Image forming apparatus and image forming program

Abstract

To perform log abnormality detection with excellent accuracy in comparison to a case of transmitting a log without distinguishing the tendency of the use contents by a user of an image formation apparatus.SOLUTION: An image formation apparatus 10 acquires the type or tendency of the use contents or the use state of the image formation apparatus 10 by a user, and transmits a log about the use by the user in such a manner that the acquired type or tendency of the use contents or use state can be distinguished.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an image forming apparatus and an image forming program. [Background technology]

[0002] Patent document 1 discloses an image forming apparatus that performs processing related to image formation, the image forming apparatus having a log management means for managing generated log information, and a log transfer means for transferring log information of a type set in log transfer information from the log information managed by the log management means to a transfer destination set in the log transfer information.

[0003] Patent Document 2 discloses a network client having a plurality of collection means for collecting a log of detected event information, the network client having a setting means for managing a first table indicating a correspondence between a collection type and at least one of the plurality of collection means, each of the collection means managing a second table indicating a correspondence between a collection type and an event type, the setting means, when receiving an event collection request from an external system in which a collection type and an acquisition trigger are specified, referring to the first table to identify one or more collection means corresponding to the collection type included in the event collection request, and instructing the identified one or more collection means to collect event information based on the collection type and the acquisition trigger, each of the collection means referring to the second table to execute an activation process for collecting event information of an event type corresponding to the collection type included in the instruction by the setting means, in accordance with the acquisition trigger included in the instruction, and notifying the setting means of the execution result of the activation process, the setting means transmitting to the external system a reflection result of the collection type for which the activation process was successful, and after the activation process is performed, a log of the event information collected by the collection means is transmitted via a network. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2006-107217 A [Patent Document 2] JP 2020-086696 A Summary of the Invention [Problem to be solved by the invention]

[0005] There is a technology that transmits logs to a server and detects anomalies on the server. However, it does not take into consideration whether the log contents have changed in response to changes in usage. In other words, it is not possible to distinguish between types or trends of usage contents and types of usage situations, so for example, even if a log is normal in a certain usage situation, an anomaly may be erroneously detected.

[0006] The present invention aims to provide an image forming device and an image forming program that enable accurate detection of abnormalities in logs, compared to when logs are sent without distinguishing the type or tendency of usage by a user of the image forming device, or the type of usage status. [Means for solving the problem]

[0007] The image forming device of the first aspect includes a processor that acquires a type or tendency of usage of the image forming device by a user, or a type of usage status, and transmits a log regarding the usage by the user in a manner that enables the acquired type or tendency of usage, or type of usage status, to be distinguished.

[0008] In a second aspect of the image forming apparatus, in the image forming apparatus of the first aspect, when the processor transmits the log in a distinguishable manner, the processor transmits the log to a destination that is predetermined depending on the type or tendency of the acquired usage content or the type of usage status.

[0009] In a third aspect of the image forming apparatus, in the image forming apparatus of the first aspect, when the processor transmits the log in a distinguishable manner, additional information indicating the type or tendency of the acquired usage content, or the type of usage status, is added to the log and transmitted.

[0010] An image forming apparatus according to a fourth aspect is an image forming apparatus according to any one of the first to third aspects, wherein the processor obtains the type of usage content from setting information set by the user for the image forming apparatus.

[0011] An image forming apparatus according to a fifth aspect is an image forming apparatus according to any one of the first to third aspects, wherein the processor acquires trends in usage from a history of usage of the image forming apparatus by the user.

[0012] In a sixth aspect of the image forming apparatus, in the image forming apparatus of the fifth aspect, the processor obtains trends in usage from the history of usage content for a specified number of times each time the image forming apparatus has been used.

[0013] An image forming program according to a seventh aspect is a program for causing a computer to execute a process of acquiring a type or tendency of usage of an image forming device by a user, or a type of usage status, and transmitting a log regarding usage by the user in a manner that enables the acquired type or tendency of usage, or type of usage status, to be distinguished. Effect of the Invention

[0014] The first and seventh aspects have the advantage of enabling more accurate detection of abnormalities in logs compared to a case in which logs are sent without distinguishing between the type or tendency of usage by a user of the image forming device, or the type of usage status.

[0015] According to the second aspect, it is possible to have the advantage that an abnormality detection can be notified to an appropriate destination, compared to a case where a log is sent to the same destination without distinguishing between the type or tendency of usage by a user of the image forming device, or the type of usage status.

[0016] According to the third aspect, the use of the additional information has the advantage of enabling more accurate detection of abnormalities in the log, compared to a case in which a log is sent without adding additional information indicating the type or tendency of usage by a user of the image forming device or the type of usage status.

[0017] According to the fourth aspect, there is an effect that the type of usage content of the image forming apparatus can be acquired from the setting information set for the image forming apparatus.

[0018] According to the fifth aspect, there is an effect that it is possible to acquire a tendency of the usage of the image forming apparatus from the history of the usage of the image forming apparatus by the user.

[0019] According to the sixth aspect, there is an advantage that it is possible to acquire a more appropriate tendency of usage details, compared to a case in which the tendency of usage details is acquired every time the image forming apparatus is used. [Brief description of the drawings]

[0020] [Figure 1] 1 is a diagram showing an example of the configuration of an image forming system according to a first embodiment and a second embodiment. [Diagram 2] FIG. 1 is a diagram showing an example of a configuration in which the image forming apparatus according to the first and second embodiments is configured using a computer. [Diagram 3] FIG. 2 is a diagram showing an example of a configuration in which the server and the information processing terminal according to the first and second embodiments are configured as a computer. [Figure 4] 2 is a diagram illustrating an example of the configuration of a log processing unit of an image forming apparatus according to the first and second embodiments. FIG. [Diagram 5] 10 is a flowchart showing an example of a specific process executed by the image forming apparatus according to the second embodiment. [Figure 6] 10 is a flowchart showing an example of a specific process executed by the image forming apparatus according to the second embodiment. [Figure 7] 10 is a flowchart showing an example of a specific process executed by the image forming apparatus according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] Hereinafter, the present embodiment will be described with reference to the drawings. Note that the same components and processes are given the same reference numerals throughout the drawings, and duplicated explanations will be omitted.

[0022] [First embodiment] FIG. 1 is a diagram showing an example of the configuration of an image forming system 1 that prints a specified image on a recording medium.

[0023] As shown in FIG. 1, the image forming system 1 includes an image forming apparatus 10, a server 20, and an information processing terminal 30, which are connected to each other via a communication line 2.

[0024] The image forming device 10 is a device with an image forming function that prints an image represented by print data received from the information processing terminal 30 via the communication line 2, or an image obtained by reading an original document, on a recording medium such as paper. As long as the image forming device 10 has an image forming function, it may be a device that includes multiple functions, such as a facsimile and a scanner. In the following, as an example, the image forming device 10 will be described as a device that has only an image forming function.

[0025] The server 20 analyzes the log transmitted from the image forming apparatus 10 via the communication line 2 to detect an abnormality.

[0026] The information processing terminal 30 is an information device having a communication function for transmitting print data stored in a storage device to the image forming apparatus 10 via the communication line 2, such as a smartphone, a tablet computer, or a notebook computer.

[0027] In the example of the image forming system 1 shown in FIG. 1, only one image forming device 10, one server 20, and one information processing terminal 30 are illustrated, but there is no restriction on the number of image forming devices 10, servers 20, and information processing terminals 30 included in the image forming system 1 and there may be multiple units.

[0028] The image forming device 10 transmits a log, and risk analysis and risk detection are performed by the server 20. The image forming device 10 has a variety of functions, and each function is used as if it were a different type of device. For this reason, in order for the server 20 to perform highly accurate risk analysis and risk detection, it is necessary to separately handle the logs of the image forming device 10 with different usage details.

[0029] The log destination is automatically switched by identifying the type of usage of the image forming device 10 based on the setting information of the image forming device 10. This allows for more accurate risk analysis and detection by dividing the log destination according to the type of usage, even for the same type of device.

[0030] In addition, in the image forming device 10, in order to prevent print requests from being accepted from an unspecified number of users for information security reasons, an authentication process is performed in which the users who can use all functions of the image forming device 10 are limited to pre-registered users, and the functions available to other unregistered users are restricted.

[0031] The image forming apparatus 10 in which the log transmission and authentication process are performed includes the following functional sections: a communication section 11, an authentication section 12, a log processing section 13, an image forming section 14, a user IF (Interface) section 15, and a control section 16.

[0032] The communication unit 11 receives a print instruction including print data from the information processing terminal 30 via the communication line 2, and transmits logs related to various events including printing executed by the image forming device 10 to the server 20. Here, the event logs are an example of logs related to usage by users.

[0033] The authentication unit 12 collates the identification information received by the user IF unit 15 with the identification information of a user registered in advance to authenticate whether the user requesting printing is a registered user. Specifically, when the identification information registered in advance in the image forming apparatus 10 includes identification information that matches the identification information received by the user IF unit 15, the authentication unit 12 determines that the user requesting printing is a registered user.

[0034] The identification information used for authentication in the authentication unit 12 may be any information, such as a user ID, that can uniquely identify the user requesting printing.

[0035] Furthermore, depending on the settings of the image forming apparatus 10, it is possible to switch between a case where authentication is performed by the authentication unit 12 and a case where authentication is not performed by the authentication unit 12.

[0036] The log processor 13 uses the communication unit 11 to transmit a log relating to an event to a destination that is determined in advance according to the type of usage of the image forming apparatus 10 by the user.

[0037] Specifically, the log processing unit 13 includes a log recording unit 101, a specifying unit 102, a destination switching unit 103, and a log transmitting unit 104, as shown in FIG.

[0038] The log recording unit 101 sequentially records logs of events occurring in the image forming apparatus 10 in a log storage area of ​​the non-volatile memory 44. Examples of events include "successful user authentication for account XX" and "printing at the user request of account YY".

[0039] The identification unit 102 identifies the type of usage from the setting information of the image forming apparatus 10. Here, the type of usage to be identified is a category suitable for performing appropriate and highly accurate risk analysis and risk detection of the log collected by the server 20, and is determined in advance. Specifically, the type of usage to be identified includes "with authentication" indicating a case where user authentication is performed by the authentication unit 12, and "without authentication" indicating that user authentication is not performed by the authentication unit 12.

[0040] Furthermore, the identifying unit 102 identifies whether the type of usage content is "authenticated" or "unauthenticated" using a setting change related to user authentication as a trigger.

[0041] The destination switching unit 103 switches the destination of the log to a destination that is determined in advance according to the type of the identified usage content.

[0042] Specifically, the log destination table holds the log destination for each type of usage, as shown in Table 1. The log destination is a set of the IP address and port number of the other server.

[0043] The destination switching unit 103 notifies the log transmission unit 104 of the log transmission destination determined from the identified type of usage content and the log transmission destination table, and switches the log transmission destination.

[0044] [Table 1]

[0045] Table 1 shows an example in which a destination for the image forming apparatus 10 without authentication and a destination for the image forming apparatus 10 with authentication are prepared in advance as log destinations for risk analysis and risk detection. In this example, the two destinations have the same IP address but different port numbers.

[0046] Since the log transmission destination (address and port of server 20) may change even for the same type of usage content after operation of image forming apparatus 10, a means for updating the log transmission destination table from the outside may be provided. Furthermore, in order to deal with changes in the type of usage content (increase / decrease, completely different types of usage content, etc.), a means for updating identification unit 102 from the outside may be provided.

[0047] The log transmission unit 104 transmits the log stored in the log storage area of ​​the non-volatile memory 44 to the notified log transmission destination via the communication unit 11.

[0048] The image forming unit 14 prints, on a recording medium, an image represented by print data received from the information processing terminal 30 or an image obtained by scanning an original. There are no restrictions on the image forming method in the image forming unit 14, and any known image forming method such as xerography or inkjet may be used.

[0049] The user IF unit 15 accepts identification information of the user operating the image forming device 10 and instructions from the user, and notifies the control unit 16, and also outputs various information regarding printing performed by the image forming device 10 to the user in accordance with the instructions of the control unit 16.

[0050] The control unit 16 controls the communication unit 11, the authentication unit 12, the log processing unit 13, the image forming unit 14, and the user IF unit 15 so that each of the communication unit 11, the authentication unit 12, the log processing unit 13, the image forming unit 14, and the user IF unit 15 performs the above-mentioned processing.

[0051] 1 is realized by using a computer 40. FIG. 2 is a diagram showing an example of a configuration in which the image forming apparatus 10 is configured by the computer 40.

[0052] The computer 40 includes a CPU (Central Processing Unit) 41, which is an example of a processor responsible for executing the functions of the image forming apparatus 10, a ROM (Read Only Memory) 42 that stores an image forming program that causes the computer 40 to function as the image forming apparatus 10, a RAM (Random Access Memory) 43 used as a temporary work area for the CPU 41, a non-volatile memory 44, and an input / output interface (I / O) 45. The CPU 41, the ROM 42, the RAM 43, the non-volatile memory 44, and the I / O 45 are connected to each other via a bus 46.

[0053] The non-volatile memory 44 is an example of a storage device that maintains stored information even if the power supplied to the non-volatile memory 44 is cut off, and is, for example, a semiconductor memory or a hard disk. The non-volatile memory 44 stores, for example, identification information of a user that has been registered in advance.

[0054] To the I / O 45, for example, a communication unit 47, a UI (User Interface) unit 49, and an image forming unit 50 are connected.

[0055] The communication unit 47 is provided with a communication protocol for performing data communication with the server 20 and the information processing terminal 30 using wired or wireless communication.

[0056] The UI unit 49 is a unit that provides an interface between the image forming apparatus 10 and a user who operates the image forming apparatus 10, and is a device that receives identification information of a user who operates the image forming apparatus 10 and instructions from the user, notifies the CPU 41, and outputs information processed by the CPU 41 to the outside. The UI unit 49 is composed of, for example, a button, a touch panel, and a liquid crystal display, and the touch panel is attached superimposed on the liquid crystal display. Information processed by the CPU 41 is displayed on the liquid crystal display, and processing associated with an object such as a button displayed at a position on the liquid crystal display selected via the touch panel is executed.

[0057] In addition, in the UI unit 49, a display device such as an organic EL (Electro Luminescence) display may be used instead of a liquid crystal display.

[0058] The image forming unit 50 forms an image on a recording medium according to an instruction from the CPU 41 .

[0059] 1 are also realized using a computer 60. FIG. 3 is a diagram showing a configuration example in which the server 20 and the information processing terminal 30 are configured using a computer 60. In FIG.

[0060] The computer 60 includes a CPU 61 which is an example of a processor responsible for executing the functions of the server 20 and the information processing terminal 30, a ROM 62 which stores a program for causing the computer 60 to function as the server 20 and the information processing terminal 30, a RAM 63 which is used as a temporary working area for the CPU 61, a non-volatile memory 64, and an I / O 65. The CPU 61, the ROM 62, the RAM 63, the non-volatile memory 64, and the I / O 65 are each connected via a bus 66.

[0061] In the non-volatile memory 64, for example, print data to be printed by the image forming apparatus 10 is stored.

[0062] To the I / O 65, for example, a communication unit 67 and a UI unit 69 are connected.

[0063] The communication unit 67 is provided with a communication protocol for performing data communication with the image forming apparatus 10 using wired or wireless communication.

[0064] The UI unit 69 is a unit that provides an interface for a user who operates the server 20 and the information processing terminal 30, and receives instructions from the user who operates the server 20 and the information processing terminal 30, notifies the CPU 61, and outputs information processed by the CPU 61 to the outside. Like the UI unit 49 of the image forming apparatus 10, the UI unit 69 is composed of, for example, buttons, a touch panel, and a liquid crystal display, and the touch panel is attached superimposed on the liquid crystal display. Naturally, a display device such as an organic EL display may be used instead of the liquid crystal display.

[0065] Next, the log processing in the image forming apparatus 10 will be described in detail.

[0066] An image forming program that prescribes the log processing is stored in advance in, for example, the ROM 42 of the image forming apparatus 10. The CPU 41 of the image forming apparatus 10 reads the image forming program stored in the ROM 42 and executes the log processing.

[0067] First, the log recording unit 101 of the image forming apparatus 10 sequentially records logs of events occurring within the image forming apparatus 10 in the log storage area of ​​the non-volatile memory 44 .

[0068] Then, the identifying unit 102, using a setting change related to user authentication as a trigger, identifies whether the type of usage content is "authenticated" or "unauthenticated."

[0069] For example, the initial setting is assumed to be "no authentication", and the identifying unit 102 notifies the destination switching unit 103 that the type of usage content is "no authentication".

[0070] Then, when the identified type of usage is "without authentication", the destination switching unit 103 switches the log destination for "without authentication" to "111.222.12.34:50010". Then, the log transmitting unit 104 transmits the log stored in the log storage area of ​​the non-volatile memory 44 to the destination for "without authentication" log processing of the server 20 via the communication unit 11. Thereafter, unless the setting for the authentication processing is changed, the log destination is not changed, and the log transmitting unit 104 transmits the log to the same destination.

[0071] Then, when the setting of the image forming device 10 is changed from "without authentication" to "with authentication", the identification unit 102 identifies that the type of usage has changed from "without authentication" to "with authentication" and notifies the destination switching unit 103.

[0072] Then, the destination switching unit 103 notifies the log sending unit 104 of the identified type of usage "authenticated" and the log sending destination to change the log sending destination to "111.222.12.34:50020" from the log sending destination table. Then, the log sending unit 104 transmits the log stored in the log storage area of ​​the non-volatile memory 44 to the notified log sending destination via the communication unit 11.

[0073] This completes the explanation of the log processing.

[0074] Then, the server 20 performs risk analysis and risk detection on the log transmitted to the destination for "unauthenticated" log processing.

[0075] Specifically, the server 20 performs risk analysis and risk detection on the logs sent to the destination for "authenticated" log processing. Here, even in the case of "authenticated", an unregistered user can use limited functions as a guest user. In this case, when the server 20 detects a sudden increase in use by guest users from the logs sent to the destination for "authenticated" log processing, it determines that a risk has been detected.

[0076] For example, the server 20 tallies the frequency of use by authenticated users and the frequency of use by guest users per unit time, and determines that a risk has been detected if the rate of change in the frequency of each method of use exceeds a threshold value.

[0077] In addition, in the case of "no authentication", the user operates the image forming apparatus 10 as a guest user. Therefore, even if the server 20 detects a sudden increase in guest user usage from the log transmitted to the destination for "no authentication" log processing, the server 20 does not determine that a risk has been detected.

[0078] For example, in an environment with 1,000 image forming devices 10, if only 100 image forming devices 10 are operating "without authentication," when the usage of these 100 devices increases, it may appear that usage by guest users has increased overall, and risk may be detected as a sign of some kind of unauthorized use. In this embodiment, the server 20 performs risk analysis and risk detection from the log sent to the destination for "without authentication" log processing, so that it is not determined that a risk has been detected even in the above-mentioned situation. This makes it possible to reduce false detection of risk.

[0079] In this way, by separating the log transmission destinations into those with and without authentication, it becomes possible to carry out different risk analyses and risk detections.

[0080] As described above, according to the first embodiment, it is possible to detect abnormalities in logs with high accuracy compared to a case where logs are sent without distinguishing the type of usage by a user of an image forming apparatus. In addition, even if settings related to the usage of an image forming apparatus are changed, it is possible to prevent a decrease in the accuracy of risk analysis and risk detection.

[0081] [Second embodiment] Next, an image forming system according to a second embodiment will be described. Note that since the image forming system according to the second embodiment has the same configuration as that of the first embodiment, the same reference numerals are used and the description will be omitted.

[0082] The second embodiment differs from the first embodiment in that the destination of the log is switched depending on the tendency of the user's usage.

[0083] The log processor 13 of the image forming apparatus 10 of the second embodiment uses the communication unit 11 to transmit a log relating to an event to a destination that is determined in advance according to the tendency of the user's use of the image forming apparatus 10.

[0084] The identifying unit 102 of the log processing unit 13 identifies a usage tendency from the usage history of the image forming device 10. Here, the usage tendency to be identified is a category suitable for performing appropriate and highly accurate risk analysis and risk detection of the log collected by the server 20, and is determined in advance. Specifically, the usage tendency to be identified includes "for copying", which indicates that the function of printing an image obtained by scanning a document is likely to be used, "for printing", which indicates that the function of printing an image represented by received print data is likely to be used, and "for both copying and printing", which indicates that both the function of printing an image obtained by scanning a document and the function of printing an image represented by received print data are likely to be used.

[0085] In addition, the identification unit 102, when the number of printing attempts reaches a predetermined number, identifies whether the usage tendency is "for copying," "for printing," or "for both copying and printing."

[0086] Here, a usage history is stored in the image forming apparatus 10. Examples of the usage history include, as shown in Table 2, the number of copies, which is the number of times a function for printing an image obtained by scanning an original was used, and the number of prints, which is the number of times a function for printing an image represented by accepted print data was used.

[0087] [Table 2]

[0088] Table 2 shows an example of the usage history at the time of initial installation in which the number of copies is 0 and the number of prints is 0.

[0089] Every time printing is performed, the number of copies or prints is counted up and saved as a usage history.

[0090] The identifying unit 102 identifies the tendency of the usage contents, for example, each time the total number of times for triggering the identifying process, which is counted, reaches a threshold value (for example, 1000 times).

[0091] When identifying the usage tendency, the identifying unit 102 identifies the usage tendency as "for copying" if the number of copies is 90% or more of the total number. Also, the identifying unit 102 identifies the usage tendency as "for printing" if the number of prints is 90% or more of the total number. The total number used here is the sum of the number of copies and the number of prints in the usage history, and is different from the value of the trigger total number that is reset each time the usage tendency is identified.

[0092] If the usage tendency was previously identified as "for copying," the identifying unit 102 identifies the usage tendency as "for both copying and printing" when the number of copies becomes 80% or less of the total number of copies.

[0093] If the usage tendency was previously identified as "for printing," and the number of prints falls to 80% or less of the total number of prints, the identifying unit 102 identifies the usage tendency as "for both copying and printing."

[0094] Here, the reason why the tendency of the usage contents is not identified until the total number of times for triggering reaches the threshold value (1000 times) is that it is difficult to determine whether copying or printing is mainly used while the total number is small. For example, if the tendency of the usage contents is identified every time the image forming device 10 is used, and the first copy, the second print, and the third copy are used, the copying ratio will transition from 100%, 50%, and 100%, and the tendency of the usage contents will be different each time, and the log transmission destination will be changed. Therefore, in this embodiment, the tendency of the usage contents is identified every time the total number of times for triggering reaches the threshold value.

[0095] In addition, when the number of copies falls below 80% of the total, or when the number of prints falls below 80% of the total, the usage trend is determined to be "both copying and printing." This is to avoid frequent changes in usage trends and changes in the log destination due to frequent changes around 90%.

[0096] The destination switching unit 103 switches the destination of the log to a predetermined destination depending on the identified tendency of the usage content.

[0097] Specifically, the log destination table holds log destinations for each usage tendency, as shown in Table 3. A log destination is a set of the IP address and port number of the other server.

[0098] The destination switching unit 103 notifies the log transmission unit 104 of the log transmission destination determined from the identified tendency of the usage content and the log transmission destination table, and switches the log transmission destination.

[0099] [Table 3]

[0100] Table 3 shows an example in which a destination for a "copy" image forming device 10, a destination for a "print" image forming device 10, and a destination for a "dual copy / print" image forming device 10 are prepared in advance as log destinations for risk analysis and risk detection. In this example, the three destinations have the same IP address but different port numbers.

[0101] The log transmission unit 104 transmits the log stored in the log storage area of ​​the non-volatile memory 44 to the notified log transmission destination via the communication unit 11.

[0102] Next, the log processing in the image forming apparatus 10 will be described in detail.

[0103] An image forming program that prescribes the log processing is stored in advance in, for example, the ROM 42 of the image forming apparatus 10. The CPU 41 of the image forming apparatus 10 reads the image forming program stored in the ROM 42 and executes the log processing.

[0104] First, the log recording unit 101 of the image forming apparatus 10 sequentially records logs of events occurring within the image forming apparatus 10 in the log storage area of ​​the non-volatile memory 44 .

[0105] Then, at the time of initial installation or when the usage tendency was previously determined to be "copy and print", the determination unit 102 executes the determination process shown in Fig. 5. Here, the total number of triggers is reset to 0.

[0106] First, in step S200, the CPU 41 waits for a trigger for a process for identifying a usage tendency to occur. For example, when printing is performed in the image forming device 10, the number of copies or prints and the total number for triggering are counted up, and the CPU 41 proceeds to step S201.

[0107] In step S201, the CPU 41 determines whether the total number of times for triggering is equal to or greater than a threshold value (for example, 1000 times). For example, when the total number of times for triggering reaches 1000 times, the CPU 41 proceeds to step S202. On the other hand, when the total number of times for triggering is less than 1000 times, the CPU 41 returns to step S200.

[0108] For example, if the number of copies is 792, the number of prints is 1, and the total number for triggers is 793, the total number for triggers is less than 1000, so the tendency of the usage is not identified. On the other hand, if the number of copies is 983, the number of prints is 17, and the total number for triggers has reached 1000, the tendency of the usage is identified.

[0109] In step S202, the CPU 41 determines the ratio of the number of prints or copies to the total number of times based on the usage history. If the ratio of the number of prints to the total number of times is 90% or more, the CPU 41 proceeds to step S205. If the ratio of the number of copies to the total number of times is 90% or more, the CPU 41 proceeds to step S204. Otherwise, the CPU 41 proceeds to step S203.

[0110] In step S203, the CPU 41 resets the total number of triggers to 0, and the process returns to step S200. At this time, the tendency of the usage content remains specified as "both copy and print".

[0111] In step S204, CPU 41 identifies the tendency of the usage content as "for copying" and notifies destination switching unit 103 that the tendency of the usage content is "for copying." For example, if the number of copies is 983 and the number of prints is 17, the proportion of copies is 98.3% (=983÷1000×100), and therefore the tendency of the usage content is identified as "for copying."

[0112] In step S205, CPU 41 identifies the tendency of the usage content to be "for printing" and notifies transmission destination switching unit 103 that the tendency of the usage content is "for printing".

[0113] In step S206, the CPU 41 resets the total number of times for triggering to 0, and ends the identification process.

[0114] Furthermore, if the usage tendency was previously identified as "for printing", the identifying unit 102 executes the identifying process shown in Fig. 6. Here, the total number of times for triggering is reset to 0.

[0115] First, in step S210, the CPU 41 waits for the occurrence of a trigger for the process of identifying the tendency of the usage contents, similarly to the above-mentioned step S200.

[0116] In step S211, the CPU 41 determines whether the total number of times for triggering is equal to or greater than a threshold value (for example, 1000 times). For example, when the total number of times for triggering reaches 1000 times, the CPU 41 proceeds to step S212. On the other hand, when the total number of times for triggering is less than 1000 times, the CPU 41 returns to step S210.

[0117] In step S212, the CPU 41 determines the ratio of the number of prints to the total number of prints based on the usage history. If the ratio of the number of prints to the total number of prints is 80% or less, the CPU 41 proceeds to step S214. If the ratio of the number of prints to the total number of prints is greater than 80%, the CPU 41 proceeds to step S213.

[0118] In step S213, the CPU 41 resets the total number of times for triggering to 0, and returns to step S210. At this time, the tendency of the usage content remains specified as "for printing".

[0119] In step S214, CPU 41 identifies the tendency of the usage content as "dual use for copying and printing" and notifies destination switching unit 103 that the tendency of the usage content is "dual use for copying and printing".

[0120] For example, if the number of copies is 1,458 and the number of prints is 365, the copying ratio is 79.98% (=1,458 ÷ (1,458 + 365) × 100), so the usage trend is identified as "both copying and printing."

[0121] In step S215, the CPU 41 resets the total number of times for triggering to 0, and ends the identification process.

[0122] Furthermore, if the usage tendency was previously identified as "for copying", the identifying unit 102 executes the identifying process shown in Fig. 7. Here, the total number of times for triggering is reset to 0.

[0123] First, in step S220, the CPU 41 waits for a trigger to occur for the process of identifying the tendency of the usage contents, similarly to the above-mentioned step S200.

[0124] In step S221, the CPU 41 determines whether the total number of times for triggering is equal to or greater than a threshold value (for example, 1000 times). For example, when the total number of times for triggering reaches 1000 times, the CPU 41 proceeds to step S222. On the other hand, when the total number of times for triggering is less than 1000 times, the CPU 41 returns to step S220.

[0125] In step S222, the CPU 41 determines the ratio of the number of copies to the total number of copies based on the usage history. If the ratio of the number of copies to the total number of copies is 80% or less, the CPU 41 proceeds to step S224. If the ratio of the number of copies to the total number of copies is greater than 80%, the CPU 41 proceeds to step S223.

[0126] In step S223, the CPU 41 resets the total number of times for trigger to 0, and returns to step S220. At this time, the tendency of the usage content remains specified as "for copying".

[0127] In step S224, CPU 41 identifies the tendency of the usage content as "dual use for copying and printing" and notifies destination switching unit 103 that the tendency of the usage content is "dual use for copying and printing".

[0128] In step S225, the CPU 41 resets the total number of times for triggering to 0, and ends the identification process.

[0129] Then, for example, when the identified tendency of the usage is "for copying", the destination switching unit 103 switches the log destination for "for copying" to "111.222.12.34:50010". Then, the log transmitting unit 104 transmits the log stored in the log storage area of ​​the non-volatile memory 44 to the destination for "for copying" log processing of the server 20 via the communication unit 11. Thereafter, unless the tendency of the usage changes, the log destination is not changed, and the log transmitting unit 104 transmits the log to the same destination.

[0130] Furthermore, when the identified tendency of the usage is "for printing", the destination switching unit 103 switches the log destination for "for printing" to "111.222.12.34:50020". Then, the log transmission unit 104 transmits the log stored in the log storage area of ​​the non-volatile memory 44 to the destination for "for printing" log processing of the server 20 via the communication unit 11.

[0131] Furthermore, when the identified usage tendency is "dual use of copy and print," destination switching unit 103 switches the log destination for "dual use of copy and print" to "111.222.12.34:50030." Then, log transmission unit 104 transmits the log stored in the log storage area of ​​non-volatile memory 44 to the destination for "dual use of copy and print" log processing of server 20 via communication unit 11.

[0132] This completes the explanation of the log processing.

[0133] Then, the server 20 performs risk analysis and risk detection for each of the logs sent to the destination for "copy" log processing, the logs sent to the destination for "print" log processing, and the logs sent to the destination for "both copy and print" log processing.

[0134] Specifically, the server 20 performs risk analysis and risk detection on the log sent to the destination for "copying" log processing. For example, when the server 20 detects a sudden increase in printing from the log sent to the destination for "copying" log processing, it determines that a risk has been detected. As a result, if printing suddenly increases when copying is the only activity being carried out, this is considered to be a sign of some kind of document leakage, and a risk is detected.

[0135] Furthermore, even if the server 20 detects a sudden increase in print usage from the log transmitted to the transmission destination for "print" log processing, it does not determine that a risk has been detected.

[0136] In this way, by separating the log destinations for copying and printing, it becomes possible to carry out different risk analyses and risk detections.

[0137] For example, in a situation where 1,000 image forming devices 10 are in operation, 900 image forming devices 10 are used for copying, and 100 image forming devices 10 are used for printing, if the frequency of use of these 100 devices increases, it may appear that the number of prints has increased sharply, and a risk may be detected. In this embodiment, the server 20 performs risk analysis and risk detection from the log sent to the destination for "print" log processing, so that it is not determined that a risk has been detected even in the above situation. This makes it possible to reduce false detection of risks.

[0138] In this way, by separating the log destinations into "copying," "printing," and "both copying and printing," it becomes possible to carry out different risk analyses and risk detections.

[0139] As described above, according to the second embodiment, it is possible to detect abnormalities in logs with high accuracy compared to a case where logs are sent without distinguishing the usage trends of users of the image forming apparatus. Furthermore, even if there is a change in the way the image forming apparatus is used, it is possible to prevent a decrease in the accuracy of risk analysis and risk detection.

[0140] Although one aspect of the image forming system 1 has been described above using the embodiment, the disclosed form of the image forming system 1 is merely an example, and the form of the image forming system 1 is not limited to the scope described in the embodiment. Various changes or improvements can be made to the embodiment without departing from the gist of the present disclosure, and forms with such changes or improvements are also included in the technical scope of the disclosure.

[0141] For example, the identifying unit 102 may identify the type of usage status (installation location, temperature, etc.) from the position information or sensor information, and transmit the log to a destination determined for the type of usage status.

[0142] In addition, although the case where the destination of the log is switched has been described as an example, the present invention is not limited to this. Any other method may be used as long as the log can be transmitted in a manner that allows the type or tendency of the usage content, or the type of usage situation to be distinguished. For example, additional information indicating the identified type or tendency of the usage content, or the type of usage situation, may be added to the log and transmitted to the server 20.

[0143] In addition, the example has been described in which there is one server 20, and a port is provided as a destination of logs for each type or tendency of usage, but the present invention is not limited to this. Multiple servers may be provided, and any one of the servers may be used as a destination of logs for each type or tendency of usage.

[0144] In the above embodiment, the processes are implemented by software. However, the processes equivalent to the flowcharts shown in Fig. 5 to Fig. 7 may be implemented by hardware. In this case, the processes can be implemented at a higher speed than when the processes are implemented by software.

[0145] In the above embodiment, the term "processor" refers to a processor in a broad sense, including general-purpose processors (e.g., CPU 41 and CPU 61) and dedicated processors (e.g., GPU: Graphics Processing Unit, ASIC: Application Specific Integrated Circuit, FPGA: Field Programmable Gate Array, programmable logic device, etc.).

[0146] In addition, the operations of the processor in the above embodiment may be performed not only by one processor but also by multiple processors located at physically separate locations working together. The order of the operations of the processor is not limited to the order described in the above embodiment and may be changed as appropriate.

[0147] In the above embodiment, an example in which the image forming program is stored in the ROM 42 has been described, but the storage destination of the image forming program is not limited to the ROM 42. The image forming program of the present disclosure can also be provided in a form recorded in a storage medium readable by the computer 40. For example, the image forming program may be provided in a form recorded in an optical disk such as a CD-ROM (Compact Disk Read Only Memory) or a DVD-ROM (Digital Versatile Disk Read Only Memory). The image forming program may also be provided in a form recorded in a portable semiconductor memory such as a USB (Universal Serial Bus) memory or a memory card.

[0148] The ROM 42, the ROM 62, the non-volatile memory 44, the non-volatile memory 64, a CD-ROM, a DVD-ROM, a USB, and a memory card are examples of non-transitory storage media.

[0149] Furthermore, the image forming apparatus 10 may download an image forming program from an external device (not shown) connected to a wireless LAN and store the downloaded image forming program in a non-transitory storage medium. In this case, the CPU 41 of the image forming apparatus 10 reads the image forming program downloaded from the external device (not shown) and executes log processing. [Explanation of symbols]

[0150] 1. Image forming system 2. Communication lines 10 Image forming device 11 Communications Department 12 Authentication Section 13 Log processing section 14 Image forming section 16 Control section 20 Servers 30 Information processing terminal 40, 60 Computer 41, 61 CPU 44, 64 Non-volatile memory 50 Image forming unit 101 Log Recording Section 102 Specific section 103 Destination Switching Unit 104 Log transmission unit

Claims

1. A processor is provided. The processor, As a type of usage of the image forming apparatus by a user, whether or not user authentication is to be performed to authenticate whether the user is a registered user is specified; When it is determined that the user authentication is to be performed, a log relating to the use by the user is transmitted to a destination that is predetermined for the case where the user authentication is to be performed; When it is determined that the user authentication is not to be performed, the log is transmitted to a destination that is a predetermined destination for a case where the user authentication is not performed and is different from a predetermined destination for a case where the user authentication is performed. Image forming device.

2. The processor, When sending the log, The image forming apparatus according to claim 1 , further comprising: transmitting the log together with additional information indicating the type of the identified usage.

3. The processor, 3. The image forming apparatus according to claim 1, wherein the type of the usage content is identified from setting information set by the user for the image forming apparatus.

4. On the computer, As a type of usage of the image forming apparatus by a user, whether or not user authentication is to be performed to authenticate whether the user is a registered user is specified; When it is determined that the user authentication is to be performed, a log relating to the use by the user is transmitted to a destination that is predetermined for the case where the user authentication is to be performed; When it is determined that the user authentication is not to be performed, the log is transmitted to a destination that is a predetermined destination for a case where the user authentication is not performed and is different from a predetermined destination for a case where the user authentication is performed. An image forming program for executing the process.

Images