Information processing device

Abstract

To make it possible to present an estimated apparatus usage environment and support appropriate settings for security measures.SOLUTION: An information processing device acquires feature information of communication performed by a first apparatus, estimates the usage environment of the first apparatus based on a trained model generated by performing machine learning based on feature information of communication performed by a plurality of second apparatuses and setting information on the usage environment set in the second apparatuses, and the acquired feature information of communication related to the first apparatus, and notifies the estimated usage environment of the first apparatus.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device. [Background technology]

[0002] As a security measure, it is necessary for the various security-related functions of information devices to be properly configured. If an information device is used in a single, fixed environment, by applying settings tailored to that single environment at the time of shipment, users can use the information device with appropriate security measures implemented without having to be aware of anything.

[0003] For example, when we look at the usage environments of multifunction devices, they are not limited to office environments, but are now diversified to include telecommuting and use in public spaces shared by an unspecified number of people. Appropriate security settings differ depending on the usage environment, so it is necessary to configure the appropriate settings for the usage environment. Information device administrators with specialized security knowledge recognize that settings need to be changed for each usage environment, and take measures such as changing the settings to suit the usage environment before using the device.

[0004] Patent Document 1 proposes a technology that supports security policy updates by linking and managing pre-set security policies with the characteristics of network operating conditions, and detecting changes in the characteristics of network operating conditions. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2019-22099 Summary of the Invention [Problem to be solved by the invention]

[0006] Due to factors such as the increase in personally used information devices and the rise in telecommuting, there are an increasing number of cases where information devices are managed by users without specialized security knowledge. In recent years, personally managed information devices tend to have less secure measures than information devices within corporate networks that are managed by security administrators, which increases the likelihood of information devices being attacked by attackers. While it is conceivable to equip information devices with a function that assists in inputting recommended setting values ​​for security measures for each usage environment, users who are not security experts may not be able to determine which usage environment their information devices fall into. [Means for solving the problem]

[0007] The information processing device according to the present disclosure is characterized by having an acquisition means for acquiring characteristic information of communications made by a first device, a trained model generated by performing machine learning based on characteristic information of communications made by a plurality of second devices and setting information of the usage environment set on the second devices, an estimation means for estimating the usage environment of the first device based on the acquired characteristic information of the communications related to the first device, and a notification means for notifying the estimated usage environment of the first device. [Effects of the Invention]

[0008] According to the present disclosure, it is possible to present an estimated device usage environment and support appropriate settings related to security measures. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating a connection configuration between an MFP and a learning and estimation server. [Figure 2] FIG. 2 illustrates an example of the configuration of a controller unit of an MFP. [Figure 3] FIG. 10 is a diagram illustrating an example of the configuration of a learning / estimation server. [Figure 4] FIG. 2 illustrates an example of the functional configuration of a controller unit of the MFP. [Figure 5]FIG. 2 is a diagram illustrating an example of the functional configuration of a learning / estimation server. [Figure 6] FIG. 10 is a diagram showing a screen configuration related to security settings. [Figure 7] FIG. 10 is a diagram illustrating the input / output structure using a learning model. [Figure 8] FIG. 1 is a diagram illustrating the operation of a system using a learning model. [Figure 9] 10 is a flowchart illustrating an example of a data transmission process of the MFP. [Figure 10] 10 is a flowchart showing an example of a process for generating and updating a trained model in the learning and estimation server. [Figure 11] 10 is a flowchart illustrating an example of a data transmission process of the MFP. [Figure 12] 10 is a flowchart illustrating an example of processing in an estimation phase in the first embodiment. [Figure 13] 10 is a flowchart illustrating an example of processing in an estimation phase in the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0011] (First embodiment) 1 is a diagram illustrating the connection configuration of MFPs (Multi-Function Peripherals) 100, 132, 133, and 134, gateways 111 and 131, and a learning and estimation server 121 according to this embodiment. The MFPs 100 and the learning and estimation server 121 are connected via a LAN (Local Area Network) 110, the gateway 111, and the Internet 120. Similarly, the MFPs 132, 133, and 134 and the learning and estimation server 121 are connected via a LAN 130, the gateway 131, and the Internet 120.

[0012] In the following description, MFP 100 is assumed to be the MFP (MFP to be estimated) directly used by the user of interest in this embodiment, and MFPs 132, 133, and 134 are assumed to be MFPs used elsewhere by other users. Learning and estimation server 121 is a server managed by an MFP vendor and can be shared by users of the same vendor. Each of MFPs 100, 132, 133, and 134 is managed for each user. For the sake of explanation, FIG. 1 illustrates three MFPs (132, 133, and 134) as MFPs different from MFP 100 directly used by the user of interest. However, in reality, many MFPs are used and operated by many users. Furthermore, although one MFP 100 is illustrated as the MFP directly used by the user of interest, the user of interest may use multiple MFPs. Furthermore, for example, LAN 110 and gateway 111, and LAN 130 and gateway 131 are used separately for each user.

[0013] The MFP 100 has an operation unit 102 that inputs and outputs data to and from the user, a printer unit 103 that outputs electronic data to paper media, and a scanner unit 104 that reads paper media and converts it into electronic data. The operation unit 102, printer unit 103, and scanner unit 104 are connected to a controller unit 101, and function as a multifunction peripheral under the control of the controller unit 101. Although not shown in FIG. 1 for simplicity, the MFPs 132, 133, and 134 also have the controller unit 101, operation unit 102, printer unit 103, and scanner unit 104.

[0014] Gateway 111 is a network router that relays communications between MFP 100 and the Internet 120. Similarly, gateway 131 is a network router that relays communications between MFPs 132, 133, and 134 and the Internet 120. Learning and estimation server 121 collects information from MFPs 100, 132, 133, and 134 to learn trends and performs estimation processing based on requests from MFPs 100, 132, 133, and 134.

[0015] 2 is a block diagram showing an example of the configuration of the controller unit 101 of the MFP. A CPU (Central Processing Unit) 201 performs the main arithmetic processing within the controller unit 101. The CPU 201 is connected to a DRAM (Dynamic Random Access Memory) 202 via a bus. The DRAM 202 is used by the CPU 201 as a working memory for storing program data representing arithmetic instructions during the calculation process by the CPU 201 and data to be processed. The CPU 201 is connected to an I / O controller 203 via the bus. The I / O controller 203 performs input and output to and from various devices according to instructions from the CPU 201.

[0016] A SATA (Serial Advanced Technology Attachment) I / F 205 is connected to the I / O controller 203. A flash ROM (Read Only Memory) 211 is connected to the SATA I / F 205. The CPU 201 uses the flash ROM 211 to store programs and document files for realizing the functions of the MFP. A network I / F 204 is connected to the I / O controller 203. A wired LAN device 210 is connected to the network I / F 204. The CPU 201 controls the wired LAN device 210 via the network I / F 204 to realize communication on the LAN 110.

[0017] A panel I / F 206 is connected to the I / O controller 203. The CPU 201 performs input and output for the user to the operation unit 102 via the panel I / F 206. A printer I / F 207 is connected to the I / O controller 203. The CPU 201 performs output processing of paper media using the printer unit 103 via the printer I / F 207. A scanner I / F 208 is connected to the I / O controller 203. The CPU 201 performs reading processing of paper media documents using the scanner unit 104 via the scanner I / F 208.

[0018] For example, when a copy function is to be performed, the CPU 201 loads program data from the flash ROM 211 into the DRAM 202 via the SATA I / F 205. The CPU 201 detects a copy instruction from the user via the panel I / F 206 on the operation unit 102 in accordance with the program loaded into the DRAM 202. When the CPU 201 detects a copy instruction, it receives an original as image data from the scanner unit 104 via the scanner I / F 208 and stores it in the DRAM 202. The CPU 201 performs color conversion processing suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 103 via the printer I / F 207, and performs output processing onto paper media.

[0019] FIG. 3 is a block diagram showing an example configuration of a server 300 that realizes the learning / estimation server 121. A CPU 301 performs the main arithmetic processing within the server 300. The CPU 301 is connected to a DRAM 302 via a bus. The DRAM 302 is used by the CPU 301 as a working memory for storing program data representing arithmetic instructions and data to be processed during the CPU 301's calculations. The CPU 301 is connected to an I / O controller 303 via the bus. The I / O controller 303 performs input and output to and from various devices in accordance with instructions from the CPU 301. A SATA I / F 304 is connected to the I / O controller 303. A storage device 305 is connected to the SATA I / F 304. The CPU 301 uses the storage device 305 to store programs and setting values ​​for realizing various server functions. The storage device 305 is, for example, a hard disk drive (HDD) or a solid-state drive (SSD).

[0020] Thus, hardware such as the CPU 301, DRAM 302, and storage device 305 constitute a so-called computer. For the sake of explanation, this embodiment illustrates a case in which one CPU 301 uses one memory (DRAM 302) to execute each process shown in the flowcharts described below, but other configurations are also possible. For example, each process shown in the flowcharts described below can be executed by multiple processors, RAMs, and storage devices working together. Furthermore, each process can be executed using multiple server computers. The server 300 can provide the functions of a learning and estimation server to multiple different tenants by using containerization or virtualization technology.

[0021] 4 is a block diagram showing an example of a functional configuration realized by software executed by the controller unit 101 of the MFP. All software executed by the controller unit 101 is executed after the CPU 201 reads programs stored in the flash ROM 211 into the DRAM 202.

[0022] The operation control unit 401 displays a screen image for the user on the operation unit 102, detects user operations, and executes processing associated with screen components such as buttons displayed on the screen. The data storage unit 402 writes and reads data to and from the flash ROM 211 in response to requests from other control units. For example, if the user wants to change some device setting, the operation control unit 401 detects the content input by the user to the operation unit 102, and in response to a request from the operation control unit 401, the data storage unit 402 saves the content as a setting value in the flash ROM 211.

[0023] A job control unit 403 controls job execution in accordance with instructions from other control units. An image processing unit 404 processes image data into a format suitable for each application in accordance with instructions from the job control unit 403. A print processing unit 405 prints an image on a paper medium via a printer I / F 207 in accordance with instructions from the job control unit 403. A reading processing unit 406 reads an original via a scanner I / F 208 in accordance with instructions from the job control unit 403.

[0024] The network control unit 407 performs network settings such as IP addresses on the TCP / IP control unit 408 at system startup or when a setting change is detected, in accordance with the setting values ​​stored in the data storage unit 402. The TCP / IP control unit 408 performs transmission and reception processing of network packets via the network I / F 204 in accordance with instructions from other control units.

[0025] The security setting control unit 409 controls the security settings of the MFP. The security setting control unit 409 manages the correspondence between usage environments such as an internal LAN, home, or public space and the corresponding security-related setting items, and can set the corresponding security-related settings all at once when the user specifies a usage environment. The security setting control unit 409 uses the data storage unit 402 to refer to and change setting values.

[0026] The learning and estimation server communication unit 410 uses the network control unit 407 to exchange information between the learning and estimation server 121 and the MFP 100. For example, the learning and estimation server communication unit 410 instructs the network control unit 407 to transmit information such as a communication log extracted by the communication log extraction unit 411 to the learning and estimation server 121. Furthermore, for example, the learning and estimation server communication unit 410 instructs the network control unit 407 in accordance with instructions from the estimation processing unit 412 to send a request for an estimation result of the usage environment to the learning and estimation server 121 or receive an estimation result from the learning and estimation server 121.

[0027] The communication log extraction unit 411 uses the network control unit 407 to extract a communication log related to the transmission and reception of data performed by the MFP 100. For example, the communication log extraction unit 411 extracts the IP addresses of the destination and source, the TCP / UDP type, the port number, and the IP header information from the information accompanying the network packet. The extraction process by this communication log extraction unit 411 excludes the content portion of the packet, called the payload.

[0028] The estimation processing unit 412 performs estimation processing of the usage environment when a screen is displayed or when a certain period of time has passed. For example, as the estimation processing, the estimation processing unit 412 acquires the estimation result (information on the estimated usage environment) by requesting the estimation result of the usage environment from the learning / estimation server 121.

[0029] 5 is a block diagram showing an example of the functional configuration realized by software executed on the learning and estimation server 121. All software executed on the learning and estimation server 121 is executed after the CPU 301 reads a program stored in the storage device 305 into the DRAM 302.

[0030] The MFP communication unit 501 controls communication with a communicatively connected MFP. The MFP communication unit 501 stores information such as a communication log (characteristic information) received from the MFP and setting values ​​(setting information) of the usage environment in the data storage unit 502, and receives a request for an estimation result from the MFP and transmits the estimation result estimated by the estimation unit 504 to the MFP. The data storage unit 502 stores and reads data in distributed resources on the cloud in response to requests from other functional units.

[0031] The learning unit 503 generates a learned model of the tendency of the communication log for the usage environment by linking the communication log (feature information) stored in the data storage unit 502 with the setting values ​​(setting information) of the usage environment. The generated learned model is stored in the data storage unit 502. The estimation unit 504 estimates the usage environment of the MFP that requested the estimation result in response to a request for the estimation result received via the MFP communication unit 501. The estimation unit 504 estimates the usage environment based on the communication data of the MFP that requested the estimation result, which is stored in the data storage unit 502, and the generated learned model that models the tendency of the communication log for the usage environment.

[0032] 6(a) and 6(b) are diagrams showing a recommended security setting screen 601 displayed on the operation unit 102. In FIGS. 6(a) and 6(b), the usage environment internal LAN button 602 is a button for setting a series of security settings in one go that are appropriate when the usage environment of the MFP to be set is an internal LAN. The usage environment at home button 603 is a button for setting a series of security settings in one go that are appropriate when the usage environment of the MFP to be set is at home. The usage environment public space button 604 is a button for setting a series of security settings in one go that are appropriate when the usage environment of the MFP to be set is a public space. The isolated network button 605 is a button for setting a series of security settings in one go that are appropriate when the usage environment of the MFP to be set is an isolated network.

[0033] A selected usage environment display 606 displays the usage environment of the MFP set by buttons 602, 603, 604, and 605. Information on what was selected as the usage environment is saved in the data storage unit 402 when the corresponding button is pressed, along with date and time information indicating when the button was pressed. A usage environment estimation result display 607 displays the usage environment of the MFP estimated from the trends in the communication log by estimation processing using a trained model. An information display unit 608 is a display area that notifies the user of various information.

[0034] 6(a) shows a display example in which the usage environment selected using buttons 602, 603, 604, and 605 differs from the estimated usage environment. In this case, since the user's selection of security settings is likely to be inappropriate, the information display unit 608 displays a notification as shown in FIG. 6(a) to prompt the user to review the settings using the recommended security settings screen 601.

[0035] Fig. 6(b) shows an example of a display when the usage environment selected using buttons 602, 603, 604, and 605 matches the estimated usage environment. In this case, since the user's selection of security settings is likely to be appropriate, the information display unit 608 displays a notification as shown in Fig. 6(b) to inform the user that the device can be used safely.

[0036] In the above example, the MFP usage environment is shown as four patterns: in-house LAN, home, public space, and isolated network, but is not limited to these. Other patterns may be set as the MFP usage environment, or at least four patterns may be set, and a security setting button may be set according to the pattern of the usage environment.

[0037] Furthermore, in this embodiment, an example has been shown in which the usage environment of the MFP is divided into usage scenarios such as telecommuting, but it is also possible to simply provide several variations in strength such as security level 1 and security level 2. In that case, learning and estimation of the usage environment based on the communication log will be performed on the security strength, but since the security strength is also linked to the usage scenario, they are essentially doing the same thing.

[0038] 7 is a conceptual diagram showing the input / output structure using the learning model of this embodiment. A learning model (trained model) 701 receives a communication log (communication characteristic information) 702 as input and outputs a usage environment 703. In this embodiment, the usage environment 703 is configured according to the pattern shown in Table 1.

[0039] [Table 1]

[0040] The "internal LAN" usage environment is a typical office environment where many people gather and are connected to the Internet to use cloud services. The number of connected information devices is the largest compared to other usage environments. In such environments, a managed firewall is generally installed at the boundary with the external network, and access is limited to employees only. In such cases, a good balance is generally maintained between security measures implemented on the usage environment side and security measures implemented on each terminal side.

[0041] The "isolated network" usage environment is assumed to be an isolated network environment where connections to the Internet are blocked as a network topology due to reasons such as the use of outdated protocols. The number of connected information devices is relatively small. In this case, by implementing strong security measures on the usage environment side, the level of security measures implemented on the terminal side can be relaxed.

[0042] The "Home" usage environment is a home network intended for working from home, where the small-scale LAN used at home is used for working from home. The number of connected information devices is the smallest. In this case, it is assumed that security measures implemented in the usage environment are not highly reliable, and security measures on the device side must be implemented in a balanced manner.

[0043] The "public space" usage environment is assumed to be an open space where an unspecified number of people enter and exit and share the network. For example, airport lounges and coworking spaces available to guests fall into this category, and are used under loose access restrictions. The number of connected information devices is relatively large. In this case, security measures implemented in the usage environment are generally not trusted, and security measures must be implemented on the device side, even if it means sacrificing some functionality.

[0044] In this embodiment, the communication log 702 is composed of the data shown in Table 2.

[0045] [Table 2]

[0046] Traffic volume is the number of communication packets sent and received per unit time. When a device is connected to a network, it can receive unicast communications addressed to the device itself, broadcasts with no specified destination, and multicasts. Broadcast and multicast traffic volume increases in proportion to the number of information devices on the network, so this information can be used to estimate the size of the network to which it is connected. Unicast communications can be excluded to more clearly identify the network size. The size of the traffic volume value can be used to estimate the relative likelihood that the usage environment is a large network (corporate LAN, isolated network), a medium-sized public space, or a small home environment. For example, a large traffic volume value is likely to be a large network with a large number of information devices on the network. A small traffic volume value is likely to be a small home environment, while a medium traffic volume value is likely to be a medium-sized public space.

[0047] The number of destination addresses is the number of variations in the addresses used as destinations for communication packets sent and received per unit time. If a device uses various external services, the number of destination addresses will increase. If the number of destination addresses is extremely small, there is a relatively high possibility that the network is an isolated network with communication restrictions.

[0048] The number of source addresses is the number of variations of addresses used as the source of communication packets sent and received per unit time. When there are a large number of information devices in a network, the number of source addresses becomes large. The size of the number of source addresses depending on the usage environment shows a similar trend to the traffic volume. However, since the number of source addresses is essentially different from the traffic volume, the accuracy of estimating the usage environment can be further improved by looking at the trend in combination with the traffic volume.

[0049] The number of protocol types is the number of protocol variations used by communication packets sent and received per unit time. The more information devices connected to the network, the larger the number of protocol types. Also, in network environments with severe functional limitations, the number of protocol types will be smaller. A small number of protocol types is likely to indicate an isolated network or a public space.

[0050] The variation of the TTL (Time to Live) attribute in the IP header is the number of variations in the TTL value attached to communication packets sent and received per unit time. The TTL value is a value that is subtracted each time a packet passes through a router, so it will have a small value for packets that have passed through many routers. An environment where there are uniformly large TTL values ​​and little variation in the TTL attribute is likely to be a small network. An environment where TTL values ​​range from large to small and where there is a lot of variation in the TTL attribute is likely to be a large network.

[0051] As such, each parameter has a certain tendency with respect to characteristics such as network size, but it is difficult to logically determine a threshold value for making such a judgment. It is also preferable to estimate the usage environment by combining multiple parameters and determining them in a composite manner. For this reason, in this embodiment, a learning algorithm is used to perform estimation processing based on a combination of the usage environment and the communication log acquired there. By conducting numerous experiments, it is possible to determine a threshold value without using a learning algorithm, so this technology is applicable even to threshold-based methods that do not use such a learning algorithm.

[0052] The input communication log (communication characteristic information) is converted into a numerical vector by processing each piece of information (data) obtained from the sent and received communication packets, thereby improving the accuracy of estimation. For traffic volume and TTL attribute variations, the number per unit time is histogrammed using information used as training data in advance, and a threshold is determined for dividing the range into, for example, five ranges so that each range contains the same amount of data. Based on the determined threshold, the traffic volume per unit time and TTL attribute variations are converted into integer values ​​from 1 to 5, which are the corresponding range values, and used as input. Note that while an example of dividing into five ranges is shown, the number of ranges to divide into is arbitrary and can be set appropriately depending on, for example, the value ranges of other parameters.

[0053] Furthermore, for the number of destination addresses, the number of source addresses, and the number of protocol types, we use the variation of unique values ​​after excluding those that occur only once or twice within a unit time. This allows us to observe communication trends while excluding communications that occur infrequently. For example, for the number of destination addresses and the number of source addresses, we count the number of packets with the same value that are duplicated among packets sent and received within a unit time. Then, we select the packets corresponding to the most duplicated values, and when 1% of the packets remain, we use the number of values ​​selected up to that point. In this way, we use the number of addresses obtained by extracting the top 99% of the destination addresses and source addresses of packets sent and received within a unit time. Similarly, for the number of protocol types, we count the number of packets using the same protocol that are duplicated among packets sent and received within a unit time. Then, we select the packets corresponding to the protocol that is most duplicated, and when 1% of the packets remain, we use the number of protocol types selected up to that point. In this way, we use the number of protocol types obtained by extracting the top 99% of the protocol types used by packets sent and received within a unit time. Although it depends on how the unit time is defined, this value will generally fall within the range of 1 to 20, so this value is used. If the value is significantly greater than 20, you can round it down to 20.

[0054] Generally, if parameter values ​​with widely different value ranges are input directly into a learning algorithm, the difference in value ranges can affect estimation accuracy. For example, if only traffic volume has a value range of 1 to 10,000 and other parameters have a value range of 1 to 10, the estimation results will be strongly sensitive to traffic volume. In order to use each parameter in a balanced manner, estimation accuracy can be improved by converting them into numerical vectors and reducing the difference in value ranges.

[0055] The learning model (trained model) 701 can be generated by collecting a large number of samples in a real environment of combinations of a communication log 702 as an input and a usage environment 703 corresponding to the output, and learning based on these. In this embodiment, the parameter array per unit time related to the communication log 702 is treated as a one-dimensional array, and a two-dimensional array is formed by sampling this array multiple times and arranging it in chronological order. The trained model is generated using a general algorithm for generating a convolutional neural network (CNN) model using the information in this two-dimensional array and the setting values ​​of the usage environment. Note that a classifier may also be configured using an algorithm such as a k-nearest neighbor method or a support vector machine.

[0056] The operation of a system using the learning model structure shown in FIG. 7 will be described with reference to FIGS. 8(a) and 8(b). FIG. 8(a) is a diagram illustrating the operation of the system in the learning phase. The MFPs 132, 133, and 134 regularly transmit to the learning and estimation server 121 the usage environment setting values ​​shown in Table 1 that were set for the devices using the recommended security setting screen 601, and communication logs including the information shown in Table 2 extracted by the communication log extraction unit 411 (P11). In this embodiment, only three devices are shown for the sake of explanation, but in reality, data (usage environment setting values ​​and communication logs) from a large number of devices (e.g., millions of devices) that are also operated elsewhere are collected. The combination of the usage environment setting values ​​and communication logs thus obtained is subjected to numerical vectorization as described in FIG. 7, and a machine learning algorithm is used to generate a trained model. In this way, a trained model is generated by linking and learning the usage environment setting values ​​and communication characteristics (P12). In reality, bias occurs in the data acquired for each usage environment, so data processing is performed by adjusting the number of data samples to prevent over-learning for a specific usage environment, and by removing outlier data based on the standard deviation for each usage environment.

[0057] FIG. 8(b) is a diagram illustrating the operation of the system in the estimation phase. The MFP 100 has completed connection to the network and has begun communication to operate as an MFP. The MFP 100 transmits a communication log to the learning and estimation server 121 (P21). For example, when the communication log extraction unit 411 has collected, for example, 30 seconds' worth of communication logs, the MFP 100 transmits the communication log including the extracted feature information shown in Table 2 to the learning and estimation server 121. This communication log may be transmitted to the learning and estimation server 121 on the condition that a certain amount of communication, such as 100 packets, has been collected, or may be transmitted one by one, or on the condition that some user operation has been performed.

[0058] Thereafter, the MFP 100 transmits a request for the estimation result to the learning and estimation system 121 (P22). For example, the MFP 100 requests the learning and estimation server 121 for the estimation result when a specific screen display or the like is triggered.

[0059] The learning and estimation server 121 estimates the usage environment of the MFP 100 based on the characteristics of communication in the MFP 100 (P23). When the learning and estimation server 121 receives a request for an estimation result from the MFP 100, it inputs the communication log received from the MFP 100 up to that point into the trained model generated in the learning phase, and acquires the usage environment as output.

[0060] The learning / estimation server 121 transmits the usage environment of the MFP 100 obtained as the output of the learned model to the MFP 100 as an estimation result (P24).

[0061] The MFP 100 supports the settings for each usage environment based on the estimation results from the learning and estimation server 121 (P25). Based on the usage environment estimated by the learning and estimation server 121, the MFP 100 determines the information to be displayed on the information display unit 608, such as the usage environment estimation result display 607 shown in Fig. 6 and the comparison result between the selected usage environment and the estimated usage environment.

[0062] By performing the series of operations described above, machine learning can be performed from the setting values ​​and communication logs of the usage environments of other MFPs not used by the user, and setting values ​​of the usage environment that are likely to be appropriate can be presented from the communication log of the MFP used by the user. This can prevent the user from being unable to make a decision when selecting a usage environment and giving up on the setting, or from using the device with incorrect usage environment settings.

[0063] Referring to Fig. 9, a process in which the MFPs 132, 133, and 134 notify the learning / estimation server 121 of a communication log in the learning phase, as in process P11 in Fig. 8(a), will be described. Fig. 9 is a flowchart showing an example of data transmission processing by the MFPs 132, 133, and 134. The processing of the flowchart in Fig. 9 is realized by the CPU 201 reading a program stored in the flash ROM 211 into the DRAM 202 and then executing the program. Every time some communication is performed, the processing of the flowchart in Fig. 9 is started.

[0064] In step S901, the communication log extraction unit 411 determines whether or not the usage environment has been set. The communication log extraction unit 411 determines whether or not the usage environment has been set by checking that information indicating which usage environment has been set using the recommended security setting screen 601 is stored in the data storage unit 402. If it is determined that the usage environment has been set (YES in step S901), the process proceeds to step S902, and if it is determined that the usage environment has not been set (NO in step S901), the process of the flowchart in FIG. 9 ends.

[0065] In step S902, the communication log extraction unit 411 determines whether the user has consented to the data usage. The MFPs 132, 133, and 134 display a pop-up or the like on the operation unit 102 at the time of initial startup or when setting up a network connection, to ask the user of the MFP whether it is OK to use the data. The result of the user's consent or refusal to use the data is stored in the data storage unit 402. In the processing of step S902, the communication log extraction unit 411 determines whether the user has consented to the data usage by checking the information on whether the user has consented to or refusal to use the data, stored in the data storage unit 402. If it is determined that the user has consented to the data usage (YES in step S902), the processing proceeds to step S903. If it is determined that the user has not consented to the data usage (NO in step S902), the processing of the flowchart in FIG. 9 ends.

[0066] In step S903, the communication log extraction unit 411 determines whether the MFPs 132, 133, and 134 have been in operation for a certain period of time. The communication log extraction unit 411 checks the data storage unit 402 and confirms the date and time when the usage environment was set using the recommended security setting screen 601 to determine whether the MFP has been in operation for a certain period of time. If a predetermined threshold, such as one week, has elapsed since the usage environment was set, the communication log extraction unit 411 determines that the MFP has been in operation for a certain period of time. If it is determined that the MFP has been in operation for a certain period of time (YES in step S903), the process proceeds to step S904. If it is determined that the MFP has not been in operation for a certain period of time (NO in step S903), the process of the flowchart in FIG. 9 ends. By not transmitting information from devices for which the certain period of time has not elapsed, data whose settings may be changed soon can be excluded from the learning data, and estimation accuracy can be improved. Note that in this embodiment, branching is performed based on the condition of a certain period of time. However, branching may also be performed based on the condition of a certain amount of communication traffic, the receipt of a certain number of print jobs, or some other user operation.

[0067] In step S904, the communication log extraction unit 411 excludes communication logs relating to communication with the learning and estimation server 121 from the communication log. If the IP address or URL (uniform resource locator) of the communication partner is assigned to the learning and estimation server 121, the communication log extraction unit 411 deletes that communication log. Communication with the learning and estimation server 121 is always performed by the device that collects information for learning in this embodiment, and does not change depending on the usage environment of each device. By excluding communications that are invariant regardless of this usage environment, trend learning can be performed by focusing on parts that change depending on the usage environment, and improvement in estimation accuracy can be expected.

[0068] In step S905, the communication log extraction unit 411 extracts characteristic information. The communication log extraction unit 411 extracts characteristic information by performing a process of extracting the information shown in Table 2 from the communication packet data being transmitted and received. The unit of information is a total value per predetermined unit time, such as every 30 seconds, so in this step, a process of collecting packets for a certain period of time is performed. In this embodiment, the collection unit is time, but the collection unit may also be the amount of data, such as 100 packets.

[0069] In step S906, the communication log extraction unit 411 transmits a communication log consisting of the feature information extracted in step S905 to the learning and estimation server 121. The communication log extraction unit 411 requests the learning and estimation server communication unit 410 to transmit the communication log to the learning and estimation server 121 via the network control unit 407. At this time, the setting values ​​of the usage environment stored in the data storage unit 404 are transmitted to the learning and estimation server 121 together with the communication log. As described above, by executing the process of the flowchart in FIG. 9, it is possible to collect the setting values ​​of the usage environment and communication logs from a large number of MFPs used in various locations.

[0070] Referring to Figure 10, the process in which the learning and estimation server 121 receives communication feature information (communication log) and usage environment setting information (setting values) as learning data, and generates and updates a trained model, will be described. Figure 10 is a flowchart showing an example of the trained model generation and update process in the learning and estimation server 121. The process of the flowchart in Figure 10 is realized by the CPU 301 loading a program stored in the storage device 305 into the DRAM 302 and then executing the program. When a communication log is received from the MFPs 132, 133, and 134, the process of the flowchart in Figure 10 starts.

[0071] In step S1001, the learning and estimation server 121 saves the data received from the MFP (communication log and usage environment setting values). This step S1001 process receives the data transmitted by the MFP in step S905 of FIG. 9 and saves it in the data storage unit 502. If the MFP's usage environment is an isolated network as described in Table 1, data cannot be collected via the Internet. Therefore, data can be collected as follows. For example, a VPN (Virtual Private Network) connection can be established between the network to which the MFP is connected and the learning and estimation server 121, allowing communication without going via the Internet. Alternatively, a service engineer can copy the communication log stored in the MFP when visiting a user onto a portable storage medium, and then transmit the data to the learning and estimation server 121 from a terminal at a service center.

[0072] In step S1002, the learning and estimation server 121 determines whether a certain period of time has passed since a predetermined reference time. For example, if the learning model is updated at a predetermined interval, such as once a week, the learning and estimation server 121 determines whether data collection from the MFP has been performed for one week. If it is determined that the certain period of time has passed (YES in step S1002), the process proceeds to step S1003. If it is determined that the certain period of time has not passed (NO in step S1002), the process of the flowchart in FIG. 10 ends. Note that, although the certain period of time is used as the condition in this embodiment, the amount of data, such as a predetermined number of pieces of received communication log data, may also be used as the condition.

[0073] In step S1003, the learning and estimation server 121 numerically vectorizes the accumulated received data. The learning and estimation server 121 performs the numerical vectorization process on the input communication log described in the explanation of FIG. 7 to convert the information in the received communication log into integer array data with a uniform value range. This one-dimensional array data of the communication log is arranged in chronological order for each MFP to obtain two-dimensional array data. This two-dimensional array data is used as input data, and the setting values ​​of the usage environment set in the MFP corresponding to the two-dimensional array data are used as training data to form one learning data set. By performing the same process on the received data of all MFPs, a learning data set consisting of multiple learning data is obtained.

[0074] In step S1004, the learning and estimation server 121 performs calculations using a learning algorithm. The learning and estimation server 121 calculates the learning data set generated in step S1003 using a convolutional neural network (CNN).

[0075] In step S1005, the learning and estimation server 121 generates a trained model based on the calculation result in step S1004. The learning and estimation server 121 extracts the result of the calculation in step S1004 and stores the trained model data in the data storage unit 502 as a trained model candidate.

[0076] In step S1006, the learning and estimation server 121 measures the estimation accuracy of the trained model saved as a trained model candidate in step S1005. The learning and estimation server 121 uses collected MFP data to verify the accuracy of the trained model saved as a trained model candidate in step S1005. In the verification, the learning and estimation server 121 measures the estimation accuracy using data not used in learning, such as a holdout method, and saves the obtained accuracy information in the data storage unit 502.

[0077] In step S1007, the learning and estimation server 121 determines whether the estimation accuracy of the trained model has improved. The learning and estimation server 121 determines whether the estimation accuracy of the trained model measured this time in step S1006 and saved as a trained model candidate in step S1005 has improved compared to the estimation accuracy of the trained model saved in the previous processing. If it is determined that the estimation accuracy has improved (YES in step S1007), the process proceeds to step S1008. If it is determined that the estimation accuracy has not improved (NO in step S1007), the process of the flowchart in FIG. 10 ends. Note that in this embodiment, a uniform determination is made as program processing. However, in reality, there are cases where it is difficult to mechanically determine which performance is better, such as when accuracy improves in a specific usage environment but decreases in another usage environment. In consideration of such cases, accuracy confirmation may be determined by a human being based on a comparison and consideration each time, and instructions may be given to the learning and estimation server 121.

[0078] In step S1008, the learning and estimation server 121 updates the trained model. The learning and estimation server 121 overwrites and updates the trained model stored in the data storage unit 502 with the trained model stored as the trained model candidate in step S1005. As described above, by executing the processing of the flowchart in Figure 10, the learning / estimation server 121 can generate a trained model for performing estimation processing of the usage environment based on the collected MFP communication log and learning data based on the setting values ​​of the usage environment.

[0079] Referring to Fig. 11, a process in which the MFP 100 notifies the learning / estimation server 121 of a communication log in the estimation phase, as in process P21 in Fig. 8(b), will be described. Fig. 11 is a flowchart showing an example of data transmission processing by the MFP 100. The processing of the flowchart in Fig. 11 is realized by the CPU 201 reading a program stored in the flash ROM 211 into the DRAM 202 and then executing the program. Every time some communication is performed, the processing of the flowchart in Fig. 11 is started.

[0080] In step S1101, the communication log extraction unit 411 excludes communication logs relating to communication with the learning and estimation server 121 from the communication logs. If the IP address or URL of the communication partner is one assigned to the learning and estimation server 121, the communication log extraction unit 411 deletes that communication log. Since communication logs relating to communication with the learning and estimation server 121 are not used in the learning phase, higher estimation accuracy can be expected by excluding communication logs relating to communication with the learning and estimation server 121 in the estimation phase as well.

[0081] In step S1102, the communication log extraction unit 411 extracts characteristic information. The communication log extraction unit 411 extracts characteristic information by performing a process of extracting the information shown in Table 2 from the communication packet data that is transmitted and received.

[0082] In step S1103, the communication log extraction unit 411 transmits a communication log consisting of the feature information extracted in step S1102 to the learning and estimation server 121. The communication log extraction unit 411 requests the learning and estimation server communication unit 410 to transmit the communication log to the learning and estimation server 121 via the network control unit 407. As described above, by executing the processing of the flowchart in FIG. 11, it is possible to prepare a communication log that is input in the processing of estimating the usage environment of MFP 100.

[0083] 12(a) and 12(b), the processing performed when the learning and estimation server 121 receives a request for an estimation result or a communication log, and the processing performed when the MFP 100 acquires an estimation result of the usage environment in the estimation phase will be described. FIG. 12(a) is a flowchart showing an example of processing performed by the learning and estimation server 121. The processing of the flowchart in FIG. 12(a) is realized by the CPU 301 loading a program stored in the storage device 305 into the DRAM 302 and then executing the program. When a communication log or a request for an estimation result is received from the MFP 100, the processing of the flowchart in FIG. 12(a) starts.

[0084] In step S1201, the learning and estimation server 121 determines whether the data received from the MFP 100 is a request for an estimation result. Specifically, the learning and estimation server 121 determines whether the data received from the MFP is a request for an estimation result or a communication log (feature information). If it is determined to be a request for an estimation result (YES in step S1201), the process proceeds to step S1203, and if it is determined to be a communication log rather than a request for an estimation result (NO in step S1203), the process proceeds to step S1202.

[0085] In step S1202, which is reached when it is determined that a communication log has been received, the learning and estimation server 121 saves the feature information (communication log) received from the MFP 100. The learning and estimation server 121 saves the communication log sent by the MFP 100 in the data storage unit 502, but because a communication log received in the past has already been saved, it does not overwrite it but saves it by adding it together with the time of reception. After the processing of step S1202 is executed, the processing of the flowchart in FIG. 12(a) ends.

[0086] In step S1203, which is reached when it is determined that a request for an estimation result has been received, the learning and estimation server 121 numerically vectorizes the accumulated feature information (communication log). The learning and estimation server 121 numerically vectorizes the communication logs corresponding to the MFP 100 that have been received and stored in the data storage unit 502 up to now. The numerical vectorization process is the numerical vectorization process described in the explanation of FIG. 7, and executes the same process as that performed in the learning phase.

[0087] In step S1204, the learning and estimation server 121 executes an estimation process for the usage environment of the MFP 100. Using the trained model stored in the data storage unit 502 in step S1008 of Fig. 10, the learning and estimation server 121 inputs the numerically vectorized communication log created in step S1203 into the trained model as input data, and obtains an estimation result for the usage environment as an output.

[0088] In step S1205, the learning and estimation server 121 transmits the estimation result of the usage environment acquired in step S1204 to the MFP 100. After executing the process of step S1205, the process of the flowchart in FIG.

[0089] Fig. 12(b) is a flowchart showing an example of processing by which MFP 100 acquires the results of estimation of the usage environment. The processing of the flowchart of Fig. 12(b) is realized by CPU 201 reading a program stored in flash ROM 211 into DRAM 202 and then executing the program. For example, the processing of the flowchart of Fig. 12(b) is started when recommended security setting screen 601 shown in Fig. 6 is displayed. Furthermore, the processing of the flowchart of Fig. 12(b) may be started periodically, for example, once a day.

[0090] In step S1211, the MFP 100 transmits a request for the estimation result of the usage environment to the learning / estimation server 121. In step S1212, the MFP 100 receives the estimation result of the usage environment transmitted from the learning and estimation server 121 as a response to the request for the estimation result. The received estimation result of the usage environment is determined by the estimation process performed in step S1204 of Fig. 12(a) and transmitted from the learning and estimation server 121 in step S1205 of Fig. 12(a).

[0091] In step S1213, MFP 100 displays the estimated results of the usage environment. For example, if MFP 100 acquires an estimated result of the usage environment triggered by displaying recommended security settings screen 601, it displays the acquired estimated result on usage environment estimation result display 607. Also, for example, if MFP 100 acquires an estimated result periodically, such as once a day, it compares the estimated result with the current setting values ​​and displays appropriate wording on information display unit 608. Note that if settings have not been made using recommended security settings screen 601, a display may be displayed urging the user to make settings using recommended security settings screen 601. By executing the processing as described above, MFP 100 can obtain the estimated results of the usage environment and present them to the user, thereby assisting the user in setting an appropriate usage environment.

[0092] According to the first embodiment, even if a user does not have specialized knowledge of security, it is possible to select a usage environment that is likely to be appropriate based on the setting trends of many MFPs used by other users, and to set appropriate security settings. Furthermore, even if the usage environment recognized by the user differs from the usage environment recognized by the majority of other users, it is possible to present a usage environment that is likely to be appropriate, and prevent inappropriate security settings. Furthermore, for example, if a change in the usage environment causes previously appropriate security settings to become inappropriate, it is possible to present a usage environment that is likely to be appropriate at present, and change the security settings to appropriate settings.

[0093] (Second embodiment) In the first embodiment, the learning and estimation server 121 performs the estimation process of the usage environment. However, in the second embodiment, an example will be described in which the estimation process of the usage environment is performed not by the learning and estimation server 121 but by an information device, which is an edge device. The system configuration and the method for generating a trained model described with reference to FIGS. 1 to 10 are the same as those in the first embodiment. In the second embodiment, the trained model stored in the data storage unit 502 of the learning and estimation server 121 in step S1008 of FIG. 10 is stored in the data storage unit 402 of the MFP 100 in advance. This is stored at the time of shipment of the device, but a firmware upgrade mechanism may be provided so that it can be updated at the same time as other programs are updated. Alternatively, a mechanism for individually updating only the trained model may be provided.

[0094] The processing in the estimation phase in the second embodiment will be described with reference to Figures 13(a) and 13(b). Figure 13(a) is a flowchart showing an example of data collection processing by MFP 100 in the estimation phase. The processing of the flowchart in Figure 13(a) is realized by CPU 201 reading a program stored in flash ROM 211 into DRAM 202 and then executing the program. Every time some communication is performed, the processing of the flowchart in Figure 13(a) is started.

[0095] In step S1301, the communication log extraction unit 411 extracts characteristic information. The communication log extraction unit 411 extracts characteristic information by performing a process of extracting the information shown in Table 2 from the communication packet data that is transmitted and received. In step S1302, the communication log extraction unit 411 stores the characteristic information extracted in step S1302 in the data storage unit 402. By executing the processing as described above, MFP 100 can constantly acquire communication logs that serve as input data in the processing for estimating the usage environment.

[0096] Fig. 13(b) is a flowchart showing an example of estimation processing of MFP 100 in the estimation phase. The processing of the flowchart of Fig. 13(b) is realized by CPU 201 reading a program stored in flash ROM 211 into DRAM 202 and then executing the program. For example, the processing of the flowchart of Fig. 13(b) is started when recommended security setting screen 601 shown in Fig. 6 is displayed. Furthermore, the processing of the flowchart of Fig. 13(b) may be started periodically, for example, once a day.

[0097] In step S1311, the estimation processing unit 412 converts the accumulated feature information (communication log) into a numerical vector. The estimation processing unit 412 processes the communication log recorded in the data storage unit 402 in step S1302 using the method described in the explanation of FIG. 7, and converts it into an array structure that can be used as an input by the trained model.

[0098] In step S1312, the estimation processing unit 412 executes a process of estimating the usage environment. Using the trained model generated in the process shown in Fig. 10 and stored in the data storage unit 404, the estimation processing unit 412 inputs the numerically vectorized communication log generated in step S1311 to the trained model as input data, and obtains an estimation result of the usage environment as an output.

[0099] In step S1313, the estimation processing unit 412 displays the estimation result of the usage environment. For example, if the estimation result of the usage environment is acquired in response to the display of the recommended security setting screen 601, the acquired estimation result is displayed in the usage environment estimation result display 607. Furthermore, if the estimation result is acquired periodically, for example, once a day, the estimation result is compared with the current setting value and an appropriate message is displayed in the information display unit 608. By performing the processing described above, even in an environment where the MFP is not constantly connected to the learning and estimation server, it is possible to obtain and present to the user the estimation results of the usage environment, improving convenience.The user can select the usage environment that is most likely to be appropriate based on the presented estimation results and configure appropriate security settings.

[0100] In the first and second embodiments described above, the selection of a usage environment that is likely to be appropriate is determined using one trained model. Alternatively, a trained model that outputs the suitability of each usage environment pattern may be prepared, a determination may be made based on the output suitability, and the usage environment pattern with the highest suitability may be selected as the usage environment with the highest suitability. For example, if there are four usage environment patterns, the suitability of each pattern may be obtained using four trained models corresponding to each pattern, and the most suitable of the four may be selected as the usage environment. Furthermore, in the first and second embodiments described above, an MFP has been described as an example, but the present disclosure is not limited to application to an MFP, and is applicable to information processing devices in general.

[0101] (Other embodiments) The present disclosure can also be realized by a process in which a program that realizes one or more functions of the above-described embodiments is supplied to a system or device via a network or a storage medium, and one or more processors in the computer of the system or device read and execute the program.The present disclosure can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0102] It should be noted that the above-described embodiments are merely examples of specific embodiments for carrying out the present disclosure, and the technical scope of the present disclosure should not be interpreted as being limited by these embodiments. In other words, the present disclosure can be carried out in various forms without departing from its technical idea or main features. [Explanation of symbols]

[0103] 100, 132, 133, 134: MFP 121: Learning and estimation server 401: Operation control unit 402: Data storage unit 403: Job control unit 407: Network control unit 408: TCP / IP control unit 409: Security setting control unit 410: Learning and estimation server communication unit 411: Communication log extraction unit 412: Estimation processing unit 501: MFP communication unit 502: Data storage unit 503: Learning unit 504: Estimation unit

Claims

[Claim 1] an acquisition means for acquiring characteristic information of a communication performed by a first device; an estimation means for estimating the usage environment of the first device based on a trained model generated by performing machine learning based on characteristic information of communications performed by a plurality of second devices and setting information of the usage environment set on the second devices, and the acquired characteristic information of the communications related to the first device; and notifying means for notifying the estimated usage environment of the first device.

Images