Image forming apparatus, control method and program for image forming apparatus

Abstract

To properly control processing for estimating a use environment.SOLUTION: The present invention relates to an image formation device that can communicate with an external device, and that has control means which controls estimation processing to estimate a use environment of an image formation device using information based upon communication packets that the image formation device transmits and receives, and notification means which gives note corresponding to a result of the estimation processing, and the control means performs control not to perform the estimation processing when the image formation device is set in a specific mode.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to a technique for estimating the usage environment of an image forming apparatus. [Background technology]

[0002] As a security measure, it is necessary for the various security-related functions of information devices to be properly configured. If an information device is used in a single, fixed environment, by applying settings tailored to that single environment at the time of shipment, users can use the information device with appropriate security measures implemented without having to be aware of anything.

[0003] For example, when we look at the usage environments of multifunction devices, they are not limited to office environments, but are now diversified to include telecommuting, use in public spaces shared by an unspecified number of people, etc. Appropriate security settings differ depending on the usage environment, so it is necessary to set appropriate settings for the usage environment.

[0004] Patent Document 1 proposes a technology that collects the operating status of a test network, creates a policy, and supports updating the policy of each network. In Patent Document 1, the technology compares the feature values ​​extracted from communication packets with the policy to detect network anomalies. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2019-22099 Summary of the Invention [Problem to be solved by the invention]

[0006] However, if the device's usage environment is estimated when the device is in a specific operating state, such as during a manufacturing process or maintenance, the estimated results may differ from those obtained when the device is in a normal operating state.

[0007] An object of the present invention is to appropriately control the estimation process of the usage environment. [Means for solving the problem]

[0008] In order to achieve the above object, an image forming apparatus of the present invention is an image forming apparatus capable of communicating with an external apparatus, and includes a control unit that controls an estimation process that estimates a usage environment of the image forming apparatus using information based on communication packets transmitted and received by the image forming apparatus, and a notification unit that issues a notification corresponding to the result of the estimation process, and the control unit controls the image forming apparatus not to perform the estimation process when the image forming apparatus is set to a specific mode. The specific mode may be a mode for communicating only with a specific external device, a mode for downloading firmware from a server, or a mode used in the manufacturing process. It is characterized by: [Effects of the Invention]

[0009] According to the image forming apparatus of the present invention, it is possible to appropriately control the estimation process of the usage environment. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating a system configuration of the present embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of the configuration of a controller unit of the MFP 100. [Figure 3] FIG. 2 is a diagram illustrating an example of the functional configuration of a controller unit of the MFP 100. [Figure 4] FIG. 10 is a diagram showing a screen configuration related to security settings. [Figure 5] 10 is a flowchart illustrating an example of a process for executing an estimation process according to the present embodiment. [Figure 6] FIG. 10 is a diagram illustrating the input / output structure using a learning model. [Figure 7] 10 is a table illustrating examples of operation modes in the present embodiment. [Figure 8] 1 is a table illustrating an example of a usage environment in this embodiment. [Figure 9]10 is a table illustrating an example of communication characteristic information used in the estimation process in this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0012] First Embodiment 1 is a diagram illustrating the connection configuration of an MFP (Multi-Function Peripheral) 100, a gateway 111, and a firmware distribution server 121 according to this embodiment. The MFP 100 and firmware distribution server 121 are connected via a LAN (Local Area Network) 110, the gateway 111, and the Internet 120. The MFP 100 and firmware distribution server 121 are connected so as to be able to communicate with external devices, i.e., other devices.

[0013] The firmware distribution server 121 is a server managed by an MFP vendor and used to distribute updated firmware. The MFP 100 can obtain updated firmware from the firmware distribution server 121 and update the firmware of its own device.

[0014] The MFP 100 has an operation unit 102 for inputting and outputting data to and from a user, a printer unit 103 for outputting electronic data to paper media, and a scanner unit 104 for reading paper media and converting the data into electronic data. The operation unit 102, printer unit 103, and scanner unit 104 are connected to a controller unit 101 and function as a multifunction peripheral under the control of the controller unit 101. Note that, in this embodiment, the MFP 100 is described as an example of an image forming apparatus, but this is not limiting. A single-function SFP (Single Function Peripheral) such as a scanner or printer may also be used. The present invention is also applicable to information processing apparatuses in general, including image forming apparatuses. For example, the present invention is also applicable to personal computers.

[0015] The gateway 111 is a network router that relays communication between the MFP 100 and the Internet 120 .

[0016] The PC 112 is an information processing terminal used by a user of the MFP 100. The user of the MFP operates the PC 112 to use the functions of the MFP 100. The user can also update the firmware without using the firmware distribution server 121 by downloading the firmware to be updated to the PC 112 in advance and sending the firmware from the PC 112 to the MFP 100.

[0017] 2 is a block diagram showing an example of the configuration of the controller unit 101 of the MFP 100. A CPU (Central Processing Unit) 201 performs the main arithmetic processing within the controller unit 101. The CPU 201 is connected to a DRAM (Dynamic Random Access Memory) 202 via a bus. The DRAM 202 is used by the CPU 201 as a working memory for storing program data representing arithmetic instructions during the calculation process by the CPU 201 and data to be processed. The CPU 201 is connected to an I / O controller 203 via the bus. The I / O controller 203 performs input and output to and from various devices according to instructions from the CPU 201.

[0018] A SATA (Serial Advanced Technology Attachment) I / F 205 is connected to the I / O controller 203. A flash ROM (Read Only Memory) 211 is connected to the SATA I / F 205. The CPU 201 uses the flash ROM 211 to store programs and document files for realizing the functions of the MFP 100, a learned model of communication tendencies according to the usage environment used in the estimation process, and operation mode information. A network I / F 204 is connected to the I / O controller 203. A wired LAN device 210 is connected to the network I / F 204. The CPU 201 controls the wired LAN device 210 via the network I / F 204 to realize communication on the LAN 110.

[0019] A panel I / F 206 is connected to the I / O controller 203. The CPU 201 performs input and output for the user to the operation unit 102 via the panel I / F 206. A printer I / F 207 is connected to the I / O controller 203. The CPU 201 performs output processing of paper media using the printer unit 103 via the printer I / F 207. A scanner I / F 208 is connected to the I / O controller 203. The CPU 201 performs reading processing of paper media documents using the scanner unit 104 via the scanner I / F 208.

[0020] For example, when a copy function is to be performed, the CPU 201 loads program data from the flash ROM 211 into the DRAM 202 via the SATA I / F 205. The CPU 201 detects a copy instruction from the user via the panel I / F 206 on the operation unit 102 in accordance with the program loaded into the DRAM 202. When the CPU 201 detects a copy instruction, it receives an original as image data from the scanner unit 104 via the scanner I / F 208 and stores it in the DRAM 202. The CPU 201 performs color conversion processing suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 103 via the printer I / F 207, and performs output processing onto paper media.

[0021] 3 is a block diagram showing an example of a functional configuration realized by software executed by controller unit 101 of MFP 100. All software executed by controller unit 101 is executed after CPU 201 reads programs stored in flash ROM 211 into DRAM 202.

[0022] The operation control unit 301 displays a screen image for the user on the operation unit 102, detects user operations, and executes processing associated with screen components such as buttons displayed on the screen. The data storage unit 302 writes and reads data to and from the flash ROM 211 at the request of another control unit. For example, if the user wants to change some device setting, the operation control unit 301 detects the content entered by the user into the operation unit 102, and at the request of the operation control unit 301, the data storage unit 302 stores the content as a setting value in the flash ROM 211. The operation control unit 301 also reads learning model data to be used in the estimation process.

[0023] A job control unit 303 controls job execution in accordance with instructions from other control units. An image processing unit 304 processes image data into a format suitable for each application in accordance with instructions from the job control unit 303. A print processing unit 305 prints an image on a paper medium via a printer I / F 207 in accordance with instructions from the job control unit 303. A reading processing unit 306 reads an original document via a scanner I / F 208 in accordance with instructions from the job control unit 303.

[0024] The network control unit 307 performs network settings such as IP addresses on the TCP / IP control unit 408 at system startup or when a setting change is detected, in accordance with the setting values ​​stored in the data storage unit 302. The TCP / IP control unit 308 performs transmission and reception processing of network packets via the network I / F 204 in accordance with instructions from other control units.

[0025] The security setting control unit 309 controls the security settings of the MFP 100. The security setting control unit 309 manages the correspondence between usage environments such as a company intranet, home, and public space and the corresponding security-related setting items, and can set the corresponding security-related settings all at once when the user specifies a usage environment. The security setting control unit 309 uses the data storage unit 302 to refer to and change setting values.

[0026] The estimation processing unit 310 performs estimation processing of the usage environment upon startup, upon screen display, or after a certain period of time has passed. For example, as part of the estimation processing, the estimation processing unit 310 uses the network control unit 407 to acquire characteristic information of communications related to the transmission and reception of data performed by the MFP 100. For example, the estimation processing unit 310 extracts destination and source IP addresses, TCP / UDP type, port number, and IP header information from information accompanying a network packet. Using the acquired information as input data, the estimation processing unit 310 uses a trained model read from the data storage unit 302 to derive the most approximate usage environment as an estimation result.

[0027] The firmware update processing unit 311 updates the program that controls the MFP 100. The firmware update processing unit 311 acquires the update program from the firmware distribution server 121 via, for example, the TCP / IP control unit 308. The firmware update processing unit 311 issues a request to the data storage unit 302 and writes the acquired update program into the flash ROM 211, thereby updating the program that controls the MFP 100.

[0028] The operation mode control unit 312 controls the operation mode for the MFP 100, which is different from the conventional operation. In this embodiment, the operation mode control unit 312 manages and controls the operation modes listed in the table of FIG.

[0029] For example, one example of an operation mode is a firmware download mode. The target users of this mode are customers or service personnel. This mode is an operation mode for updating the firmware of the MFP 100. When the MFP 100 is set to this mode, the characteristics of the communications performed by the MFP 100 are as follows: Communications for downloading firmware from a firmware distribution server are dominant. As a result, large volumes of traffic with specific addresses tend to account for the majority of communications. As a result, the usage environment may be estimated to be linked to a smaller network than the actual usage environment.

[0030] Another example of an operating mode is a fixed IP address mode. The target user of this mode is a service person. This mode is an operating mode in which the service person activates the MFP 100 with a specific IP address in order to directly connect the MFP 100 to a maintenance PC. When the MFP 100 is set to this mode, the characteristics of the communication performed by the MFP 100 are as follows. This mode assumes a one-to-one direct connection between the MFP 100 and the maintenance PC. Therefore, the addresses recorded in the communication characteristic information tend to be limited to specific addresses. As a result, the usage environment may be estimated to be linked to a smaller network than the actual usage environment.

[0031] Another example of an operation mode is a manufacturing process mode. The target users of this mode are the vendor's manufacturing staff. This mode is an operation mode in which manufacturing staff perform inspection work and the like during the manufacturing process of MFP100. After manufacturing and before shipping, this operation mode is canceled, and the MFP100 will not operate in this mode after shipping. When MFP100 is set to this mode, the characteristics of the communications performed by MFP100 are as follows: communications required for the manufacturing process are performed on a network within the factory. The physical location where MFP100 is installed is itself different from that during normal operation, and it is estimated that the network and communication trends are also different from the normal usage environment.

[0032] The operation mode of the MFP 100 is stored in the flash ROM 211 and can be switched by the operation of the target user. For example, the setting of the fixed IP address mode is set on a setting menu screen (not shown) for service personnel. In the example of this embodiment, it is assumed that when the operation mode change is completed, the MFP 100 is restarted and the operation mode returns to the normal operation mode used by the customer. Note that the change of the operation mode is not limited to the configuration of the present invention, and the means for setting the operation mode and the restart accompanying the change may be performed by other means.

[0033] Fig. 4 is a diagram showing a recommended security setting screen 401 displayed on the operation unit 102. In Fig. 4, a usage environment selection list 410 is a list for selecting the usage environment of the MFP 100. By making a selection in the usage environment selection list 410, a series of security settings that are appropriate for each usage environment are set collectively.

[0034] The selected usage environment display 406 displays the usage environment of the MFP 100 currently being set, selected in the usage environment selection list 410. The selected usage environment display 406 highlights the selected usage environment. That is, a set of setting values ​​recommended for the highlighted usage environment is set in the MFP 100. Information on which usage environment was selected is stored in the data storage unit 302 when the corresponding button was pressed, along with date and time information indicating when the button was pressed. The usage environment estimation result display 407 displays the usage environment of the MFP 100 estimated from the trends in communication characteristic information by an estimation process using a trained model, and information on the date and time when the estimation process was performed. Furthermore, "recommended" is displayed in association with the usage environment item obtained as a result of the estimation process in the usage environment selection list 410. Note that the display here is based on the result and date and time of the last execution of the estimation process. That is, if the usage environment estimation process is not performed in a specific operating mode, the result and date and time of the last execution of the estimation process before the specific operating mode is set is displayed. The information display unit 408 is a display area that notifies the user of various information, such as the execution status and execution results of the estimation process.

[0035] The estimation execution button 409 is a button for manually executing the usage environment estimation process at any timing.

[0036] The cancel setting button 411 is a button for clearing the settings of the selected usage environment. When the cancel setting button 411 is pressed, the information related to the usage environment selection list 410 and the selected usage environment display 406 is reset, and the usage environment becomes an unset state.

[0037] Examples of usage environments used in this embodiment are shown in the table of Figure 8. In this embodiment, six usage environments are taken as examples. For example, an in-house intranet environment is a general office environment. A direct internet connection environment is an office environment that does not have any infrastructure defense functions such as a firewall. An internet-prohibited environment is an isolated network environment in which connection to the internet is prohibited. A home environment is a home network environment designed for working from home. A public space environment is an open space environment where an unspecified number of people enter and exit and share the network. A highly confidential information management environment is a network environment in which security is operated with the highest priority as it handles highly confidential information such as personal identification number information.

[0038] Control of the estimation process according to the operation mode of MFP 100 shown in Fig. 3 will be described with reference to Fig. 5. Fig. 5 is a flowchart showing an example of the process of executing the estimation process in the first embodiment. The process of the flowchart in Fig. 5 is realized by CPU 201 reading a program stored in flash ROM 211 into DRAM 202 and then executing the program. Each process of the flowchart in Fig. 5 is executed by establishment processing unit 310 in cooperation with operation mode control unit 312 and operation control unit 301 as necessary.

[0039] When the power of the MFP 100 is turned on in step S501, each function of the controller shown in Fig. 3 is started. That is, when the estimation processing unit 310 detects that the power of the MFP 100 has been turned on, the process proceeds to step S502, and starts a process for estimating the usage environment.

[0040] In step S503, the estimation processing unit 310 cooperates with the operation mode control unit 312 to obtain information about the current operation mode from the data storage unit 302 and determines whether the operation mode of the MFP 100 matches or does not match the execution conditions for the estimation process. The execution condition in this embodiment is that the operation mode of the MFP 100 is not one of the operation modes shown in the table of FIG. 7. If the operation mode is one of the operation modes shown in the table of FIG. 7, the operation mode control unit 312 determines that the execution conditions for the estimation process are not met. That is, it determines that the estimation process should not be executed. Furthermore, if the operation mode is other than those shown in the table of FIG. 7, the operation mode control unit 312 determines that the execution conditions for the estimation process are met. That is, it determines that the estimation process should be executed.

[0041] If it is determined in step S503 that the estimation process should not be executed, the operation mode control unit 312 ends this flow without executing the estimation process. That is, the usage environment estimation process ends without executing the estimation process in S504 and the notification process in S506. Note that, if the operation mode control unit 312 determines that the estimation process should not be executed, the operation mode control unit 312 may control the estimation execution button 409 to be in a state where it cannot be pressed, in order to control manual execution of the estimation process using the estimation execution button 409. Specifically, if the operation mode control unit 312 determines, in cooperation with the operation control unit 301, that the estimation process should not be executed, the operation mode control unit 312 controls the display so that the estimation execution button 409 cannot be pressed when displaying the screen 401. Note that, until the MFP 100 is next powered on and it is determined in S503 that the operation mode satisfies the execution conditions, the operation mode control unit 312 controls the display so that the estimation execution button 409 cannot be pressed every time the screen 401 is displayed.

[0042] If it is determined in step S503 that estimation processing should be performed, the process proceeds to S504, where the operation mode control unit 312 requests the estimation processing unit 310 to perform usage environment estimation processing. In step S504, the estimation processing unit 310 performs usage environment estimation processing. The estimation processing performed by the estimation processing unit 310 will be described in detail using FIG. 6. The results are then stored via the data storage unit 302.

[0043] Then, the process proceeds to S505, where the estimation processing unit 310 determines whether the result of the estimation processing satisfies the notification condition. Specifically, if the usage environment of the result of the estimation processing is different from the usage environment selected on screen 401 and set in MFP 100, and if the usage environment of the result of the estimation processing is different from the usage environment of the result of the previous estimation processing, it is determined that the notification condition is satisfied. If the usage environment of the result of the estimation processing is the same as the usage environment selected on screen 401 and set in MFP 100, or if the usage environment of the result of the estimation processing is the same as the usage environment of the result of the previous estimation processing, it is determined that the notification condition is not satisfied. If it is determined that the notification condition is not satisfied, the estimation process is terminated without providing a notification via the information display unit 408, which will be described later.

[0044] If it is determined that the notification conditions are met, the process proceeds to S506, where the information display unit 408 cooperates with the operation control unit 301 to notify the user. Specifically, a notification is displayed indicating that the usage environment resulting from the estimation process differs from the usage environment selected on the screen 401 and set in the MFP 100. Note that, although the information display unit 408 is displayed on the recommended security settings screen 401 in FIG. 4, this is not limiting. That is, the information display unit 408 is displayed at the bottom of the screen even while another screen is displayed on the operation unit 102. The estimation process is executed even if the user does not open the screen 401 after turning on the power of the MFP 100. If the usage environment currently being set differs from the usage environment resulting from the estimation, a notification is displayed at the bottom of the screen even when another screen, such as the home screen, is open. This allows the user to recognize that the usage environment settings need to be revised. Note that the notification sent via the information display unit 408 in S506 is canceled when the recommended security settings screen 401 is opened. Also, the setting is cancelled when the power of the MFP 100 is turned off, and the notification is not displayed the next time the power is turned on.

[0045] Furthermore, when the operation control unit 301 receives an instruction to display the screen 401 after the estimation of the usage environment is completed, the operation control unit 301 displays the screen 401 on the operation unit 102, displaying the usage environment of the latest estimation result as a recommended environment type 407.

[0046] Note that the control shown in FIG. 5 is an example of a flow executed when the power is turned on in step S501 of the MFP 100, but similar control may be performed even when the usage environment estimation process is executed when a screen is displayed or after a certain period of time has passed. Furthermore, the determination process of S505 is not essential to the present invention. For example, the estimation result may be notified without fail after the estimation process is executed. Furthermore, the notification conditions are not limited to those described above. For example, the condition may be simply whether the usage environment resulting from the estimation process differs from the usage environment set in the MFP 100. Furthermore, the condition may be simply whether the usage environment resulting from the estimation process differs from the usage environment resulting from the previous estimation process.

[0047] By the processing of the flowchart described in FIG. 5 , the present invention can control so that the estimation process is not performed in a specific operation mode that is not a normal operation mode. Furthermore, it can also control so that the notification of the result of the estimation process is not performed. In a specific operation mode, a usage environment different from that in the normal operation mode may be obtained as a result of the estimation process. That is, unnecessary estimation process may be performed. Consequently, unnecessary notification may be sent. If a usage environment different from that in the normal operation mode is obtained as a result of the estimation process and notified, the user may be confused. Furthermore, if a user who has confirmed the result of the estimation process in a specific operation mode selects the usage environment of the estimation result on the recommended security settings screen 401, security settings suitable for the usage environment of the specific operation mode may be configured. That is, security settings inappropriate for the usage environment of the normal operation mode may be configured. The processing of the present invention can solve these problems.

[0048] 6 is a conceptual diagram showing the input / output structure using the learning model of this embodiment. A learning model (trained model) 601 receives communication feature information 602 as input and outputs a usage environment 603. In this embodiment, the usage environment 603 is configured according to the patterns shown in the table of FIG.

[0049] In this embodiment, the communication characteristic information 602 is configured from the data shown in the table of FIG.

[0050] Traffic volume is the number of communication packets sent and received per unit time. When a device is connected to a network, it can receive unicast communications addressed to itself, broadcasts with no specified destination, and multicasts. Broadcast and multicast traffic volume increases in proportion to the number of information devices on the network, so this information can be used to estimate the size of the network to which it is connected. Unicast communications can be excluded to more clearly identify the network size. The magnitude of the traffic volume value can be used to estimate the relative likelihood that the usage environment is a large network (company intranet, direct Internet connection, Internet access prohibited), a medium-sized public space, or a small home. For example, a large traffic volume value indicates a high likelihood of a large network with a large number of information devices on the network. A small traffic volume value indicates a high likelihood of a small home environment, while a medium traffic volume value indicates a high likelihood of a medium-sized public space.

[0051] The number of destination addresses is the number of variations in the addresses used as destinations for communication packets sent and received per unit time. If a device uses various external services, the number of destination addresses will increase. If the number of destination addresses is extremely small, there is a relatively high possibility that the network is an isolated network with communication restrictions.

[0052] The number of source addresses is the number of variations of addresses used as the source of communication packets sent and received per unit time. When there are a large number of information devices in a network, the number of source addresses becomes large. The size of the number of source addresses depending on the usage environment shows a similar trend to the traffic volume. However, since the number of source addresses is essentially different from the traffic volume, the accuracy of estimating the usage environment can be further improved by looking at the trend in combination with the traffic volume.

[0053] The number of protocol types is the number of protocol variations used by communication packets sent and received per unit time. The more information devices connected to the network, the larger the value of the number of protocol types. Also, in network environments with strict functional restrictions, the number of protocol types will be smaller. If the number of protocol types is small, it is likely that the internet is prohibited or the space is public.

[0054] The variation of the TTL (Time to Live) attribute in the IP header is the number of variations in the TTL value attached to communication packets sent and received per unit time. The TTL value is a value that is subtracted each time a packet passes through a router, so it will have a small value for packets that have passed through many routers. An environment where there are uniformly large TTL values ​​and little variation in the TTL attribute is likely to be a small network. An environment where TTL values ​​range from large to small and where there is a lot of variation in the TTL attribute is likely to be a large network.

[0055] As such, each parameter has a certain tendency with respect to characteristics such as network size, but it is difficult to logically determine a threshold value for making such a judgment. It is also preferable to estimate the usage environment by combining multiple parameters and determining them in a composite manner. For this reason, in this embodiment, a learning algorithm is used to perform estimation processing based on a combination of the usage environment and characteristic information of the communication acquired there. By conducting numerous experiments, it is possible to determine a threshold value without using a learning algorithm, and therefore this technology is applicable even to threshold-based methods that do not use such a learning algorithm.

[0056] The input communication characteristic information is converted into a numerical vector by processing each piece of information (data) obtained from the sent and received communication packets, thereby improving the accuracy of estimation. For the traffic volume and TTL attribute variations, the number per unit time is histogrammed using information as training data in advance, and a threshold is determined for dividing the range into, for example, five ranges so that each range contains the same amount of data. Based on the determined threshold, the traffic volume per unit time and the variation of the TTL attribute are converted into integer values ​​from 1 to 5, which are the corresponding range values, and used as input. Note that while an example of dividing into five ranges is shown, the number of ranges to divide into is arbitrary and can be set appropriately depending on, for example, the value ranges of other parameters.

[0057] Furthermore, for the number of destination addresses, the number of source addresses, and the number of protocol types, we use the variation of unique values ​​after excluding those that occur only once or twice within a unit time. This allows us to observe communication trends while excluding communications that occur infrequently. For example, for the number of destination addresses and the number of source addresses, we count the number of packets with the same value that are duplicated among packets sent and received within a unit time. Then, we select the packets corresponding to the most duplicated values, and when 1% of the packets remain, we use the number of values ​​selected up to that point. In this way, we use the number of addresses obtained by extracting the top 99% of the destination addresses and source addresses of packets sent and received within a unit time. Similarly, for the number of protocol types, we count the number of packets using the same protocol that are duplicated among packets sent and received within a unit time. Then, we select the packets corresponding to the protocol that is most duplicated, and when 1% of the packets remain, we use the number of protocol types selected up to that point. In this way, we use the number of protocol types obtained by extracting the top 99% of the protocol types used by packets sent and received within a unit time. Although it depends on how the unit time is defined, this value will generally fall within the range of 1 to 20, so this value is used. If the value is significantly greater than 20, you can round it down to 20.

[0058] When collecting the number of destination addresses, the number of source addresses, and the number of protocol types, it is preferable to include breakdown information for each. This is because, rather than extracting the top 99% as tuning during learning, it is possible to perform analysis with higher accuracy by extracting the top 90%. For example, in the case of address information, breakdown information would be information on the number of packets for each type, such as 80 packets from 192.168.100.12 and 32 packets from 172.24.100.30. Furthermore, because IP addresses are sometimes treated as personal information, it is preferable to collect address information in a confidential manner, such as by calling 192.168.100.12 Address A and 172.24.100.30 Address B.

[0059] Generally, if parameter values ​​with widely different value ranges are input directly into a learning algorithm, the difference in value ranges can affect estimation accuracy. For example, if only traffic volume has a value range of 1 to 10,000 and other parameters have a value range of 1 to 10, the estimation results will be strongly sensitive to traffic volume. In order to use each parameter in a balanced manner, estimation accuracy can be improved by converting them into numerical vectors and reducing the difference in value ranges.

[0060] The learning model (trained model) 601 can be generated by collecting a large number of samples in a real environment of combinations of communication feature information 602, which is the input, and usage environment 603, which corresponds to the output, and learning based on these samples. In this embodiment, a parameter array per unit time related to the communication feature information 602 is treated as a one-dimensional array, and a two-dimensional array is formed by sampling this array multiple times and arranging it in time series. The trained model is generated using a general algorithm for generating a convolutional neural network (CNN) model using the information in this two-dimensional array and the setting values ​​of the usage environment. Note that a classifier may also be configured using an algorithm such as a k-nearest neighbor method or a support vector machine.

[0061] <Modification> In the first embodiment, an example has been described in which the operation mode control unit 312 manages the definition of the operation mode as a condition for not executing the estimation process. However, the management of the operation mode is not limited to this. For example, the operation mode control unit 312 may manage the definition of the operation mode as a condition for executing environment estimation. That is, the control of the estimation process may be realized in an embodiment in which the normal mode is defined as the operation mode for normal operation of the MFP 100, and the estimation process is executed in the normal mode.

[0062] In addition, the operation mode control unit 312 may be configured to execute the estimation process when the estimation process is manually executed even in an operation mode that does not execute the estimation process, or when it detects that the operation mode has switched from one that does not execute environmental estimation to one that does.

[0063] Furthermore, although an example has been described in which the environment estimation button 409 is controlled so that it cannot be pressed in an operation mode in which estimation processing is not executed, the present invention is not limited to this. The environment estimation button 409 may not be controlled, and environment estimation may be executed regardless of the operation mode when the user intentionally requests execution.

[0064] <Other embodiments> The present invention can also be realized by supplying a program that realizes one or more functions of each of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program. It can also be realized by a circuit (e.g., ASIC or FPGA) that realizes one or more functions. [Explanation of symbols]

[0065] 100 MFP 110 LAN 120 Internet 401 Recommended security settings screen 402 Usage environment Internal LAN button 403 Usage environment at home button 404 Usage Environment Public Space Button 405 Usage environment isolation network button 406 Display of selected usage environment 407 Usage environment estimation result display 408 Information display section 409 Estimation execution button

Claims

1. An image forming apparatus capable of communicating with an external device, a control unit that controls an estimation process for estimating a usage environment of the image forming apparatus using information based on communication packets transmitted and received by the image forming apparatus; a notification means for issuing a notification corresponding to the result of the estimation process; and the control means controls the image forming apparatus so as not to perform the estimation process when the image forming apparatus is set to a specific mode; The specific mode may be a mode for communicating only with a specific external device, a mode for downloading firmware from a server, or a mode used in the manufacturing process. An image forming apparatus characterized by:

2. The specific external device is a computer for maintenance 2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

3. a display control means for displaying a screen for accepting a selection of a usage environment of the image forming apparatus; a setting unit for setting a setting value corresponding to the usage environment selected on the screen in the image forming apparatus; and The notification means issues a notification when the usage environment obtained as a result of the estimation process is selected on the screen and the corresponding setting value is different from the usage environment set in the image forming apparatus.

2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

4. The result of the estimation process is displayed on the screen.

4. The image forming apparatus according to claim 3, wherein the image forming apparatus is a recording medium.

5. the control unit performs the estimation process when the image forming apparatus is turned on and the image forming apparatus is not set to a specific mode; As a result of the estimation process, the latest result of the estimation process is displayed on the screen.

5. The image forming apparatus according to claim 4.

6. A control method for an image forming apparatus capable of communicating with an external device, comprising: a control step of controlling an estimation process for estimating a usage environment of the image forming apparatus using information based on communication packets transmitted and received by the image forming apparatus; a notification step of issuing a notification corresponding to the result of the estimation process; and In the control step, when the image forming apparatus is set to a specific mode, the estimation process is not performed; The specific mode may be a mode for communicating only with a specific external device, a mode for downloading firmware from a server, or a mode used in the manufacturing process. A control method comprising:

7. An image forming apparatus capable of communicating with an external device, a control unit that controls an estimation process for estimating a usage environment of the image forming apparatus using information based on communication packets transmitted and received by the image forming apparatus; a notification means for issuing a notification corresponding to the result of the estimation process; A program for functioning as the control means controls the image forming apparatus so as not to perform the estimation process when the image forming apparatus is set to a specific mode; The specific mode may be a mode for communicating only with a specific external device, a mode for downloading firmware from a server, or a mode used in the manufacturing process. A program characterized by:

Images