JP2017174176A - Decision making support system, and method - Google Patents

Abstract

An object of the present invention is to provide information for a company to determine measures against social threats. An impact analysis unit of a social threat calculates a change in a first index relating to an impact on a society or an economy due to the social threat based on an occurrence probability of the social threat, and generates the occurrence of the social threat Based on the probability and the profile of the company, the change of the second index relating to the direct impact of the company on the social threat is calculated, and the change of the first index or the change of the second index is the management of the company Based on the definition information that defines the causal relationship of the influence on the index, the change in the management index of the company is predicted from the change in the first index and the change in the second index. The social threat countermeasure recommendation unit 216 refers to a countermeasure list in which a plurality of countermeasure candidates are associated with an effect indicating the degree of suppression of the change in the first or second index when each countermeasure candidate is implemented. Then, a countermeasure plan is prepared so that the change of the management index falls within a predetermined range. [Selection] Figure 2

Description

  The present invention relates to a technology that analyzes the degree of impact of social threats such as terrorism on a company, formulates a countermeasure plan to reduce the degree of the influence, and supports decision making of the countermeasure.

  In patent document 1, the draft of the business continuity plan according to the business condition of a company is presented in an emergency. Even for users who do not have industry knowledge, simply select the business name of the target company, specify the category within the industry according to the combination of business, identify the business that is indispensable for the survival of the company, Extract business continuity plan templates by combining business operations essential for survival.

  Moreover, in patent document 2, the content of a trouble is determined by an if-then rule using an expert system, and countermeasure data corresponding to the trouble is extracted and executed to solve the trouble.

JP 2004-288109 A JP 2003-157183 A

  By the way, when social threats such as terrorism occur, corporate activities are directly or indirectly affected. This is an unavoidable risk for companies as well as a natural disaster. Therefore, it is important for companies to understand the impact of social threats and take appropriate measures to mitigate them.

  Therefore, an object of the present invention is to provide information for a company to determine measures against social threats.

  Another object of the present invention is to predict the probability of occurrence of social threats.

  Yet another object of the present invention is to quantitatively analyze the impact of social threats on companies.

  The decision support system according to one embodiment of the present invention is a means for calculating a change in a first index, which is an index relating to an effect on a society or an economy due to the social threat, based on a probability of occurrence of the social threat. And a means for calculating a change in a second index, which is an index relating to an influence that the company is directly affected by the social threat, based on the occurrence probability of the social threat and the profile of the company, From the definition information defining the causal relationship of the influence of the change in the index or the change in the second index on the management index of the company, the change in the first index and the change in the second index Corresponding means for predicting a change in management index of the company, a plurality of countermeasure candidates, and an effect indicating a degree of suppression of a change in the first or second index when each countermeasure candidate is implemented Referring to measures list, and means for changing said management indicator to formulate countermeasure such that within a predetermined range, and means for outputting the countermeasures.

  In a preferred embodiment, it may further comprise means for predicting the probability of occurrence of the social threat using one or more of economic growth rate, population growth rate and past conflict situation.

  In a preferred embodiment, the information processing apparatus may further include means for updating the countermeasure list based on an evaluation result obtained by comparing the effect expected from the countermeasure plan and the actual result.

  In a preferred embodiment, the information processing apparatus may further include means for updating the definition information based on an evaluation result obtained by comparing the prediction result of the change of the management index and the actual result.

  A decision support system according to another embodiment of the present invention includes a first private system for a first company, a second private system for a second company, and a public system. . The public system includes means for predicting a probability of occurrence of a social threat using one or more of an economic growth rate, a population growth rate, and a situation of past conflict, and the predicted probability of occurrence of the social threat Means for transmitting to the first and second private systems. The first private system is a first index that is an index relating to the influence of the first company on the social threat based on the occurrence probability of the social threat and the profile of the first company. Based on the first definition information defining the causal relationship of the influence of the change of the first index on the management index of the first company, the means for calculating the change, and from the change of the first index The means for predicting the change in the management index of the first company, the plurality of countermeasure candidates, and the effect indicating the degree of suppression of the change in the first index when each countermeasure candidate is implemented are associated with each other Means for drafting a countermeasure plan for the first company such that a change in the management index of the first company falls within a predetermined range with reference to the first countermeasure list. The second private system is based on the probability of occurrence of the social threat and the profile of the second company, and the second index is an index relating to the influence of the second company on the social threat. Based on the second definition information defining the causal relationship between the means for calculating the change and the effect of the change of the second index on the management index of the second company, from the change of the second index The means for predicting the change in the management index of the second company, the plurality of countermeasure candidates, and the effect indicating the degree of suppression of the change in the second index when each countermeasure candidate is implemented are associated with each other Means for making a countermeasure plan for the second company such that the change in the management index of the second company falls within a predetermined range with reference to the second countermeasure list.

  In a preferred embodiment, the first private system may further comprise means for transmitting the first countermeasure list to the second private system. The second private system may devise a countermeasure plan for the second company with reference to the first countermeasure list transmitted from the first private system.

  In a preferred embodiment, the first private system may further comprise means for transmitting the first definition information to the second private system. The second private system may predict a change in the management index of the second company using the first definition information transmitted from the first private system.

The conceptual diagram which shows the whole picture of prediction, impact analysis, and countermeasure recommendation. System configuration diagram of social threat prediction, impact analysis, decision support system. The block diagram which shows the specific example of a country name-city name master database and a company profile database. The block diagram which shows the specific example of a company profile database. The block diagram which shows the specific example of a social situation database. The block diagram which shows the specific example of a social situation database (continuation of FIG. 5). The block diagram which shows the specific example of a result database of prediction, impact analysis, and countermeasure recommendation. The block diagram which shows the specific example of the file in which the social threat prediction algorithm was stored. The block diagram which shows the specific example of the file in which the social threat influence analysis algorithm was stored. The block diagram which shows the specific example of the file in which the social threat countermeasure recommendation algorithm was stored. Process flow diagram showing the entire process of social threat prediction, impact analysis, and countermeasure recommendation The processing flowchart which shows the detail of the process of the data collection for prediction. The processing flowchart which shows the detail of the process of prediction. The processing flowchart which shows the detail of a process of influence analysis. The processing flowchart which shows the detail of a process of countermeasure plan recommendation. The processing flowchart which shows the detail of the process of learning which improves the precision of each algorithm. The processing flowchart which shows the detail of the process of learning which improves the precision of each algorithm. Screen to display prediction results Screen to display impact analysis results Screen that displays a list of countermeasures A system configuration diagram for data linkage between a public cloud system and an on-premises system. The processing flowchart which shows the detail of the process of the data collection for prediction in a public cloud system. The processing flowchart which shows the detail of the process which takes in the result predicted in the public cloud system to an on-premises system. The processing flowchart which shows the detail of the process which shares the impact analysis algorithm which an on-premises system hold | maintains with another on-premises system. The processing flowchart which shows the detail of the process which shares the countermeasure recommendation algorithm which an on-premises system hold | maintains with another on-premises system. Screen showing the causal relationship model that fills the space between the proposed measure and KPI

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.

  A first embodiment of the present invention will be described with reference to FIGS. The decision support system according to the present embodiment predicts the occurrence of social threats such as terrorism, analyzes the degree of impact on the company when it occurs, and the management of the company reduces the degree of impact To support decision making for measures. However, the present invention is not limited thereby, and the present invention can be applied to any situation in which a social threat is predicted, the degree of influence is estimated, and countermeasures against the influence are planned.

  FIG. 1 is a conceptual diagram showing an overall view of a decision support system 200 according to the first embodiment. The system 200 predicts social threats using news and public information of government agencies, analyzes the impact on the company using company profile data, and outputs recommended countermeasures at the company. May be.

  The decision support system 200 is a web crawling technology (society) via a communication line 180 for news of terrorism cases 151 and international conflicts 152 reported on news sites 130 such as newspaper companies and television stations around the world. It may be collected by the situation data collection unit 212). Similarly, the decision support system 200 collects economic indicators 153 and demographics 154 published by the government agency 140 via the communication line 180, and analyzes the collected data using a text mining technology (text mining unit 213). And may be shaped. The decision support system 200 fetches the collected data and the shaped data into the social threat prediction unit 214. The social threat prediction unit 214 performs logistic regression analysis based on the acquired data, and calculates the terrorism occurrence probability 155 for each city. As the communication line 180, various networks such as a LAN (Local Area Network), a dedicated line, a WAN (Wide Area Network), a power line network, a wireless network, a public line network, a mobile phone network, and a satellite communication line are adopted. can do.

  The social threat prediction unit 214 predicts the probability of occurrence of a social threat using one or more of the economic growth rate, population growth rate, and past conflict situations.

  Based on the probability of occurrence of a social threat, the social threat impact analysis unit 215 determines a change in KPI (for example, GDP growth rate: first index) related to the social or economic impact caused by the social threat. calculate. The impact analysis unit 215 of social threats is based on the probability of occurrence of social threats and the profile of the company. ) Is calculated. Based on the definition information that defines the causal relationship between the change in the first index or the change in the second index on the KGI (enterprise management index), the social threat impact analysis unit 215 The change of the management index of the company is predicted from the change and the change of the second index.

  Based on the company profile data 160 set by the user, the social threat influence analysis unit 215 determines the degree of influence of the terrorism occurrence probability 155 of the city in which the company has entered the company on the KGI (Key Goal Indicator). ). In the calculation, a causal relationship model in which the terrorism occurrence probability 155 and the company profile data 160 are input and the KGI is an output is used.

  The social threat countermeasure recommendation unit 216 associates a plurality of countermeasure candidates with an effect indicating the degree of suppression of a change in KPI (first or second index) when each countermeasure candidate is implemented. With reference to the measure recommendation algorithm 227 (measure list), a measure plan is prepared so that the change in KGI (management index) falls within a predetermined range.

  The social threat countermeasure recommendation unit 216 searches for a countermeasure plan for improving the KGI deteriorated by the probability of occurrence of terrorism to the limit KGI based on the KGI (limit KGI 170) that is the limit of the allowable range set by the user. . For example, the social threat countermeasure recommending unit 216 uses the KPI to which the countermeasure proposal is related to the search method to achieve the limit KGI 170 based on the causal relationship model of the social threat influence analysis unit 215. (Key Performance Indicator) Back-calculate from the limit KGI 170 how much the node needs to be improved. Based on the KPI improvement value (KPI improvement value 172) obtained in this way, the numerical value 173 (the number of installed surveillance cameras) of the countermeasure plan is calculated based on the countermeasure template (social threat countermeasure recommendation algorithm), Define recommended measures. This countermeasure plan can be used, for example, as a proposal for the management of a company.

  FIG. 2 shows an example of the system configuration of the decision support system 200 according to the present embodiment.

  The decision support system 200 may be configured by a general computer having a central control device 230, a main storage device 210, an auxiliary storage device 220, a communication device 231, and an input / output device 232. The central control device 230, the main storage device 210, the auxiliary storage device 220, the communication device 231 and the input / output device 232 are mutually connected by a bus.

  The auxiliary storage device 220 includes a country-city name master database 221, a company profile database 222, a social situation database 223, a prediction, impact analysis, a countermeasure recommendation result database 224, a social threat prediction algorithm file 225, and a social threat impact analysis algorithm. A file 226 and a social threat countermeasure recommendation algorithm file 227 are stored.

  The company profile setting unit 211, the social situation data collection unit 212, the text mining unit 213, the social threat prediction unit 214, the social threat impact analysis unit 215, and the social threat countermeasure implemented in the main storage device 210 The recommendation unit 216 and the algorithm improvement unit 217 are both computer programs. Thereafter, when the subject is described as “XX section”, the central controller 230 reads out each program from the auxiliary storage device 220 and loads it into the main storage device 210, and then the function of each program (detailed later). Shall be realized.

  In FIG. 2, the decision support system 200 is realized by a single computer machine. However, the decision support system 200 is connected to the other computer via a communication line with a single computer machine, and data is input / output by the input / output device of the terminal. It is good to do.

  FIG. 3 shows an example of the country name-city name master database 221.

  The country-city name master database 221 includes a city master table 300 and a country / region master table 310.

  The city master table 300 stores a list of major cities around the world.

  The city master table 300 includes a city ID 301, a city name 302, and a country / region ID 303. A city ID 301 is an identifier for uniquely identifying a city, and is a key for identifying each record. The city name 302 indicates the name of the city. The country / region ID 303 is an identifier for uniquely identifying the country / region to which the city belongs.

  The country / region master table 310 stores a list of major countries / major regions of the world.

  The country / region master table 310 includes a country / region ID 311 and a country / region name 312. The country / region ID 311 is an identifier for uniquely identifying the country / region, and is a key for identifying each record. The country / region name 312 indicates the name of the country / region.

  FIG. 4 shows an example of the company profile database 222.

  The company profile database 222 is composed of an advancing site profile table 320.

  The advance base profile table 320 stores a list of companies' advance bases and a list of activities at the advance bases.

  The expansion base profile table 320 includes a city ID 321, base number 322, base asset value 323, number of employees 324, government contract number 325, base sales ratio (base sales / global sales) 326. Is done. The city ID 321 is an identifier for uniquely identifying a city, and is a key for identifying each record. The number of bases 322 indicates the number of bases of companies in the city. The base asset value 323 indicates the sum of the asset values (such as the book value of fixed assets) of the bases where the business has entered. The number of employees 324 indicates the total number of employees at the expansion base. The number of government contracts 325 indicates the number of contracts (including orders received and accepted) from the government of the country of expansion at the base. The base sales ratio (base sales / global sales) 326 indicates the ratio of sales at the base to the global sales of the company in order to measure the size of the base at the base. Take advantage of.

  5 and 6 show examples of the social situation database 223. FIG. The social situation database 223 includes a world situation table 400, a conflict country table 410, a conflict period 420, a country / region situation table 430, a collection target list table 500, and a terrorist incident table 510. FIGS. 5A to 5D show examples of the world situation table 400, the conflict country table 410, the conflict period 420, and the country / region situation table 430. FIGS. 6A and 6B show the collection target list table 500, the terrorist incident, and the like. An example of a table 510 is shown.

  The world situation table 400 in FIG. 5A stores a list of situations in each country / region in the world.

  World situation table 400 includes country / region ID 401, year 402, GDP growth rate 403, security stability 404, population 405, and number of visitors 406. The country / region ID 401 is an identifier for uniquely identifying the country / region. Year 402 indicates when the country / region situation is. The country / region ID 401 and the year 402 are keys for identifying each record. The GDP growth rate 403 indicates the economic growth rate of the country / region in the current year. The security stability 404 is an index indicating the security stability of the country / region in the current year. This index is an index indicating the relative security stability with respect to 0, + indicates more stability, and-indicates more instability. Population 405 indicates the number of populations in the year in the country / region. The number of visitors 406 indicates the number of visitors to the country / region from that country / region in the current year.

  The conflict country table 410 of FIG. 5B stores a list of parties to the past and current disputes.

  The conflict country table 410 includes a conflict ID 411, a first party / region ID 412, and a second party / region ID 413. The dispute ID 411 is an identifier for uniquely identifying an international dispute. The first party / region ID 412 is an identifier for uniquely identifying one party / region of the international dispute. The second country / region ID 413 is an identifier for uniquely identifying the other country / region at the time of the international conflict. The dispute ID 411, the first country / region ID 412 and the second country / region ID 413 are keys for identifying each record.

  The dispute period table 420 in FIG. 5C stores a list of past and current dispute periods.

  The conflict period table 420 includes a conflict ID 421, a start year 422, and an end year 423. The dispute ID 421 is an identifier for uniquely identifying an international dispute, and is a key for identifying each record. The start year 422 indicates the start year of the international dispute. The end year 423 indicates the end year of the international dispute.

  In the country / region situation table 430 of FIG. 5D, a list of situations of cities in the country / region is stored.

  The country / regional situation table 430 includes a city ID 431, a year 432, a population size 433, the number of railway lines 434, and a total highway extension (km) 435. The city ID 431 is an identifier for uniquely identifying a city. Year 432 indicates when the city situation is. The city ID 431 and the year 432 are keys for identifying each record. The population scale 433 indicates the population of the area in the current year. The number of railway lines 434 indicates the number of railway lines in the city in the current year. The highway total length (km) 435 indicates the length of the total highway length in the current year in the area.

  The collection target list table 500 in FIG. 6A includes an information source 501 and a storage destination DB 502.

  The information source 501 indicates what information source is the information source of the information to be collected. The storage destination DB 502 indicates in which DB the information of the information source is stored.

  The information source 501 includes an information source ID 503, an overall name 504, a type 505, and a URL 506. The information source ID 503 is an identifier for uniquely identifying an information source of information to be collected, and is a key for identifying each record. The overall name 504 indicates the name of the information source (ΔΔ news site, etc.). The type 505 indicates the type of whether the information source is public information or non-public information. URL 506 indicates the address of the information source.

  The storage destination DB 502 includes a DB name 507, a table name 508, and a column name 509. The DB name 507 indicates the DB where the information of the information source is stored. A table name 508 indicates a table for storing information of the information source. A column name 509 indicates a storage destination column of information of the information source.

  The terrorist incident table 510 of FIG. 6B stores a list of past terrorist incidents that occurred in various countries / regions around the world.

  The terrorist incident table 510 includes an incident ID 511, an occurrence date 512, an occurrence country / region ID 513, an occurrence city ID 514, a damaged organization 515, the number of deaths 516, the number of injuries 517, a technique 518, and a suspect. 519. The case ID 511 is an identifier for uniquely identifying the case, and is a key for identifying each record. Occurrence date 512 indicates the date on which the incident occurred. The country / region ID 513 is an identifier for uniquely identifying the country / region where the incident occurred. The city 514 is an identifier for uniquely identifying the city where the incident occurred. The victim organization 515 shows the main target of the incident. The number of deaths 516 indicates the number of deaths in the case. The number of injuries 517 indicates the number of injuries in the incident. A technique 518 indicates a criminal technique in the incident. Suspect 519 indicates the mastermind of the case.

  FIG. 7 shows an example of the result database 224 of prediction, impact analysis, and countermeasure recommendation. The prediction, impact analysis, and countermeasure recommendation result database 224 includes a prediction result table 600, an impact analysis result table 610, and a countermeasure recommendation result table 620.

  The prediction result table 600 in FIG. 7A stores a list of prediction results.

  The prediction result table 600 includes a prediction ID 601, a prediction implementation date 602, a target candidate city ID 603, a terrorism occurrence probability 604, and an evaluation 605. The prediction ID 601 is an identifier for uniquely identifying the prediction result, and is a key for identifying each record. The prediction execution date 602 indicates the date on which the prediction is performed. The target candidate city ID 603 indicates a city predicted to be targeted as a terrorist target as a result of the prediction, and is an identifier for uniquely identifying the city. The terrorism occurrence probability 604 indicates the probability that the city is targeted as a terrorist target. The evaluation 605 indicates the result of evaluating whether the prediction of terrorism is correct by matching the prediction result with the result of the actual result. The evaluation result may be input manually when a terrorist event occurs, or may be automatically input in response to an update of the terrorist incident table 510 of the social situation database 223.

  A list of impact analysis results is stored in the impact analysis result table 610 of FIG. 7B.

  The impact analysis result table 610 includes an analysis ID 611, an analysis execution date 612, a KGI 613, a value 614, a unit 615, a good / bad 616, and an evaluation 617. The analysis ID 611 is an identifier for uniquely identifying the impact analysis result, and is a key for identifying each record. The analysis execution date 612 indicates the date on which the impact analysis was performed. KGI 613 indicates the KGI to which the company is affected as a result of the impact analysis. A value 614 indicates how the value of KGI 613 changes as a result of the impact analysis. A unit 615 indicates a unit of the value of KGI 613. The good / bad 616 indicates whether the value 614 is a good value, a bad value, or a value that can be regarded as unchanged. The evaluation 617 indicates the result of evaluating whether or not the impact analysis of the terrorism on the company is correct by matching the impact analysis result with the actual result. As for the evaluation result, when the terrorist event occurs, the influence state on the company may be manually input, or the influence state may be monitored by another system and automatically input from there.

  The countermeasure recommendation result table 620 in FIG. 7C stores a list of countermeasure recommendation results.

  The recommended countermeasure result table 620 includes a countermeasure ID 621, a countermeasure implementation date 622, a countermeasure 623, a KPI effect 624, a KGI effect 625, a KPI evaluation 626, and a KGI evaluation 627. The countermeasure ID 621 and the node ID 630 of the KPI effect 624 are keys for identifying each record.

  The countermeasure ID 621 is an identifier for uniquely identifying the implementation result of the recommended countermeasure. The countermeasure implementation date 622 indicates the date on which the recommended countermeasure was implemented. The countermeasure 623 indicates the content of the recommended and implemented countermeasures. The countermeasure 623 further includes a content 628 and a number 629. The content 628 indicates the content of the countermeasure. The number 629 indicates a parameter of the content of the countermeasure (in the case of a countermeasure for installing a camera, the number of cameras, etc.). The KPI effect 624 indicates a change in the KPI node and its value to which the recommended countermeasure is directly effective. The KPI effect 624 further includes a node ID 630 and a value 631. The node ID 630 indicates the node ID of the KPI. A value 631 indicates the value of KPI. The KGI effect 625 indicates a change in the node of the KGI due to the recommended countermeasure. The KGI effect 625 further includes a node ID 632 and a value 633. The node ID 632 indicates the node ID of KGI. A value 633 indicates the value of KGI.

  Here, when there are a plurality of records having the same countermeasure ID 621, it indicates that there are a plurality of KPI nodes effective for the same countermeasure, but there may be one effective KGI node. In this case, it is assumed that the KGI node ID 632 and its value 633 are input only to a record of an arbitrary KPI effect, and “-” is input to the corresponding column (node ID 632, value 633) of another record. Also good. This is to avoid redundant input of information.

  The KPI evaluation 626 indicates a result of evaluating whether or not the recommended countermeasure of the company against terrorism is appropriate for the change of KPI by matching the result of the countermeasure assumed in advance with the result of the actual result. The KGI evaluation 627 indicates the result of evaluating whether the recommended countermeasures against terrorism are appropriate for the change in KGI by matching the results of countermeasures assumed in advance and the results of results. Here, when there are a plurality of records having the same countermeasure ID 621 due to the same reason (to avoid redundant input of information) as the input of “−” to the node ID 632 and its value 633 of the KGI, the KGI evaluation 627 May input "-". As an evaluation result, a countermeasure result when a terrorist event occurs may be manually input, or the countermeasure result may be monitored by another system and an automatic input may be received therefrom.

  FIG. 8 shows an example of the social threat prediction algorithm file 225.

  In the social threat prediction algorithm file 225, information on logistic regression equations used for terror prediction is stored.

  The social threat prediction algorithm file 225 includes a variable / constant ID 701, a type 702, a coefficient / value 703, a storage source DB name 704, a storage source table name 705, and a storage source column name 706.

  The variable / constant ID 701 is an identifier for identifying an explanatory variable and a constant (intercept) of the logistic regression equation. The type 702 indicates whether the variable / constant ID 701 is an explanatory variable or a constant. The coefficient / value 703 indicates a coefficient when the variable / constant ID 701 is an explanatory variable, and indicates the constant value itself when the variable / constant ID 701 is a constant. The storage source DB name 704 indicates a database that stores the value of the variable / constant ID 701. A storage source table name 705 indicates a table that stores the value of the variable / constant ID 701. A storage source column name 706 indicates a storage source column of the value of the variable / constant ID 701.

  FIG. 9 shows an example of the social threat impact analysis algorithm file 226.

  The social threat impact analysis algorithm file 226 stores information on the causal relationship model used for analyzing the impact on the company due to terrorism.

  The social threat impact analysis algorithm file 226 includes a KPI ID 801, a KPI name 802, and a calculation formula / value 803.

  The KPI ID 801 is an identifier for identifying the KPI. The KPI indicates an index related to corporate activity and indicates a node in the causal relationship model. The KPI name 802 indicates the name of the KPI. Calculation formula / value 803 indicates the value of KPI. When the value is calculated by another KPI, the calculation formula is shown. When the value is referred from the database, “database name”. "table name". Indicates “column name”.

  FIG. 10 shows an example of the social threat countermeasure recommendation algorithm file 227.

  In the social threat countermeasure recommendation algorithm file 227, information on a template of a countermeasure plan recommended as a countermeasure against terrorism is stored.

  The social threat countermeasure recommendation algorithm file 227 includes a countermeasure ID 901, a countermeasure content 902, a countermeasure unit 903, a KPI effect node 904, a KPI effect value 905, a KGI effect node 906, and a KGI effect value 907.

  The countermeasure ID 901 is an identifier for identifying the countermeasure plan described in the countermeasure plan template. The countermeasure content 902 indicates the content of the countermeasure plan. The countermeasure unit 903 indicates a parameter unit of the contents shown in the countermeasure proposal (for example, in the case of a countermeasure for installing a camera, the number of cameras). The KPI effect node 904 indicates the node ID of the KPI to which the recommended countermeasure is directly effective. The KPI effect value 905 indicates a change in the KPI value to which the recommended countermeasure is directly effective. The KPI effect value 905 may be set based on an empirical rule. The KGI effect node 906 indicates the node ID of the KGI for which the recommended countermeasure is effective. The KGI effect value 907 indicates a change in the value of KGI for which the recommended countermeasure is effective. The KGI effect value 907 may be blank, but a value that can be calculated from the KPI effect value 905 and the causal relationship model (social threat influence analysis algorithm file 226) may be described.

  Next, each process in the present embodiment will be described.

  FIG. 11 shows an overall flow of processing performed by the decision support system 200 according to the present embodiment.

  In the present embodiment, data may be collected and the probability of terrorism occurring may be predicted based on the collected data. In the present embodiment, the influence of the terrorism prediction result on the company may be analyzed and a countermeasure plan for suppressing the influence may be drafted. Further, in the present embodiment, an algorithm for planning a countermeasure may be learned by comparing the expected effect of the countermeasure with the actual result.

  In process S1001, the social situation data collection unit 212 determines whether or not the data collection time has come. For example, the collection time may be registered in advance by the user. The collection time may be a periodic event such as “every Monday at 10:00”, or may be an irregular event such as “when a user inputs a collection instruction”. If it is the collection time, the process proceeds to step S1002, and if it is not the collection time, the process proceeds to step S1003.

  In process S1002, the company profile setting unit 211 receives input of company profile data from the user, the social situation data collection unit 212 collects public information such as social situation data from the Web, and registers the collected data in the database. . (Details will be described later with reference to FIG. 12).

  In process S1003, the social threat prediction unit 214 determines whether or not it is time to predict terrorism. The time when terrorism is predicted may be registered in advance by the user, for example. The prediction time may be a periodic event such as “every Monday at 10:00”, or may be an irregular event such as “when a user inputs a prediction instruction”. If it is the predicted time, the process proceeds to step S1004, and if it is not the predicted time, the process proceeds to step S1007.

  In process S1004, the social threat prediction unit 214 predicts the occurrence probability of terrorism (social threat) using the data collected in process S1002. (Details will be described later with reference to FIG. 13). The probability of terrorism is predicted for each city.

  In process S1005, 230 performs an impact analysis on the company due to terrorism using the terrorism prediction information predicted in process S1004. (Details will be described later with reference to FIG. 14).

  In step S1006, a countermeasure plan against terrorism is drafted using the result analyzed in step S1005. (Details will be described later with reference to FIG. 15).

  In step S <b> 1007, it is determined whether a learning period for prediction, influence analysis, and countermeasure recommendation algorithm improvement has come. The learning time may be registered in advance by the user. The learning time may be a periodic event such as “every Monday at 10:00” or an irregular event such as “when a user inputs a learning instruction”. If it is the learning time, the process proceeds to step S1008, and if it is not the learning time, the process proceeds to step S1009.

  In step S1008, terrorism prediction, analysis of the impact of terrorism on a company, and countermeasures thereof are compared with actual results, and an algorithm with low accuracy is improved. (Details will be described later with reference to FIGS. 16 and 17).

  FIG. 12 is a diagram showing a detailed process flow of data collection and registration for process S1002 among the processes included in the process flow described in FIG. The central controller 230 performs these processes.

  In process S1101, the company profile setting unit 211 determines whether the set time of the company profile data has come. The set time may be registered in advance by the user. The set time may be a periodic event such as “every Monday at 10:00” or an irregular event such as “when a user inputs a setting instruction”. If it is the set time, the process proceeds to step S1102, and if it is not the set time, the process proceeds to step S1103.

  In process S <b> 1102, the company profile setting unit 211 accepts input of company profile data from the user via the input / output device 232 and registers it in the company profile database 222.

  In process S1103, social situation data collection unit 212 determines whether or not the social situation data collection time has come. The collection time may be registered in advance by the user. The collection time may be a periodic event such as “every Monday at 10:00”, or may be an irregular event such as “when a user inputs a collection instruction”. If it is the collection time, the process proceeds to step S1104, and if it is not the collection time, the process proceeds to step S1106.

  In process S <b> 1104, social situation data collection unit 212 acquires a collection destination list of social situation data collection targets from collection target list table 500 of social situation database 223. For example, the social situation data collection unit 212 refers to the URL 506 of the information source 501.

  In process S1105, the social situation data collection unit 212 accesses the URL 506 referred to in process S1104 via the communication device 231, and the social situation data (terrorism incident 151, international dispute 152, economic index 153, demographic 154, etc.) To collect. The data to be collected is not limited thereto, and may be data that can be acquired from any information source registered in the collection target list table 500, for example. This data collection may utilize, for example, a web crawling technique. The collected data may be registered in the database after the text mining unit 213 shapes the data. Use text mining technology for shaping. The registration destination database may follow the DB name 507, the table name 508, and the column name 509 specified in the storage destination DB 502 in the collection target list table 500 of the social situation database 223.

  FIG. 13 is a diagram illustrating a detailed process flow of the social threat (terrorism) prediction for each city in process S1004 among the processes included in the process flow described in FIG. The central controller 230 performs these processes. Thereafter, the social threat prediction unit 214 performs processing.

  In process S1201, the social threat prediction unit 214 acquires a prediction algorithm (logistic regression equation) described in the social threat prediction algorithm file 225.

  In process S1202, the social threat prediction unit 214 obtains social situation data necessary for prediction from 223, and generates a logistic regression equation. A logistic regression equation is generated for each city.

  For example, when the type 702 is “explanatory variable”, the city ID of the city where terrorism prediction is performed is keyed from the specified database (storage source DB name 704, storage source table name 705, storage source column name 706). Thus, data related to the city is acquired and used as an explanatory variable.

  For example, in the example of the explanatory variable “X1” in FIG. 8, first, the country / region ID to which the terror prediction city belongs is specified with reference to the city master table 300 of the country name-city name master database 221. The year 402 is the previous year of the year in which this processing is performed. Based on the country / region ID and year determined here, the GDP growth rate 403 of the record that matches the country / region ID 401 and year 402 of the world situation table 400 of the social situation database 223 is acquired.

  When the type 702 is “constant”, the coefficient / value 703 is an intercept value. Whether or not to add the intercept value to the logistic regression equation may be determined by whether or not the city where the terrorism prediction is made is a conflict party. For example, the country / region ID to which the city belongs is specified in the city master table 300 of the country name-city name master database 221. When the specified country / region ID 303 is searched in the specified database (storage source DB name 704, storage source table name 705, storage source column name 706), the coefficient / constant 703 is used as a logistic regression equation as an intercept. In addition, it is not necessary to add when it is not searched.

  For example, in the example of the constant “b1” in FIG. 8, in order to determine whether or not the country is a dispute party, the country / region ID 303 is used to determine the first country / region in the conflict country table 410 of the social situation database 223. It is determined whether or not the area ID 412 matches. If they match, the conflict period table 420 acquires the start year 422 and end year 423 of the conflict ID 421 that matches the conflict ID 411, and confirms that the year in which this process is performed is the start year 422 or later. In that case, the value of coefficient / value 703 may be added to the logistic regression equation as an intercept. Even if it is after the start year, it may not be added if a predetermined period or more has passed since the end year 423. For example, the predetermined period may be set in advance by the user.

  In step S1203, the probability of terrorism for each city is calculated based on the logistic regression equation generated in step S1202.

  In step S1204, the probability of occurrence of terrorism calculated in step S1203 is displayed as a prediction result on the input / output device 232 and registered in the result database 224 of prediction, impact analysis, and countermeasure recommendation. Further, the calculated terrorism occurrence probability may be temporarily held in the main storage device 210. At this time, the occurrence probability of terrorism may be displayed, registered, and held only when the user exceeds a preset threshold. An example of the display screen is shown in FIG.

  In step S1202 and step S1203, the probability of terrorism for each city managed by the country-city name master database 221 is calculated in all cities. It is also possible to reduce the calculation load by extracting the cities and calculating the probability of occurrence of terrorism only for the countries and cities that have advanced.

  FIG. 14 is a diagram showing a detailed process flow of an analysis of the impact on a company due to a social threat (terrorism) in process S1005 among the processes included in the process flow described in FIG. The central controller 230 starts a processing flow of terror impact analysis. Thereafter, the social threat influence analysis unit 215 performs processing.

  In process S1301, the social threat impact analysis unit 215 acquires the impact analysis algorithm (causal relationship model) described in the social threat impact analysis algorithm file 226.

  In process S1302, the impact analysis unit 215 of social threat acquires the prediction result (probability of terrorism for each city) of the process S1004 from the main storage device 210. Also, the social threat impact analysis unit 215 obtains the company profile data for each city necessary for the impact analysis described in the social threat impact analysis algorithm file 226 from the company profile database 222, and the main storage device. 210 may be held. For example, the calculation formula / value 803 of the social threat impact analysis algorithm file 226 includes “database name”. "table name". The social threat influence analysis unit 215 obtains data according to this designation for those for which “column name” is described. “Company profile database 222” may be designated as the database name.

  In process S1303, the social threat impact analysis unit 215 analyzes the impact of the terrorist incident on the company using the impact analysis algorithm acquired in process S1301. The input data to the impact analysis algorithm is the terrorism occurrence probability and company profile data for each city acquired in step S1302. These input values are substituted into the calculation formula / value 803 of the corresponding KPI ID 801 in the social threat impact analysis algorithm file 226 to calculate the KPI. Then, the calculated KPI value is substituted into the corresponding part specified by another KPI calculation formula / value 803, and a new KPI is calculated by substitution. By repeating the above processing, the final KPI ID 801 and its calculation formula / value 803 are obtained as KGI.

  In process S1304, the social threat impact analysis unit 215 displays the impact analysis result calculated in process S1303 on the input / output device 232 and registers it in the prediction, impact analysis, and countermeasure recommendation result database 224. Further, the KPI value and the KGI value may be temporarily stored in the main storage device 210. An example of the display screen is shown in FIG.

  FIG. 15 is a diagram showing a detailed process flow of recommendation of countermeasures at a company against a social threat (terrorism) in process S1006 among the processes included in the process flow described in FIG. The central controller 230 starts a process flow for recommending countermeasures in the enterprise against terrorism. Thereafter, the social threat countermeasure recommendation unit 216 performs processing.

  In step S1401, the social threat countermeasure recommendation unit 216 acquires a countermeasure recommendation algorithm described in the social threat countermeasure recommendation algorithm file 227.

  In process S1402, the social threat countermeasure recommendation unit 216 obtains the influence analysis result (KPI value, KGI value) of process S1005 from the main storage device 210. Also, the social threat countermeasure recommendation unit 216 acquires the company profile data for each city necessary for countermeasure recommendation described in the social threat countermeasure recommendation algorithm file 227 from the main storage device 210. The acquisition of the company profile data may be performed on behalf of the value of the KPI at the time of acquiring the impact analysis result, or may be acquired from the company profile database 222.

  In process S1403, the social threat countermeasure recommendation unit 216 accepts a limit KGI set value (a limit value that allows KGI deterioration) from the user via the input / output device 232.

  In process S1404, the social threat countermeasure recommendation unit 216 extracts a countermeasure plan of the company against the terrorist incident using the countermeasure recommendation algorithm acquired in process S1401. For example, the difference between the limit KGI setting value acquired by the social threat countermeasure recommendation unit 216 in step S1403 and the KGI value acquired in step S1402 is calculated, and all the KPIs are filled to fill the difference. The degree to which the KPI value should be improved may be calculated by back-calculating from the causal relationship model of the impact analysis algorithm.

  In process S1405, the social threat countermeasure recommendation unit 216 uses the template of the countermeasure proposal of the social threat countermeasure recommendation algorithm file 227 to realize the KPI value calculated in process S1404. The numerical value is calculated. For example, the social threat countermeasure recommendation unit 216 starts from each KPI calculated in step S1404, and calculates the calculated KPI for the KPI that matches the KPI effect node 904 of the social threat countermeasure recommendation algorithm file 227. The numerical value of the countermeasure necessary for realization (the numerical value in the countermeasure unit 903) may be calculated backward from the KPI effect value 905. For example, if the KIP improvement target “KPI of“ base attack rate ”should be“ reduced by 10% ”” is obtained in step S1404, the KPI effect node 904 matches the “base attack rate”. Refer to the KPI effect value 905 for “Monitoring camera augmentation at the base”, and because there is a description of “−1% / unit”, there should be a numerical value of “10” for the surveillance camera (because the countermeasure unit 903 is “unit”). It can be seen that a 10% reduction in KPI can be satisfied. Such counter-calculation of the numerical values of countermeasures is performed for all KPIs, and a countermeasure content 902 that satisfies the limit KGI and a list of the numerical values are obtained.

  In process S1406, the social threat countermeasure recommendation unit 216 displays a list of countermeasure contents 902 and its numerical values obtained in process S1404 on the input / output device 232, and results database for prediction, impact analysis, and countermeasure recommendation. 224 registration. Further, it may be temporarily held in the main storage device 210. An example of the display screen is shown in FIG.

  FIGS. 16 and 17 are diagrams illustrating a detailed process flow of algorithm improvement by learning about the process S1008 among the processes included in the process flow described in FIG. The central controller 230 starts the algorithm learning process flow. Thereafter, the algorithm improvement unit 217 performs processing.

  In process S1501, the algorithm improvement unit 217 receives, from the user, the setting of the target period of learning data, the setting of the target place (city, country / region), and the setting of allowable accuracy for evaluation via the input / output device 232 . The allowable accuracy may be a relative value (± 10% or the like) or an absolute value (± 100 people or the like).

  In process S1502, the algorithm improvement unit 217 performs past social situation data, past terrorism prediction, past impact analysis, past target recommendation, and actual results according to the target period and target place set in step S1501. Is obtained from the result database 224 of prediction, impact analysis, and countermeasure recommendation.

  In process S1503, the algorithm improvement unit 217 determines whether or not the accuracy of the prediction algorithm is equal to or higher than an allowable accuracy (± xxx% or higher) preset by the user. The accuracy is the expected value of occurrence based on the probability of occurrence of terrorism (multiplication of terrorism occurrence probability 604 in the prediction result table 600 and the number of predictions) and the number of times terrorism actually occurred (“occurrence” in the evaluation 605 of the prediction result table 600 May be calculated as “| number of occurrences−expected occurrence value | / expected occurrence value”. As a result of the accuracy determination based on this calculation result, if the accuracy is better than the allowable accuracy, the process proceeds to step S1505. If the accuracy is lower than the allowable accuracy, the process proceeds to step S1504.

  In process S1504, the algorithm improvement unit 217 automatically updates the logistic regression equation. The logistic regression equation is updated by performing a logistic regression analysis on the occurrence of terrorism using the past social situation database of the target period and target location, and using the newly acquired logistic regression equation to calculate the social threat prediction algorithm file 225. The logistic regression equation may be updated.

  In process S1505, the algorithm improvement unit 217 determines whether or not the accuracy of the impact analysis algorithm is equal to or higher than an allowable accuracy (± xxx% or higher) preset by the user. The accuracy may be calculated by comparing the KGI of the causal relationship model when terrorism occurs and the actual results. For example, it may be calculated as | “value 614 of impact analysis result table 610” − “evaluation 617” / “value 614 of impact analysis result table 610” | ”. As a result of the accuracy determination based on this calculation result, if the accuracy is better than the allowable accuracy, the process proceeds to step S1507. If the accuracy is lower than the allowable accuracy, the process proceeds to step S1506.

  In process S1506, the algorithm improvement unit 217 manually updates the causal relationship model. The causal relationship model may be updated by, for example, having the user confirm the causal relationship diagram and the causal relationship equation, and having the user determine and update the improved portion of the diagram or equation. In response to this result, the causal relationship model of the social threat impact analysis algorithm file 226 may be updated.

  In process S1507, the algorithm improvement unit 217 determines whether or not the accuracy of the countermeasure recommendation algorithm is equal to or higher than an allowable accuracy (± xxx% or higher) preset by the user. The accuracy may be calculated by comparing the KPI of the causal relationship model for countermeasures against terrorism with the actual results. For example, it may be calculated as | “value 631 in the recommended countermeasure result table 620” − “KPI evaluation 626” / “value 631 in the recommended countermeasure result table 620” | ”. As a result of the accuracy determination based on this calculation result, if the accuracy is better than the allowable accuracy, the process proceeds to step S1508. If the accuracy is lower than the allowable accuracy, the process proceeds to step S1510.

  In process S1508, the algorithm improvement unit 217 determines whether or not the accuracy of the countermeasure recommendation algorithm is equal to or higher than an allowable accuracy (± xxx% or higher) preset by the user. The accuracy may be calculated by comparing the KGI of the causal relationship model for countermeasures against terrorism with the actual results. For example, it may be calculated as | “value 633 of countermeasure recommendation result table 620” − “KGI evaluation 627” / “value 633 of countermeasure recommendation result table 620” | ”. As a result of the accuracy determination based on the calculation result, if the accuracy is higher than the allowable accuracy, the process is terminated, and if the accuracy is lower than the allowable accuracy, the process proceeds to step S1509.

  In process S1509, the algorithm improvement unit 217 updates the causal relationship model. The update of the causal relationship model may be performed according to an input from the user. For example, the user may confirm the causal relationship diagram and the causal relationship equation, and the user may determine the final update content such as the improved portion of the diagram or the equation. In response to this result, the causal relationship model of the social threat impact analysis algorithm file 226 may be updated.

  In process S1510, the algorithm improvement unit 217 updates the countermeasure plan template. The social threat countermeasure recommended algorithm file 227 is set so that the KPI effect value 905 of the social threat countermeasure recommended algorithm file 227 (measure plan template) matches the actual KPI improvement effect (evaluation 626 of the countermeasure recommendation result table 620). It may be automatically updated. For example, the KPI effect value 905 is automatically updated with a value obtained by dividing the evaluation 626 by the number 629.

  FIG. 18 shows an example of a terrorism prediction result display screen 5000 displayed in step S1204 of FIG. The prediction result display screen 5000 displays the probability of occurrence of terrorism for each city, and is displayed on the input / output device 232 of the decision support system 200. The prediction result display screen 5000 includes a logistic regression image diagram 1600 of terror prediction and a prediction result list 1610.

  Logistic regression image FIG. 1600 is a logistic regression equation 1604 for calculating the probability of occurrence of terrorism, P representing the probability of the objective variable of the logistic regression equation, variable meaning 1605 explaining the meaning of the explanatory variable x, and originally expressed in two dimensions. It may be composed of a graph 1601 showing a two-dimensional image diagram of a logistic regression equation that cannot be done. The graph 1601 may be configured by a logistic regression curve 1603 showing a two-dimensional image curve of a logistic regression equation that cannot be originally expressed in two dimensions, and a plot 1602 in which the relationship between past social situation data and a terrorist incident is plotted. A prediction result list 1610 is a list of terrorism occurrence probabilities for each city calculated using this logistic regression equation.

  The prediction result list 1610 includes a rank 1611 ranked from the top of the probability of occurrence of terrorism, a target city candidate 1612 indicating the city to be predicted, and a terrorism occurrence probability 1613 indicating the terrorism occurrence probability calculated for each city. It may be configured. The user can use this screen for confirming the prediction result.

  FIG. 19 shows an example of the influence analysis result display screen 6000 displayed in step S1304 of FIG. The influence analysis result display screen 6000 visualizes the influence of terrorism for each city of the company, and is displayed on the input / output device 232 of the decision support system 200. The impact analysis result display screen 6000 may include a causal relationship model 1700 that visualizes the causal relationship of terrorism. The causal relationship model includes a tab 1710 for switching display for each city, a KGI node 1720 indicating KGI which is a target KPI of a company, a KPI node 1721 indicating KPI, and an arc 1722 indicating a causal relationship between KPIs. The causal relationship may be configured by a mathematical expression 1740 that is expressed by a mathematical expression. Moreover, the terrorism occurrence probability node 1723 among the KPI nodes 1721 may be a node indicating the terrorism occurrence probability calculated in the process S1204 and displayed on the prediction result screen of FIG. Furthermore, the company profile node 1730 may be a node indicating company profile data received from the user in step S1102 and read from the database in step S1302. The user can use this screen for checking the impact analysis result.

  FIG. 20 shows an example of a countermeasure plan list display screen 7000 displayed in step S1406 of FIG. The countermeasure plan list display screen 7000 visualizes countermeasures against terrorism in each city of the company, and is displayed on the input / output device 232 of the decision support system 200. The measure plan list display screen 7000 may include a prediction result list 1810, a tab 1870, a degree of influence 1820 on a company, a measure plan list 1830, a measure plan execution button 1860, and a cancel button 1861.

  The prediction result list 1810 is the same as the prediction result list 1610 in FIG. 18, and includes a rank 1811 ranked from the top of the probability of occurrence of terrorism, a target city candidate 1812 indicating a prediction target city, It may be configured with a terrorism occurrence probability 1813 indicating a terrorism occurrence probability calculated every time.

  The degree of influence 1820 on the company and the countermeasure plan list 1830 may be switched by the user operating a tab 1870 for switching display for each city. The degree of influence 1820 on the company may be composed of # 1821, KGI 1822, value 1823, unit 1824, and good / bad 1825. # 1821 indicates the item number of KGI. KGI 1822 indicates the KGI to which the company is affected as a result of the impact analysis. A value 1823 indicates how the value of KGI 1822 changes as a result of the impact analysis. A unit 1824 indicates a unit of a value of KGI 1822. The good / bad 1825 indicates whether the value 1823 is a good value, a bad value, or a value that can be regarded as unchanged.

  The countermeasure plan list 1830 may include # 1831, a selection column 1832, a countermeasure 1833, a KPI effect 1834, and a KGI effect 1835. The measure 1833 may be composed of a content 1836 and a number 1837. The KPI effect 1834 includes a node 1838 and a value 1839. The KGI effect 1835 may consist of a node 1840 and a value 1841.

  # 1831 is a number for distinguishing countermeasures. The selection column 1832 is a column for allowing the user to select a countermeasure, and includes a radio button 1850 for inputting the selection. The measure 1833 indicates the content of the recommended measure. Content 1836 indicates the content of the countermeasure. The number 1837 indicates a parameter of the content of the countermeasure (in the case of a countermeasure for installing a camera, the number of cameras, etc.). The KPI effect 1834 indicates a change in the KPI node and its value to which the recommended countermeasure is directly effective. A node 1838 indicates a KPI node. A value 1839 indicates the value of KPI. The KGI effect 1835 indicates a change in the node of the KGI whose recommended countermeasure is KGI. A node 1840 indicates a KGI node. A value 1841 indicates the value of KGI.

  The measure plan execution button 1860 is a button for the user to execute the measure plan selected by the user with the radio button 1850 in the selection field 1832. The cancel button 1861 is a button for canceling selection of the radio button 1850 input by the user. Thereby, it is possible to accept decision-making of countermeasures from the user on this screen.

  According to this embodiment, the probability of occurrence of a social threat can be predicted for each city. Since the algorithm for predicting the probability of occurrence of a social threat can be modified according to the results, it is possible to improve the prediction accuracy.

  Moreover, according to this embodiment, the influence which a social threat has on a company can be quantitatively analyzed in the form of KGI. Since the algorithm for calculating the KGI can also be modified according to the results, it is possible to increase the accuracy of the KGI calculation.

  Furthermore, according to this embodiment, it is providing the information for a company to determine the countermeasure against a social threat. Thereby, the management of a company can obtain a countermeasure plan necessary for obtaining a desired KGI, and can make a quick decision.

  Next, a second embodiment of the present invention will be described with reference to FIGS.

  In this embodiment, an embodiment in which the decision support system shown in the first embodiment is linked between a plurality of organizations will be described. Therefore, in the following description, differences from the first embodiment will be mainly described, and the same configurations or functions as those of the first embodiment may be denoted by the same reference numerals and description thereof may be omitted.

  FIG. 21 shows an example of the system configuration of the decision support system 203 according to the second embodiment of the present invention.

  The decision support system 203 includes a public cloud system 1900, an on-premises system 1910, and an on-premises system 1920. For the sake of convenience, the on-premises system 1910 and the on-premises system 1920 will be referred to as the A system and the B system, respectively, so that the on-premises system 1910 and the on-premises system 1920 can be easily distinguished. Each of the public cloud system 1900, the on-premises system 1910, and the on-premises system 1920 may be the decision support system 200 described in the first embodiment.

  The public cloud system 1900 predicts social threats using, for example, public information on the news site 130 (terrorism case 151, international dispute 152) and public information on the government agency 140 (economic indicators 153, demographics 154). The result may be transmitted to the on-premises system 1910 as terror prediction information 1930 and may be transmitted to the on-premises system 1920 as terror prediction information 1940. Thereby, the terrorism prediction process can be outsourced from the on-premises system to the public cloud system, and the calculation load and communication load of the on-premises system can be reduced. Alternatively, the public cloud system 1900 can increase the accuracy of terrorism prediction using the non-public information 1901 of the government agency 140, and transmit the result to the on-premises system as terror prediction information 1930 and terror prediction information 1940. By doing so, it is possible to use the prediction result with higher accuracy than the prediction result of only the public information in the on-premises system without transmitting the non-public information 1901 to the on-premises system. The terror prediction information 1930 may be terror prediction information only for public information, and the terror prediction information 1940 may be terror prediction information using also the non-public information 1901. The non-public information 1901 of the government agency 140 is used according to the on-premises system. It may be possible to select whether or not to use.

  Also, social threat impact analysis algorithms and countermeasure recommendation algorithms may be shared between on-premises systems. For example, the social threat impact analysis algorithm 1931 and countermeasure recommendation algorithm 1932 of the A system may be shared with the B system, and conversely, the social threat impact analysis algorithm 1941 and countermeasure recommendation algorithm 1942 of the B system may be shared with the A system. . For example, algorithms in the same industry have a lot in common, so sharing them can be expected to improve the accuracy of impact analysis and countermeasure recommendation. Whether to share or not to share may be selected for each on-premises system.

  FIG. 22 is a diagram showing a detailed processing flow of data collection and registration in the public cloud system 1900.

  In process S2001, the social situation data collection unit 212 of the public cloud system 1900 determines whether or not the social situation data collection time has come. The collection time may be registered in advance by the user. The collection time may be a periodic event such as “every Monday at 10:00”, or may be an irregular event such as “when a user inputs a collection instruction”. If it is the collection time, the process proceeds to step S2002, and if it is not the collection time, the process ends.

  In process S2002, the social situation data collection unit 212 of the public cloud system 1900 acquires a collection destination list of social situation data collection targets from the collection target list table 500 of the social situation database 223. For example, the social situation data collection unit 212 refers to the URL 506 of the information source 501.

  In process S2003, the social situation data collection unit 212 accesses the URL 506 referred to in process S2002 via the communication device 231 of the public cloud system 1900, and the social situation data (terrorist incident 151, international dispute 152, economic indicator). 153, demographics 154, etc.). The data to be collected is not limited thereto, and may be data that can be acquired from any information source registered in the collection target list table 500, for example. For this data collection, for example, Web crawling technology may be used. The collected data may be registered in the database of the public cloud system 1900 after the data is shaped by the text mining unit 213 of the public cloud system 1900. Use text mining technology for shaping. The registration destination database may follow the DB name 507, the table name 508, and the column name 509 specified in the storage destination DB 502 in the collection target list table 500 of the social situation database 223.

  In process S2004, the social situation data collection unit 212 collects the non-public information 1901 of the government agency 140 via the communication device 231, shapes the data in the text mining unit 213, and registers the data in the database. At this time, the access destination of the non-public information may be described in the collection target list table 500 and may be collected by referring to it, or a database or data file for managing confidential information separately from the collection target list table 500 For example, the access destination may be described in advance, and the user may refer to the access destination. Alternatively, the user may input the access destination via the input / output device 232 each time data is collected.

  FIG. 23 is a diagram illustrating a processing flow in which the public cloud system 1900 and the on-premises system 1910 share the prediction result of social threat (terrorism).

  In process S2102, the social threat prediction unit 214 of the public cloud system 1900 obtains a prediction algorithm (logistic regression equation) described in the social threat prediction algorithm file 225 of the public cloud system 1900.

  In process S2103, the social threat prediction unit 214 of the public cloud system 1900 obtains social situation data necessary for prediction from 223, and generates a logistic regression equation. A logistic regression equation is generated for each city.

  In process S2104, the social threat prediction unit 214 of the public cloud system 1900 calculates the probability of terrorism for each city based on the logistic regression equation generated in process S2103.

  In process S2105, the social threat prediction unit 214 of the public cloud system 1900 registers the probability of occurrence of terrorism calculated in process S2104 in the prediction, impact analysis, countermeasure recommendation result database 224, The terrorism prediction information 1930 is transmitted to the on-premises system 1910 via the communication device 231.

  In process S 2106, the social threat prediction unit 214 of the on-premises system 1910 receives the terror prediction information 1930 via the communication device 231 of the on-premises system 1910. The received terrorism prediction information is displayed on the input / output device 232 of the on-premises system 1910 and registered in the result database 224 of the prediction, impact analysis, and countermeasure recommendation of the on-premises system 1910. Further, it may be temporarily held in the main storage device 210 of the on-premises system 1910.

  FIG. 24 is a diagram showing a processing flow in which the public cloud system 1900 and the on-premises system 1910 share the social threat impact analysis algorithm.

  In process S2203, the algorithm improvement unit 217 of the public cloud system 1900 determines whether or not the algorithm sharing time has come. The sharing time may be registered in advance by the user. The sharing time may be a periodic event such as “every Monday at 10:00” or an irregular event such as “when a user inputs a sharing instruction”. If it is the sharing time, the process proceeds to step S2204.

  In process S2204, the algorithm improvement unit 217 of the public cloud system 1900 transmits an impact analysis algorithm collection request 2250 to the on-premises system 1910 via the communication device 231.

  In process S 2205, the algorithm improvement unit 217 of the on-premises system 1910 receives the collection request 2250 via the communication device 231.

  In process S2206, the algorithm improvement unit 217 of the on-premises system 1910 acquires the impact analysis algorithm (causal relationship model) described in the social threat impact analysis algorithm file 226 of the on-premises system 1910, and passes through the communication device 231. And sent to the public cloud system 1900 as the social threat impact analysis algorithm 1931.

  In process S <b> 2207, the algorithm improvement unit 217 of the public cloud system 1900 receives the social threat impact analysis algorithm 1931 via the communication device 231. The reception result may be displayed on the input / output device 232 of the public cloud system 1900.

  In process S2208, the algorithm improvement unit 217 of the public cloud system 1900 updates the social threat impact analysis algorithm file 226 of the public cloud system 1900 with the social threat impact analysis algorithm 1931 acquired from the on-premises system 1910. At this time, it is good also as conditions on obtaining user's approval.

  In process S2209, the algorithm improvement unit 217 of the public cloud system 1900 may distribute the social threat impact analysis algorithm 1931 via the communication device 231. The delivery destination may be, for example, another company of the same industry registered in advance.

  In process S2210, the algorithm improvement unit 217 of the on-premises system 1920 receives the social threat impact analysis algorithm 1931 via the communication device 231. The algorithm improvement unit 217 may display the reception result on the input / output device 232 of the on-premises system 1920.

  In process S2211, the algorithm improvement unit 217 of the on-premises system 1920 updates the social threat impact analysis algorithm file 226 of the on-premises system 1920 with the social threat impact analysis algorithm 1931 acquired from the on-premises system 1920. At this time, it is good also as conditions on obtaining user's approval.

  FIG. 25 is a diagram showing a processing flow in which the public cloud system 1900 and the on-premises system 1910 share the social threat countermeasure recommendation algorithm.

  In process S2303, the algorithm improvement unit 217 of the public cloud system 1900 determines whether or not the algorithm sharing time has come. The sharing time may be registered in advance by the user. The sharing time may be a periodic event such as “every Monday at 10:00” or an irregular event such as “when a user inputs a sharing instruction”. If it is the sharing time, the process proceeds to step S2304.

  In process S 2304, the algorithm improvement unit 217 of the public cloud system 1900 transmits a countermeasure recommendation algorithm collection request 2350 to the on-premises system 1910 via the communication device 231.

  In process S 2305, the algorithm improvement unit 217 of the on-premises system 1910 receives the collection request 2350 via the communication device 231.

  In process S2306, the algorithm improvement unit 217 of the on-premises system 1910 acquires the social threat countermeasure recommendation algorithm file 227 of the on-premises system 1910, and uses the public cloud system as the social threat countermeasure recommendation algorithm 1932 via the communication device 231. 1900.

  In process S2307, the algorithm improvement unit 217 of the public cloud system 1900 receives the social threat countermeasure recommendation algorithm 1932 via the communication device 231. The algorithm improvement unit 217 may display the reception result on the input / output device 232 of the public cloud system 1900.

  In process S 2308, the algorithm improvement unit 217 of the public cloud system 1900 updates the social threat countermeasure recommendation algorithm file 227 of the public cloud system 1900 with the social threat countermeasure recommendation algorithm 1932 acquired from the public cloud system 1900. At this time, it is good also as conditions on obtaining user's approval.

  In process S2309, the algorithm improvement unit 217 of the public cloud system 1900 may distribute the social threat countermeasure recommendation algorithm 1932 via the communication device 231. The delivery destination may be, for example, another company of the same industry registered in advance.

  In process S2310, the algorithm improvement unit 217 of the on-premises system 1920 receives the social threat countermeasure recommendation algorithm 1932 via the communication device 231. The algorithm improvement unit 217 may display the reception result on the input / output device 232 of the on-premises system 1920.

  In process S 2311, the algorithm improvement unit 217 of the on-premises system 1920 updates the social threat countermeasure recommendation algorithm file 227 of the on-premises system 1920 with the social threat countermeasure recommendation algorithm 1932 acquired from the on-premises system 1920. At this time, it is good also as conditions on obtaining user's approval.

  According to the present embodiment, when predicting the probability of occurrence of terrorism in the public cloud system 1900, if non-public information is provided, an improvement in prediction accuracy can be expected.

  Furthermore, according to the present embodiment, the impact analysis algorithm and the countermeasure recommendation algorithm can be shared between companies, so that improvement in accuracy can be expected for these.

  A third embodiment of the present invention will be described with reference to FIG.

  In the present embodiment, one form of a method for setting the KPI effect value 905 in the social threat countermeasure recommendation algorithm 227 (measure plan template) of the decision support system based on a logical basis is shown. Therefore, in the following description, only the setting part of the KPI effect value 905 will be described.

  FIG. 26 shows an example of a measure plan value-KPI causal model screen 8000 for setting the KPI effect value 905.

  In order to set the KPI effect value 905, the countermeasure plan numerical value-KPI causal model shown in the figure shows how the numerical value of the countermeasure content 902 (the number of cameras in the case of a countermeasure for installing a camera, etc.) It is a model that visualizes the causal relationship that exerts a positive effect.

  The measure plan numerical value-KPI causal model screen 8000 is displayed on the input / output device 232 of the decision support system 200, and includes a measure plan numerical value-KPI causal relationship model 2400.

  The causal relationship model 2400 includes a KPI node 2420 indicating the KPI effect node 904 in the countermeasure plan template, a sub KPI node 2421 that is a KPI used in the countermeasure plan numerical value-KPI causal relationship model 2400, and the causal effects of the sub KPI and KPI. The sub-arc 2422 indicating the relationship and the causal relationship between the sub-KPIs, and the mathematical expression 2440 expressing the causal relation by a mathematical expression may be used. Also, among the sub KPI nodes 2421, the countermeasure proposal numerical node 2423 is a node indicating the numerical value of the countermeasure contents 902 of the countermeasure proposal template. Furthermore, the company profile node 2430 is a node indicating the company profile data received from the user in step S1102.

  The user constructs the causal relationship between the numerical node 2423 and the KPI node 2420 of the countermeasure plan using the sub KPI and sub arc using the countermeasure plan numerical value-KPI causal model screen 8000, and performs simulation using these causal relationships. Thus, it is possible to confirm the change in the value of the KPI node 2420 with respect to the change in the value of the numerical value node 2423 of the countermeasure plan. Therefore, the KPI effect value 905 can be obtained based on the correspondence of this change.

  Although the KPI effect value 905 is set in the causal relationship model here, it is also possible to perform an FTA (Fault Tree Analysis) analysis and set the KPI effect value 905 from the analysis result.

  Alternatively, in any method, if the relationship between the numerical value of the countermeasure content 902 and the numerical value of the KGI node 1720 is clear, the numerical relationship is directly described in the KGI effect value 907 of the social threat countermeasure recommendation algorithm 227. The effect of KGI may be calculated using this.

  The above-described embodiments of the present invention are examples for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the present invention in various other modes without departing from the gist of the present invention.

  For example, the decision support system does not need to perform data collection, social threat prediction, impact analysis, and countermeasure planning in a series of procedures, and may perform each at a necessary timing. The probability of terrorism used for impact analysis and countermeasure planning does not have to be the probability predicted by this system. For example, impact analysis and countermeasure planning may be made using the probability of terrorism for each city obtained by some other method.

200 Decision Support System 214 Social Threat Prediction Unit 215 Social Threat Impact Analysis Unit 216 Social Threat Countermeasure Recommendation Unit 217 Algorithm Improvement Unit 221 Country-City Name Master Database 222 Company Profile Database 223 Social Situation Database 224 Prediction, Impact analysis and countermeasure recommendation result database 225 Social threat prediction algorithm file 226 Social threat impact analysis algorithm file 227 Social threat countermeasure recommendation algorithm file 230 Central controller 231 Communication device 232 Input / output device

Claims (8)

Means for calculating a change in the first index, which is an index relating to the influence of society or the economy due to the social threat, based on the probability of occurrence of the social threat;
Means for calculating a change in a second index, which is an index relating to an impact directly affected by the social threat, based on the occurrence probability of the social threat and the profile of the company;
Based on the definition information defining the causal relationship of the influence of the change of the first index or the change of the second index on the management index of the company, the change of the first index and the second index Means for predicting the change in the management index of the company from the change in
Change of the management index with reference to a countermeasure list in which a plurality of countermeasure candidates are associated with the effect indicating the degree of suppression of the change of the first or second index when each countermeasure candidate is implemented Means for drafting countermeasures that are within the prescribed range,
A decision support system comprising: means for outputting the countermeasure plan.   The decision support system according to claim 1, further comprising means for predicting an occurrence probability of the social threat using one or more of an economic growth rate, a population growth rate, and a past conflict situation.   3. The decision support system according to claim 1, further comprising means for updating the countermeasure list based on an evaluation result obtained by comparing an effect expected from the countermeasure plan and a result.   The decision support system according to any one of claims 1 to 3, further comprising means for updating the definition information based on an evaluation result obtained by comparing a prediction result of the change of the management index and a result. A decision support system comprising a first private system for a first company, a second private system for a second company, and a public system,
The public system is
A means of predicting the probability of occurrence of a social threat using one or more of economic growth rate, population growth rate and past conflict situations;
Means for transmitting the predicted probability of occurrence of the social threat to the first and second private systems,
The first private system is:
Means for calculating a change in a first index, which is an index related to an influence of the first company on the influence of the social threat, based on the occurrence probability of the social threat and the profile of the first company;
Based on the first definition information that defines the causal relationship of the influence of the change of the first index on the management index of the first company, the management of the first company is determined from the change of the first index. A means of predicting changes in indicators,
With reference to the first countermeasure list in which a plurality of countermeasure candidates and the effect indicating the degree of suppression of the change in the first index when each countermeasure candidate is implemented, the first company's And a means for drafting a countermeasure plan for the first company so that the change of the management index is within a predetermined range,
The second private system is
Means for calculating a change in a second index, which is an index relating to the influence of the second company on the social threat, based on the occurrence probability of the social threat and the profile of the second company;
Based on the second definition information defining the causal relationship of the influence of the change of the second index on the management index of the second company, the management of the second company from the change of the second index A means of predicting changes in indicators,
With reference to a second countermeasure list that associates a plurality of countermeasure candidates with an effect indicating the degree of suppression of the change in the second index when each countermeasure candidate is implemented, Means for drafting a countermeasure plan for a second company such that the change in the management index falls within a predetermined range. The first private system is:
Means for transmitting the first countermeasure list to the second private system;
The second private system is
The decision support system according to claim 5, wherein a countermeasure plan for the second company is made with reference to a first countermeasure list transmitted from the first private system. The first private system is:
Means for transmitting the first definition information to the second private system;
The second private system is
The decision support system according to claim 5, wherein a change in a management index of the second company is predicted using the first definition information transmitted from the first private system. Company profile data, definition information defining the causal relationship of the effect of changes in the first index or the second index on the management index of the company, a plurality of countermeasure candidates, and the above-mentioned when each countermeasure candidate is implemented A method performed by a decision support system having a storage unit that stores a countermeasure list that associates an effect indicating a degree of suppression of a change in the first or second index,
Calculating a change in the first index, which is the first index based on the probability of occurrence of a social threat, which is an index relating to the influence of society or the economy due to the social threat;
Based on the probability of occurrence of the social threat and the profile data of the company, the second index, which is an index relating to the effect that the company is directly affected by the social threat. Calculating a change in
Predicting a change in the management index of the company from a change in the first index and a change in the second index based on the definition information;
Referring to the countermeasure list, planning a countermeasure plan such that the change in the management index falls within a predetermined range;
A decision support method for executing the step of outputting the countermeasure plan.

Images