JP7235966B2 - File classification device, file classification program and file classification method - Google Patents

Description

The present invention relates to a file sorting device, a file sorting program, and a file sorting method.

In recent years, for example, a file existence confirmation tool has been used as a countermeasure against leakage of information stored in a PC (Personal Computer). For example, when a file that may cause information leakage is stored in the PC, this file existence confirmation tool notifies the user to delete or move the file.

In general, a user's PC contains not only data files created by the user, but also a large number of OS (Operating System) and application files. For this reason, the above-mentioned file existence confirmation tool, for example, uses the file name and file path (hereinafter also referred to as the file name etc.) of the file to be checked (hereinafter also referred to as the target file) and the pre-created pattern ( It is determined whether or not each target file contains confidential information by matching with a whitelist or blacklist. Then, the file existence confirmation tool notifies the user of information about the files determined to possibly contain confidential information. This enables the user to determine, for example, whether or not each PC is ready to be taken outside the company.

Specifically, the file existence confirmation tool identifies, for example, Microsoft Office (registered trademark) document files, mail files, program source codes, etc., as files that are highly likely to contain confidential information. In addition, the file existence confirmation tool identifies, for example, program execution files, temporary files, shortcut files, setting files, etc., as files that are unlikely to contain confidential information (see Patent Documents 1 and 2, for example).

Japanese Patent Application Laid-Open No. 2008-140102 JP 2011-129023 A

Here, for example, when a pattern described by a regular expression with a high degree of freedom of description is used, the file existence confirmation tool takes a long time to match the file name of the target file with the pattern.

Therefore, in the file existence confirmation tool, for example, by performing forward matching and backward matching using a pattern not described by a regular expression, the file name of the target file and the pattern are matched. As a result, the file existence confirmation tool can quickly classify files that are highly likely to contain confidential information and files that are unlikely to contain confidential information (hereafter simply referred to as file classification). become.

However, patterns not described by regular expressions are patterns with a low degree of freedom in description. Therefore, when using patterns that are not described by regular expressions, the number of patterns required to classify files becomes enormous. Therefore, in this case, it takes an enormous amount of time to prepare the patterns, which may make it difficult to efficiently classify the files.

Accordingly, in one aspect, an object of the present invention is to provide a file sorting device, a file sorting program, and a file sorting method that enable efficient file sorting.

In one aspect of the embodiment, a first determination unit that refers to a first storage unit that stores a character string and determines whether each file name of a plurality of files includes the character string; When it is determined that each of the file names of the files does not contain the character string, referring to a second storage unit storing the regular expression to determine whether each of the file names of the plurality of files conforms to the regular expression. and a common identification unit that identifies a common portion of character strings in the file names of the plurality of files when each of the file names of the plurality of files conforms to the regular expression. and an information management unit that further stores a character string corresponding to the identified common portion in the first storage unit when the common portion matches the regular expression.

According to one aspect, it is possible to efficiently classify files.

FIG. 1 is a diagram illustrating the configuration of an information processing system 10. As shown in FIG. FIG. 2 is a diagram for explaining the hardware configuration of the information processing device 1. As shown in FIG. FIG. 3 is a functional block diagram of the information processing apparatus 1. As shown in FIG. FIG. 4 is a flowchart for explaining an outline of file classification processing according to the first embodiment. FIG. 5 is a flowchart for explaining an outline of file classification processing according to the first embodiment. FIG. 6 is a flowchart for explaining details of file classification processing in the first embodiment. FIG. 7 is a flowchart for explaining details of file classification processing according to the first embodiment. FIG. 8 is a flowchart for explaining details of file classification processing according to the first embodiment. FIG. 9 is a diagram explaining a specific example of the prefix match information 133. As shown in FIG. FIG. 10 is a diagram explaining a specific example of the regular expression information 132. As shown in FIG. FIG. 11 is a diagram illustrating a specific example of the temporary storage information 135. As shown in FIG. FIG. 12 is a diagram for explaining file classification processing according to the first embodiment. FIG. 13 is a diagram explaining a specific example of the prefix match information 133. As shown in FIG. FIG. 14 is a diagram explaining a specific example of the prefix match information 133. As shown in FIG. FIG. 15 is a diagram illustrating a specific example of the temporary storage information 135. As shown in FIG. FIG. 16 is a diagram illustrating a specific example of the temporary storage information 135. As shown in FIG. FIG. 17 is a flowchart for explaining file classification processing according to the second embodiment. FIG. 18 is a flowchart for explaining file classification processing according to the second embodiment. FIG. 19 is a flowchart for explaining file classification processing according to the second embodiment. FIG. 20 is a flowchart for explaining file classification processing in the second embodiment. FIG. 21 is a flowchart for explaining file classification processing in the second embodiment. FIG. 22 is a diagram illustrating a specific example of the backward matching information 134. As shown in FIG.

[Configuration of information processing system]
First, the configuration of the information processing system 10 will be described. FIG. 1 is a diagram illustrating the configuration of an information processing system 10. As shown in FIG.

As shown in FIG. 1, an information processing system 10 includes, for example, an information processing device 1, which is a PC on which a user performs various tasks, and a management device 2 connected to the information processing device 1 via a network NW (for example, the Internet). and a storage device 3 accessed by the management device 2 .

The information processing device 1 accesses the management device 2 to determine whether or not the target file contains confidential information (hereinafter also referred to as file classification processing). A pattern (hereinafter also referred to as a first character string) is obtained and stored in a storage area (hereinafter also referred to as a first storage unit). The first character string is, for example, a character string described by regular expressions.

Then, the information processing apparatus 1 refers to a storage area (hereinafter also referred to as a second storage unit) that stores a character string (hereinafter also referred to as a second character string) that does not use regular expressions, and stores a plurality of target files. contains the second string. The second character string is, for example, a character string that does not use regular expressions.

As a result, when it is determined that each of the plurality of files does not contain the second character string, the information processing apparatus 1 refers to the first storage unit and determines that each of the plurality of target files corresponds to the first character string. Determine whether the expression matches.

Then, when it is determined that each of the plurality of files does not match the regular expression, the information processing apparatus 1 determines that each of the plurality of files is likely to contain confidential information, and notifies that fact. Notify users.

On the other hand, when it is determined that each of the plurality of files matches the regular expression, the information processing apparatus 1 identifies the common part of the character strings in the file names of the plurality of target files. Then, when the information processing apparatus 1 determines that the specified common part matches the regular expression corresponding to the first character string, the information processing apparatus 1 sets the character string corresponding to the specified common part as at least one of the second character strings to the second character string. It is further stored in the storage unit.

That is, the information processing apparatus 1 according to the present embodiment determines whether or not each of the plurality of target files is likely to contain confidential information, and newly identifies the plurality of files from the file names and the like. store the second character string. Here, the second character string is a common part such as file names of a plurality of target files determined to have a low possibility of containing confidential information. Therefore, when a new target file whose file name or the like includes the second character string is generated, the information processing apparatus 1 determines that the newly generated target file is unlikely to contain confidential information. Is possible. Therefore, before determining whether each of the plurality of target files matches the regular expression corresponding to the first character string, the information processing apparatus 1 allows each of the plurality of target files to match the second character string. It is determined whether or not it is included.

As a result, the information processing apparatus 1 can suppress the number of matching times between the file name of the target file and the first character string described by the regular expression. Therefore, the information processing apparatus 1 can reduce the time required to classify the target file without using patterns not described by regular expressions. Therefore, the information processing apparatus 1 can efficiently classify the target files while suppressing the burden required for pattern creation.

[Hardware configuration of information processing system]
Next, the hardware configuration of the information processing system 10 will be described. FIG. 2 is a diagram for explaining the hardware configuration of the information processing device 1. As shown in FIG.

The information processing apparatus 1 has a CPU 101 as a processor, a memory 102, an external interface (I/O unit) 103, and a storage medium 104, as shown in FIG. Each unit is connected to each other via a bus 105 .

The storage medium 104 has, for example, a program storage area (not shown) that stores a program 110 for file classification processing. The storage medium 104 also has a storage unit 130 (hereinafter also referred to as an information storage area 130) that stores information used when performing file classification processing, for example. Note that the storage medium 104 may be, for example, an HDD (Hard Disk Drive) or an SSD (Solid State Drive). Note that each of the first storage unit, the second storage unit, and the third storage unit described above may correspond to at least part of the storage unit 130, for example.

The CPU 101 executes the program 110 loaded from the storage medium 104 to the memory 102 to perform file classification processing.

Also, the external interface 103 communicates with the management apparatus 2 via the network NW, for example.

[Functions of information processing system]
Next, functions of the information processing system 10 will be described. FIG. 3 is a functional block diagram of the information processing apparatus 1. As shown in FIG.

As shown in FIG. 3, the information processing apparatus 1 has an information reception unit 111, an information management unit 112, a file Various functions including a name extraction unit 113, a first determination unit 114, a second determination unit 115, a common identification unit 116, a third determination unit 117, and an information output unit 118 are realized.

For example, as shown in FIG. 3, the information processing apparatus 1 stores file information 131, regular expression information 132, prefix matching information 133, trailing match information 134, and temporary storage information 135 in the information storage area 130. memorize to Note that the above first character string may correspond to the regular expression information 132, for example. Also, the above second character string may correspond to the prefix match information 133 or the suffix match information 134, for example.

The information receiving unit 111 receives regular expression information 132 transmitted from the management device 2, for example. Then, the information management unit 112 stores the regular expression information 132 received by the information receiving unit 111 in the information storage area 130, for example. Note that the regular expression information 132 may be stored in advance in the information storage area 130 by a user or the like.

The file name extractor 113 acquires the file information 131 from, for example, an OS (not shown) running on the information processing apparatus 1 . The file information 131 may include, for example, read information and write information for files. Then, the file name extraction unit 113 extracts the file name of each file from the file information 131 acquired from the OS.

The first determination unit 114 refers to the prefix match information 133 stored in the information storage area 130 and determines whether each of the file names extracted by the file name extraction unit 113 includes the character string included in the prefix match information 133. judge. The prefix match information 133 is information including a character string for determining whether or not there is a prefix match relationship with each of the file names extracted by the file name extraction unit 113 .

When the second determination unit 115 determines that each of the file names extracted by the file name extraction unit 113 does not include the character string included in the prefix matching information 133, the second determination unit 115 converts the regular expression information 132 stored in the information storage area 130 into It is determined whether or not each of the file names extracted by the file name extraction unit 113 matches the regular expression included in the regular expression information 132 .

If each of the file names extracted by the file name extraction unit 113 matches the regular expression included in the regular expression information 132, the common identification unit 116 identifies the common part of the character strings in the file names extracted by the file name extraction unit 113. Identify.

The third determination unit 117 determines whether the common portion identified by the common identification unit 116 matches the regular expression included in the regular expression information 132 .

Then, when the common part specified by the common specifying part 116 is included in the regular expression information 132 , the information managing part 112 adds a character string corresponding to the common part specified by the common specifying part 116 to at least part of the prefix matching information 133 . is stored in the information storage area 130 as .

When the second determination unit 115 determines that each of the file names extracted by the file name extraction unit 113 does not match the regular expression included in the regular expression information 132, the information output unit 118 outputs the file name extracted by the file name extraction unit 113. The user is notified that the file corresponding to the file name is highly likely to contain confidential information. Specifically, in this case, the information output unit 118 outputs information indicating that there is a high possibility that the file corresponding to the file name extracted by the file name extraction unit 113 contains confidential information. (not shown). A description of the backward match information 134 will be given later.

[Outline of the first embodiment]
Next, an outline of the first embodiment will be described. 4 and 5 are flowcharts for explaining an outline of file classification processing according to the first embodiment.

As shown in FIG. 4, the information processing apparatus 1 waits until the file classification timing (NO in S1). The file classification timing may be, for example, the timing at which the user inputs information to the information processing apparatus 1 to perform the file classification process.

Then, when it is time to classify files (YES in S1), the information processing apparatus 1 refers to the second storage unit storing the second character string, and the file names of the plurality of files each have the second character string. (S2).

As a result, when it is determined that each of the file names of the plurality of files does not contain the second character string (NO in S3), the information processing device 1 refers to the first storage unit storing the first character string. , file names of a plurality of files, and the like match the regular expression corresponding to the first character string (S4).

Then, when it is determined that each of the file names of the plurality of files matches the regular expression corresponding to the first character string (YES in S5), the information processing apparatus 1 performs the processing of the plurality of files as shown in FIG. A common portion of character strings in file names and the like is specified (S11).

Subsequently, the information processing apparatus 1 determines whether or not the common part specified in the process of S11 matches the regular expression corresponding to the first character string (S12).

As a result, if it is determined that the common part specified in the process of S11 matches the regular expression corresponding to the first character string (YES in S13), the information processing device 1 determines that the common part specified in the process of S12 The character string is further stored in the second storage unit as a second character string (S14).

On the other hand, if it is determined that each of the file names of the plurality of files includes the second character string (YES in S3), or if each of the file names of the plurality of files is a regular expression corresponding to the first character string, If it is determined that it does not match (NO in S5), the information processing device 1 ends the file classification process. Likewise, when it is determined that the common portion specified in the process of S11 does not match the regular expression corresponding to the first character string (NO in S13), the information processing device 1 terminates the file classification process.

As a result, the information processing apparatus 1 can suppress the number of matching times between the file name of the target file and the first character string described by the regular expression. Therefore, the information processing apparatus 1 can reduce the time required to classify the target file without using patterns not described by regular expressions. Therefore, the information processing apparatus 1 can efficiently classify the target files while suppressing the burden required for pattern creation.

[Details of the first embodiment]
Next, details of the first embodiment will be described. 6 to 8 are flowcharts for explaining the details of file classification processing according to the first embodiment. 9 to 16 are diagrams for explaining the details of the file classification process in the first embodiment. A case where each of the regular expression information 132, the prefix matching information 133, and the trailing match information 134 is a whitelist will be described below.

As shown in FIG. 6, the information reception unit 111 waits until it receives the file information 131 (NO in S21). Specifically, the information receiving unit 111 waits until it receives the file information 131 transmitted from the OS, for example.

When the file information 131 is received (YES in S21), the file name extractor 113 extracts the file name and the like of the target file from the file information 131 received in the process of S21 (S22).

Subsequently, the first determination unit 114 determines that the character string corresponding to the file name extracted in the process of S22 matches the character string included in the prefix match information 133 stored in the information storage area 130. (S23). A specific example of the prefix match information 133 will be described below.

[Specific example of prefix matching information]
9, 13 and 14 are diagrams for explaining specific examples of the prefix match information 133. FIG.

The prefix matching information 133 shown in FIG. 9 and the like consists of a "character string" that stores a character string used for determining prefix matching, and a "time stamp" that stores the epoch seconds when each piece of information was generated (updated). as items.

Specifically, in the prefix match information 133 shown in FIG. 9, the information on the first line stores "c:\user\appdata\test\" as the "character string" and "1551128928" as the "time stamp". is stored.

In the prefix match information 133 shown in FIG. 9, the information on the second line stores "c:\tmp\" as the "character string" and "1551129475" as the "time stamp".

Therefore, for example, if the character string corresponding to the file name extracted in S22 is "c:\documents\test\.git\objects\a1\34567", the first determination unit 114 It is determined that the character string corresponding to the file name or the like extracted in the process and each character string whose information is included in the prefix match information 133 do not have a prefix matching relationship.

Returning to FIG. 6, when it is determined that the character string corresponding to the file name or the like extracted in the process of S22 does not have a prefix match relationship with the character string included in the prefix match information 133 stored in the information storage area 130 ( NO in S24), the second determination unit 115 determines whether the character string corresponding to the file name extracted in the process of S22 matches the regular expression included in the regular expression information 132 stored in the information storage area 130. (S25). A specific example of the regular expression information 132 will be described below.

[Specific example of regular expression information]
FIG. 10 is a diagram explaining a specific example of the regular expression information 132. As shown in FIG.

The regular expression information 132 shown in FIG. 10 has items of “ID” for identifying each piece of information included in the regular expression information 132 and “character string” in which a character string described by the regular expression is stored.

Specifically, in the regular expression information 132 shown in FIG. 10, "REGEXP1" is stored as "ID" in the information on the first line. In the regular expression information 132 shown in FIG. 10, the information on the first line contains "(. *[/¥¥])+¥..+” is stored. Description of other information included in FIG. 10 is omitted.

Therefore, for example, when the character string corresponding to the file name extracted in the process of S22 is "c:\documents\test\.git\objects\a1\34567", the second determination unit 115 It is determined that the character string corresponding to the file name extracted in the process of S22 matches the regular expression stored in the "character string" of the eye information.

Returning to FIG. 6, if it is determined that the character string corresponding to the file name extracted in the process of S22 matches the regular expression included in the regular expression information 132 stored in the information storage area 130 (YES in S26), As shown in FIG. 7, the common identification unit 116 determines whether the character strings in the file name extracted in the process of S22 and the character strings included in the temporary storage information 135 stored in the information storage area 130 are prefix-matched. It is determined whether or not there is a relationship to do (S31). A specific example of the temporary storage information 135 will be described below.

[Specific example of temporary storage information]
11 and 15 are diagrams illustrating specific examples of the temporary storage information 135. FIG.

Temporarily stored information 135 shown in FIG. 11 and the like identifies regular expression information 132 that matches each piece of information included in temporarily stored information 135 (for example, any information included in regular expression information 132 described with reference to FIG. 10). "ID", "character string" storing character strings such as file names extracted in the process of S22, and "timestamp" storing the epoch seconds when each piece of information was generated (updated) as items. have.

Specifically, in the temporary storage information 135 shown in FIG. 11, the information on the first line stores “REGEXP1” as “ID” and “c:\documents\test\.git\objects” as “character string”. ¥00¥12345” is stored, and “1551128871” is stored as the “time stamp”.

In the temporary storage information 135 shown in FIG. 11, the information on the second line stores "REGEXP2" as "ID" and "c:\user\appdata\test\abcdef.pdf" as "character string". is stored, and "1551128928" is stored as the "timestamp". Description of other information included in FIG. 11 is omitted.

Therefore, for example, when the character string corresponding to the file name extracted in the process of S22 is "c:\documents\test\.git\objects\a1\34567", the common identification unit 116 performs the process of S22. It is determined that the character string corresponding to the file name, etc., extracted in step 1 and the character string stored in the "character string" of the information on the first line have a forward matching relationship.

Returning to FIG. 7, when it is determined that the character strings in the file name extracted in the process of S22 and the character strings included in the temporary storage information 135 stored in the information storage area 130 have a forward matching relationship. (YES in S32), the common identification unit 116 identifies character strings in the file names and the like extracted in the process of S22 that are determined to have a prefix matching relationship in the process of S31 (S33).

Specifically, in the information on the first line in the temporary storage information 135 described with reference to FIG. 11, "c:\documents\test\.git\objects\00\12345" is stored as the "character string". Therefore, for example, when the character string corresponding to the file name extracted in the process of S22 is "c:\documents\test\.git\objects\a1\34567", the common identification unit 116 performs the , the common part of these character strings is identified as "c:\documents\test\.git\objects\".

Then, the third determination unit 117 stores information corresponding to the ID corresponding to the character string included in the temporarily stored information 135 determined in the process of S31 that the character string specified in the process of S33 has a prefix matching relationship. It is determined whether or not the regular expression contained in the regular expression information 132 stored in the area 130 is matched (S34).

Specifically, for example, when the character string specified in the process of S33 is "c:\documents\test\.git\objects\", the third determination unit 117 determines that the character string specified in the process of S33 is A diagram corresponding to the ID "REGEXP1" corresponding to the character string "c:\documents\test\.git\objects\00\12345" included in the temporary storage information 135 determined to have a prefix matching relationship in the process of S31 10 is matched with the regular expression "(.*[/¥¥])+¥..+" stored in the "character string" of the information on the first line in the regular expression information 132 described in 10 above.

As a result, when it is determined that the character string specified in the process of S33 matches the regular expression included in the regular expression information 132 stored in the information storage area 130 (YES in S35), the information management unit 112 performs the The character string specified in the process is stored in the information storage area 130 as at least part of the prefix matching information 133 (S36).

Specifically, for example, when the character string determined to match the regular expression in the process of S35 is "c:\documents\test\.git\objects\", the information management unit 112 performs the following operations as shown in FIG. , “c:¥documents¥test¥.git¥objects¥” is stored in the information storage area 130 as the prefix matching information 133 . Then, the information management unit 112, for example, as shown in the underlined portion of FIG. is added to the information storage area 130 as the prefix matching information 133 .

Subsequently, as shown in FIG. 8, the information output unit 118 generates, for example, information indicating that the file corresponding to the file name extracted in the process of S22 does not contain confidential information (S42).

After that, the information output unit 118 outputs the information generated in the process of S42 (S44). Specifically, the information output unit 118 outputs the information generated in the process of S42 to an output device (not shown) of the information processing apparatus 1, for example.

Similarly, when it is determined that the character string corresponding to the file name or the like extracted in the process of S22 has a prefix matching relationship with the character string included in the prefix match information 133 stored in the information storage area 130 ( YES in S24), the information output unit 118 performs the processing from S42 onwards.

In this case, the information management unit 112, as shown in the underlined part in FIG. The time stamp of the character string determined to have a prefix matching relationship with the character string corresponding to may be updated to the current date and time.

On the other hand, if it is determined that the character string in the file name extracted in the processing of S22 and the character string included in the temporary storage information 135 stored in the information storage area 130 do not have a forward matching relationship (S32 NO), as shown in FIG. 8, the information management unit 112 stores the character string in the file name or the like extracted in the process of S22 in the information storage area 130 as the temporary storage information 135 (S41).

Specifically, for example, when the character string determined to match the regular expression in the process of S35 is "c:\documents\abcd\.git\objects\20\34567", the information management unit 112, for example, As shown in the underlined part of 15, information (fourth line information) storing "c:\documents\abcd\.git\objects\20\34567" is added to the "character string".

If the character string determined to match the regular expression in the process of S35 is already stored as the temporary storage information 135, the information management unit 112 stores the character string determined to match the regular expression in the process of S35. It may be one that updates only the timestamp.

Then, the information output unit 118 performs the processes after S42. Likewise, when it is determined that the character string specified in the process of S33 does not match the regular expression included in the regular expression information 132 stored in the information storage area 130 (NO in S35), the information management unit 112 etc. perform the processing after S41.

Furthermore, when it is determined that the character string corresponding to the file name extracted in the process of S22 does not match the regular expression included in the regular expression information 132 stored in the information storage area 130 (NO in S26), the information is output. As shown in FIG. 8, the unit 118 generates information indicating that the file corresponding to the file name extracted in the process of S22 is a file containing confidential information (S43). Then, the information output unit 118 outputs the information generated in the process of S43 (S44).

That is, the information processing apparatus 1 according to the present embodiment determines whether or not each of the plurality of target files is likely to contain confidential information, and newly identifies the plurality of files from the file names and the like. The forward matching information 133 that has been received is accumulated. Here, the prefix match information 133 is a common part such as the file names of a plurality of target files determined to have a low possibility of containing confidential information. Therefore, when a new target file whose file name or the like includes the prefix matching information 133 is generated, the information processing apparatus 1 determines that the newly generated target file is unlikely to contain confidential information. Is possible. Therefore, before the information processing apparatus 1 determines whether or not each of the plurality of target files matches the regular expression included in the regular expression information 132, each of the plurality of target files matches the prefix matching information 133. It is determined whether or not it is included.

As a result, the information processing apparatus 1 can suppress the number of times of matching between the file name of the target file and the regular expression information 132 described by the regular expression. Therefore, the information processing apparatus 1 can reduce the time required to classify the target file without using patterns not described by regular expressions. Therefore, the information processing apparatus 1 can efficiently classify the target files while suppressing the burden required for pattern creation.

In the process of S36, the character string already stored as the temporary storage information 135 may be replaced with the character string specified in the process of S33.

Specifically, for example, the character string already stored as the temporary storage information 135 is "c:\documents\test\.git\objects\00\12345", and it is determined in the process of S35 that it matches the regular expression. If the character string obtained is "c:\documents\test\.git\objects\", the information management unit 112 stores the character string " c:\documents\test\.git\objects\00\12345" may be updated to "c:\documents\test\.git\objects\".

This enables the information management unit 112 to reduce the storage area required for storing the temporary storage information 135 .

Further, the information management unit 112 not only stores the character string specified in the process of S33 as the prefix match information 133 in the information storage area 130 (the timing of the process of S36), but also in the process of S41. The temporary storage information 135 may be updated.

In this case, the information management unit 112, as shown in the underlined part in FIG. The same date and time as the stamp (for example, the time stamp of the information on the third line in the prefix match information 133 described with reference to FIG. 13) is stored.

As a result, the information management unit 112 can further reduce the storage area required for storing the temporary storage information 135 .

Further, the information management unit 112, for example, among the information included in each of the prefix match information 133 and the temporarily stored information 135, stores information that is stored as a time stamp before a predetermined time or more before the current date and time. It may be deleted.

[Second embodiment]
Next, a second embodiment will be described. 17 to 21 are flowcharts for explaining file classification processing in the second embodiment. FIG. 22 is a diagram for explaining file classification processing in the second embodiment.

The file classification process in the second embodiment is performed not only for the prefix match information 133 but also for reference and update of the suffix match information 134 . The backward matching information 134 is information including a character string for determining whether or not there is a backward matching relationship with each of the file names extracted by the file name extraction unit 113 . Only points that differ from the file classification process in the first embodiment will be described below.

As shown in FIG. 17, the information reception unit 111 waits until it receives the file information 131 (NO in S51).

When the file information 131 is received (YES in S51), the file name extractor 113 extracts the file name of the target file from the file information 131 received in the process of S51 (S52).

Subsequently, the first determination unit 114 determines that the character string corresponding to the file name extracted in the process of S52 matches the character string included in the prefix match information 133 stored in the information storage area 130. (S53).

As a result, if it is determined that the character string corresponding to the file name or the like extracted in the process of S52 does not have a prefix match relationship with the character string included in the prefix match information 133 stored in the information storage area 130 (S54). NO), the first determination unit 114 determines that the character string corresponding to the file name extracted in the process of S52 matches the character string included in the backward match information 134 stored in the information storage area 130. (S55). A specific example of the backward match information 134 will be described below.

[Specific example of prefix matching information]
FIG. 22 is a diagram illustrating a specific example of the backward matching information 134. As shown in FIG.

The suffix information 134 shown in FIG. 22 consists of a "character string" that stores a character string used for suffix determination, and a "time stamp" that stores the epoch seconds when each piece of information was generated (updated). have as an item.

Specifically, in the backward match information 134 shown in FIG. 22, the information on the first line stores ".exe" as the "character string" and "1551128942" as the "time stamp".

In the backward match information 134 shown in FIG. 22, the information on the second line stores ".dll" as the "character string" and "1551129621" as the "time stamp."

Therefore, for example, when the character string corresponding to the file name extracted in the process of S52 is "c:\documents\test\.git\objects\a1\98765.exe", the first determination unit 114 It is determined that the character string corresponding to the file name or the like extracted in the process of S52 and the character string stored in the "character string" of the information on the first line have a backward matching relationship.

Returning to FIG. 17, when it is determined that the character string corresponding to the file name extracted in the process of S52 does not have a backward matching relationship with the character string included in the backward matching information 134 stored in the information storage area 130 ( NO in S56), the second determination unit 115 determines that the regular expression information 132 stored in the information storage area 130 includes a character string corresponding to the file name extracted in the process of S52, as shown in FIG. It is determined whether or not it matches the regular expression (S61).

As a result, if it is determined that the character string corresponding to the file name extracted in the process of S52 matches the regular expression included in the regular expression information 132 stored in the information storage area 130 (YES in S62), common identification The unit 116 determines whether or not the character string in the file name or the like extracted in the process of S52 and each of the character strings included in the temporary storage information 135 stored in the information storage area 130 have a forward matching relationship. (S63).

If it is determined that the character strings in the file name extracted in the process of S52 and the character strings contained in the temporary storage information 135 stored in the information storage area 130 have a forward matching relationship (S64). YES), the common identification unit 116 identifies, among the character strings in the file names and the like extracted in the process of S52, the character strings determined to have a prefix matching relationship in the process of S63 (S65).

Subsequently, as shown in FIG. 19, the third determination unit 117 determines whether the character string specified in the process of S65 matches the regular expression included in the regular expression information 132 stored in the information storage area 130. is determined (S71).

As a result, when it is determined that the character string specified in the process of S65 matches the regular expression included in the regular expression information 132 stored in the information storage area 130 (YES in S72), the information management unit 112 performs the The character string specified in the process is stored in the information storage area 130 as at least part of the prefix match information 133 (S73).

On the other hand, if it is determined that the character string specified in the process of S65 does not match the regular expression included in the regular expression information 132 stored in the information storage area 130 (NO in S72), the information management unit 112 performs No processing.

Also, if it is determined that the character string in the file name extracted in the process of S52 and the character string included in the temporary storage information 135 stored in the information storage area 130 do not have a forward matching relationship (S64 NO), the common identification unit 116 does not perform the processing of S65 to S73.

Subsequently, the common identification unit 116 finds that the character string in the file name extracted in the process of S52 and the character string included in the temporary storage information 135 stored in the information storage area 130 have a backward matching relationship. It is determined whether or not (S74).

As a result, if it is determined that the character string in the file name extracted in the process of S52 and the character string included in the temporary storage information 135 stored in the information storage area 130 have a backward matching relationship (S75 YES), the common identification unit 116 identifies the character string determined to have a backward matching relationship in the process of S74, among the character strings in the file names and the like extracted in the process of S52 (S76).

Specifically, for example, the character string corresponding to the file name extracted in the process of S52 is "c:\documents\test\.git\objects\a1\98765.exe", which is included in the temporary storage information 135. If the character string is "c:\documents\test\.git\objects\a1\76543.exe", the common identification unit 116 adds the character string corresponding to the file name extracted in the process of S52 and the temporary It is determined that the character string included in the stored information 135 has a backward matching relationship. In this case, the common specifying unit 116 specifies “.exe”, which is a common part between the character string corresponding to the file name extracted in the process of S52 and the character string included in the temporary storage information 135 .

Furthermore, as shown in FIG. 20, the third determination unit 117 determines whether or not the character string specified in the process of S76 matches the regular expression contained in the regular expression information 132 stored in the information storage area 130. Determine (S81).

As a result, when it is determined that the character string specified in the process of S73 matches the regular expression included in the regular expression information 132 stored in the information storage area 130 (YES in S82), the information management unit 112 performs the The character string specified in the process is stored in the information storage area 130 as at least part of the backward matching information 134 (S83).

On the other hand, when it is determined that the character string specified in the process of S73 does not match the regular expression included in the regular expression information 132 stored in the information storage area 130 (NO in S82), the information management unit 112 performs the No processing.

Also, if it is determined that the character string in the file name extracted in the process of S52 and the character string included in the temporary storage information 135 stored in the information storage area 130 do not have a backward matching relationship (S75 NO), the common identification unit 116 does not perform the processing of S76 to S83.

After that, the information management unit 112 determines whether or not the character string was stored as the prefix matching information 133 or the trailing match information 134 in the process of S65 or S76 (S84).

Then, if it is determined in the process of S65 or S76 that the character string is not stored (YES in S85), the information output unit 118 stores, for example, the file name extracted in the process of S52 as shown in FIG. Information indicating that the corresponding file does not contain confidential information is generated (S92).

After that, the information output unit 118 outputs the information generated in the process of S92 (S94). Specifically, the information output unit 118 outputs the information generated in the process of S92 to an output device (not shown) of the information processing apparatus 1, for example.

If it is determined that the character string corresponding to the file name or the like extracted in the process of S52 has a prefix matching relationship with the character string included in the prefix match information 133 stored in the information storage area 130 (YES in S54). ), or if it is determined that the character string corresponding to the file name or the like extracted in the process of S52 has a backward matching relationship with the character string included in the backward matching information 134 stored in the information storage area 130. Then (YES in S56), the information output unit 118 performs the processes after S92.

On the other hand, if it is determined in the process of S65 or S76 that the character string is stored (YES in S85), the information management unit 112 stores the character string in the file name, etc., extracted in the process of S52, as shown in FIG. is stored in the information storage area 130 as the temporary storage information 135 (S91). Then, the information output unit 118 performs the processes after S42.

Furthermore, if it is determined that the character string corresponding to the file name or the like extracted in the process of S52 does not match the regular expression included in the regular expression information 132 stored in the information storage area 130 (NO in S62), the information is output. As shown in FIG. 21, the unit 118 generates information indicating that the file corresponding to the file name extracted in the process of S52 is a file containing confidential information (S93). Then, the information output unit 118 performs the process of S94.

As a result, the information processing apparatus 1 can further suppress the number of times of matching between the file name of the target file and the regular expression information 132 described by the regular expression. Therefore, the information processing apparatus 1 can more efficiently classify the target files.

Note that the information management unit 112 may, for example, delete at any time, from among the information included in the backward match information 134, information whose date and time stored as a time stamp is earlier than the current date and time by a predetermined time or more. good.

The above embodiments are summarized as follows.

(Appendix 1)
a first determination unit that refers to a first storage unit that stores a character string and determines whether each file name of a plurality of files includes the character string;
When it is determined that each of the file names of the plurality of files does not contain the character string, a second storage unit storing a regular expression is referred to, and each of the file names of the plurality of files matches the regular expression. A second determination unit that determines whether or not
a common identification unit that identifies a common portion of character strings in the file names of the plurality of files when each of the file names of the plurality of files matches the regular expression;
an information management unit that further stores a character string corresponding to the identified common portion in the first storage unit when the identified common portion matches the regular expression;
A file classification device characterized by:

(Appendix 2)
In Appendix 1,
The character string stored in the first storage unit is a character string that does not use regular expressions,
A file classification device characterized by:

(Appendix 3)
In Appendix 1,
The first determination unit refers to the first storage unit and determines whether a first file included in the plurality of files includes the character string,
The second determination unit, when determining that the first file does not contain the character string, refers to the second storage unit and determines whether the file name of the first file matches the regular expression. judge,
The information management unit stores the file name of the first file in a third storage unit when the file name of the first file matches the regular expression, and
The first determination unit refers to the first storage unit after the information management unit stores the file name of the first file, and determines whether a second file included in the plurality of files includes the character string. determine whether or not
In the process of determining whether or not the regular expression conforms to the regular expression, the second determination unit refers to the second storage unit when determining that the second file does not contain the character string. determining whether the filename of the file matches the regular expression;
When the file name of the second file matches the regular expression, the common identification unit refers to the third storage unit and selects one of the file names stored in the third storage unit and the second file. identify the common part of the string in the file name,
A file classification device characterized by:

(Appendix 4)
In Appendix 3,
The information management unit stores the file name of the second file in the third storage unit when the file name of the second file matches the regular expression.
A file classification device characterized by:

(Appendix 5)
In Appendix 3,
The common identifying unit identifies, as the common part, a character string that matches the beginning of any of the file names stored in the third storage unit and the file name of the second file,
A file classification device characterized by:

(Appendix 6)
In Appendix 3,
The common identification unit identifies, as the common part, a character string that matches the end of any of the file names stored in the third storage unit and the file name of the second file,
A file classification device characterized by:

(Appendix 7)
In Supplementary Note 3, further,
when it is determined that the file name of the first file includes the character string, outputting information indicating that the first file matches the regular expression, and outputting information indicating that the file name of the second file includes the character string an information output unit that outputs information indicating that the second file matches the regular expression when it is determined that
A file classification device characterized by:

(Appendix 8)
In Appendix 7,
The information output unit outputs information indicating that the first file does not match the regular expression when the file name of the first file does not match the regular expression, and the file name of the second file outputs information indicating that the file name of the second file does not match the regular expression. If the regular expression does not match, output information indicating that the second file does not match the regular expression;
A file classification device characterized by:

(Appendix 9)
referring to the first storage unit storing the character string, determining whether each of the file names of the plurality of files includes the character string;
When it is determined that each of the file names of the plurality of files does not contain the character string, a second storage unit storing a regular expression is referred to, and each of the file names of the plurality of files matches the regular expression. determine whether or not
If each of the file names of the plurality of files matches the regular expression, identify a common portion of strings in the file names of the plurality of files;
If the identified common portion matches the regular expression, further storing a character string corresponding to the identified common portion in the first storage unit;
A file classification program characterized by causing a computer to execute processing.

(Appendix 10)
In Appendix 9,
In the process of determining whether or not the character string is included, referring to the first storage unit, determining whether or not a first file included in the plurality of files includes the character string,
In the process of determining whether or not the regular expression matches the regular expression, when it is determined that the first file does not contain the character string, the second storage unit is referred to, and the file name of the first file is the regular expression. Determine whether or not the expression matches, and
storing the file name of the first file in a third storage if the file name of the first file matches the regular expression;
let the computer do the work,
In the process of determining whether or not the character string is included, after the process of storing the file name of the first file in the third storage unit, the first storage unit is referred to, and the file name included in the plurality of files is stored. determining whether the second file contains the character string;
In the process of determining whether or not the second file matches the regular expression, when it is determined that the second file does not contain the character string, the second storage unit is referred to, and the file name of the second file is the regular expression. Determine whether the expression matches,
In the specifying process, if the file name of the second file matches the regular expression, the third storage unit is referred to, and one of the file names stored in the third storage unit and the second file identify the common part of the string in the file name,
A file classification program characterized by:

(Appendix 11)
referring to the first storage unit storing the character string, determining whether each of the file names of the plurality of files includes the character string;
When it is determined that each of the file names of the plurality of files does not contain the character string, a second storage unit storing a regular expression is referred to, and each of the file names of the plurality of files matches the regular expression. determine whether or not
If each of the file names of the plurality of files matches the regular expression, identify a common portion of strings in the file names of the plurality of files;
If the identified common portion matches the regular expression, further storing a character string corresponding to the identified common portion in the first storage unit;
A file classification method characterized in that processing is executed by a computer.

(Appendix 12)
In Appendix 11,
In the process of determining whether or not the character string is included, referring to the first storage unit, determining whether or not a first file included in the plurality of files includes the character string,
In the process of determining whether or not the regular expression matches the regular expression, when it is determined that the first file does not contain the character string, the second storage unit is referred to, and the file name of the first file is the regular expression. Determine whether or not the expression matches, and
storing the file name of the first file in a third storage if the file name of the first file matches the regular expression;
let the computer do the work,
In the process of determining whether or not the character string is included, after the process of storing the file name of the first file in the third storage unit, the first storage unit is referred to, and the file name included in the plurality of files is stored. determining whether the second file contains the character string;
In the process of determining whether or not the second file matches the regular expression, when it is determined that the second file does not contain the character string, the second storage unit is referred to, and the file name of the second file is the regular expression. Determine whether the expression matches,
In the specifying process, if the file name of the second file matches the regular expression, the third storage unit is referred to, and one of the file names stored in the third storage unit and the second file identify the common part of the string in the file name,
A file classification method characterized by:

1: information processing device 2: management device 3: storage device 10: information processing system NW: network

Claims (10)

a first determination unit that refers to a first storage unit that stores a character string and determines whether each file name of a plurality of files includes the character string;
When it is determined that each of the file names of the plurality of files does not contain the character string, a second storage unit storing a regular expression is referred to, and each of the file names of the plurality of files matches the regular expression. A second determination unit that determines whether or not
a common identification unit that identifies a common portion of character strings in the file names of the plurality of files when each of the file names of the plurality of files matches the regular expression;
an information management unit that further stores a character string corresponding to the identified common portion in the first storage unit when the identified common portion matches the regular expression;
A file classification device characterized by: In claim 1,
The character string stored in the first storage unit is a character string that does not use regular expressions,
A file classification device characterized by: In claim 1,
The first determination unit refers to the first storage unit and determines whether a first file included in the plurality of files includes the character string,
The second determination unit, when determining that the first file does not contain the character string, refers to the second storage unit and determines whether the file name of the first file matches the regular expression. judge,
The information management unit stores the file name of the first file in a third storage unit when the file name of the first file matches the regular expression, and
The first determination unit refers to the first storage unit after the information management unit stores the file name of the first file, and determines whether a second file included in the plurality of files includes the character string. determine whether or not
In the process of determining whether or not the regular expression conforms to the regular expression, the second determination unit refers to the second storage unit when determining that the second file does not contain the character string. determining whether the filename of the file matches the regular expression;
When the file name of the second file matches the regular expression, the common identification unit refers to the third storage unit and selects one of the file names stored in the third storage unit and the second file. identify the common part of the string in the file name,
A file classification device characterized by: In claim 3,
The information management unit stores the file name of the second file in the third storage unit when the file name of the second file matches the regular expression.
A file classification device characterized by: In claim 3,
The common identifying unit identifies, as the common part, a character string that matches the beginning of any of the file names stored in the third storage unit and the file name of the second file,
A file classification device characterized by: In claim 3,
The common identification unit identifies, as the common part, a character string that matches the end of any of the file names stored in the third storage unit and the file name of the second file,
A file classification device characterized by: In claim 3, further,
when it is determined that the file name of the first file includes the character string, outputting information indicating that the first file matches the regular expression, and outputting information indicating that the file name of the second file includes the character string an information output unit that outputs information indicating that the second file matches the regular expression when it is determined that
A file classification device characterized by: In claim 7,
The information output unit outputs information indicating that the first file does not match the regular expression when the file name of the first file does not match the regular expression, and the file name of the second file outputs information indicating that the file name of the second file does not match the regular expression. If the regular expression does not match, output information indicating that the second file does not match the regular expression;
A file classification device characterized by: referring to the first storage unit storing the character string, determining whether each of the file names of the plurality of files includes the character string;
When it is determined that each of the file names of the plurality of files does not contain the character string, a second storage unit storing a regular expression is referred to, and each of the file names of the plurality of files matches the regular expression. determine whether or not
If each of the file names of the plurality of files matches the regular expression, identify a common portion of strings in the file names of the plurality of files;
If the identified common portion matches the regular expression, further storing a character string corresponding to the identified common portion in the first storage unit;
A file classification program characterized by causing a computer to execute processing. referring to the first storage unit storing the character string, determining whether each of the file names of the plurality of files includes the character string;
When it is determined that each of the file names of the plurality of files does not contain the character string, a second storage unit storing a regular expression is referred to, and each of the file names of the plurality of files matches the regular expression. determine whether or not
If each of the file names of the plurality of files matches the regular expression, identify a common portion of strings in the file names of the plurality of files;
If the identified common portion matches the regular expression, further storing a character string corresponding to the identified common portion in the first storage unit;
A file classification method characterized in that processing is executed by a computer.

Images