JP2012141989A - Abnormal behavior detection device, monitoring system, abnormal behavior detection method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an abnormal behavior detection device capable of making an appropriate response such as the prevention of a fraudulent action by a detection object, etc. by obtaining the output of information related to an abnormal action or abnormal position leading to the fraudulent action.SOLUTION: An abnormal behavior detection device includes an image information acquisition part, a behavior identification part, a scheduled behavior storage part, a properness determination part, an abnormality determination part, and an abnormality report part. The image information acquisition part acquires image information of a detection object. The behavior identification part identifies the action and action position of the detection object, based on the image information. The scheduled behavior storage part stores scheduled behavior information, which indicates a scheduled action and action position associated with time, for each detection object. The properness determination part determines properness when the action and position of the detection object identified by the behavior identification part are the scheduled action and action position associated with the time, which is stored in the scheduled behavior storage part.

Description

  Embodiments of the present invention relate to an abnormal behavior detection technique that detects abnormal behavior of a person or the like using image processing.

  In recent years, data-related services called colocation services have been provided in data centers (including computer centers). The colocation service is a service that lends a server room managed by a data center to a general company that is a user. Normally, a plurality of servers are installed in the server room.

  In the colocation service, a user of a data center may own a server installed in a server room and perform maintenance of the server by the user himself / herself. In such a case, the user dispatches a worker to the server room to perform maintenance of the server and peripheral devices (for example, disk drives).

  Here, a server used by other users is also installed in the server room. In a server room where a high level of security is required, strict entry / exit management is generally performed by a biometric authentication function or a verification device using an IC card. However, there is no mechanism for strictly managing the behavior of a person such as a worker who has entered the server room and preventing information leakage due to, for example, physical unauthorized access to the server.

  2. Description of the Related Art Conventionally, a system has been proposed in which a pre-registered maintenance work reservation and a maintenance work log in a maintenance target server are compared to detect an illegal act after the fact (see, for example, Patent Document 1).

JP 2006-268148 A

  Prior art systems detect fraudulent acts after the fact, so to speak, relate to information security functions. However, in order to eliminate the risk of information leakage due to physical unauthorized access to the servers installed in the server room described above, it is possible to detect abnormal behavior of people and prevent unauthorized acts such as physical unauthorized access. In other words, a physical security function is necessary.

  Therefore, an object of the present invention is to obtain an output of information related to an abnormal action or an abnormal position that leads to an illegal action, so that the administrator can know the abnormality and prevent an illegal action caused by a detection target. It is an object of the present invention to provide an abnormal behavior detection device that can take appropriate measures.

  According to the present embodiment, the abnormal behavior detection device includes an image information acquisition unit, a behavior identification unit, a scheduled behavior storage unit, an appropriate determination unit, an abnormality determination unit, and an abnormality notification unit. . The image information acquisition unit acquires image information to be detected. The action identifying means identifies the action and action position of the detection target based on the image information. The scheduled action storage means stores scheduled action information indicating a scheduled action and an action position corresponding to time for each detection target. The appropriateness determining means determines that the action and position of the detection target identified by the action identifying means are appropriate if the detected action and position corresponding to the time stored in the scheduled action storage means are appropriate. To do. The abnormality determining means determines that the action is detected as abnormal when the action and position of the detection target identified by the action identifying means are different from the scheduled action and action position corresponding to the time stored in the scheduled action storage means. To do. The abnormality notification means notifies that the action to be detected is abnormal when the abnormality determination means determines that an abnormality has occurred.

The block diagram which shows the principal part of the monitoring system regarding embodiment of this invention. The block diagram for demonstrating the structure of the image process part regarding this embodiment. 6 is a flowchart for explaining the operation of the image processing unit according to the present embodiment. The flowchart for demonstrating operation | movement of the monitoring system regarding this embodiment. The timing chart for demonstrating operation | movement of the monitoring system regarding this embodiment. The timing chart for demonstrating operation | movement of the monitoring system regarding this embodiment.

  Embodiments of the present invention will be described below with reference to the drawings.

[System configuration]
FIG. 1 is a block diagram for explaining a configuration of a monitoring system according to the present embodiment.

  The monitoring system 10 is roughly divided into a determination unit 11, an image processing unit 12, an entry / exit management unit 13, and a business management unit 14, which are configured by computer system hardware and software. In addition, each function part 12-14 may consist of a computer, respectively, and the structure connected by a network and transmitting / receiving information may be sufficient. The network includes not only a computer network such as a LAN but also a communication network connected to a mobile phone or the like.

  Based on the information provided from the image processing unit 12, the entrance / exit management unit 13, and the business management unit 14, the determination unit 11 determines whether, for example, the actions of the person entering and leaving the server room and the person entering the room are appropriate. The pass / fail judgment operation for judging the That is, the determination unit 11 is an abnormal behavior detection unit that detects abnormal behavior when a person's behavior is inappropriate. In this embodiment, a server room is assumed as the monitoring range.

  The image processing unit 12 has a function of processing image information input from a sensor 15 such as a monitoring camera and identifying the behavior of a person to be monitored. The image processing unit 12 refers to the database 20 that stores action identification information and the database 21 that stores work position information.

  The entrance / exit management unit 13 manages a person entering or leaving the server room based on an authentication result from the authentication device 16 using an IC card, for example. The entry / exit management unit 13 acquires personal attribute information from the authentication result of the authentication device 16 and stores it in the database 22. The entrance / exit management unit 13 controls the opening and closing of a physical gate 17 such as an automatic door provided at the entrance of the server room.

  The business management unit 14 manages work reservation information stored in the database 23. That is, the business management unit 14 registers the work reservation information input from the operator of the data center that operates the server room in the database 23, and the work reservation information registered in the database 23 in response to a request from the determination unit 11. I will provide a.

  The work reservation information is information related to scheduled work contents in the server room that a worker who performs work in the server room applies to the manager of the data center in advance. Specifically, the work reservation information includes work content, work date and time, work place, work procedure, work area and rack position, server position information, and the like.

  As illustrated in FIG. 2, the image processing unit 12 includes an image acquisition unit 120 and an action identification unit 121. The image acquisition unit 120 acquires image information input from the sensor 15 and stores it in an internal buffer memory. The sensor 15 is a plurality of surveillance cameras 150, a laser detector 151, or an infrared sensor 152 installed in the server room. In the present embodiment, the image acquisition unit 120 acquires image information obtained by photographing a person in the server room with the monitoring camera 150.

[System Operation]
Hereinafter, the operation of the system of the present embodiment will be described with reference to FIGS.

  First, the operation of the entrance / exit management unit 13 of the system 10 when an operator enters the server room will be described with reference to the flowchart of FIG. 4 and the timing chart of FIG. Here, the worker is a person dispatched by a data center user who operates the server room.

  The worker accesses the authentication device 16 installed at the entrance of the server room using an IC card. The authentication device 16 reads personal attribute information from the IC card and executes authentication processing. The entry / exit management unit 13 acquires personal attribute information from the authentication result of the authentication device 16 and stores it in the database 22.

  The determination unit 11 compares the personal attribute information obtained from the entrance / exit management unit 13 with the work reservation information registered in advance, and determines whether or not the work reservation person and the room entry match (step S11). At this time, as shown in FIG. 5, the determination unit 11 obtains work reservation information such as a worker name, work schedule, work reservation time, and the like registered in the database 23 from the business management unit 14 (step S12).

  When the determination unit 11 obtains a determination result that the work reservation person and the room occupant coincide with each other and the work reservation time and the room entry time substantially coincide with each other, the determination part 11 determines that the worker is an appropriate room occupant ( YES in step S11). In this case, as shown in FIG. 5, the system 10 unlocks, for example, an electric lock and opens a physical gate 17 such as an automatic door of a server room. Thereby, the worker can enter the server room.

  On the other hand, the system 10 maintains the closed state of the physical gate 17 without unlocking the electric lock when the determination results of the determination unit 11 do not match (NO in step S11, S13). Therefore, when the worker is inappropriate, the worker cannot enter the server room.

  Next, the operation of the system 10 after the worker enters the server room will be described. The operation of the image processing unit 12 will be mainly described below with reference to the flowchart of FIG.

  In the present embodiment, a plurality of monitoring cameras 150 are installed in the server room. The surveillance camera 150 photographs a person who has entered the server room. In the image processing unit 12, the image acquisition unit 120 converts the image signal transmitted from the monitoring camera 150 into image information and acquires it (step S3). If the image processing unit 12 is a monocular image processing method, the image acquisition unit 120 acquires image information obtained by photographing with one monitoring camera 150. If the image processing unit 12 is a stereo image processing method, the image acquisition unit 120 acquires stereo image information from image signals transmitted from the two monitoring cameras 150. In the present embodiment, there are no restrictions on the number of surveillance cameras or the angle of view.

  Here, the image processing unit 12 inputs a model file necessary for image processing in advance and executes initialization processing of the model (steps S1 and S2). The image processing unit 12 identifies an action (mainly an act of accessing the server) of a person (here, a worker) who enters the server room by image processing from the acquired image information. Moreover, the server position which the worker is accessing is specified. That is, the image processing unit 12 generates worker action identification information (including location information of the accessed server) based on the image processing result. Details will be described below.

  The behavior identification unit 121 executes behavior identification processing based on the acquired image information (step S4). In addition, the action identification unit 121 also executes a process for identifying a work (access) position. The action identification unit 121 outputs the action identification process result (behavior identification result file) and the work position information (position information file) to the determination unit 11 and outputs them to the display screen of the terminal of the computer system (step S5).

  Here, the action content to be identified in the server room is, for example, opening / closing of the rack of the server body, replacement of the disk drive (HDD), insertion / removal of the USB memory, keyboard / mouse operation, cabling, etc. It is an action related to physical access to equipment such as a rack. The work (access) position is specified by, for example, the location of an interface with an external medium. The action identifying unit 121 also performs an action identifying process corresponding to a criminal act such as theft or destruction of a disk drive in the server room. In addition, the action identification unit 121 identifies an action of physical access to the server even when the posture of the worker (for example, standing state, middle waist state, squatting state) or the height of the server is different. The action identifying unit 121 identifies the area in the server room where the worker is located, which rack is present in front, which server is being accessed, and the like as work (access) position identification processing.

  As such an action identification process by the action identification unit 121, in a method for identifying an action on a rule basis, an identification process can be performed based on a threshold setting for specific feature amount information. For example, when the action of inserting the USB memory is identified in a posture in which the worker squats down, the posture is determined based on the height information of the person in the feature amount information. Also, the action of inserting the USB memory is identified based on the feature amount information such as the silhouette of the person. At this time, the threshold value used as a reference for identification is variable.

  As described above, as an operation of the system 10 after the worker enters the server room, the image processing unit 12 captures the image of the worker by photographing with the monitoring camera 150 as shown in the flowchart of FIG. Information is acquired (step S14). The image processing unit 12 uses the behavior identification unit 121 to execute behavior identification processing for identifying the worker's behavior content and work (access) position (step S15).

  Next, based on the action identification result (behavior information) output from the image processing unit 12, the determination unit 11 of the system 10 determines whether the worker's work (behavior or action) in the server room is an abnormal action. It is determined whether or not (step S16). Specifically, the determination unit 11 refers to the work reservation information registered in the database 23, and compares the work reservation information with action information (that is, action identification result) (step S17). Here, the work reservation information and the behavior information are associated by the personal attribute information managed by the entrance / exit management unit 13.

  Here, as illustrated in FIG. 5, the determination unit 11 acquires work reservation information registered in the database 23 from the business management unit 14. The business management unit 14 registers the work reservation information input from the data center operator who operates the server room in the database 23. The work reservation information is information related to scheduled work contents in the server room that a worker who performs work in the server room applies to the manager of the data center in advance. Specifically, the work reservation information includes the worker's affiliation and name, work schedule (start time, end time, etc.), work content, work place, work procedure, work area and rack position, server position information, etc. Including.

  If the comparison results match, the determination unit 11 determines that the worker's work is appropriate (YES in step S16). The system 10 notifies the data center operator and server administrator by outputting the determination result of the determination unit 11 on the display screen of the terminal (step S18).

  On the other hand, when the comparison results do not match, the determination unit 11 determines that the worker's work is inappropriate (NO in step S16). That is, the determination unit 11 detects an abnormal behavior of the worker. Here, the determination unit 11 may detect the abnormal behavior by comparing the work reservation information on the time axis and the behavior information (behavior identification result) as the comparison process. That is, when the work reservation information includes work contents for which the date and time are specified, the action information at the same date and time is compared. Specifically, for example, the work for exchanging the disk drive of the server is a case where the date and time are specified as work reservation information. In this case, when it is identified that the worker's action is a work for exchanging the disk drive, if the date and time are different, it is detected that the worker's action is an abnormal action.

  When the operation is inappropriate according to the determination result of the determination unit 11, as shown in FIG. 6, the system 10 locks the electric gate at the entrance of the server room and locks the physical gate 17 (step S19). That is, when it is determined that the worker is performing an illegal act (abnormal behavior), the user cannot leave the server room.

  Further, the system 10 controls the warning device and issues an alarm to a data center operator or the like. In this case, the system 10 may perform warning measures such as playing a warning announcement using a speaker in the server room. As shown in FIG. 6, when the system 10 detects an abnormal behavior of the worker, the system 10 performs an anti-fraud measure such as a warning or locking the entrance of the server room, and notifies the data center operator or server administrator ( Step S18).

  As described above, the monitoring system 10 of the present embodiment can monitor the work (behavior) of the worker in the server room even if the worker is allowed to enter the server room. . That is, based on the work reservation information registered in advance, it is determined whether or not the worker's work is appropriate, and when it is determined that an inappropriate work has been performed (when abnormal behavior is detected), Predetermined countermeasure processing can be performed. Countermeasure processing includes processing such as locking and locking the entrance door of the server room, alarm notification to a data center manager or the like, or sending a warning announcement in the server room.

  By performing such countermeasure processing, it is possible to interrupt work that is not scheduled by the operator, for example, work such as taking out a disk drive. Therefore, for example, even when a suspicious person pretending to be an operator enters the server room, it is possible to prevent unauthorized access to the server and unauthorized acts such as stealing a disk drive. This makes it possible not only to detect unauthorized access to the server from the operation history etc., but also to detect and interrupt physical unauthorized access to the server and abnormal behavior in the server room. Accordingly, the risk of information leakage due to physical unauthorized access to the server can be eliminated.

  In the system 10, when the determination unit 11 notifies the business management unit 14 of the determination result, the business management unit 14 causes the personal attribute information of the suspicious person in the server room and the history information of physical access to the server. Can be managed. In addition, when the determination unit 11 detects a person with abnormal behavior, the system 10 may register the captured image of the suspicious person (worker) captured by the monitoring camera 150 in the database. By such registration processing (a kind of learning function), the system 10 can refer to the registered captured image when detecting the abnormal behavior of the worker in the next server room.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

DESCRIPTION OF SYMBOLS 10 ... Monitoring system, 11 ... Determination part, 12 ... Image processing part, 13 ... Entrance / exit management part,
14 ... Business management unit, 15 ... Sensor, 16 ... Authentication device, 17 ... Physical gate,
20 ... database (action identification information), 21 ... database (work position information),
22 ... Database (personal attribute information), 23 ... Database (work reservation information),
120 ... an image acquisition unit, 121 ... an action identification unit, 150 ... a surveillance camera.

Claims (14)

Image information acquisition means for acquiring image information of a detection target;
Action identifying means for identifying the action and action position of the detection target based on the image information;
Scheduled action storage means for storing scheduled action information indicating a scheduled action and an action position corresponding to time for each detection target;
A correctness determining means for determining that the action and position of the detection target identified by the action identifying means are appropriate if the action and position of the detection target are the scheduled action and the action position corresponding to the time stored in the scheduled action storage means; ,
An abnormality determining means for determining an abnormality when the action and position of the detection target identified by the action identifying means are different from the scheduled action and the action position corresponding to the time stored in the scheduled action storage means; ,
An abnormal behavior detection apparatus comprising: an abnormality notification means for notifying that the action to be detected is abnormal when the abnormality determination means determines that an abnormality has occurred. Image information acquisition means for acquiring image information of a detection target;
Action identifying means for identifying the action and action position of the detection target based on the image information;
Scheduled action storage means for storing scheduled action information indicating a scheduled action and an action position corresponding to time for each detection target;
An abnormality determining means for determining an abnormality when the action and position of the detection target identified by the action identifying means are different from the scheduled action and the action position corresponding to the time stored in the scheduled action storage means; ,
An abnormal action detection apparatus comprising: output means for outputting information indicating that the action to be detected is abnormal when the abnormality determination means determines that the action is abnormal. A detection target authenticating means for authenticating a detection target entering the monitoring area based on identification information stored in advance for each detection target;
Image information acquisition means for acquiring image information of a detection target in the monitoring area as a detection target authenticated by the detection target authentication means;
Action identifying means for identifying the action and action position of the detection target based on the image information;
Scheduled action storage means for storing scheduled action information indicating a scheduled action and an action position corresponding to time for each detection target;
An abnormality determining means for determining an abnormality when the action and position of the detection target identified by the action identifying means are different from the scheduled action and the action position corresponding to the time stored in the scheduled action storage means; ,
An abnormal action detection apparatus comprising: output means for outputting information indicating that the action to be detected is abnormal when the abnormality determination means determines that the action is abnormal.   The abnormal action detection device according to claim 1, wherein the time includes a date and time or a time. The abnormal behavior detection device according to any one of claims 1 to 3,
A monitoring system comprising: a monitoring camera that images the detection target in a monitoring area and transmits the image information generated by the imaging to the image information acquisition unit.   Countermeasure processing means for executing a countermeasure process for interrupting or preventing an illegal act by a person in the monitoring area when information indicating an abnormal behavior of the person is output as the detection target by the abnormal behavior detection device. The monitoring system according to claim 5, further comprising: The countermeasure processing means includes:
The monitoring system according to claim 6, further comprising means for preventing a person from withdrawing from the monitoring area. The countermeasure processing means includes:
The monitoring system according to claim 6, further comprising means for giving a warning to a person in the monitoring area. Applied to an abnormal behavior detection device having image information acquisition means for acquiring image information of a detection target, and scheduled action storage means for storing scheduled action information indicating a scheduled action and an action position corresponding to time for each detection target A method for detecting abnormal behavior,
A process of acquiring image information to be detected;
A process of identifying an action and an action position of the detection target based on the image information;
When the action and position of the detection target identified by the action identification means are the scheduled action and action position corresponding to the time stored in the scheduled action storage means,
When the identified action and position of the detection target are different from the scheduled action and action position corresponding to the time stored in the scheduled action storage unit, a process of determining an abnormality,
And a process for notifying that the action to be detected is abnormal when it is determined that the abnormality is abnormal. Applied to an abnormal behavior detection device having image information acquisition means for acquiring image information of a detection target, and scheduled action storage means for storing scheduled action information indicating a scheduled action and an action position corresponding to time for each detection target A method for detecting abnormal behavior,
A process of acquiring image information to be detected;
A process of identifying an action and an action position of the detection target based on the image information;
When the identified action and position of the detection target are different from the scheduled action and action position corresponding to the time stored in the scheduled action storage unit, a process of determining an abnormality,
And a process of outputting information indicating that the action to be detected is abnormal when the abnormality is determined to be abnormal. Detection target authentication means for authenticating detection targets that fall within the monitoring area based on identification information stored in advance for each detection target, image information acquisition means for acquiring image information of the detection target in the monitoring area, and the detection target An abnormal behavior detection method applied to an abnormal behavior detection device having scheduled behavior storage means for storing scheduled behavior information indicating a scheduled behavior and an action position corresponding to time every time,
A process of acquiring image information of a detection target in the monitoring area as a detection target authenticated by the detection target authentication unit;
A process of identifying an action and an action position of the detection target based on the image information;
When the identified action and position of the detection target are different from the scheduled action and action position corresponding to the time stored in the scheduled action storage unit, a process of determining an abnormality,
And a process of outputting information indicating that the action to be detected is abnormal when the abnormality is determined to be abnormal. Incorporated into an abnormal behavior detection device having image information acquisition means for acquiring image information of a detection target, and scheduled action storage means for storing scheduled action information indicating a scheduled action and an action position corresponding to time for each detection target A program executed by a computer,
A process of acquiring image information to be detected;
A process of identifying an action and an action position of the detection target based on the image information;
When the action and position of the detection target identified by the action identification means are the scheduled action and action position corresponding to the time stored in the scheduled action storage means,
When the identified action and position of the detection target are different from the scheduled action and action position corresponding to the time stored in the scheduled action storage unit, a process of determining an abnormality,
The program which makes the said computer perform the procedure which has the process of notifying that the action of the said detection object is abnormal when it determines with the said abnormality. Incorporated into an abnormal behavior detection device having image information acquisition means for acquiring image information of a detection target, and scheduled action storage means for storing scheduled action information indicating a scheduled action and an action position corresponding to time for each detection target A program executed by a computer,
A process of acquiring image information to be detected;
A process of identifying an action and an action position of the detection target based on the image information;
When the identified action and position of the detection target are different from the scheduled action and action position corresponding to the time stored in the scheduled action storage unit, a process of determining an abnormality,
The program which makes the said computer perform the procedure which has the process which outputs the information which shows that the action of the said detection object is abnormal when it determines with the said abnormality. Detection target authentication means for authenticating detection targets that fall within the monitoring area based on identification information stored in advance for each detection target, image information acquisition means for acquiring image information of the detection target in the monitoring area, and the detection target A program executed by a computer incorporated in an abnormal action detection device having scheduled action storage means for storing scheduled action information indicating a scheduled action and an action position corresponding to time every time,
A process of acquiring image information of a detection target in the monitoring area as a detection target authenticated by the detection target authentication unit;
A process of identifying an action and an action position of the detection target based on the image information;
When the action and position of the identified detection object are different from the scheduled action and action position corresponding to the time stored in the scheduled action storage unit related to the detection object, a process of determining an abnormality,
The program which makes the said computer perform the procedure which has the process which outputs the information which shows that the action of the said detection object is abnormal when it determines with the said abnormality.

Images