Specific device, specific method, and specific program

Abstract

This specifying device (10) extracts, for each domain, an ID that is included in the domain. With respect to a combination of IDs of different domains from among the extracted IDs, the specifying device (10) calculates the extent of temporal overlapping of operation events by using operation events that correspond to the IDs. The specifying device (10) then specifies a combination of IDs pertaining to the same user on the basis of the calculated extent of overlapping.

Description

[Technical Field]

[0001] The present invention relates to an identification device, an identification method, and an identification program. [Background technology]

[0002] Generally, in the business improvement process of a company, the approach taken is to grasp the actual business situation through manual interviews and estimation of workload through observation and time measurement, to identify problem areas, and then consider improvement plans. However, grasping the actual business situation through interviews, etc. requires time and can be biased towards the subjective opinion of some workers, resulting in problems with accuracy and comprehensiveness.

[0003] In response to this, there is a method for improving business operations by acquiring terminal operation logs and visualizing operation events. By acquiring and visualizing terminal operation logs, it becomes possible to grasp the actual state of business operations more efficiently, broadly, and at a finer level of granularity. Here, data items included in the operation logs can include, for example, user name, terminal name, application name, window title, URL / file path, window handle, etc.

[0004] One visualization method is a timeline format (hereafter referred to as a timeline) in which time is assigned to the x-axis (or y-axis), elements are arranged on the y-axis (or x-axis), and the duration of each element is represented by a rectangle. This visualization is suitable for intuitively understanding the context and co-occurrence of window usage on a terminal. Also, if you want to understand the actual work status of each worker, for example, you can grasp the application usage status of each worker by displaying a timeline hierarchically in the order of user name, application name, and window title. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2020-77174 Summary of the Invention [Problem to be solved by the invention]

[0006] However, with conventional technology, for tasks in which one worker uses multiple terminals and IDs, a combination of IDs for each worker had to be created manually as a configuration file, which was a time-consuming process.

[0007] For example, for various reasons, one worker may perform their work using multiple terminals and IDs. For example, the same worker may be assigned terminals and IDs for each domain established according to the purpose of use. For example, domains may include a domain with a high security level that connects to a customer database, etc., and a domain that can connect to external networks such as the Internet and email. Generally, these domains have different security levels, so they are operated on independent networks, and there are environments in which the terminals that can connect to them are also different.

[0008] In such an environment, conventional methods display timelines by device name or ID, making it difficult to grasp the actual work status of a worker when one worker uses multiple devices or IDs.

[0009] In such an environment, one method is for analysts to create a configuration file that combines the IDs of each worker, allowing the timelines of the same worker to be displayed in the same group. However, this method requires the analyst to know the IDs of each worker in advance and create the configuration file, which is time-consuming.

[0010] The present invention has been made in consideration of the above, and aims to provide an identification device, an identification method, and an identification program that can grasp the actual work status of each worker without human labor, even in an environment where one worker uses multiple IDs. [Means for solving the problem]

[0011] In order to solve the above-mentioned problems and achieve the object, the identification device of the present invention is characterized by having an extraction unit that extracts identifiers contained in each specified area, a calculation unit that calculates the degree of overlap in time of operation events for combinations of identifiers from different areas among the identifiers extracted by the extraction unit, using operation events corresponding to each identifier, and an identification unit that identifies combinations of identifiers of the same worker based on the degree of overlap calculated by the calculation unit. [Effects of the Invention]

[0012] According to the present invention, it is possible to easily grasp the actual work status of each worker. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram illustrating the configuration of a specific device according to this embodiment. [Figure 2] FIG. 2 is a diagram in which the occurrence times of operation events are plotted on the time axis. [Figure 3] FIG. 3 is a diagram illustrating the overlap degree calculation process performed by the calculation unit. [Figure 4] FIG. 4 is a diagram illustrating the identification process performed by the identification unit. [Figure 5] FIG. 5 is a flowchart illustrating an example of a processing procedure performed by the identifying device according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating a computer that executes a program. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, embodiments of a specifying device, a specifying method, and a specifying program according to the present application will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described below.

[0015] [Specific equipment configuration] FIG. 1 is a block diagram illustrating the configuration of a specific device according to this embodiment. As shown in FIG. 1, the specific device 10 according to this embodiment is connected to a terminal device 20 via a network (not shown). Note that the connection between the devices is not limited to being via a network, and any connection form may be used, whether wired or wireless. Also, while FIG. 1 illustrates a case in which the specific device 10 is connected to one terminal device 20, it may be connected to multiple terminal devices 20.

[0016] The identifying device 10 reads the operation log and extracts the IDs recorded for each domain. The identifying device 10 then extracts all combinations of the extracted domain IDs between domains and calculates the degree of overlap in the occurrence times of operation events for each combination. The identifying device 10 then identifies combinations with the smallest calculated degree of overlap as ID combinations assigned by the same worker. Through the above process, the identifying device 10 can automatically create a configuration file for ID combinations for each worker in an environment where multiple IDs are assigned to the same worker. This allows the identifying device 10 to grasp the actual work status of each worker without human intervention, even in an environment where one worker uses multiple terminals. The identifying device 10 may be any type of information processing device, including a server.

[0017] The terminal device 20 is an information processing device used by a user. The user is, for example, a business person. The business person uses various software, such as a business system or a general-purpose application, on the terminal device 20. The terminal device 200 may be any type of information processing device, including a client device such as a smartphone, a desktop PC, a notebook PC, or a tablet PC. In the example of FIG. 1, the specific device 10 and the terminal device 20 are separate devices, but the terminal device 20 may have some or all of the functions of the specific device 10.

[0018] The terminal device 20 acquires an operation log including operation time, operation location, operation position, etc. at the timing of an operation event. Here, in order to record the operation content on the terminal device 20 as a log, for example, the terminal device 20 detects events that occur in association with the operation from the OS or GUI framework and acquires information on GUI components, thereby generating an operation log that serves as the basis for analysis and includes information on the operation type and operation location, which are the smallest units of an RPA scenario. Then, the terminal device 20 transmits the operation log to the identifying device 10.

[0019] The identifying device 10 receives the operation log acquired by the terminal device 20 and stores it in the operation log storage unit 13a of the storage unit 13. Note that the timing at which the identifying device 10 and the terminal device 20 transmit and receive the operation log may be any timing, for example, they may be transmitted and received at a predetermined time interval, or they may be transmitted and received every time the terminal device 20 acquires an operation log.

[0020] The identifying device 10 has a communication processing unit 11, a control unit 12, and a storage unit 13. The processing of each unit of the identifying device 10 will be described below.

[0021] The communication processing unit 11 is realized by a NIC (Network Interface Card) or the like, and controls communication between the control unit 12 and an external device via a telecommunication line such as a LAN (Local Area Network) or the Internet. For example, the communication processing unit 11 receives an operation log from the terminal device 20.

[0022] The storage unit 13 stores data and programs necessary for various processes by the control unit 12, and has an operation log storage unit 13a. For example, the storage unit 13 is a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

[0023] The operation log storage unit 13a stores the operation log acquired from the terminal device 20. For example, the operation log storage unit 13a stores, for each domain, a table including the following columns: "event occurrence time" which is the time when an operation event occurred, "user name" which indicates the user who performed the operation, "window title" which indicates the window title of the window to be operated, and "application name" which indicates the application to be operated. Note that the information included in the operation log is merely an example and is not limited to this.

[0024] Here, a domain is a predetermined area set according to the purpose of use. For example, there are domains with high security levels that connect to customer databases, and domains that can connect to external networks such as the Internet and email.

[0025] The control unit 12 has an internal memory for storing programs that define various processing procedures and required data, and executes various processes using these. For example, the control unit 12 has an extraction unit 12a, a calculation unit 12b, and an identification unit 12c. Here, the control unit 12 is an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0026] The extraction unit 12a extracts, for each domain (predetermined area), an ID (identifier) ​​belonging to the domain. For example, the extraction unit 12a reads the operation log from the operation log storage unit 13a and extracts the ID recorded for each domain. Here, the extraction unit 12a may extract, as the ID, other identifiers such as a user ID or user name that identifies a user, a terminal ID or terminal name that identifies a terminal, etc. from the operation log.

[0027] The calculation unit 12b calculates the degree of overlap in time of operation events for combinations of IDs of different domains among the IDs extracted by the extraction unit 12a, using operation events corresponding to each ID. For example, the calculation unit 12b extracts all combinations of IDs of each domain with IDs of other domains, and calculates the degree of overlap in time of operation events for each combination.

[0028] Furthermore, when only the time when an operation event is spoken is known and the end time cannot be determined, the calculation unit 12b calculates the degree of overlap by providing a certain time range before and after the event occurrence time, because an operation is instantaneous and therefore a certain range is required.

[0029] Here, the degree of overlap of operation events will be explained. FIG. 2 is a diagram in which the occurrence times of operation events are plotted on a time axis. In the example of FIG. 2, there are two domains A and B, and domain A has IDs A1, A2, and A3 related to workers, and domain B has IDs B1, B2, B3, and B4 related to workers. Assume that operation logs such as those shown in FIG. 2 are acquired by the operations of the workers. In this case, the extraction unit 12a reads the operation logs and extracts IDs "A1," "A2," and "A3" from domain A and IDs "B1," "B2," "B3," and "B4" from domain B.

[0030] 2 plots on the time axis the occurrence times of operation events recorded in the operation logs acquired from each terminal device 20. For example, the example in FIG. 2 shows that operation events occurred at 10:00, 10:30, 12:30, etc. for ID "A1" of domain A.

[0031] Next, the overlap degree calculation process by the calculation unit 12b will be described with reference to FIG. 3. FIG. 3 is a diagram illustrating the overlap degree calculation process by the calculation unit. As illustrated in FIG. 3, the calculation unit 12b extracts all combinations between domains for each domain ID, and calculates the overlap degree for the operation event. For example, the calculation unit 12b calculates the overlap degree as "1" when the overlap occurs within 5 minutes before and after the operation event occurrence time, and as "0.5" when the overlap occurs within 10 minutes before and after the operation event occurrence time. Note that the method for calculating the overlap degree of the operation event is not limited to this, and a normal distribution may also be used, for example.

[0032] In addition, when each operation event in the operation log includes a start time and an end time, the calculation unit 12b may determine whether the period from the start time to the end time of each operation event overlaps with the period from the start time to the end time of another operation event, and if the periods overlap, calculate the degree of overlap as "1".

[0033] The identifying unit 12c identifies a combination of IDs belonging to the same worker based on the degree of overlap calculated by the calculating unit 12b. For example, the identifying unit 12c identifies an ID combination whose degree of overlap is equal to or less than a predetermined threshold as a combination of IDs belonging to the same worker.

[0034] Explaining this using the example of FIG. 3, for example, the identification unit 12c finds combinations with a small degree of overlap, as illustrated in FIG. 4, and identifies combinations of A1 and B2, A2 and B3, and A3 and B1 as combinations of IDs of the same worker. Note that in the example of FIG. 4, it is assumed that the predetermined threshold is set to "0." That is, the identification unit 12c identifies combinations of A1 and B2, A2 and B3, and A3 and B1 as combinations of IDs of the same worker, as combinations of IDs with a degree of overlap of "0." Note that in the example of FIG. 4, it is assumed that there is no ID combination in domain A for worker B4 because there is no ID in domain A or there was no work in domain A during this period.

[0035] [Processing procedure of specific device 10] Next, an example of a processing procedure of a process executed by the identifying device 10 will be described with reference to Fig. 5. Fig. 5 is a flowchart showing an example of a processing procedure by the identifying device of the embodiment.

[0036] 5, the extraction unit 12a of the identifying device 10 reads the operation log from the operation log storage unit 13a and extracts the ID recorded for each domain (step S101). Then, the calculation unit 12b extracts all combinations of the IDs of each domain between domains and calculates the degree of overlap of the occurrence times of the operation events for each combination (step S102).

[0037] Next, the identifying unit 12c identifies a combination with a small degree of overlap as a combination of IDs by the same worker (step S103). For example, the identifying unit 12c identifies a combination of IDs with a degree of overlap equal to or less than a predetermined threshold as a combination of IDs by the same worker.

[0038] [Effects of the embodiment] In this way, the identifying device 10 according to the embodiment extracts, for each domain, IDs included in the domain. Then, for combinations of IDs from different domains among the extracted IDs, the identifying device 10 calculates the degree of overlap in time of operation events using operation events corresponding to each ID. Next, the identifying device 10 identifies combinations of IDs of the same worker based on the calculated degree of overlap. This allows the identifying device 10 to easily grasp the actual work status of each worker.

[0039] In other words, the identifying device 10 can automatically create a setting file for a combination of IDs for each worker in an environment where multiple IDs are assigned to the same worker. This allows the identifying device 10 to grasp the actual work status of each worker without human intervention, even in an environment where one worker uses multiple terminals.

[0040] [System configuration, etc.] The components of each device shown in the drawings according to the above embodiments are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of each device can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0041] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0042] 〔program〕 It is also possible to create a program written in a computer-executable language that executes the processes executed by the specific device described in the above embodiments. In this case, the same effects as those of the above embodiments can be achieved by having a computer execute the program. Furthermore, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by a computer to achieve the same processes as those of the above embodiments.

[0043] 6 is a diagram showing a computer that executes a program. As shown in the example of FIG. 6, a computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070, and these components are connected by a bus 1080.

[0044] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012, as exemplified in FIG. 6. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090, as exemplified in FIG. 6. The disk drive interface 1040 is connected to a disk drive 1100, as exemplified in FIG. 6. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, as exemplified in FIG. 6. The video adapter 1060 is connected to a display 1061, as exemplified in FIG. 6.

[0045] 6, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above programs are stored, for example, on the hard disk drive 1090 as program modules in which instructions to be executed by the computer 1000 are written.

[0046] The various data described in the above embodiment are stored as program data, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 and the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as needed, and executes various processing procedures.

[0047] Note that the program module 1093 and program data 1094 related to the program are not limited to being stored in the hard disk drive 1090, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via a disk drive or the like. Alternatively, the program module 1093 and program data 1094 related to the program may be stored in another computer connected via a network (such as a LAN (Local Area Network) or WAN (Wide Area Network)) and read by the CPU 1020 via the network interface 1070.

[0048] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention. [Explanation of symbols]

[0049] 10 Specific equipment 11 Communications Department 12 Control Unit 12a Extraction part 12b Calculation part 12c Specific part 13 Storage section 13a Operation log storage section

Claims

1. an extraction unit that extracts, for each predetermined area, an identifier included in the area; a calculation unit that calculates a degree of overlap in time of operation events for a combination of identifiers in different regions among the identifiers extracted by the extraction unit, using occurrence times of operation events corresponding to each identifier; an identification unit that identifies a combination of identifiers of the same worker based on the degree of overlap calculated by the calculation unit; A specific device characterized by having:

2. The identification device according to claim 1 , wherein the calculation unit extracts all combinations of identifiers of each area with identifiers of other areas, and calculates the degree of overlap in time of operation events for each combination.

3. The identification device according to claim 1 , wherein the identification unit identifies a combination of identifiers for which the degree of overlap calculated by the calculation unit is equal to or less than a predetermined threshold as a combination of identifiers made by the same worker.

4. The identifying device according to claim 1 , wherein the extracting unit reads an operation log and extracts the identifier recorded for each of the areas from the operation log.

5. A specific method executed by a specific device, comprising: an extraction step of extracting, for each predetermined area, an identifier included in the area; a calculation step of calculating a degree of overlap in time of operation events for a combination of identifiers in different regions among the identifiers extracted by the extraction step, using occurrence times of operation events corresponding to each identifier; an identifying step of identifying a combination of identifiers of the same worker based on the degree of overlap calculated in the calculating step; A method for identifying a target object, comprising:

6. an extraction step of extracting, for each predetermined area, an identifier included in the area; a calculation step of calculating a degree of overlap in time of operation events for combinations of identifiers in different regions among the identifiers extracted by the extraction step, using occurrence times of operation events corresponding to each identifier; a specifying step of specifying a combination of identifiers of the same worker based on the degree of overlap calculated in the calculating step; A specific program characterized by causing a computer to execute the above.

Images