Information processing device and file change detection method

Abstract

An information processing device according to one aspect of the present invention comprises: a storage unit that stores a detection object file; a pattern definition unit; a change detection unit; a difference search unit; a similarity-degree calculation unit; and a change determination unit. The pattern definition unit generates a pattern definition by associating, with the detection object file, a difference file between the detection object file and a post-reflection file in which the situation to be monitored is reflected in the detection object file. The change detection unit detects a change in the detection object file. The difference search unit searches for a difference between the detection object file before and after the change, and generates a patch file. The similarity-degree calculation unit calculates the similarity degree between the pattern definition and the patch file. The change determination unit determines, on the basis of the similarity degree, whether or not the situation to be monitored has occurred.

Description

Information processing device and file change detection method

[0001] One aspect of the present invention relates to an information processing device and a file change detection method.

[0002] Detecting file changes (hereafter referred to as file change detection) is a fundamental requirement in computer systems. File change detection is used in a variety of applications, such as triggering the automatic execution of new tasks. For example, in Robotic Process Automation (RPA) applications, it is used to detect the timing (trigger) for executing automated operations (Reference [1]).

[0003] For example, in Windows (registered trademark), the API described in Non-Patent Document 1 is known. This API allows users to receive notifications of situations such as file creation, modification, deletion, and renaming, and is therefore used in many software implementations.

[0004] "FileSystemWatcher class", [online], [Retrieved December 11, 2023], Internet <https: / / learn.microsoft.com / ja-jp / dotnet / api / system.io.filesystemwatcher?view=net-8.0>

[0005] Existing file change detection modules only detect events such as whether a file has been created, changed, deleted, or updated, or whether file attribute information (such as the file name) has changed. For this reason, their granularity is too coarse to be considered general-purpose in some situations. For example, it is difficult to use them for purposes such as monitoring whether a specific cell in a report file has been changed.

[0006] On the other hand, there is also a method in which a dedicated monitoring module is assigned to each file and this module opens the file to check for changes. This method allows file changes to be detected at a fine granularity, but a dedicated program must be prepared for each file. Also, since the program opens the file and checks it each time, processing speed is inevitably sacrificed.

[0007] As such, currently, file change detection granularity is either too coarse or too fine, and no known technology can provide a middle ground. In other words, there is no established effective method for situations where detailed checks that require a dedicated monitoring program are not necessary, but a general check for some changes is required.

[0008] The present invention has been made in light of the above circumstances, and aims to provide a technique that can improve the versatility of file alteration detection.

[0009] An information processing device according to one aspect of the present invention includes a storage unit that stores a detection target file, a pattern definition unit, a change detection unit, a difference detection unit, a similarity calculation unit, and a change determination unit. The pattern definition unit generates a pattern definition by associating a difference file between the detection target file and a post-reflection file in which a situation to be monitored has been reflected in the detection target file with the detection target file. The change detection unit detects changes to the detection target file. The difference detection unit detects differences between the detection target file before and after the change and generates a patch file. The similarity calculation unit calculates the similarity between the pattern definition and the patch file. The change determination unit determines whether a situation to be monitored has occurred based on the similarity.

[0010] According to one aspect of the present invention, the versatility of file change detection can be improved.

[0011] FIG. 1 is a block diagram showing an example of an information processing device according to an embodiment of the present invention. FIG. 2 is a diagram showing an example of a difference file. FIG. 3 is a flowchart showing an example of a processing procedure in the information processing device 1 shown in FIG. 1. FIG. 4 is a flowchart showing an example of a processing procedure by a processor in a pattern definition process. FIG. 5 is a flowchart showing an example of a processing procedure by a processor in a similarity calculation process. FIG. 6 is a flowchart showing an example of a processing procedure by a processor in a change determination process. FIG. 7 is a flowchart showing an example of a processing procedure by a processor in a change determination process. FIG. 8 is a diagram for explaining the processing of the information processing device 1 according to an embodiment.

[0012] 1 is a block diagram showing an example of an information processing device according to an embodiment of the present invention. The information processing device 1 is a computer including a processor 10 such as a CPU (Central Processing Unit), a memory 20, and a storage unit 30. The information processing device 1 further includes an interface unit 50 connected to an input unit 51 and an output unit 52.

[0013] The storage unit 30 is a block device on which a file system is to be constructed, and stores a program 304 for causing a computer to function as the information processing device 1. The storage unit 30 also stores files (detection target files 301) that are set in advance as detection targets, pattern definitions 302, and backup files 303.

[0014] The processor 10 includes, as processing functions according to the embodiment, a difference detection unit 101, an alteration detection unit 102, a pattern definition unit 103, a similarity calculation unit 104, and an alteration determination unit 105. The difference detection unit 101 detects and outputs differences between different files. The difference detection unit 101 can be realized, for example, as a diff command.

[0015] FIG. 2 shows an example of a difference file. For example, when comparing text files, a text difference file can be obtained by passing the file names (file 1, file 2) of the files to be compared as arguments to the diff command. The difference file may also contain optional information such as marks (>, <) indicating the changed parts, line numbers, or file names. In addition to this format, some coding tools have a function to visually display differences by color. The difference detection unit 101 generates and outputs a difference file (patch file) in any format.

[0016] In this way, any method can be applied to realize the difference detection unit 101, and existing software or tools may also be applied. Furthermore, the difference between binary files may be generated, not limited to the example of a difference file between text files (FIG. 2). Alternatively, for files in XML (eXtended Markup Language) format, a difference file generated by XML difference detection may be used. Furthermore, a difference file generated by detecting differences between PDF format files, image files, etc. may also be used.

[0017] 1 , the explanation will be continued. The change detection unit 102 detects that the detection target file 301 has been changed. The change detection unit 102 may also detect the timing at which the detection target file 301 has been changed. The change detection unit 102 can be realized as an API disclosed in Patent Document 1, for example.

[0018] Here, when it is detected that the detection target file has been changed, the change detection part 102 gives a message to the difference detection part 101, detects the difference between the detection target file before and after the timing of the change, and generates a patch file.

[0019] The pattern definition unit 103 reflects the situation to be monitored in the detection target file 301 and generates a post-reflection file. Then, the pattern definition unit 103 associates the post-reflection file with the detection target file 301, creating a difference file, to generate a pattern definition. The created pattern definition is stored in the storage unit 30 (pattern definition 302). That is, the pattern definition unit 103 applies a difference detection (Diff) process to each of the detection target file 301 and the file in which the changes to be detected are reflected, and generates a pattern definition (difference file).

[0020] The similarity calculation unit 104 compares the pattern definition 302 with the patch file obtained by the difference detection unit 101 and calculates the similarity between them. Any similarity calculation algorithm can be applied depending on the format of the difference file. For example, the diff output for two text files is a text file, and the similarity can be a value based on the string edit distance (Levenshtein distance, Jaro-Winkler distance) contained in the text files. Alternatively, a simple similarity function can be defined such that the similarity is 1.0 (maximum score) if the patch file contains a specific string, and 0.0 (minimum score) if it does not.

[0021] The change determination unit 105 determines whether a situation that should be monitored has occurred based on the calculated similarity. That is, at the time when the detection target file 301 is changed, it determines whether a situation that should be monitored has occurred for this detection target file 301. That is, the change determination unit 105 receives the output result of the similarity calculation unit 104, determines whether the target change has occurred in the detection target file 301, and outputs the result. The change determination unit 105 determines whether a change has occurred, for example, by comparing the similarity with a predetermined threshold value. Furthermore, multiple threshold values ​​may be set, and the possibility of a change may be determined and output in stages. Next, the operation of the above configuration will be described.

[0022] 3 is a flowchart showing an example of a processing procedure in the information processing device 1 shown in FIG. In FIG. 3, the information processing device 1 first executes a pattern definition process (step S1). Next, the information processing device 1 executes a change detection process (step S2) and waits for a change detection notification from, for example, the OS. The granularity of the change detection here is relatively coarse.

[0023] When a change to the detection target file is detected (Yes in step S3), the information processing device 1 executes a similarity calculation process (step S4), and executes a change determination process using the calculated similarity (step S5). The procedure from step S2 to step S5 is continued until monitoring is completed (step S6).

[0024] 4 is a flowchart showing an example of the processing procedure of the processor in the pattern definition process (step S1 in FIG. 3). In FIG. 4, when the pattern definition process is called with a list of files to be detected and a list of files reflecting situations to be monitored, the processor 10 backs up all files to be detected in the storage unit 30 and saves them as backup files 303 (step S11).

[0025] Next, the processor 10 selects the next file (let's say file X) from the list of files to be detected (step S12), and selects the file corresponding to file X (let's say file Y) from the list of files reflecting the situation to be monitored (step S13).

[0026] Next, the processor 10 performs a difference detection process on the files X and Y to generate a difference file (step S14). The processor 10 then corrects the difference file as appropriate (step S15). Note that step S15 may be performed optionally or may be omitted.

[0027] Next, the processor 10 associates the differential file with the corresponding backup file and stores the pattern definition in the storage unit 30 (pattern definition 302). The procedures of steps S12 to S16 are performed for all files in the list of files to be detected (Yes in step S17).

[0028] 5 is a flowchart showing an example of the processing procedure of the processor in the similarity calculation process (step S4 in FIG. 3). When the similarity calculation process is called with the detection target file where the change occurred, the backup file corresponding to the detection target file, and the pattern definition corresponding to the detection target file, the processor 10 performs a difference detection process on the detection target file where the change occurred and the backup file corresponding to the detection target file, and generates a difference file (patch file) (step S21). The patch file obtained here is referred to as difference file D.

[0029] Next, the processor 10 overwrites the changed target file with a backup (step S22), and then calculates the similarity between the pattern definition corresponding to the target file and the difference file D as input (step S23).

[0030] The index of similarity may be, for example, the ratio of the number of lines output by the diff command to the entire file, or the number of bytes in the matching area when comparing binary files, etc. The calculated similarity is output and stored in the memory 20 or the like (step S24).

[0031] 6 and 7 are flowcharts showing an example of the processing procedure of the processor in the change determination process (step S5 in FIG. 3). FIG. 6 shows a case where there is only one threshold. In FIG. 6, when the change determination process is called with the similarity and a predetermined threshold, the processor 10 determines whether the similarity is greater than the threshold (step S31), and determines that there is no change if the threshold > similarity (step S33). If the threshold ≦ similarity, it determines that there is a change (step S32). A state determined to have changed indicates that the file to be detected has reached a state where it should be monitored.

[0032] 7 shows a case where multiple thresholds are set. For example, assume that three thresholds (threshold A, threshold B, and threshold C) are set, with threshold A > threshold B > threshold C. In FIG. 7, when the change determination process is called along with the similarity and thresholds, the processor 10 determines whether the similarity is greater than or equal to threshold A (step S41). If the similarity is greater than or equal to threshold A, it determines that the possibility of the detection target file being changed is "high" (step S42).

[0033] On the other hand, if the similarity is less than threshold A in step S41, the processor 10 determines whether the similarity is greater than or equal to threshold B (step S43). If the similarity is greater than or equal to threshold B, the processor 10 determines that the possibility of modification of the file to be detected is medium (step S44).

[0034] On the other hand, if the similarity is less than the threshold value B in step S43, the processor 10 determines whether the similarity is greater than or equal to the threshold value C (step S45). If the similarity is greater than or equal to the threshold value C, the processor 10 determines that the possibility of a change to the detection target file is "low" (step S46). Finally, if the similarity is less than the threshold value C in step S45, the detection target file is determined to be "unchanged" (step S47). In this way, by providing multiple threshold values, the possibility of a change can be determined in stages.

[0035] 8 is a diagram illustrating the processing of the information processing device 1 according to the embodiment. In the embodiment, a difference file generated by file difference detection is used as a pattern of the target situation to be monitored as a pre-processing step. In other words, the difference between the file before the change and the file after the change in the situation to be detected is detected (Diff), and the resulting difference file is used as a pattern definition.

[0036] In addition, when a file change is detected by the OS or other device, a backup file of the file is saved, and the differences between the newly detected file and the backup are detected to obtain a patch file.The similarity between the newly generated patch file and a difference file prepared as a pattern definition is calculated, and the occurrence of a change is determined based on the similarity.In other words, if the similarity between the two difference files (the pattern definition prepared in advance and the patch file generated afterwards) is high, it can be detected that the target change to be monitored has likely occurred.

[0037] This process eliminates the need for a dedicated monitoring program for file change detection. Furthermore, the above process is not limited to text files, but can be applied to any file format. Therefore, it can be applied universally to any file, and it is possible to detect the desired situation by patterning it.

[0038] As described above, in this embodiment, when a change to a file of interest is detected, a backup file of the file is saved, the difference between the newly detected file and its backup file is detected, and the resulting difference file is stored as a pattern definition. Furthermore, the similarity between the newly generated patch file and the difference file stored as the pattern definition is calculated, and the occurrence of a change to the file of interest is determined by comparing the magnitude of the similarity. This makes it possible to detect certain changes without the need for a dedicated program.

[0039] Existing technologies have not been able to meet the need for general-purpose checking for changes to a certain extent, without requiring the granularity of a dedicated monitoring program. In other words, while file change detection technologies are used in a variety of applications, they are either too coarse in granularity to detect the desired situation, or can detect any situation but require a dedicated monitoring program for each file.

[0040] In contrast, according to the embodiment, it is possible to detect relatively complex file change situations with the same ease as using an OS API. This opens up a wide range of potential applications. For example, it can be incorporated into RPA tools. Conventional dedicated monitoring programs have a limited range of application when incorporated into RPA tools, and therefore lack versatility. In contrast, the technology of the embodiment is highly versatile and can detect certain changes, and by incorporating it into RPA tools, it is expected that the use scenarios for RPA tools will expand.

[0041] As described above, according to the embodiment, a dedicated monitoring program is not required, and the system can be applied to any file in a general purpose manner, and the target situation can be detected by patterning it. Therefore, according to the embodiment, the versatility of file change detection can be improved, and usability can be improved.

[0042] It should be noted that the present invention is not limited to the above-described embodiments. In other words, the present invention is not limited to the above-described embodiments as they are, and the components can be modified and embodied in the implementation stage without departing from the spirit of the invention. Furthermore, various inventions can be formed by appropriately combining multiple components disclosed in the above-described embodiments. For example, some components may be deleted from all the components shown in the embodiments. Furthermore, components from different embodiments may be appropriately combined.

[0043] <References> [1] “File Change Trigger”, [online], [Retrieved December 11, 2023], Internet <https: / / docs.uipath.com / ja / activities / other / latest / workflow / file-change-trigger-v-2>

[0044] DESCRIPTION OF SYMBOLS 1... Information processing device 10... Processor 20... Memory 30... Storage unit 50... Interface unit 51... Input unit 52... Output unit 101... Difference detection unit 102... Change detection unit 103... Pattern definition unit 104... Similarity calculation unit 105... Change determination unit 301... Detection target file 302... Pattern definition 303... Backup file 304... Program

Claims

1. An information processing apparatus comprising: a storage unit that stores a file to be detected; a pattern definition unit that associates a difference file between a reflected file obtained by reflecting a situation to be monitored in the file to be detected and the file to be detected with the file to be detected, and generates a pattern definition; a change detection unit that detects a change in the file to be detected; a difference detection unit that detects a difference between the file to be detected before and after the change and generates a patch file; a similarity calculation unit that calculates a similarity between the pattern definition and the patch file; and a change determination unit that determines whether or not the situation to be monitored has occurred based on the similarity.

2. The information processing apparatus according to claim 1, wherein when the file to be detected is a text file, the similarity calculation unit calculates the similarity based on a string edit distance.

3. The information processing apparatus according to claim 1, wherein when the file to be detected is a text file, the similarity calculation unit calculates the similarity based on whether or not the patch file includes a specific string.

4. A file change detection method by an information processing apparatus including a storage unit that stores a file to be detected and a processor, the method comprising: a process in which the processor associates a difference file between a reflected file obtained by reflecting a situation to be monitored in the file to be detected and the file to be detected with the file to be detected, and generates a pattern definition; a process in which the processor detects a change in the file to be detected; a process in which the processor detects a difference between the file to be detected before and after the change and generates a patch file; a process in which the processor calculates a similarity between the pattern definition and the patch file; and a process in which the processor determines whether or not the situation to be monitored has occurred based on the similarity.

Images