Management method, management device, and management program

• US 10,284,572 B2
• Filed: 02/25/2015
• Issued: 05/07/2019
• Est. Priority Date: 03/14/2014
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Terada, Takeaki, Katayama, Yoshinori, Morinaga, Masanobu, Takenaka, Masahiko
• Primary Examiner(s): Feild, Lynn D
• Assistant Examiner(s): Lakhia, Viral S
• Application Number:
  US14/631,359
• Publication Number:
  US 20150264075A1
• Time in Patent Office: 1,532 Days
• Field of Search: 726 25, 726 23, 705 729, 705500, 434236
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A management method comprising, extracting, using a processor, psychological characteristics that are characteristic of people who have experienced a certain incident; extracting, using the processor, behavioral characteristics that are characteristic of people who have experienced a certain incident; obtaining, using the processor, a relational expression between each item of the extracted psychological characteristics and a plurality of items of the extracted behavioral characteristics; and calculating, using the processor, a psychological characteristic value from the relational expression of each psychological characteristic item and a value of log data for each user and, distributing, using the processor, to any user whose psychological characteristic value exceeds a predetermined value, a measure devised for the exceeded psychological characteristic.

Claims

1. A management method comprising:

extracting, using a hardware processor, psychological characteristics of first people from psychological characteristics that are included in questionnaire answer data read from a storage device and derived from the first people and second people, the psychological characteristics including a degree of over confidence wherein the first people each have performed one or more of operations in an information processing system, the one or more operations including opening a malicious email attachment, wherein the second people each have not performed the one or more of operations, and the extracted psychological characteristics are each rated at values and are determined to be characteristic of the first people more than the second people by a difference that exceeds a first specific value;

extracting, using the hardware processor, behavioral characteristics of the first people from log data of operations performed with respect to the information processing system by the first people and the second people within a predetermined period, the log data including a time of patch application and being collected from the information processing system, stored in the storage device, and read therefrom, the extracted behavioral characteristics each including values and being determined to be characteristic of the first people more than the second people by a difference that exceeds a second specific value;

obtaining, using the hardware processor, by employing a regression analysis method, regression formulas that each describe a relationship between the value of each of the extracted psychological characteristics and the values of the extracted behavioral characteristics;

calculating at regular intervals, using the hardware processor, a value of each of the extracted psychological characteristics from the regression formulas and the log data that is read from the storage device at the regular intervals, for each user; and

improving security by delivering, using the hardware processor, to any user when the calculated value of any of the extracted psychological characteristics thereof exceeds a predetermined value, a corrective measure specifically devised for a psychological characteristic whose calculated value exceeds the predetermined value.

2. The management method according to claim 1, wherein the delivering a corrective measure includes delivering a corrective measure specifically devised for a psychological characteristic to a user when a calculated value of the psychological characteristic thereof falls within a region of a distribution of calculated values of the psychological characteristic of a plurality of users, the region being where a calculated value of the psychological characteristic of the first people is positioned and occupying a predetermined ration of the distribution.

3. A management device comprising a memory and a hardware processor coupled to the memory, the hardware processor executing a process including:

calculating at regular intervals, for each user, a value of each of psychological characteristics including a degree of over confidence from regression formulas and log data that includes a time of patch application, is collected from an information processing system, is stored in a storage device, and is read therefrom at the regular intervals, the regression formulas being obtained by employing a regression analysis method and each regression formula describing a relationship between a value of each of the psychological characteristics that are characteristic of people who each have performed one or more of operations in the information processing system, the one or more operations including opening a malicious email attachment, and values of behavioral characteristics that are characteristic of the people, so as to detect a user of which the calculated value of any of the psychological characteristics exceeds a predetermined value; and

improving security by delivering, to the detected user, a corrective measure specifically devised for a psychological characteristic whose calculated value exceeds the predetermined value.

4. A non-transitory computer-readable recording medium having stored therein a management program that causes a computer to execute a process comprising:

calculating at regular intervals, for each user, a value of each of psychological characteristics including a degree of over confidence from regression formulas and log data that includes a time of patch application, is collected from an information processing system, is stored in a storage device, and is read therefrom at the regular intervals, the regression formulas being obtained by employing a regression analysis method and each regression formula describing a relationship between a value of each of the psychological characteristics that are characteristic of people who each have performed one or more of operations in the information processing system, the one or more operations including opening a malicious email attachment, and values of behavioral characteristics that are characteristic of the people, so as to detect a user of which the calculated value of any of the psychological characteristics exceeds a predetermined value; and

improving security by delivering, to the detected user, a corrective measure devised for a psychological characteristic whose calculated value exceeds the predetermined value.