ALERT AI MANAGEMENT DEVICE, ALERT AI MANAGEMENT METHOD, AND ALERT AI MANAGEMENT PROGRAM

Abstract

To provide an alert AI management device capable of controlling security by creating definition groups that group audit scenarios based on a nature of an alert AI audit content and by assigning roles to each group to appropriately allocate authority for each role, an alert AI management method, and an alert AI management program.SOLUTION: An alert AI management device acquires user data of an authority-specific target user and identifies a role type of the target user and the alert AI definition that has modifying authority and / or viewing authority on the basis of, the user data, a user group member master, a user alert definition group relationship table, an alert AI definition group master, and abnormal value determination definition table.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an alert AI management device, an alert AI management method, and an alert AI management program. [Background technology]

[0002] Patent Document 1 discloses a configuration for managing an environment in which a control function realized by AI (Artificial Intelligence) operates. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2021-193511 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the invention described in Patent Document 1 above had a problem in that unauthorized changes to the alert AI definition, either intentionally or accidentally, could result in the inability to detect unauthorized operations that should be detected, resulting in the control system failing to function.

[0005] The present invention has been made in consideration of the above-mentioned problems, and aims to provide an alert AI management device, an alert AI management method, and an alert AI management program that can create definition groups by grouping audit scenarios based on the nature of the audit content of the alert AI, and assign roles to each group, thereby appropriately allocating authority to each role and controlling security. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, the alert AI management device of the present invention is an alert AI management device including a memory unit and a control unit, wherein the memory unit includes a user group member master set by linking users and user groups, a user alert definition group relation storage means for storing an alert AI definition group compiled according to an audit scenario based on the nature of the monitoring content of an alert AI that judges abnormal values ​​during business execution, the role type of the user group or the user, and a user alert definition group relation table set by linking the user group, and an abnormal value judgment definition storage means for storing an alert AI definition group master in which the alert AI definitions of the alert AIs that constitute the alert AI definition group are set, and an abnormal value judgment definition table in which the definition contents of each alert AI definition are set, and the control unit includes a user acquisition means for acquiring user data of a target user for authority identification, and an authority identification means for identifying the role type of the target user and the alert AI definition for which the user has change authority and / or viewing authority based on the user data, the user group member master, the user alert definition group relation table, the alert AI definition group master, and the abnormal value judgment definition table.

[0007] In addition, in the alert AI management device of the present invention, the role types include an alert AI administrator who manages the audit scenario, an alert AI operation checker who is responsible for checking whether any fraud has been committed in creating and changing the alert AI definition, and / or whether the operations personnel who perform the audit check to see whether any abnormalities are found in the actual use of the alert AI and / or the alert AI definition assigned by the alert AI administrator are correctly operating the audit check, and the operations personnel who perform the audit check to see whether any abnormalities are found in the actual use of the alert AI and / or the alert AI definition assigned by the alert AI administrator.

[0008] In addition, in the alert AI management device of the present invention, the authority identification means identifies the role type of the target user based on the linkage between the user data, the user group member master, and the user alert definition group relation table, and identifies the alert AI definition for which the user has the change authority and / or the viewing authority based on the linkage between the user alert definition group relation table, the alert AI definition group master, and the abnormal value judgment definition table.

[0009] In addition, in the alert AI management device of the present invention, the memory unit further includes an alert AI management memory means that stores a control table that sets the change authority and the viewing authority for the alert AI definitions that constitute each alert AI definition group for each role type, the viewing authority for the change history of the alert AI definition, the viewing authority for the alert AI list inquiry based on the alert AI definition, the viewing authority for the alert AI detail inquiry based on the alert AI definition, and the viewing authority for the alert AI execution history and log based on the alert AI definition, and the control unit further includes a system control means that controls, based on the control table, the target user's changes to and / or viewing of the alert AI definition identified by the authority identification means, viewing of the change history of the alert AI definition, viewing of the alert AI list inquiry, viewing of the alert AI detail inquiry, and / or viewing of the alert AI execution history and log.

[0010] In addition, in the alert AI management device of the present invention, the memory unit further includes a user alert definition relation storage means for storing the alert AI definition and a user alert definition relation table linked to the user or the user group who is the operations officer, and the authority identification means further identifies the alert AI definition for which the target user who is the operations officer has the change authority and / or the viewing authority based on the user data, the user group member master, the user alert definition relation table, and the abnormal value judgment definition table.

[0011] In addition, in the alert AI management device of the present invention, the alert AI definition group is characterized in that it includes a fictitious order alert definition group, a sales recording alert definition group, a fictitious transaction alert definition group, and / or an expense fraud alert definition group.

[0012] Further, an alert AI management method according to the present invention is an alert AI management method to be executed by an alert AI management device having a memory unit and a control unit, wherein the memory unit includes a user group member master set by linking a user and a user group, a user alert definition group relation storage means for storing an alert AI definition group compiled according to an audit scenario based on the nature of the monitoring content of an alert AI that judges abnormal values ​​during business execution, the role type of the user group or the user, and a user alert definition group relation table set by linking the user group, and an alert AI definition group master in which the alert AI definitions of the alert AIs constituting the alert AI definition group are set, and an abnormal value judgment definition table in which the definition contents of each alert AI definition are set, and the method includes a user acquisition step of acquiring user data of a target user for authority identification, which is executed by the control unit, and an authority identification step of identifying the role type of the target user and the alert AI definition for which the target user has change authority and / or viewing authority, based on the user data, the user group member master, the user alert definition group relation table, the alert AI definition group master, and the abnormal value judgment definition table.

[0013] Further, an alert AI management program according to the present invention is an alert AI management program to be executed by an alert AI management device having a memory unit and a control unit, wherein the memory unit includes a user group member master set by linking a user and a user group, a user alert definition group relation storage means for storing an alert AI definition group compiled according to an audit scenario based on the nature of the monitoring content of an alert AI that judges abnormal values ​​during business execution, the role type of the user group or the user, and a user alert definition group relation table set by linking the user group, an alert AI definition group master in which the alert AI definitions of the alert AIs that constitute the alert AI definition group are set, and an abnormal value judgment definition storage means for storing an abnormal value judgment definition table in which the definition contents of each alert AI definition are set, and the control unit executes a user acquisition step of acquiring user data of a target user for authority identification, and an authority identification step of identifying the role type of the target user and the alert AI definition for which change authority and / or viewing authority is granted based on the user data, the user group member master, the user alert definition group relation table, the alert AI definition group master, and the abnormal value judgment definition table. Effect of the Invention

[0014] According to the present invention, it is possible to provide an effect that only an appropriate user can use the system for each definition based on the contents of the audit scenario. Also, according to the present invention, it is possible to prevent unauthorized changes by monitoring changes to the alert AI definition and the execution history of the judgment. Also, according to the present invention, it is possible to flexibly set the person in charge who uses the alert AI. Also, according to the present invention, it is possible to specify the authority that each user can operate, mainly by defining the role by the relationship setting. Also, according to the present invention, it is possible to provide roles and mechanisms in terms of security in order to operate to detect fraud and abnormalities within a company. Also, according to the present invention, it is possible to provide an effect that a plurality of judgment definitions are managed in one database, and judgment processing according to the characteristics of each business can be set by setting. Also, according to the present invention, it is possible to provide an effect that a screen for analyzing the result of the judgment of each judgment definition and the accompanying business data can be provided. Also, in this embodiment, it is possible to group the definitions of abnormal value judgment, and set a role for each group. In addition, this embodiment has the effect of grouping audit scenarios based on the nature of the audit content of the alert AI, and specifying the authority to change the definition or view the results. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of an alert AI management device according to this embodiment. [Diagram 2] FIG. 2 is a diagram showing an example of the user master 106a in this embodiment. [Diagram 3] FIG. 3 is a diagram showing an example of the user group master 106b in this embodiment. [Figure 4] FIG. 4 is a diagram showing an example of the user group member master 106c in this embodiment. [Diagram 5] FIG. 5 is a diagram showing an example of the alert AI definition group master 106d in this embodiment. [Figure 6] FIG. 6 is a diagram showing an example of the alert AI definition group member master 106e in this embodiment. [Figure 7] FIG. 7 is a diagram showing an example of management data in this embodiment. [Figure 8] FIG. 8 is a diagram showing an example of management data in this embodiment. [Figure 9] FIG. 9 is a diagram showing an example of management data in this embodiment. [Figure 10] FIG. 10 is a diagram showing an example of management data in this embodiment. [Figure 11] FIG. 11 is a diagram showing an example of management data in this embodiment. [Figure 12] FIG. 12 is a diagram showing an example of management data in this embodiment. [Figure 13] FIG. 13 is a flowchart showing an example of processing of the alert AI management device in this embodiment. [Figure 14] FIG. 14 is a diagram showing an example of a method for identifying authority in this embodiment. [Figure 15] FIG. 15 is a diagram showing an example of a method for identifying authority in this embodiment. [Figure 16] FIG. 16 is a diagram showing an example of a method for identifying authority in this embodiment. [Figure 17] FIG. 17 is a diagram showing an example of a method for identifying authority in this embodiment. [Figure 18] FIG. 18 is a diagram showing an example of a method for identifying authority in this embodiment. [Figure 19] FIG. 19 is a diagram showing an example of a method for identifying authority in this embodiment. [Figure 20] FIG. 20 is a diagram showing an example of a method for identifying authority in this embodiment. [Figure 21] FIG. 21 is a diagram showing an example of a method for identifying authority in this embodiment. [Figure 22] FIG. 22 is a diagram showing an example of an application environment in this embodiment. [Figure 23]FIG. 23 is a diagram showing an example of an application environment in this embodiment. [Figure 24] FIG. 24 is an explanatory diagram showing an example of the significance of setting an alert AI operation checker in this embodiment. [Diagram 25] FIG. 25 is a diagram showing an example of role setting in this embodiment. [Figure 26] FIG. 26 is a diagram showing an example of a screen configuration and a business flow that can prevent unauthorized changes in this embodiment. [Figure 27] FIG. 27 is a diagram showing an example of a screen configuration and a business flow that can prevent unauthorized changes in this embodiment. [Figure 28] FIG. 28 is a diagram showing an example of a screen configuration and a business flow that can prevent unauthorized changes in this embodiment. [Figure 29] FIG. 29 is a diagram showing an example of a screen configuration and a business flow that can prevent unauthorized changes in this embodiment. [Diagram 30] FIG. 30 is a diagram showing an example of an alert definition creation screen in this embodiment. [Diagram 31] FIG. 31 is a diagram showing an example of the alert AI definition change history screen in this embodiment. [Diagram 32] FIG. 32 is a diagram showing an example of an alert AI inquiry screen in this embodiment. [Diagram 33] FIG. 33 is a diagram showing an example of an alert AI inquiry screen in this embodiment. [Diagram 34] FIG. 34 is a diagram showing an example of the alert AI execution history log viewer in this embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to the embodiment.

[0017] [1. Overview] First, an overview of the present invention will be described.

[0018] In the past, when there was a high possibility of handling highly confidential data, such as detecting business fraud such as inflated sales or manipulation of inventory values, it was not possible to restrict the users who could change and view the settings of the alert AI definition to only the minimum necessary content for each user, so it was desirable to restrict the users who could change and view the settings of the alert AI definition, even within the same company. In other words, in the past, there was a high possibility that highly confidential data would be handled when making judgments or viewing results, but there was no mechanism to control the minimum necessary authority for each user according to the contents of the audit scenario. In addition, since the only users who could set authority were system administrators who were not business personnel, it was not possible to flexibly change the person in charge of using the alert AI. In addition, since the alert AI definition could be changed by setting, there was a risk that the control would not function because the control would not be able to detect business fraud that should be detected due to intentional or negligent changes to the alert AI definition, but there was no mechanism to control the changes. In addition, in the past, there was a possibility that users would view data that should not be viewed due to the nature of the data, and appropriate security control was lacking.

[0019] Therefore, in this embodiment, it is possible to create definition groups that group audit scenarios based on the nature of the audit content of the alert AI, and to each group, three roles can be assigned: alert AI management officer, alert AI operation check officer, and operation officer. A mechanism is provided in which authority to change and view definitions, view judgment results, view history, etc. is appropriately assigned to each role to control security.

[0020] As a result, in this embodiment, alert AI definitions can be grouped and roles can be set for each group, and settings can be made for each business unit. Three roles are provided and authority is divided for each role, allowing each person to perform necessary processing while preventing fraud. In addition, in this embodiment, unauthorized changes are prevented by monitoring changes to alert AI definitions and the execution history of judgments, and the alert AI operation checker is given authority to monitor the implementation of settings added and changed by the alert AI management personnel, and it is possible to check whether unauthorized changes have been made. In addition, in this embodiment, even if the user is not a system administrator, the alert AI definition can be created and the authority settings of the operation personnel can be changed, and the authority to grant viewing authority can be delegated from the system administration user to the alert AI management personnel by giving them the authority to set the operation personnel.

[0021] Here, the system administrator has the authority to perform the appointment management of the alert AI administrator and the alert AI operation checker for each business content, to create a definition group that is managed by a user group and summarizes audit scenarios based on the nature of the audit content of the alert AI, to create a user group that summarizes users, to assign users to the user group, to assign a user group that will be the alert AI administrator to the definition group, and to assign a user group that will be the alert AI operation checker to the definition group. Note that in this embodiment, an alert AI administrator and an alert AI operation checker may be selected for each audit scenario based on the nature of the audit content of the alert AI, and the necessary authority may be delegated.

[0022] In addition, the alert AI administrator has the authority to manage audit scenarios based on the nature of the audit content of the transferred alert AI, to newly create, modify, delete, and view alert AI definitions in the definition group managed by the user group and assigned by the system administrator, to view the change history of alert AI definitions in the definition group assigned by the system administrator, to assign users of operations personnel to alert AI definitions in the definition group assigned by the system administrator, and to view the results of abnormal value determinations performed from alert AI definitions in the definition group assigned by the system administrator.

[0023] In addition, the alert AI operation checker is responsible for checking whether any irregularities have been committed when creating or modifying alert AI definitions, whether the operations staff is operating the audit check correctly, etc., and has the authority to view the change history of alert AI definitions in the definition group managed by user groups and assigned by the system administrator, to view the execution history and logs of anomaly judgments performed from alert AI definitions in the definition group assigned by the system administrator, and to view the judgment results of anomaly judgments performed from alert AI definitions in the definition group assigned by the system administrator.

[0024] In addition, the operations officer is the person who operates the audit checks to see if any abnormalities are found in the alert AI definitions assigned by the alert AI administrator who actually uses the alert AI, and is managed by user groups or users, and (depending on the assignment of authority) can view the alert AI definitions assigned by the alert AI administrator, can view the results of anomaly determinations performed from the alert AI definitions assigned by the alert AI administrator, and has the authority to output the results of anomaly determinations performed from the alert AI definitions assigned by the alert AI administrator.

[0025] [2. Configuration] An example of the configuration of the alert AI management device 100 according to this embodiment will be described with reference to Fig. 1 to Fig. 12. Fig. 1 is a block diagram showing an example of the configuration of the alert AI management device 100 according to this embodiment.

[0026] 1, the alert AI management device 100 is a commercially available desktop personal computer. The alert AI management device 100 is not limited to a stationary information processing device such as a desktop personal computer, but may be a portable information processing device such as a commercially available notebook personal computer, a PDA (Personal Digital Assistant), a smartphone, or a tablet personal computer.

[0027] The alert AI management device 100 includes a control unit 102, a communication interface unit 104, a storage unit 106, and an input / output interface unit 108. The units included in the alert AI management device 100 are connected to each other so as to be able to communicate with each other via any communication path.

[0028] The communication interface unit 104 communicatively connects the alert AI management device 100 to the network 300 via a communication device such as a router and a wired or wireless communication line such as a dedicated line. The communication interface unit 104 has a function of communicating data with other devices via the communication line. Here, the network 300 has a function of connecting the alert AI management device 100 and the server 200 so that they can communicate with each other, and is, for example, the Internet or a LAN (Local Area Network).

[0029] An input device 112 and an output device 114 are connected to the input / output interface unit 108. The output device 114 may be a monitor (including a touch panel), a speaker, or a printer. The input device 112 may be a keyboard, a mouse, a microphone, or a monitor that cooperates with a mouse to realize a pointing device function. In the following, the output device 114 may be referred to as the monitor 114 or the printer 114, and the input device 112 may be referred to as the keyboard 112 or the mouse 112.

[0030] The storage unit 106 stores various databases, tables, files, and the like. The storage unit 106 records computer programs for cooperating with an OS (Operating System) to give instructions to a CPU (Central Processing Unit) to perform various processes. For example, memory devices such as RAM (Random Access Memory) and ROM (Read Only Memory), fixed disk devices such as hard disks, flexible disks, and optical disks can be used as the storage unit 106. The storage unit 106 includes a user master 106a, a user group master 106b, a user group member master 106c, an alert AI definition group master 106d, an alert AI definition group member master 106e, and an alert AI management database 106f.

[0031] The user master 106a is a master that sets users. Here, the user master 106a may be set in association with a user ID (Identification) and a user name.

[0032] An example of the user master 106a in this embodiment will now be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the user master 106a in this embodiment.

[0033] As shown in FIG. 2, the user master 106a in this embodiment is set in association with a user ID and a user name, and may be configurable only by a system administrator.

[0034] 1, the user group master 106b is a master that sets user groups. Here, the user group master 106b may be set in association with a user group ID and a user group name.

[0035] An example of the user group master 106b in this embodiment will now be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the user group master 106b in this embodiment.

[0036] As shown in FIG. 3, the user group master 106b in this embodiment is set in association with a user group ID and a user group name, and may be configurable only by a system administrator.

[0037] 1, the user group member master 106c is a master that associates users with user groups. Here, the user group member master 106c may be set with user IDs and user group IDs associated with each other.

[0038] An example of the user group member master 106c in this embodiment will now be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the user group member master 106c in this embodiment.

[0039] As shown in FIG. 4, the user group member master 106c in this embodiment is set in association with a user group ID and a user ID, and may be configurable only by a system administrator.

[0040] Returning to FIG. 1, the alert AI definition group master 106d is a master that sets the alert AI definition of the alert AI that constitutes the alert AI definition group. Here, the alert AI definition group may include a fictitious order alert definition group, a sales recording alert definition group, a fictitious transaction alert definition group, and / or an expense fraud alert definition group. In addition, the alert AI definition group master 106d may be set in association with a definition group ID and an alert AI definition group name. Here, the fictitious order alert definition group may include a fictitious order alert definition, a fictitious business partner sales alert definition, and an accounts payable alert definition. In addition, the sales recording alert definition group may include a sales cancellation alert definition, a sales correction alert definition, and a sales discount alert definition. In addition, the fictitious transaction alert definition group may include an expense item fraudulent use alert definition and an excessive billing alert definition. In addition, the expense fraud alert definition group may include an excessive expense alert and a fictitious business partner expense alert.

[0041] An example of the alert AI definition group master 106d in this embodiment will now be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the alert AI definition group master 106d in this embodiment.

[0042] As shown in FIG. 5, the alert AI definition group master 106d in this embodiment is set in association with a definition group ID and an alert AI definition group name, and may be set only by the system administrator.

[0043] 1, the alert AI definition group member master 106e is a master in which an alert AI definition group and an alert AI definition are linked and set. Here, the alert AI definition group member master 106e may be set in which a definition group ID and a definition ID are linked and set.

[0044] An example of the alert AI definition group member master 106e in this embodiment will now be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the alert AI definition group member master 106e in this embodiment.

[0045] As shown in Figure 6, the alert AI definition group member master 106e in this embodiment is set in association with a definition group ID and a definition ID, and only definitions assigned to the definition group to which the alert AI administrator is assigned may be set.

[0046] Returning to FIG. 1, the alert AI management database 106f stores management data of the alert AI. Here, the alert AI management database 106f may store (as management data) a control table in which the change authority and viewing authority for the alert AI definition constituting each alert AI definition group for each role type, the viewing authority for the change history of the alert AI definition, the viewing authority for the alert AI list inquiry based on the alert AI definition, the viewing authority for the alert AI detail inquiry based on the alert AI definition, and the viewing authority for the alert AI execution history and log based on the alert AI definition are set. In addition, the alert AI management database 106f may store (as management data) an alert AI definition group summarized according to an audit scenario based on the nature of the monitoring content of the alert AI that judges an abnormal value during business execution, a user group or user role type, and a user alert definition group relation table set by linking the user group. Here, the role types may include an alert AI administrator who manages the audit scenario, and an alert AI operation checker who is in charge of checking whether any fraud has been committed in creating and changing the definition of the alert AI, and / or whether the operation staff who actually uses the alert AI and / or performs the audit check to see whether any abnormality is found in the alert AI definition assigned by the alert AI administrator is performing the audit check correctly. The alert AI management database 106f may also store (as management data) an abnormal value determination definition table in which the definition contents of each alert AI definition are set. The alert AI management database 106f may also store (as management data) an alert AI definition and a user alert definition relation table that is set by linking it with the user or user group who is the operation staff.

[0047] An example of management data in this embodiment will now be described with reference to Fig. 7 to Fig. 12. Fig. 7 to Fig. 12 are diagrams showing an example of management data in this embodiment.

[0048] As shown in FIG. 7, the management data in this embodiment includes a user alert definition group relation table in which a definition group ID, a role type, and a user group ID are linked and set, and may be set only by the system administrator. Also, as shown in FIG. 7, the management data in this embodiment includes a user alert definition relation table in which a definition ID, a setting type, a user group ID, a user ID, an output authority flag, and a definition reference flag are linked and set, and only the definitions assigned to the definition group assigned as the alert AI administrator can be set, and a user or user group who will be the operator may be assigned to each definition. Also, as shown in FIG. 7, the management data in this embodiment includes a control table in which the change authority and viewing authority of the alert AI definition, the viewing authority of the alert AI definition change history, the viewing authority of the alert AI inquiry (list), the viewing authority of the alert AI inquiry (details), and the viewing authority of the alert AI execution history and log are set for each role type, and may be used to control other tables included in the management data. Here, the control table is linked to a role for each alert AI definition group, and all data outside the linked alert AI definition group may not be viewable. In this embodiment, the control table shown in FIG. 7 may be displayed as a definition screen.

[0049] In addition, in this embodiment, the scope of authority of the alert AI administrator to the table related to the definition is that only new definitions can be added to the definition group assigned to the alert AI administrator, only definitions belonging to the definition group assigned to the alert AI administrator can be modified and deleted, and only definitions belonging to the definition group assigned to the alert AI administrator can be viewed. In addition, in this embodiment, the scope of authority of the alert AI operation checker to the table related to the definition is that only definitions belonging to the definition group assigned to the alert AI operation checker can be viewed. In addition, in this embodiment, the scope of authority of the operation staff to the table related to the definition is that only definitions assigned to the operation staff and with "definition reference flag = TRUE" can be viewed. Here, as shown in FIG. 8, the abnormal value determination definition table, which is a table related to the definition in this embodiment, may be set in association with a definition ID, a definition name, an algorithm code, a definition, a result table name, and a data acquisition definition ID. As shown in FIG. 8, the extraction condition table, which is a table related to the definition in this embodiment, may have a definition ID, a position NO, a conjunction, a parenthesis, an extraction column name, an operator, a threshold, a data type, a comparison column name, and a rear parenthesis. As shown in FIG. 8, the change point definition table, which is a table related to the definition in this embodiment, may have a definition ID, a time series name, a key item, a target column name, a comparison target, a change degree calculation type, a number, a change point detection type, an upper limit, and a lower limit. As shown in FIG. 8, the anomaly rank definition table, which is a table related to the definition in this embodiment, may have a definition ID and an anomaly rank number associated with each other. As shown in FIG. 8, the data acquisition definition table, which is a table related to the definition in this embodiment, may have a data acquisition definition ID, a data acquisition definition name, and a stored procedure name associated with each other.

[0050] In this embodiment, the scope of authority of the alert AI administrator to the history table of the table related to the definition can only view definitions belonging to the definition group assigned to the alert AI administrator. In this embodiment, the scope of authority of the alert AI operation checker to the history table of the table related to the definition can only view definitions belonging to the definition group assigned to the alert AI operation checker. In this embodiment, the scope of authority of the operation staff to the history table of the table related to the definition does not have a viewing authority. In this embodiment, the history table is updated whenever there is a change in the original table, and the generation number is counted up every time there is a change for each definition ID. Here, as shown in FIG. 9, the abnormal value determination definition generation management table, which is the history table of the table related to the definition in this embodiment, may be set with the generation number, definition ID, update contents, and update date linked to each other. In addition, as shown in FIG. 9, the abnormal value determination definition history table, which is the history table of the table related to the definition in this embodiment, may be set with the generation number, definition ID, definition name, algorithm code, definition, result table name, data acquisition definition ID, update contents, and update date linked to each other.

[0051] As shown in Fig. 10, the extraction condition history table, which is a history table of the table related to the definition in this embodiment, may be set with a generation number, a definition ID, a position number, a conjunction, a parenthesis, an extraction column name, an operator, a threshold, a data type, a comparison column name, a parenthesis, an update content, and an update date linked together. As shown in Fig. 10, the change point definition history table, which is a history table of the table related to the definition in this embodiment, may be set with a generation number, a definition ID, a time series name, a key item, a target column name, a comparison target, a change degree calculation type, a number, a change point detection type, an update content, and an update date linked together. As shown in Fig. 10, the anomaly rank definition history table, which is a history table of the table related to the definition in this embodiment, may be set with a generation number, a definition ID, an anomaly rank number, an update content, and an update date linked together. Moreover, as shown in FIG. 10, the data acquisition definition history table, which is a history table of tables related to definitions in this embodiment, may be set in association with the data acquisition definition ID, data acquisition definition name, stored procedure name, update contents, and update date.

[0052] In addition, in this embodiment, the scope of authority of the alert AI manager to the table related to the judgment result is that only data linked to the definition belonging to the definition group assigned to the alert AI manager can be viewed. In addition, in this embodiment, the scope of authority of the alert AI operation checker to the table related to the judgment result is that only data linked to the definition belonging to the definition group assigned to the alert AI operation checker can be viewed. In addition, in this embodiment, the scope of authority of the operation staff to the table related to the judgment result is that only data linked to the definition assigned to the operation staff can be viewed. Here, as shown in FIG. 11, the judgment result table, which is a table related to the judgment result in this embodiment, may be set in such a manner that the index, definition ID, execution Guid, judgment result, staff CD (code), customer CD, accounting year and month, and sales cancellation amount are linked together. In addition, as shown in FIG. 11, the result message table, which is a table related to the judgment result in this embodiment, may be set in such a manner that the definition ID, execution Guid, index, layout element CD, and message are linked together.

[0053] In addition, in this embodiment, the scope of authority of the alert AI administrator to the table used to refer to the execution history and log is that only data linked to the definition belonging to the definition group assigned to the alert AI administrator can be viewed. In addition, in this embodiment, the scope of authority of the alert AI operation checker to the table used to refer to the execution history and log is that only data linked to the definition belonging to the definition group assigned to the alert AI operation checker can be viewed. In addition, in this embodiment, the scope of authority of the operation staff to the table used to refer to the execution history and log is that they do not have viewing authority. Here, as shown in FIG. 12, the judgment log table, which is a table used to refer to the execution history and log in this embodiment, may be set in association with a sequence number, a definition ID, an execution Guid, a message, and an update time. In addition, as shown in FIG. 12, the judgment history table, which is a table used to refer to the execution history and log in this embodiment, may be set in association with a sequence number, a definition ID, an execution Guid, a state, and an update time.

[0054] Returning to Fig. 1, the control unit 102 is a CPU or the like that performs overall control of the alert AI management device 100. The control unit 102 has an internal memory for storing control programs such as an OS, programs that define various processing procedures, required data, etc., and executes various information processing based on these stored programs. In terms of functional concept, the control unit 102 includes a user acquisition unit 102a, an authority identification unit 102b, and a system control unit 102c.

[0055] The user acquisition unit 102a acquires user data of a target user for which authority is to be specified.

[0056] The authority specification unit 102b specifies the role type of the target user and the alert AI definition for which the target user has change authority and / or viewing authority. Here, the authority specification unit 102b may specify the role type of the target user and the alert AI definition for which the target user has change authority and / or viewing authority based on the user data, the user group member master 106c, the user alert definition group relation table, the alert AI definition group master 106d, and the abnormal value judgment definition table. The authority specification unit 102b may specify the role type of the target user based on the linkage between the user data, the user group member master 106c, and the user alert definition group relation table, and may specify the alert AI definition for which the target user has change authority and / or viewing authority based on the linkage between the user alert definition group relation table, the alert AI definition group master 106d, and the abnormal value judgment definition table. The authority specification unit 102b may specify the change history of the alert AI definition of the alert AI for which the target user has viewing authority, the alert AI list inquiry, the alert AI detail inquiry, and / or the alert AI execution history log. The authority identifying unit 102b may also identify an alert AI definition for which the target user, who is an operations staff member, has modification authority and / or viewing authority based on the user data, the user group member master 106c, the user alert definition relation table, and the abnormal value determination definition table. The authority identifying unit 102b may also identify the role type of the target user and the alert AI definition for which the target user has modification authority and / or viewing authority based on the linkage of the user data, the user master 106a, the user group master 106b, the user group member master 106c, the user alert definition group relation table, the alert AI definition group master 106d, the alert AI definition group member master 106e, and / or the abnormal value determination definition table.

[0057] Based on the control table, the system control unit 102c controls the target user's ability to change and / or view the alert AI definition identified by the authority identification unit 102b, view the change history of the alert AI definition, view the alert AI list inquiry, view the alert AI detail inquiry, and / or view the alert AI execution history and log.

[0058] [3. Specific Examples] A specific example of this embodiment will be described with reference to FIGS.

[0059] [Alert AI Management Processing] An example of an alert AI management process in this embodiment will now be described with reference to Fig. 13. Fig. 13 is a flowchart showing an example of the process of the alert AI management device 100 in this embodiment.

[0060] As shown in FIG. 13, when a login is performed by a target user for which authority is specified, the user acquisition unit 102a acquires user data in which the user name and / or user ID of the target user is set (step SA-1).

[0061] Then, the authority identification unit 102b identifies the role type of the target user based on the linkages between the user data, the user master 106a, the user group master 106b, and the user alert definition group relation table, and determines whether the target user is an alert AI administrator or an alert AI operation checker (step SA-2).

[0062] If the authority specifying unit 102b determines that the target user is not the alert AI administrator or the alert AI operation checker (step SA-2: No), the authority specifying unit 102b shifts the process to step SA-3.

[0063] Then, the authority identifying unit 102b judges whether the target user is an operations person based on the association between the user data, the user master 106a, the user group master 106b, and the user alert definition relation table (step SA-3).

[0064] If the authority identifying unit 102b determines that the target user is not an operations person (step SA-3: No), the authority identifying unit 102b shifts the process to step SA-6.

[0065] On the other hand, if the authority identifying unit 102b determines that the target user is an operations staff member (step SA-3: Yes), the authority identifying unit 102b shifts the process to step SA-4.

[0066] Then, the authority identification unit 102b identifies the alert AI definition that the target user, who is an operations officer, has viewing authority for, based on the linkages between the user data, the user master 106a, the user group member master 106c, the user alert definition relation table, and the abnormal value determination definition table (step SA-4), and transitions the processing to step SA-6.

[0067] On the other hand, if the authority identifying unit 102b determines that the target user is the alert AI administrator or the alert AI operation checker (step SA-2: Yes), the authority identifying unit 102b shifts the process to step SA-5.

[0068] Then, the authority identification unit 102b identifies the alert AI definition for which the target user has modification authority and / or viewing authority based on the linkages between the user data, user master 106a, user group master 106b, user group member master 106c, user alert definition group relation table, alert AI definition group master 106d, alert AI definition group member master 106e, and the abnormal value determination definition table (step SA-5), and transitions the processing to step SA-6.

[0069] Then, based on the control table stored in the alert AI management database 106f, the system control unit 102c controls the target user's changes to and / or viewing of the alert AI definition identified by the authority identification unit 102b, viewing of the change history of the alert AI definition, viewing of the alert AI list inquiry based on the alert AI definition, viewing of the alert AI detail inquiry based on the alert AI definition, and / or viewing of the alert AI execution history and log based on the alert AI definition (step SA-6), and terminates the processing.

[0070] Here, an example of an authority specifying method in this embodiment will be described with reference to Fig. 14 to Fig. 21. Fig. 14 to Fig. 21 are diagrams showing an example of an authority specifying method in this embodiment.

[0071] In this embodiment, it is possible to determine what authority each user has for which definition. As shown in Figure 14, when the logged-in user has "User ID: U01, User name: Yamashita Shigeru", the role type of the user is identified as Alert AI Administrator, and it is possible to determine that the user has Alert AI Administrator authority for two definitions (linked to the Alert AI Administrator user), and each screen is controlled according to system control.

[0072] Also, as shown in FIG. 15, in this embodiment, if the logged-in user has "User ID: U06, User name: Shibatsuji Kotomi", the role type of the user is identified as an alert AI operation checker, and it can be identified that the user has alert AI operation checker authority for five definitions (linked to the alert AI operation checker), and each screen is controlled according to system control.

[0073] Also, as shown in FIG. 16, in this embodiment, if the logged-in user is an operations person with "user ID: U02, user name: Kinoshita Yuji", it can be determined that the user has operations person authority for one definition (linked to the operations person), and each screen is controlled according to system control.

[0074] Also, as shown in FIG. 17, in this embodiment, if the logged-in user is an operations person with "user ID: U07, user name: Yamazato Hiromichi", it can be determined that the user has operations person authority for one definition (linked to the operations person), and each screen is controlled according to system control.

[0075] Also, as shown in FIG. 18, in this embodiment, in the case of "Definition ID: T001, Definition Name: Sales Correction Alert Definition," the alert AI definition and the results are linked based on "Definition ID: T01" and "Execution Guid: 00000000-0000-0000-0000-000000000000."

[0076] Also, as shown in Figure 19, in this embodiment, in the case of "Definition ID: T001, Definition Name: Sales Correction Alert Definition", the alert AI definition is linked to each setting or history based on the "Data Acquisition Definition ID".

[0077] Furthermore, as shown in FIG. 20 and FIG. 21, in this embodiment, a "definition ID" is set in all setting tables and history tables, making it possible to specify authority.

[0078] An example of an application environment in this embodiment will be described with reference to Fig. 22 and Fig. 23. Fig. 22 and Fig. 23 are diagrams showing an example of an application environment in this embodiment.

[0079] 22, the alert AI management in this embodiment is applicable to a structure in which a system administrator appoints and manages an alert AI manager and an alert AI operation checker for each of a plurality of alert AI definition groups within company 100. In addition, since the alert AI operation checker should be a person who is capable of exercising control, as shown in FIG. 23, the alert AI management in this embodiment is applicable to a structure in which a system administrator appoints an alert AI operation checker within parent company 100, and appoints and manages alert AI managers for each of a plurality of alert AI definition groups within subsidiary company 200 and subsidiary company 300.

[0080] The significance of setting the person in charge of checking the alert AI operation in this embodiment will be described with reference to Fig. 24. Fig. 24 is an explanatory diagram showing an example of the significance of setting the person in charge of checking the alert AI operation in this embodiment.

[0081] As shown in Fig. 24, in this embodiment, by providing an alert AI operation checker, it is possible to prevent unauthorized changes to the alert AI by the alert AI administrator and the deletion of schedule definitions, which can cause content that should be detected to go undetected. In other words, in this embodiment, by providing an alert AI operation checker, unauthorized changes can be prevented from being made, and in the unlikely event that an unauthorized change is made, it can be noticed.

[0082] Also, an example of an authority setting structure that allows even a person other than the system administrator to change detailed viewing authority in this embodiment will be described with reference to Fig. 25. Fig. 25 is a diagram showing an example of role setting in this embodiment.

[0083] In this embodiment, the system administrator delegates the authority to set the operation person to the alert AI administrator based on the role setting shown in FIG. 25. In addition, in this embodiment, the operation person can be set for each alert AI definition. That is, in this embodiment, the person in charge of managing the entire alert AI definition group is limited, while the person who actually uses the alert AI screen often differs for each scenario and definition. Therefore, even within the alert AI definition group, the alert AI definition and the user are linked, so that the user's authority setting can be finely and appropriately set. In addition, in this embodiment, not only the link with the user group but also the link with the user is possible. Here, when setting the operation person for each alert AI definition, if only the user group can be set and a new operation person is to be added, it is necessary to request the system administrator to add it, but the rights cannot be divided. Therefore, in this embodiment, the alert AI administrator has the authority for the whole range of the operation person's authority, so that the user alone can also set it.

[0084] In addition, in this embodiment, the authority can be divided finely for each operator. That is, in this embodiment, the definition viewing authority for whether or not the definition of what definition the abnormal value judgment is performed under can be viewed can be divided for each operator. In this embodiment, if the operator can understand the judgment conditions for anomaly detection, it is possible to control the input of business data to avoid fraud detection, so it is given only to the minimum number of users. In addition, in this embodiment, the result viewing authority for whether or not the analysis screen of the abnormal value judgment result can be viewed can be divided for each operator. In this embodiment, all users assigned to the operator have this authority, and when there is data judged to be abnormal, detailed data on the analysis screen can be viewed. In addition, in this embodiment, the output authority for whether or not the result can be output from the analysis screen of the abnormal value judgment result can be divided for each operator. In this embodiment, the data after output can also be processed and shared, so it is given only to the minimum number of users.

[0085] Moreover, an example of a screen configuration and a business flow that can prevent unauthorized changes in this embodiment will be described with reference to Figures 26 to 29. Figures 26 to 29 are diagrams showing an example of a screen configuration and a business flow that can prevent unauthorized changes in this embodiment.

[0086] In this embodiment, unauthorized changes are prevented by monitoring changes to the alert AI definition and the user. That is, as shown in Fig. 26 to Fig. 29, in this embodiment, since the alert AI administrator has the authority to change the definition, it is possible to monitor whether unauthorized detection is performed by making the alert AI operation checker know that each alert AI definition has been changed, its contents, or that it has been executed, assuming a case where the alert AI administrator has the authority to change the definition, for example, to conceal unauthorized detection by deleting the alert AI definition so that abnormal value judgment is not executed, or a case where the judgment rule is tampered with to conceal unauthorized detection.

[0087] Further, an example of a system control screen in this embodiment will be described with reference to Figs. 30 to 34. Fig. 30 is a diagram showing an example of an alert definition creation screen in this embodiment. Fig. 31 is a diagram showing an example of an alert AI definition change history screen in this embodiment. Fig. 32 is a diagram showing an example of an alert AI inquiry screen in this embodiment. Fig. 33 is a diagram showing an example of an alert AI inquiry screen in this embodiment. Fig. 34 is a diagram showing an example of an alert AI execution history log viewer in this embodiment.

[0088] As shown in Fig. 30, the alert definition creation screen in this embodiment is a system screen that allows the user to create, modify, delete, and view alert definitions, and includes the alert AI definition group member master 106e, the abnormal value determination definition table, the extraction condition table, the change point definition table, the abnormality rank definition table, and the data acquisition definition table as the setting and viewing destinations. Here, as shown in Fig. 30, on the alert definition creation screen in this embodiment, the definition groups assigned as the alert AI administrator are displayed in a list, the definition groups assigned as the alert AI operation checker are displayed in a list, the definitions assigned as the operation person and with "definition reference flag = TRUE" are displayed in a list, and the new creation button is displayed only when the user assigned as the alert AI administrator starts up, and when a new record is created, tables related to the definitions such as the abnormal value determination definition table are updated, and a new record in which the corresponding definition group and definition ID are set is added to the alert AI definition group member master 106e. 30, in the alert definition creation screen in this embodiment, the Modify / Delete button is displayed only when a definition belonging to a definition group assigned as the alert AI administrator is selected, and when the definition is modified or deleted, tables related to the definition, such as the abnormal value determination definition table, are updated or deleted, and when the definition is deleted, the record of the corresponding definition ID is deleted from the alert AI definition group member master 106e, and only the definitions displayed in the definition list can be viewed, and only the definition group assigned as the alert AI administrator can be added on the new creation screen. Note that in this embodiment, the definition group to be linked from the alert AI administrator user may be specified, the definition group to be linked from the alert AI operation checker user may be specified, and the definition to be linked from the operation person user may be specified, and the alert AI definition, each setting, and history may be linked.

[0089] Also, as shown in FIG. 31, the alert AI definition change history screen in this embodiment is a system screen that allows the contents of new creation, modification, and deletion on the alert definition creation screen to be viewed, and the abnormal value determination definition generation management table, abnormal value determination definition history table, extraction condition history table, change point definition history table, anomaly rank definition history table, and data acquisition definition history table are viewed. Here, as shown in FIG. 31, on the alert AI definition change history screen in this embodiment, the definition groups assigned as the alert AI administrator are displayed in a list, and the definition groups assigned as the alert AI operation checker are displayed in a list, and only the definitions displayed in the definition list can be viewed. Note that, in this embodiment, the definition group associated with the alert AI administrator user may be identified, and the definition group associated with the alert AI operation checker user may be identified, and the alert AI definition, each setting, and history may be associated.

[0090] Also, as shown in FIG. 32, the alert AI inquiry (list) screen in this embodiment is a system screen that allows a list of judgments made based on the alert definition, and the result message table is used as the viewing destination. Here, as shown in FIG. 32, on the alert AI inquiry (list) screen in this embodiment, messages of the results judged based on the definition belonging to the definition group assigned to the alert AI administrator are displayed in a list, messages of the results judged based on the definition belonging to the definition group assigned to the alert AI operation checker are displayed in a list, and messages of the results judged based on the definition assigned to the operation person are displayed in a list. Note that, in this embodiment, the definition group to be linked from the alert AI administrator user may be identified, and the definition group to be linked from the alert AI operation checker user may be identified, and the definition and the result may be linked.

[0091] Also, as shown in FIG. 33, the alert AI inquiry screen (screen for each scenario) in this embodiment is an analysis system screen that allows the judgments executed based on the alert AI definition to be individually viewed using graphs, etc., and the judgment result table and the result message table are viewed. Here, as shown in FIG. 33, in the alert AI inquiry screen in this embodiment, the system for viewing the judgment result of the definition belonging to the definition group assigned as the alert AI administrator is displayed on the menu, the system for viewing the judgment result of the definition belonging to the definition group assigned as the alert AI operation checker is displayed on the menu, the system for viewing the judgment result of the definition assigned as the operation person is displayed on the menu, and the output button is displayed only when the operation person has output authority. Note that, in this embodiment, the definition group to be linked from the alert AI administrator user, the definition group to be linked from the alert AI operation checker user, and the definition to be linked from the operation person user may be linked to the definition and the result.

[0092] Also, as shown in FIG. 34, the alert AI execution history log viewer in this embodiment is a system screen that allows viewing of the log and execution history data updated in the database when a judgment is executed, and the judgment log table and judgment history table are the viewing destinations. Here, as shown in FIG. 34, in the alert AI execution history log viewer in this embodiment, the definition group assigned as the alert AI administrator can be selected, and the definition group assigned as the alert AI operation checker can be selected, and only the definitions displayed in the list can be viewed. Note that, in this embodiment, the definition group associated with the alert AI administrator user may be identified, and the definition group associated with the alert AI operation checker user may be identified, and the definition and the result may be associated.

[0093] [4. Contribution to the United Nations-led Sustainable Development Goals (SDGs)] This embodiment can contribute to improving business efficiency and promoting appropriate management decisions by companies, thereby contributing to goals 8 and 9 of the SDGs.

[0094] Furthermore, this embodiment can contribute to reducing waste and promoting paperless and electronic systems, thereby contributing to the achievement of SDGs Goals 12, 13, and 15.

[0095] Furthermore, this embodiment can contribute to strengthening control and governance, making it possible to contribute to Goal 16 of the SDGs.

[0096] 5. Other embodiments The present invention may be embodied in various different embodiments other than those described above within the scope of the technical concept set forth in the claims.

[0097] For example, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods.

[0098] In addition, the processing procedures, control procedures, specific names, information including parameters such as registered data and search conditions for each process, screen examples, and database configurations shown in this specification and drawings may be changed as desired unless otherwise specified.

[0099] Furthermore, with regard to the alert AI management device 100, each of the components shown in the figures is a functional concept, and does not necessarily have to be physically configured as shown in the figures.

[0100] For example, the processing functions of the alert AI management device 100, particularly the processing functions performed by the control unit 102, may be realized in whole or in part by a CPU and a program interpreted and executed by the CPU, or may be realized as hardware using wired logic. The program is recorded in a non-transient computer-readable recording medium that includes programmed instructions for causing the information processing device to execute the processes described in this embodiment, and is mechanically read by the alert AI management device 100 as necessary. That is, a computer program for giving instructions to the CPU in cooperation with the OS and performing various processes is recorded in a storage unit such as a ROM or HDD (Hard Disk Drive). This computer program is executed by being loaded into a RAM, and cooperates with the CPU to form a control unit.

[0101] In addition, this computer program may be stored in an application program server connected to the alert AI management device 100 via any network, and it is also possible to download all or part of it as needed.

[0102] In addition, the program for executing the process described in this embodiment may be stored in a non-transient computer-readable recording medium, or may be configured as a program product. Here, the "recording medium" includes any "portable physical medium" such as a memory card, a Universal Serial Bus (USB) memory, a Secure Digital (SD) card, a flexible disk, a magneto-optical disk, a ROM, an Erasable Programmable Read Only Memory (EPROM), an Electrically Erasable and Programmable Read Only Memory (EEPROM (registered trademark)), a Compact Disk Read Only Memory (CD-ROM), a Magneto-Optical disk (MO), a Digital Versatile Disk (DVD), and a Blu-ray (registered trademark) Disc.

[0103] Moreover, a "program" is a data processing method written in any language or description method, and may be in any form, such as source code or binary code. Note that a "program" is not necessarily limited to a single configuration, but also includes a configuration that is distributed as a plurality of modules or libraries, and a program that achieves its function by cooperating with a separate program, such as an OS. Note that the specific configuration and reading procedure for reading a recording medium in each device shown in this embodiment, as well as the installation procedure after reading, may use well-known configurations and procedures.

[0104] The various databases etc. stored in the memory unit 106 are storage means such as memory devices such as RAM and ROM, fixed disk devices such as hard disks, flexible disks, and optical disks, and store various programs, tables, databases, and web page files etc. used for various processes and providing websites.

[0105] The alert AI management device 100 may be configured as an information processing device such as a known personal computer or workstation, or may be configured as the information processing device to which any peripheral device is connected. The alert AI management device 100 may be realized by installing software (including programs or data) that causes the device to realize the processing described in this embodiment.

[0106] Furthermore, the specific form of distribution and integration of the devices is not limited to that shown in the drawings, and all or part of them can be functionally or physically distributed and integrated in any unit according to various additions or functional loads. In other words, the above-mentioned embodiments can be implemented in any combination, or the embodiments can be implemented selectively. [Industrial Applicability]

[0107] The present invention is useful in a variety of industries that require internal controls to prevent fraud. [Explanation of symbols]

[0108] 100 Alert AI Management Device 102 Control section 102a User Acquisition Section 102b Authority Specification Section 102c System control unit 104 Communication interface section 106 Storage section 106a User Master 106b User Group Master 106c User Group Member Master 106d Alert AI definition group master 106e Alert AI definition group member master 106f Alert AI Management Database 108 Input / Output Interface Section 112 Input Devices 114 Output Device 200 Servers 300 Network

Claims

1. An alert AI management device comprising a storage unit and a control unit, The storage unit is User group member master that links users and user groups, a user alert definition group relation storage means for storing an alert AI definition group compiled according to an audit scenario based on the nature of monitoring content of an alert AI that determines abnormal values ​​during business execution, the user group or the role type of the user, and a user alert definition group relation table that is set by linking the user group; An alert AI definition group master that sets an alert AI definition of the alert AI that constitutes the alert AI definition group; The alert AI definition group and an alert AI definition group member master that is linked and set to the alert AI definition; an abnormal value determination definition storage means for storing an abnormal value determination definition table in which the definition contents of each of the alert AI definitions are set; an alert AI management storage means for storing a control table that sets, for each role type, modification authority and viewing authority for the alert AI definition constituting each of the alert AI definition groups, viewing authority for the change history of the alert AI definition, viewing authority for an alert AI list inquiry based on the alert AI definition, viewing authority for an alert AI detail inquiry based on the alert AI definition, and viewing authority for the alert AI execution history and log based on the alert AI definition; Equipped with The control unit is A user acquisition means for acquiring user data of a user who is a target user for authority identification; an authority specifying means for specifying the role type of the target user and the alert AI definition to which the change authority and / or the viewing authority has been assigned based on the user data, the user group member master, the user alert definition group relation table, the alert AI definition group master, the alert AI definition group member master, and the abnormal value determination definition table; A system control means for controlling, based on the control table, the target user's modification and / or viewing of the alert AI definition identified by the authority identification means, viewing of the change history of the alert AI definition, viewing of the alert AI list inquiry, viewing of the alert AI detail inquiry, and / or viewing of the alert AI execution history and log; An alert AI management device comprising:

2. The role type is: The alert AI management device of claim 1, further comprising: an alert AI administrator who manages the audit scenario; and an alert AI operation checker who is responsible for checking whether any fraud has occurred in the creation and modification of the alert AI definition, and / or whether the audit check is being performed correctly by an operations personnel who performs an audit check to check whether any abnormalities are found in the actual use of the alert AI and / or the alert AI definition assigned by the alert AI administrator.

3. The authority specifying means is The alert AI management device described in claim 1 or 2, characterized in that the role type of the target user is identified based on the linkage between the user data, the user group member master, and the user alert definition group relation table, and the alert AI definition for which the change authority and / or the viewing authority is assigned is identified based on the linkage between the user alert definition group relation table, the alert AI definition group master, the alert AI definition group member master, and the abnormal value judgment definition table.

4. The storage unit is A user alert definition relation storage means for storing the alert AI definition and a user alert definition relation table set by linking the alert AI definition and the user or the user group who is the operation person; Further comprising: The authority specifying means is The alert AI management device of claim 2 further identifies the alert AI definition for which the target user, who is the operations officer, has viewing authority based on the user data, the user group member master, the user alert definition relation table, the alert AI definition group member master, and the abnormal value judgment definition table.

5. The alert AI definition group includes: The alert AI management device according to any one of claims 1 to 4, characterized in that it includes a fictitious order alert definition group, a sales recording alert definition group, a fictitious transaction alert definition group, and / or an expense fraud alert definition group.

6. An alert AI management method to be executed by an alert AI management device having a storage unit and a control unit, The storage unit is User group member master that links users and user groups, a user alert definition group relation storage means for storing an alert AI definition group compiled according to an audit scenario based on the nature of monitoring content of an alert AI that determines abnormal values ​​during business execution, the user group or the role type of the user, and a user alert definition group relation table that is set by linking the user group; An alert AI definition group master that sets an alert AI definition of the alert AI that constitutes the alert AI definition group; The alert AI definition group and an alert AI definition group member master that is linked and set to the alert AI definition; an abnormal value determination definition storage means for storing an abnormal value determination definition table in which the definition contents of each of the alert AI definitions are set; an alert AI management storage means for storing a control table that sets, for each role type, modification authority and viewing authority for the alert AI definition constituting each of the alert AI definition groups, viewing authority for the change history of the alert AI definition, viewing authority for an alert AI list inquiry based on the alert AI definition, viewing authority for an alert AI detail inquiry based on the alert AI definition, and viewing authority for the alert AI execution history and log based on the alert AI definition; Equipped with The control unit executes A user acquisition step of acquiring user data of a target user for which authority is identified; An authority specifying step of specifying the role type of the target user and the alert AI definition to which the change authority and / or the viewing authority has been assigned based on the user data, the user group member master, the user alert definition group relation table, the alert AI definition group master, the alert AI definition group member master, and the abnormal value determination definition table; A system control step of controlling, based on the control table, the target user's modification and / or viewing of the alert AI definition identified in the authority identification step, viewing of the change history of the alert AI definition, viewing of the alert AI list inquiry, viewing of the alert AI detail inquiry, and / or viewing of the alert AI execution history and log; An alert AI management method comprising:

7. An alert AI management program to be executed by an alert AI management device having a storage unit and a control unit, The storage unit is User group member master that links users and user groups, a user alert definition group relation storage means for storing an alert AI definition group compiled according to an audit scenario based on the nature of monitoring content of an alert AI that determines abnormal values ​​during business execution, the user group or the role type of the user, and a user alert definition group relation table that is set by linking the user group; An alert AI definition group master that sets an alert AI definition of the alert AI that constitutes the alert AI definition group; The alert AI definition group and an alert AI definition group member master that is linked and set to the alert AI definition; an abnormal value determination definition storage means for storing an abnormal value determination definition table in which the definition contents of each of the alert AI definitions are set; an alert AI management storage means for storing a control table that sets, for each role type, modification authority and viewing authority for the alert AI definition constituting each of the alert AI definition groups, viewing authority for the change history of the alert AI definition, viewing authority for an alert AI list inquiry based on the alert AI definition, viewing authority for an alert AI detail inquiry based on the alert AI definition, and viewing authority for the alert AI execution history and log based on the alert AI definition; Equipped with In the control unit, A user acquisition step of acquiring user data of a target user for which authority is identified; an authority specifying step of specifying the role type of the target user and the alert AI definition to which the change authority and / or the viewing authority has been assigned based on the user data, the user group member master, the user alert definition group relation table, the alert AI definition group master, the alert AI definition group member master, and the abnormal value determination definition table; A system control step of controlling, based on the control table, the target user's modification and / or viewing of the alert AI definition identified in the authority identification step, viewing of the change history of the alert AI definition, viewing of the alert AI list inquiry, viewing of the alert AI detail inquiry, and / or viewing of the alert AI execution history and log; An alert AI management program for executing the above.

Images