Extracting device, extracting method, and extracting program
An extraction device includes processing circuitry configured to collect, from an operating system (OS) of a computer operated by each of operators, an operation log indicating an operation of the computer of each of the operators when each of the operators operates the computer to conduct an investigation, and extract a series of operations common to the operators from collected operation logs of the operators and output the extracted series of operations.
1 . An extraction device comprising:
processing circuitry configured to:
collect, from an operating system (OS) of a computer operated by each of different human operators, an operation log indicating operations of the computer of each of the different human operators when each of the different human operators operates the computer to conduct an investigation;
extract a series of operations common to the different human operators from the collected operation logs of the different human operators; and
output the extracted series of operations.
2 . The extraction device according to claim 1 , wherein the processing circuitry is further configured to extract the series of operations common to the different human operators by applying a longest common subsequence to an operation sequence indicating a series of operations of each of the different human operators.
3 . The extraction device according to claim 1 , wherein the processing circuitry is further configured to;
extract an operation sequence for each n-gram from an operation sequence indicating a series of operations of each of the different human operators, and
extract, from among extracted n-gram operation sequences, an n-gram operation sequence having a degree of commonality among the different human operators of equal to or greater than a predetermined threshold as the series of operations common to the different human operators.
4 . The extraction device according to claim 1 , wherein the processing circuitry is further configured to:
create a state transition model indicating a state transition of the operation from an operation sequence indicating a series of operations of each of the different human operators, and
set a regular expression created from the created state transition model as the series of operations common to the different human operators.
5 . The extraction device according to claim 1 , wherein the processing circuitry is further configured to collect the operation log using a window function of the operating system to acquire operations recognizable by a human.
6 . The extraction device according to claim 1 , wherein the operation log includes a time-series record of operations performed by each different human operator on the computer.
7 . The extraction device according to claim 1 , wherein the processing circuitry is further configured to abstract the collected operation logs by replacing a number with a code representing the number or converting a selected character string into a code representing a character string type.
8 . The extraction device according to claim 7 , wherein the processing circuitry is further configured to convert the abstracted operation logs into identifiers representing content of the operation logs.
9 . The extraction device according to claim 1 , wherein the operation log includes at least two of a click, a key input, and a window interaction.
10 . The extraction device according to claim 1 , wherein the operation log includes at least two of setting a first window as an active window, selecting displayed text, copying a character string, setting a second window as the active window, pasting the character string, clicking a submit button, browsing a web page, and switching a tab of interest.
11 . The extraction device according to claim 1 , wherein the operation log includes at least three of setting a first window as an active window, selecting displayed text, copying a character string, setting a second window as the active window, pasting the character string, clicking a submit button, browsing a web page, and switching a tab of interest.
12 . The extraction device according to claim 1 , wherein the operation log includes at least four of setting a first window as an active window, selecting displayed text, copying a character string, setting a second window as the active window, pasting the character string, clicking a submit button, browsing a web page, and switching a tab of interest.
13 . The extraction device according to claim 1 , wherein the operation log includes at least five of setting a first window as an active window, selecting displayed text, copying a character string, setting a second window as the active window, pasting the character string, clicking a submit button, browsing a web page, and switching a tab of interest.
14 . The extraction device according to claim 1 , wherein the operation log includes at least six of setting a first window as an active window, selecting displayed text, copying a character string, setting a second window as the active window, pasting the character string, clicking a submit button, browsing a web page, and switching a tab of interest.
15 . The extraction device according to claim 1 , wherein extract the series of operations common to the different human operators from the collected operation logs of the different operators includes analyzing sequences of the operations to find patterns common to the different operators.
16 . The extraction device according to claim 1 , wherein the investigation is an investigation into a security breach.
17 . The extraction device according to claim 1 , wherein the investigation is an investigation into a network failure.
18 . An extraction method executed by an extraction device, the extraction method comprising:
collecting, from an operating system (OS) of a computer operated by each of different human operators, an operation log indicating operations of the computer of each of the different human operators when each of the different human operators operates the computer to conduct an investigation;
extracting a series of operations common to the different human operators from the collected operation logs of the different human operators; and
outputting the extracted series of operations.
19 . A non-transitory computer-readable recording medium storing therein an extraction program that causes a computer to execute a process comprising:
collecting, from an operating system (OS) of a computer operated by each of different human operators, an operation log indicating operations of the computer of each of the different human operators when each of the different human operators operates the computer to conduct an investigation;
extracting a series of operations common to the different human operators from the collected operation logs of the different human operators; and
outputting the extracted series of operations.