Investigation apparatus, computer-readable recording medium, and investigation method
An investigation apparatus according to an embodiment includes a processor that executes a process including: analyzing uniqueness of a plurality of values included in an attribute for each attribute of a table; reducing a plurality of values included in an attribute of which the analyzed uniqueness is lower than a predetermined value by a predetermined ratio with respect to an investigation original table and outputting a feature of the investigation original table; reducing a plurality of values included in an attribute of which the analyzed uniqueness is higher than a predetermined value by a predetermined ratio with respect to an investigation target table and outputting a feature of the investigation target table; and investigating similarity of the investigation target table to the investigation original table by comparing the feature of the investigation original table with the feature of the investigation target table.
1. An investigation apparatus comprising a memory and a microprocessor coupled to the memory, the microprocessor executing a process comprising:
inputting investigation original tables obtained from a database;
analyzing uniqueness of a plurality of values included in an attribute for each attribute of each of the investigation original tables;
reducing a plurality of values included in a first attribute of which the analyzed uniqueness is lower than a predetermined value by a predetermined ratio with respect to each of the investigation original tables and first outputting a feature of each of the investigation original tables to a storage unit based on values that are not reduced;
inputting an investigation target table that includes confidential information that is leaked;
analyzing uniqueness of a plurality of values included in an attribute for each attribute of the investigation target table;
reducing a plurality of values included in a second attribute of which the analyzed uniqueness is higher than a predetermined value by a predetermined ratio with respect to the investigation target table and second outputting a feature of the investigation target table based on values that are not reduced;
calculating a similarity of the investigation target table to each of the investigation original tables by comparing the feature of each of the investigation original tables stored in the storage unit with the feature of the investigation target table; and
determining an investigation original table among the investigation original tables from which the confidential information is leaked and the investigation target table has been derived, based on the calculated similarity.
2. The investigation apparatus according to claim 1 , wherein the first outputting reduces a plurality of the values included in the first attribute by a ratio corresponding to a ratio based on a number of unique values included in the first attribute and a number of records of each of the investigation original tables.
3. The investigation apparatus according to claim 1 , wherein the second outputting reduces a plurality of the values included in the second attribute by a ratio corresponding to a ratio based on a number of unique values included in the second attribute and a number of records of the investigation target table.
4. The investigation apparatus according to claim 1 , wherein
the each attribute is defined for each of a plurality of individuals
and the comparing includes comparing values included in the feature of each of the investigation original tables with values included in the feature of the investigation target table.
5. A non-transitory computer-readable recording medium having stored therein a program that causes a computer to execute a process comprising:
inputting investigation original tables obtained from a database;
analyzing uniqueness of a plurality of values included in an attribute for each attribute of each of the investigation original tables;
reducing a plurality of values included in a first attribute of which the analyzed uniqueness is lower than a predetermined value by a predetermined ratio with respect to each of the investigation original tables and first outputting a feature of each of the investigation original tables to a storage unit based on values that are not reduced;
inputting an investigation target table that includes confidential information that is leaked;
analyzing uniqueness of a plurality of values included in an attribute for each attribute of the investigation target table;
reducing a plurality of values included in a second attribute of which the analyzed uniqueness is higher than a predetermined value by a predetermined ratio with respect to the investigation target table and second outputting a feature of the investigation target table based on values that are not reduced;
calculating a similarity of the investigation target table to each of the investigation original tables by comparing the feature of each of the investigation original tables stored in the storage unit with the feature of the investigation target table; and
determining an investigation original table among the other investigation original tables from which the confidential information is leaked and the investigation target table has been derived, based on the calculated similarity.
6. The non-transitory computer-readable recording medium according to claim 5 , wherein the first outputting reduces a plurality of the values included in the first attribute by a ratio corresponding to a ratio based on a number of unique values included in the first attribute and a number of records of each of the investigation original tables.
7. The non-transitory computer-readable recording medium according to claim 5 , wherein the second outputting reduces a plurality of the values included in the second attribute by a ratio corresponding to a ratio based on a number of unique values included in the second attribute and a number of records of the investigation target table.
8. A computer-implemented method comprising:
inputting investigation original tables obtained from a database, by a processor;
analyzing uniqueness of a plurality of values included in an attribute for each attribute of each of the investigation original tables by the processor;
reducing a plurality of values included in a first attribute of which the analyzed uniqueness is lower than a predetermined value by a predetermined ratio with respect to each of the investigation original tables and first outputting a feature of each of the investigation original tables to a storage unit based on values that are not reduced, by the processor;
inputting an investigation target table that includes confidential information that is leaked, by the processor;
analyzing uniqueness of a plurality of values included in an attribute for each attribute of the investigation target table, by the processor;
reducing a plurality of values included in a second attribute of which the analyzed uniqueness is higher than a predetermined value by a predetermined ratio with respect to the investigation target table and second outputting a feature of the investigation target table based on values that are not reduced, by the processor;
calculating a similarity of the investigation target table to each of the investigation original tables by comparing the feature of each of the investigation original tables stored in the storage unit with the feature of the investigation target table, by the processor; and
determining an investigation original table among the investigation original tables from which the confidential information is leaked and the investigation target table has been derived, based on the calculated similarity, by the processor.
9. The computer-implemented method according to claim 8 , wherein the first outputting reduces a plurality of the values included in the first attribute by a ratio corresponding to a ratio based on a number of unique values included in the first attribute and a number of records of each of the investigation original tables.
10. The computer-implemented according to claim 8 , wherein the second outputting reduces a plurality of the values included in the second attribute by a ratio corresponding to a ratio based on a number of unique values included in the second attribute and a number of records of the investigation target table.