coworking spaces available to guests, and are used under loose access restrictions. There are a relatively large number of information devices connected. Security measures implemented in the user environment are generally not trusted, and security measures must be implemented on the device side, even if this means sacrificing some functionality.

[0039] Direct Internet connection assumes an environment where the office does not have a local area network and is connected directly to the Internet. Since there is no expectation of firewall protection on the network side, security measures must be taken on the terminal side to assume unauthorized access.

[0040] Highly confidential information management envisions an environment where highly confidential information such as customer personal information is handled on terminals, and where maximum security is required even at the expense of user convenience. In such environments, IPSec communication encryption is often used on the network side, but on top of that, it is also necessary to implement the safest possible security measures on the terminal side.

[0041] Specifically, the communication log 802 is composed of the data shown in Table 2. One piece of communication log data is generated from an input packet made up of multiple network packets.

[0042] [Table 2]

[0043] The number of destination addresses is the number of variations of addresses that the communication packets contained in the input packets had as their destination. This value increases when the device uses various external services. If this value is extremely small, there is a relatively high possibility that the device is on an isolated network where communication is restricted.

[0044] The number of source addresses is the number of variations of addresses used as the source of communication packets included in input packets. This value increases when there are a large number of information devices in the network. Although it shows a similar trend to traffic volume, it is essentially a different value, so by looking at the trends in combination, the estimation accuracy can be improved.

[0045] The number of protocol types is the number of protocol variations used by the communication packets included in the input packet. The number increases proportionally with the number of information devices connected to the network. Also, the value becomes small in network environments with strict functional restrictions. If this value is small, it is likely that the network is isolated or in a public space.

[0046] The number of TTL (Time to Live) values ​​in the IP header is the number of variations in the TTL value attached to the communication packet included in the input packet. Because this value is subtracted each time the packet passes through a router, it will have a small value for packets that have passed through many routers. An environment with only uniformly large values ​​is likely to be a small network, while an environment with validation from large to small values ​​is likely to be a large network.

[0047] The attribute of including packets with a global IP address is a value of 1 if the input packet contains a global IP address in the source address, and 0 if it does not. If it is included, it means that the network is accessible from outside. In such cases, it is highly likely that it is directly connected to the Internet, but even if it is included, it may be in a different environment, and even if it is not included, it may be directly connected to the Internet. Here, a global IP address is an IP address included in Table 3.

[0048] [Table 3]

[0049] The attribute of including IPSec communication packets is a value of 1 if the input packet includes IPSec communication, and 0 if it does not. If it does, it indicates that low-layer communication encryption is being applied to the network. In such cases, it is highly likely that the environment is one where highly confidential information is managed, but even if it does, it may be a different environment, and even if it does not, it may still be one where highly confidential information is managed.

[0050] As such, each parameter has a certain tendency with respect to characteristics such as network size, but it is difficult to logically determine a threshold value for making that judgment, and estimation is performed by combining multiple parameters to determine a composite value. For this reason, in this embodiment, a learning algorithm is used to perform estimation processing based on a combination of the usage environment and the communication log acquired there. By conducting numerous experiments, it is possible to determine a threshold value without using a learning algorithm, so this technology is also applicable to threshold-based methods that do not use such learning algorithms.

[0051] The input communication logs are processed into numerical vectors to improve the accuracy of estimation.

[0052] Regarding variations in the TTL attribute, the number of packets contained in the input packets is histogrammed, thresholds are determined that divide the same amount of data into, for example, five ranges, and integers from 1 to 5, which are the corresponding range values, are used as inputs.

[0053] For the number of destination addresses, the number of source addresses, and the number of protocol types, the variations in the appearance of unique values ​​contained in the input packets are used. Specifically, the number of packets with the same value that are included multiple times in the input packets is counted, and the packets corresponding to the value with the most overlaps are selected, and the number of selected values ​​is used when 1% of all packets have been selected. Depending on how the unit time is taken, this value will generally fall within the range of 1 to 20, so this value is used. If a value significantly exceeding 20 appears occasionally, it may be rounded to 20 or some other processing may be performed.

[0054] Generally, when parameters with widely different value ranges are input to a learning algorithm, the difference in value ranges can affect estimation accuracy. For example, if only the TTL variation has a value range of 1 to 10,000 and the others are 1 to 10, the estimation results will be strongly sensitive to the TTL variation. By using each parameter in a balanced manner, this type of numerical vectorization can improve estimation accuracy.

[0055] In the learning phase, a single learning model is generated using a large number of communication logs 801. At this time, the number of packets contained in the input packets from which each communication log 801 is generated must be the same. Even in communication logs acquired in the exact same environment, if the number of packets contained is one, there can only be one destination address, and if the number of packets is 100, the value may be around 20, which makes them unsuitable as data for estimating the environment. In this embodiment, the learning model for the first threshold uses input packets containing 150 packets, and the learning model for the second threshold uses input packets containing 50 packets. This also applies to communication logs input in the estimation phase; the input packets must contain the same number of packets as during learning. If only 50 packets are acquired in the estimation phase, one possible method is to triple that value and use a learning model trained with input packets containing 150 packets; however, this approach significantly reduces estimation accuracy. For example, in an environment where 150 packets are acquired and the destination address is 20, a value close to 20 is often obtained even when only 50 packets are acquired. This is because the number of unique values ​​is counted, and the increase in value slows as the number of acquired packets increases. In this case, multiplying it by three will result in 60, which will result in an estimation of a completely different environment. To prepare 50 packets of training data, you can extract 50 packets from a sample where 150 packets were acquired, but it is preferable to use data from an environment where only 50 packets were acquired.

[0056] The learning model can be generated by collecting a large number of samples in a real environment of combinations of a communication log 801 as an input and a usage environment 802 corresponding to the output, and learning based on these. In this embodiment, the parameter array of the communication log is a one-dimensional array, which is then sampled multiple times and arranged in chronological order to form a two-dimensional array. Then, a general algorithm for generating a convolutional neural network model is used to generate the learning model. Note that a classifier may also be configured using an algorithm such as a k-nearest neighbor method or a support vector machine.

[0057] FIG. 8 is a diagram illustrating the operation of a system in the learning phase to which the present invention can be applied, utilizing the learning model structure shown in FIG. 7. The MFPs 132, 133, and 132 regularly transmit to the learning system 121 the usage environment patterns shown in Table 1 set for the devices using the recommended security settings screen 701 and communication logs containing the information shown in Table 2 extracted by the communication log extraction unit 311. While only three devices are shown in this example for the sake of explanation, data is actually collected from millions of devices operated worldwide. The combination of usage environment and communication log thus obtained is subjected to the numerical vectorization described in FIG. 7, and a learning model is generated by performing calculations using a machine learning algorithm. In practice, bias occurs in the data obtained for each usage environment, so data processing is performed, such as adjusting the number of data samples to prevent overlearning for a specific usage environment and removing outlier data based on the standard deviation for each usage environment.

[0058] By making an estimation using the learning model generated as a result of the series of operations shown in Figure 8, it is possible to present usage environment settings that are likely to be appropriate for the MFP used by the user, based on the usage environment settings and communication logs of MFPs including those not currently being used by the user.

[0059] 9, the process in which MFP 100 performs estimation processing, notifies the user, and transmits information to the learning server to improve accuracy in the future will be described. The process performed by the MFP in Fig. 9 is the process of communication log extraction unit 311, estimation processing unit 312, operation control unit 301, and learning server communication unit 310. After CPU 201 reads a program stored in Flash ROM 211 into DRAM 202, the program is executed as calculation processing of CPU 201.

[0060] This flow starts when initialization of the network function is completed in the MFP 100 or when the recommended security setting screen 701 is displayed. Initialization of the network function is performed when the system starts up after the power of the device is turned on or when the network settings are changed, and is the timing when the MFP 100 becomes capable of communication.

[0061] In step S1001, the MFP 100 starts scanning. Specifically, the communication log extraction unit 311 captures network packets transmitted and received between the MFP 100 and the LAN 100.

[0062] In S1002, the communication log extraction unit 311 checks whether the scan time has exceeded the upper limit. That is, it checks whether a predetermined time has elapsed since the start of network packet scanning. In this embodiment, the upper limit of the scan time is set to 60 seconds. This is determined in advance as the time within which the first threshold amount of network packets checked in S1008 can be collected in many network environments. If the upper limit has been exceeded, the process of S1003 is carried out, and if not, the process of S1008 is carried out.

[0063] In S1008, the communication log extraction unit 311 checks whether the number of packets is equal to or greater than a first threshold. That is, it checks whether the number of packets acquired within a predetermined time period after starting network packet scanning is equal to or greater than the first threshold. In this embodiment, the first threshold is 150 packets. This is determined in advance by verifying the improvement in estimation accuracy with an increase in the number of input packets for the usage environment estimation model and determining the turning point at which the rate of improvement in accuracy slows down with an increase in the number of packets. From the perspective of estimation accuracy, the more packets assumed as input, the better. However, for the estimation result display function, the shorter the scan time, which depends on the number of packets, the better. Furthermore, it is generally known that the rate of improvement in estimation accuracy with respect to the number of data assumed as input follows a logarithmic increase graph, which slows down as the number of data increases. If the number of packets is equal to or greater than the first threshold, S1009 is performed. If the number of packets is not equal to or greater than the first threshold, i.e., if the number of packets is less than the first threshold, S1002 is performed again. If the number of packets is not equal to or greater than the first threshold, a short processing pause may be provided to avoid excessive repetitive calculations.

[0064] In S1009, the estimation processing unit 312 estimates the usage environment using the learning model for the first threshold. The first threshold is set to 150 packets. The learning model for the first threshold is a learning model optimized for input of 150 packets, with 150 packets prepared as each data set used as learning data during learning. This step is executed only when 150 packets have been acquired, and these packets are used as input for the estimation process. Specifically, the communication log extraction unit 311 extracts feature quantities such as those shown in Table 2 using 150 packets among the packets acquired within a predetermined time. The estimation processing unit 312 inputs the feature quantities extracted by the communication log extraction unit 311 into the learning model for the first threshold to estimate the usage environment.

[0065] In S1003, the communication log extraction unit 311 checks whether the number of packets is equal to or greater than a second threshold. In this embodiment, the second threshold is set to 50 packets. This is determined in advance as the lower limit value at which a significant estimation result can be obtained by verifying the improvement characteristic of estimation accuracy as the number of input packets increases. If the number is equal to or greater than the second threshold, S1004 is executed. If the number is not equal to or greater than the second threshold, i.e., if the number is less than the second threshold, S1007 is executed.

[0066] In S1004, the estimation processing unit 312 estimates the usage environment using a learning model for the second threshold. The second threshold is set to 50 packets. The learning model for the second threshold is a learning model optimized for input of 50 packets, with 50 packets prepared as each data set used as learning data during learning. Although 51 or more packets may be acquired in this step, only 50 packets in the order they were received are used as input for the estimation process. Specifically, the communication log extraction unit 311 extracts feature quantities as shown in Table 2 using 50 packets among those acquired within a predetermined time. The estimation processing unit 312 inputs the feature quantities extracted by the communication log extraction unit 311 into the learning model for the second threshold to estimate the usage environment.

[0067] In S1007, the estimation processing unit 312 performs rule-based estimation of the usage environment. Rule-based estimation is, for example, the following estimation: If an IPSec packet is included, it is uniformly estimated to be a highly confidential information management environment. If a global IP address packet is included, it is uniformly estimated to be an environment directly connected to the Internet. If none of these conditions apply, it is estimated to be an in-house intranet environment. Rule-based estimation is such a judgment table-based estimation. This is less accurate than when a learning model is used, but in many cases it is better than no estimation result being produced due to the nature of the function.

[0068] In S1005, the MFP 100 notifies the estimation result. Specifically, the operation control unit 301 notifies the estimation result. If the recommended security setting screen 701 is being displayed, the usage environment estimated in any one of S1004, S1007, and S1009 is displayed in the usage environment estimation result 707. At this timing, the estimation result may be sent to the management tool and displayed on the display unit of the management tool, or may be recorded as a log within the MFP 100.

[0069] In S1006, the MFP 100 transmits the collection packet to the learning server 121. Specifically, the learning server communication unit 310 transmits the collection packet to the learning server 121. The processing on the learning server side that receives this data will be described with reference to FIG.

[0070] The above flow allows for estimation of the usage environment using an appropriate learning model depending on the amount of communication traffic.

[0071] The process from when the learning server 121 receives learning data to when it updates the learning model will be described using Figure 10. In this embodiment, all software executed by the learning server 121 in Figure 10 is executed by the CPU 251 after reading programs stored in the HDD 255 into the DRAM 252.

[0072] This flow starts when a communication log is received from the MFPs 132, 133, and 134.

[0073] In S1101, the learning server 121 stores the data received from the MFP.

[0074] If the usage environment is an isolated network as described in Table 1, data cannot be collected via the Internet, and some ingenuity is required. For example, by establishing a VPN (Virtual Private Network) connection between the user's network and the learning server 121, a connection can be made without going via the Internet. Alternatively, when a service engineer visits a user, the logs accumulated on the MFP 100 can be copied to a portable storage medium and then transmitted from the service center to the learning server 121.

[0075] This is processing for receiving the data transmitted by the MFP in S1006 and storing it in the data storage unit 402.

[0076] In S1102, the learning server 121 checks whether a certain period of time has passed. For example, if the learning model is updated at a predetermined interval, such as once a week, it checks whether data collection has been performed for one week. If the certain period of time has passed, S1103 is executed; if not, this flow ends. In this embodiment, the condition is time, but the condition may also be the amount of data, such as the number of received communication logs being 10,000.

[0077] In S1103, the learning server 121 vectorizes the accumulated received data. Specifically, by performing the vectorization process on the communication log, which is the input described in the explanation of Figure 7, the received communications are converted into an array of integers with a uniform value range. This one-dimensional array of the communication log is arranged in chronological order for each individual MFP to obtain a two-dimensional array. This two-dimensional array is used as input data, and the usage environment pattern set for this individual MFP is used as training data to form one training data set. A training data set is obtained by performing the same process on the data for all MFPs. Note that to generate a learning model for the first threshold, training data is created using data with the number of packets equal to the first threshold number. To generate a learning model for the second threshold, training data is created using data with the number of packets equal to the second threshold number.

[0078] In S1104, the learning server 121 performs calculations using a learning algorithm. The learning data set generated in S1103 is calculated using a convolutional neural network.

[0079] A learning model is generated in S1105. The results of the calculation in S1104 are extracted, and the learning model data is stored in the data storage unit 402 as a learning model candidate.

[0080] In S1106, the estimation accuracy is measured. The accuracy of the learning model saved in S1105 is verified using collected data. In the verification, accuracy is measured using data that was not used in learning, such as a holdout method, and accuracy information is saved in the data storage unit 402.

[0081] In S1107, it is confirmed whether the accuracy has improved. In S1106, it is confirmed whether the accuracy measured this time has improved compared to the accuracy of the previously generated learning model. If it has improved, S1108 is executed; if it has not improved, this flow ends. In this embodiment, a uniform judgment is made as program processing, but in reality, there are cases where it is difficult to mechanically judge which performance is better, such as when accuracy improves in a specific usage environment but decreases in others. Taking such cases into consideration, the accuracy can be confirmed by a human being who makes a comparison and consideration each time and then instructs the learning server 121.

[0082] In S1108, the learning server 121 updates the learning model by overwriting the learning model stored in the data storage unit 402 with the learning model candidate stored in S1105.

[0083] According to the above flow, a learning model for performing estimation processing can be generated based on the collected learning data. The learning model generated in this way can be stored in advance in the data storage unit 402 of the MFP 100, and can be used when the estimation processing unit 312 of the MFP 100 performs estimation processing. This model is stored when the device is shipped, but a firmware upgrade mechanism may be provided so that the model can be updated at the same time as other programs are updated.

[0084] Through the above flow, the MFP can obtain the estimation results and present them to the user, thereby assisting the user in setting up the device.

[0085] Although the image forming apparatus has been described as an example, the present technology is applicable to information processing apparatuses in general, including image forming apparatuses.

[0086] The above flow allows a user without specialized security knowledge to select settings that are likely to be appropriate for the usage environment, regardless of the amount of communication traffic.

[0087] <Second embodiment> Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In this embodiment, when the environment selected in the recommended security settings differs from the estimated usage environment, the user is strongly recommended to change the settings.

[0088] 1, 2, 3, 4, 5, 7, 8, 9 and 10 show the same configuration as the first embodiment.

[0089] 11A shows a recommended security setting screen 701 displayed on the operation unit 102. The operation control unit 301 controls the display of the recommended security setting screen 701. 701, 702, 703, 704, 705, 706, 707, 708, 709, and 710 in the figure have the same configuration as in FIG.

[0090] The estimation execution button 711 is a button that the user uses to instruct the start of the usage environment estimation process. As explained in Fig. 9, the estimation process is automatically performed without user instruction when the initialization of the network function is completed or when the recommended security settings screen 701 is displayed. This button is used by the user to intentionally perform the estimation process at any timing.

[0091] FIG. 11(B) shows the recommended security setting screen 701, which displays a pop-up screen informing the user when the selected usage environment differs from the usage environment estimation result. When the recommended security setting screen 701 is displayed, if the previously estimated usage environment estimation result differs from the selected usage environment, this screen is displayed before the screen shown in FIG. 11(A) is displayed. When the execution estimation button 711 is pressed or network initialization is completed, the estimation result is updated while the screen shown in FIG. 11(A) is displayed. If the estimation result differs from the selected usage environment, the pop-up screen 712 displays a message indicating that the selected usage environment differs from the usage environment estimation result, as well as the selected usage environment and the usage environment estimation result. The close button 713 is pressed by the user when they determine that no changes to the settings are necessary; pressing this button closes the pop-up screen 712. The set button 714 is pressed by the user when they determine that changes to the settings are necessary; this button switches the display to the pop-up screen shown in FIG. 11(C).

[0092] 11(C) shows the recommended security settings screen 701 with a pop-up screen displayed to confirm with the user whether or not it is OK to display the recommended settings. A pop-up screen 715 displays the usage environment estimation results, which are the recommended settings to be set. A Yes button 716 is a button for executing the settings, and pressing the button executes the settings. A No button 717 is a button for canceling the settings, and pressing the button closes the pop-up screen 715.

[0093] In this way, when the usage environment selected on the recommended security setting screen 701 differs from the estimated result, the operation control unit 301 controls the display so as to display a pop-up screen including the usage environment of the estimated result.

[0094] With the above configuration, the user is strongly encouraged to use the usage environment estimation results, increasing the likelihood that the user will use more desirable settings.

[0095] <Third embodiment> DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below with reference to the accompanying drawings. The present embodiment is an example in which, in estimating the usage environment, priority is given to judgment based on some rules.

[0096] 1, 2, 3, 4, 5, 6, 7, 8, and 10 show the same configuration as in the first embodiment. Also, as in the second embodiment, the configuration in Fig. 11 may be used instead of Fig. 6.

[0097] The process in which MFP 100 performs estimation processing, notifies the user, and transmits information to the learning server to improve accuracy in the future will be described using Figure 12. The process performed by the MFP in Figure 12 is the process of communication log extraction unit 311, estimation processing unit 312, operation control unit 301, and learning server communication unit 310. After CPU 201 loads a program stored in Flash ROM 211 into DRAM 202, the program is executed as calculation processing of CPU 201.

[0098] This flow starts when initialization of the network function is completed in the MFP 100 or when the recommended security setting screen 701 is displayed. Initialization of the network function is performed when the system starts up after the power of the device is turned on or when the network settings are changed, and is the timing when the MFP 100 becomes capable of communication.

[0099] In step S1201, the MFP 100 starts scanning. Specifically, the communication log extraction unit 311 captures network packets transmitted and received between the MFP 100 and the LAN 100.

[0100] In S1202, the communication log extraction unit 311 checks whether the scan time has exceeded the upper limit. That is, it checks whether a predetermined time has elapsed since the start of scanning network packets. In this embodiment, the upper limit of the scan time is set to 60 seconds. This is determined in advance as the time within which the first threshold amount of network packets checked in S1208 can be collected in many network environments. If the upper limit has been exceeded, the process of S1203 is carried out; if not, the process of S1208 is carried out.

[0101] In S1208, the communication log extraction unit 311 checks whether the number of packets is equal to or greater than a first threshold. That is, it checks whether the number of packets acquired within a predetermined time period after starting network packet scanning is equal to or greater than the first threshold. In this embodiment, the first threshold is 150 packets. This is determined in advance by verifying the improvement in estimation accuracy with an increase in the number of input packets for the usage environment estimation model and determining the turning point at which the rate of improvement in accuracy slows down with an increase in the number of packets. From the perspective of estimation accuracy, the more packets assumed as input, the better. However, for the estimation result display function, the shorter the scan time, which depends on the number of packets, the better. Furthermore, it is generally known that the rate of improvement in estimation accuracy with respect to the number of data assumed as input follows a logarithmic increase graph, which slows down as the number of data increases. If the number of packets is equal to or greater than the first threshold, S1210 is performed. If the number of packets is not equal to or greater than the first threshold, i.e., if the number of packets is less than the first threshold, S1202 is performed again. If the number of packets is not equal to or greater than the first threshold, a short processing pause may be provided to avoid excessive repetitive calculations.

[0102] In S1210, the estimation processing unit 312 checks whether the packet conforms to a priority rule. A priority rule is a highly accurate rule that, for example, uniformly infers that an environment containing IPSec packets is a highly confidential information management environment. If such a highly accurate rule is known, checking it prior to estimation using the learning model can improve the accuracy of the estimation. If the packet conforms in S1210, S1211 is executed, and if the packet does not conform, S1209 is executed.

[0103] In step S1211, the estimation processing unit 312 estimates the usage environment based on a priority rule, that is, it makes a preset estimation such that if an IPSec packet is included, it is uniformly estimated to be a highly confidential information management environment.

[0104] In S1209, the estimation processing unit 312 estimates the usage environment using the learning model for the first threshold. The first threshold is set to 150 packets. The learning model for the first threshold is a learning model optimized for input of 150 packets, with 150 packets prepared as each data set used as learning data during learning. This step is executed only when 150 packets have been acquired, and these packets are used as input for the estimation process. Specifically, the communication log extraction unit 311 extracts feature quantities such as those shown in Table 2 using 150 packets among the packets acquired within a predetermined time. The estimation processing unit 312 inputs the feature quantities extracted by the communication log extraction unit 311 into the learning model for the first threshold to estimate the usage environment.

[0105] In S1203, the communication log extraction unit 311 checks whether the number of packets is equal to or greater than a second threshold. In this embodiment, the second threshold is set to 50 packets. This is determined in advance as the lower limit value at which a significant estimation result can be obtained by verifying the improvement characteristic of estimation accuracy as the number of input packets increases. If the number is equal to or greater than the second threshold, S1204 is executed. If the number is not equal to or greater than the second threshold, i.e., if the number is less than the second threshold, S1207 is executed.

[0106] In S1204, the estimation processing unit 312 estimates the usage environment using a learning model for the second threshold. The second threshold is set to 50 packets. The learning model for the second threshold is a learning model optimized for input of 50 packets, with 50 packets prepared as each data set used as learning data during learning. Although 51 or more packets may be acquired in this step, only 50 packets in the order they were received are used as input for the estimation process. Specifically, the communication log extraction unit 311 extracts feature quantities as shown in Table 2 using 50 packets among those acquired within a predetermined time. The estimation processing unit 312 inputs the feature quantities extracted by the communication log extraction unit 311 into the learning model for the second threshold and estimates the usage environment.

[0107] In S1207, the estimation processing unit 312 performs rule-based usage environment estimation. Rule-based estimation is, for example, the following estimation: If a global IP address packet is included, it is uniformly estimated to be an environment directly connected to the Internet. If the conditions do not apply, it is estimated to be an in-house intranet environment. Rule-based estimation is such a judgment table-based estimation. This is less accurate than using a learning model, but in many cases it is better than not being able to produce an estimation result due to the nature of the function.

[0108] In S1205, the MFP 100 notifies the estimation result. Specifically, the operation control unit 301 notifies the estimation result. If the recommended security setting screen 701 is being displayed, the usage environment estimated in any one of S1204, S1207, and S1209 is displayed in the usage environment estimation result 707. At this timing, the estimation result may be sent to the management tool and displayed on the display unit of the management tool, or may be recorded as a log within the MFP 100.

[0109] In S1206, the MFP 100 transmits the collected packet to the learning server 121. Specifically, the learning server communication unit 310 transmits the collected packet to the learning server 121.

[0110] In the above flow, it is possible to give priority to judgments based on some rules.

[0111] <Other embodiments> The present invention can also be realized by supplying a program that realizes one or more functions of each of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program. It can also be realized by a circuit (e.g., ASIC or FPGA) that realizes one or more functions. [Explanation of symbols]

[0112] 100 MFP 311 Communication Log Extraction Unit 312 Estimation processing unit

Claims

1. An information processing device, acquiring means for acquiring a plurality of packets transmitted and received by the information processing device; an estimation means for estimating a usage environment of the information processing device by inputting data based on the acquired plurality of packets into a model; and The estimation means If the number of the acquired plurality of packets is equal to or greater than a threshold, data based on the acquired plurality of packets is input to a first model to perform estimation; If the number of the acquired plurality of packets is less than the threshold, data based on the plurality of packets is input to a second model different from the first model to perform estimation.

1. An information processing device comprising:

2. A setting means for setting a setting value corresponding to the estimated usage environment. The information processing device according to claim 1 , further comprising:

3. the acquiring means acquires the plurality of packets within a predetermined time period; The estimation means If the number of the plurality of packets acquired within the predetermined time is equal to or greater than the threshold, data based on the plurality of packets is input to the first model to perform estimation; If the number of the plurality of packets acquired within the predetermined time is less than the threshold, data based on the plurality of packets is input to the second model to perform estimation.

2. The information processing apparatus according to claim 1, wherein:

4. The estimation means If the number of the acquired plurality of packets is less than the threshold value and is equal to or greater than another threshold value lower than the threshold value, data based on the acquired plurality of packets is input to the second model to perform estimation; If the number of the acquired packets is less than the other threshold, the usage environment is estimated based on the packets without using the model.

2. The information processing apparatus according to claim 1, wherein:

5. The first model is generated by learning data based on the threshold number of packets as learning data.

2. The information processing apparatus according to claim 1, wherein:

6. The second model is generated by learning data based on the number of packets equal to the other threshold value as learning data.

5. The information processing apparatus according to claim 4,

7. The estimated usage environment is at least one of an environment connected to an internal LAN, an environment directly connected to the Internet, an environment cut off from the Internet, an environment intended for telecommuting, an environment intended for use in a public space, and an environment managing highly confidential information.

2. The information processing apparatus according to claim 1, wherein:

8. the information processing device is an image processing device further including a scanner and a printer; The plurality of packets acquired includes packets related to a job to be executed in the scanner or the printer.

2. The information processing apparatus according to claim 1, wherein:

9. The estimation means If the number of the acquired plurality of packets is equal to or greater than the threshold value and the plurality of packets satisfy a predetermined condition, outputting a usage environment corresponding to the predetermined condition as an estimation result; If the number of the acquired plurality of packets is equal to or greater than the threshold value and the plurality of packets do not satisfy the predetermined condition, data based on the plurality of packets is input to the first model to perform estimation.

2. The information processing apparatus according to claim 1, wherein:

10. a display control means for displaying a screen for accepting a selection of a usage environment of the information processing device; a setting means for setting a setting value corresponding to the usage environment selected on the screen in the information processing device; and The display control means displays a pop-up screen including the estimated usage environment when a usage environment selected on the screen and a corresponding setting value set in the information processing device differs from the usage environment estimated by the estimation means.

2. The information processing apparatus according to claim 1, wherein:

11. A control method for an information processing device, comprising: an acquisition step of acquiring a plurality of packets transmitted and received by the information processing device; an estimation step of estimating a usage environment of the information processing device by inputting data based on the acquired plurality of packets into a model; and In the estimation step, If the number of the acquired plurality of packets is equal to or greater than a threshold, data based on the acquired plurality of packets is input to a first model to perform estimation; If the number of the acquired plurality of packets is less than the threshold, data based on the plurality of packets is input to a second model different from the first model to perform estimation. A control method comprising:

12. An information processing device acquiring means for acquiring a plurality of packets transmitted and received by the information processing device; an estimation means for estimating a usage environment of the information processing device by inputting data based on the acquired plurality of packets into a model; A program for functioning as The estimation means If the number of the acquired plurality of packets is equal to or greater than a threshold, data based on the acquired plurality of packets is input to a first model to perform estimation; If the number of the acquired plurality of packets is less than the threshold, data based on the plurality of packets is input to a second model different from the first model to perform estimation. A program characterized by:

Images