JP7782767B2 - Information processing device, information processing method, and program - Google Patents

Description

This disclosure relates to an information processing device, an information processing method, and a program.

In user systems with multiple terminals, users often commit fraud. To address fraud, systems are used to detect fraud and analyze the risk of fraud. Conventional technology effectively utilizes user logs managed in various locations, using various logs to calculate a risk score for each user via a security management server, and then uses the calculated risk score to detect users engaging in fraudulent activities (see Patent Document 1). For example, conventional technology tallies the average number of operations for each of several types of operations during a target period, and calculates each user's risk score based on the average number of operations, etc.

Japanese Patent Application Laid-Open No. 2019-204389

However, work-related operations typically vary widely, and conventional techniques, such as relying on the frequency of operations, make it difficult to distinguish whether a user is performing legitimate work or committing fraud, posing the risk of false positives.

This disclosure has been made to solve the above-mentioned problems and aims to appropriately evaluate whether a user using a terminal is engaging in fraudulent activity.

According to a first aspect of the present invention, an information processing device includes: a detection unit that detects disruptive behavior, which is behavior related to disruption of security set in a device, by a user who uses a device of an organization;
an evaluation unit that evaluates the user based on the detection of the disruptive behavior,
the disruptive behavior includes behavior of investigating the security set in the device and behavior of circumventing the security set in the device;
The evaluation unit performs different evaluations depending on whether the behavior to be investigated is detected or whether the behavior to be avoided is detected .
According to a second aspect of the present invention, there is provided an information processing method for an information processing device, comprising: a step of detecting, by a detection unit , a disruptive behavior by a user who uses an organization's device, the disruptive behavior being a behavior related to disruption of security set in the device;
and evaluating the user by an evaluation unit based on the detection of the disruptive behavior;
the disruptive behavior includes behavior of investigating the security set in the device and behavior of circumventing the security set in the device;
The step of making the evaluation makes different evaluations depending on whether the behavior to investigate is detected or whether the behavior to avoid is detected .
According to a third aspect of the present invention, a program includes a process for causing a computer to perform the following: detecting a disruptive behavior by a user who uses an organization's equipment, the disruptive behavior being a behavior related to disrupting security set in the equipment ;
and performing a process of evaluating the user based on the detection of the disruptive behavior,
the disruptive behavior includes behavior of investigating the security set in the device and behavior of circumventing the security set in the device;
The evaluation is made differently depending on whether the behavior to investigate is detected or whether the behavior to avoid is detected .

This disclosure detects disruptive behavior against the organization's security by users of terminals that use the organization's equipment, making it possible to appropriately detect whether a user is engaging in fraudulent activity.

FIG. 1 is a diagram showing an example of a system configuration according to an embodiment. FIG. 1 is a diagram showing an entire system according to a first embodiment. FIG. 1 is a diagram showing an example of a system configuration in a first embodiment. FIG. 4 is a diagram showing an example of a user input log in the first embodiment. FIG. 4 is a diagram showing an example of a user management database in the first embodiment. FIG. 2 is a diagram showing the functional configuration of a server in the first embodiment. FIG. 4 is a sequence diagram showing an example of the flow of processing executed by each device in the first embodiment. FIG. 10 is a diagram showing an example of a system configuration in a second embodiment. FIG. 11 is a sequence diagram showing an example of the flow of processing executed by each device in the second embodiment. 10 shows an example of a screen displayed on a display unit in the second embodiment. 10 shows an example of a screen displayed on a display unit in the second embodiment. FIG. 11 is a diagram showing the functional configuration of a server in the third embodiment. FIG. 13 is a diagram showing an example of a user management database in the third embodiment. FIG. 11 is a sequence diagram showing an example of the flow of processing executed by each device in the third embodiment. FIG. 13 is a diagram showing the functional configuration of a terminal in a fourth embodiment. 13 is a flowchart showing an example of the flow of processing executed by a terminal in the fourth embodiment. FIG. 13 is a diagram showing an example of a system configuration in a fifth embodiment. FIG. 13 is a sequence diagram showing an example of the flow of processing executed by each device in the fifth embodiment.

In order to explain the present disclosure in more detail, embodiments for carrying out the present disclosure will be described below with reference to the accompanying drawings.
<System Configuration>
FIG. 1 is a diagram showing an example of the system configuration of a communication system 1 according to this embodiment.
In the communication system 1, for example and not by way of limitation, a server 10 and a plurality of terminals 20 (terminal 20A, terminal 20B, terminal 20C, . . . ) are connected via a network 30.

The server 10 is connected to a terminal 20 used by a user via a network 30 .
In Figure 1, the number of servers 10 connected to the network 30 is shown as one, and the number of terminals 20 is shown as three, but this number is not limited, and multiple servers 10 may be provided, and the number of terminals 20 may be one or multiple.

The network 30 serves to connect one or more terminals 20 and one or more servers 10. In other words, the network 30 refers to a communication network that provides a connection path so that the various devices mentioned above can connect and send and receive data.

One or more portions of network 30 may or may not be a wired or wireless network. Network 30 may include, by way of example and not limitation, an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), a portion of the Internet, a portion of the Public Switched Telephone Network (PSTN), a cellular network, integrated service digital networks (ISDN), wireless LAN, long term evolution (LTE), code division multiple access (CDMA), Bluetooth, satellite communications, or the like, or a combination of two or more thereof. Network 30 may include one or more networks 30.

The server 10 may be any device capable of implementing the functions described in each embodiment. Examples of the server 10 include, but are not limited to, a server device, a computer (for example, but not limited to, a desktop, laptop, tablet, etc.), a handheld computing device (for example, but not limited to, a PDA (personal digital assistant)), or other types of computers or communication platforms. The server 10 may also be referred to as an information processing device or information management device.

The terminal 20 may be any device capable of implementing the functions described in each embodiment. Examples of the terminal 20 include, but are not limited to, a computer (such as, but not limited to, a desktop, laptop, tablet, etc.), a handheld computing device (such as, but not limited to, a PDA (personal digital assistant)), or other types of computers. The terminal 20 may also be referred to as an information processing device or information management device.

[Hardware (HW) configuration of each device]
The HW configuration of each device included in the communication system 1 will be described.

(1) HW Configuration of Server FIG. 1 shows an example of the HW configuration of the server 10. As shown in FIG.
The server 10 includes a control unit 11 (CPU: central processing unit), a memory unit 15, a communication I/F 14 (interface), an input/output unit 12, a display 13, and a clock unit 16. The components of the HW of the server 10 are connected to each other via a bus, for example and not as a limitation. It is not essential that the HW of the server 10 include all of the components. For example and not as a limitation, the HW of the server 10 may or may not be configured such that the display 13 and the clock unit 16 are detachable. The display 13 and other components may be installed outside the server, and information output via the communication I/F 14 (interface) may be received and displayed on the display 13 installed outside the server.

The control unit 11 has physically structured circuitry to perform the functions realized by the code or instructions contained in the program, and is realized, for example but not limited to, by a data processing device embedded in hardware.

The control unit 11 is typically a central processing unit (CPU), but may also be a microprocessor, processor core, multiprocessor, ASIC (application-specific integrated circuit), or FPGA (field programmable gate array). Each process may or may not be implemented by a dedicated circuit or logic circuit (hardware) formed in an integrated circuit (IC (Integrated Circuit) chip, LSI (Large Scale Integration)), etc. These circuits may be implemented by one or more integrated circuits, and multiple processes shown in each embodiment may or may not be implemented by a single integrated circuit. LSIs are also sometimes referred to as VLSIs, super LSIs, ultra LSIs, etc., depending on the level of integration. Therefore, the control unit 11 may or may not be referred to as a control circuit. In this disclosure, the control unit 11 is not limited to these.

The storage unit 15 has the function of storing various programs and data required for the operation of the server 10. The storage unit 15 is realized by various storage media such as a hard disk drive (HDD), a solid state drive (SSD), or flash memory. However, in this disclosure, the storage unit 15 is not limited to these. Furthermore, the storage unit 15 may or may not be referred to as memory.

The server 10 stores a program P in the memory unit 15, and by executing this program P, the control unit 11 executes the processing of each unit included in the control unit 11. In other words, the program P stored in the memory unit 15 causes the server 10 to realize each function executed by the control unit 11. This program P may or may not be expressed as a program module.

The communication I/F 14 sends and receives various data via the network 30. The communication may be performed either wired or wirelessly, and any communication protocol may be used as long as mutual communication is possible. The communication I/F 14 has the function of communicating with various devices such as the terminal 20 via the network 30. The communication I/F 14 transmits various data to various devices such as the terminal 20 in accordance with instructions from the control unit 11. The communication I/F 14 also receives various data transmitted from various devices such as the terminal 20 and transmits it to the control unit 11. The communication I/F 14 may also be simply referred to as a communication unit. If the communication I/F 14 is composed of a physically structured circuit, it may also be referred to as a communication circuit.

The input/output unit 12 includes a device for inputting various operations to the server 10 and a device for outputting the processing results processed by the server 10. The input/output unit 12 may be an integrated input unit and output unit, or may be separate input and output units.

The input unit of the input/output 12 is realized by a device that inputs various operations to the server 10. The input unit is realized by any one or combination of devices of any type that can accept input from a user and transmit information related to the input to the control unit 11. The input unit is typically realized by hardware keys such as a keyboard, or a pointing device such as a mouse. Note that the input unit may or may not include, but is not limited to, a touch panel, a camera (for inputting operations via video images), or a microphone (for inputting operations via voice). However, in this disclosure, the input/output unit 12 is not limited to these. Note that the input unit may be detachable as appropriate, or may be attached as needed. For example, in each embodiment, the components related to the input unit may be detached in their entirety or only a portion thereof may be attached as needed.

The output unit of the input/output 12 is realized by any one or combination of devices capable of outputting the results of processing performed by the control unit 11. An example of an output unit is the display 13, which is typically realized by a monitor (for example, but not limited to, a liquid crystal display or an organic electroluminescence display (OELD)). The display 13 may or may not be a head-mounted display (HMD), a projection mapping device, a hologram, or a device capable of displaying images, text information, etc. in air (which may or may not be a vacuum). The display 13 may or may not be capable of displaying data in 3D. In this disclosure, the display 13 is not limited to these devices. The output unit is not limited to the display 13, but may be a touch panel, touch display, speaker, printer, or other device that notifies the user of information or notifies the user of processing results, such as presenting information. The output unit may be detachable or attachable as needed. For example, in each embodiment, the entire configuration related to the output unit may be removed, or a part of it may be attached, as necessary.

The clock unit 16 is a built-in clock of the server 10 and outputs time information (timekeeping information). The clock unit 16 is configured to include, for example and not limitation, a hardware clock such as an RTC (Real Time Clock) or a system clock. The clock unit 16 can also be referred to as, for example and not limitation, a timekeeping unit or a time information detection unit.

(2) HW Configuration of Terminal FIG. 1 shows an example of the HW configuration of the terminal 20.
The terminal 20 includes a control unit 21 (CPU: central processing unit), a memory unit 28, a communication I/F 22 (interface), an input/output unit 23, a display unit 24, a microphone 25, a speaker 26, a camera 27, a clock unit 29A, and a position calculation information detection unit 29B. The HW components of the terminal 20 are connected to each other via a bus, for example and not by way of limitation. It is not essential that the HW configuration of the terminal 20 includes all of the components. For example and not by way of limitation, the terminal 20 may or may not be configured such that individual components, such as the microphone 25, the camera 27, or multiple components, are detachable.

The control unit 21 has physically structured circuitry to perform the functions realized by the code or instructions contained in the program, and is realized, for example but not limited to, by a data processing device embedded in hardware.

The control unit 21 may include, but is not limited to, a central processing unit (CPU), microprocessor, processor core, multiprocessor, ASIC (application-specific integrated circuit), or FPGA (field programmable gate array). Furthermore, each process may or may not be realized by a logic circuit (hardware) formed in an integrated circuit (IC (Integrated Circuit) chip, LSI (Large Scale Integration)), or a dedicated circuit. These circuits may be realized by one or more integrated circuits, and multiple processes shown in each embodiment may or may not be realized by a single integrated circuit. Furthermore, LSIs are sometimes referred to as VLSIs, super LSIs, ultra LSIs, etc., depending on the level of integration. Therefore, the control unit 21 may or may not be referred to as a control circuit.

The storage unit 28 has the function of storing various programs and data required for the operation of the terminal 20. The storage unit 28 includes, but is not limited to, various storage media such as a hard disk drive (HDD), a solid state drive (SSD), flash memory, random access memory (RAM), and read-only memory (ROM). Furthermore, the storage unit 28 may or may not be referred to as memory.

The terminal 20 stores the program P in the memory unit 28, and by executing this program P, the control unit 21 executes the processing of each unit included in the control unit 21. In other words, the program P stored in the memory unit 28 causes the terminal 20 to realize each function executed by the control unit 21. Furthermore, this program P may or may not be expressed as a program module.

The communication I/F 22 sends and receives various data via the network 30. The communication may be performed either wired or wirelessly, and any communication protocol may be used as long as mutual communication is possible. The communication I/F 22 has the function of communicating with various devices, such as the server 10, via the network 30. The communication I/F 22 transmits various data to various devices, such as the server 10, in accordance with instructions from the control unit 21. The communication I/F 22 also receives various data transmitted from various devices, such as the server 10, and transmits it to the control unit 21. The communication I/F 22 may also be simply referred to as a communication unit. If the communication I/F 22 is composed of a physically structured circuit, it may also be referred to as a communication circuit.

The input/output unit 23 includes a device for inputting various operations to the terminal 20 and a device for outputting the processing results processed by the terminal 20. The input/output unit 23 may have an integrated input unit and an output unit, or may have separate input and output units, or may not.

The input unit is realized by any one or combination of devices capable of accepting input from a user and transmitting information related to the input to the control unit 21. Examples of input units include, but are not limited to, hardware keys such as a touch panel, touch display, and keyboard, pointing devices such as a mouse, a camera (operation input via video images), and a microphone (operation input via voice). Note that a camera is, but is not limited to, an example of an imaging unit 27, and a microphone is, but is not limited to, an example of an audio input unit 26. Note that the input unit is not limited to the disclosure of this application, and individual components or multiple components may or may not be removable in each embodiment as needed. Configurations not described in this disclosure may also be added as appropriate.

The output unit is realized by any one or combination of devices of any type that can output the processing results processed by the control unit 21. Examples of output units include, but are not limited to, touch panels, touch displays, speakers (which are examples of sound output units), optical components (which are examples, but are not limited to, components such as lenses and media for 3D (three dimensions) output and hologram output), printers, etc. These output processing results, such as notifying the user of information or presenting information.

In addition, if the input/output unit 23 is a touch panel, the input/output unit 23 and the display unit 24 may be arranged opposite each other with approximately the same size and shape.

The display unit 24 is realized by any one or combination of devices capable of displaying images according to the display data written to the frame buffer. Examples of the display unit 24 include, but are not limited to, touch panels, touch displays, monitors (such as, but not limited to, liquid crystal displays and organic electroluminescence displays (ELDs)), head-mounted displays (HMDs), projection mapping, holograms, and devices capable of displaying images, text information, etc. in air (which may or may not be a vacuum). These display units 24 may or may not be capable of displaying display data in 3D.

The clock unit 29A is a built-in clock of the terminal 20 and outputs time information (timekeeping information). The clock unit 29A is configured to include, for example and not by way of limitation, a clock that uses a quartz oscillator. The clock unit 29A can also be referred to as, for example and not by way of limitation, a timekeeping unit or a time information detection unit.

The clock unit 29A may or may not have a clock that conforms to the NITZ (Network Identity and Time Zone) standard, etc.

The position calculation information detection unit 29B is a functional unit that detects (measures) information (hereinafter referred to as "position calculation information") necessary for the control unit 21 to calculate (measure) the position of its own terminal 20. The position calculation information detection unit 29B can also be expressed as a position calculation sensor unit, for example and without limitation.

The position calculation information detection unit 29B includes, by way of example and not limitation, a satellite positioning sensor (satellite positioning unit), which is a sensor or unit for calculating the position of the terminal 20 using a satellite positioning system such as GPS (Global Positioning System), and an inertial measurement sensor (inertial measurement unit (IMU)), which is a sensor or unit for calculating the position of the terminal 20 using an inertial navigation system.

The satellite positioning unit includes, by way of example and not limitation, an RF receiving circuit that converts RF (Radio Frequency) signals, including positioning satellite signals transmitted from positioning satellites and received by an antenna (not shown), into digital signals, and a baseband processing circuit that performs correlation calculation processing on the digital signals output from the RF receiving circuit to capture the positioning satellite signals, and outputs information such as satellite orbit data and time data extracted from the positioning satellite signals as information for position calculation.

The inertial measurement unit has an inertial sensor, which is a sensor that detects information necessary to calculate the position of the terminal 20 using inertial navigation calculations. Examples of inertial sensors include, but are not limited to, a three-axis acceleration sensor and a three-axis gyro sensor, and output the acceleration detected by the acceleration sensor and the angular velocity detected by the gyro sensor as information for position calculation.

For example, but not by way of limitation, the control unit 21 calculates the position of its own terminal 20 at regular intervals or specific intervals based on the position calculation information detected by the position calculation information detection unit 29B. The terminal position is referred to as the "terminal position," and the calculated terminal position is referred to as the "calculated terminal position." The control unit 21 then associates the calculated terminal position with the date and time when the calculated terminal position was calculated, and stores the calculated terminal position history data in the storage unit 28.
(3) Other

Furthermore, the program P (which may be, for example and not limited to, a software program, computer program, or program module) of each embodiment of the present disclosure may or may not be provided in a state stored on a computer-readable storage medium. The storage medium may store the program P on a "non-transitory tangible medium." Furthermore, the program P may or may not be intended to realize part of the functions of each embodiment of the present disclosure. Furthermore, the program P may or may not be a so-called differential file (differential program) that can realize the functions of each embodiment of the present disclosure in combination with a program P already recorded on a storage medium.

Storage media such as storage unit 15 and storage unit 28 may include any of the storage media described above, or a suitable combination of two or more of these. Storage media may be volatile, non-volatile, or a combination of volatile and non-volatile, as appropriate. Note that storage media are not limited to these examples and may be any device or medium capable of storing program P. Furthermore, storage media may or may not be referred to as memory.

Furthermore, the program P of the present disclosure may or may not be provided to the server 10 or the terminal 20 via any transmission medium capable of transmitting a program (such as a communications network or broadcast waves). By way of example and not limitation, the server 10 or the terminal 20 executes the program P downloaded via the Internet or the like to realize the functions of the multiple functional units shown in each embodiment. The same applies to other devices.

In addition, each embodiment of the present disclosure may be realized in the form of a data signal in which the program P is embodied by electronic transmission.
At least a part of the processing in the server 10 or the terminal 20 may or may not be realized by cloud computing configured by one or more computers.
At least a part of the processing in the terminal 20 may or may not be performed by the server 10. In this case, at least a part of the processing of each functional unit of the control unit 21 of the terminal 20 may or may not be performed by the server 10.
At least a part of the processing in the server 10 may or may not be performed by the terminal 20. In this case, at least a part of the processing of each functional unit of the control unit 11 of the server 10 may or may not be performed by the terminal 20.
Unless explicitly stated otherwise, each determination in the embodiments of the present disclosure is not essential, and a predetermined process may or may not be performed when the determination condition is met, or when the determination condition is not met. Furthermore, unless explicitly stated otherwise, the configuration of each process in the embodiments of the present disclosure is not essential, and some of the processes disclosed in the embodiments may or may not be skipped.

The programs disclosed herein may be implemented using, for example and without limitation, scripting languages such as ActionScript and JavaScript (registered trademark), compiler languages such as Objective-C and Java (registered trademark), and markup languages such as HTML5.

<Embodiment 1>
The first embodiment discloses an example in which an information processing device such as a server 10 detects an obstruction to the security of an organization, which is performed by a user who uses a terminal 20 that is a device of the organization.

2 shows an overall system diagram of the first embodiment. The overall system of the first embodiment includes the server 10, terminal 20, and display device 24 described above, and the server 10 and terminal 20 are capable of communicating with each other via a network 30.
In the first embodiment, the server 10 is a server used by an organization, and the terminal 20 is a terminal used by a user belonging to the organization. Note that the organization in this embodiment may be an individual or a group of multiple people formed for a purpose. Examples of organizations are not limited to these, and may include facilities such as accommodation facilities, government offices, companies, factories, schools, medical institutions such as hospitals, and other organizations. Therefore, the terminal 20 of the organization is a terminal used by a user belonging to the organization, and the server 10 communicates information with the terminal 20 of the organization via the network 30 to detect disruptive behavior of users against the organization's security, as described below.

Next, an example of the functions realized by the server 10 and terminal 20 according to the first embodiment will be described using FIG. 3. The server 10 includes the control unit 21, communication unit 22, input/output unit 23, and memory unit 28 described above. The memory unit 28 stores a user input log 281. The user input log 281 stores operations performed by a user using the terminal 20.

The data structure of the user input log 281 is composed of a user name, user ID, operation log, and other information, as shown in Figure 4. The user name is the name of the user using the terminal 20, and may be, by way of example and not limitation, a name entered by an administrator who manages the organization, or information entered by the user using the terminal 20 themselves.

The user ID may be information for identifying the user using the terminal 20, or information for identifying the terminal 20 that the user can use (has the right to use). The user input log 281 is expressed in alphabets and numbers as an example of a user ID, but is not limited to this. Alternatively, the user ID may be expressed in other languages such as kanji, or symbols.

Next, the operation log is an item that records operations performed on terminal 20 by the user using terminal 20. For example, the operation log of user input log 281 records that on Nth month, Nth day, the user of terminal 20 performed an operation to delete antivirus software, which is an action that interferes with the security of the organization.

Here, security refers to something set up by an organization to safely protect the organization. Security may be configured in hardware or software. Software-based security may include, but is not limited to, antivirus software to counter external attacks, a firewall set up in the organization, an intrusion detection system that detects external intrusions into the organization's system, or an intrusion prevention system that prevents external intrusions based on detection. Security may also be something that protects the organization's network using the specific security systems described above.

Security may also be set uniformly for all terminals 20 within an organization. As an example, an organization may have multiple terminals 20, each distributed to multiple users. Antivirus software, firewalls, and other software are uniformly configured for all of these terminals 20. In this way, the same security may be set for the entire organization. While the above description uses the same security level, the security level does not need to be the same for all terminals 20; different security levels may be set. For example, a higher security level may be set for users with higher job responsibilities, and a lower security level may be set for users with lower job responsibilities. This is because users with higher job responsibilities are more likely to store important information on their terminals 20, so a higher security level may be set to strictly protect the information. Conversely, the security level may be set lower for users with higher job responsibilities and higher for users with lower job responsibilities.

Furthermore, behavior that disrupts the security of an organization is behavior in which a user disrupts the above-mentioned security established by the organization using terminal 20. By way of example and not limitation, behavior that disrupts the security of an organization includes behavior that investigates the security established by the organization and behavior that circumvents the security established by the organization.

Actions to investigate the security of an organization include actions by a user of terminal 20 to investigate the security itself set up in the organization, and actions to investigate logs of operations performed on the security set up in the organization.

By way of example and not limitation, the behavior of investigating the security measures set up in an organization includes the behavior of investigating the location where antivirus software or firewalls are stored that are set up on terminals 20 available to users. Such behavior may later lead to circumvention of the set up security measures (as will be described in more detail below, but as an example and not limitation, the deletion of antivirus software shown in user input log 281 in Figure 4), and therefore is treated as behavior that interferes with the security of the organization.

Furthermore, the action of investigating logs of operations performed on security settings configured for the organization may involve investigating the logs or operation logs stored in the user input log 281 or user management database 152, which store the history of operations performed by users of terminal 20, as described below. Such actions may later lead to the deletion of recorded security operation logs (such as, but not limited to, deleting the log of an operation indicating the removal of antivirus software, as shown in user input log 281 in Figure 4), and therefore may be included in actions that disrupt the security of the organization.

Actions to circumvent security set by an organization may include actions to disable security set by the organization or actions to delete operation logs that perform operations against security set by the organization.

Examples of actions that disable security measures implemented by an organization include, but are not limited to, uninstalling security software that is implemented by the organization, or installing software that compromises the security measures implemented by the organization. These actions directly compromise the security measures implemented by the organization, and therefore may be included in actions that disrupt the security of an organization.

Furthermore, the action of deleting operation logs that have been performed against the security set by an organization is the action of deleting the above-mentioned user input log 281 and operation logs stored in the user management database 152. Such actions may be included in actions that disrupt the security of an organization, as they are actions that conceal actions that the user of terminal 20 has performed that disrupt security.

Also, in Figure 4, the operation log of user input log 281 may not only record disruptive behavior that interferes with security set by the organization, but may also record operations that are normally performed using terminal 20 by the user of terminal 20. As an example, user input log 281 in Figure 4 records an operation indicating that user A.A. logged in to a community within the organization on month L, day L. Such information may be recorded, or the data may be structured not to store such information and only record disruptive behavior that interferes with security.

The user input log 281 may also include other information. The other information is information related to user A.A. The information about user A.A may include, by way of example and not limitation, the date on which user A.A joined the company and the type of work the user does at the organization. User A.A's years of service can be calculated from the date on which user A.A joined the company, and since a user with a long number of years of service is generally a trustworthy user, this can be used to determine whether the actions stored in user A.A's operation log were performed by mistake.
Furthermore, based on the work that the user is engaged in at the organization, it can be used to determine whether the actions recorded in the operation log are work that user A. It should be noted that other information does not need to be included in the user input log 281, and it can be included or not.
Other items may also be configured to store information about the location of the terminal 20. If the location of the terminal 20 is not where normal business operations are performed, there is a possibility that fraudulent activity is being performed, and this information can be used to determine whether the actions stored in the operation log of user A. A were performed by mistake. Note that the location information can be detected using the location calculation detection unit 29B described in FIG. 1, or the like, and if necessary, a device may be attached to the terminal 20 as appropriate to enable location detection.

In this way, the user input log 281 records the history of operations of the terminal 20 by the user of the terminal 20. The user input log 281 records operations of the terminal 20 by input to the input/output unit 23 of the terminal 20.

The control unit 21 of the terminal 20 controls the communication unit 22 to transmit the information recorded in the user input log 281 to the server 10 via the network 30. Under the control of the control unit 21, the information recorded in the user input log 281 of the storage unit 28 is transmitted to the server 10.
The information stored in the user input log 281 that is sent may or may not be all of the information contained in the user input log 281. For example, only the user ID and operation log information contained in the user input log 281 may be sent to the server 10. If the receiving server has already recorded the user's name, the user name does not need to be sent. Although the case where the user ID is sent has been described, if the user can be uniquely identified by the user name, the user name may be sent together with the operation log instead of the user ID. Therefore, if the user can be uniquely identified by the user name, the user ID is not necessarily required.
Furthermore, other information included in the user input log 281 does not need to be transmitted if it is not used in subsequent processing by the server 10 .

Next, the server 10 comprises the control unit 11, communication unit 14, and memory unit 15 described above. The memory unit 15 comprises a security processing program 151 and a user management database 152. The security processing program 151 is a program for executing the detection process described below in the first embodiment, and the control unit 11 is able to execute the detection process by reading the security processing program 151. Furthermore, the user management database 152 stores, in database format for each user, information such as each user input log 281 transmitted from each user's terminal 20 via the network 30.

The communication unit 14 of the server 10 receives information based on the user input log 281 sent from the terminal 20. The control unit 11 of the server 10 controls the storage of the information based on the user input log 281 received by the communication unit 14 in the user management database 152 stored in the storage unit 15. Under the control of the control unit 11, operation logs performed by each user are stored in the respective user input logs 281 in database format.

Figure 5 is a diagram showing the data configuration of the user management database 152 stored in the memory unit 15. The user management database 152 is configured based on the information in the user input log 281 sent from each user's terminal 20, and therefore, like the user input log 281, includes the user name, user ID, operation log, and other information. Note that while the user management database 152 shown in Figure 5 is illustrated as having a similar configuration to the user input log 281, it does not have to be the same. For example, unlike the input log 281, the user management database 152 may or may not include other information. On the other hand, even if the user management database 152 includes an item for other information, the input log 281 may not include an item for other information.

The user name, user ID, operation log, and other information are based on the input log 281 described above and may be the same information as the input log 281, or may be information added to or partially deleted from the information in the input log 281. The user management database 152 is information that aggregates the information in the input log 281 transmitted from each terminal 20, and therefore includes the user name, user ID, operation log, and other information for each user. For example, the user management database 152 in FIG. 5 stores in its operation log information that antivirus software was deleted on Nth month and Nth day, which is included in the operation log of the input log 281 stored in the terminal 20 of user A. Furthermore, the user management database 152 stores in its operation log information that the U application was operated on Qth month and Qth day, which is included in the operation log of the input log 281 stored in the terminal 20 of user B.
In this way, the user management database 152 is configured from information in which the information of the input log 281 sent from each terminal 20 is aggregated.

Next, the detection process according to the first embodiment of the present invention will be described using Figure 6. Figure 6 shows the functions included in the server 10, which includes a control unit 11 and a memory unit 15. The control unit 11 includes a detection unit 111, and the memory unit 15 includes the security processing program 151 and user management database 152 described above.

The control unit 11 reads the security processing program 151 stored in the memory unit 15 and executes the detection process in accordance with the security processing program 151. The detection unit 111 included in the control unit 11 accesses the user management database 152 stored in the memory unit 15 in accordance with the security processing program 151 and executes the process of checking the operation logs of each user.

The detection unit 111 included in the control unit 11 checks the operation logs of each user in the user management database 152, and then performs processing to determine whether or not there is an operation log corresponding to an action that interferes with the security of the organization. If there is an operation log corresponding to an action that interferes with the security of the organization, the detection unit 111 performs processing to detect the corresponding operation log.
An example of the detection process will be described with reference to Figure 5. Since the operation log of user A.A includes the action of deleting antivirus software, which is included in the actions that disrupt security, the detection unit 111 included in the control unit 11 performs processing to detect this action as an action that disrupts security. Furthermore, the operation log of user D.D includes an action that investigates security, namely, performing a search for security software on month P, day P, and the detection unit 111 included in the control unit 11 performs processing to detect this action as an action that disrupts security.

After performing the detection process, the detection unit 111 included in the control unit 11 may or may not control the storage of the detection results in the user management database 152. When controlling the storage, as a non-limiting example, the detection unit 111 included in the control unit 11 may control the storage of the fact that an action that interferes with the security of the organization has been detected in the "other information" section of the user management database 152. Furthermore, the control unit 11 may control the storage of the detection results in another storage area of the storage unit 15, not just the user management database 152. Note that this storage control is not required in this embodiment 1, and the storage control may or may not be performed.

Next, the processing according to the first embodiment will be described with reference to the sequence diagram shown in FIG. 7 . The processing of the sequence diagram in FIG. 7 is executed by the server 10 and the terminal 20. The processing by the server 10 may be implemented by the control unit 11 reading and executing code of the security processing program 151 stored in the storage unit 15. The processing by the terminal 20 may be implemented by the control unit 21 reading and executing code of the program stored in the storage unit 28. Note that the processing described below is merely an example of a processing for implementing the technique of the present disclosure, and is not limited thereto. Other steps may be added to the processing described below, or some steps may be omitted (deleted or skipped) from the processing described below.
7, for simplicity, the explanation is given using one terminal 20, but the processing shown in FIG. 7 may be executed by two or more terminals 20. In this case, the server 10 receives information based on the user input log 281 described below from the multiple terminals 20. The information based on the user input log 281 transmitted from the multiple terminals 20 is then stored in the management database 152.

First, the control unit 21 of the terminal 20 determines whether there has been any input via the input/output unit 23 by the user using the terminal 20 (A100). If there has been no input (A100: NO), the control unit 21 again determines whether there has been any input via the input/output unit 23. If there has been input (A100: YES), the control unit 21 controls the storage of the operation information entered via the input/output unit 23 in the user input log 281 included in the storage unit 28.

Thereafter, the control unit 21 controls the communication unit 22 to transmit information based on the user input log 281 via the network 30 (A120). Note that in the sequence diagram shown in FIG. 7, the control unit 21 performs the process of step A120 consecutively after step A110, but this process is not limited to this. The process of step A120 may be performed as appropriate and may be executed independently of the process of step A110. For example, the information recorded in the user input log 281 may be transmitted periodically or aperiodically at a set time after 11:00 PM, when the user's work is finished.
Furthermore, it is not necessary to transmit all information in the user input log 281, and information that has already been transmitted to the server 10 does not need to be transmitted, and only updated information that is not stored in the server 10 may be transmitted.

The control unit 11 of the server 10 controls the communication unit 14 of the server 10 to receive information based on the user input log 281 transmitted by the communication unit 22 of the terminal 20 (S200).

After receiving information based on the user input log 281 via the communication unit 14 of the server 10, the control unit 11 controls the storage of the information based on the received user input log 281 in the user management database 152 stored in the memory unit 15 of the server 10 (S210).

Next, the detection unit 111 included in the control unit 11 of the server 10 performs a process of accessing the user management database 152 in order to execute the detection process (S220). Note that in FIG. 7, step S220 is executed following the process of step S210, but it does not have to be executed consecutively. It may be executed independently of step S210, or, like step A120, may be executed at a set timing. For example, the process of accessing the user management database 152 may be executed periodically or aperiodically at a set time, such as after 10:00 p.m. when the user's work hours have ended.

After accessing the user management database 152, the detection unit 111 included in the control unit 11 determines whether the user management database 152 contains any behavior that violates security (S230). If the user management database 152 does not contain any behavior that violates security (S230: NO), the detection process is terminated.

On the other hand, if the detection unit 111 included in the control unit 11 determines that the behavior includes behavior that interferes with security (S230: YES), it performs control to detect interference behavior that interferes with the relevant organization from the operation log of the user management database 152 (S235). After performing step S235, the detection process described in Figure 7 is terminated.

As mentioned above, after processing of step 235, the control unit 11 may or may not control the storage of the detected disruptive behavior in association with the user who committed the disruptive behavior. If this is done, the control unit 11 may or may not control the storage of the fact that the disruptive behavior has been detected in the other information section of the user who committed the disruptive behavior contained in the user management database 152. Also, as mentioned above, the control unit 11 may control the storage of the information in an area of the memory unit 15 different from the user management database 152.

<Effects of the First Embodiment>
This embodiment shows a configuration in which an information processing device such as a server 10 detects disruptive behavior, which is behavior related to disrupting security set on an organization's terminal 20 (not limited to, but an example of an organization's equipment) by a user using the organization's terminal 20, using a detection unit 111 included in the control unit 11.
As an example of an effect of an embodiment obtained by such a configuration, it becomes possible to detect information intended to disrupt the security of an organization, thereby making it possible to detect users who directly harm the security of an organization.

In addition, in this embodiment, actions related to the violation of security include actions to investigate the security set in the terminal 20 (which is not limited to the terminal 20 but is an example of an organization's equipment).
This configuration makes it possible to detect security investigation behavior by a user, which is a precursor to a security breach, and therefore makes it possible to detect behavior by a user that could harm the security of an organization before the user breaches security.

In addition, this embodiment includes, as actions related to the violation of security, an operation by a user of terminal 20 to investigate the security set on terminal 20 (which is not limited to terminal 20 but is an example of an organization's equipment), or an action to investigate an operation log regarding security.
Such a configuration makes it possible to detect user behavior that could compromise the security of an organization before the user actually causes a security disruption.

In addition, in this embodiment, actions related to violating security include actions by the user of the terminal 20 that circumvent security set in the terminal 20 (which is not limited to the terminal 20 but is an example of an organization's equipment).
This configuration makes it possible to detect malicious user attempts to circumvent security.
In addition, it will be possible to detect users who have circumvented an organization's security measures and are likely to engage in further malicious behavior before they engage in further malicious behavior such as launching a specific attack against the organization (for example, but not limited to, a cyber attack), thereby limiting damage to the organization.

In addition, in this embodiment, actions related to the interference with security include actions by the user of terminal 20 to disable the security set on terminal 20 (which is not limited to terminal 20 but is an example of an organization's equipment), or actions to delete operation logs of operations performed on security.
This configuration makes it possible to detect malicious user attempts to circumvent security.
In addition, it will be possible to detect users who have circumvented an organization's security measures and are likely to engage in further malicious behavior before they carry out further malicious behavior such as launching a specific attack against the organization (for example, but not limited to, a cyber attack), thereby limiting damage to the organization.

Furthermore, in this embodiment, the security may include security set by an organization to protect the organization's network.
With this configuration, as a security measure, it is possible to detect behavior that disrupts the protection of an organization's network, thereby making it possible to detect users who disrupt the organization's network, thereby protecting the organization's network from disruption.

Furthermore, in this embodiment, security may be set on the terminals 20 (not limited to, but an example of organizational equipment) distributed to each of a plurality of users belonging to an organization.
With this configuration, the security target for detecting interference is set uniformly for the organization, so by detecting acts of interference with security, it is possible to detect interference with the security set for the organization and protect the entire organization from interference with the security set for the organization.

In addition, in this embodiment, the security may be software-based security.
With this configuration, it becomes possible to detect software-based sabotage of security, thereby making it possible to protect against software-based sabotage of security.

<First Modification of First Embodiment>
In the first embodiment, the actions that disrupt the security of an organization may be input by an administrator who manages the organization's terminal 20, and the actions that constitute the actions that disrupt security may be obtained from outside via the network 30.

When input by a user managing an organization's terminal 20, the input is made via the input/output unit 23 of the organization's terminal 20 or the input/output unit 12 provided in the server 10. As a non-limiting example, if an action to remove the organization's firewall is added as a specific action included in the aforementioned actions to circumvent security, the action is input via the input/output unit 23 of the organization's terminal 20 or the input/output unit 12 provided in the server 10 and added as a new action that violates security. The added new action that violates security is stored in the memory unit 15 or the like.

In addition, when acquiring actions that are included in actions that disrupt the security of the organization from the outside via the network 30, the communication unit 14 of the server 10 receives new actions that are included in actions that disrupt the security of the organization and stores them in the memory unit 15 or the like.
By way of example and not limitation, the newly added security-compromising behavior is stored in security program 151, which is stored in storage unit 15. This allows control unit 11, when loading security program 151, to obtain information indicating what behaviors, including the newly added disruptive behavior, are threatening the security of the organization.

By performing the processing described in variant example 1 of embodiment 1, it becomes possible to appropriately update behaviors that disrupt the security of an organization, and it becomes possible to add newly occurring disruptive behaviors or newly occurring behaviors that disrupt security, thereby making it possible to appropriately detect behaviors that disrupt the security of an organization.

<Embodiment 2>
In the first embodiment, a configuration has been disclosed in which an information processing device such as the server 10 detects, by the detection unit 111 included in the control unit 11, any disruptive behavior against the security of an organization by a user who uses equipment in the organization.
In the second embodiment, after detection is performed by the detection unit 111, a device control unit 114 included in the control unit 11, which will be described later, controls notification and the use of the terminal 20.

FIG. 8 is a block diagram showing an example of the functional configuration of the server 10 according to the second embodiment.
To explain the second embodiment by focusing on the differences between the first and second embodiments, the server 10 according to the second embodiment includes a determination unit 113 and a device control unit 114. As will be described later, the determination unit 113 is not necessarily required, and may or may not be present.

The determination unit 113 executes a process to determine whether to control the device based on the results detected by the detection unit 111. If it is determined that device control should be executed, the device control unit 114 executes device control. In embodiment 2, the device control is described using an example of control that notifies information indicating that an action that violates security has been detected, but this is not limited to this, as described in the modified example below.

Next, a sequence diagram showing an example of the flow of processing executed by each device in this embodiment is shown in Figure 9. Here, the contents shown in Figure 9 will be explained, focusing on the differences from the first embodiment. First, unlike the first embodiment, the second embodiment is configured with two terminals 20 and a server 10. Note that the explanation is given using an example of two terminals, terminal 20A and terminal 20B, but this is not limited to this, and there may be two or more terminals that perform processing equivalent to terminal 20A, or there may be two or more terminals that perform processing equivalent to terminal 20B.
9, the description will be given assuming that the user using terminal 20A is a user who belongs to an organization, and the user using terminal 20B is a user (which may be expressed as an administrator) who manages terminal 20A, etc., in the organization, but the present invention is not limited to this. The user using terminal 20B may be a user who belongs to the organization, like the user using terminal 20A, or may be a user who belongs to an organization different from the organization to which terminal 20A belongs.

Next, in the second embodiment, the processing flow that differs from the first embodiment is that there are no particular differences in terminal 20A, but in server 10, it differs from the first embodiment in that it includes steps S240 and S245, and in terminal 20B, it differs from the first embodiment in that it includes processing in steps B300 and B310.

In order to focus on the differences between the second embodiment and the first embodiment, the description will begin with the processing after step S235, which is similar to the processing in the first embodiment and is executed by the detection unit 111 included in the control unit 11 of the server 10. As the processing after step S235, based on the detection of the disruptive behavior detected in step S235, the determination unit 113 included in the control unit 11 determines whether to control the device (S240).
In the description here, as described above, the control of the device will be described by taking as an example the control of notifying the terminal 20A.
9, an example in which the determination in step S240 is executed is described, but the present invention is not limited to this. Step S240 is not essential, and after step S235, the process may be executed by skipping step S240.

When the determination unit 113 determines that the notification should not be sent to the terminal 20B as the device control (S240: NO), the device control is not performed and the control by the control unit 11 in FIG. 9 is terminated.
On the other hand, if the determination unit 113 determines that the device control should be to notify the terminal 20B (S240: YES), the device control unit 114 executes control to notify the terminal 20B that a security interference behavior has been detected (S245). As the control to notify, the device control unit 114 controls the communication unit 14 to transmit information for the notification to the terminal 20B via the network 30.

Here, the information for sending a notification includes at least information for causing terminal 20B to execute the notification, and when terminal 20B receives this information, terminal 20B executes a notification indicating that a security interference behavior has been detected. Note that the information for sending a notification may or may not include notification content consisting of text information. If it does include text information, the notification content is displayed on the display unit 24 of terminal 20B, as described below, by way of example and not limitation.

Next, the control unit 21 of terminal 20B determines whether the communication unit 22 of terminal 20B has received information for notification, which is included in the information regarding device control sent from the server 10, via the network 30 (B300).

If the information for sending a notification has not been received (B300: NO), the control unit 21 of terminal 20B again determines whether the information for sending a notification has been received. If the information for sending a notification has been received (B300: YES), the control unit 21 of terminal 20B executes processing to send a notification to the user of terminal 20B based on the information for sending a notification.

Figure 10 is a diagram showing that, upon receiving information for notification by terminal 20B, notification of information indicating that interference with security has been detected is executed on display unit 24 of terminal 20B. As shown in Figure 10, display unit 24 displays "User A. A may be engaging in interference with security" as notification of information indicating that interference with security has been detected.

As mentioned above, the user using terminal 20B may be an administrator who manages an organization, so by checking the content of this notification, the user using terminal 20B will be able to immediately know that user A.A. is engaging in disruptive behavior.

Note that while a display has been used as an example of the content of the notification, this is not limited to this. The notification here may also be a sound notification or a vibration notification. The control unit 21 of terminal 20B may perform different control depending on the type of notification and control the notification appropriately. Note that sound notifications and notifications using the sense of touch may be performed by the input/output unit 23 shown in Figure 1. Sound notifications may also be a buzzer sound or chime that is an alarm sound indicating that a security breach has been detected, or a synthesized voice that corresponds to text indicating that a security breach has been detected.

<Effects of the Second Embodiment>
This embodiment shows a configuration in which an information processing device such as a server 10 detects disruptive behavior, which is behavior related to disrupting security set on an organization's terminal 20 by a user using the organization's terminal 20 (not limited to this, but an example of an organization's equipment), using a detection unit 111 included in the control unit 11, and controls the equipment (not limited to this, but an example of control) based on the detection using an equipment control unit 114 included in the control unit 11.
As an example of an effect of an embodiment obtained by such a configuration, control can be exercised based on the detection of information intended to disrupt the security of an organization, making it possible to appropriately respond to disruptive behavior against the security of an organization.

Furthermore, in this embodiment, as control of the device (not limited to this, but an example of control), control of notifying of disruptive behavior is performed by the device control unit 114 included in the control unit 11 .
As an example of an effect of an embodiment obtained by such a configuration, based on the detection of information intended to disrupt the security of an organization, it is possible to notify that an action to disrupt security is being taken, and to deal with the disruption early.

<Modification 1 of Second Embodiment>
9 and 10 of the second embodiment, notification has been described as an example of device control, but the present invention is not limited to this. Device control may involve restricting the use of the terminal 20B of a user who has engaged in disruptive behavior based on the detection of disruptive behavior.
In the example illustrated in FIG. 9 , the user using terminal 20B is assumed to be a user (administrator) who manages terminals 20A and the like in an organization. However, in this first modification, the user using terminal 20B is assumed to be a user who belongs to the organization, just like the user using terminal 20A. The following example is explained using terminals 20A and 20B, but the explanation is given assuming that terminal 20B has already executed the processing performed by terminal 20A in the sequence diagram of FIG. 9 , which will be described below. In other words, since terminal 20B has already executed the processing performed by terminal 20A in FIG. 9 , the user management database 152 already stores information based on the user's input log stored in terminal 20B.
Furthermore, as described below, the terminal 20B may be read as the terminal 20A, and the processing of the first modification of the second embodiment may be executed.

A specific explanation will be given using Figure 9. In the sequence diagram of Figure 9, the processing is the same up to step S240. When device control is performed in step S240, device control in step S245 may be performed by the device control unit 114 included in the control unit 11 to restrict the use of terminal 20B of the user who has engaged in disruptive behavior.

The control to restrict the use of terminal 20B by the user who has engaged in disruptive behavior is a control to transmit information for restricting the use of terminal 20B from server 10 to terminal 20B. When terminal 20B receives the information restricting the use of terminal 20B, the use of terminal 20B is restricted, and terminal 20B no longer accepts operations from the user, making it impossible to use terminal 20B.
It is not necessary to limit the acceptance of all operations, and it is also possible to prevent the acceptance of some operations. As a non-limiting example, only some functions, such as the Internet function, email function, and chat function, or software that constitutes some functions may be made unavailable, or all functions or all software may be made unavailable.

In addition to the above example, when terminal 20B receives this information, the user of terminal 20B may be stripped of their authority to use terminal 20B and may no longer be able to log in to terminal 20B.

Therefore, when performing device control, in step S245, the device control unit 114 controls the communication unit 14 of the server 10 to transmit information for restricting the use of terminal 20B. Thereafter, if in step B300 the control unit 21 determines that information for restricting the use of terminal 20B has been received by the communication unit 22 of terminal 20B, in step B310 the control unit 21 executes control to restrict the use of terminal 20B as described above as device control.

Although an example of restricting the use of the terminal 20B has been described above, in addition to this, a notification indicating that the use of the terminal 20B has been restricted may be sent.
11 shows the display unit 24 of terminal 20B after control to restrict the use of terminal 20B has been executed. Display unit 24 displays a message indicating that user B may be engaging in disruptive behavior and that use of the terminal has been restricted. In this way, a notification may be sent to the user of terminal 20B informing them that use of the terminal has been restricted in response to the user of terminal 20B engaging in disruptive behavior against the security of the organization.

In this way, the device control may not only perform the control for sending the notification described in the second embodiment, but also perform control for restricting the use of the terminal 20B.
In addition, although the explanation of the first modification of the second embodiment has been given using information for restricting the use of terminal 20B, the processing may be executed by replacing terminal 20B with terminal 20A. That is, although the example of the first modification of the second embodiment has been described above using processing executed by two terminals, terminal 20A and terminal 20B, and server 10, the processing may be executed by terminal 20A and server 10, or the processing may be changed so that the processing executed by terminal 20B is executed only by terminal 20A.
Furthermore, the processing of Modification 1 of Embodiment 2 may be executed by a plurality of terminals in accordance with the description of Embodiment 2. That is, there may be a plurality of terminals corresponding to terminal 20A described in Modification 1 of Embodiment 2, or there may be a plurality of terminals corresponding to terminal 20B described in Modification 1 of Embodiment 2.

In the example of the first modification of the second embodiment, the device control executed on terminal 20B is to restrict the use of terminal 20B. However, the device control is not limited to this. Alternatively, the device control may be to transmit information to terminal 20B inquiring whether to restrict the use of a terminal different from terminal 20B (for example, terminal 20A). In this case, the user of terminal 20B may be a user corresponding to a user (administrative user) who manages devices in the organization.
For example, if disruptive behavior by a user of a terminal (e.g., terminal 20A) different from terminal 20B is detected in step S235, the device control unit 114 of the server 10 transmits information inquiring whether to restrict use of the terminal (e.g., terminal 20A) different from terminal 20B as device control in step S240. Then, terminal 20B receives the information inquiring whether to restrict use from the server 10. Then, terminal 20B displays corresponding information on the display unit 24 of terminal 20B.
When the user of terminal 20B confirms this and inputs permission to restrict use, control unit 11 of server 10 may execute control to restrict use of a terminal other than terminal 20B (for example, terminal 20A). That is, referring to the example of Modification 1 of Embodiment 2, server 10 may transmit information inquiring whether to restrict use as device control.

<Effects of Modification 1 of Second Embodiment>
In addition, this modified example shows a configuration in which, as control of the device (not limited to this, but an example of control), control to restrict the use of the device used by the user or control to restrict the software of the device used by the user is performed by the device control unit 114 included in the control unit 11.
As an example of an effect of an embodiment obtained by such a configuration, it becomes possible to restrict the use of a terminal that is violating security based on the detection of information intended to violate the security of an organization, thereby making it possible to prevent the user who has violated security from engaging in further malicious behavior before it occurs.

<Embodiment 3>
The first embodiment discloses a configuration in which an information processing device such as the server 10 detects, by the detection unit 111 included in the control unit 11, any disruptive behavior against the security of an organization by a user who uses equipment in the organization.
In the third embodiment, after detection is performed by the detection unit 111, the risk value of the disruptive behavior is evaluated by the evaluation unit 112 included in the control unit 11, which will be described later, and a quantitative evaluation of the risk of disruptive behavior performed by users of the organization's equipment is performed.

The configuration of the third embodiment will be described with reference to Fig. 12. As described above, the third embodiment differs from the first embodiment in that the control unit 11 includes an evaluation unit 112. The evaluation unit 112 quantitatively evaluates the risk of disruptive behavior against the security of the organization, detected by the detection unit 111 included in the control unit 11.
The evaluated values and the like may be stored in the user management database 152 included in the storage unit 15 , or may be stored in a separate storage area of the storage unit 15 .

Fig. 13 shows how the evaluations by the evaluation unit 112 are stored in the user management database 152. The user management database 152 shown in Fig. 13 differs from the previously described Fig. 5 in that it has an item for inputting an evaluation point for each user. An evaluation value based on the behavior of each user is input into this item for inputting an evaluation point.
Although the evaluated values are shown here as numerical values, evaluation may be performed using other methods. For example, and without limitation, evaluation may be performed using multiple levels such as high, normal, and low risk, or the magnitude of risk may be indicated in alphabetical order (for example, and without limitation, A may indicate the greatest risk, and the evaluation may be performed in order from A to A in decreasing risk).

13 shows that the evaluation of user A.A. is minus 50. This is because user A.A. deleted antivirus software, which is an obstruction to the security of the organization, and so the evaluation unit 112 has given the evaluation of minus 50.
13 also shows that the evaluation of user D.D. is minus 15. This is because the evaluation unit 112 has evaluated the user D.D. as having performed a search for the location where security software is stored, which is an obstruction to the security of the organization.

The evaluation here may be uniform, or may be different for each behavior. For example, removing antivirus software is included in behaviors that circumvent organizational security. The behavior of circumventing security may be determined to be higher risk than the behavior of investigating security, and the evaluation may be set higher (so that the negative evaluation is more significant) than the behavior of investigating security.
9, the removal of antivirus software, which is included in the behavior of circumventing security, is evaluated as minus 50 (not a limitation, but an example of a first value). On the other hand, performing a security search, which is included in the behavior of investigating security, is evaluated as minus 15 (not a limitation, but an example of a second value), which is a smaller negative evaluation than removing antivirus software. In this way, the negative evaluation of the circumventing behavior may be set to be larger than that of the investigating behavior (not a limitation, but an example of the second value being a more negative evaluation than the first value), or vice versa.

Furthermore, since multiple types of behaviors to be avoided are set, the evaluation unit 112 may perform a different evaluation for each type. As a non-limiting example, the evaluation may be different for the removal of antivirus software and the deletion of security operation logs, which are included in the behaviors to be avoided. As a non-limiting example, the evaluation unit 112 may perform a minus 50 evaluation for the removal of antivirus software, and a minus 30 evaluation for the deletion of security operation logs. In this way, the evaluation unit 112 may perform a different evaluation for each type. Note that similarly, with regard to behaviors that investigate security, the evaluation unit 112 may perform a different evaluation for each type included in the behaviors that investigate security.

13, user B.B has been given a rating of minus 5 by the evaluation unit 112. This does not constitute an action that would compromise the security of the organization, but because the frequency of operations on the terminal 20 is higher than that of a normal user, the evaluation unit 112 has given the user a rating of minus 5. Therefore, the evaluation unit 112 gives a rating that is different from the rating of an action that would compromise the security of the organization.
13, the evaluation unit 112 has given user C-C a rating of +15. This is because, as described in the other information, user C-C has not engaged in any particularly problematic behavior since joining the company, and therefore the evaluation unit 112 has given a positive evaluation. Also, although a positive evaluation is used as an example here, the evaluation unit 112 may give a negative evaluation depending on the other information described.
Furthermore, a negative or positive evaluation may be made depending on the work content of the user of the terminal 20 and the location information of the terminal 20, as described in the first embodiment. As a non-limiting example, if the other field stores the location of a place different from the place where the user of the terminal 20 normally performs work, the evaluation unit 112 may make a negative or positive evaluation based on the location, time, and time.
Although it is disclosed here to perform evaluations unrelated to security breaches and to perform positive evaluations, this processing does not need to be performed. Also, although evaluations are performed using positive and negative evaluations, evaluations may be performed using only one of them, for example, evaluations may be performed using only negative evaluations and no positive evaluations may be performed.

Furthermore, if multiple actions are stored in the operation log, an evaluation may be performed for each action, and the sum of these evaluations may be used as the user's evaluation. As a non-limiting example, if user A.A. deletes antivirus software and performs more operations than usual, the evaluation unit 112 may add minus 5 to minus 50, giving user A.A. an evaluation of minus 55, and store this in the user database 152.

Next, the processing of embodiment 3 will be explained using Figure 14. Focusing on the differences between embodiment 1 and embodiment 3, the processing up to step S235 is the same, but the processing from step S250 onwards differs between embodiment 3 and embodiment 1. Therefore, the processing from step S250 onwards will be explained in detail.

After detecting disruptive behavior in step S235 by the detection unit 111 provided in the control unit 11, the detected disruptive behavior against the security of the organization is evaluated by the evaluation unit 112 (S250). After the evaluation by the evaluation unit 112 is performed, the evaluation is stored in the user management database 152 provided in the memory unit 15 (step S260). Note that, as described above, the evaluation may be stored in a memory area of the memory unit 15 different from the user management database 152.

<Effects of the Third Embodiment>
In this embodiment, an information processing device such as a server 10 detects disruptive behavior, which is behavior related to disrupting security set on the organization's terminal 20 by a user using the organization's terminal 20 (not limited to, but an example of the organization's equipment), using a detection unit 111 included in the control unit 11, and evaluates the detected disruptive behavior using an evaluation unit 112 included in the control unit 11, and the evaluation by the evaluation unit 112 is stored in a memory unit 15 by the control unit 11.
As an example of an effect of an embodiment obtained by such a configuration, by quantitatively evaluating the disruptive behavior performed by users and storing that evaluation, it becomes possible to confirm the extent to which each user's behavior was malicious.

In addition, this embodiment shows a configuration in which, in the evaluation by the evaluation unit 112, different evaluations are made for actions that investigate the security set on the organization's terminal 20 (not limited to this but an example of a device) and actions that circumvent the security set on the terminal 20.
As an example of an effect of an embodiment obtained by such a configuration, by differently evaluating actions that circumvent security and actions that investigate security, it becomes possible to appropriately evaluate the actions of malicious users.

In addition, this embodiment shows a configuration in which, in the evaluation by the evaluation unit 112, different evaluations are made for actions that disrupt the security set on the organization's terminal 20 (not limited to this but an example of equipment) and user operations on the terminal 20 that are different from disruptive actions.
As an example of an effect of an embodiment obtained by such a configuration, by differently evaluating actions that circumvent security and actions that investigate security, it becomes possible to appropriately evaluate the actions of malicious users.

<Third embodiment, modified example 1>
In the example of the third embodiment, in step S260, the evaluation by the evaluation unit 112 is stored in the user management database 152, and then the processing ends. However, the processing described in the second embodiment may be added thereafter. In the second embodiment, in step S240, it is determined whether or not to control the device. This determination of whether or not to control the device may be made based on the evaluation points stored in the storage unit 15.

The following describes a first modification of the third embodiment using an example and not a limitation. After step S260 in the sequence diagram shown in FIG. 14, the process of step S240 in FIG. 9 described in the second embodiment may be added and executed. At this time, the evaluations stored for each user are stored in the user management database 152 included in the storage unit 15. Using the evaluations stored in this user management database 152, the device control unit 114 determines whether to control the device.
For example, and not by way of limitation, the device control unit may control the device when the evaluation score falls below a set threshold of minus 50. When the evaluation score falls below, exceeds, or becomes equal to a set value (for example, and not by way of limitation, the threshold), the device control unit 114 may determine to control the device. Note that the processing from step S240 onwards may be performed according to FIG. 9 described in the second embodiment.

It should be noted that the present invention is not limited to the above example, and the device control unit 114 may determine to control the device when a specific disruptive behavior is performed regardless of the evaluation score.
As a non-limiting example, when the detection unit 111 detects an action that interferes with security set for an organization, the device control unit 114 may determine to control the device regardless of (or skip) the evaluation by the evaluation unit 112. For example, suppose a user's evaluation score exceeds +100 in the evaluation by the evaluation unit 112 described above, and then the user is deducted by 50 for performing an action that circumvents security. In this case, the user's evaluation score is deducted by 50 from +100, so that the user's evaluation score is still positive at +50. However, regardless of this evaluation, the device control unit 114 may determine to control the device because the user has performed an action that interferes with security.

Note that when executing device control, the device control unit 114 may or may not execute device control only when it detects behavior that circumvents security, regardless of (or by skipping) the evaluation by the evaluation unit 112. In other words, when it detects behavior that investigates security, it controls the device based on the evaluation by the evaluation unit 112, and only when it detects behavior that circumvents security, it executes device control regardless of (or by skipping) the evaluation by the evaluation unit 112.
Furthermore, when executing control of an equipment, the equipment control unit 114 may or may not execute control of the equipment regardless of the evaluation by the evaluation unit 112 (or may skip the evaluation) only if it detects behavior that investigates security.

The above describes an example of combining embodiment 2 with embodiment 3, but this example is not limiting and the contents described in this embodiment may be combined in any way. Furthermore, when combining, it is not necessary to execute all steps; unnecessary steps may be skipped as appropriate, or other steps may be added as appropriate.

<Third embodiment, modified example 2>
In the third embodiment, the evaluation unit 112 makes a constant evaluation for each of the behaviors that circumvent security and the behaviors that investigate security. However, this evaluation may vary depending on the situation. As a non-limiting example, when the detection unit 111 detects multiple behaviors that circumvent security or multiple behaviors that investigate security per set time (or period) or per unit time (or unit period), the evaluation may be different from when the same multiple behaviors are detected at intervals longer than the set time or unit time.

As a non-limiting example, suppose the above-mentioned set time is set to 72 hours. Suppose that, within this set time, the detection unit 111 detects three instances of behavior to investigate security. In such a case, even if the evaluation unit 112 evaluates the first instance as minus 15, the second instance may be evaluated as minus 20, and the third instance may be evaluated as minus 50, with each evaluation value being different.
The reason for this is that even if a security check behavior is detected once within a 72-hour period, the user may perform such an operation by mistake without malicious intent. On the other hand, if the same behavior is performed multiple times within a set time period, it is likely that the user is performing it with the intention of interfering. Therefore, if the same behavior is performed multiple times within a set time period, the negative evaluation will be greater than if the same behavior is performed at a time interval longer than the set time period, making it possible to more accurately evaluate interfering behavior.
In addition, the clock unit 16 or clock unit 29A shown in FIG. 1 may be used to calculate whether or not the set time has passed. Therefore, the terminal 20 or the server 10 may be appropriately equipped with the above-mentioned configuration when calculating whether or not the set time has passed. This makes it possible to calculate whether or not the detected behavior that violates security is within the set time. In addition, instead of providing the above-mentioned configuration in the device itself, the device may be configured to obtain time information, etc. via a network.

Furthermore, without being limited to the above example, a configuration may be adopted in which, each time multiple similar actions are detected within a set time, an additional minus 10 is added to the evaluation of each action. In this way, any evaluation method may be used as long as multiple actions performed within a set time are evaluated so that they receive a larger negative evaluation compared to multiple actions performed outside the set time.
Although the above description has been given using multiple identical actions, different types of actions may also be evaluated so that the negative evaluation is greater. As a non-limiting example, if a security investigation action and a security evasion action are performed, the evaluation would normally be minus 15 and minus 50, totaling minus 65. However, if the above actions are performed within the set time of 72 hours, the evaluation unit 112 may evaluate the action as minus 100, which is greater than minus 65, or minus 130, which is twice the value.

Furthermore, as described above, while a set time is set and an evaluation is made based on disruptive behavior detected at the set time, the evaluation may be different for each set time. As a non-limiting example, the evaluation unit 112 may make a normal evaluation between 9:00 and 18:00, when normal business operations are carried out, but may make a different evaluation during other periods.

As a non-limiting example, the late night hours between 12:00 and 3:00 are times when normal business operations are not conducted. If the detection unit 111 detects behavior that interferes with security during these hours, there is a high possibility that the behavior is malicious. Therefore, if the above-mentioned behavior is detected between 12:00 and 3:00 in the late night hours, the evaluation unit 112 will assign a larger negative rating than normal. For example, the evaluation may be set to twice the normal rating.

The second modification of the third embodiment shows a configuration in which the evaluation unit 112 performs evaluation based on the disruptive behavior detected at a set time.
As an example of the effect of this embodiment obtained by such a configuration, it becomes possible to accurately evaluate whether or not a user is intentionally violating security.

In addition, variant example 2 of this embodiment 3 shows a configuration in which when the detection unit 111 detects multiple security evasion behaviors or multiple behaviors to be investigated per set time or per unit time, the evaluation by the evaluation unit 112 is different compared to when the same multiple behaviors are detected at intervals longer than the set time or unit time.
As an example of the effect of this embodiment obtained by such a configuration, it becomes possible to accurately evaluate whether or not a user is intentionally violating security.

<Fourth Embodiment>
In the first embodiment, a configuration has been disclosed in which an information processing device such as the server 10 detects, by the detection unit 111 included in the control unit 11, any disruptive behavior against the security of an organization by a user who uses equipment in the organization.
In the fourth embodiment, instead of the server 10, an information processing device such as a terminal 20 is configured to detect disruptive behavior against the organization's security by a user who uses the organization's equipment using a detection unit 211 included in the control unit 21 of the terminal.

Figure 15 is a diagram showing an example of functions realized by the control unit 21 of the terminal 20 according to embodiment 4. Focusing on the differences between embodiment 4 and embodiment 1, the terminal 20 shown in Figure 15 includes a control unit 21, which in turn includes a detection unit 211. The detection unit 211 may have the same configuration as the detection unit 111 described above. In addition to the user input log described in embodiment 1, the memory unit 28 also stores a terminal security processing program 282 that the control unit 21 reads and the detection unit 211 executes the detection process. The terminal security processing program 282 may have the same configuration as the security processing program 151 provided in the server 10 described in embodiment 1. However, the terminal security processing program 282 is a program for processing on the terminal 20. Compared to embodiment 1, the communication unit 22 is described here as being removed because communication with the server 10 is not required, but the communication unit 22 may or may not be provided.

As described above, the terminal 20 described in embodiment 4 reads the terminal security processing program 282 stored in the memory unit 28 using the control unit 20, and is able to execute detection processing in accordance with the terminal security processing program 282. After reading the terminal security processing program 282, the detection unit 211 accesses the user input log 281 and executes processing to check the operation log contained in the user input log 281. Then, if the operation log contains any disruptive behavior against the organization's security, the detection unit 211 executes processing to detect the disruptive behavior.

Next, the processing of the fourth embodiment will be described with reference to the flowchart shown in Fig. 16. Focusing on the differences from the content described in the first embodiment, the processing is the same up to step A110, but the processing thereafter is different. After step A110, the detection unit 211 provided in the control unit 21 performs processing to access the user input log 281 (step A130). After the detection unit 211 accesses the user input log 281, it executes processing to determine whether any sabotaging behavior against security is recorded in the operation log included in the user input log 281 (step A140).
For simplicity, the following description is given assuming that step A140 is executed immediately after step A130, but this is not limiting. As described in the first embodiment, step A140 may be executed independently of step A130. As a non-limiting example, step A140 may be executed periodically, for example, at a set time, separate from step A130.

If no disruptive behavior against security is recorded in the operation log, the detection process is terminated (step A140: NO). On the other hand, if the detection unit 211 determines that disruptive behavior against security is recorded in the operation log, the detection unit 211 executes a process to detect disruptive behavior (step A145).

From the above, embodiment 4 shows that the detection process of the above-mentioned embodiment is performed by terminal 20 instead of server 10. Therefore, this embodiment also includes execution by an information processing device such as terminal 20 without using server 10.

<Effects of the Fourth Embodiment>
This embodiment shows a configuration in which an information processing device such as a terminal 20 detects disruptive behavior, which is behavior related to disrupting security set on the organization's terminal 20 by a user using the organization's terminal 20 (not limited to this, but an example of the organization's equipment), using a detection unit 211 included in the control unit 21.
As an example of an effect of the embodiment obtained by such a configuration, by executing the detection process by an information processing device such as the terminal 20, it becomes possible to perform the detection process at the terminal itself.

<Embodiment 5>
In the fifth embodiment, in addition to the fourth embodiment, an information processing device such as the terminal 20 may be provided with components corresponding to the determination unit 113 and the device control unit 114 described in the second embodiment.
The configuration of the fifth embodiment will be described with a focus on the differences from the fourth embodiment. FIG. 17 is a diagram showing an example of functions realized by the control unit 21 of the terminal 20 according to the fifth embodiment. In addition to the configuration of the fourth embodiment, FIG. 17 adds a determination unit 213 and a device control unit 214. Note that the determination unit 213 may have the same function as the determination unit 113 described in the second embodiment, and the device control unit 214 may have the same function as the device control unit 114 described in the second embodiment. Furthermore, the fifth embodiment includes a communication unit 22 for communication, but this is not necessarily required. In the case of processing executed only by the terminal 20, the communication unit 22 may or may not be detached.

17 also includes a server 10, which includes a communication unit 14, a control unit 11, and an input/output unit 12. The control unit 11 also includes a device control unit 114, and when the control unit 11 receives information for sending a notification, which is an example of device control transmitted from the device control unit 214, via the communication unit 14, the notification control unit 114 executes control for sending a notification based on the information for sending a notification.
In the example described here, notification is sent to the input/output unit 12 provided in the server 10, but notification may be sent to another terminal 20 instead of the server 10. In this case, the information received by the server may be information for restricting the use of the terminal, as described in the second embodiment, instead of information for sending notification.
The assumed output to the input/output unit 12 of the server 10 is to send a notification to a user who manages an organization and is located near the input/output unit 12 of the server 10, but this example is not limited to this.
It is also possible to send notifications and restrict usage to the terminal 20 itself, rather than to other terminals 20. In this case, the device control unit 214 may be configured to control the device itself (by way of example and not limitation, to control notifications and to restrict usage of the terminal itself). In this case, since there is no need to communicate information for device control, the terminal 20 may or may not include the communication unit 22.

Figure 18 is a sequence diagram illustrating the processing of embodiment 5. Focusing on the differences from embodiment 4, the processing up to step A145 is the same as in embodiment 4. After step A145, the determination unit 213 determines whether or not device control is necessary based on the detection of disruptive behavior (step A160). If it is determined that device control is not necessary, the processing related to embodiment 5 is terminated (step A160: NO). On the other hand, if the determination unit 213 determines that device control is necessary (step A160: YES), the device control unit 214 provided in the control unit 21 executes device control (step A165). As device control, the device control unit 214 performs control such as transmitting information related to device control to the server 10 via the communication unit 22. Note that the example here is not limited to control such as transmitting information for notification.

Next, the control unit 11 of the server 10 controls the communication unit 14 to receive the information about the device transmitted via the network 30 (step S250). Then, based on the received information about the device, the device control unit 114 included in the control unit 11 controls the device (step S260). Here, as an example and not a limitation, the device control unit 114 controls the input/output unit to notify the input/output unit that it has detected an action that violates security, based on the information for notification.

As described above, the fifth embodiment shows a configuration in which the detection process and the process related to device control are executed by an information processing device such as the terminal 20 instead of the server 10. In this way, the process shown in the second embodiment may be executed by an information processing device such as the terminal 20 instead of the server 10.
In the above-described embodiment, a configuration in which the detection unit 211 is provided in an information processing device such as the terminal 20 has been described, but the present invention is not limited to this, and other configurations described in embodiment 3 may also be provided. As a non-limiting example, the control unit 21 may have a configuration equivalent to the evaluation unit 112 described in embodiment 3. Furthermore, in addition to the configuration equivalent to the evaluation unit 112, the control unit 21 may or may not have a configuration equivalent to the determination unit 213 or the device control unit 214 described above.
Furthermore, the control unit 21 may include a configuration equivalent to the evaluation unit 112, and the server 10 may include configurations equivalent to the determination unit 113 and device control unit 114. In this case, the configuration equivalent to the evaluation unit 112 included in the control unit 21 of the terminal 20 performs an evaluation by the user of the terminal 20, and the terminal 20 transmits the evaluation result to the server 10. The server 10 may be configured to perform device control as described in the second embodiment using the determination unit 113 and device control unit 114 based on the received result of the evaluation by the terminal 20.
These combinations may be freely made as appropriate, and all combinations described in this embodiment are within the scope of the disclosure of this specification.

<Effects of the Fifth Embodiment>
This embodiment shows a configuration in which an information processing device such as a terminal 20 detects disruptive behavior, which is behavior related to disrupting security set on the organization's terminal 20 by a user using the organization's terminal 20 (not limited to this, but an example of an organization's equipment), using a detection unit 211 included in the control unit 21, and controls the equipment using the equipment control unit 114.
As an example of an effect of the embodiment obtained by such a configuration, by executing device control using an information processing device such as the terminal 20, it becomes possible to perform device control at the terminal itself without going through a network.

As explained above, it is possible to freely combine the various embodiments, modify any of the components of each embodiment, or omit any of the components of each embodiment as appropriate. Furthermore, the present disclosure is not limited to the above-described embodiments and modifications, and other forms that are conceivable within the scope of the technical concept of this disclosure are also included within the scope of this disclosure.

The various aspects of this disclosure are summarized below as appendices.

(Appendix 1)
An information processing device comprising: a detection unit that detects disruptive behavior, which is behavior related to disruption of security set in a device, by a user who uses the device in an organization.
(Appendix 2)
The information processing device according to claim 1, wherein the disruptive behavior includes an action of investigating the security set in the device.
(Appendix 3)
The investigating action includes an operation by the user to investigate the security set in the device or an action to investigate an operation log for the security.
3. The information processing device according to claim 2.
(Appendix 4)
The information processing device according to any one of Supplementary Note 1 to Supplementary Note 3, wherein the disruptive behavior includes an action that circumvents the security set in the device.
(Appendix 5)
The avoidance behavior includes a behavior for disabling the security or a behavior for deleting an operation log in which an operation was performed against the security.
5. The information processing device according to claim 4.
(Appendix 6)
and a control unit that performs control based on the detection of the disruptive behavior.
(Appendix 7)
The information processing device according to claim 6, wherein the control unit performs the control of notifying the disruptive behavior based on the detection of the disruptive behavior.
(Appendix 8)
The information processing device according to claim 6 or 7, wherein the control unit performs the control of restricting use of the device used by the user or software of the device based on the detection of the disruptive behavior.
(Appendix 9)
an evaluation unit that evaluates the user based on the detection of the disruptive behavior,
The information processing device according to any one of Supplementary Note 1 to Supplementary Note 8, wherein the control unit performs control to store the evaluation in a storage unit in association with the user.
(Appendix 10)
The information processing device according to claim 9, wherein the evaluation unit evaluates the user based on the disruptive behavior detected at a set time.
(Appendix 11)
the disruptive behavior includes behavior of investigating the security set in the device and behavior of circumventing the security set in the device;
The information processing device according to claim 9 or 10, wherein the evaluation unit performs different evaluations when the behavior to be investigated is detected and when the behavior to be avoided is detected.
(Appendix 12)
The detection unit detects an operation of the user on a device of the organization that is different from the disruptive behavior,
The information processing device according to any one of Supplementary Note 9 to Supplementary Note 11, wherein the evaluation unit performs different evaluations when the disruptive behavior is detected and when the user's operation on a device of the organization is different from the disruptive behavior.
(Appendix 13)
the information processing device is a server,
a control unit that controls transmission of information based on the detection of the disruptive behavior to a terminal of the organization.
(Appendix 14)
The information processing device according to any one of Supplementary Note 1 to Supplementary Note 12, wherein the information processing device is the device used by the user.
(Appendix 15)
The security includes security established by the organization to protect the organization's network.
15. An information processing device according to any one of claims 1 to 14.
(Appendix 16)
16. The information processing device according to any one of Supplementary Note 1 to Supplementary Note 15, wherein the security is set for a plurality of devices of the organization including the device.
(Appendix 17)
The security includes software-based security.
17. An information processing device according to any one of claims 1 to 16.
(Appendix 18)
An information processing method of an information processing device, comprising: a step of detecting, by a detection unit, disruptive behavior, which is behavior related to disrupting security set in a device, by a user who uses a device in an organization.
(Appendix 19)
On the computer,
A program that executes a process to detect disruptive behavior by users of an organization's devices that disrupts the security settings of the devices.

This disclosure is suitable for information processing, information processing methods, and programs.

10 Server, 11 Control unit, 12 Input/output unit, 13 Display unit, 14 Communication I/F (communication unit), 15 Memory unit, 16 Clock unit, 20 Terminal, 21 Control unit, 22 Communication unit I/F (communication unit), 23 Input/output unit, 24 Display unit, 25 Sound input unit, 26 Sound output unit, 27 Imaging unit, 28 Memory unit, 29A Clock unit, 29B Position detection unit, 30 Network, 111 Detection unit, 112 Evaluation unit, 113 Determination unit, 114 Device control unit, 151 Security processing program, 152 User management database, 211 Detection unit, 213 Determination unit, 214 Device control unit, 281 User input log, 282 Terminal security processing program.

Claims (16)

a detection unit that detects disruptive behavior, which is behavior related to disruption of security set in a device, by a user who uses the device in the organization;
an evaluation unit that evaluates the user based on the detection of the disruptive behavior,
the disruptive behavior includes behavior of investigating the security set in the device and behavior of circumventing the security set in the device;
The evaluation unit performs different evaluations when the behavior to be investigated is detected and when the behavior to be avoided is detected.
Information processing device. The investigating action includes an operation by the user to investigate the security set in the device or an action to investigate an operation log for the security.
The information processing device according to claim 1 . The avoidance behavior includes a behavior for disabling the security or a behavior for deleting an operation log in which an operation was performed against the security.
The information processing device according to claim 1 . The information processing device according to claim 1 , further comprising: a control unit that performs control based on the detection of the disruptive behavior. The information processing device according to claim 4 , wherein the control unit performs the control of notifying the disruptive behavior based on the detection of the disruptive behavior. The information processing device according to claim 4 , wherein the control unit performs the control of restricting use of the device used by the user or software of the device based on the detection of the disruptive behavior. The information processing device according to claim 4 , wherein the control unit performs control to store the evaluation in a storage unit in association with the user. The information processing device according to claim 1 , wherein the evaluation unit evaluates the user based on the disruptive behavior detected at a set time. The detection unit detects an operation of the user on a device of the organization that is different from the disruptive behavior,
The information processing apparatus according to claim 1 , wherein the evaluation unit performs different evaluations when the disruptive behavior is detected and when the user's operation on a device of the organization is different from the disruptive behavior. the information processing device is a server,
The information processing device according to claim 1 , further comprising: a control unit that controls transmission of information based on the detection of the disruptive behavior to the terminal of the organization. The information processing device according to claim 1 , wherein the information processing device is the device used by the user. The security includes security established by the organization to protect the organization's network.
The information processing device according to claim 1 . The information processing device according to claim 1 , wherein the security is set for a plurality of devices of the organization, including the device. The security includes software-based security.
The information processing device according to claim 1 . a step of detecting, by a detection unit, a disruptive behavior by a user who uses a device in the organization, the disruptive behavior being a behavior related to disrupting security set in the device;
and evaluating the user by an evaluation unit based on the detection of the disruptive behavior;
the disruptive behavior includes behavior of investigating the security set in the device and behavior of circumventing the security set in the device;
The step of making the evaluation makes different evaluations when the behavior to be investigated is detected and when the behavior to be avoided is detected.
Information processing methods. On the computer,
A process of detecting disruptive behavior by a user of an organization's device, which is behavior related to disrupting security set in the device ;
and performing a process of evaluating the user based on the detection of the disruptive behavior,
the disruptive behavior includes behavior of investigating the security set in the device and behavior of circumventing the security set in the device;
The evaluation is performed differently when the behavior to be investigated is detected and when the behavior to be avoided is detected.
program .