JP4264113B2 - Terminal monitoring apparatus and terminal monitoring program - Google Patents

Description

  The present invention relates to a terminal monitoring technique for acquiring user operation information on a user terminal from a plurality of user terminals.

  As a technique for acquiring operation content information from a plurality of user terminals and managing the actions of each user, for example, an action management system disclosed in Patent Document 1 is known. The behavior management server that constitutes the behavior management system acquires log information, which is the operation content operated by the user, from the terminal, and extracts information from the log information based on a preset condition, It comprises a change detecting means for detecting a change in operation content for each terminal from information obtained by the extracting means, and a notifying means for notifying the administrator terminal of the analysis result obtained by the change detecting means.

  The behavior management server configured as described above analyzes the change in the behavior pattern of the terminal user from the time and rhythm of each terminal, the change in the access destination, the frequency of access to the file, etc. This makes it possible to manage the terminal with higher accuracy.

JP-A-2005-332345 (paragraphs [0010] to [0011])

  The above-described behavior management system is useful because it can grasp changes in behavior patterns of terminal users of each terminal and is useful for preventing information leakage and the like. However, when work is performed in units of groups in a company or business office, terminal monitoring that detects terminal users who perform operations different from those normally performed in the group is desired.

  The present invention has been made paying attention to such problems, and its purpose is terminal monitoring that can easily monitor terminal users who perform suspicious operations within a group when working in groups. To provide technology.

In the terminal monitoring unit that acquires operation log information of a user from a plurality of user terminals to be monitored at the user terminal, and operation log information classifying unit for classifying the operation log information for each group to which the user terminal belongs, the operation For each user terminal belonging to each group classified by the log information classification unit, the contents of the operation items defined in the operation log information of the user terminal are defined in the operation log information of other user terminals belonging to the group. When it is determined that the sum of the evaluation values given each time it matches the content of the operation item is less than the threshold, the operation relevance determination unit identifies the user terminal as the user terminal on which the suspicious operation is performed When monitoring Les be higher than normal level of monitoring of the user terminal that is identified as being performed a suspicious operation by the operation-related determining unit And a le adjuster.

According to the above configuration, a plurality of user terminals are divided into predetermined groups, the degree of relevance of operation contents between user terminals included in the group is determined for each group, and the monitoring level is adjusted based on the determination result Therefore, for example, if there is a user who performs a suspicious operation different from the operation normally performed in the group, the monitoring level is increased, and this can be easily monitored. As operation content information, for example, operation log information describing operation content performed by the user can be used. Moreover, according to the said structure, since a relevance degree is directly determined between user terminals, the relevance degree of the operation content between the terminals in a group can be determined more precisely.

Operation relevance as the determination result to adjust the monitoring level based judging unit, can take a variety of forms, of the steering drawing surface acquired from the plurality of user terminals, said suspicious activity performed It is preferable that the operation screen of the user terminal specified as being displayed is displayed on the monitoring screen more easily than the operation screens of other user terminals in a display form corresponding to the monitoring level. According to such a configuration, the terminal monitor can visually and easily recognize the user terminal having no relevance, and can easily monitor the operation content via the operation screen.

The program implemented in the above-described terminal monitoring apparatus is also included in the scope of rights of the present invention. A terminal monitoring program for causing a computer to function as a terminal monitoring apparatus that acquires user operation log information in the user terminal from a plurality of user terminals to be monitored is the computer, and the operation log information is transmitted to the user. and operation log information classifying unit which classifies into groups the terminal belongs, for each user terminal belonging to each group to which the operation log information classifying unit classifies, the contents of operation items the defined in the operation log information of the user terminal When it is determined that the total value of the evaluation values given each time it matches the content of the operation item specified in the operation log information of another user terminal belonging to the group, the user terminal is and operation-related determining unit for identifying a user terminal that suspicious operation is being performed, suspicious steering by the operation-related determining unit It is for causing functions to monitor the level of the user terminal identified as the monitoring level adjusting unit to higher than normal as is done.

  Of course, this terminal monitoring program also has the same operation and effect as the above-described terminal monitoring apparatus, and can be provided with various additional characteristic configurations described above.

[First Embodiment]
Hereinafter, a first embodiment of a terminal monitoring apparatus according to the present invention will be described with reference to the drawings.
As shown in FIG. 1, a plurality of user terminals 1, a terminal monitoring server 2 as a terminal monitoring device that monitors the user terminals 1, and a printer 3 are connected via a network 4 to construct a terminal monitoring system. ing. The plurality of user terminals 1 are further grouped into a plurality of groups such as group A and group B. In the present embodiment, user terminals that perform similar operations are grouped into one group.

  A specific system configuration of this terminal monitoring system is shown in FIG. First, in the computer of the terminal 1a belonging to the group A (the other terminals 1a and the terminals belonging to other groups are the same), the software 51 and / or the hardware have functions as a function related to the present invention. The GUI unit 11 that controls output from the operation input device 61 such as a keyboard and a mouse, the data processing unit 12 that performs data processing by the user including various file processing such as file creation, and manages various operations in the terminal 1a An operation management unit 13, a network interface 14 as a transmission / reception unit for transmitting data to the network 4, and the like are constructed. The created file can be recorded on the recording medium M via the I / O interface.

  Of these, the operation management unit 13 has functions such as login / logoff processing, and operation log information that generates operation log information describing operation contents in response to a predetermined operation performed on the terminal 1a. The generation unit 13a includes an operation screen cab 13b that cabs the operation screen in the terminal 1a and generates a capture image of the operation screen. The generated operation log information and the captured image of the operation screen are linked.

  On the other hand, the computer of the terminal monitoring server 2 includes, as a function related to the present invention, software or hardware, or both, a terminal management unit 21 that manages the terminal 1, and operation content information acquired from the terminal 1. An operation log information classification unit 22 that classifies operation log information for each predetermined group, an operation log information storage unit 23 that stores operation log information classified for each group, and an operation for each group based on the stored operation log information The operation reference generation unit 24 that generates a reference or updates the generated operation reference, the operation reference table 25 that stores the operation reference, and compares the acquired operation log information with the operation reference stored in the operation reference table 25. The determination result of the operation relevance determination unit 26 and the operation relevance determination unit 26 for determining the relevance of the operation content between the user terminals in the group And monitoring the level adjusting unit 27 for adjusting the level of monitoring of the user terminal 1 based is built.

  The terminal management unit 21 includes an operation log information acquisition unit 21 a that acquires operation log information from the user terminal 1 and a terminal capture image acquisition unit 21 b that acquires a captured image of the operation screen of the user terminal 1. In addition, the operation relevance determination unit 26 includes a terminal specifying unit 26a that specifies a user terminal determined to have no relevance in the operation content. The user terminal specified by the terminal specifying unit 26a is: The monitoring level is raised by the monitoring level adjustment unit 27.

  Similarly to the terminal 1, a GUI unit 28 that controls output to the monitor 52 and input from the operation input device 62 such as a keyboard and a mouse, a network interface 29 as a transmission / reception unit that transmits data to the network 4, and the like are constructed. ing. The monitor 52 displays a list of operation screens of user terminals to be monitored, and the terminal monitor can visually recognize the operation content of each terminal on this screen.

  As described above, the grouping of the plurality of user terminals 1 to be monitored is set in advance, and the operation log information classification unit 22 has information regarding the association between the user terminal and the group to which the user terminal belongs. is doing.

  As schematically illustrated in FIG. 3, the data structure of the operation log information is a terminal ID for identifying the terminal 1, a user ID (or login name) for identifying a login user, date / time data, and execution of an operation by the user. Contents, applications used, files, folders to which the files belong are included. The execution contents of the operation by the user include application activation, operation time after activation, printing, and the like.

  The operation criteria stored in the operation criteria table 25 are generated for each group. The operation standards for each group include various operation standards such as an application operation standard for each application, a printing operation standard, and a recording medium operation standard. Such an operation standard is generated based on the operation log information stored in the operation log information storage unit 23. As an example, the application operation standard generated based on the usage situation for each application is schematically illustrated in FIG. Has been shown.

  The application operation standard shown in FIG. 4 relates to the application APL1 in the group A, and this application operation standard is generated every month, and here, the one for December is shown. As can be seen from FIG. 4, the application operation standard is composed of an average operating time (solid line) and an allowable range (dotted line) for each time zone. Of course, it is also possible to create an operation standard using the number of activations in addition to the operation time.

  Therefore, if the operation time of the application APL1 in a predetermined time zone is acquired from the operation log information of the user terminal 1a to be determined, and the operation time satisfies the application operation standard in FIG. 4 (shaded portion in FIG. 4). , It is regarded as an operation related to the operation of group A. On the other hand, when it is determined that the operation criterion is not satisfied, it is considered that an operation having no relevance in the operation content in the group is performed. For example, if the operation time exceeds the allowable range at night, etc., the operation may be suspicious, and conversely the allowable range during working hours (from 9:00 to 18:00 in FIG. 4). If the operation time is less than that, there is a possibility that necessary work is not being performed.

  As for the generation of the operation reference, taking group A as an example, the operation log information of the user terminals 1a belonging to the group is read from the operation log information storage unit 23, and the operation of the application APL1 for which the operation reference is created The time is totaled for each predetermined month and day, and the average value is calculated. The average value calculated in this way is the average operation time drawn by the solid line in FIG. 4, and an operation reference is generated with an allowable range of ± 10% of the average operation time, for example. At this time, as shown in FIG. 4, the width of the allowable range may be changed according to the time zone. Further, the operation reference generation method is not limited to this, and various forms are possible by using a known statistical method.

  The operation criteria stored in the operation criteria table 25 are configured to be updatable. Taking the application operation standard in FIG. 4 as an example, the application operation standard is generated based on the operation log information stored in the operation log information storage unit 23 when December of the year has passed, It will be updated as the application operation standard in the next year.

  Next, the flow of terminal monitoring processing using operation criteria will be described with reference to FIG. First, the terminal monitoring server 2 acquires operation log information from each user terminal 1 by the operation log information acquisition unit 21a (# 01). The acquired operation log information is classified for each predetermined group by the operation log information classification unit 22 (# 02).

  When such grouping is performed, in each group, determination of the degree of relevance of operation contents between user terminals belonging to the group is performed based on the operation criteria and operation log information. For this reason, first, the operation standard (for example, application operation standard) of the group to which the user terminal to be determined belongs is read (# 03), and is included in the read application operation standard and the operation log information of the user terminal. Comparison with the application operation content to be performed is performed (# 04). That is, it is determined whether or not the application operation content of the user terminal satisfies the application operation standard as illustrated in FIG. 4. If it is determined that the application operation content does not satisfy the application operation standard (# 05 No branch), the user terminal Is identified as a user terminal performing an operation with no relevance (# 06).

  When a user terminal that is not related to the operation content is specified, the monitoring level for the user terminal is increased (# 07). In the present embodiment, the operation screen of the user terminal is highlighted on the monitoring screen 70 of the monitor 52 connected to the terminal monitoring server 2. An example of such highlighting is shown in FIG. 6, where the operation screen G (terminal 006 in the figure) of the user terminal 1 is located at a high priority position in the terminal monitor display unit 71 of the monitoring screen 70 ( (Upper left) and a larger size. Specifically, the frame 80 of the operation screen G is enlarged as a whole, the frame 80 is displayed in a conspicuous color such as red or yellow, and the process of blinking or flashing the frame 80 is also performed. The user terminal 1 is displayed on the display unit 72 as requiring attention. By setting the display form in this way, the terminal supervisor can more easily discover a suspicious operation.

  Of course, the processing after step # 04 described above is performed for each user terminal. If it is determined in step # 05 that the user terminal satisfies the operation criteria (# 05 Yes branch), the normal monitoring level is maintained (# 28). That is, the operation screen G of each user terminal is displayed with the same size on the monitoring screen 70 as shown in FIG. The acquired operation log information is stored in the operation log information storage unit 23, and the stored operation log information is used when updating the operation reference.

[Second Embodiment]
Next, a second embodiment of the terminal monitoring apparatus according to the present invention will be described with reference to the drawings. In the first embodiment, operation log information is accumulated, an operation standard is generated or updated for each group based on the operation log information, and operation contents between user terminals in the group are stored using the operation standard. Although the degree of relevance is determined, in the second embodiment, the degree of relevance is determined by focusing on the operation items defined in the operation log information without using the operation reference.

  For this reason, in the second embodiment, the operation reference generation unit 24 and the operation reference table 25 (see FIG. 2) in the first embodiment are omitted, and the operation content collation unit 26b and the evaluation value as shown in FIG. A threshold table 30 is provided. In FIG. 7, the same reference numerals are used for the same members as in FIG. The operation content collating unit 26b collates the contents of the operation items specified in the operation log information for each user terminal, and determines whether or not the operation items have the same contents. The operation relevance level determination unit 26 in the embodiment determines the relevance level of the operation content of the user terminal based on the degree of coincidence of the content of the operation item defined in the acquired operation log information.

  More specifically, in the present embodiment, the operation content collation unit 26b gives a predetermined numerical value (evaluation value) every time the contents of the operation items match, and the operation relevance determination unit 26 gives A user terminal whose sum of numerical values (evaluation values) is less than a threshold is determined as a user terminal having no relevance. Numerical values (evaluation values) and threshold values used for this determination are stored in the evaluation value / threshold value table 30.

  FIG. 8A shows the contents of the operation items defined in the operation log information of each user terminal 1a belonging to the group A at a certain time, and FIG. 8B shows the evaluation values given to the operation items and The threshold values are shown in a list format. As shown in FIG. 8A, the operation items include the contents of the operation performed by the user, the application being used, the file, the folder to which the file belongs, and the like. Also, as shown in FIG. 8B, 1, 2, 5, and 4 are assigned as evaluation values to the execution contents, applications, files, and folders that are operation items, and the contents of the operation items are other. This evaluation value is given when it matches the content of the operation item of the user terminal.

  For example, the user ab01 of the group A has the execution content of the user ac05 and the like, and the application ad and the folder of the user ad11 and the like match, so that 1 + 2 + 4 = 7 is given as the total value of the evaluation values. Also, since the user ae15 only has an execution content and an application that match those of other user terminals, 3 is given as the sum of evaluation values. Here, as shown in FIG. 8B, for the group A, the threshold value 4 is set for the relevance level determination, and there is no relevance level if the sum of the calculated evaluation values is less than this threshold value. It is determined to be a thing. Therefore, the user ab01 is determined as a user terminal having a relevance level, and the user ae15 is determined as a user terminal having no relevance level.

  FIG. 9 shows a flow of terminal monitoring processing in the second embodiment. As in the first embodiment, first, the terminal monitoring server 2 acquires operation log information from each user terminal 1 by the operation log information acquisition unit 21a (# 21). The acquired operation log information is classified for each predetermined group by the operation log information classification unit 22 (# 22).

  When such grouping is performed, in each group, determination of the degree of relevance of operation contents between user terminals belonging to the group is performed based on the degree of coincidence of the contents of the operation items defined in the operation log information. . That is, the contents of the operation items between the user terminals are collated in the group to be determined (# 23), and a predetermined evaluation value is given each time the contents of the operation items match (# 24). Then, it is determined whether or not the total value of the assigned evaluation values is less than the threshold value. When it is determined that the total value is not satisfied (# 25 No branch), the user terminal performs an operation with no relevance It is specified as a terminal (# 26).

  When a user terminal having no relevance level in the operation content is specified, the monitoring level for this user terminal is increased as in the first embodiment (# 27). If it is determined that the sum of the evaluation values assigned in step # 25 is equal to or greater than the threshold (# 25 Yes branch), the normal monitoring level is maintained (# 28).

  In addition to the above, various values can be used for the evaluation value and threshold value to be given. Moreover, you may comprise so that the evaluation value provided may be increased according to the number of user terminals with which the content of the operation item overlaps. The method of increasing the evaluation value may be set as appropriate, but as an example, the evaluation value may be increased by 1 when a predetermined number (for example, 4) or more overlap. That is, taking FIG. 8A as an example, since the application APL1 is overlapped by four user terminals, the evaluation value given in accordance with this is increased from 2 to 3.

  In addition to the above-described form of operation relevance determination using the degree of coincidence, for example, a user terminal serving as a leader is set in a group, and the operation at the leader terminal is used as a reference, that is, the operation of the leader terminal. As long as it has at least one operation item that matches the content of the item, it may be determined as a user terminal having a degree of association.

  In addition, a user information storage unit that stores unique information (such as job title and years of service) of the user who uses the terminal is provided, and a reference terminal such as the above-described leader terminal is selected from the user terminals in the group based on the unique information. You may make it do. For example, the operation relevance determination unit refers to the user information storage unit to select the user with the highest post in the group, and sets the terminal used by the selected user as the reference terminal. Then, the contents of the operation items of the reference terminal and other user terminals in the group are collated by the operation content collating unit, and if there is at least one matching operation item, it is determined as a user terminal having a degree of association. The In addition, a user terminal using a specific application may be selected as a reference terminal.

[Another embodiment]
(1) In the above-described embodiment, the operation level G of the monitoring screen 70 is highlighted to increase the monitoring level. However, other than this, a voice warning or the like may be performed. Further, an administrator terminal may be provided and a warning notification may be sent to the administrator terminal.
(2) An operation screen recording unit may be provided in the terminal monitoring server, and the operation screen of the user terminal with a high monitoring level or the monitoring screen 70 displaying the operation screen may be recorded.
(3) The terminal management unit may transmit a warning message to the user terminal whose monitoring level is increased, or an operation restriction command such as a forced logoff command to restrict the operation. Examples of this operation restriction include prohibition of network connection, prohibition of copying and moving files, prohibition of access to folders and files, prohibition of use of external storage media, and the like.
(4) Moreover, although 1st Embodiment and 2nd Embodiment were comprised separately, the form which combines this and makes both selectable may be sufficient.

Overall configuration of terminal monitoring system Functional block diagram of a terminal monitoring system in the first embodiment Diagram showing the data structure of operation log information Illustration of application operation criteria The flowchart which shows the flow of the terminal monitoring process in 1st Embodiment. Monitoring screen displayed on the monitor connected to the terminal monitoring server Functional block diagram of a terminal monitoring system in the second embodiment (A) Contents of operation items defined in operation log information in one group, and (b) Explanatory diagram of evaluation values and thresholds given to each operation item The flowchart which shows the flow of the terminal monitoring process in 2nd Embodiment.

Explanation of symbols

21 terminal management unit 21a operation log information acquisition unit 21b terminal capture image acquisition unit (operation screen acquisition unit)
22 Operation log information classification part (operation content information classification part)
23 Operation log information storage unit (operation content information storage unit)
24 Operation Criteria Generation Unit 25 Operation Criteria Table 26 Operation Relevance Determining Unit 26a Terminal Identification Unit 26b Operation Content Collation Unit 27 Monitoring Level Collation Unit 30 Evaluation Value / Threshold Table

Claims (3)

In a terminal monitoring apparatus that acquires user operation log information in the user terminal from a plurality of user terminals to be monitored,
And operation log information classifying unit for classifying the operation log information for each group to which the user terminal belongs,
For each user terminal belonging to each group classified by the operation log information classification unit, the contents of the operation items defined in the operation log information of the user terminal are included in the operation log information of other user terminals belonging to the group. When it is determined that the total value of evaluation values given each time it matches the contents of the specified operation item is less than the threshold value, the operation relevance level that identifies the user terminal as a user terminal that is performing a suspicious operation A determination unit;
The operation-related determining unit terminal monitoring device and a monitoring level adjusting unit to higher than normal monitoring level of the user terminal that is identified as being performed a suspicious operation by. Of Misao drawing surface acquired from the plurality of user terminals, the suspicious operation is an operation screen of the user terminal that is identified as being carried out, in the display form corresponding to the monitoring level, the operation of the other user terminals The terminal monitoring device according to claim 1, wherein the terminal monitoring device is displayed on the monitoring screen more easily than the screen. In a terminal monitoring program for causing a computer to function as a terminal monitoring apparatus that acquires user operation log information in the user terminal from a plurality of user terminals to be monitored,
The computer,
And operation log information classifying unit for classifying the operation log information for each group to which the user terminal belongs,
For each user terminal belonging to each group classified by the operation log information classification unit, the contents of the operation items defined in the operation log information of the user terminal are included in the operation log information of other user terminals belonging to the group. When it is determined that the total value of evaluation values given each time it matches the contents of the specified operation item is less than the threshold value, the operation relevance level that identifies the user terminal as a user terminal that is performing a suspicious operation A determination unit ;
The terminal monitoring program for functioning as a monitoring level adjustment part which raises the monitoring level of the user terminal specified as suspicious operation being performed by the said operation relevance determination part from the usual .

Images