Information Processing Apparatus and Information Processing Program

Abstract

To reduce the number of erroneous alarms regarding operation contents performed on an information apparatus, as compared with the case where highly dangerous operation contents are defined in advance and an alarm is always outputted when a defined dangerous operation content is performed on an information apparatus.SOLUTION: An operation content of operation performed on each information apparatus 12 which is the object of management of an apparatus management server 14 and event information that indicates an event that caused to the information apparatus 12 by operation of the operation content are stored in association in an operation log database 48. An alarm output unit 54 refers to the operation log database 48 and extracts the operation content of operation upon a plurality of information apparatuses 12 associated with the same event. When operation of an operation content (minor operation content) different from other information apparatuses 12 is being performed on a smaller number of information apparatuses 12 than a threshold among the plurality of information apparatuses 12 on which operation of the extracted operation content is performed, the alarm output unit 54 outputs an alarm regarding the minor operation content.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present invention relates to an information processing apparatus and an information processing program.

Background Art

[0002] Conventionally, an information processing apparatus for managing events occurring in a plurality of information devices has been proposed.

[0003] For example, Patent Document 1 discloses that information related to events occurring in each information device is transmitted to a security management server, and the security management server determines whether a predefined event has occurred in common among a plurality of information devices based on the information from each information device. Further, Patent Document 2 discloses an operation management support apparatus capable of displaying a list of events occurring in a plurality of information devices to be managed.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0005] By the way, in order to cause a certain event to occur in an information device, an operation with highly dangerous operation content may be performed. Here, the highly dangerous operation content means operation content that can cause damage to the information device or a system including the information device. For example, as highly dangerous operation content, when updating the firmware of an information device, a secret special operation for obtaining privileges related to the firmware update, an operation of logging in without a password from an operation unit provided in the information device, and the like can be mentioned.

[0006] If a malicious person performs highly dangerous operation content, the information device or the system including the information device may be damaged. Therefore, it is conceivable to define in advance highly dangerous operation content and output a warning when the defined highly dangerous operation content is performed on the information device.

[0007] Here, depending on the installation environment of the information device, highly dangerous operation content may mainly be performed as operation content for causing a certain event. For example, within a company building with thorough access control, since the possibility of an outsider entering is extremely low, highly dangerous operation content can be used daily.

[0008] In such a case, if a warning is output when the highly dangerous operation content is performed, the warning will be a false warning (that is, outputting a warning when there is actually no danger). On the other hand, when an operation that is considered truly dangerous is performed in the installation environment of each information device, it is desirable to output a warning appropriately.

[0009] An object of the present invention is to reduce the number of false warnings regarding the operation content performed on an information device as compared with the case where highly dangerous operation content is defined in advance and a warning is always output when the defined highly dangerous operation content is performed on the information device.

Means for Solving the Problem

[0010] The invention according to claim 1 comprises a processor, and the processor receives, from a plurality of information devices, operation contents of operations performed on the information devices, where the operation contents are associated with event information indicating an event caused by the operations on the information devices, accumulatively stores and remembers the operation contents in an operation log database, refers to the operation log database, and when operations of different operation contents associated with the same event are performed on a plurality of information devices, and when operations of a small number of operation contents, which are different from those of the other information devices, are performed on a number of the information devices equal to or less than a threshold number among the plurality of information devices, outputs a warning regarding the small number of operation contents. An information processing apparatus is characterized by this. The invention according to claim 2 is the information processing apparatus according to claim 1, characterized in that the number of the information devices equal to or less than the threshold number is the number of the information devices equal to or less than a threshold ratio among the plurality of information devices. The invention according to claim 3 is the information processing apparatus according to claim 1 or 2, characterized in that the processor refers to a threshold number database in which different operation content-specific threshold numbers, which are different threshold numbers for each of the plurality of operation contents, are associated with each of the plurality of operation contents, and when operations of different operation contents associated with the same event are performed on a plurality of information devices, and when operations of the operation contents associated with the operation content-specific threshold number in the threshold number database are performed on a number of the information devices equal to or less than the operation content-specific threshold number among the plurality of information devices, outputs the warning. The invention according to claim 4 is the information processing apparatus according to claim 1, characterized in that the processor determines, based on state information indicating the state of the information device, whether the information device has fallen into an abnormal state, and when the operation of the small number of operation contents is performed on the information device that has fallen into the abnormal state, does not output the warning. In the invention according to claim 5, the operation content stored and accumulated in the operation log database is further associated with information indicating whether the operation of the operation content is a maintenance operation for performing maintenance on the information device. When the processor performs an operation of the minority operation content on the information device that has fallen into the abnormal state, and when the minority operation content is the maintenance operation, the processor does not output the warning. The information processing apparatus according to claim 4 is characterized in that. In the invention according to claim 6, when the processor receives a notification that the output warning is a false warning, and then, when the minority operation content related to the warning is performed on the information device related to the warning, the processor does not output a warning. The information processing apparatus according to claim 1 is characterized in that. In the invention according to claim 7, the operation content stored and accumulated in the operation log database is further associated with information indicating whether the operation related to the operation content is a maintenance operation for performing maintenance on the information device. When the processor receives a notification that the output warning is a false warning, and then, when the minority operation content related to the warning is performed on the information device related to the warning, and when the minority operation content is the maintenance operation, the processor does not output a warning. The information processing apparatus according to claim 6 is characterized in that. The invention according to claim 8 is an information processing program for causing a computer to receive, from a plurality of information devices, operation content of an operation performed on the information device, the operation content being associated with event information indicating an event caused by the operation of the operation content, and storing and accumulating the operation content in an operation log database, and referring to the operation log database, when operations of different operation contents associated with the same event are performed on a plurality of information devices, and when an operation of a minority operation content, which is different from the other information devices, is performed on a number of the information devices equal to or less than a threshold number among the plurality of information devices, causing a warning regarding the minority operation content to be output.

Effect of the Invention

[0011] According to the invention according to claim 1 or 8, by defining in advance highly dangerous operation contents and outputting a warning whenever the defined highly dangerous operation contents are performed on an information device, it is possible to reduce the number of false warnings regarding the operation contents performed on the information device as compared with the case where a warning is always output. According to the invention according to claim 2, a warning can be output when an operation of a small number of operation contents is performed on a number of information devices equal to or less than a threshold ratio among a plurality of information devices. According to the invention according to claim 3, a warning can be output when an operation of a small number of operation contents is performed on a number of information devices equal to or less than the threshold number for each operation content corresponding to the operation content among a plurality of information devices. According to the invention according to claim 4, it is possible to prevent false warnings regarding operations of a small number of operation contents on information devices in an abnormal state. According to the invention according to claim 5, it is possible to prevent false warnings regarding maintenance operations on information devices in an abnormal state. According to the invention according to claim 6, it is possible to prevent re-occurrence of false warnings regarding a combination of an information device and an operation of a small number of operation contents, where it has been notified in the past that the warning was a false warning. According to the invention according to claim 7, it is possible to prevent re-occurrence of false warnings regarding a combination of an information device and an operation of a small number of operation contents that is a maintenance operation, where it has been notified in the past that the warning was a false warning.

Brief Description of the Drawings

[0012]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Embodiment for Carrying Out the Invention

[0013] FIG. 1 is a schematic configuration diagram of an information processing system 10 according to the present embodiment. The information processing system 10 includes a plurality of information devices 12 and a device management server 14 as an information processing device. Each information device 12 and the device management server 14 are communicably connected to each other via a communication line 16 including, for example, an Internet line or a LAN (Local Area Network).

[0014] The device management server 14 is a device that manages the information devices 12 included in the information processing system 10, that is, a plurality of information devices 12 to be managed. Specifically, the device management server 14 monitors events (in other words, events) generated by operations of a user or other devices in a plurality of information devices 12 to be managed, and detects security risks generated by the events. Managing security risks occurring in each information device in this way is also called SIEM (Security Information and Event Management). Thus, it can be said that the information processing system 10 is an information device management system that manages a plurality of information devices 12.

[0015] Although it will be described in detail later, when it is determined that an abnormal operation has been performed on any of the plurality of information devices 12 to be managed with respect to the information device 12 or the information processing system 10, the device management server 14 outputs a warning. An abnormal operation is an operation that the administrator of the information processing system 10, the information device 12, or the device management server 14 (hereinafter simply referred to as "administrator") has not assumed. An abnormal operation may be an operation that is likely to be an operation performed by a malicious third party attempting to damage the information processing system 10 or the information device 12.

[0016] A plurality of information devices 12 to be managed by one device management server 14 are in similar installation environments (or usage environments). For example, a plurality of information devices 12 installed in one building, or a plurality of information devices 12 used within one company, are the management targets of one device management server 14.

[0017] Although not shown in FIG. 1, the information processing system 10 may further include a manager terminal which is a computer used by a manager, or a remote server that executes a process for updating the firmware of each information device 12.

[0018] FIG. 2 is a schematic configuration diagram of the information device 12. In the present embodiment, each information device 12 is an image processing device (in other words, a multifunction device) having functions such as a printing function, a scanning function, a copying function, and a fax transmission function. However, the information device 12 is not limited to an image processing device, and any device may be used as long as it is operated by a user or another device and thereby causes some event to occur in the information device 12.

[0019] The communication interface 20 is configured to include, for example, a network adapter. The communication interface 20 functions to communicate with the device management server 14 and other devices via the communication line 16. The communication interface 20 receives instructions from other devices. For example, it receives a firmware update instruction from a remote server or a setting change instruction from a manager terminal. The information device 12 causes events (such as firmware update and setting change) in response to these instructions. In this specification, the operations performed on the information device 12 include not only the user directly operating the information device 12 but also transmitting instructions remotely (that is, via the communication line 16) as described above.

[0020] The input interface 22 is configured to include, for example, a touch panel, buttons, etc. The input interface 22 receives the user's operation, thereby receiving the user's instruction to the information device 12. The user can cause an event corresponding to the operation content to occur in the information device 12 by performing an operation with a predetermined operation content on the input interface 22.

[0021] The display 24 is configured to include, for example, a liquid crystal panel. Various display screens are displayed on the display 24.

[0022] The memory 26 is configured to include, for example, an HDD (Hard Disk Drive), an SSD (Solid State Drive), an eMMC (embedded Multi Media Card), a ROM (Read Only Memory), or a RAM (Random Access Memory), etc. The memory 26 stores a device ID that uniquely identifies the information device 12, firmware which is software for operating the information device 12, and setting information indicating the settings of the information device 12, etc.

[0023] The processor 28 refers to a processor in a broad sense and is configured to include at least one of a general-purpose processor (such as a CPU (Central Processing Unit), etc.) and a dedicated processing device (such as a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a programmable logic device, etc.). The processor 28 may be composed not by one processing device but by the cooperation of a plurality of physically separated processing devices. The processor 28 controls each part of the information device 12.

[0024] In addition to the above, the information device 12 may include a printer that prints image data on a printing medium such as paper, or a scanner that reads a paper document and generates image data.

[0025] FIG. 3 is a schematic configuration diagram of the device management server 14. The device management server 14 is configured by, for example, a server computer or the like. Note that the device management server 14 may be configured from a plurality of computers. That is, the functions exhibited by the device management server 14 described below may be realized by the cooperation of a plurality of computers.

[0026] The communication interface 40 includes, for example, a network adapter or the like. The communication interface 40 functions to communicate with each information device 12 via the communication line 16.

[0027] The memory 42 includes, for example, an HDD, an SSD, an eMMC, a ROM, or a RAM. An information processing program for operating each part of the device management server 14 is stored in the memory 42. Further, as shown in FIG. 3, a device DB (Data Base) 44, an operation content DB 46, an operation log DB 48, and a threshold number DB 50 are stored in the memory 42.

[0028] Information regarding a plurality of information devices 12 to be managed by the device management server 14 is stored in the device DB 44.

[0029] FIG. 4 is a conceptual diagram showing an example of the content of the device DB 44. In this embodiment, it is assumed that the information processing system 10 includes 20 information devices 12 (that is, there are 20 information devices 12 to be managed by the device management server 14). Therefore, information regarding 20 information devices 12 is shown in FIG. 4. In the device DB 44, a device ID that is an identifier for uniquely identifying the information device 12, an error history indicating the history of errors (malfunctions) that have occurred in the information device 12 in the past, and status information indicating the state of the information device are stored in association with each other.

[0030] The error history can be received from each information device 12. For example, when an error (here, an error of a level that causes the information device 12 to malfunction) occurs in each information device 12, the information device 12 transmits an error notification to the device management server 14 together with the device ID of its own device. The processor 52 (described later) of the device management server 14 stores the reception time of the error notification (in other words, the error occurrence time) in the device DB 44 in association with the device ID received from the information device 12. Also, the error history of each information device 12 may be manually input into the device management server 14 by an administrator or the like.

[0031] The states that each information device 12 can take include a normal state in which the information device 12 can operate normally and an abnormal state in which the information device 12 cannot operate normally. The state of each information device 12 can be determined by the processor 52 based on the error history that has occurred in the information device 12. For example, an information device 12 in which an error has occurred within the past three days from the current time can be set as an abnormal state, and other information devices 12 can be set as a normal state. Also, the state of each information device 12 may be manually input into the device management server 14 by an administrator or the like.

[0032] In the operation content DB 46, the operation content for the information device 12 to be managed and the event (event) that occurs in the information device 12 due to the operation content are stored in association with each other. The information stored in the operation content DB 46 is input by an administrator or the like. In particular, the operation content DB 46 stores the operation content for causing an event that can damage the information device 12 or the information processing system 10. Also, in the operation content DB 46, a plurality of operation contents for causing one event are associated with each other. That is, in each information device 12, a plurality of operation contents for causing one event are prepared in advance. In this embodiment, it is assumed that the same event occurs with the same operation content in all the information devices 12 to be managed.

[0033] FIG. 5 is a conceptual diagram showing an example of the content of the operation content DB 46. In the example of FIG. 5, as events, firmware update and security setting update are stored. If the firmware of the information device 12 is updated by a person other than the administrator, there is a possibility that a problem may unexpectedly occur in the information processing system 10. Alternatively, if the security settings are changed by a person other than the administrator, there may be a case where an operation that causes a problem in the information processing system 10 becomes possible in the information device 12. Therefore, these events are stored in the operation content DB 46.

[0034] For example, in the example of FIG. 5, as the operation content for updating the firmware in each information device 12, receiving an automatic instruction from a remote server for firmware update and the user performing a special operation on the local panel of the information device 12 (that is, the input interface 22) are shown. Note that the special operation is basically the operation content that is not disclosed to general users and should originally be known only to the administrator.

[0035] In the operation log DB 48, the operation content of the operation performed on each information device 12 to be managed and the event information indicating the event caused in the information device 12 by the operation of the operation content are stored in association with each other.

[0036] FIG. 6 is a conceptual diagram showing an example of the content of the operation log DB 48. In the operation log DB 48, the device ID of the information device 12, the operation time and operation content of the operation performed on the information device 12, and the event caused in the information device 12 by the operation of the operation content are stored in association with each other.

[0037] Each information device 12 included in the information processing system 10 transmits operation information indicating the device ID of the own device and the operation content of the operation to the device management server 14 each time an operation is performed on the own device. The processor 52 of the device management server 14 refers to the operation content DB 46 and identifies an event associated with the operation content received from the information device 12. Then, the processor 52 associates the received device ID, the time when the operation information was received from the information device 12 (in other words, the operation time), the operation content of the operation, and the identified event, and stores and accumulates them in the operation log DB 48.

[0038] Note that in this embodiment, the device management server 14 receives operation information indicating the operation content from the information device 12, and then the processor 52 refers to the operation content DB 46 to identify an event corresponding to the operation content. However, each information device 12 may transmit operation information including the operation content and an event caused by the operation content to the device management server 14. In this case, the processor 52 associates the operation content and the event included in the operation information and stores them in the operation log DB 48. In this case, it is not necessary to prepare the operation content DB 46.

[0039] Also, in the operation log DB 48, it is preferable that the operation type of the operation content is further associated with the operation content. Specifically, the operation type is information indicating whether the operation of the operation content is a maintenance operation for performing maintenance on the information device 12. For example, in the example of FIG. 5, the operation contents “automatic instruction from a remote server” and “special operation on a local panel” that cause the event “firmware update” are maintenance operations of the information device 12. Therefore, the operation type “maintenance operation” is associated with the operation content. The operation type corresponding to the operation content may be included in the operation information transmitted from the information device 12. That is, each information device 12 defines in advance the operation type of each operation content, and each information device 12 transmits operation information including the device ID, the operation content, and the operation type of the operation content to the device management server 14. The processor 52 associates the operation content and the operation type included in the operation information and stores them in the operation log DB 48. Also, in the operation content DB 46 (see FIG. 5), the operation type may be associated with and stored for each operation content or event, and the processor 52 may refer to the operation content DB 46 to specify the operation type of the operation content received from the information device 12.

[0040] Furthermore, in the operation log DB 48, it is preferable that the presence or absence of a false warning notification is associated with the combination of the device ID (that is, the information device 12) and the operation content. Details of the presence or absence of the false warning notification and its usage method will be described later.

[0041] FIG. 6 shows the operation details when firmware updates are performed on 20 information devices 12 that are under the management of the device management server 14. Although the operation details for the information devices 12 indicated by device IDs "MFP3" to "MFP18" are omitted, for these information devices 12, similar to the information devices 12 indicated by device IDs "MFP1" and "MFP2", it is assumed that the operation content "automatic instruction from the remote server" and the event "firmware update" are associated. Of course, what is shown in FIG. 6 is only a part of the operation log DB48, and the operation log DB48 stores and accumulates information regarding various operation details performed on each information device 12.

[0042] The memory 42 further stores a threshold number DB50, and the details of the threshold number DB50 will be described later.

[0043] The processor 52 refers to a processor in a broad sense and is configured to include at least one of a general-purpose processor (such as a CPU, etc.) and a dedicated processing device (such as a GPU, ASIC, FPGA, or a programmable logic device, etc.). The processor 52 may be configured not by a single processing device but by the cooperation of a plurality of processing devices existing at physically separated positions. The processor 52 functions as a warning output unit 54 according to the information processing program stored in the memory 42.

[0044] When it is determined that the operation content of the operation performed on each information device 12 under management is the above-described abnormal operation, the warning output unit 54 outputs a warning. Hereinafter, the details of the processing of the warning output unit 54 will be described.

[0045] First, the warning output unit 54 refers to the operation log DB 48 and extracts the operation details of operations performed on a plurality of information devices 12 associated with the same event. For example, in the example of FIG. 6, the operation details of operations performed on each of the 20 information devices 12 indicated by the device IDs "MFP1" to "MFP20" associated with the event "firmware update" are extracted. Specifically, the operation details "automatic instruction from the remote server" performed on the 18 information devices 12 indicated by the device IDs "MFP1" to "MFP18", and the operation details "special operation on the local panel" performed on the 2 information devices 12 indicated by the device IDs "MFP19" and "MFP20" are extracted.

[0046] Next, the warning output unit 54 determines whether an operation with an operation detail different from that of the other information devices 12 has been performed on the information devices 12 (here, the 20 information devices 12 indicated by the device IDs "MFP1" to "MFP20") among the plurality of information devices 12 on which the operation of the extracted operation detail has been performed and whose number is equal to or less than the threshold number.

[0047] The above threshold number can be predetermined by an administrator or the like. Also, the threshold ratio among the plurality of information devices 12 on which the operation of the extracted operation detail has been performed can be used as the threshold number. In this case, the information devices 12 whose number is equal to or less than the threshold number are the information devices 12 whose number is equal to or less than the threshold ratio among the plurality of information devices 12 on which the operation of the extracted operation detail has been performed. The threshold ratio can also be predetermined by an administrator or the like in advance. For example, the threshold ratio can be predetermined to be 10%. Here, the following explanation will be given assuming that the above threshold number is set to 2.

[0048] In this example, among the 20 information devices 12 on which the operations of the extracted operation contents were performed, for the two information devices 12 indicated by the device IDs "MFP19" and "MFP20", an operation of "special operation on the local panel", which is different from the operation contents of the other information devices 12 (18 information devices 12 indicated by the device IDs "MFP1" to "MFP18"), was performed. Therefore, the warning output unit 54 determines that, among the plurality of information devices 12 on which the operations of the extracted operation contents were performed, for the information devices 12 that are two or less, which is the threshold number, an operation of an operation content different from that of the other information devices 12 (in this specification, this operation content is referred to as "minority operation content") was performed.

[0049] In this way, when an operation of minority operation content is performed on a part of the plurality of information devices 12, the warning output unit 54 determines that the operation of the minority operation content is an abnormal operation. Then, the warning output unit 54 outputs a warning regarding the minority operation content. For example, as a warning, the warning output unit 54 notifies the administrator terminal used by the administrator of the device ID of the information device 12 on which the operation of the minority operation content was performed, together with the fact that the operation of the minority operation content was performed on the information device 12. Alternatively, as a warning, the warning output unit 54 causes a warning message to be displayed on the display 24 of the information device 12 on which the operation of the minority operation content was performed.

[0050] If a plurality of information devices 12 are in mutually similar installation environments (or usage environments), the operation contents of the operations on each information device 12 for causing the same event to occur on each information device 12 often become the same. For example, for each information device 12 installed within a certain company, an operation of sending an automatic instruction from a remote server in the same manner to each information device 12 for firmware update is performed, for example.

[0051] Depending on the installation environment, when an operation with a high risk operation content is selected as an operation that is similarly performed on each information device 12 to cause a certain event, there may be a case where an operation with a high risk operation content is intentionally performed on a plurality of information devices 12 in the installation environment. Here, if the operation content with a high risk is defined in advance and a warning is always output when the defined operation content with a high risk is performed on the information device 12, depending on such an installation environment, the warning may become a false warning.

[0052] In view of such a situation, in the present embodiment, the warning output unit 54, as an operation for causing the same event to occur in a plurality of information devices 12 to be managed, outputs a warning only when an operation with an operation content different from that of the other majority of information devices 12 (that is, a minority operation content) is performed on only a small number (specifically, a number equal to or less than a threshold value) of information devices 12 among the plurality of information devices 12.

[0053] Thereby, in a certain installation environment, even if an operation with a high risk operation content is intentionally performed on a plurality of information devices 12 to cause a certain event, if it is performed on the majority of information devices 12, the warning output unit 54 does not issue a warning. That is, false warnings are reduced. On the other hand, if there is an operation content that is performed only on a small number of information devices 12 to cause a certain event, it is an abnormal operation and is likely to be an operation that truly damages the information device 12 or the information processing system 10, so the warning output unit 54 outputs a warning.

[0054] In the above embodiment, the threshold number or threshold ratio that is the criterion for whether the warning output unit 54 issues a warning is constant regardless of the operation content, but the threshold number or threshold ratio may be determined according to the operation content. Here, the threshold number DB50 stored in the memory 42 will be described.

[0055] In the threshold number DB50, different threshold numbers or threshold ratios are associated with and stored for a plurality of operation contents that can be operated on the information device 12. The threshold number or threshold ratio here is a concept corresponding to the threshold number for each operation content. In the present embodiment, in the threshold number DB50, different threshold numbers or threshold ratios are associated with and stored for a plurality of operation contents stored in the operation content DB46 that cause one event. The threshold number or threshold ratio for each operation content is determined in advance by an administrator or the like and stored in the threshold number DB50.

[0056] FIG. 7 is a conceptual diagram showing an example of the content of the threshold number DB50. In the example of FIG. 7, different threshold ratios are associated with a plurality of operation contents "special operation on the local panel", "instruction from an administrator logged in with a password", and "automatic instruction from a remote server" that cause the event "firmware update". Hereinafter, an example in which a threshold ratio is associated with each operation content will be described, but as described above, a threshold number may be associated with each operation content.

[0057] In the threshold number DB50, the higher the risk of the operation content (that is, the higher the possibility of causing damage to the information device 12 or the information processing system 10, or the greater the damage caused to the information device 12 or the information processing system 10), the higher the threshold ratio associated with the operation content. In the example of FIG. 7, among the three operation contents shown, the "special operation on the local panel" has the highest risk. Therefore, the highest threshold ratio of "40% or less" is associated with this operation content. On the other hand, among the three operation contents shown, the "automatic instruction from a remote server" has the lowest risk, so the lowest threshold ratio of "3% or less" is associated with this operation content. Note that the expression "〇% or less" of the threshold ratio in FIG. 7 does not include "0%", that is, not applicable.

[0058] The process of the warning output unit 54 referring to the threshold number DB50 is as follows. First, similar to the above-described embodiment, the warning output unit 54 refers to the operation log DB48 and extracts the operation details of the operations performed on a plurality of information devices 12 associated with the same event. For example, referring to FIG. 6, the operation details of the operations performed on each of the 20 information devices 12 indicated by the device IDs "MFP1" to "MFP20" associated with the event "firmware update" are extracted.

[0059] Next, the warning output unit 54 refers to the threshold number DB50 and determines whether the operations of the extracted operation details are performed on the information devices 12 in a number less than or equal to the threshold ratio associated with the threshold number DB50.

[0060] For example, first, in the threshold number DB50, the operation detail "automatic instruction from the remote server" is associated with the threshold ratio "3% or less". Therefore, the warning output unit 54 determines whether the operation detail "automatic instruction from the remote server" is performed on 3% or less (here, 1 or less) of the 20 information devices 12. Here, since the operation detail "automatic instruction from the remote server" is performed on 18 devices, the warning output unit 54 determines that the operation detail "automatic instruction from the remote server" is not a minority operation detail and does not output a warning for this.

[0061] Next, in the threshold number DB50, the operation detail "special operation on the local panel" is associated with the threshold ratio "40% or less". Therefore, the warning output unit 54 determines whether the operation detail "special operation on the local panel" is performed on 40% or less (8 or less) of the 20 information devices 12. Here, since the operation detail "special operation on the local panel" is performed on 2 devices, the warning output unit 54 determines that the operation detail "special operation on the local panel" is a minority operation detail and outputs a warning for this.

[0062] In the threshold number DB50, the higher the risk of the operation content, the higher the threshold ratio is associated with the operation content. Therefore, it can be said that the higher the risk of the operation content, the easier it is to output a warning. In this way, the warning output unit 54 can output a warning in consideration of the risk of the operation content.

[0063] For the information device 12 that has fallen into an abnormal state, operations with operation contents different from normal may be performed for its repair or the like. Therefore, even if an operation determined to be a small number of operation contents is performed on the information device 12 that has fallen into an abnormal state, if a warning is output for it, there is a high possibility that it will be a false warning. Therefore, the warning output unit 54 can be configured not to output a warning when an operation with a small number of operation contents is performed on the information device 12 that has fallen into an abnormal state.

[0064] Specifically, by the above method, the warning output unit 54 identifies the information device 12 on which an operation with a small number of operation contents has been performed from among the plurality of information devices 12. Then, the warning output unit 54 refers to the device DB44 and determines whether the identified information device 12 has fallen into an abnormal state based on the status information of the information device 12. If the information device 12 has fallen into an abnormal state, the warning output unit 54 does not output a warning regarding the operation with the small number of operation contents performed on the information device 12.

[0065] Also, when the operation type of the operation with a small number of operation contents performed on the information device 12 that has fallen into an abnormal state is not a maintenance operation for repairing the information device 12 or the like, but an attack operation that causes, for example, the event of "login failure", a warning is desired to be output regarding the small number of operation contents.

[0066] Therefore, when a small number of operations are being performed on the information device 12 that has entered an abnormal state, the warning output unit 54 further refers to the operation log DB 48 to identify the operation type of the small number of operations performed on the information device 12. And when the identified operation type is other than "maintenance operation", the warning output unit 54 may output a warning regarding the operation of the small number of operations performed on the information device 12. On the other hand, when the identified operation type is "maintenance operation", the warning output unit 54 may not output a warning regarding the operation of the small number of operations performed on the information device 12.

[0067] Even when the warning output unit 54 outputs a warning by the above method, it is conceivable that the warning may inevitably become a false warning. For example, among a plurality of information devices 12 installed within the same company (that is, a plurality of information devices 12 managed by one device management server 14), it is conceivable that only the information device 12 installed in a specific department has different operations. For example, since the information device 12 installed in the department handling confidential information cannot communicate with the outside of the company, only that one device is not updated with firmware by an automatic instruction from a remote server, but the firmware is downloaded to the information device 12 and then updated with firmware by a special operation on the local panel. In such a case, the operation content "special operation on the local panel" for the information device 12 is not an operation originally intended to damage the information device 12 or the information processing system 10, but since it is a small number of operations, a warning is output by the warning output unit 54.

[0068] In such a case, the administrator notifies the device management server 14 that the warning is a false warning. Based on the notification from the administrator, the warning output unit 54 associates information indicating "yes" for a false warning notification with the combination of the device ID of the information device 12 related to the warning and the operation content (minor operation content) related to the warning, and stores it in the operation log DB 48 (see FIG. 6). In the example of FIG. 6, a false warning notification "yes" is associated with the combination of the device ID "MFP20" and the operation content "special operation on the local panel".

[0069] When there is a false warning notification from the administrator, the operation of the minor operation content related to the warning for the information device 12 related to the warning is likely not an operation that will damage the information device 12 or the information processing system 10. Therefore, when the warning output unit 54 receives a notification that the output warning is a false warning, thereafter, when the minor operation content related to the warning is performed on the information device 12 related to the warning, the warning output unit 54 can be configured not to output a warning.

[0070] Specifically, by the above method, the warning output unit 54 identifies the information device 12 on which the operation of the minor operation content is performed from among the plurality of information devices 12. Then, the warning output unit 54 refers to the operation log DB 48 again and determines whether the false warning notification associated with the combination of the identified information device 12 and the minor operation content is "yes". If the false warning notification is "yes", the warning output unit 54 does not output a warning regarding the operation of the minor operation content performed on the information device 12.

[0071] Also, the operation content associated with the false warning notification "Yes" may be extended to similar operation content similar to the operation content. For example, in the example of FIG. 6, the operation content associated with the false warning notification "Yes" is the "special operation on the local panel" for the information device 12 indicated by the device ID "MFP20", but the operation content associated with the false warning notification "Yes" may be extended to include the similar operation content "operation using the local panel" for the information device 12 indicated by the device ID "MFP20". This is because when it is found that the warning for the operation of a certain small number of operation contents for a certain information device 12 is a false detection, that is, when it is clear that the certain small number of operation contents for the information device 12 are not operations that would damage the information device 12 or the information processing system 10, it is based on the fact that in many cases, the similar operation contents for the information device 12 are also not operations that would damage the information device 12 or the information processing system 10. Note that the event caused by the operation content associated with the false warning notification "Yes" and the event caused by the similar operation content may be the same or different from each other.

[0072] As a result, as shown in FIG. 6, when a false warning notification "Yes" is associated with the combination of the device ID "MFP20" and the operation content "special operation on the local panel", and a similar operation content "operation on the local panel without a password" that causes the event "update of security settings" is performed on the information device 12 indicated by the device ID "MFP20", the warning output unit 54 can be configured not to output a warning even if the similar operation content is a small number of operation contents.

[0073] Also, considering a situation where, among the plurality of information devices 12 to be managed, a different operation is performed only on a specific information device 12 for maintenance operations as described above, even when a notification that the output warning is a false warning is received, and then, even when a small number of operation contents related to the warning are performed on the information device 12 related to the warning, if the type of the small number of operation contents is not a maintenance operation, for example, an attack operation that causes an event such as "login failure", a warning regarding the small number of operation contents is desired to be output.

[0074] Therefore, when an incorrect warning notification "yes" is associated with the combination of the specified information device 12 and the small number of operation contents, the warning output unit 54 further refers to the operation log DB 48 to specify the operation type of the small number of operation contents for the information device 12. And when the specified operation type is other than "maintenance operation", the warning output unit 54 may output a warning regarding the operation of the small number of operation contents performed on the information device 12. On the other hand, when the specified operation type is "maintenance operation", the warning output unit 54 may not output a warning regarding the operation of the small number of operation contents performed on the information device 12.

[0075] The outline of the information processing system 10 according to this embodiment is as described above. Hereinafter, the processing flow of the device management server 14 will be described according to the flowchart shown in FIG. 8.

[0076] In step S10, the warning output unit 54 refers to the operation log DB 48 and extracts the operation contents of the operations on the plurality of information devices 12 associated with the same event.

[0077] In step S12, the warning output unit 54 determines whether an operation with an operation content different from that of other information devices 12, that is, an operation with a small number of operation contents, is being performed on the information devices 12 with a number less than or equal to the threshold number among the plurality of information devices 12 on which the operations of the operation contents extracted in step S10 are performed. If an operation with a small number of operation contents is not being performed, the process ends. If it is being performed, the process proceeds to step S14.

[0078] In step S14, the warning output unit 54 refers to the device DB44 and determines whether the information device 12 on which the small number of operation contents specified in step S12 is performed has fallen into an abnormal state. If the information device 12 has not fallen into an abnormal state, the process proceeds to step S16. If the information device 12 has fallen into an abnormal state, the process proceeds to step S18.

[0079] In step S16, the warning output unit 54 refers to the operation log DB48 and determines whether there is a false warning notification associated with the combination of the information device 12 specified in step S12 and the small number of operation contents. If there is a false warning notification associated with the combination, the process proceeds to step S18. If there is a false warning notification associated with the combination, the process proceeds to step S20.

[0080] In step S18, the warning output unit 54 refers to the operation log DB48 and determines whether the operation type associated with the small number of operation contents specified in step S12 is "maintenance operation". If the operation type is not "maintenance operation", the process proceeds to step S20. If the operation type is "maintenance operation", the process ends.

[0081] In step S20, the warning output unit 54 outputs a warning regarding the small number of operation contents for the information device 12 specified in step S12.

[0082] As described above, the embodiments according to the present invention have been described. However, the present invention is not limited to the above embodiments, and various modifications are possible without departing from the spirit of the present invention.

[0083] For example, in the present embodiment, the device DB 44, the operation content DB 46, the operation log DB 48, and the threshold number DB 50 are stored in the memory 42 of the device management server 14, but these DBs may be stored in the memory of another device accessible from the device management server 14.

Explanation of Reference Numerals

[0084] 10 Information processing system, 12 Information device, 14 Device management server, 16 Communication line, 20, 40 Communication interface, 22 Input interface, 24 Display, 26, 42 Memory, 28, 52 Processor, 44 Device DB, 46 Operation content DB, 48 Operation log DB, 50 Threshold number DB, 54 Warning output unit.

Claims

1. Comprising a processor, The processor: Receives, from a plurality of information devices, operation contents of operations performed on the information devices, where the operation contents are associated with event information indicating an event caused by the operations on the information devices, and stores and accumulates the operation contents in an operation log database; Refers to the operation log database, and when operations with different operation contents associated with the same event are performed on a plurality of information devices, and when operations with a small number of operation contents, which are different from those of other information devices, are performed on a number of the information devices that is less than or equal to a threshold number among the plurality of information devices, outputs a warning regarding the small number of operation contents; An information processing apparatus characterized by the above.

2. The number of the information devices that is less than or equal to the threshold number is the number of the information devices that is less than or equal to a threshold ratio among the plurality of information devices. The information processing apparatus according to claim 1, characterized by the above.

3. The processor: Refers to a threshold number database in which different operation content-specific threshold numbers, which are different for each of the plurality of operation contents, are associated with the plurality of operation contents; When operations with different operation contents associated with the same event are performed on a plurality of information devices, and when operations with the operation contents associated with the operation content-specific threshold number in the threshold number database are performed on a number of the information devices that is less than or equal to the operation content-specific threshold number among the plurality of information devices, outputs the warning. The information processing apparatus according to claim 1 or 2, characterized by the above.

4. The processor: Based on state information indicating the state of the information device, determines whether the information device has entered an abnormal state; When the operation with the small number of operation contents is performed on the information device that has entered the abnormal state, does not output the warning. The information processing apparatus according to claim 1, characterized by the above.

5. The operation contents stored and accumulated in the operation log database are further associated with information indicating whether the operation of the operation content is a maintenance operation for performing maintenance on the information device; The processor: When the operation with the small number of operation contents is performed on the information device that has entered the abnormal state, and when the small number of operation contents is the maintenance operation, does not output the warning. The information processing apparatus according to claim 4, characterized by the above.

6. When the processor receives a notification that the output warning is a false warning, and then, when the minority operation content related to the warning is performed on the information device related to the warning, the processor does not output a warning. The information processing apparatus according to claim 1, characterized in that.

7. In the operation content stored and accumulated in the operation log database, information indicating whether the operation related to the operation content is a maintenance operation for performing maintenance on the information device is further associated. When the processor receives a notification that the output warning is a false warning, and then, when the minority operation content related to the warning is performed on the information device related to the warning, and the minority operation content is the maintenance operation, the processor does not output a warning. The information processing apparatus according to claim 6, characterized in that.

8. In a computer, Receiving, from a plurality of information devices, operation contents of operations performed on the information device, the operation contents being associated with event information indicating an event caused by the operation of the operation contents, and storing and accumulating the operation contents in an operation log database. Referring to the operation log database, when operations of different operation contents associated with the same event are performed on a plurality of information devices, and when operations of minority operation contents, which are different operation contents from those of other information devices, are performed on a number of the information devices equal to or less than a threshold number among the plurality of information devices, causing a warning regarding the minority operation contents to be output. An information processing program, characterized in that.

Images