Information Processing Apparatus Warning Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information processing systems often issue incorrect warnings when risky operations are performed, as they lack the ability to differentiate between deliberate and genuine risky operations in similar installation environments, leading to unnecessary alerts.
Innovation Solution
An information processing apparatus that accumulates operation logs from multiple devices and issues warnings only if a minority of devices perform an operation different from the majority, using a threshold value to determine the validity of the operation, thereby reducing false alarms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If risky operations are defined in advance and warnings are invariably issued after predefined risky operations are performed, then security monitoring coverage is improved, but the number of incorrect warnings increases
Solution Approach 1:
The system applies different warning strategies to different operation types based on their characteristics. For operations with high conformity across devices, statistical analysis is applied; for operations with inherent variability, warnings are issued based on predefined risk definitions. This localized approach to warning generation reduces incorrect warnings while maintaining security coverage.
Solution Approach 2:
The system changes the parameter of warning issuance from a binary (always issue) to a conditional (issue only when conformity threshold is exceeded). By introducing a statistical threshold parameter based on operation conformity rates, the system dynamically adjusts warning behavior to distinguish between deliberate and genuine risky operations.
2Reliability
If warnings are issued for all predefined risky operations, then security alert coverage is improved, but false alarms increase
Solution Approach 1:
The system uses feedback from the operation log database to continuously monitor operation conformity patterns. By analyzing historical operation data and detecting deviations from normal patterns, the system generates warnings only when genuine anomalies are detected, reducing false alarms while maintaining comprehensive security alert coverage.
3Measurement precision
If operation logs from multiple devices are analyzed, then accuracy of warning determination is improved, but system complexity increases
Solution Approach 1:
The system merges operation logs from multiple information devices into a centralized operation log database. By combining data from multiple sources, the system achieves more accurate statistical analysis of operation conformity patterns, improving warning determination accuracy while managing complexity through centralized data consolidation.
Data Source
AI summary
An information processing apparatus includes a processor configured to: receive, from each of plural information devices, operation information indicating an operation that has been performed on the information device, the operation information being associated with event information indicating an event caused by the operation in the information device, and accumulate the operation information in an operation log database; and refer to the operation log database and, if different operations associated with a same event have been performed on at least a part of the plural information devices and, among the at least a part of the plural information devices, at least one information device fewer than or equal to a threshold value has been subjected to a minority operation, which is an operation different from an operation performed on other information devices, issue a warning against the minority operation.