Anomaly detection method, information processing device, and program

Abstract

This information processing device acquires remote operation information for remotely operating an appliance, acquires event information indicating occurrence of a specific event that is concerning the behavior of a user and that is associated with the remote operation, determines whether the remote operation is normal or abnormal on the basis of relationship information indicating a relationship between the remote operation and the event, and the acquired remote operation information and the acquired event information, and outputs abnormality notification when the remote operation has been determined to be abnormal.

Description

Technical Field

[0001] The present disclosure relates to an abnormality determination method, an information processing apparatus, and a program.

Background Art

[0002] Patent Document 1 discloses a device control system including an abnormal state determination unit. When the abnormal state determination unit determines that the operation mode of the control device is a remote control mode, it reduces the magnitude of the abnormality determination threshold compared to when it determines that the operation mode is not the remote control mode.

[0003] However, Patent Document 1 does not consider at all determining whether remote operation is normal or abnormal based on remote operation information and event information.

Prior Art Literature

Patent Literature

[0004]

Patent Document 1

Summary of the Invention

[0005] An object of the present disclosure is to obtain an abnormality determination method, an information processing apparatus, and a program that can determine whether remote operation is normal or abnormal with high accuracy based on remote operation information and event information.

Means for Solving the Problem

[0006] An abnormality determination method according to an aspect of the present disclosure is characterized in that an information processing apparatus acquires remote operation information for remotely operating a device, acquires event information indicating occurrence of a predetermined event related to a user's behavior associated with the remote operation, determines whether the remote operation is normal or abnormal based on relevance information indicating a relevance between the remote operation and the event, the acquired remote operation information and the acquired event information, and outputs an abnormality notification when it is determined that the remote operation is abnormal. [Brief explanation of the drawing]

[0007] [Figure 1] This diagram shows a simplified overall configuration of the remote control system. [Figure 2] This is a flowchart showing the processing flow executed by the information processing unit. [Figure 3] This figure shows an example of table information. [Figure 4] This figure shows an example of table information. [Figure 5] This diagram shows a simplified overall configuration of the remote control system. [Figure 6] This is a flowchart showing the processing flow executed by the information processing unit. [Figure 7] This figure shows an example of table information. [Modes for carrying out the invention]

[0008] (Knowledge that forms the basis of this disclosure) With the spread of IoT technology, users can now connect various devices such as home appliances to a communication network and remotely control them from operating terminals such as smartphones via the communication network.

[0009] While this convenience is a major concern, remote control systems also raise concerns among users that their equipment could be illegally controlled through hacking by third parties. Therefore, in order to instill confidence in users and promote the widespread adoption of remote control systems, it is crucial to develop a system that can detect abnormal remote control operations with high accuracy.

[0010] In the equipment control system disclosed in Patent Document 1, the abnormal state determination unit reduces the magnitude of the abnormal determination threshold when it determines that the operating mode of the control device is remote control mode, compared to when it determines that the operating mode is not remote control mode. However, this equipment control system does not consider determining whether remote control is normal or abnormal based on remote control information and event information, and the determination accuracy is insufficient, so further improvement in determination accuracy is desired.

[0011] To solve these problems, the inventors have come up with the present disclosure based on the finding that it is possible to determine with high accuracy whether remote operation is normal or abnormal by using remote operation information and event information associated therewith.

[0012] Next, we will describe each aspect of this disclosure.

[0013] An abnormality determination method according to a first aspect of this disclosure involves an information processing device acquiring remote operation information for remotely controlling equipment, acquiring event information indicating the occurrence of a predetermined event related to user behavior associated with the remote operation, determining whether the remote operation is normal or abnormal based on relationship information indicating the relationship between the remote operation and the event, the acquired remote operation information, and the event information, and outputting an abnormality notification if it is determined that the remote operation is abnormal.

[0014] According to the first embodiment, the information processing device determines whether the remote operation is normal or abnormal based on relationship information indicating the relationship between the remote operation and the event, and the acquired remote operation information and event information. This makes it possible to determine whether the remote operation is normal or abnormal with high accuracy.

[0015] In the first embodiment, the anomaly determination method according to the second aspect of this disclosure may include, in relation information, a first threshold information relating to the time difference between the time the remote operation information is acquired and the time the event occurs.

[0016] According to the second aspect, the relevance information includes first threshold information relating to the time difference between the acquisition time of remote control information and the occurrence time of an event, thereby making it possible to improve the accuracy of determining whether a remote operation is normal or abnormal.

[0017] In the abnormality determination method according to the third aspect of the present disclosure, in the second aspect, the content of the abnormality notification may be varied according to the correlation strength between the acquisition time of the remote control information and the occurrence time of the event.

[0018] According to the third aspect, by varying the content of the abnormality notification according to the correlation strength, it is possible to clearly notify a user of the occurrence of a truly highly urgent abnormality.

[0019] In the abnormality determination method according to the fourth aspect of the present disclosure, in the first or second aspect, it may further be determined whether the remote operation is normal or abnormal based on the acquisition time of the remote control information and second threshold information relating to the variation in the acquisition time.

[0020] According to the fourth aspect, the information processing apparatus determines whether a remote operation is normal or abnormal based on the acquisition time of remote control information and second threshold information relating to the variation in the acquisition time. This makes it possible to further improve the accuracy of determining whether a remote operation is normal or abnormal.

[0021] In the abnormality determination method according to the fifth aspect of the present disclosure, in the fourth aspect, the content of the abnormality notification may be varied according to the correlation strength between the acquisition time of the remote control information and the variation in the acquisition time.

[0022] According to the fifth aspect, by varying the content of the abnormality notification according to the correlation strength, it is possible to clearly notify a user of the occurrence of a truly highly urgent abnormality.

[0023] The abnormality determination method according to the sixth aspect of this disclosure may further output a confirmation notice to the user to ask whether or not to discontinue the remote operation if it is determined that the remote operation is abnormal, in any one of the first to fifth aspects.

[0024] According to the sixth aspect, the information processing device outputs a confirmation notice, allowing the user to perform a cancellation operation to stop an abnormal remote operation.

[0025] The abnormality determination method according to the seventh aspect of this disclosure may further output a control command to cancel the remote operation if it is determined that the remote operation is abnormal in any one of the first to fifth aspects.

[0026] According to the seventh aspect, the information processing device can output a control command to stop an abnormal remote operation without requiring a user to cancel it.

[0027] An information processing device according to the eighth aspect of this disclosure includes: an acquisition unit that acquires remote operation information for remotely operating a device and event information indicating the occurrence of a predetermined event relating to user behavior associated with the remote operation; a relationship information indicating the relationship between the remote operation and the event; a determination unit that determines whether the remote operation is normal or abnormal based on the acquired remote operation information and event information; and an output unit that outputs an abnormality notification when it is determined that the remote operation is abnormal.

[0028] According to the eighth aspect, the determination unit determines whether the remote operation is normal or abnormal based on relationship information indicating the relationship between the remote operation and the event, and the acquired remote operation information and event information. This makes it possible to determine whether the remote operation is normal or abnormal with high accuracy.

[0029] The program according to the ninth aspect of this disclosure causes the information processing device to function as an acquisition means for acquiring remote operation information for remotely operating equipment and event information indicating the occurrence of a predetermined event relating to user behavior associated with the remote operation; relationship information indicating the relationship between the remote operation and the event; determination means for determining whether the remote operation is normal or abnormal based on the acquired remote operation information and event information; and output means for outputting an abnormality notification when it is determined that the remote operation is abnormal.

[0030] According to the ninth aspect, the determination means determines whether the remote operation is normal or abnormal based on relationship information indicating the relationship between the remote operation and the event, and the acquired remote operation information and event information. This makes it possible to determine whether the remote operation is normal or abnormal with high accuracy.

[0031] This disclosure can also be implemented as a program that causes a computer to execute each characteristic configuration included in such a method or apparatus, or as a system that operates using such a program. It goes without saying that such a computer program can be distributed via a computer-readable, non-temporary recording medium such as a CD-ROM, or via a communication network such as the Internet. (Embodiments of the present disclosure)

[0032] Embodiments of the present disclosure will be described in detail below with reference to the drawings. However, unnecessary details may be omitted. For example, detailed explanations of already well-known matters or redundant explanations of substantially identical configurations may be omitted. This is to avoid the following explanation being unnecessarily verbose and to facilitate understanding for those skilled in the art.

[0033] The attached drawings and the following description are provided to enable those skilled in the art to fully understand this disclosure and are not intended to limit the subject matter described in the claims.

[0034] (First Embodiment) Figure 1 is a simplified diagram showing the overall configuration of a remote control system 1 according to the first embodiment of this disclosure. The remote control system 1 comprises an anomaly detection server 2, a remote control terminal 3, a remote control server 4, a communication device 51, a detection device 52, and a device to be operated 53. The device to be operated 53 is the device to be remotely operated by the remote control terminal 3. The communication device 51, the detection device 52, and the device to be operated 53 are installed, for example, in a house 5 where the user resides. The anomaly detection server 2, the remote control terminal 3, the remote control server 4, and the communication device 51 can communicate with each other via a communication network 6. The communication network 6 is a dedicated or general-purpose network of any type that supports any communication method such as IP.

[0035] The anomaly detection server 2 comprises an information processing unit 11, a storage unit 12, and a communication unit 13. The information processing unit 11 is configured using a CPU, etc. The storage unit 12 is configured using an HDD, SSD, or flash memory, etc. The communication unit 13 is configured using a communication module, etc., that corresponds to the communication method of the communication network 6. The information processing unit 11 has an acquisition unit 21, a setting unit 22, a determination unit 23, and an output unit 24 as functions realized by the CPU executing a predetermined program. The storage unit 12 stores remote control data 31, event data 32, threshold data 33, and table information 101. Details of this data and information will be described later. The acquisition unit 21 acquires remote control command signals as remote control information for remotely controlling the target device 53 from the remote control terminal 3 via the communication network 6 and the communication unit 13. The acquisition unit 21 also acquires event detection signals as event information indicating the occurrence of an event from the detection device 52 via the communication device 51, the communication network 6, and the communication unit 13. Furthermore, the acquisition unit 21 acquires remote control data 31 and event data 32 stored as a database in the storage unit 12 by reading them from the storage unit 12. The setting unit 22 performs statistical data analysis on the remote control data 31 and event data 32 acquired by the acquisition unit 21. The setting unit 22 also sets a first threshold based on the results of the data analysis and stores threshold data 33 indicating the first threshold in the storage unit 12. Furthermore, the setting unit 22 creates table information 101 by associating the remote control content, the corresponding event content, and the first threshold based on the remote control data 31, event data 32, and threshold data 33. The setting unit 22 stores the created table information 101 in the storage unit 12. The determination unit 23 determines whether the remote control command signal to be determined is normal or abnormal. The output unit 24 generates and outputs an alert notification if it is determined that the remote control command signal is abnormal.

[0036] The remote control terminal 3 is, for example, a smartphone owned by a user who is a resident of the house 5. The remote control terminal 3 comprises an input unit 41, a display unit 42, a processing unit 43, and a communication unit 44. The input unit 41 and the display unit 42 are configured using, for example, a touch panel display using liquid crystal or organic EL. The processing unit 43 is configured using a CPU or the like. The communication unit 44 is configured using a communication module or the like that corresponds to the communication method of the communication network 6.

[0037] House 5 is equipped with a communication device 51, a detection device 52, and a device to be operated 53. The communication device 51 is configured, for example, using a gateway device to connect an external communication network 6 to a communication network such as a wireless LAN inside House 5. The detection device 52 is a sensor for detecting the occurrence of a predetermined event within House 5. A predetermined event refers to an event or occasion related to the user's actions, such as leaving home, returning home, dropping off or picking up children from cram school, eating out with family, taking lessons, or attending school events. For example, if the predetermined event is the user leaving home or returning home, the detection device 52 is a motion sensor installed at the entrance of House 5 or a door opening / closing sensor for the front door. The device to be operated 53 is an IoT device that can be remotely controlled from outside House 5, such as an air conditioner, an electronic lock on the front door, or a Blu-ray recorder.

[0038] The remote control server 4 receives a remote control command signal transmitted from the remote control terminal 3, and generates and transmits a control signal to control the operation of the target device 53 based on the remote control command signal. The target device 53 is remotely controlled when this control signal is input to the target device 53 via the communication device 51.

[0039] Figure 2 is a flowchart showing the processing flow executed by the information processing unit 11 of the anomaly detection server 2.

[0040] When a user inputs a remote control command for the target device 53 from the input unit 41 of the remote control terminal 3, the processing unit 43 transmits a remote control command signal from the communication unit 44 to the remote control server 4 and the anomaly detection server 2 via the communication network 6. The communication unit 13 of the anomaly detection server 2 receives the remote control command signal. In step SP101, the acquisition unit 21 acquires the remote control command signal received by the communication unit 13 from the communication unit 13. The information processing unit 11 also stores the remote control command signal received by the communication unit 13 in the storage unit 12. The remote control command signal is stored in the storage unit 12 as one record of the remote control data 31, which is a database. Furthermore, when the detection device 52 detects the occurrence of a predetermined event within the house 5, an event detection signal related to that event is transmitted from the communication device 51 to the anomaly detection server 2 via the communication network 6. The communication unit 13 of the anomaly detection server 2 receives the event detection signal. In step SP101, the acquisition unit 21 acquires the event detection signal received by the communication unit 13 from the communication unit 13. Furthermore, the information processing unit 11 stores the event detection signal received by the communication unit 13 in the storage unit 12. The event detection signal is stored in the storage unit 12 as one record in the event data 32, which is a database. Each time the communication unit 13 receives a remote control command signal and an event detection signal, the remote control command signal and the event detection signal are stored in the storage unit 12. As a result, the storage unit 12 accumulates remote control data 31, which is a database containing multiple records corresponding to multiple remote control command signals, and event data 32, which is a database containing multiple records corresponding to multiple event detection signals.

[0041] In step SP102, the acquisition unit 21 acquires the remote control data 31 and event data 32 stored in the storage unit 12. The setting unit 22 performs statistical data analysis on the acquired remote control data 31 and event data 32.

[0042] In step SP103, the setting unit 22 sets a first threshold based on the results of the data analysis in step SP102 and stores threshold data 33 indicating the first threshold in the storage unit 12. The setting unit 22 also creates table information 101 by associating the remote operation content with the corresponding event content and the first threshold based on the remote operation data 31, event data 32, and threshold data 33, and stores the table information 101 in the storage unit 12.

[0043] Figure 3 shows an example of table information 101. In this example, the remote operation "Air conditioner ON" for the air conditioner, which is the target device 53, is associated with the event of the user returning to the house 5, and "1 hour" is set as the first threshold for the time difference between turning on the air conditioner and returning home. Similarly, the remote operation "Unlock electronic lock" for the electronic lock on the front door, which is the target device 53, is associated with the event of the user returning to the house 5, and "1 minute" is set as the first threshold for the time difference between unlocking the electronic lock and returning home. These first thresholds correspond to association information that shows the relationship between the remote operation and the corresponding event. The setting unit 22 can, for example, calculate the average value and standard deviation σ of the time difference based on a large number of samples of the time difference between the reception time (acquisition time) of the remote operation command signal and the reception time (event occurrence time) of the event detection signal related to the corresponding event, and set the time obtained by adding, for example, a time equivalent to +3σ to the average value of the time difference as the first threshold. However, +3σ is just an example, and it could be +2σ or +1σ, etc. The same applies to the second threshold, which will be discussed later. In the example shown in Figure 3, the first threshold for remote operation to turn on the air conditioner is set to 1 hour, and the first threshold for remote operation to unlock the electronic lock is set to 1 minute. In other words, in the example shown in Figure 3, it is typical for the user of this house 5 to return home within 1 hour of sending the remote operation command signal to turn on the air conditioner, and also typical for the user to return home within 1 minute of sending the remote operation command signal to unlock the electronic lock. Each time the communication unit 13 receives a remote operation command signal and an event detection signal, the setting unit 22 calculates the first threshold and updates the contents of the threshold data 33 and table information 101 stored in the storage unit 12.

[0044] In step SP104, the determination unit 23 determines whether the remote control command signal to be determined is normal or abnormal. In the example shown in Figure 3, if the remote control command signal to be determined is for the air conditioner to be turned ON, the determination unit 23 calculates the time difference between the reception time (acquisition time) of the remote control command signal for turning the air conditioner ON and the reception time (occurrence time) of the event detection signal related to the user's return home event, and determines whether that time difference is within the first threshold (1 hour in the example of Figure 3). Also, if the remote control command signal to be determined is for unlocking the electronic lock, the determination unit 23 calculates the time difference between the reception time (acquisition time) of the remote control command signal for unlocking the electronic lock and the reception time (occurrence time) of the event detection signal related to the user's return home event, and determines whether that time difference is within the first threshold (1 minute in the example of Figure 3).

[0045] If the time difference is within the first threshold (step SP105: NO), the remote control command signal being judged is considered normal, and the process returns to step SP101.

[0046] If the time difference exceeds the first threshold (step SP105: YES), the remote control command signal being judged is deemed abnormal. In step SP106, the output unit 24 generates and outputs an alert notification, such as text or a graphic, to inform the user that an abnormal remote control has been performed. The communication unit 13 transmits the alert notification data received from the output unit 24 to the remote control terminal 3 via the communication network 6. At the remote control terminal 3, the communication unit 44 receives the alert notification data, and the processing unit 43 displays the alert notification on the display unit 42 based on the data received by the communication unit 44.

[0047] Next, in step SP107, the output unit 24 generates and outputs a cancellation confirmation notice, such as text or a graphic, to ask the user whether or not to cancel (cancel) the abnormal remote operation. The communication unit 13 transmits the cancellation confirmation notice data received from the output unit 24 to the remote operation terminal 3 via the communication network 6. At the remote operation terminal 3, the communication unit 44 receives the cancellation confirmation notice data, and the processing unit 43 displays the cancellation confirmation notice on the display unit 42 based on the data received by the communication unit 44.

[0048] When a user inputs a command to cancel remote operation from the input unit 41 of the remote operation terminal 3, the processing unit 43 transmits a cancellation command signal from the communication unit 44 to the remote control server 4 via the communication network 6. The remote control server 4 receives the cancellation command signal transmitted from the remote operation terminal 3 and, based on the cancellation command signal, generates and transmits a control signal to cancel the remote operation of the target device 53. When this control signal is input to the target device 53 via the communication device 51, the remote operation of the target device 53 is canceled.

[0049] In addition, the alert notification in step SP106 and the cancellation confirmation notification in step SP107 may be output as voice messages from the speaker of the remote control terminal 3, instead of being displayed on the display unit 42 as text or images.

[0050] Furthermore, the alert notification in step SP106 and the cancellation confirmation notification in step SP107 may be executed simultaneously as a single step rather than as separate steps.

[0051] Furthermore, the cancellation confirmation notification in step SP107 may be a request signal that asks the user to input a response regarding whether or not to cancel the abnormal remote operation. If a response indicating that the remote operation should be canceled is input from the input unit 41, such as by tapping the cancel button, the response signal may be sent from the remote operation terminal 3 to the abnormality detection server 2, and the abnormality detection server 2 may send a remote operation cancellation control command to the remote control server 4. Here, if the determination unit 23 determines that the remote operation is abnormal, the response input from the user may be omitted, and the abnormality detection server 2 may immediately send a remote operation cancellation control command to the remote control server 4.

[0052] Furthermore, it is possible to individually configure whether to require a response input from the user or to immediately send a cancellation control command without requiring a response input, depending on the type of remote operation. For example, for remote operations of low security importance, such as turning on an air conditioner, a response input from the user may be required, while for remote operations of high security importance, such as unlocking an electronic lock, a cancellation control command may be sent immediately.

[0053] Furthermore, if the corresponding event is the user leaving or returning home, the determination unit 23 may determine whether the user who left or returned home is a registered legitimate user by analyzing the video footage captured by the camera installed at the entrance of the house 5, or by comparing it with beacon information received from the user's smartphone. The determination unit 23 does not have to treat the event as having occurred if it is not an event by a legitimate user.

[0054] According to this embodiment, the anomaly detection server 2 (information processing device) determines whether the remote operation to be judged is normal or abnormal based on a first threshold (relationship information) indicating the relationship between the remote operation and the corresponding event, and the remote operation command signal (remote operation information) and event detection signal (event information) acquired by the acquisition unit 21. This makes it possible to determine whether the remote operation is normal or abnormal with high accuracy.

[0055] Furthermore, according to this embodiment, the relevance information includes threshold data 33 (first threshold information) relating to the time difference between the time the remote control command signal is acquired and the time the event occurs, thereby improving the accuracy of determining whether the remote control is normal or abnormal.

[0056] Furthermore, according to this embodiment, when the abnormality detection server 2 outputs a cancellation confirmation notice, the user can perform a cancellation operation to stop the abnormal remote operation.

[0057] Furthermore, according to this embodiment, the abnormal remote operation can be immediately terminated without user intervention by the abnormality detection server 2 outputting a termination control command.

[0058] (Second Embodiment) In the first embodiment described above, the determination unit 23 determined whether the time difference between the acquisition time of the remote control command signal and the occurrence time of the corresponding event was within a first threshold. In addition to this, it may also determine whether the acquisition time of the remote control command signal was within a second threshold related to the variation in said acquisition time. However, the first threshold may be omitted, and the normality or abnormality of the remote control may be determined based only on the second threshold.

[0059] Figure 4 shows an example of table information 102. In this embodiment, table information 102 is stored in the storage unit 12 instead of table information 101 shown in Figure 1. In the example shown in Figure 4, in addition to the items shown in Figure 3, the time "18:00" is set as the average acquisition time for turning the air conditioner ON, and "30 minutes" is set as the second threshold related to the time difference from that average acquisition time. Also, the time "19:00" is set as the average acquisition time for unlocking the electronic lock, and "30 minutes" is set as the second threshold related to the time difference from that average acquisition time. In this embodiment, threshold data 33 indicating the first threshold and the second threshold is stored in the storage unit 12.

[0060] The second threshold indicates the maximum allowable variation in the acquisition time of remote control information. The setting unit 22 can, for example, calculate the mean and standard deviation σ based on a large number of samples of the reception time (acquisition time) of remote control commands, and set a time corresponding to, for example, ±3σ of the mean as the second threshold. In other words, in the example shown in Figure 4, the user of this house 5 usually sends a remote control command signal to turn on the air conditioner between 17:30 and 18:30, and also usually sends a remote control command signal to unlock the electronic lock between 18:30 and 19:30. Each time the communication unit 13 receives a remote control command signal, the setting unit 22 calculates the second threshold and updates the contents of the threshold data 33 and table information 102 stored in the storage unit 12.

[0061] In step SP104, the determination unit 23 performs the following determination processing in addition to the determination processing of the first embodiment described above. In the example shown in Figure 4, if the remote control command signal to be determined is for the air conditioner to be ON, the determination unit 23 calculates the time difference between the acquisition time of the remote control command signal for the air conditioner to be ON and the average acquisition time (18:00), and determines whether the time difference is within the second threshold (30 minutes). Also, if the remote control command signal to be determined is for the electronic lock to be unlocked, the determination unit 23 calculates the time difference between the acquisition time of the remote control command signal for the electronic lock to be unlocked and the average acquisition time (19:00), and determines whether the time difference is within the second threshold (30 minutes).

[0062] In addition to the determination process of the first embodiment described above, the determination unit 23 determines that the remote control command signal to be determined is normal if the time difference between the acquisition time of the remote control command signal and the average acquisition time is within the second threshold. Specifically, the determination unit 23 determines that the remote control command signal to be determined is normal if the time difference between the acquisition time of the remote control command signal and the occurrence time of the corresponding event is within the first threshold, and the time difference between the acquisition time of the remote control command signal and the average acquisition time is within the second threshold. On the other hand, if the time difference between the acquisition time of the remote control command signal and the average acquisition time exceeds the second threshold, the determination unit 23 determines that the remote control command signal to be determined is abnormal. Specifically, the determination unit 23 determines that the remote control command signal to be determined is abnormal if the time difference between the acquisition time of the remote control command signal and the occurrence time of the corresponding event exceeds the first threshold, or if the time difference between the acquisition time of the remote control command signal and the average acquisition time exceeds the second threshold.

[0063] According to this embodiment, in addition to the determination process of the first embodiment, the determination unit 23 determines whether the remote control command signal is normal or abnormal based on the acquisition time of the remote control command signal and second threshold information regarding the variation in said acquisition time. This makes it possible to further improve the accuracy of determining whether the remote control is normal or abnormal.

[0064] (Third embodiment) The information processing unit 11 may vary the content of the abnormality notification depending on the correlation strength between the acquisition time of the remote control command signal and the occurrence time of the event, or depending on the correlation strength between the acquisition time of the remote control command signal and the variation in said acquisition time. Figure 5 is a simplified diagram showing the overall configuration of the remote control system 1 according to the third embodiment of this disclosure. In addition to the first or second embodiment described above, correlation data 34 is stored in the storage unit 12.

[0065] Figure 6 is a flowchart showing the processing flow executed by the information processing unit 11 according to the third embodiment. The following explanation will focus on the differences from the second embodiment described above.

[0066] In step SP103, the setting unit 22 sets the first and second correlation strengths based on the results of the data analysis in step SP102, and stores the correlation data 34 indicating the settings in the storage unit 12. The first correlation strength represents the magnitude of the correlation (smallness of variation) between the acquisition time of the remote control command signal and the occurrence time of the corresponding event in two stages: "strong" or "weak". The second correlation strength represents the magnitude of the correlation between the acquisition time of the remote control command signal and the variation in said acquisition time in two stages: "strong" or "weak". However, the first and second correlation strengths may be divided into three or more stages. The setting unit 22 also creates table information 103 that associates the remote control content, the corresponding event content, the first and second thresholds, and the first and second correlation strengths based on the remote control data 31, event data 32, threshold data 33, and correlation data 34, and stores the table information 103 in the storage unit 12.

[0067] Figure 7 shows an example of table information 103. A first correlation strength is set corresponding to the first threshold, and a second correlation strength is set corresponding to the second threshold. In the example shown in Figure 7, a first correlation strength of "strong" is set corresponding to the first threshold (1 hour) for turning the air conditioner ON, and a first correlation strength of "strong" is set corresponding to the first threshold (1 minute) for unlocking the electronic lock. In addition, a second correlation strength of "weak" is set corresponding to the second threshold (30 minutes) for turning the air conditioner ON, and a second correlation strength of "strong" is set corresponding to the second threshold (30 minutes) for unlocking the electronic lock.

[0068] If the time difference between the acquisition time of the remote control command signal and the occurrence time of the corresponding event is within the first threshold (step SP105A: NO), and the time difference between the acquisition time of the remote control command signal and the average acquisition time is within the second threshold (step SP105B: NO), the determination unit 23 determines that the remote control command signal to be judged is normal and returns to step SP101. On the other hand, if the time difference between the acquisition time of the remote control command signal and the occurrence time of the corresponding event deviates beyond the first threshold (step SP105A: YES), or if the time difference between the acquisition time of the remote control command signal and the average acquisition time deviates beyond the second threshold (step SP105B: YES), then in step SP201, the determination unit 23 determines whether the correlation strength set in accordance with the deviating threshold is "strong" or "weak".

[0069] If the correlation strength is "strong" (step SP201: YES), then in step SP106, the output unit 24 generates and outputs an alert notification to strongly inform the user that an abnormal remote operation has been performed by highlighting it. The communication unit 13 transmits the alert notification data received from the output unit 24 to the remote operation terminal 3 via the communication network 6. At the remote operation terminal 3, the communication unit 44 receives the alert notification data, and the processing unit 43 displays the alert notification on the display unit 42 based on the data received by the communication unit 44.

[0070] If the correlation strength is "weak" (step SP201: NO), then in step SP202, the output unit 24 generates and outputs a warning notification to normally inform the user that an abnormal remote operation has been performed. The communication unit 13 transmits the warning notification data received from the output unit 24 to the remote operation terminal 3 via the communication network 6. At the remote operation terminal 3, the communication unit 44 receives the warning notification data, and the processing unit 43 displays the warning notification on the display unit 42 based on the data received by the communication unit 44.

[0071] Furthermore, the correlation strength may be set according to the type of device 53 being operated. For example, the correlation strength may be set to "weak" for devices 53 that are of low security importance, such as air conditioners, while the correlation strength may be set to "strong" for devices 53 that are of high security importance, such as electronic locks on front doors.

[0072] According to this embodiment, by varying the content of the anomaly notification according to the correlation strength, it becomes possible to clearly inform users of truly urgent anomalies.

[0073] As an example of varying the content of anomaly notifications depending on the correlation strength, if the correlation strength is below a threshold (in the case of "weak" in the above example), the output unit 24 provides a first type of anomaly notification (warning notification in the above example) that includes a normal display. On the other hand, if the correlation strength is above the threshold (in the case of "strong" in the above example), the output unit 24 provides a second type of anomaly notification (alert notification in the above example) that includes a highlighting that suggests a higher level of urgency than the first type. This makes it possible to clearly inform users of truly urgent anomalies. [Industrial applicability]

[0074] This disclosure is particularly useful for applications to remote control systems that enable remote operation of IoT devices and other devices within a home from an operating terminal such as a smartphone. [Explanation of Symbols]

[0075] 2 Anomaly detection server 11. Information Processing Department 12 Storage section 21 Acquisition Department 22 Setting section 23 Judgment section 24 Output section 31 Remote control data 32 Event Data 33 Threshold data 34. Correlation Data

Claims

1. Information processing device, We obtain remote control information to remotely control the equipment. The system acquires event information indicating the occurrence of a predetermined event related to the user's actions, which is associated with the aforementioned remote operation. The relationship between the remote operation and the event is shown, and for each combination of the content of the remote operation and the content of the event, the relationship information includes a first threshold information relating to the time difference between the time the remote operation information was acquired and the time the event occurred, and based on the acquired remote operation information and the event information, the first threshold indicated by the first threshold information corresponding to the combination of the content of the remote operation indicated by the acquired remote operation information and the content of the event indicated by the acquired event information is compared with the time difference between the time the remote operation information was acquired and the time the event occurred to determine whether the remote operation was normal or abnormal. If the remote operation is determined to be abnormal, an abnormality notification will be output. Abnormality determination method.

2. The abnormality determination method according to Claim 1, wherein the first threshold information is set based on the mean and standard deviation of a plurality of samples of the time difference between the acquisition time of the remote operation information and the occurrence time of the event, obtained for each combination.

3. The abnormality determination method according to claim 1, wherein the content of the abnormality notification is varied according to the strength of the correlation between the time of acquisition of the remote control information and the time of occurrence of the event.

4. Furthermore, the method for determining whether the remote operation is normal or abnormal is determined based on the time of acquisition of the remote operation information and a second threshold information relating to the variation in the acquisition time.

5. The abnormality determination method according to claim 4, wherein the content of the abnormality notification is varied according to the strength of the correlation between the time of acquisition of the remote control information and the variation in the time of acquisition.

6. Furthermore, the abnormality detection method according to any one of claims 1 to 5, wherein if it is determined that the remote operation is abnormal, a confirmation notice is output to the user to ask whether or not to cancel the remote operation.

7. Furthermore, the abnormality determination method according to any one of claims 1 to 5, wherein if it is determined that the remote operation is abnormal, a control command to cancel the remote operation is output.

8. An acquisition unit that acquires remote operation information for remotely controlling equipment and event information indicating the occurrence of a predetermined event related to user actions associated with the remote operation, A determination unit that determines whether the remote operation is normal or abnormal by comparing the acquired remote operation information and the event information with a first threshold information corresponding to the combination of the content of the remote operation and the content of the event, which indicates the relationship between the remote operation and the event, and a first threshold indicated by the first threshold information corresponding to the combination of the content of the remote operation indicated by the acquired remote operation information and the content of the event indicated by the acquired event information, and the time difference between the time of acquisition of the remote operation information and the time of occurrence of the event, based on the acquired remote operation information and the event information, An output unit that outputs an abnormality notification when it is determined that the remote operation is abnormal, An information processing device equipped with the following features.

9. Information processing equipment, An acquisition means for acquiring remote operation information for remotely controlling equipment and event information indicating the occurrence of a predetermined event related to user behavior associated with the remote operation, A determination means for determining whether the remote operation is normal or abnormal by comparing the acquired remote operation information and the event information with a first threshold information relating to the time difference between the acquisition time of the remote operation information and the occurrence time of the event, which indicates the relationship between the remote operation and the event, for each combination of the content of the remote operation and the content of the event, and a first threshold indicated by the first threshold information corresponding to the combination of the content of the remote operation indicated by the acquired remote operation information and the content of the event indicated by the acquired event information, and the time difference between the acquisition time of the remote operation information and the occurrence time of the event. An output means that outputs an abnormality notification when it is determined that the remote operation is abnormal, A program designed to function as such.

Images