JP4397404B2 - Terminal management apparatus and terminal management program - Google Patents

Description

  The present invention relates to a terminal management technique for acquiring an operation log and an operation image associated with the operation log from a client terminal and displaying the operation image on a monitor screen.

  As a technique for acquiring an operation log and an operation image associated with the operation log from a client terminal and displaying the operation image on a monitor screen, for example, a remote control system disclosed in Patent Document 1 is known. This remote control system is configured by connecting a remote control server and a client terminal via a communication network. The client terminal includes operation command specifying information for specifying each operation command input to the terminal and a display unit. The captured images obtained by acquiring the displayed screens at predetermined intervals are transmitted to the remote control server, and the remote control server sequentially displays the received captured images on the display unit up to a predetermined number.

  By sequentially displaying up to a predetermined number of captured images thus received on the display unit of the remote control server, the operator of the remote control server can view the screens of a plurality of client terminals at a time. In addition, if the operation commands and screens entered at the client terminal are recorded, the recorded screen can be played back at a later date, so that the operation status of the operator of the client terminal can be easily grasped by this playback. It is possible to monitor unauthorized operations by the operator of the client terminal.

JP 2006-108947 A (paragraphs [0005], [0020], [0051], [0057])

  Since the above-described remote control system can display a plurality of client terminal screens connected via a network on the display unit of the remote control server, the operator of the remote control server can operate the plurality of client terminal operators. It is convenient to monitor the operation status of

  However, although it is convenient to monitor a plurality of client terminals at a time, when the screen of a specific client terminal is recorded and played back to monitor the operation status of the operator, all the played back screens are completely viewed. There is a problem that it takes a long time.

  Furthermore, when monitoring the operation status of the operator of the client terminal, monitoring is often performed by paying attention to the window displayed on the screen, but it is displayed by opening / closing the window or active / inactive operation. The window changes from moment to moment. Accordingly, when the focused window is once closed and then opened to perform an operation, a problem that a series of operations in the window becomes difficult to understand simply by fast-forwarding the playback screen may occur.

  The present invention has been made paying attention to such problems, and an object of the present invention is to provide a terminal management technique capable of easily and quickly grasping the operation status in the window of the client terminal.

  In a terminal management apparatus that acquires an operation log and an operation image associated with the operation log from a client terminal, in order to solve the above problem, in the present invention, window display information describing a display state of a window in the operation image In the operation log, and for each of the client terminals, an operation image classifying unit that classifies the operation image according to the category of the window of interest based on the window display information, and a display area for each category on the monitor screen. And a display control unit that continuously reproduces and displays the operation images of the category in the display area.

  According to the above configuration, the operation images acquired from one client terminal are classified according to the category of the window of interest based on the window display information included in the operation log, and the classified operation images are provided on the monitor screen. Each category is continuously reproduced and displayed in each category display area. Thereby, a series of operations of the window of interest can be viewed in the corresponding display area, and the operation status can be easily grasped. In other words, when an operation image is continuously reproduced and displayed for a certain client terminal as in the conventional case, the operation on the window of interest is reproduced and displayed discontinuously by temporarily closing or minimizing the window of interest. However, according to the present invention, the operations on the windows of interest in the display areas of the categories can be linked together and reproduced systematically, so that the operation status can be easily grasped. In addition, a display area is provided for each category on the monitor screen, and the classified operation images are continuously reproduced and displayed in the corresponding display area, so that all the operation images are continuously reproduced and displayed in one display area. In comparison, you can see all this in a short time.

  Note that various windows such as an active window that is an operation target of the operator of the client terminal and a window that displays the entire area can be adopted as the window of interest. In addition, various forms such as a file name and an application can be adopted for the category of the window to be noted which should be called a display unit when continuously reproducing and displaying on the monitor screen.

  The operation image used in the terminal management apparatus according to the present invention may be the entire operation image displayed on the monitor screen of the client terminal, or a window generated by extracting a window area from the entire operation image. It may be an image. In particular, in order to monitor the operation status in the window, it is sufficient that the window image is displayed in the display area on the monitor screen, and the operation status is also easy to see because the window image is displayed in the entire display area. Become. The window image may be generated on the client terminal side and transmitted to the terminal management device, or may be generated on the terminal management device side. In view of this, in a preferred embodiment of the terminal management apparatus according to the present invention, the terminal management apparatus includes a window area extraction unit that extracts a window area from the operation image, and the extracted window area is continuously reproduced and displayed in the display area. Is done.

In one preferred embodiment of the terminal management apparatus of the present invention, the terminal management device includes an unauthorized operation determination unit that determines an unauthorized operation based on the operation log, and the display control unit performs an unauthorized operation by the unauthorized operation determination unit. When determined, the display form of the display area may be changed.

With this configuration, when an unauthorized operation is determined based on the operation log, the captured image when the unauthorized operation is performed can be identified because the operation log and the captured image are associated with each other. Since the display form of the display area is changed when the operation image related to the unauthorized operation is reproduced, the operation state in which the unauthorized operation is performed can be accurately monitored.

In such a terminal management device, in order to avoid overlooking the occurrence of an unauthorized operation, it is preferable to let the administrator perceive the unauthorized operation before the operation is performed. Therefore, in one preferred embodiment of the terminal management apparatus of the present invention, the change in the display form of the display area by the display control unit reproduces the operation image related to the operation log determined to be an unauthorized operation. It is performed a predetermined time before.

  Furthermore, a program implemented in the above-described terminal monitoring apparatus is also included in the scope of rights of the present invention. That is, a terminal management program for a terminal management apparatus that acquires an operation log and an operation image associated with the operation log from a client terminal is a window that describes a display state of a window in the operation image included in the operation log. Based on display information, for each of the client terminals, a function for classifying the operation image according to the category of the window of interest, and a display area for each category on the monitor screen are provided, and the operation image of the category is displayed in the display area. A function of continuously reproducing and displaying is realized on a computer.

  Of course, this terminal management program also has the same operational effects as the terminal management apparatus according to the present invention, and can be provided with the various additional features described above.

Embodiments of a terminal management apparatus according to the present invention will be described below with reference to the drawings.
As shown in FIG. 1, a plurality of client terminals 1 and a terminal monitoring server 2 (an example of a terminal management apparatus) that monitors the client terminals 1 are connected via a network 3 to construct a terminal monitoring system. . The computer of the client terminal 1a includes a GUI unit 11 for controlling output to the monitor 51 and input from the operation input device 61 such as a keyboard and a mouse, as functions related to the present invention, in software and / or hardware. A data processing unit 12 that performs data processing by a user including various file processing such as file creation, an operation management unit 13 that manages various operations in the client terminal 1a, a network interface 14 as a transmission / reception unit that performs data transmission to the network 3, and the like. Has been built. The same applies to the other client terminals 1.

  Among these, the operation management unit 13 has functions such as login / logoff processing, and also generates an operation log that describes operation contents according to a predetermined operation performed on the client terminal 1a. Unit 13a, and an operation screen capture unit 13b that captures an operation screen in the client terminal 1a and generates a capture image as an operation image.

  An example of the data structure of the operation log and the captured image generated in the operation log generation unit 13a or the operation screen capture unit 13b and transmitted to the terminal monitoring server 2 is schematically illustrated in FIG. As shown in FIG. 2A, this operation log is based on a terminal ID that identifies the client terminal 1, and a user ID (or login name) that identifies the login user of the terminal, and date / time data that generated the operation log. The execution contents of the operation by the user are linked. Furthermore, as the window display information describing the display state of the window on the operation screen, the name of the running application, the file name of the window being executed, the arrangement data on the screen of the window, and the use state thereof are linked. . In FIG. 2A, two types of applications are activated, and two windows of one application are being executed. The window arrangement data includes the arrangement order as well as the window arrangement position and display size on the operation screen. With respect to the arrangement order, “0” is assigned when the window is not overlapped with another window (see FIG. 3B described later), and when the window is overlapped with another window (FIG. 3 (a)) is assigned “1”, “2”,... In order from the highest arrangement position. That is, the entire area of the window whose allocation order assignment data is “0” or “1” is displayed on the screen. In addition, the usage state includes information indicating whether the window is active or inactive.

  Further, as shown in FIG. 2B, the captured image is linked to the date / time data with the terminal ID as a base point. The generated operation log and the captured image of the operation screen are associated with each other based on the date / time data. Thereby, the display state of the window in the captured image can be grasped from the window display information of the operation log. When the capture image generation interval is shorter than the operation log, that is, when the number of capture image generations is larger, for example, the captured image acquired between the operation log s1 and the subsequent operation log s2 is You may estimate and associate with the display state of the window described in the window display information of operation log s1.

  On the other hand, the computer of the terminal monitoring server 2 includes a client terminal 1 via a terminal management unit 21 that manages the client terminal 1 and a network interface 32 as a function related to the present invention in software and / or hardware. The operation log acquisition unit 22 that acquires the operation log from the window, the window display information extraction unit 23 that extracts the window display information from the acquired operation log, the operation log storage unit 24 that stores the acquired operation log, and the client via the network interface 32 Captured image acquisition unit 25 that acquires a captured image from the terminal 1, a captured image management unit 26 that performs various management of the acquired captured image, a captured image storage unit 27 that stores the acquired captured image, and a continuous reproduction display of the acquired captured image To do Such as tea image reproduction unit 28 is constructed.

  The captured image management unit 26 receives the captured image acquired by the captured image acquisition unit 25 based on the window display information corresponding to the captured image extracted by the window display information extraction unit 23 for each client terminal. The captured image classification unit 26a for classifying the acquired captured images by category, and the captured image processing unit 26b for performing predetermined image processing on the acquired captured images are included.

  The “target window” and “category”, which are the criteria for capturing image classification performed by the captured image classification unit 26 a, are designated by the classification criterion designating unit 29. The designation information of the classification standard designation unit 29 can be input / changed by the operation input device 62 via the GUI unit 31. In the present embodiment, an active window is specified as the target window, and a file name is specified as the category. Therefore, for example, the captured images acquired from the client terminal 1a are classified for each category of the same file name according to the file name of the active window of the captured image.

  This classification will be described with reference to FIG. In FIG. 3, a thick frame window in the captured image represents an active window. In particular, when a plurality of windows are displayed on the screen, the display forms include overlapping display patterns as shown in FIG. 3A and parallel display patterns as shown in FIG. A mixed pattern is conceivable. As described above, in this embodiment, the captured images are classified by the file name as the active window as the window of interest. Therefore, the captured images Ga1 to Ga2, Ga4 (Gb1 Gb2, Gb4) are classified into category: file name A, and captured images Ga3, Ga5 (Gb3, Gb5) whose title B window is an active window are classified into category: file name B. Here, in order to make the explanation easy to understand, the case where two windows are displayed is shown as an example, but of course, even when more windows are displayed or when only one window is displayed, the same classification can be made. The mixed patterns can be similarly classified. A captured image in which no window is displayed may be classified into category: no window.

  The captured images classified in this way are stored in time series in a predetermined area of the captured image storage unit 27 by category. Then, when a display command is issued from the monitor, the captured image management unit 26 reads the display command, and the captured image reproduction unit 28 displays the display command on the monitoring monitor 52 via the GUI unit 31. At this time, a display area for each category, that is, for each file name is provided on the screen of the monitoring monitor 52, and captured images of the category are continuously reproduced and displayed in time series in each display area. Therefore, taking the captured image of FIG. 3A as an example, the display area of the file name A is in the order of the captured images Ga1, Ga2, Ga4,. Continuous reproduction display is performed in the order of Ga5,.

  FIG. 4 shows an example of this terminal monitoring screen. On the terminal monitoring screen 100, an operation image reproduction button 101 for reproducing a captured image, a log browsing button 102, a PC information button 103, a remote control button 104, an alert setting button 105, and the like are arranged in the form of icons at the upper position. A capture image display unit 110, a display setting unit 111, a terminal list display unit 112, a playback time setting unit 113, and a playback control unit 114 are formed at the lower part of the terminal monitoring screen 100. The capture image display unit 110 displays a plurality of capture image display areas surrounded by a frame 120 in a matrix form, and an attribute display unit 121 indicating the attributes of the display area is arranged below the frame 120. ing. Further, a playback slider 114a and a plurality of playback control buttons 114b are arranged at the lower part of the captured image display unit 110. The playback slider 114a and a plurality of playback control buttons 114b are selected by selecting the target frame 120 and operating these buttons and sliders. The playback speed of the captured image of the frame 120 can be controlled.

  As described above, in the present embodiment, the captured images acquired from one terminal are displayed in a list on the captured image display unit 110 according to the file name of the active window. That is, the captured images classified by the file names are continuously reproduced and displayed in time series in each frame 120. At this time, the file name of the active window displayed in the frame is displayed below each frame 120. Yes. Further, by double-clicking the frame 120, only the frame 120 can be enlarged and displayed. Furthermore, if necessary, operation log information such as window display information linked to the captured image displayed in the frame 120 can be displayed in another operation log display window.

  The client terminal to be displayed on the captured image display unit 110 can be specified by clicking and specifying a desired client terminal on the terminal list display unit 112. In addition, how the captured image is displayed on the captured image display unit 110, in other words, how the captured images are classified and displayed on the captured image display unit 110, is determined by the reproduced image of the display setting unit 111. It can be set by operating the setting button 111c.

  FIG. 5 shows a reproduction image setting screen 200 displayed by operating the reproduction image setting button 111c. The reproduction image setting screen 200 is provided with an attention window designation unit 210, a category designation unit 220, and a window image extraction / display selection unit 230. The noted window designation unit 210 and the category designation unit 220 are columns for designating a window and a category to be noticed. As described above, in this embodiment, an active window is designated as a noticed window, and a file name is designated as a category. Yes. The window image extraction / display selection unit 230 is a column for selecting to display the window area extracted from the capture image on the frame 120 of the terminal monitoring screen 100. In this embodiment, “No” is selected. Therefore, the entire area of the captured image is displayed in the frame 120. By performing each setting described above, it is possible to set the classification and display mode of the captured image.

  In addition to the playback image setting button 111c, the display setting unit 111 is provided with an all-terminal display button 111a and a terminal-specific display button 111b. When the all-terminal display button 111a is operated, a captured image display is displayed. Each frame 120 of the unit 110 displays a list of captured images of each client terminal. When the terminal-specific display button 111b is operated, a list of captured images for each category of a specific client terminal is displayed as described above. .

  In addition, continuous playback display of captured images in the captured image display unit 110 can be performed by the playback time setting unit 113. That is, the playback start date and time is input from the operation input device 62 in the playback start date and time input unit 113a, and the playback end date and time is input to the playback end date and time input unit 113b as necessary, and then the OK button 113c is clicked. As a result, the captured image of the client terminal 1 specified in the terminal list display unit 112 is read from the captured image storage unit 27 by the captured image management unit 26, and is continuously reproduced and displayed in time series on each frame 120. The reproduction start / end date and time here is substantially the date and time when the capture image was generated in the client terminal (date and time data in FIG. 2B).

  As shown in FIG. 2, the operation log includes operation contents. In this embodiment, it is possible to determine whether or not an unauthorized operation is performed based on the operation contents. Examples of unauthorized operations include non-business operations such as game operations and access operations to an access-prohibited homepage, operations that lead to information leakage such as browsing confidential files, and the like. This unauthorized operation determination can be performed, for example, by referring to an operation content and an unauthorized operation table (not shown) provided separately. In addition to this, the total operation time in the window may be used, or the total operation time may be determined together with the illegal operation table. For example, the total operation time of the allowable range is set according to the operation content, and when the operation is performed exceeding the allowable range, it is determined as an unauthorized operation. Since the operation log and the captured image are associated with each other, it is possible to specify the captured image when an unauthorized operation is performed. At this time, the display form of the display area (frame 120) on the screen of the monitoring monitor 52 is changed before a predetermined time before the unauthorized operation is reproduced so that the operation state where the unauthorized operation is performed can be accurately monitored. Configure. There are various possible changes in the display form, and an example thereof is to enlarge the corresponding frame 120 as shown in FIG. That is, when a predetermined time before the illegal operation is reproduced, for example, 10 seconds before, the frame 120 (the frame of the file name E in FIG. 6) in which the captured image when the illegal operation is performed is enlarged and displayed. When the reproduction scene of the captured image when the unauthorized operation is performed passes, the display is restored to the original size.

  Next, the flow of terminal monitoring processing by this terminal monitoring server will be described with reference to FIG. First, the terminal monitoring server 2 acquires an operation log from the client terminal 1 using the operation log acquisition unit 22 and a capture image associated with the operation log using the capture image acquisition unit 25 (# 01). From the acquired operation log, the window display information extraction unit 23 extracts the window display information describing the display state of the window in the operation image (capture image) (# 02).

  Then, the acquired captured images are classified for each client terminal based on the window display information. As described above, in this embodiment, the active window is specified as the window of interest, and the file name is specified as the category. Therefore, the captured images are classified by category, that is, for each file name, according to the file name of the active window. (# 03). If there is no window in the captured image, it is classified as no window.

  The captured images classified in the categories such as file name A, file name B,..., No window in this way are stored in the captured image storage unit 27 by the captured image management unit 26 (# 04). It should be noted that such capture image classification and storage processing may be performed when the captured image is acquired or may be performed when the captured image is reproduced.

  Then, when there is a request for reproducing and displaying the captured image via the terminal monitoring screen 100 (# 05 Yes branch), the captured image managing unit 26 reads the captured image to be displayed from the captured image storing unit 27, and the captured image reproducing unit 28. Is displayed on the terminal monitoring screen of the monitoring monitor 52. As described above, the frame 120 of the terminal monitoring screen 100 is provided for each file name, and the read captured image is continuously reproduced and displayed in time series in the frame 120 of the file name to which the captured image belongs (# 06).

  In this reproduction display, whether or not an unauthorized operation is performed is determined by the unauthorized operation determination unit 30, and if it is determined that there is an unauthorized operation (Yes branch at # 07), the unauthorized operation is reproduced. The display form is changed a predetermined time before, for example, the frame 120 on which the captured image is reproduced and displayed when an unauthorized operation is performed is enlarged and displayed (# 08). Then, when the playback scene of the captured image when this unauthorized operation is performed (# 09 Yes branch) or when no risk operation is detected in any frame 120 (# 07 No branch), the same size The list display by the frame 120 is continued (# 10).

  As described above, in the present embodiment, when the monitor monitors a specific client terminal, a series of operations of the window of interest can be monitored in the corresponding display area, and the operation status can be easily grasped. Can do. In other words, when an operation image is continuously reproduced and displayed for a certain client terminal as in the conventional case, the operation on the window of interest is reproduced and displayed discontinuously by temporarily closing or minimizing the window of interest. In the display area of each category, the operations on the window of interest can be linked together and reproduced systematically, so that the operation status can be easily grasped. In addition, a display area is provided for each category on the monitor screen, and the classified operation images are continuously reproduced and displayed in the corresponding display area, so that all the operation images are continuously reproduced and displayed in one display area. In comparison, you can see all this in a short time. In particular, by setting the active window that is the operation target of the operator of the client terminal as the window of interest, it is possible to sufficiently monitor the operation status, and by using the category as the file name, the same file can be monitored. Since a series of operations are continuously reproduced and displayed, it is easy to monitor. Furthermore, since the display form of the display area of the category where the unauthorized operation is reproduced on the monitor screen is changed a predetermined time before the unauthorized operation is performed, the monitor can know in advance that the unauthorized operation will be performed. Thus, it is possible to avoid a situation where an illegal operation in the corresponding display area is missed.

[Another embodiment]
(1) In the above-described embodiment, the entire area of the captured image is displayed on each frame 120 of the terminal monitoring screen 100. However, the window area is extracted from the captured image and displayed on each frame 120. You may comprise. At this time, it is preferable to extract only the window area of interest from the window area. This is set by selecting “Yes” in the window image extraction / display selection unit 230 of the reproduction image setting screen 200 described above, and the window region extraction process of interest is performed by the capture image processing unit 26b of the capture image management unit 26. Is done.

  Taking this as an example in the case of FIG. 3A, a window area A is cut out from each of the captured images Ga1 to Ga2 and Ga4, and a window area B is cut out from each of the captured images Ga3 and Ga5 as shown in FIG. The window image is classified and stored in each category. The same applies to Gb1 to Gb5 in FIG. The window images thus classified are continuously reproduced and displayed in time series in each frame 120 of the terminal monitoring screen 100.

  The window area extraction process may be performed not only on the terminal monitoring server side but also on the client terminal side. That is, an image of the entire operation screen of the client terminal is not transmitted as the operation image, but an image in the window area in the client terminal is transmitted as the operation image.

(2) In the embodiment described above, the window of interest is the active window, but other windows may be specified. For example, you may specify a window image that displays the entire area as the window to be noted, or specify the window that is located in the foreground when multiple windows are displayed in duplicate or a window with a large area You may make it do. In this way, it is preferable to designate a window with display conditions that are likely to be viewed by the operator of the client terminal.

  Further, a window hidden behind the window or a window having a small area may be designated as the window of interest. Such a window may be a window that is used outside of work, and it may be easy to find an illegal operation by paying attention to such a window.

  Note that when a window in which the entire area is displayed is designated as the window of interest, in the overlapping display pattern as shown in FIG. 3A, the same as the case where the above-described active window is classified as the window of interest. Can be classified. On the other hand, in the case of a parallel display pattern in which a plurality of windows are displayed in parallel as shown in FIG. 3B, a captured image is duplicated as necessary as shown in FIG. Can be properly classified. Note that such capture image replication can be performed by the capture image processing unit 26b.

(3) In the embodiment described above, the category is the file name, but of course, the present invention is not limited to this, and other applications such as application A, application B,. May be set. Further, the folder name to which each file belongs may be set as a category.

  Further, a part of the category may be a specific application, and the other may be a file name. For example, in the case of a browser, the title may change every moment, so that it may be an application, and in the case of document software, it may be a file name.

(4) In the above-described embodiment, the configuration is such that the monitor 120 is alerted by enlarging and displaying the frame 120 a predetermined time before the unauthorized operation is reproduced. Coloring or blinking display may be performed. Moreover, not only visual alerting but also alerting by voice may be performed. Furthermore, the reason for determining that it is illegal may be displayed in a form such as a pop-up when reproducing the illegal operation.

(5) In the above-described embodiment, all display areas (frames 120) are displayed in the same size in normal display in which an unauthorized operation is not detected. For example, display is performed according to the playback time in each display area. The size of the area may be changed, and a display area having a longer reproduction time may be displayed larger. Further, the position of the display area to be reproduced may be changed according to the reproduction time, for example, a plurality of display areas are displayed in a matrix on the monitor screen, and from the display area at the upper left position to the display area at the lower right position, You may make it arrange | position in order from the thing with long reproduction time. Further, the playback time may be displayed in each display area.

  Instead of the reproduction time in each display area, the total operation time for the window of interest may be used. The total operation time can be easily obtained from the operation log. For example, the operation log s1 describes that the file A is opened at the time t1, and the operation log s2 describes that the file A is closed at the time t2. If it is, the operation time is calculated as t2-t1, and the total operation time can be obtained by accumulating the operation time for such file A. Note that as the total operation time, a cumulative value of the duration time of the active state of the window of interest may be used. Then, using the obtained total operation time, it is possible to change the size of the display area, change the reproduction display position, display the total operation time, and the like as described above.

  A display area for all categories may be provided on the monitor screen. However, a display area selection unit may be provided to select and display some of these, or to select one not to be displayed. good. In particular, if the display area selection unit automatically selects the display area that is determined to be reproduced by the unauthorized operation determination unit and displays the display area, the unauthorized operation can be efficiently monitored. This is preferable.

(6) In the embodiment described above, acquisition of operation logs and operation images from the client terminal may be acquired in the form of real-time processing, or may be acquired in the form of batch processing. Moreover, it is not limited to the case where it acquires via a network, The form which acquires via a recording medium etc. may be sufficient. Further, the client terminal may be provided with a captured image classification / reproduction display function provided in the terminal monitoring server. Thus, the present invention can be applied to a stand-alone type terminal.

(7) In the above-described embodiment, the terminal management apparatus is used in the form of a terminal monitoring server. However, the terminal management apparatus according to the present invention is not only for monitoring purposes but also for other purposes such as browsing and confirmation of a window of interest. Can also be used.

Functional block diagram of the terminal monitoring system in this embodiment The figure which shows the data structure of an operation log and a capture image Diagram explaining the classification of captured images Terminal monitoring screen displayed on the monitoring monitor connected to the terminal monitoring server Playback image setting screen developed from the terminal monitoring screen of FIG. FIG. 4 is a terminal monitoring screen diagram transformed from the terminal monitoring screen of FIG. Flow chart showing the flow of terminal monitoring processing The figure explaining extraction of the window area in another embodiment The figure explaining the classification | category of the captured image in another embodiment

Explanation of symbols

1 Client terminal 2 Terminal monitoring server (terminal management device)
3 Network 21 Terminal management unit 22 Operation log acquisition unit 23 Window display information extraction unit 24 Operation log storage unit 25 Capture image acquisition unit 26 Capture image management unit 26a Capture image classification unit (operation image classification unit)
26b Capture image processing unit (window image extraction unit)
27 Captured image storage unit 28 Captured image playback unit (display control unit)
29 Classification standard designating unit 30 Risk operation determining unit 31 GUI unit

Claims (5)

In a terminal management device that acquires an operation log and an operation image associated with the operation log from a client terminal,
The operation log includes window display information describing a display state of the window in the operation image,
An operation image classifying unit that classifies the operation image for each category of a window of interest based on the window display information for each client terminal;
A terminal management apparatus comprising: a display area for each category on a monitor screen; and a display control unit that continuously reproduces and displays operation images of the category in the display area.   The terminal management apparatus according to claim 1, further comprising a window area extraction unit that extracts a window area from the operation image, wherein the extracted window area is continuously reproduced and displayed in the display area. An unauthorized operation determination unit that determines an unauthorized operation based on the operation log;
The terminal management apparatus according to claim 1, wherein the display control unit changes a display form of the display area when an unauthorized operation is determined by the unauthorized operation determination unit. The terminal management apparatus according to claim 3, wherein the display form display area is changed by the display control unit a predetermined time before the operation image related to the operation log determined to be an unauthorized operation is reproduced. In a terminal management program for a terminal management device that acquires an operation log and an operation image associated with the operation log from a client terminal,
A function of classifying the operation image by category of the window of interest for each client terminal based on window display information describing a display state of the window in the operation image included in the operation log;
A terminal management program for providing a display area for each category on a monitor screen and causing a computer to realize a function of continuously reproducing and displaying operation images of the category in the display area.

Images