Unauthorized operation judgment system, unauthorized operation judgment method, and unauthorized operation judgement program

摘要

An unauthorized-operation-judgment system judges whether an operation received by a computer is an unauthorized operation by referencing a profile to find a peculiar action. This system can handle an unauthorized operation due to a change of a computer be an authorized user and unauthorized operation by a new user whose user profile is not yet created. When a user executes a certain operation, the operation tendency and th operation tendency executed by the user are learned to create a node profile and a user, profile, which are stored in a node-profile-state table and a user-profile-state table of each user, respectively. The node profile and the user profile thus created are referenced so as to perform deviation calculation between the operation received and the normal operation pattern, thereby judging whether the operation is peculiar and calculating the possibility of an unauthorized operation as a score valve.