Information processing device, information processing method, and program.

Abstract

This will make it easier to identify operations that may be suspected of being for non-work-related purposes. [Solution] An information processing device characterized by comprising: an acquisition means for acquiring operation logs of operations performed by a user; an extraction means for selecting a predetermined operation from the operation logs acquired by the acquisition means as a detection operation log, and extracting a predetermined range of operation logs based on the detection operation log; and a determination means for determining whether or not the operation logs within the predetermined range extracted from the extraction means are for non-business use.

Description

Technical Field

[0004] , , , , , , ,

[0006] , , , ,

[0005] , , , , , , ,

[0001] The present invention relates to an information processing apparatus, an information processing method, and a program.

Background Art

[0002] In recent years, data information leakage has been one of the greatest concerns of companies. For example, there are various information leakage risks caused by unauthorized use or personal use of business terminals, such as copying in-house files to a USB (Universal Serial Bus) memory and taking them out illegally, or uploading files to cloud storage.

[0003] According to Patent Document 1, as a method for monitoring the presence or absence of personal use of business terminals, a system is disclosed that acquires operation histories of files and applications from multiple terminals and detects that an operation of a file has been performed when alias storage or data name editing is included.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

[0007] To achieve the above objective, an information processing device according to one aspect of the present invention is characterized by comprising: an acquisition means for acquiring operation logs of operations performed by a user; an extraction means for selecting a predetermined operation from the operation logs acquired by the acquisition means as a detection operation log, and extracting a predetermined range of operation logs based on the detection operation log; and a determination means for determining whether or not the operation logs within the predetermined range extracted from the extraction means are for non-business use. [Effects of the Invention]

[0008] According to the present invention, it is possible to easily identify operations that are suspected of being used for purposes other than work. [Brief explanation of the drawing]

[0009] [Figure 1] This figure shows an example of an overview of an information processing system according to the first embodiment. [Figure 2] This figure shows an example of the hardware configuration of the client terminal device 110 according to the first embodiment. [Figure 3] This figure shows an example of an operation log acquired by the security software 111 of the client terminal device 110 according to the first embodiment. [Figure 4] This figure shows an example of the hardware configuration of the server device 120 according to the first embodiment. [Figure 5] This figure shows an example of the log data creation flow according to the first embodiment. [Figure 6] This figure shows an example of log data created according to the first embodiment. [Figure 7] This figure shows an example of the workflow for creating a business decision model according to the first embodiment. [Figure 8] This figure shows an example of the workflow for the business determination process according to the first embodiment. [Figure 9] This figure shows an example of the hardware configuration of the server device 120 according to the third embodiment. [Figure 10]This figure shows an example of the workflow for business determination processing according to the third embodiment. [Figure 11] (a) shows log data under normal circumstances, and Figure 11(b) shows an example of log data when used outside of business operations. [Figure 12] This figure shows an example of a configuration file for the third embodiment. [Figure 13] This figure shows an example of the flow after the business decision processing in the fourth embodiment. [Modes for carrying out the invention]

[0010] Embodiments of the present invention will be described in detail below with reference to the drawings. Note that the following embodiments do not limit the invention as described in the claims. Furthermore, although several technical features are described in the following embodiments, not all of these features are essential to the present invention and may be used at will. In addition, in the drawings, the same or similar configurations are given the same reference numerals, and redundant descriptions are omitted.

[0011] (First embodiment) <System Configuration Overview> The configuration of the information processing system according to the first embodiment will be explained using the system configuration diagram in Figure 1. Figure 1 is a diagram showing an example of the information processing system according to the first embodiment.

[0012] First, the information processing system according to this embodiment has personal computers, that is, information processing devices 110 and 120, and each information processing device is connected to a network 130 such as the Internet or a LAN. The information processing devices 110 and 120 in this embodiment are information processing devices (hereinafter referred to as client terminal devices) 110 that operate as client terminals and information processing devices (hereinafter referred to as server devices) 120 that operate as servers. Note that the number of client terminal devices 110 and server devices 120 and the network configuration are not limited to those shown in FIG. 1. Also, the client terminal device 110 and the server device 120 may be any device as long as it can execute each of the processes described later that an information processing device performs, such as a personal computer, a smartphone, or a tablet terminal.

[0013] The client terminal device 110 acquires an operation log based on an operation history including applications and operation information operated on the client terminal device 110. The acquired operation log is summarized as a log file and transmitted to the server device 120 through the network 130. The server device 120 stores the log file sent from the client terminal device 110 and creates log data used for the business determination process described later from the log file. For the created log data, a business determination process using the business determination model 122 stored in the server device 120 is executed to determine whether it is normal business or business that is not normal business (operation of out-of-business use).

[0014] <Client Terminal Device 110> The hardware configuration of the client terminal device 110 according to this embodiment will be described using FIG. 2. FIG. 2 is a diagram showing an example of the hardware configuration of the client terminal device 110 according to the first embodiment.

[0015] The CPU (Central Processing Unit) 11 controls the operation of the entire device by executing various processes using computer programs and data stored in the RAM 12 and the ROM 13, and also executes each of the processes described later that the device performs (control unit). The CPU 11 may be a GPU (Graphics Processing Unit), an NPU (Neural Processing Unit), or the like.

[0016] The RAM (Random Access Memory) 12 has an area for temporarily storing computer programs and data loaded from the storage device 16, and an area for temporarily storing various data received from external devices via the I / F (interface) 17. Further, the RAM 12 also has a work area used when the CPU 11 executes various processes. Thus, the RAM 12 can appropriately provide various areas.

[0017] The ROM (Read Only Memory) 13 stores setting data of the device, a boot program, and the like.

[0018] The operation unit 14 is composed of a mouse, a keyboard, etc., and various instructions can be input to the CPU 11 by the operator of the device operating it.

[0019] The display unit 15 is composed of a liquid crystal screen or the like, and the processing result by the CPU 11 can be displayed as an image, characters, or the like.

[0020] The storage device 16 is a large-capacity information storage device, such as a hard disk drive. This storage device 16 stores the OS (operating system) and computer programs and data that cause the CPU 11 to execute various processes described later as being performed by this device. This computer program includes log acquisition software 111. The log acquisition software 111 is a program for acquiring logs of data and programs from the client terminal device 110. For example, it monitors file operations (copy, move, rename, etc.) and program startups performed by a user operating the client terminal device 110 via the operation unit 14. It also has the function of storing the history of operations as an operation log in the storage device 16. The log acquisition software 111 may also have an output function to send data related to the operation log to the server device 120. The computer programs and data stored in the storage device 16, including the log acquisition software 111, are loaded into RAM 12 as appropriate according to the control of the CPU 11 and become the target of processing by the CPU 11. It is assumed that multiple application programs are running simultaneously on the client terminal device 110.

[0021] I / F17 consists of various interfaces. For example, it includes a network interface for connecting this device to the network 130 mentioned above, and a device interface for connecting external storage devices such as a USB memory 19. All of the above components are connected to the bus 18.

[0022] <Processing by logging software 111> Next, we will describe the log acquisition software 111 stored in the storage device 16 of the client terminal device 110. Here, we will describe the acquisition and storage of operation logs of the client terminal device 110 performed by the log acquisition software 111. The CPU 11 of the client terminal device 110 executes the log acquisition process described below in accordance with the log acquisition software 111.

[0023] When the client terminal device 110 is started, the CPU 11 monitors the client terminal device 110 according to the log acquisition software 111. Specifically, it monitors the names of application programs running on the client terminal device 110, the title information displayed in the title display area of ​​the active window of the application program, the operation time (viewing time) when the application program is running (active), the startup and shutdown of the client terminal device 110, and the user's file operations. Each time the application operation status switches to active, or each time an operation such as copy, move, rename, delete, or print is performed, the CPU 11 acquires an operation log (log record) of the client terminal device 110 and writes it to a log file (a file that summarizes the operation logs). Note that the operation history may also be acquired using a file filter driver, API Hook, or standard Windows APIs. As the acquisition method is publicly known, it will not be explained here.

[0024] Figure 3 shows an example of an operation log (log file) acquired by the CPU 11 according to the log acquisition software 111. In this embodiment, the acquired operation log records operation history, operation type, and terminal information, but the present invention is not limited to this.

[0025] The operation history includes information such as the following: • Operation start date and time: The date and time the operation started (when the acquisition of operation history began). • Application name of the active window... process name, etc. • Active window title... Caption name (e.g., the name of the file being edited) ·URL··Web page address • Path name... File path, folder path, etc. • Operation records for USB memory sticks, CD-ROMs, etc. • Network logs

[0026] These are just examples; for instance, information such as application operation time, URLs, browsing time for each path, and the number of keystrokes on the keyboard may also be recorded.

[0027] For example, the active window log is a type of operation log generated when the application's operation status switches to active, and it is displayed as "ACTIVE" in the operation name column in Figure 3.

[0028] The operation type indicates what kind of log it is, such as a window operation log, file / directory operation log, device operation log, mouse / keyboard log, system log, or print log.

[0029] Terminal information includes, for example, the user's account name and PC name. However, it is not limited to these; it may also include domain names, the PC's IP address, or MAC address. Furthermore, this terminal information is unique to the client terminal device.

[0030] The operation log, consisting of the operation history, operation type, and terminal information described above, is acquired by the CPU 11 and then compiled into a log file as shown in Figure 3. The CPU 11 records (saves) the log file to the storage device 16 of the client terminal device 110. The log file stored in the storage device 16 is sent by the CPU 11 to the server device 120 via the network using the I / F 17. This transmission is described as being sent automatically at regular intervals, but is not limited to this. For example, the operation log may be acquired at pre-set monitoring intervals (e.g., 1 second) and sent to the server device 120 each time it is acquired. Alternatively, it may be sent automatically when the client terminal device 110 logs in, logs off, or shuts down.

[0031] <Server device 120> The hardware configuration of the server device 120 according to this embodiment will be explained with reference to Figure 4. Figure 4 is a diagram showing an example of the hardware configuration of the server device 120 according to the first embodiment. The hardware configuration of the server device 120 is assumed to be the same as that of the client terminal device 110 described above, and in Figure 4, detailed explanations of components that are the same as those shown in Figure 2 will be omitted. That is, the CPU 21 of the server device 120 uses computer programs and data stored in the storage device 26 of the server device 120 to perform data communication with external devices via the I / F 27 of the server device 120, and also executes the various processes described later as being performed by the server device 120.

[0032] Furthermore, the storage device 26 of the server device 120 includes security software 121 that manages and analyzes log files acquired from client terminal devices and displays the results to the user. It also includes a business decision model 122, which will be explained later.

[0033] <Security Software 121> The CPU 21 of the server device 120 manages logs and security according to the security software 121.

[0034] The CPU 21 receives log files from the client terminal device 110 via the network using the I / F 27. The received log files are stored in the storage device 26 of the server device 120, and are processed, stored, and managed collectively by the server device 120.

[0035] Alternatively, instead of the server device 120's storage device 26 processing and storing all log files (operation logs) sent from the client terminal device 110 in a single batch, each client terminal device 110 may keep its own operation log in its storage device 16.

[0036] <Log data creation process for security software 121> Next, we will explain the log data creation process (log data creation process) used in the business judgment process, which will be explained later, among the processes performed by the security software 121.

[0037] The business judgment process identifies operations that may be for non-business purposes, such as unauthorized uploads, private removal of information, and access to websites unrelated to work. It determines whether these operations are part of normal business operations or non-business operations. To determine if an operation is for non-business purposes, it's necessary to analyze a series of operations, not just a single operation log. However, performing the business judgment process based on all information from the log file results in an overwhelming amount of data, making it difficult to determine which operations to focus on. Therefore, a process is performed to extract only the operation logs suitable for business judgment from the operation logs (log files) acquired from the client terminal device 110 (creation of log data).

[0038] Operation logs suitable for use in business decision-making processes, which are compiled as log data, include a series of operations that might occur when information is taken out for personal use or illegally uploaded, such as the following: • Copy confidential information from local machine to USB memory stick 19 • Open the drawing, work on it, save it to a local folder, and then upload the drawing to cloud storage.

[0039] An example of an operation log related to the series of operations described above will be explained using Figure 3. The log file shown in Figure 3 contains operations that appear to involve copying confidential information to USB memory 19 and taking the information out. Specifically, the operations in the area enclosed by the thick lines in Figure 3, from top to bottom, can be seen from the operation log as follows: open a file related to "confidential information", rename it to "test", connect USB memory 19, copy the file renamed to "test" to USB memory 19, and remove USB memory 19. In other words, it can be seen that confidential information was taken out using USB memory 19.

[0040] When a series of operations such as those for non-business use are performed, it is likely that some kind of confidential information has been leaked. Specifically, it is likely that operations such as "connecting / disconnecting external devices," "uploading," "downloading," "copying," "moving," and "printing" are always included in the series of operations. Therefore, the operation log containing these operations will be used as the operation log (detection operation log) for detecting the series of operations.

[0041] Then, operation logs within a predetermined range determined based on the detection operation log are acquired. That is, a series of operations are acquired. The predetermined range of operation logs is set as, for example, the following range, but this embodiment is not limited to this, and other ranges may be set. - From the time a file stored on the external device is opened between "connecting the external device" and "disconnecting the external device," until the external device is actually disconnected. • Between the operation log one minute before and the operation log one minute after the "copy" log. • Between the operation log one minute prior to the "upload" log and the "upload" log itself • From the operation log one minute before the file was opened, as indicated in the detection operation log, to the operation log one minute after the file was closed. • Operation log during the execution of the printed file in the "Print" log.

[0042] Next, we will explain the log data creation process flow using Figure 5. Figure 5 is a diagram showing an example of the log data creation flow.

[0043] First, in S501, CPU21 retrieves the log file stored in memory device26 and extracts the first line of the operation log contained in the retrieved log file.

[0044] Next, in S502, CPU21 determines whether the extracted operation log is a detection operation log. A detection operation log is an operation log that is always included in the operations performed during non-business use as described above, that is, an operation log used to detect operation logs suitable for use in business determination processing. If the operation log extracted in S501 is a detection operation log, proceed to S503. If it is not a detection operation log, proceed to S505.

[0045] Next, in S503, CPU21 acquires a predetermined range of operation logs (a series of operation logs), including the detection operation log.

[0046] Next, in S504, CPU21 collects (extracts) the operation logs within a predetermined range obtained in S503 and saves them to a file as log data (creates log data).

[0047] Next, in S505, CPU21 determines whether there is a successor operation log to the operation log that was being studied (acquired) in the log file. If there is a successor operation log, it returns to S501, extracts the next operation log, and proceeds to S502. On the other hand, if there is no successor operation log, this process is terminated.

[0048] The log data creation process in the log file shown in Figure 3 will be explained using Figure 6. Figure 6 shows an example of log data extracted from Figure 3. In the log file shown in Figure 3, the connection log of the USB memory 19 (shaded area) is detected as an operation log for detection in S502. Then, in S503, the operation log for a predetermined range is extracted, which covers the period from when a file stored on the external device (USB memory 19) is opened between "connection" and "disconnection" until the external device is removed. In other words, the operation log within the area enclosed by the thick black frame in Figure 3 becomes the log data, and in S504, it is saved to a file as the log data shown in Figure 6.

[0049] In this embodiment, after creating log data, it is described that the process is looped by determining whether there is a successor to the operation log acquired in S501. However, the present invention is not limited to this. For example, the process may be looped by determining whether there is a successor to the last operation log included in the series of operation logs acquired in S503 and saved as log data in S504. Also, if there is a different detection operation log among the operation logs extracted as log data, the range of the series of operation logs corresponding to that detection operation log may be extracted together as log data.

[0050] Furthermore, this embodiment is not limited to this, and if it is possible to focus on a series of operations that may occur when other unauthorized or private use is taking place, and predetermined operation logs generated within that series of operations, other operation logs may be used as detection operation logs.

[0051] Furthermore, while it is assumed that creating log data from log files and storing it in storage device 16 will be done periodically, it may also be converted to log data during the business decision processing described later.

[0052] Furthermore, the conditions for setting the detection operation log and the operation log within a predetermined range are intended to be set by writing these conditions in a configuration file and loading the configuration file as needed. However, any method that allows this process to be performed may be used for setting these conditions.

[0053] <Creation of a business decision model 122 used by security software 121> In this embodiment, the log data created as described above is used to perform a task determination process to determine whether it is a normal task or a task that is not a normal task (a task used outside of work). In this embodiment, an example of task determination processing using an AI-based task determination model 122 is described. The task determination model 122 is a learning model that has been semi-supervised to extract log data from log files of users acquired in the past when they were performing normal tasks, and treat this as a normal task. During operation, unknown log data is extracted from newly acquired log files of users and input into the task determination model as unknown data. Then, it is verified whether there is a high probability that the unknown data is a normal task. If the probability is high, it is determined to be a normal task, and if it is low, it is determined to be a task used outside of work, thereby detecting tasks used outside of work. Note that the learning model used in this embodiment is not limited to this one, and other models may be used as long as they can perform task determination.

[0054] First, we will explain how to create a business decision model using Figure 7. Figure 7 is a diagram showing an example of the business decision model creation flow according to the first embodiment.

[0055] First, S701 retrieves user operation logs (log files) acquired in the past, and then retrieves log data using the log data extraction method described above. In this embodiment, instead of using log data extracted from operations performed by the user in the past, a training dataset or the like may be prepared and used for training.

[0056] Next, in S702, the log data acquired in S701 is filtered to include only log data related to normal operations, thus creating the log data used for training (training log data). In other words, log data that appears to have been used for non-business purposes is either deleted from the log data acquired in S701, or labeled to indicate that it was used for non-business purposes, and the log data related to normal operations is used for training. This filtering can be done manually or automatically using existing technologies.

[0057] An example of how to automatically filter training data is described below.

[0058] For log data acquired by S701, the business content indicated by the operation logs contained in the log data is classified. For example, words are extracted from information (file names, etc.) contained in the operation logs using existing technology and vectorized. As a vectorization method, for example, (TF-IDF or BoW) is used to divide the log data into units such as words, count the frequency of occurrence and represent each document as a vector to create word vectors. Alternatively, preprocessing such as morphological analysis (word segmentation), word normalization, word unification (unification of meaning, etc.), and removal of stop words (such as ".", ",", "wa", "no", "()", "de", "wo", etc.) may be performed. Next, the business content of the operation logs contained in the log data is classified from the created word vectors. Specifically, existing document classification methods (topic models or SVM) are used to classify them into groups such as pre-defined business content or categories.

[0059] Log data can be classified in this way, and the log data classified into commonly performed task categories can be used as training data to filter the training data. Furthermore, this embodiment is not limited to this, and other processing methods can be used as long as automatic filtering is possible.

[0060] Next, in S703, the training log data created in S702 is input into the training model.

[0061] Next, on S704, the learning model is trained using training log data to simulate normal business operations.

[0062] By creating a task determination model that can determine whether a task is a normal task or not, it becomes possible to perform task determination in file operations.

[0063] In this embodiment, the learning model is described as being trained using pre-stored data. However, it is also possible to extract only normal business operations and train the model each time new log data is acquired during operation. Furthermore, the order and method of processing can differ as long as similar processing can be achieved.

[0064] <Business judgment processing of security software 121> Next, the business decision process using the created business decision model will be explained with reference to Figure 8. Figure 8 is a diagram showing an example of a flowchart illustrating the business decision process according to the first embodiment.

[0065] First, in S801, CPU21 obtains newly created unknown log data based on the log file newly acquired from client terminal device 110 through the log data creation process.

[0066] Next, in S802, CPU21 inputs the unknown log data acquired in S801 into the business decision model.

[0067] Next, in S803, CPU21 determines whether the series of operations indicated by the unknown log data are normal operations or not, based on the results output from the business determination model. For example, it determines whether the degree of normal operation, which indicates the possibility of it being a normal operation, output from the business determination model, is above a pre-set threshold. If it is determined that the value is above the threshold, it is determined to be a normal operation. On the other hand, if it is below the threshold, it is determined to be a non-normal operation (an operation for non-business use) and this process is terminated.

[0068] Alternatively, by flagging the content of the tasks in the training data and training the model accordingly, the trained model can determine whether a task is a normal task or a non-normal task (an operation performed outside of work duties), and at the same time, classify the content of the normal tasks. The method for flagging the content of the tasks in the training data is the same as the labeling process performed during automatic filtering as explained in the creation of the task determination model, so we will omit the explanation.

[0069] As described above, by using a predetermined range of operation logs, including detection operation logs, to make business decisions, it is possible to make business decisions that take into account information about preceding and succeeding operations that could not be obtained from a single operation log.

[0070] (Second embodiment) Next, a second embodiment of the present invention will be described. In the first embodiment, the created business decision model 122 was trained on an individual basis, whereas in the second embodiment, a case in which the business decision model 122 is trained on a group basis will be described.

[0071] <Creation of a business decision model 122 used by security software 121> The method for creating the business decision model in the second embodiment will be explained using Figure 7, as in the first embodiment. Note that if the same processing as in the first embodiment is performed, the explanation will be omitted.

[0072] First, using S701, retrieve user operation logs (log files) acquired in the past, and then retrieve the log data using the log data extraction method described above.

[0073] Next, in S702, the log data acquired in S701 is filtered (preprocessed) to use only log data related to normal operations for training. After that, user information corresponding to the log data is linked to the log data, and this becomes the log data to be used for training (training log data). User information includes a number that identifies the user corresponding to the log data, as well as information about the organization to which they belong and information about their work.

[0074] Next, in S703, training log data from multiple users is input into the training model, and in S704, the training model is trained to identify trends for each user in the same department or performing the same tasks. By inputting unknown data into the trained model in this way, more accurate business decision-making becomes possible. Note that the information files used to group the models are not limited to organizations or tasks; any type of file is acceptable as long as multiple people are involved in the learning process.

[0075] (Third embodiment) Next, a third embodiment of the present invention will be described. In the previous embodiments, an AI-based business determination model 122 was used for business determination processing, but in the third embodiment, a case in which business determination processing is performed using a business determination program will be described.

[0076] <Server device 120> The hardware configuration of the server device 120 according to the third embodiment will be described with reference to Figure 9. Figure 9 is a diagram showing an example of the hardware configuration of the server device 120 according to the third embodiment. Note that the same configuration as in the first embodiment will not be described.

[0077] In the server device 120 according to the third embodiment, the storage device 26 has a business determination program 123 instead of a business determination model 122.

[0078] <Business Judgment Program 123> The business determination program is a program that determines whether log data extracted from a user's log file is related to normal business operations or non-normal business operations (non-business use). The business determination process using the business determination program in the third embodiment will be explained with reference to Figure 10. Figure 10 is a diagram showing an example of a flowchart illustrating the business determination process according to the third embodiment.

[0079] First, in S1001, CPU21 obtains newly created unknown log data based on the log file newly acquired from client terminal device 110 through the log data creation process.

[0080] S1001 acquires log data using the log data extraction method described above.

[0081] Next, in S1002, CPU21 performs a determination (business determination) as to whether or not it is a normal business operation. Details of the business determination will be explained below using Figure 11. Figure 11(a) shows an example of log data during normal operation, and Figure 11(b) shows an example of log data during non-business use.

[0082] Under normal circumstances, operation logs are recorded and accumulated as shown in Figure 11(a). However, in the case of unusual operations, such as taking files using a USB memory stick 19 at a time outside of normal business hours (nighttime), logs such as "2024 / 9 / 1 23:36, File A, USB memory" as shown in Figure 11(b) may be recorded. In such cases, it is possible that information is being taken out of the office outside of business hours without anyone noticing, or that a user who needs a personal computer for personal use is using the information processing device 110 outside of business hours to obtain information.

[0083] Therefore, we will create a program that determines whether an operation is for non-work-related purposes by defining operations that can be considered unnatural. This will make it possible to determine whether an operation is for normal work or non-work-related purposes without using AI.

[0084] Figure 12 shows an example of the setting conditions for the business judgment program to determine whether an operation is for business purposes. For example, the condition shown in the first row determines that an operation may be for business purposes if all users copy any files to USB memory 19 between 20:00 and 06:00. If there are operations that are exceptions, exclusion conditions may be set to exclude them from the determination of business purposes. For example, as shown in Figure 12, even if the same operation is performed between 20:00 and 06:00, if the user is working overtime (but within business hours), it will be determined as normal business operations. The condition shown in the fifth row applies when all users copy or upload any files to USB memory 19, regardless of the time period. Therefore, as a prerequisite, an operation may be for business purposes if a file that has been copied or uploaded has been renamed. As described above, the business judgment performed in S1002 determines whether or not the log data (series of operation logs) acquired in S1001 contains information as shown in Figure 12.

[0085] Next, in S1003, CPU21 determines whether the result of the business judgment in S1002 is determined to be non-business use. If it is determined to be non-business use, the process proceeds to S1004, and the process ends with the determination that there was non-business use. On the other hand, if it is below the threshold, the process proceeds to S1005, and the process ends with the determination that there was no non-business use.

[0086] By using this method, it is possible to determine non-work-related use without using AI. Furthermore, if the business determination in S1002 determines that it is non-work-related use, it may be treated as such immediately.

[0087] (Fourth embodiment) Next, a fourth embodiment of the present invention will be described. In the fourth embodiment, after determining whether or not it is a normal operation using one of the methods of the first to third embodiments, an alert is issued and notification is given if it is not a normal operation. Figure 13 is a diagram showing an example of the flow after the operation determination process in the fourth embodiment.

[0088] First, in S1301, CPU21 determines whether the result obtained from the business determination process is a normal business or a non-normal business (non-business use). If it is a normal business, this process ends. If it is a non-normal business (non-business use), proceed to S1302.

[0089] Next, in S1302, CPU21 sends an alert notification to the user or administrator. Examples of alert notifications include sending emails or SMS messages, or displaying pop-ups, to notify terminals that have performed operations related to operation logs determined to be for personal use. Notifications may also be sent to designated terminals, the terminals of supervisors, or administrators of the information systems department. [Explanation of symbols]

[0090] 110 Client terminal device 111 Logging software 120 Server Devices 121 Security Software 122 Business Decision Model 130 Networks

Claims

1. A means of obtaining operation logs of operations performed by the user, An extraction means that selects a predetermined operation from the operation logs acquired by the acquisition means as a detection operation log, and extracts operation logs within a predetermined range determined based on the detection operation log, A determination means for determining whether or not the operation log is for non-business use based on the operation log within the predetermined range extracted from the extraction means, An information processing device characterized by having the following features.

2. The information processing apparatus according to claim 1, characterized in that the detection operation log is the connection or disconnection of an external storage device, upload, download, copy, move, or print.

3. The information processing device according to claim 2, characterized in that the operation log within the predetermined range is the detection operation log and the operation logs within the predetermined range before and after it.

4. The information processing apparatus according to claim 2 or 3, characterized in that it has a notification means for notifying that an unauthorized use has occurred when the determination means determines that the use is for purposes other than business use.

5. An information processing method performed by the control unit of an information processing device, The process of acquiring operation logs of operations performed by the user, An extraction step is performed in which predetermined operations from the operation logs acquired in the acquisition step are designated as detection operation logs, and operation logs within a predetermined range are extracted based on the detection operation logs. A determination step to determine whether or not the operation log is for non-business use based on the operation log within the predetermined range extracted from the extraction step, An information processing method characterized by having the following features.

6. Computers, A means of obtaining operation logs of operations performed by the user, An extraction means that selects a predetermined operation from the operation logs acquired by the acquisition means as a detection operation log, and extracts a predetermined range of operation logs based on the detection operation log, Determination means for determining whether or not the operation log is for non-business use based on the predetermined range of operation logs extracted from the extraction means. A program designed to function as such.

Images