Information processor, information processing method, and program

Abstract

To provide an information processor, an information processing method, and a program for detecting an abnormality in a user at an early stage with less effort and without omission.SOLUTION: In an information processor, history information acquisition means 101 acquires history information of a first user terminal, including an amount of input operation performed on the first user terminal used by a user. Determination means 102 determines, on the basis of the history information, whether or not there is an abnormality in the user. Notification means 103 notifies a result of the determination by the determination means 102.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] Various efforts are being made to detect early signs of abnormalities in people, such as being bullied, having physical or mental health problems, or being involved in some kind of trouble, and early detection is considered to be an important issue.

[0003] Patent Document 1 discloses a technology for estimating a user's attention function and stress by acquiring a device log from a communication device carried by the user and inputting the acquired device log into an estimation model. Examples of the device log include sensor values ​​from an acceleration sensor, angular velocity sensor, tilt sensor, etc., operation history such as app launch history, time period Wi-Fi connection on information, and observed Wi-Fi access destination information. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2020-201751 Summary of the Invention [Problem to be solved by the invention]

[0005] Patent Document 1 is a technology that estimates a user's attention function and stress level based mainly on sensor values ​​such as an acceleration sensor, an angular velocity sensor, and an inclination sensor. However, there are cases where abnormalities in the user of a terminal cannot be detected using only these sensor values.

[0006] Therefore, an object of the present disclosure is to provide a technology that can detect abnormalities in a terminal user. [Means for solving the problem]

[0007] a history information acquisition means for acquiring history information of the first user terminal, including the amount of input operation performed on the first user terminal by the user; a determination means for determining whether or not there is any abnormality in the user based on the history information; a notification means for notifying a result of the determination by the determination means; Including, An information processing device is provided.

[0008] The computer, acquiring history information of the first user terminal, including the amount of input operation performed on the first user terminal used by the user; determining whether or not there is any abnormality in the user based on the history information; Notify the judgement result, A method for processing information is provided.

[0009] Computer, a history information acquisition means for acquiring history information of the first user terminal, including the amount of input operation performed on the first user terminal by the user; a determination means for determining whether or not there is any abnormality in the user based on the history information; a notification means for notifying a result of the determination by the determination means; To function as, Programs are offered. [Effects of the Invention]

[0010] According to the present disclosure, abnormalities in users can be detected early and with less effort and without oversight. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram of an information processing device. [Figure 2] FIG. 1 is a configuration diagram of an information processing system. [Figure 3] FIG. 1 is a block diagram of an information processing device. [Figure 4]FIG. 10 is a diagram illustrating an example of a notification screen. [Figure 5] FIG. 1 is a sequence diagram of an information processing system. DETAILED DESCRIPTION OF THE INVENTION

[0012] (Summary of the Disclosure) 1 is a block diagram of an information processing device 100. As shown in FIG. 1, the information processing device 100 includes a history information acquisition unit 101, a determination unit 102, and a notification unit 103.

[0013] The history information acquisition means 101 acquires history information of the first user terminal, including the amount of input operation performed on the first user terminal used by the user.

[0014] The determining means 102 determines whether or not there is something unusual about the user based on the history information.

[0015] The notification means 103 notifies the result of the determination made by the determination means 102 .

[0016] According to the above configuration, abnormalities in the user can be detected early and with less effort and without overlooking anything.

[0017] (First embodiment) A first embodiment of the present disclosure will be described below.

[0018] Various efforts are being made to detect early signs of abnormalities in people, such as being bullied, having physical or mental health problems, or being involved in some kind of trouble, and early detection is considered to be an important issue.

[0019] The first approach involves school staff (teachers, principals), caregivers (school social workers, school counselors, etc.), and parents visually observing and talking to children to understand their behavior. The second approach involves distributing surveys about bullying and having children fill them out to understand the situation. The third approach involves understanding the situation through surveys of living conditions (questionnaire format) conducted at school and changes in grades on report cards.

[0020] However, the first, second, and third initiatives mentioned above have the following challenges:

[0021] In the first approach, due to limited manpower, it is difficult to find the time to monitor each child individually, and there are individual differences in the ability to monitor them. School teachers are busy with their daily work, and their experience and skills vary. Even when caregivers are assigned to schools, the number of such caregivers is far from sufficient. Furthermore, parents are busy with work and housework, and may not pay much attention to their children.

[0022] The second initiative involves surveys, but surveys do not always provide an accurate picture of bullying, etc. Also, children tend to hide the fact that they are being bullied or have some other problem from those around them, so they may not write their true feelings in the surveys.

[0023] Regarding the third initiative, living situation surveys and report cards are only conducted a few times a year, which is not sufficient for early detection in real time (daily, weekly, monthly, etc.).

[0024] However, these efforts are unable to detect abnormalities in users early on with less effort and without overlooking anything.

[0025] Fig. 2 is a configuration diagram of an information processing system 1. As shown in Fig. 2, the information processing system 1 includes an information processing device 2, a plurality of user terminals 3, and a plurality of user terminals 4. The plurality of user terminals 3 are a specific example of a first user terminal. The plurality of user terminals 4 are a specific example of a second user terminal.

[0026] The multiple user terminals 3 are terminals used by multiple users U3, respectively. User U3 is one specific example of a user. Specifically, the multiple user terminals 3 include user terminal 3a, user terminal 3b, user terminal 3c, and user terminal 3d. The multiple users U3 include user U3a, user U3b, user U3c, and user U3d. User terminal 3a is the terminal used by user U3a. User terminal 3b is the terminal used by user U3b. User terminal 3c is the terminal used by user U3c. User terminal 3d is the terminal used by user U3d. The multiple users U3 typically belong to the same class G (group) in an educational facility such as an elementary school or a junior high school. Hereinafter, user terminal 3a, user terminal 3b, user terminal 3c, and user terminal 3d will sometimes be simply referred to as user terminals 3, and user U3a, user U3b, user U3c, and user U3d will sometimes be simply referred to as user U3. The plurality of user terminals 3 are typically laptop personal computers, but may alternatively be desktop personal computers, tablet terminals, or smartphones.

[0027] The multiple user terminals 4 are terminals used by multiple users U4, respectively. Specifically, the multiple user terminals 4 include user terminal 4a, user terminal 4b, user terminal 4c, and user terminal 4d. The multiple users U4 include user U4a, user U4b, user U4c, and user U4d. User terminal 4a is a terminal used by user U4a. User terminal 4b is a terminal used by user U4b. User terminal 4c is a terminal used by user U4c. User terminal 4d is a terminal used by user U4d. The multiple users U4 are personnel who care for user U3 when something unusual happens to user U3, and are typically, but not limited to, the teacher in charge of class G, other teachers, the principal, a school social worker, or a school counselor. Hereinafter, user terminal 4a, user terminal 4b, user terminal 4c, and user terminal 4d may be simply referred to as user terminal 4, and user U4a, user U4b, user U4c, and user U4d may be simply referred to as user U4. The multiple user terminals 4 are typically laptop personal computers. However, instead, the multiple user terminals 4 may be desktop personal computers, tablet terminals, or smartphones.

[0028] The user terminal 3 and the user terminal 4 typically communicate with the information processing device 2 via a LAN (Local Area Network) or a WAN (Wide Area Network). While the user terminal 3 is attending school at the educational facility, the user terminal 3 communicates with the information processing device 2 via the LAN. Similarly, while the user terminal 4 is attending work at the educational facility, the user terminal 4 communicates with the information processing device 2 via the LAN.

[0029] The information processing device 2 determines whether or not there is something unusual about the user U3 who uses the user terminal 3 based on the log of the user terminal 3, and notifies the user terminal 4 of the determination result. An abnormality in the user U3 means that the user U3 is being bullied, has physical or mental health problems, or is involved in some kind of trouble. Upon receiving the notification, the user U4 takes the necessary measures to care for the user U3.

[0030] FIG. 3 shows a block diagram of the information processing device 2. As shown in FIG. 3, the information processing device 2 includes a processor 2a, a memory 2b, and a communication interface 2c. The processor 2a communicates with multiple user terminals 3 and 4 via the communication interface 2c. The processor 2a reads and executes a program stored in the memory 2b. As a result, the program causes hardware such as the processor 2a to function as a log acquisition unit 10, an electronic file access management unit 11, a determination unit 12, a notification unit 13, a setting unit 14, an anomaly information acquisition unit 15, and a learning unit 16. The information processing device 2 may be configured as a single device, or may be realized by distributed processing using multiple devices.

[0031] The memory 2b is realized by a ROM (Read Only Memory), a RAM (Random Access Memory), a HDD (Hard Disc Drive), or an SSD (Solid State Drive). As the processor 2a executes processing according to a program, a log DB 20, an electronic file DB 21 (electronic file storage means), an incident information DB 22, and a model storage unit 23 are constructed in the memory 2b.

[0032] The log acquisition unit 10 acquires logs from multiple user terminals 3. A log is a specific example of history information. Agent software is pre-installed on each user terminal 3. The agent software uploads the log of the user terminal 3 to the information processing device 2. The log acquisition unit 10 associates the logs acquired from multiple user terminals 3 with the corresponding user U3 and stores them in the log DB 20. In this embodiment, the log is composed of the following data (1) to (10), but is not limited to these.

[0033] (1) Amount of input operation The log includes the amount of input operations. Input operations refer to the number of keyboard strokes on the corresponding user terminal 3, the number of mouse clicks on the corresponding user terminal 3, the number of touches on the touch panel of the corresponding user terminal 3, and other input operations. The log acquisition unit 10 typically aggregates the amount of input operations daily, associates it with the corresponding user U3, and stores it in the log DB 20. It can be said that this amount of operation is correlated with "declining motivation," which is one example of a sign of bullying. Declining motivation can mean, for example, a decrease in the amount of daily studying, a decrease in concentration, and a decrease in conversation. (2) Usage time of learning applications The log includes the usage time of the learning application. The log acquisition unit 10 typically tally the usage time of the learning application daily and store it in the log DB 20 in association with the corresponding user U3. This usage time can be said to be correlated with "declining motivation," which is an example of a sign of bullying. (3) Number of comments made on the chat application during the study The log includes the number of comments made on the chat application during the study. The log acquisition unit 10 typically tally the number of comments daily and store them in the log DB 20 in association with the corresponding user U3. It can be said that the number of comments correlates with "declining motivation," which is an example of a sign of bullying. (4) Start time of input operation The log includes the start time of the input operation. The start time of the input operation means the first time in a day that the user terminal 3 is turned on, or the first time in a day that the user terminal 3 returns from sleep mode, standby mode, or hibernation mode. The log acquisition unit 10 associates the start time of the input operation with the corresponding user U3 and stores it in the log DB 20. This start time can be said to be correlated with "deteriorating health," which is an example of a sign of bullying. Deteriorating health specifically means increasing lateness to school or absenteeism. (5) Destination network The log includes the destination network. The destination network typically refers to the access point name. The log acquisition unit 10 associates the destination network with the corresponding user U3 and stores it in the log DB 20. If the user terminal 3 is connected to an access point installed in an educational facility, it means that the user U3 for the user terminal 3 is at the educational facility, i.e., attending school. Therefore, it can be said that this destination network is related to "declining health," which is an example of a sign of bullying. By combining the log of the destination network and the log of the start time of the input operation, it is possible to determine the time when the corresponding user U3 arrived at school. (6) Number of comments made on chat applications after school or at home The log includes the number of times a user makes a comment on a chat application after school or at home. The log acquisition unit 10 typically tally the number of comments daily and store them in the log DB 20 in association with the corresponding user U3. The number of comments can be said to be correlated with "deterioration in friendships," which is an example of a sign of bullying. Deterioration in friendships specifically means less conversation with friends. (7) Contents of statements made on chat applications The log includes the content of comments made on the chat application. The log acquisition unit 10 typically associates the content of comments made on the chat application with the corresponding user U3 and stores them in the log DB 20. The content of comments made on the chat application can be considered to be related to "traces of harassment," which is an example of a sign of bullying. That is, if abusive comments are made in a chat between the user U3 and another person, or if abusive comments are found in combination with the user U3's name in a chat group in which the user U3 is not present, it is considered that harassment against the user U3 is occurring. Note that instead of acquiring a log of comments from the user U3's user terminal 3, the log acquisition unit 10 may acquire a log of comments from another user terminal 3 or from an external server providing a chat service. Specifically, signs of harassment include tampering with the user U3's belongings or constant concern about the user U3. (8) Number of online file accesses and sources of access The log includes the number of accesses and the source of the accesses to the online file (electronic file) stored in the electronic file DB21. Alternatively, if the online file (electronic file) exists on another device, the log includes the number of accesses to the online file, the source of the accesses, and information about the owner. The log acquisition unit 10 typically stores the number of accesses and the source of the accesses to the online file in the log DB20 in association with user U3, the owner of the online file. The number of accesses and the source of the accesses to the online file can be said to be related to "traces of harassment," which is an example of a sign of bullying. In other words, if the number of posts from a specific user U3 to the online file increases from a certain point in time, it can be assumed that harassment from that specific user U3 is occurring. (9) Device usage time during nighttime hours The log includes the terminal usage time during the nighttime hours. The log acquisition unit 10 typically tally the terminal usage time during the nighttime hours daily and store it in the log DB 20 in association with the corresponding user U3. It can be said that this terminal usage time during the nighttime hours is correlated with "suspicious behavior," which is an example of a sign of bullying. Specifically, suspicious behavior is having trouble falling asleep or staying locked in one's room. In other words, if the terminal usage time during the nighttime hours increases, it can be assumed that the person is having trouble falling asleep. (10) Website access history and search terms The log includes website access history and search terms. The log acquisition unit 10 typically associates the website access history and search terms with the corresponding user U3 and stores them in the log DB 20. This website access history and search terms can be said to be correlated with "suspicious behavior," which is an example of a sign of bullying. In other words, if the user accesses a harmful website or searches using dangerous terms, it is likely that the user is holed up in their room.

[0034] The electronic file access management unit 11 generates a log relating to the number of accesses and the source of the accesses to the online file (8) above by monitoring accesses to the electronic file DB 21. Alternatively, if the online file (electronic file) exists on another device, the log acquisition unit 10 acquires a log including the number of accesses, the source of the access, and information on the owner of the online file from the user terminal 3, and stores it in the log DB 20.

[0035] The determination unit 12 determines whether or not there is an abnormality for each of the multiple users U3 based on the logs. Here, whether or not there is an abnormality for user U3 also includes the possibility of an abnormality for user U3. The determination unit 12 may first calculate an abnormality score for each user U3 based on the logs and determine whether or not there is an abnormality for user U3 based on the abnormality score. Second, the determination unit 12 may determine whether or not there is an abnormality for user U3 by comparing various parameters contained in the logs for each user U3 with some threshold value. Third, the determination unit 12 may determine whether or not there is an abnormality for user U3 by inputting various parameters contained in the logs into a determination model stored in the model storage unit 23. Typically, the first or second determination method is adopted in the initial operation of the information processing system 1, and is switched to the third determination method when learning of the determination model has progressed to a certain extent.

[0036] <First Judgment Method> When calculating an anomaly score based on the log and determining whether or not there is an anomaly in the user U3 based on this anomaly score, the determination unit 12 calculates the anomaly score, for example, using the following procedure: If the anomaly score exceeds a predetermined value, the determination unit 12 determines that there is an anomaly in the user U3, and if the anomaly score is below the predetermined value, the determination unit 12 determines that there is no anomaly in the user U3.

[0037] In relation to the above-mentioned (1), the determination unit 12 weekly aggregates the amount of input operations aggregated daily, and adds the value obtained by multiplying the ratio of the weekly aggregated amount of operation to the previous week by a predetermined weighting coefficient to the anomaly score. Monthly aggregation may be used instead of weekly aggregation. Furthermore, the determination unit 12 may multiply the difference between the weekly aggregated amount of operation and the average value of the weekly aggregated amount of operation in class G to which the user belongs by a predetermined weighting coefficient to the anomaly score. The average value of the weekly aggregated amount of operation in class G means the average value of the weekly aggregated amount of operation for each of multiple users U3 belonging to class G. In this case, the determination unit 12 sets the weighting coefficient so that the anomaly score is increased when the amount of input operations is less than usual or less than the average value for class G.

[0038] Furthermore, in relation to the above-mentioned (2), the determination unit 12 weekly aggregates the usage time of the learning application aggregated daily, and adds the value obtained by multiplying the ratio of the weekly aggregated usage time to the previous week by a predetermined weighting coefficient to the anomaly score. Monthly aggregation may be used instead of weekly aggregation. Furthermore, the determination unit 12 may multiply the difference between the weekly aggregated usage time and the average weekly aggregated usage time in class G to which the user belongs by a predetermined weighting coefficient to the anomaly score, and add the result to the anomaly score. In this case, the determination unit 12 sets the weighting coefficient so that the anomaly score increases when the usage time decreases.

[0039] Furthermore, in relation to the above-mentioned (3), the determination unit 12 weekly aggregates the number of comments aggregated daily, and adds the value obtained by multiplying the weekly aggregated ratio of usage time to the previous week by a predetermined weighting coefficient to the anomaly score. Monthly aggregation may be used instead of weekly aggregation. Furthermore, the determination unit 12 may add the value obtained by multiplying the difference between the weekly aggregated number of comments and the average number of weekly aggregated comments in class G to which the person belongs by a predetermined weighting coefficient to the anomaly score. In this case, the determination unit 12 sets the weighting coefficient so that the anomaly score increases when the number of comments decreases.

[0040] In addition, in relation to the above (4) and (5), the determination unit 12 estimates the person's school arrival time based on the start time of the input operation and the connected network, aggregates the school arrival times weekly, and adds the value obtained by multiplying the weekly aggregated school arrival time compared to the previous week by a predetermined weighting coefficient to the abnormality score. Monthly aggregation may be used instead of weekly aggregation. Furthermore, the determination unit 12 may add the value obtained by multiplying the difference between the weekly aggregated school arrival time and the average weekly aggregated school arrival time for class G to which the person belongs by a predetermined weighting coefficient to the abnormality score. In this case, the determination unit 12 sets the weighting coefficient so that the abnormality score increases if the school arrival time is later than before.

[0041] In addition, in relation to the above-mentioned (5), the determination unit 12 determines whether the person attended school or was absent based on the connected network, calculates the number of days absent on a weekly basis, and adds the result obtained by multiplying the ratio of the weekly calculated number of days absent to the previous week by a predetermined weighting coefficient to the abnormality score. Monthly calculations may be used instead of weekly calculations. In this case, the determination unit 12 sets the weighting coefficient so that the abnormality score increases if the number of days absent becomes more than before.

[0042] In addition, in relation to the above-mentioned (6), the determination unit 12 weekly tallies the number of comments made on a chat application after school or at home, and adds a value obtained by multiplying the weekly total number of comments compared to the previous week by a predetermined weighting coefficient to the anomaly score. Monthly tallies may be used instead of weekly tallies. In this case, the determination unit 12 sets a weighting coefficient so that the anomaly score increases when the number of comments becomes less than before.

[0043] In addition, in relation to the above-mentioned (7), the determination unit 12 extracts negative comments from the content of comments made on the chat application using natural language processing, counts the number of extracted comments on a weekly basis, and adds the predetermined value to the anomaly score when the weekly counted number of extracted comments exceeds a predetermined value. Monthly counting may be adopted instead of weekly counting.

[0044] In addition, in relation to (8) above, if the number of posts from a specific user U3 increases from a certain point in time, the judgment unit 12 determines that harassment from that specific user U3 is occurring and adds a predetermined value to the abnormality score.

[0045] In addition, in relation to the above-mentioned (9), the determination unit 12 performs a weekly aggregation of the nighttime terminal usage time aggregated daily, and adds a value obtained by multiplying the ratio of the weekly aggregated nighttime terminal usage time to the previous week by a predetermined weighting coefficient to the anomaly score. Monthly aggregation may be used instead of weekly aggregation. In this case, the determination unit 12 sets a weighting coefficient so that the anomaly score increases when the nighttime terminal usage time increases.

[0046] In addition, in relation to (10) above, if the person accesses a harmful website or performs a search using a dangerous word, the judgment unit 12 determines that the person has locked themselves in a room and adds a predetermined value to the anomaly score.

[0047] The weighting coefficients used by the determination unit 12 may be changeable as appropriate based on input from the user U4.

[0048] <Second judgment method> In the second determination method, the determination unit 12 focuses on a characteristic change in the behavior of the user U3 and determines whether or not something unusual has happened to the user U3.

[0049] As a first change, if user U3 has become less likely to study or have lost concentration than before, the determination unit 12 determines that something is wrong with user U3. Specifically, for example, if the amount of input operation has decreased by less than 50% compared to the previous month or month, and the average value of the operation amount for class G has fluctuated by approximately plus or minus 10% compared to the previous week or month, the determination unit 12 determines that something is wrong with user U3. By taking into account the fluctuations in the average value of the operation amount for class G in this way, it is possible to prevent erroneous detection of an abnormality in user U3, for example, if all users U3 belonging to class G have not used their user terminals 3 for a certain period of time due to a class closure, etc.

[0050] As a second change, if user U3 becomes more frequently late than before, the determination unit 12 determines that something is wrong with user U3. Specifically, for example, if user U3's school arrival time, calculated based on the start time of the input operation and the connected network, becomes 15 minutes or more later than the previous month or month, the determination unit 12 determines that something is wrong with user U3. The determination unit 12 may also determine that something is wrong with user U3 if user U3's school arrival time becomes 15 minutes or more later than the previous month or month and the average school arrival time for class G fluctuates by approximately plus or minus 10% compared to the previous week or month. By taking into account fluctuations in the average school arrival time for class G in this way, it is possible to prevent false detection of an abnormality in user U3, for example, if all users U3 belonging to class G have not attended school for a certain period of time due to a class closure or the like.

[0051] The determination unit 12 may determine whether or not there is an abnormality in user U3 by focusing on only one of the first change and the second change, or by combining them as appropriate. For example, the determination unit 12 may determine whether or not there is an abnormality in user U3 by focusing on only the first change, or may determine whether or not there is an abnormality in user U3 by focusing on only the second change. Furthermore, the determination unit 12 may determine whether or not there is an abnormality in user U3 when it determines that there is an abnormality in user U3 by focusing on the first change and also determines that there is an abnormality in user U3 by focusing on the second change.

[0052] The notification unit 13 notifies the user terminal 4 of the determination result by the determination unit 12. As a result, a notification screen such as that shown in FIG. 4 is displayed on the display device of the user terminal 4. As shown in FIG. 4, the notification by the notification unit 13 may include the name of the class G to which the user U3 belongs, the user U3's name, the type of notification, the detection pattern, and the detection content. The detection pattern is a pattern related to an abnormality in the user U3, and corresponds to one of motivation, health, friendships, and suspicious behavior. The user terminal 4 presents the basis for the abnormality determination for each detection pattern as the detection content. The notification screen includes a check box 29 for confirming that the notification screen has been viewed. When the check box 29 is checked, the user terminal 4 notifies the information processing device 2 that the user U4 has viewed the notification screen. If the notification unit 13 of the information processing device 2 does not receive a notification from the user terminal 4 that the notification screen has been viewed within a predetermined period after notifying the user terminal 4 of the determination result by the determination unit 12, the notification unit 13 of the information processing device 2 may instruct the user U4 to view the notification screen via the user terminal 4. The notification screen also has an input means 30, typically in a pull-down format, for inputting the judgment result of whether or not user U4 has actually changed as a result of interviewing user U3. The input means 30 of this embodiment is configured to allow input of only the presence or absence of a change in user U3. However, instead of this, the input means 30 may be configured to allow input of a multi-level evaluation of the presence or absence of a change in user U3. The multi-level evaluation typically involves evaluation using a numerical value between 0 and 100%. The notification screen also has a judgment result transmission button 31 as a trigger for transmitting the judgment result to the information processing device 2. The user terminal 4 transmits the judgment result to the information processing device 2 as change information.

[0053] The setting unit 14 sets the notification destination of the determination result of whether or not there is an abnormality for the user U3 based on the input of the user U3. For example, the setting unit 14 transmits a setting screen for setting the notification destination of the determination result to the user terminal 3. The user terminal 3 displays the setting screen on a display device. The user U3 sets the notification destination of the determination result on the setting screen. The user U3 selects one of multiple users U4 as the notification destination of the determination result. The user U3 may also select himself / herself as the notification destination of the determination result. The user U3 may also set multiple notification destinations. In this case, the user U3 may set the notification order of the multiple notification destinations. For example, the user U3 may select himself / herself and one of the users U4 in this order. In this case, the notification unit 13 first transmits the determination result to the user terminal 3 of the user U3, and after the user U3 confirms the notification content and obtains the user U3's approval, the notification unit 13 transmits the determination result to the user U4. This is because if the bullying against user U3 is the homeroom teacher of user U3, the abnormal behavior of user U3 may not be resolved even if the homeroom teacher is notified of the judgment result.

[0054] The incident information acquisition unit 15 acquires incident information from the user terminal 4, associates the incident information with the corresponding user U3, and stores the incident information in the incident information DB 22. As described above, the incident information indicates the result of a determination made by the user U4 as to whether or not there is an incident with the corresponding user U3.

[0055] The learning unit 16 executes a learning process to optimize the neural network so that, when a log is input, it outputs whether or not an abnormality has occurred for user U3, using as training data the logs stored in the log DB 20 and the abnormality information acquired by the abnormality information acquisition unit 15. In this way, the learning unit 16 generates a determination model and stores the generated determination model in the model storage unit 23.

[0056] Next, a control flow of the information processing system 1 will be described with reference to Fig. 5. Fig. 5 is a sequence diagram of the information processing system 1.

[0057] First, the user terminal 3 transmits a log to the information processing device 2 (S100). The log acquisition unit 10 of the information processing device 2 receives the log from the user terminal 3 (S100). Next, the determination unit 12 determines whether or not something unusual has happened to the user U3 based on the log acquired from the user terminal 3 (S110). Next, the notification unit 13 notifies the user terminal 4 of the determination result by the determination unit 12 (S120). The user terminal 4 displays the notification screen shown in FIG. 4 on the display device based on the determination result received from the notification unit 13 (S130). After checking the notification screen, the user U4 interviews the user U3 and determines whether or not something unusual has actually happened to the user U3 (S140). The user U4 inputs the determination result on the notification screen of the user terminal 4 (S150). The user terminal 4 transmits the input determination result to the information processing device 2 as abnormality information (S160). The incident information acquisition unit 15 of the information processing device 2 receives incident information from the user terminal 4 (S160). If the user U4 determines that there is actually something wrong with the user U3, the user U4 implements the necessary incident care (S170). For example, if the incident is caused by bullying, the user U4 executes a predetermined process for dealing with the bullying (S170). On the other hand, if the incident is caused by something other than bullying, such as family problems, illness, or studying, the user U4 collaborates with other users U4 to try to resolve the incident (S170).

[0058] The learning unit 16 generates a determination model by performing learning using the log acquired by the log acquisition unit 10 and the incident information acquired by the incident information acquisition unit 15 as training data (S180).

[0059] When the judgment model is completed to a certain extent, the judgment unit 12 inputs the logs acquired by the log acquisition unit 10 (S190) into the judgment model, and judges whether or not there is any abnormality in the user U3 based on the output of the judgment model (S200). The notification unit 13 notifies the user terminal 4 of the judgment result (S210), similar to step S120.

[0060] The first embodiment has been described above. The first embodiment has the following features.

[0061] The information processing device 2 includes a log acquisition unit 10 (history information acquisition means), a determination unit 12 (determination means), and a notification unit 13 (notification means). The log acquisition unit 10 acquires a log (history information) of the user terminal 3 (first user terminal) used by the user U3 (user), including the amount of input operations performed on the user terminal 3. The determination unit 12 determines whether or not there is anything unusual about the user U3 based on the log. The notification unit 13 notifies the user of the determination result by the determination unit 12. With the above configuration, any abnormality in the user U3 can be detected early and with less effort, without oversight.

[0062] Furthermore, the determination unit 12 determines whether or not there has been any abnormality in user U3 by comparing the log of user U3 with the logs of other users who belong to the same group as user U3. Specifically, the determination unit 12 determines whether or not there has been any abnormality in user U3 by comparing the log of user U3 with the average value of the logs of other users who belong to the same group as user U3. With the above configuration, it is possible to prevent false detection of an abnormality in user U3 when logs fluctuate across the entire group.

[0063] Furthermore, the determination unit 12 aggregates the amount of operation for each predetermined period and determines whether or not there is something unusual about the user U3 based on the change in the amount of operation for each predetermined period. With the above configuration, it is possible to effectively detect a decline in motivation of the user U3.

[0064] The log also includes the start time of the input operation to the user terminal 3. According to the above configuration, the deterioration of the health of the user U3 can be effectively detected.

[0065] The log also includes the network to which the user terminal 3 is connected. With the above configuration, it is possible to effectively capture that the user terminal 3 has come to school.

[0066] The information processing device 2 further includes a setting unit 14 (setting means) that sets the notification destination of the determination result based on an input from the user U3. According to the above configuration, the user U3 can freely set the notification destination of the determination result.

[0067] The information processing device 2 also includes an incident information acquisition unit 15 (incident information acquisition means) that acquires incident information indicating whether or not an incident has occurred in user U3 from the user terminal 4, which is the recipient of the determination result, and a learning unit 16 (learning means) that generates a determination model by learning the log and the incident information as training data. The determination unit 12 determines whether or not an incident has occurred in user U3 by inputting the log into the determination model. With the above configuration, it is possible to accurately determine whether or not an incident has occurred in user U3, without requiring user U4 to increase or decrease the weighting coefficient used by the determination unit 12.

[0068] The first embodiment has been described above, but the first embodiment can be modified as follows.

[0069] For example, the learning unit 16 may generate new training data by referring to bullying case data and knowledge data, and retrain the determination model using the training data.

[0070] In addition, the judgment unit 12 may obtain test score data and grade data for each subject for user U3 from the school administration system, and further take into account fluctuations in the score data and grade data to determine whether or not there is anything unusual about user U3.

[0071] The determination unit 12 may also acquire information about the family situation of user U3 from a local government welfare information system and determine whether there is any change in user U3 by taking into account any changes in the family situation. Examples of changes in family situation include when the family becomes a single parent or when the user begins receiving welfare benefits.

[0072] Furthermore, the notification unit 13 may change the notification destination depending on the degree of abnormality of the user U3. For example, if the degree of abnormality of the user U3 is mild, the determination result may be notified to one of the multiple user terminals 4, whereas if the degree of abnormality of the user U3 is severe, the determination result may be notified to all of the multiple user terminals 4.

[0073] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure.

[0074] Each drawing is merely an example for describing one or more embodiments. Each drawing may relate not only to one particular embodiment, but also to one or more other embodiments. As will be understood by those skilled in the art, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings to create, for example, an embodiment not explicitly shown or described. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0075] In the above examples, the program can be stored and supplied to a computer using various types of non-transitory computer-readable media. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives) and magneto-optical recording media (e.g., magneto-optical disks). Further examples of non-transitory computer-readable media include CD-ROM (Read Only Memory), CD-R, CD-R / W, and semiconductor memory (e.g., mask ROM). Further examples of non-transitory computer-readable media include PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, and RAM (Random Access Memory). The program may also be supplied to a computer by various types of transitory computer-readable media. Examples of transitory computer-readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire or an optical fiber, or via a wireless communication path.

[0076] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.

[0077] (Appendix 1) a history information acquisition means for acquiring history information of the first user terminal, including the amount of input operation performed on the first user terminal by the user; a determination means for determining whether or not there is any abnormality in the user based on the history information; a notification means for notifying a result of the determination by the determination means; Including, Information processing device. (Appendix 2) 10. The information processing device according to claim 1, the determination means determines whether or not there is any abnormality in the user by comparing the history information of the user with the history information of other users who belong to the same group as the user; Information processing device. (Appendix 3) 10. The information processing device according to claim 1, the determining means aggregates the operation amounts for each predetermined period and determines whether or not there is an abnormality in the user based on a change in the operation amounts for each predetermined period. Information processing device. (Appendix 4) 10. The information processing device according to claim 1, the history information further includes a start time of an input operation on the first user terminal; Information processing device. (Appendix 5) 10. The information processing device according to claim 1, The history information further includes a network to which the first user terminal is connected. Information processing device. (Appendix 6) 10. The information processing device according to claim 1, further comprising a setting unit for setting a notification destination of the determination result based on an input from the user; Information processing device. (Appendix 7) 10. The information processing device according to claim 1, an incident information acquisition means for acquiring incident information indicating whether or not an incident has occurred in the user from the notification destination of the determination result; a learning means for generating a determination model by learning the history information and the abnormality information as training data; Further comprising: the determination means determines whether or not there is an abnormality in the user by inputting the history information into the determination model; Information processing device. (Appendix 8) 10. The information processing device according to claim 1, the history information further includes a start time of the input operation on the first user terminal and a connection destination network of the first user terminal; the determining means estimates the time when the user will arrive at school based on the start time and the destination network, and determines whether or not there is something unusual about the user, taking the time when the user will arrive at school into consideration. Information processing device. (Appendix 9) 10. The information processing device according to claim 1, the notification means notifies the user and then notifies other users; Information processing device. (Appendix 10) 10. The information processing device according to claim 1, the notification means changes the notification destination depending on the degree of abnormality of the user. Information processing device. (Appendix 11) 10. The information processing device according to claim 1, further comprising an electronic file storage means for storing the electronic files of the users; The determination means further determines whether or not there is any abnormality with the user based on the account that accessed the electronic file or the number of accesses. Information processing device. (Appendix 12) The computer, acquiring history information of the first user terminal, including the amount of input operation performed on the first user terminal used by the user; determining whether or not there is any abnormality in the user based on the history information; Notify the judgement result, Information processing methods. (Appendix 13) Computer, a history information acquisition means for acquiring history information of the first user terminal, including the amount of input operation performed on the first user terminal by the user; a determination means for determining whether or not there is any abnormality in the user based on the history information; a notification means for notifying a result of the determination by the determination means; To function as, program.

[0078] Some or all of the elements (e.g., configurations and functions) described in Supplementary Notes 2 to 11 that are dependent on Supplementary Notes 1 may also be dependent on Supplementary Notes 12 to 13 in the same dependent relationship as Supplementary Notes 2 to 11. Some or all of the elements described in any Supplementary Note may be applied to various hardware, software, recording means for recording software, systems, and methods. [Explanation of symbols]

[0079] 1. Information Processing Systems 2. Information processing equipment 3. User terminal 4 User terminal 10 Log acquisition section 11 Electronic File Access Management Department 12 Judgment section 13 Notification Department 14 Setting section 15. Anomaly Information Acquisition Department 16 Learning Department 23 Decision Model 23 Model memory section 29 Checkboxes 30 Input Methods 31. Submit judgment result button G-Class U3 users U4 users 20 Log DB 21 Electronic File Database 22. Incident Information DB

Claims

1. a history information acquisition means for acquiring history information of the first user terminal, including an amount of input operation performed on the first user terminal by the user; a determination means for determining whether or not there is any abnormality in the user based on the history information; notification means for notifying a result of the determination by the determination means; Including, Information processing device.

2. 2. The information processing device according to claim 1, the determination means determines whether or not there is any abnormality in the user by comparing the history information of the user with the history information of other users who belong to the same group as the user; Information processing device.

3. 2. The information processing device according to claim 1, the determining means aggregates the operation amounts for each predetermined period and determines whether or not there is an abnormality in the user based on a change in the operation amounts for each predetermined period. Information processing device.

4. 2. The information processing device according to claim 1, the history information further includes a start time of an input operation on the first user terminal; Information processing device.

5. 2. The information processing device according to claim 1, The history information further includes a connection destination network of the first user terminal. Information processing device.

6. 2. The information processing device according to claim 1, further comprising a setting unit for setting a notification destination of the determination result based on an input from the user; Information processing device.

7. 2. The information processing device according to claim 1, an incident information acquisition means for acquiring incident information indicating whether or not an incident has occurred in the user from the notification destination of the determination result; a learning means for generating a determination model by learning the history information and the abnormality information as training data; Further comprising: the determination means determines whether or not there is an abnormality in the user by inputting the history information into the determination model; Information processing device.

8. 2. The information processing device according to claim 1, the history information further includes a start time of an input operation on the first user terminal and a connection destination network of the first user terminal; the determining means estimates the time when the user will arrive at school based on the start time and the destination network, and determines whether or not there is something unusual about the user, taking the time when the user will arrive at school into consideration. Information processing device.

9. The computer acquiring history information of the first user terminal, including the amount of input operation performed on the first user terminal used by the user; determining whether or not there is any abnormality in the user based on the history information; Notify the judgement result, Information processing methods.

10. Computer, a history information acquisition means for acquiring history information of the first user terminal, including an amount of input operation performed on the first user terminal by the user; a determination means for determining whether or not there is any abnormality in the user based on the history information; notification means for notifying a result of the determination by the determination means; To function as, program.

Images