Event detection device and program

Abstract

An event detection device (100) according to an embodiment of the present invention comprises: an event storage unit (121) that records event information composed of combinations of a plurality of objects to be operated associated with object screen information and a plurality of operation types; an event detection unit (111) that acquires an operation log including at least the objects to be operated and the operation types, and the event information to compare the operation log with the event information and detect / determine the event corresponding to the operation log; a copy destination candidate extraction unit (112) that, if the detected / determined event is file copying, acquires a copy source file, and, from the operation log immediately before copy detection, acquires a copy destination folder name to execute a search using the folder name, and extract, as copy destination candidate files, all of the files in a folder obtained as the result of the search; and a copy destination estimation unit (113) that calculates the degree of similarity between the copy source file and the plurality of copy destination candidate files to determine, as the copy destination file, the copy destination candidate file having the highest degree of similarity to the copy source file.

Description

Event Detection Device and Program

[0001] The present invention relates to an event detection device and a program.

[0002] In PC work, for various automatic operation tools such as RPA (Robotic Process Automation), by using a task scheduler (time) or an API of the OS to detect changes in files (it is possible to detect changes such as updates, deletions, and name changes by specifying the detected files with file paths), the business improvement effect is enhanced.

[0003] “FileSystemWatcher class”, [online], [searched on November 5, 2024], Internet <URL:https: / / learn.microsoft.com / ja-jp / dotnet / api / system.io.filesystemwatcher?view=net-8.0>

[0004] In PC work, in addition to the above situations, there are situations where it is desired to detect "copied files", but they cannot be detected because they are outside the detection target. To detect them, it is necessary to link multiple APIs of the OS.

[0005] On the other hand, there are objects for which it is difficult to detect the status using OS functions such as applications operating on the web. To detect the status of these, it is necessary to individually create a status detection tool according to the specifications of the application. That is, since the situations that can be easily detected by the prior art are limited, the business improvement effect is not sufficiently obtained.

[0006] The present invention has been made in view of the above circumstances, and an object thereof is to provide an event detection device and a program that enable status detection regardless of the specifications of an application for PC operation situations such as file copying.

[0007] An event detection device according to a first aspect of the present invention includes: an event storage unit that records event information composed of a combination of a plurality of operation targets and a plurality of operation types associated with target screen information; an event detection unit that compares the operation log and event information by acquiring an operation log and event information that include at least an operation target and an operation type, and detects and determines an event corresponding to the operation log; a copy destination candidate extraction unit that, if the detected event is a file copy, obtains the source file and the destination folder name from the operation log immediately before copy detection, performs a search using the folder name, and extracts all files in the folder obtained as a search result as copy destination candidate files; and a copy destination estimation unit that calculates the similarity between the source file and a plurality of copy destination candidate files, and determines the copy destination candidate file with the highest similarity to the source file as the copy destination file.

[0008] A program according to a second aspect of the present invention is a program that causes a computer to function as an event detection device according to the first aspect.

[0009] According to the present invention, it is possible to provide an event detection device and program that enable status detection of PC operations such as file copying, regardless of the application specifications.

[0010] Figure 1 is a block diagram showing an example of the functional configuration of an event detection device according to an embodiment. Figure 2 is a block diagram showing an example of an overview of the functions of the functional configuration of the event detection device according to an embodiment. Figure 3 is a block diagram showing an example of a detailed function of the functional configuration of the event detection device according to an embodiment. Figure 4 is a block diagram showing an example of a detailed function of the functional configuration of the event detection device according to an embodiment. Figure 5 is a flowchart showing an example of the event detection process of the event detection device according to an embodiment. Figure 6 is a flowchart showing an example of the event determination process of the event detection device according to an embodiment. Figure 7 is a flowchart showing an example of the copy destination candidate extraction process of the event detection device according to an embodiment. Figure 8 is a flowchart showing an example of the copy destination candidate estimation process of the event detection device according to an embodiment. Figure 9 is a flowchart showing an example of the detection target correction process of the event detection device according to an embodiment. Figure 10 is a block diagram showing an example of the hardware configuration of an event detection device according to an embodiment.

[0011] Each embodiment is described below with reference to the drawings. Each embodiment illustrates an apparatus or method for realizing the technical idea of ​​the invention. The drawings are schematic or conceptual. Hereinafter, components having substantially the same function and configuration are denoted by the same reference numeral. The numbers following the letters that make up the reference numerals are used to distinguish elements that are referred to by reference numerals containing the same letters and have similar configurations. When it is not necessary to distinguish between elements indicated by reference numerals containing the same letters or numbers, these elements are referred to by reference numerals containing only letters or numbers.

[0012] The functional configuration of the event detection device 100 according to the embodiment will be described using Figures 1 and 2. Figure 1 is a block diagram showing an example of the functional configuration of the event detection device 100 according to the embodiment. Figure 2 is a block diagram showing an example of an overview of the functions of the functional configuration of the event detection device according to the embodiment.

[0013] The event detection device 100 is an electronic device such as a computer, and may be, for example, a television receiver (including internet television), a PC (personal computer), a mobile terminal (e.g., a tablet, smartphone, laptop, feature phone, digital music player, e-book reader, smartwatch, etc.), a game console (home game console, portable game console), a VR (Virtual Reality) terminal, an AR (Augmented Reality) terminal, etc.

[0014] The event detection device 100 may be connected to an external server or the like via a network, for example. In this case, multiple event detection devices 100 can be connected to the external server via the network, enabling them to communicate with each other and share necessary information. The external server may be a storage device or the like.

[0015] The event detection device 100 comprises a control unit 110, a data storage unit 120, a program storage unit 130, a communication unit 140, and an input / output unit 150.

[0016] The control unit 110 includes an event detection unit 111, a copy destination candidate extraction unit 112, and a copy destination estimation unit 113 as processing functions for implementing this embodiment. The control unit 110 comprehensively controls the data storage unit 120, the program storage unit 130, the communication unit 140, and the input / output unit 150.

[0017] The event detection unit 111 assumes that the various situations that occur during PC operation can be defined from combinations and sequences of GUI (graphical user interface) operations. It takes a PC operation log that includes at least the target of the operation and the type of operation, and event information to be detected based on GUI operations as input, and has the function of detecting events that are not dependent on a specific application by matching the PC operation log and the event information.

[0018] The target of the operation is information used to identify the GUI object on the screen that is the target of the operation performed by the corresponding process, and includes, for example, the application name, file name, link, copy dialog, etc.

[0019] The operation type is information used to identify the specific content of the operation performed by the corresponding process, and includes, for example, clicking a specific button, clicking copy, selecting a destination in the destination input field, clicking the confirm button, etc.

[0020] Furthermore, the event detection unit 111 has a function (event detection notification) that notifies a program to be executed as a trigger by outputting detected event information. Details of the event detection unit 111 will be described later.

[0021] The copy destination candidate extraction unit 112, when it detects a copy of a file managed on an application that cannot be detected by the OS function, extracts candidate files for the copy destination based on the information acquired at the time of detection. Details of the copy destination candidate extraction unit 112 will be described later.

[0022] The copy destination estimation unit 113 has the function of calculating the similarity between files using the contents of the copy destination candidate files extracted by the copy destination candidate extraction unit 112 and the contents of the source file obtained by the event detection unit 111 when file copying is detected, and outputting the estimated location information of the copy destination file.

[0023] Furthermore, the copy destination estimation unit 113 has the function of correcting existing information of the detection event given as input by feeding back the location information of the output copy destination file, thereby allowing event detection to follow the file copy destination. Details of the copy destination estimation unit 113 will be described later.

[0024] The data storage unit 120 stores data or information necessary for carrying out the embodiment, as well as data or information generated during the execution of various processes. The data storage unit 120 includes an event storage unit 121. Details of the event storage unit 121 will be described later.

[0025] The program storage unit 130 stores programs necessary for executing various controls and processes according to the embodiment. Specifically, the program storage unit 130 stores an event detection program, an information processing program, a control program, and other application programs for executing processes in the event detection device 100 according to the embodiment.

[0026] The communication unit 140 has the function of transmitting data, information, and information processing programs according to the embodiment to an external server device or the like via a network.

[0027] The input / output unit 150 transmits data or information input by the user to the control unit 110. The input / output unit 150 also outputs data or information received from the control unit 110 to the user. The input / output unit 150 comprises an input unit 151 and an output unit 152.

[0028] The input unit 151 has the function of inputting, for example, operation logs and event information to the event detection unit 111. The output unit 152 has the function of outputting event detection notifications output from the event detection unit 111 to a program that is executed as a trigger for said notification. The output unit 152 also has the function of outputting copy destination file location information output from the copy destination estimation unit 113 to the input unit 151.

[0029] Next, the details of the functional configuration of the event detection device 100 according to the embodiment will be described using Figures 3 and 4. Figure 3 is a block diagram showing a detailed example of the functions of the event detection device according to the embodiment. Figure 4 is a block diagram showing a detailed example of the functions of the event detection device according to the embodiment.

[0030] The event storage unit 121 has the function of registering and recording events by defining the detected situation by the target of the operation and the type of operation. The event storage unit 121 also has the function of transmitting event information to the event determination unit 1112 and determining whether the event information needs to be modified using the destination information output from the copy destination estimation unit 113, and modifying the event information if it is determined that modification is necessary.

[0031] For example, the event storage unit 121 records the first event by associating the target of the operation, "link" and "file name," with the operation type, "click any button." The event storage unit 121 also records the second event by associating the target of the operation, "link" and "file name," with the operation type, "click copy." The event storage unit 121 also records the third event by associating the target of the operation, "copy dialog," with the operation type, "select copy destination in copy destination input field." The event storage unit 121 also records the fourth event by associating the target of the operation, "copy dialog," with the operation type, "click confirm button." The above combinations of target of the operation and operation type are examples only and are not limited to those above. It is assumed that the target screen information (application name, page title, etc.) is associated with the information of the target of the operation.

[0032] As shown in Figure 3, the event storage unit 121 may be included in the event detection device 100, or, as shown in Figure 4, if there are events that multiple users want to use, such as when the file to be detected is collaboratively edited by multiple users, the event storage unit 121 may be located on a shared file server or the like that can be accessed by other users.

[0033] The event detection unit 111 comprises an operation log acquisition unit 1111 and an event determination unit 1112. The operation log acquisition unit 1111 has the function of detecting the user's PC work and acquiring operation logs from the input unit 151. The operation log acquisition unit 1111 also has the function of acquiring the user's operation logs and sending the operation logs to the event determination unit.

[0034] In other words, the operation log acquisition unit 1111 acquires the target of operation and the type of operation included in the PC operation log by means that does not depend on the execution environment of the target of operation or the attribute values ​​of GUI components, in order to support a variety of applications.

[0035] The operation log acquisition unit 1111, for example, uses captured images taken before and after the timing of operating an input item or a confirmation button, and selects and saves a captured image from the captured images that shows the location where a change occurred.

[0036] The operation log acquisition unit 1111 determines the operation type from the operation that triggered the acquisition by selecting and acquiring a captured image that shows the changed position. Furthermore, the operation log acquisition unit 1111 analyzes the acquired captured image by selecting and acquiring the captured image that shows the changed position, thereby determining the target of the operation. The method of determining the operation type and target of the operation by the operation log acquisition unit 1111 is not limited to the above.

[0037] Furthermore, if the resolution of the obtainable target information (e.g., a captured image) is low and the image is coarse, the operation log acquisition unit 1111 may be configured to enable identification of the target by providing a string acquisition function using OCR (Optical Character Reader) or the like for a range of identifiable information (address bar, etc.) around the target image in the acquired captured image. The target range may be arbitrarily set by direction, contrast distance, etc., from the target image.

[0038] The event determination unit 1112 has the function of detecting and determining events corresponding to the operation log by matching the operation log output from the operation log acquisition unit 1111 with the event information transmitted from the event storage unit 121.

[0039] Furthermore, the event determination unit 1112 has a function to notify the copy destination candidate extraction unit 112 of the determined event content, and a function to notify DX tools such as RPA tools of other detected events.

[0040] The event determination unit 1112 determines the detection status based on the similarity between the identification information such as "file name" and "location information" registered in the event list recorded in the event storage unit 121, and the operation target and operation type consisting of GUI component image files, and the operation log acquired from the operation log acquisition unit 1111.

[0041] The copy destination candidate extraction unit 112 includes an extraction scenario storage unit 1121 and an extraction scenario execution unit 1122. The extraction scenario storage unit 1121 has a function of acquiring a copy source file based on a copy notification output from the event determination unit 1112. The extraction scenario storage unit 1121 also has a function of storing an execution file for extracting a copy destination candidate file and a function of transmitting the execution file to the extraction scenario execution unit 1122.

[0042] For example, in a file management system that operates on the Web, the designation of the copy destination is not by destination / movement destination information or direct input of a link. First, a folder is selected by a GUI operation that can be visually operated. Second, it is assumed that the identification information of the GUI component clicked immediately before finalizing the copy includes the name of the copy destination folder. Third, it is assumed that the folder name is a unique name set in advance by the user or the like. By making these assumptions, all search functions commonly provided in the target system are utilized, the operations are extracted, and registered as an execution file. It is assumed that the registration is set for each event.

[0043] That is, the extraction scenario storage unit registers and stores an execution file of the following procedure. As the first step, the detected copy source file is acquired. Next, as the second step, the folder name is entered into the search bar and the search is executed. It is assumed that the folder name is acquired from an operation log at the time of copy detection or the like that meets the above conditions.

[0044] As the third step, all the files displayed in the search results are extracted. Finally, as the fourth step, the extracted copy destination candidate files are acquired at an arbitrary location of the event detection device 100. For example, when the event detection device 100 is a PC, the copy destination candidate files are acquired at an arbitrary location such as a document folder or a desktop.

[0045] From the first step to the fourth step, these are executable files that are automatically operated triggered by copy detection, and the extraction scenario storage unit 1121 registers and records these executable files. For example, when the operation means is only simple mouse and keyboard operations, assuming that the OS function is available, operations are performed based on preset operation positions (such as coordinates on the screen). Since it is immediately after file detection, it is determined that the target system is an active window, and before the first step, the window may be maximized so that operations can be performed at the preset operation positions.

[0046] The extraction scenario execution unit 1122 has a function of executing a scenario based on the executable file acquired from the extraction scenario storage unit 1121 and a function of outputting the file extracted along with the execution of the scenario to a file conversion unit 1131 described later.

[0047] The extraction scenario execution unit 1122 selects and executes the registered executable file based on the copy notification output from the event determination unit 1112 to acquire the copy source file and extract copy destination file candidates.

[0048] The copy destination estimation unit 113 includes a file conversion unit 1131, a similarity calculation unit 1132, and a copy destination estimation unit 1133. The file conversion unit 1131 has a function of acquiring the copy source file and the copy destination candidate file from the extraction scenario execution unit 1122 and converting the acquired copy source file and the copy destination candidate file.

[0049] The file conversion unit 1131 converts the copy source file and the copy destination candidate file into an arbitrary file format (such as xml, etc.) for calculating the similarity between the copy source file and the copy destination candidate file by the similarity calculation unit 1132 described later.

[0050] The similarity calculation unit 1132 has a function of acquiring the copy source file and the copy destination candidate file converted by the file conversion unit 1131 and calculating the similarity between the copy source file and the copy destination candidate file.

[0051] For example, the similarity calculation unit 1132 may use the edit distance between strings (e.g., Levenshtein distance or Jalowinkler distance) or character similarity (e.g., N-gram) as a method for calculating the similarity between the source file and multiple candidate destination files.

[0052] The copy destination estimation unit 1133 has the function of extracting files that can be estimated as file copy destinations based on the similarity calculated by the similarity calculation unit 1132. In other words, the copy destination estimation unit 1133 determines the file that is determined to be the most similar to the source file among a plurality of copy destination candidate files as the copy destination.

[0053] The copy destination estimation unit 1133 is provided with arbitrarily configurable criteria to take into account cases where, due to processing delays or other reasons, there is no actual copy destination among the candidate copy destination files.

[0054] In the case of copying within the same folder, the source file is also extracted as a candidate destination file, and the file with the highest similarity becomes the source file. Therefore, if the folder name is the same as the source file, the destination estimation unit 1133 estimates the file with the second highest similarity as the destination file.

[0055] After estimating the destination of the file, the copy destination estimation unit 1133, if event detection for the source file is not required, updates the target information included in the event information recorded in the event storage unit 121 using the location information of the target file.

[0056] Furthermore, if the copy destination estimation unit 1133 continues to detect events for the source file after estimating the copy destination, it uses the location information of the target file to duplicate the target information contained in the event information recorded in the event storage unit 121 and updates one of the target information. Note that the overwriting process of the target information by the copy destination estimation unit 1133 may be configured to be changed uniformly or individually by providing a configuration file in the program, or the system may be configured to notify the user after estimating the copy destination of the file, and allow the user to change it by selection.

[0057] Next, the details of the event detection process in the event detection device 100 according to the embodiment will be explained using Figure 5. Figure 5 is a flowchart showing an example of the event detection process of the event detection device according to the embodiment.

[0058] For example, the event detection process in the event detection device 100 is triggered when an operation is initiated by the user. The operation log acquisition unit 1111 detects the user's operation of the event detection device 100 and acquires an operation log from the input unit 151 (step S10).

[0059] The event determination unit 1112 acquires event information from the event storage unit 121 (step S11). After completing the process in step S11, the event determination unit 1112 proceeds to the event determination process (step S12).

[0060] Here, we will explain the details of the event determination process in the event detection device 100 according to the embodiment using Figure 6. Figure 6 is a flowchart showing an example of the event determination process of the event detection device according to the embodiment.

[0061] The event determination unit 1112 acquires a new operation log from the operation log acquisition unit 1111 (step S20). The event determination unit 1112 determines whether the acquired operation log matches the event information acquired from the event storage unit 121 (step S21). That is, the event determination unit 1112 determines whether the combination of operation target and operation type included in the acquired operation log is included in the event information. The event determination unit 1112 repeats the processes of steps S20 and S21 until it determines that there is event information that matches the operation log (step S21, NO).

[0062] If the event determination unit 1112 determines that there is event information that matches the operation log (step S21, YES), it determines that it matches the i-th operation (step S22). For example, if the event information contains an event that includes the first to fourth events, the event determination unit 1112 determines whether the operation log matches the first event, the second event, the third event, or the fourth event of the event.

[0063] If the event determination unit 1112 determines that it matches the i-th operation (step S22, YES), it determines whether it is the last operation (step S23). For example, in the previous example, the event determination unit 1112 determines whether the operation log is the fourth event. If the event determination unit 1112 determines that it is not the last operation (step S23, NO), it increments i and returns to the process in step S22.

[0064] If the event determination unit 1112 determines that it is the last operation (step S23, YES), it detects a change (step S24) and terminates the event determination process.

[0065] Returning to the explanation of Figure 5, once the event detection process is complete, the event detection unit 1112 determines whether the detected event is a file copy (step S13). If the event detection unit 1112 determines that the detected event is not a file copy (step S13, NO), it notifies the linked RPA tool (step S17) and terminates the event detection process.

[0066] On the other hand, if the event determination unit 1112 determines that the detected event is a file copy (step S13, YES), it proceeds to the copy destination candidate extraction process in step S14.

[0067] Next, the details of the copy destination candidate extraction process in the event detection device 100 according to the embodiment will be explained using Figure 7. Figure 7 is a flowchart showing an example of the copy destination candidate extraction process of the event detection device according to the embodiment.

[0068] The extraction scenario execution unit 1122 starts the process of extracting candidate copy destinations based on the executable file obtained from the extraction scenario storage unit 1121. The extraction scenario execution unit 1122 obtains the detected source file (step S30). The extraction scenario execution unit 1122 obtains the destination folder name based on the operation log immediately before copy detection (step S31).

[0069] The extraction scenario execution unit 1122 uses the acquired destination folder name and the search field to input the destination folder name into the search field and perform a full search (step S32). Then, the extraction scenario execution unit 1122 acquires all files in the folder displayed as search results as destination candidate files (step S33) and terminates the destination candidate extraction process. When the destination candidate extraction process in Figure 7 (step S14) is completed, the process transitions to the destination estimation process in step S15.

[0070] Next, the details of the copy destination candidate estimation process in the event detection device 100 according to the embodiment will be explained using Figure 8. Figure 8 is a flowchart showing an example of the copy destination candidate estimation process of the event detection device according to the embodiment.

[0071] The file conversion unit 1131 obtains the source file and the destination file from the extraction scenario execution unit 1122, and the destination candidate estimation process begins. The file conversion unit 1131 converts the source file and the multiple destination candidate files into XML format (step S40).

[0072] The similarity calculation unit 1132 obtains the source file and the destination candidate file that have been converted to XML format by the file conversion unit 1131, and calculates the edit distance between the source file and the destination candidate file (step S41).

[0073] If the maximum number of potential destination files is n, the similarity calculation unit 1132 determines whether the i-th potential destination file is the maximum value n (step S42). If the similarity calculation unit 1132 determines that the i-th potential destination file is not the maximum value n (step S42, NO), it increments i and returns to the process in step S41.

[0074] If the similarity calculation unit 1132 determines that the i-th copy destination candidate file is the maximum value n (step S42, YES), the copy destination estimation unit 1133 extracts information about the file with the highest similarity from among the n copy destination candidate files (step S44). If the information of the extracted file matches the information of the source file, the copy destination estimation unit 1133 determines that the extracted file is identical to the source file (step S45, YES), and extracts information about the file with the second highest similarity (step S46).

[0075] If the destination estimation unit 1133 determines that the extracted file information does not match the source file information and that the extracted file is not identical to the source file (step S45, NO), or if it extracts information from the file with the second highest similarity (step S46), it determines whether the similarity meets the criteria (step S47). For example, the destination estimation unit 1133 determines whether the similarity is above a preset threshold.

[0076] If the copy destination estimation unit 1133 determines that the similarity meets the criteria (step S47, YES), it determines the extracted file as the copy destination (step S48) and terminates the copy destination estimation process. On the other hand, if the copy destination estimation unit 1133 determines that the similarity does not meet the criteria (step S47, NO), it outputs a request to the user to manually correct the file (step S49) and terminates the copy destination estimation process. Once the copy destination estimation process in Figure 8 (step S15) is completed, the process transitions to the detection target correction process in step S16.

[0077] Next, the details of the detection target processing in the event detection device 100 according to the embodiment will be explained using Figure 9. Figure 9 is a flowchart showing an example of the detection target modification processing of the event detection device according to the embodiment.

[0078] When the copy destination estimation unit 1133 receives a correction request (step S50), it extracts all events (n) set for the event occurrence file (step S51). It corrects the folder name registered in the i-th event (step S52). It repeats the correction for all n events (steps S53, S54). Once the correction for all n events is complete (step S55), it terminates the detection target correction process and ends the event detection process in the event detection device 100 in Figure 5.

[0079] According to the event detection device 100 of this embodiment, by employing a user operation-based status detection means, it becomes possible to expand the scope of status detection to include applications where status detection by OS functions is difficult. Furthermore, according to the event detection device 100 of this embodiment, by detecting changes that follow the copy destination of a file, it becomes possible to minimize the modification of information in existing file change detection events.

[0080] Next, an example of the hardware configuration of the event detection device 100 according to the embodiment will be described with reference to Figure 10. Figure 10 is a block diagram showing an example of the hardware configuration of the event detection device according to the embodiment.

[0081] As shown in Figure 10, the event detection device 100 includes, for example, a processor 101, a ROM (Read Only Memory) 102, a RAM (Random Access Memory) 103, storage 104, a communication interface 105, and an input / output interface 106.

[0082] The control unit 110, which includes the event detection unit 111, the copy destination candidate extraction unit 112, and the copy destination estimation unit 113 shown in Figures 1 to 4, corresponds to, for example, the processor 101 and the RAM 103. The data storage unit 120 corresponds to, for example, the ROM 102, the RAM 103, and the storage 104. The program storage unit 130 corresponds to, for example, the ROM 102 and the storage 104. The communication unit 140 corresponds to, for example, the communication interface 105. The input / output unit 150 corresponds to, for example, the input / output interface 106 and the input / output device 107.

[0083] The processor 101, ROM 102, RAM 103, storage 104, communication interface 105, and input / output interface 106 are each connected via a bus communication line (BUS) and can transmit and receive data from each other. Alternatively, the processor 101, ROM 102, RAM 103, storage 104, communication interface 105, and input / output interface 106 may be configured to transmit and receive data from each other via wireless communication or the like.

[0084] The processor 101 includes at least one processor such as a CPU (Central Process Unit), MPU (micro processing unit), GPU (Graphics Processing Unit), or FPGA (field-programmable gate array), and can realize various functions of the event detection device 100 by executing programs such as system software, application software, or firmware stored in the ROM 102, RAM 103, or storage 104.

[0085] ROM 102 is a read-only non-volatile memory. ROM 102 non-temporarily stores the startup program required when the event detection device 100 of this embodiment is started. The event detection device 100 is started when the processor 101 executes the program in ROM 102. ROM 102 is, for example, an EPROM (Erasable Programmable Read Only Memory) and stores various startup settings in addition to the startup program.

[0086] RAM 103 is a volatile memory that can be written to and read from. RAM 103 temporarily stores programs necessary for processing in processor 101 and data necessary for executing those programs. For example, processor 101 executes a program in RAM 103 to perform calculations on the data in RAM 103 and stores the calculation results in RAM 103.

[0087] The storage 104 is composed of non-volatile memory such as an HDD (Hard Disk Drive) or SSD (Solid State Drive). The storage 104 non-temporarily stores the program executed by the processor 101 and the data necessary for the execution of the program. The processor 101 reads the program and data from the storage 104 into the RAM 103 and executes various functions by executing the program.

[0088] The communication interface 105 is connected to a communication network and enables the reception of information from and transmission of information to server devices, etc.

[0089] The input / output interface 106 is connected to an input device 1071 and an output device 1072, respectively. The input / output interface 106 enables the input of information from the input device 1071 and the output of information to the output device 1072. The input device 1071 includes, for example, a keyboard, mouse, touch panel, and disk drive. The input device 1071 is not limited to these and may include any other input device. The output device 1072 includes, for example, a display and disk drive. The output device 1072 is not limited to these and may include audio output means such as a speaker or any other output device. The input device 1071 and the output device 1072 may be configured as an input / output device 107 that has the functions of both.

[0090] The program for operating the event detection device 100 according to the embodiment is provided to the computer, for example, via a computer-readable storage medium 108. This storage medium 108 is a non-temporary computer-readable storage medium. Non-temporary computer-readable storage media include, for example, disks such as flexible disks, optical disks (CD-ROM, CD-R, DVD-ROM, DVD-R, etc.), magneto-optical disks (MO, etc.), semiconductor memory, USB memory, etc.

[0091] Furthermore, the above program may be stored on a server device on a communication network, downloaded from the server device, and temporarily stored in the storage 104.

[0092] For example, in response to an input signal instructing the activation of the event detection device 100, the processor 101 reads a program from the storage 104 into the program area of ​​the RAM 103, and also reads the data necessary for executing the program from the storage 104 into the data area of ​​the RAM 103. The processor 101 performs calculations on the data in the data area according to the program and writes the calculation results to the data area. Through these operations, the processor 101, RAM 103, storage 104, communication interface 105, and input / output interface 106 cooperate to perform at least some of the functions of the components of the event detection device 100, namely the event detection unit 111, the copy destination candidate extraction unit 112, and the copy destination estimation unit 113.

[0093] It should be noted that the present invention is not limited to the embodiments described above, and can be modified in various ways during implementation without departing from its essence. Furthermore, each embodiment may be combined as appropriate, and in that case, the combined effects can be obtained. Moreover, the above embodiments include various inventions, and various inventions can be extracted by selecting combinations from the multiple constituent elements disclosed. For example, if the problem can be solved and effects obtained even if some constituent elements are deleted from all the constituent elements shown in the embodiment, then the configuration with these deleted constituent elements can be extracted as an invention.

[0094] 100...Event detection device 101...Processor 102...ROM 103...RAM 104...Storage 105...Communication interface 106...Input / output interface 107...Input / output device 1071...Input device 1072...Output device 108...Storage medium 110...Control unit 111...Event detection unit 1111...Operation log acquisition unit 1112...Event determination unit 112...Copy destination candidate extraction unit 1121...Extraction scenario storage unit 1122...Extraction scenario execution unit 113...Copy destination estimation unit 1131...File conversion unit 1132...Similarity calculation unit 1133...Copy destination estimation unit 120...Data storage unit 121...Event storage unit 130...Program storage unit 140...Communication unit 150...Input / output unit 151...Input unit 152...Output unit

Claims

1. An event detection device comprising: an event storage unit that records event information composed of a combination of multiple operation targets and multiple operation types associated with target screen information; an event detection unit that compares the operation log and the event information by acquiring an operation log that includes at least the operation targets and the operation types, and detects and determines an event corresponding to the operation log; a copy destination candidate extraction unit that, if the detected event is a file copy, acquires the source file and the destination folder name from the operation log immediately before copy detection, performs a search using the folder name, and extracts all files in the folder obtained as a search result as copy destination candidate files; and a copy destination estimation unit that calculates the similarity between the source file and a plurality of copy destination candidate files, and determines the copy destination candidate file with the highest similarity to the source file as the copy destination file.

2. The event detection device according to claim 1, wherein the copy destination estimation unit converts the source file and a plurality of copy destination candidate files into an arbitrary file format, and uses the edit distance between strings as a method for calculating the similarity.

3. The event detection device according to claim 2, wherein, after determining the destination file, if event detection for the source file is not required, the copy destination estimation unit updates the target information included in the event information using the destination information of the destination file, and if event detection for the source file is to be continued, it duplicates the target information included in the event information using the destination information of the destination file and updates one of the target information.

4. A program that causes a computer to function as an event detection device according to any one of claims 1 to 3.

Images