JP2010061254A - Method, device, and program for analyzing behavioral history - Google Patents

Abstract

A method for easily determining whether or not a user ID has been transferred by determining whether or not a user's behavior has changed is provided.
An action history reading step of reading an action history stored in advance by associating a user ID and a feature vector having a feature value indicating a characteristic of each feature item characterizing the user's action as a component; and the whole part or of the feature vectors stored in the action history as teacher data, separation than the separation and feature vector associated with one user ID, the feature vector associated with another user ID, and The feature vector associated with the one user ID that is not the teacher data is calculated as a plane, and belongs to the region that includes the teacher data associated with the user ID among the regions separated by the separation hyperplane. If not, at least a behavior history analysis step of determining that the behavior of the user corresponding to the one user ID has changed is executed.
[Selection] Figure 4

Description

  The present invention relates to an action history analysis method, apparatus, and program for analyzing a user's action history.

In recent years, user IDs are used in various Internet services. For example, when using webmail, it is necessary to log in by entering a user ID and password.
[Online], YAHOO! JAPAN Mail, [Search July 29, 2008], Internet <URL: https: // login. yahoo. co. jp / config / login? . src = www &. done = http: // www. yahoo. co. jp>

  However, in the conventional Internet service, it has not been possible to easily determine whether or not the user ID has been transferred to another person (including theft; the same applies hereinafter). This is because it is presumed that the person who has entered the correct user ID and password and logged in is the person himself / herself.

  The present invention is proposed in view of such circumstances, and it is easy to determine whether or not a user ID has been transferred by determining whether or not the user's behavior has changed based on a predetermined rule. It is an object of the present invention to provide an action history analysis method, apparatus, and program that can be determined in a simple manner.

  In order to achieve the above object, the present inventor has found a method for determining whether or not a user's behavior has changed based on a predetermined rule, and has come up with the present invention.

  The behavior history analysis method according to the present invention classifies a feature vector having a feature value indicating a characteristic of each feature item characterizing the user's behavior according to a predetermined rule, and whether the user's behavior has changed. By determining whether or not, the user ID is easily determined whether or not the user ID has been transferred.

(1) An action history reading step in which a computer reads an action history stored in association with a user ID and a feature vector having a feature value indicating a feature for each feature item characterizing the user's behavior in advance, Using part or all of the feature vectors stored in the read action history as teacher data, the feature vector associated with one user ID and the feature vector associated with another user ID are separated by machine learning,
Behavior history analysis that determines that the behavior of the user corresponding to the one user ID has changed when the feature vector associated with the one user ID that is not teacher data does not belong to the region associated with the user ID And an action history analysis method characterized in that at least steps are executed.

  Here, as the feature item, for example, a search query for a search engine, browsing of contents such as news, contents of a web scheduler such as a calendar, the tone of a blog, the tone of a messenger, the tone of an email, and the like correspond. These feature items tend to be user-specific and characterize the user's behavior. Also, as the feature value, according to the dialect of each region, for example, “1” for “Kansai dialect” and “2” for “Tohoku dialect” for email tone as a feature item. A predetermined numerical value may be assigned. Teacher data refers to correspondence between given data and its attributes. As the teacher data, for example, the correspondence that the predetermined feature vector A belongs to the user A corresponds. There are many methods for machine learning. For example, support vector machine (SVM; see V. Vapnik, “The Nature of Statistical Learning Theory”, Springer, (1995), etc.) May be used.

  According to the invention of (1), whether or not the behavior of the user corresponding to the user ID has changed depending on which of the regions separated by machine learning (for example, SVM) the feature vector associated with the user ID belongs. Therefore, it can be easily determined whether or not the user ID has been transferred.

  (2) When it is determined that the user's behavior corresponding to the one user ID has changed, the fact that the one user ID may be transferred is output. Behavior history analysis method.

  According to the invention of (2), when it is determined that the behavior of the user corresponding to the one user ID has changed, the fact that the one user ID may be transferred is output. Can be easily recognized.

  Here, the fact that there is a possibility that the one user ID has been transferred may be output, and login using this user ID may be prohibited. According to this, when the user ID is stolen or the like, unauthorized login can be prevented.

  (3) When the feature vector associated with the one user ID belongs to an area in which teacher data associated with the other user ID is included in an area separated by a separation hyperplane in a support vector machine. In addition, the behavior history analysis method according to (1), wherein an advertisement previously associated with the component of the feature vector is transmitted to an e-mail address previously associated with the one user ID.

  According to the invention of (3), when it is determined that the user's behavior has changed, the advertisement associated in advance with the component of the feature vector that is the basis of the determination is distributed. Can do. Here, only for a feature value that is a component of a feature vector has changed, an advertisement associated with the changed feature value may be extracted from a predetermined storage unit and passed to the analysis result output unit 13. . For example, when the feature value of an Internet shopping history as a feature item changes from a value corresponding to “car” to a value corresponding to “children's goods”, an advertisement associated with “children's goods” is displayed. It is possible to deliver. According to this, it is possible to prevent the advertisement associated with the unchanged feature value from being delivered.

  (4) Action history reading means for reading an action history stored in association with a user ID and a feature vector having a feature value indicating a feature for each feature item that characterizes the user's behavior as a component; A separation hyperplane that separates a feature vector associated with one user ID and a feature vector associated with another user ID using a part or all of the feature vectors stored in the action history as teacher data. The feature vector calculated and associated with the one user ID that is not the teacher data does not belong to the region that includes the teacher data associated with the user ID among the regions separated by the separation hyperplane. And an action history analyzing means for judging that the action of the user corresponding to the one user ID has changed, and an analysis result output for outputting the judged result. Action history analysis apparatus characterized by comprising: a stage, a.

  (5) A program that causes a computer to execute the method according to (1).

  According to this invention, it is determined whether the user's action corresponding to the user ID has changed according to which of the regions separated by the separation hyperplane the feature vector associated with the user ID belongs. It can be easily determined whether or not the ID has been transferred.

Hereinafter, the best mode for carrying out the present invention will be described with reference to the drawings. This is merely an example, and the technical scope of the present invention is not limited to this.
[Functional structure of action history analyzer]

  FIG. 1 is a diagram showing an outline of a functional configuration of the behavior history analysis apparatus 1 according to the present embodiment. The behavior history analysis apparatus 1 according to the present embodiment analyzes a user's behavior history, and includes a behavior history reading unit 11, a behavior history analysis unit 12, and an analysis result output unit 13.

  The action history reading means 11 reads the data of the action history database 14 storing the user's action history and passes it to the action history analysis means 12. Here, the action history database 14 constitutes a part of the action history reading means 11. Details of the action history database 14 will be described later.

  The behavior history analysis means 12 analyzes the data of the behavior history database 14 received from the behavior history reading means, and determines whether or not the user behavior has changed. Then, the action history analysis unit 12 passes the determination result to the analysis result output unit 13.

The analysis result output means 13 outputs the determination result received from the action history analysis means 12 to a display device such as a display.
[Configuration of the action history database]

  FIG. 2 is a diagram showing an outline of the configuration of the action history database 14.

  The behavior history database 14 includes a search query table, a content browsing table, a schedule content table, a blog tone table, and a mail tone table as tables for each feature item that characterizes the user's behavior.

  The search query table stores a user ID, a feature value indicating a characteristic of a search query for a search engine as a feature item, and a period in advance in association with each other. As the feature value, for example, “1” if the word included in the search query is a word related to “car” and “2” if it is a word related to “children's goods”, according to a predetermined category. Assign a predetermined number.

  The content browsing table stores a user ID, a feature value indicating a browsing characteristic of content such as news as a feature item, and a period in association with each other in advance. As the feature value, for example, the content viewed by the user corresponding to the user ID is “1” if the content is related to “car”, and “2” if the content is related to “children's goods”. A predetermined numerical value is assigned according to the category.

  The schedule content table stores a user ID, a feature value indicating a characteristic of the content of a web scheduler such as a calendar as a feature item, and a period in advance in association with each other. As the feature value, for example, a predetermined category such as “1” if the schedule of the user corresponding to the user ID is a plan related to “work” and “2” if the schedule is related to “private” is used. A predetermined numerical value is assigned according to

  The blog tone table stores in advance a user ID, a feature value indicating a tone characteristic of the blog as a feature item, and a period in association with each other. As the feature value, for example, a predetermined numerical value is assigned according to the dialect of each region, such as “1” if the tone of the blog is “Kansai dialect” and “2” if “Tohoku dialect”. As a method for specifying the tone, for example, the ending of the blog sentence as the sentence related to the feature item is divided by the morphological analysis and the ending of the dialect for each locality stored in a predetermined storage means is compared. To identify the dialect. Note that morpheme analysis refers to dividing a given sentence into the smallest grammatically meaningful units (morphemes). As the morphological analysis, for example, morphological analysis using a hidden Markov model is applicable.

  The mail tone table stores in advance a user ID, a feature value indicating a tone characteristic of an electronic mail as a feature item, and a period in association with each other. As the feature value, for example, a predetermined numerical value is assigned according to the dialect of each region, such as “1” if the tone of the electronic mail is “Kansai dialect” and “2” if “Tohoku dialect”. The method for specifying the tone is the same as the method for specifying the tone of the blog.

The above-described behavior history database 14 is configured so that a user ID, a feature vector having a feature value indicating a characteristic for each feature item as a component, and a period are associated with each other and stored in the behavior history database 14 in advance. means. Here, the first to fifth components of the feature vector are feature values of the search query table, content browsing table, schedule content table, blog tone table, and mail tone table, respectively.
[Hardware configuration diagram of action history analyzer]

  FIG. 3 is a diagram illustrating a hardware configuration of the action history analysis apparatus 1 according to the present embodiment.

  The behavior history analysis apparatus 1 includes a CPU (Central Processing Unit) 310 (a plurality of CPUs such as a CPU 320 may be added in a multiprocessor configuration), a bus line 200, a communication I / F (I / F). : Interface) 330, main memory 340, BIOS (Basic Input Output System) 350, display device 355, I / O controller 360, hard disk 370, optical disk drive 380, and semiconductor memory 390. The hard disk 370, the optical disk drive 380, and the semiconductor memory 390 are collectively referred to as a storage device 410.

  The control unit 300 is a part that controls the behavior history analysis apparatus 1 in an integrated manner. By appropriately reading and executing various programs stored in the hard disk 370 (described later), the control unit 300 cooperates with the hardware described above. Various functions according to the invention are realized.

  The communication I / F 330 is a network adapter when the behavior history analysis apparatus 1 transmits / receives information to / from an external apparatus via a communication network. The communication I / F 330 may include a modem, a cable modem, and an Ethernet (registered trademark) adapter.

  The BIOS 350 records a boot program executed by the CPU 310 when the action history analysis apparatus 1 is started, a program that the action history analysis apparatus 1 depends on hardware, and the like.

  The display device 355 displays a screen for accepting data input or displays a screen for outputting a result, and includes a display device such as a cathode ray tube display device (CRT) or a liquid crystal display device (LCD).

  A storage device 410 such as a hard disk 370, an optical disk drive 380, and a semiconductor memory 390 can be connected to the I / O controller 360.

  The hard disk 370 stores various programs for causing the hardware to function as the action history analysis apparatus 1, programs for executing the functions of the present invention, and the like. In addition, the action history analyzer 1 can also use a hard disk (not shown) separately provided as an external storage device.

  As the optical disk drive 380, for example, a DVD-ROM drive, a CD-ROM drive, a DVD-RAM drive, or a CD-RAM drive can be used. In this case, the optical disk 400 corresponding to each drive is used. A program or data can be read from the optical disk 400 by the optical disk drive 380 and provided to the main memory 340 or the hard disk 370 via the I / O controller 360.

  The action history analysis device 1 is configured by an information processing device including a storage device 410, a control unit 300, and the like, and this information processing device is included in the concept of the computer of the present invention.

In this behavior history analysis apparatus 1, the control unit 300 mainly corresponds to the behavior history analysis means 12, the main memory 340 mainly corresponds to the behavior history reading means 11, and the display device 355 or the communication I / F 330 corresponds to the analysis result output means 13. Corresponding to
[Flowchart According to Embodiment of the Present Invention]

  FIG. 4 shows a flowchart of the action history analysis process according to the embodiment of the present invention.

  S1: The action history reading means 11 reads the feature vector associated with each user ID in the past predetermined period (for example, from January 1, 2008 to January 4, 2008) from the action history database 14. Then, it passes to the action history analysis means 12. That is, the behavior history reading unit 11 reads the feature value associated with each user ID in the past predetermined period from each table of the behavior history database 14 and passes it to the behavior history analysis unit 12.

  S2: The action history analysis unit 12 calculates a separation hyperplane for separating the feature vector for each user ID, using the feature vector received from the action history reading unit 11 as teacher data. Here, the separation hyperplane is calculated by a support vector machine. In the support vector machine, the linear programming method is used to increase the distance between the feature vector associated with one user ID that is teacher data and the feature vector associated with another user ID that is teacher data. A plane is calculated.

  S3: The action history reading means 11 reads the feature vector associated with each user ID in a predetermined period (for example, from June 2008 to July 2008) from the action history database 14, and the action history Pass to analysis means 12. That is, the action history reading unit 11 reads a feature value associated with each user ID in a predetermined period from each table of the action history database 14 and passes it to the action history analysis unit 12. The designation of the period may be accepted by a predetermined input means such as a keyboard.

  S4: The action history analysis means 12 analyzes the feature vector associated with each user ID received from the action history reading means 11 using a separation hyperplane calculated for each user ID. . That is, the behavior history analysis means 12 has its own user ID (00001) in the region where the feature vector associated with one user ID (for example, 00001) that is not teacher data is separated on the separation hyperplane of this user ID. If the user does not belong to the area associated with, it is determined that the user's behavior corresponding to one user ID (00001) has changed. Alternatively, it may be determined that the behavior of the user corresponding to one user ID (00001) has changed when belonging to an area in which teacher data associated with another user ID (for example, 00002) is included. On the other hand, the behavior history analysis unit 12 determines that the behavior of the user corresponding to one user ID (00001) has not changed when the above condition is not satisfied. Then, the behavior history analysis unit 12 passes the feature vector associated with each user ID and the determination result for each user ID to the analysis result output unit 13 during a period specified in advance.

  S5: The analysis result output unit 13 outputs the feature vector associated with each user ID received from the action history analysis unit 12 and the determination result for each user ID to the display device. FIG. 5 is an example of a screen in which a feature vector associated with each user ID and a determination result for each user ID are output to the display device. In this screen, a feature value for each feature item and a determination (determination) result are displayed for each user ID. Here, the analysis result output unit 13 may prohibit the login by the user ID determined to have changed the user's behavior. According to this, when the user ID is stolen or the like, unauthorized login can be prevented. In addition, the determination result not only indicates whether or not the user's behavior has changed, but if the user's behavior has changed, a message that the user ID may have been transferred is displayed. Also good. According to this, it is possible to grasp the possibility that the user ID has been transferred at a glance.

  As described above, since it is determined whether the user's action corresponding to the user ID has changed depending on which of the regions separated by the separation hyperplane the feature vector associated with the user ID belongs, It can be easily determined whether or not the ID has been transferred. In addition, when the behavior of the user changes, the Internet service provider can improve security by notifying the user corresponding to the user ID that the user ID may be stolen. .

  FIG. 6 shows a flowchart of the advertisement distribution process according to the embodiment of the present invention.

  S11: The behavior history analysis unit 12 associates the feature vector associated with one user ID (for example, 00001) with its own user ID (00001) in the region separated by the separation hyperplane of the user ID. If it does not belong to the specified area, or if it belongs to an area in which teacher data associated with another user ID (for example, 00002) is included, it is previously associated with a feature value that is a component of this feature vector The advertisement is extracted from a predetermined storage means and passed to the analysis result output means 13. Here, only for those whose feature values that are the components of the feature vector have changed, the advertisement associated with the changed feature value may be extracted from a predetermined storage means and passed to the analysis result output means 13. . For example, if a feature value of a search query that is a component of a feature vector changes from a value corresponding to “car” to a value corresponding to “children”, it is associated with “children”. The advertisement is extracted from the predetermined storage means and passed to the analysis result output means 13. According to this, it is possible to prevent the advertisement associated with the unchanged feature value from being delivered.

  S12: The action history analysis unit 12 extracts a mail address (00001@yahoo.co.jp) previously associated with one user ID (00001) from a predetermined storage unit and passes it to the analysis result output unit 13.

  S13: The analysis result output means 13 transmits the advertisement (such as an advertisement for children's goods) received from the action history analysis means 12 to the mail address (00001@yahoo.co.jp) received from the action history analysis means 12. .

  As described above, when it is determined that the user's behavior has changed, an advertisement associated in advance with the component of the feature vector that is the basis of the determination is distributed, so that the advertisement can be distributed effectively. Can do. In other words, for example, when a user's behavior changes, a trader who distributes an advertisement can infer that a user's living environment has changed due to marriage or the like, and his / her hobbies / preferences have changed. And this trader can distribute an advertisement suitable for a user's new hobbies and preferences. Thereby, it becomes possible to improve the sales of the advertised product.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

It is a figure which shows the outline | summary of the function structure of the action history analyzer which concerns on this embodiment. It is a figure which shows the outline | summary of a structure of an action history database. It is a figure which shows the hardware constitutions of the action history analyzer which concerns on this embodiment. The flowchart of the action history analysis process which concerns on embodiment of this invention is shown. It is an example of the screen which output the feature vector linked | related for every user ID which concerns on embodiment of this invention, and the judgment result for every user ID to the display apparatus. The flowchart of the advertisement delivery process which concerns on embodiment of this invention is shown.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Action history analyzer 11 Action history reading means 12 Action history analysis means 13 Analysis result output means 14 Action history database

Claims (5)

Computer
An action history reading step for reading an action history stored in association with a user ID and a feature vector having a feature value indicating a characteristic for each feature item characterizing the user's action in advance;
Using part or all of the feature vectors stored in the read action history as teacher data, feature vectors associated with one user ID and feature vectors associated with another user ID are separated by machine learning. ,
Behavior history analysis that determines that the behavior of the user corresponding to the one user ID has changed when the feature vector associated with the one user ID that is not teacher data does not belong to the region associated with the user ID Steps,
The action history analysis method characterized by performing at least.   The behavior history according to claim 1, wherein when it is determined that the behavior of the user corresponding to the one user ID has changed, the fact that the one user ID may be transferred is output. Analysis method.   When the feature vector associated with the one user ID belongs to a region including the teacher data associated with the other user ID among the regions separated by the separation hyperplane in the support vector machine, The behavior history analysis method according to claim 1, wherein an advertisement previously associated with a feature vector component is transmitted to an e-mail address previously associated with the one user ID. An action history reading means for reading an action history stored in association with a user ID and a feature vector having as a component a feature value indicating a characteristic for each feature item characterizing the user's behavior;
Separating a feature vector associated with one user ID and a feature vector associated with another user ID using part or all of the feature vectors stored in the read action history as teacher data A region in which the feature data associated with the one user ID that is not the teacher data is calculated in the separation hyperplane and the teacher data associated with the user ID is included in the region separated by the separation hyperplane. Action history analysis means for determining that the action of the user corresponding to the one user ID has changed,
Analysis result output means for outputting the determined result;
An action history analyzing apparatus comprising:   A program causing a computer to execute the method according to claim 1.

Images