JP7800682B2 - Specific device, specific method, and specific program - Google Patents

Description

The present invention relates to a specific device, a specific method, and a specific program.

Generally, companies' business improvement processes involve grasping the actual state of operations through manual interviews and estimating workloads through observation and time measurement, identifying problem areas, and then considering improvement proposals. However, grasping the actual state of operations through interviews and other methods requires time and can be biased toward the subjective views of a few workers, resulting in problems with accuracy and comprehensiveness.

In response to this, one method for improving corporate operations is to acquire terminal operation logs and visualize operation events. By acquiring and visualizing terminal operation logs, it becomes possible to grasp the actual state of business operations more efficiently, broadly, and at a finer granularity. Here, data items included in operation logs may include, for example, user name, terminal name, application name, window title, URL/file path, and window handle.

One visualization method is a timeline format (hereafter referred to as a timeline) in which time is assigned to the x-axis (or y-axis), elements are arranged on the y-axis (or x-axis), and the duration of each element is represented by a rectangle. This is suitable for intuitively understanding the context and co-occurrence of window usage on a device. For example, if you want to understand the actual work status of each worker, displaying a timeline hierarchically by user name, application name, and window title will allow you to understand the application usage status of each worker.

Japanese Patent Application Laid-Open No. 2020-77174

However, with conventional technology, for tasks in which one worker uses multiple terminals and IDs, a configuration file had to be created manually, combining IDs for each worker, which was a time-consuming process.

For example, for various reasons, a single worker may perform their work using multiple devices and IDs. For example, the same worker may be assigned a device and ID for each domain established according to the purpose of use. For example, a domain may be one with a high security level that connects to a customer database, etc., and another domain that can connect to external networks such as the Internet and email. Generally, these domains have different security levels and are operated on independent networks, and there are environments in which the devices that can connect to them are also different.

In such an environment, conventional methods display timelines by device name or ID, making it difficult to grasp the actual work status of a worker when one worker uses multiple devices or IDs.

In such an environment, one method is for analysts to create a configuration file that combines IDs for each worker, allowing timelines for the same worker to be displayed in the same group. However, this poses the problem of requiring analysts to know each worker's ID in advance and create the configuration file, which is time-consuming.

The present invention has been made in consideration of the above, and aims to provide an identification device, identification method, and identification program that can grasp the actual work status of each worker without human intervention, even in an environment where one worker uses multiple IDs.

In order to solve the above-mentioned problems and achieve the objectives, the identification device of the present invention is characterized by having an extraction unit that extracts identifiers contained in each specified area, a calculation unit that calculates the degree of overlap in time of operation events for combinations of identifiers from different areas among the identifiers extracted by the extraction unit, using operation events corresponding to each identifier, and an identification unit that identifies combinations of identifiers of the same worker based on the degree of overlap calculated by the calculation unit.

According to the present invention, it is possible to easily grasp the actual work status of each worker.

FIG. 1 is a block diagram illustrating the configuration of a specific device according to this embodiment. FIG. 2 is a diagram in which the occurrence times of operation events are plotted on the time axis. FIG. 3 is a diagram illustrating the overlap degree calculation process performed by the calculation unit. FIG. 4 is a diagram illustrating the identification process performed by the identification unit. FIG. 5 is a flowchart illustrating an example of a processing procedure performed by the identifying device according to the embodiment. FIG. 6 is a diagram illustrating a computer that executes a program.

The following describes in detail embodiments of the specific device, specific method, and specific program according to the present application, with reference to the accompanying drawings. Furthermore, the present invention is not limited to the embodiments described below.

[Configuration of specific device]
FIG. 1 is a block diagram illustrating the configuration of a specific device according to this embodiment. As shown in FIG. 1, the specific device 10 according to this embodiment is connected to a terminal device 20 via a network (not shown). Note that the connection between the devices is not limited to being via a network, and any connection form may be used, whether wired or wireless. Also, while FIG. 1 illustrates a case in which the specific device 10 is connected to one terminal device 20, it may also be connected to multiple terminal devices 20.

The identification device 10 reads the operation log and extracts the IDs recorded for each domain. The identification device 10 then extracts all combinations of the extracted domain IDs between domains and calculates the degree of overlap in the occurrence times of operation events for each combination. The identification device 10 then identifies combinations with the lowest calculated overlap as ID combinations used by the same worker. Through the above process, the identification device 10 can automatically create configuration files for ID combinations for each worker in an environment where multiple IDs are assigned to the same worker. This allows the identification device 10 to grasp the actual work status of each worker without human intervention, even in an environment where a single worker uses multiple terminals. The identification device 10 may be any type of information processing device, including a server.

The terminal device 20 is an information processing device used by a user. The user may be, for example, a business person. The business person may use various software, such as a business system or general-purpose applications, on the terminal device 20. The terminal device 200 may be any type of information processing device, including client devices such as smartphones, desktop PCs, notebook PCs, and tablet PCs. In the example of Figure 1, the specific device 10 and the terminal device 20 are separate devices, but the terminal device 20 may have some or all of the functions of the specific device 10.

At the timing of an operation event, the terminal device 20 acquires an operation log including the operation time, operation location, operation position, etc. Here, in order to record the operation content on the terminal device 20 as a log, the terminal device 20 generates an operation log that serves as the basis for analysis, including information on the operation type and operation location, which are the smallest units of an RPA scenario, by, for example, detecting events that occur in conjunction with the operation from the OS or GUI framework and acquiring information on GUI components. The terminal device 20 then transmits the operation log to the identification device 10.

The specific device 10 receives the operation log acquired by the terminal device 20 and stores it in the operation log memory unit 13a of the memory unit 13. The specific device 10 and the terminal device 20 may send and receive the operation log at any timing; for example, they may send and receive at a predetermined time interval, or they may send and receive each time the terminal device 20 acquires an operation log.

The specific device 10 has a communication processing unit 11, a control unit 12, and a memory unit 13. The processing of each unit of the specific device 10 is explained below.

The communication processing unit 11 is realized using a NIC (Network Interface Card) or the like, and controls communication between the control unit 12 and external devices via telecommunications lines such as a LAN (Local Area Network) or the Internet. For example, the communication processing unit 11 receives an operation log from the terminal device 20.

The memory unit 13 stores data and programs necessary for various processes performed by the control unit 12, and has an operation log memory unit 13a. For example, the memory unit 13 is a semiconductor memory element such as RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or optical disk.

The operation log storage unit 13a stores operation logs obtained from the terminal device 20. For example, the operation log storage unit 13a stores, for each domain, a table containing the following columns as operation logs: "Event occurrence time," which is the time when the operation event occurred; "User name," which indicates the user who performed the operation; "Window title," which indicates the window title of the window that was operated on; and "Application name," which indicates the application that was operated on. Note that the information contained in the operation log is merely an example and is not limited to this.

A domain here refers to a specific area set according to the purpose of use. For example, there are domains that are connected to customer databases and have a high level of security, and domains that can connect to external networks such as the Internet and email.

The control unit 12 has an internal memory for storing programs that define various processing procedures and required data, and executes various processes using these. For example, the control unit 12 has an extraction unit 12a, a calculation unit 12b, and an identification unit 12c. Here, the control unit 12 is an electronic circuit such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

The extraction unit 12a extracts, for each domain (predetermined area), an ID (identifier) belonging to that domain. For example, the extraction unit 12a reads the operation log from the operation log storage unit 13a and extracts the ID recorded for each domain. Here, the extraction unit 12a may extract, as the ID, other identifiers, such as a user ID or user name that identifies a user, a terminal ID or terminal name that identifies a terminal, or the like, from the operation log.

The calculation unit 12b calculates the degree of overlap in time of operation events for combinations of IDs from different domains among the IDs extracted by the extraction unit 12a, using the operation events corresponding to each ID. For example, the calculation unit 12b extracts all combinations of IDs from each domain with IDs from other domains, and calculates the degree of overlap in time of operation events for each combination.

Furthermore, when the calculation unit 12b knows only the time when an operation event is spoken and does not know the end time, it calculates the degree of overlap by setting a certain time range before and after the event occurrence time. This is because an operation is instantaneous and therefore a certain range is necessary.

Here, we will explain the degree of overlap of operation events. Figure 2 is a diagram in which the occurrence times of operation events are plotted on the time axis. In the example of Figure 2, there are two domains, A and B. Domain A has IDs A1, A2, and A3, while domain B has IDs B1, B2, B3, and B4 related to workers. Assume that operation logs such as those shown in Figure 2 are obtained through the operations of the workers. In this case, the extraction unit 12a reads the operation logs and extracts IDs "A1," "A2," and "A3" from domain A and IDs "B1," "B2," "B3," and "B4" from domain B.

Figure 2 plots the occurrence times of operation events recorded in the operation logs obtained from each terminal device 20 on the time axis. For example, the example in Figure 2 shows that operation events occurred at 10:00, 10:30, 12:30, etc. for ID "A1" of domain A.

Next, the overlap degree calculation process performed by the calculation unit 12b will be described using Figure 3. Figure 3 is a diagram illustrating the overlap degree calculation process performed by the calculation unit. As illustrated in Figure 3, the calculation unit 12b extracts all combinations between domains for each domain ID and calculates the degree of overlap for the operation event. For example, the calculation unit 12b calculates the overlap degree as "1" if the overlap occurs within 5 minutes before and after the operation event occurrence time, and "0.5" if the overlap occurs within 10 minutes before and after the operation event occurrence time. Note that the method for calculating the overlap degree of the operation event is not limited to this, and other methods, such as a normal distribution, may also be used.

In addition, when each operation event in the operation log includes a start time and an end time, the calculation unit 12b may determine whether the period from the start time to the end time of each operation event overlaps with the period from the start time to the end time of another operation event, and if the periods overlap, calculate the degree of overlap as "1".

The identification unit 12c identifies combinations of IDs belonging to the same worker based on the degree of overlap calculated by the calculation unit 12b. For example, the identification unit 12c identifies combinations of IDs whose degree of overlap is equal to or less than a predetermined threshold as combinations of IDs belonging to the same worker.

To explain using the example of Figure 3, for example, the identification unit 12c finds combinations with low overlap, as illustrated in Figure 4, and identifies combinations A1 and B2, A2 and B3, and A3 and B1 as combinations of IDs of the same worker. Note that in the example of Figure 4, the predetermined threshold is set to "0." In other words, the identification unit 12c identifies combinations A1 and B2, A2 and B3, and A3 and B1 as combinations of IDs of the same worker, as combinations of IDs with a degree of overlap of "0." Note that in the example of Figure 4, it is assumed that there is no ID combination in domain A for worker B4, either because there is no ID in domain A or because there was no work in domain A during this period.

[Processing Procedure of Identifying Device 10]
Next, an example of a processing procedure executed by the identifying device 10 will be described with reference to Fig. 5. Fig. 5 is a flowchart showing an example of a processing procedure executed by the identifying device of the embodiment.

As illustrated in FIG. 5, the extraction unit 12a of the identification device 10 reads the operation log from the operation log storage unit 13a and extracts the IDs recorded for each domain (step S101). The calculation unit 12b then extracts all combinations of the IDs of each domain between domains and calculates the degree of overlap in the occurrence times of operation events for each combination (step S102).

Next, the identification unit 12c identifies combinations with a small degree of overlap as combinations of IDs by the same worker (step S103). For example, the identification unit 12c identifies combinations of IDs with a degree of overlap equal to or less than a predetermined threshold as combinations of IDs by the same worker.

[Effects of the embodiment]
In this manner, the identifying device 10 according to the embodiment extracts, for each domain, the IDs included in that domain. Then, for combinations of IDs from different domains among the extracted IDs, the identifying device 10 calculates the degree of overlap in time of operation events using operation events corresponding to each ID. Next, the identifying device 10 identifies combinations of IDs of the same worker based on the calculated degree of overlap. This allows the identifying device 10 to easily grasp the actual work status of each worker.

In other words, the identifying device 10 enables automatic creation of a configuration file for each worker's ID combination in an environment where multiple IDs are assigned to the same worker. This allows the identifying device 10 to grasp the actual work status of each worker without human intervention, even in an environment where one worker uses multiple terminals.

[System configuration, etc.]
The components of each device shown in the drawings according to the above embodiments are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the drawings, and all or part of the devices can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods. In addition, the information, including the processing procedures, control procedures, specific names, various data, and parameters shown in the above documents and drawings, can be changed as desired unless otherwise specified.

〔program〕
It is also possible to create a program written in a computer-executable language that executes the processes executed by the specific device described in the above embodiments. In this case, the same effects as those of the above embodiments can be achieved by having a computer execute the program. Furthermore, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by a computer to achieve the same processes as those of the above embodiments.

Figure 6 is a diagram showing a computer that executes a program. As illustrated in Figure 6, the computer 1000 has, for example, memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070, and each of these components is connected by a bus 1080.

As illustrated in FIG. 6, the memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090 as illustrated in FIG. 6. The disk drive interface 1040 is connected to a disk drive 1100 as illustrated in FIG. 6. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052 as illustrated in FIG. 6. The video adapter 1060 is connected to a display 1061 as illustrated in FIG. 6.

Here, as illustrated in FIG. 6, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. In other words, the above programs are stored, for example, on the hard disk drive 1090 as program modules that describe instructions to be executed by the computer 1000.

In addition, the various data described in the above embodiments are stored as program data, for example, in memory 1010 or hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed, and executes various processing procedures.

The program module 1093 and program data 1094 related to the program do not necessarily have to be stored on the hard disk drive 1090, but may be stored, for example, on a removable storage medium and read by the CPU 1020 via a disk drive or the like. Alternatively, the program module 1093 and program data 1094 related to the program may be stored in another computer connected via a network (such as a LAN (Local Area Network), WAN (Wide Area Network)), and read by the CPU 1020 via the network interface 1070.

The above describes an embodiment of the invention made by the inventor, but the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention according to this embodiment. In other words, all other embodiments, examples, operational techniques, etc. made by those skilled in the art based on this embodiment are included in the scope of the present invention.

REFERENCE SIGNS LIST 10 Identifying device 11 Communication unit 12 Control unit 12a Extraction unit 12b Calculation unit 12c Identification unit 13 Storage unit 13a Operation log storage unit

Claims (6)

an extraction unit that extracts, for each predetermined area, an identifier included in the area;
a calculation unit that calculates a degree of overlap in time of operation events for a combination of identifiers in different regions among the identifiers extracted by the extraction unit, using occurrence times of operation events corresponding to each identifier;
and an identification unit that identifies a combination of identifiers of the same worker based on the degree of overlap calculated by the calculation unit. The identification device described in claim 1, characterized in that the calculation unit extracts all combinations of identifiers of each area with identifiers of other areas, and calculates the degree of temporal overlap of operation events for each combination. The identification device described in claim 1, characterized in that the identification unit identifies combinations of identifiers for which the degree of overlap calculated by the calculation unit is below a predetermined threshold as combinations of identifiers created by the same worker. The identification device described in claim 1, characterized in that the extraction unit reads the operation log and extracts the identifier recorded for each area from the operation log. A specific method executed by a specific device, comprising:
an extraction step of extracting, for each predetermined area, an identifier included in the area;
a calculation step of calculating a degree of overlap in time of operation events for a combination of identifiers in different regions among the identifiers extracted by the extraction step, using occurrence times of operation events corresponding to each identifier;
and a specifying step of specifying a combination of identifiers of the same worker based on the degree of overlap calculated in the calculating step. an extraction step of extracting, for each predetermined area, an identifier included in the area;
a calculation step of calculating a degree of overlap in time of operation events for combinations of identifiers in different regions among the identifiers extracted by the extraction step, using occurrence times of operation events corresponding to each identifier;
and a specifying step of specifying a combination of identifiers of the same worker based on the degree of overlap calculated in the calculating step.