Information processing device, information processing method, and program

Abstract

This information processing device has: an integration unit for integrating a plurality of items of hypothetical solution information generated through a weighted hypothesis inference process using observed event information that represents an observed event and rule information that represents inferential knowledge; and a detection unit for detecting a difference between first integrated hypothetical solution information, which is generated by integrating one or more items of first hypothetical solution information generated using the observed event information and rule information by using the integration unit, and second integrated hypothetical solution information, which is generated by integrating one or more items of second hypothetical solution information by using the integration unit, the one or more items of second hypothetical solution information being generated when one or both of an observed event and a rule are altered.

Description

[Technical field]

[0001] The technical field relates to an information processing device and an information processing method for comparing inference results, and further to a program for implementing these. To Regarding. [Background technology]

[0002] In the field of cyber security, when an event is observed in a system, it is necessary to determine whether the observed event is the result of a cyber attack and take action based on the result. A method using hypothetical reasoning has been proposed as a method for making such a determination.

[0003] Abduction is an inference that uses observed events and inference knowledge (rules) given by logical expressions to derive a hypothesis that best explains the observed events. Therefore, by applying observed events to rules prepared in advance for the system to derive a hypothesis, it is possible to determine whether or not a cyber attack is the cause.

[0004] However, the conditions (observed events and rules) used in the hypothetical reasoning change over time. Also, when an error in the observed events is corrected or when the rules are updated to the latest version, the observed events or rules change, and the inference results of the hypothetical reasoning also change.

[0005] Therefore, we would like to compare the inference results before and after changing the conditions used in the hypothetical inference. Changing the conditions means changing the observed events, the rules, or both.

[0006] As a related technique, Patent Document 1 discloses an inference device that generates an integrated graph by combining directed graphs, which are information belonging to different domains among dynamically changing external information, using knowledge information provided from a knowledge base and inference rules provided from a rule database. The inference device of Patent Document 1 also traces the nodes of the combined graph via edges, executes probabilistic inference (deductive inference, inductive inference, and hypothetical inference), and calculates the importance of each node as a result of the inference. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] International Publication No. 2021-124502 Summary of the Invention [Problem to be solved by the invention]

[0008] However, the inference device of Patent Document 1 does not compare inference results before and after a condition used in hypothetical inference is changed.

[0009] Furthermore, if multiple solution hypotheses are output as inference results of weighted abduction, both before and after the change in conditions, users will not be able to easily grasp the inference results. Weighted abduction is an inference method that generates candidate hypotheses based on observed events and rules, and the candidate hypothesis with the smallest total cost is the solution hypothesis (the hypothesis that provides the best explanation: inference result).

[0010] One of the objectives is to provide an information processing device, an information processing method, and a method for detecting a difference between an inference result before a condition is changed and an inference result after a condition is changed, even if there are multiple solution hypotheses before and after the condition is changed. program The purpose of this invention is to provide [Means for solving the problem]

[0011] In order to achieve the above object, an information processing device according to one aspect comprises: an integration means for integrating a plurality of pieces of solution hypothesis information generated by the weighted abductive reasoning process using observed event information representing observed observation events and rule information representing reasoning knowledge; a detection means for detecting a difference between first integrated solution hypothesis information generated by integrating, by the integration means, one or more first solution hypothesis information generated using the observed event information and the rule information, and second integrated solution hypothesis information generated by integrating, by the integration means, one or more second solution hypothesis information generated when the observed event and / or the rule information are changed; The present invention is characterized by having the following.

[0012] In order to achieve the above object, an information processing method according to one aspect includes: An information processing device, generating first integrated solution hypothesis information by integrating one or more first solution hypothesis information generated by the weighted abductive reasoning process using condition information having observed event information representing an observed observation event and rule information representing inference knowledge; when the observed event information and / or the rule information included in the condition information is changed, using the changed condition information to integrate one or more pieces of second solution hypothesis information generated by the weighted abductive reasoning process to generate second integrated solution hypothesis information; detecting a difference between the first integrated solution hypothesis information and the second integrated solution hypothesis information; The present invention is characterized by executing a process.

[0013] Furthermore, in order to achieve the above object, M is , On the computer, generating first integrated solution hypothesis information by integrating one or more first solution hypothesis information generated by the weighted abductive reasoning process using condition information having observed event information representing an observed observation event and rule information representing inference knowledge; when the observed event information and / or the rule information included in the condition information is changed, using the changed condition information to integrate one or more second solution hypothesis information generated by the weighted abductive reasoning process to generate second integrated solution hypothesis information; detecting a difference between the first integrated solution hypothesis information and the second integrated solution hypothesis information; child It is characterized by: Effect of the Invention

[0014] As one aspect, even if there are multiple solution hypotheses before and after a condition change, it is possible to detect differences between the inference results before and after a condition change. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a diagram for explaining generation of hypothesis candidates. [Diagram 2] FIG. 2 is a diagram for explaining the derivation of a solution hypothesis. [Diagram 3] FIG. 3 is a diagram for explaining a comparison of individual solution hypotheses. [Figure 4] FIG. 4 is a diagram illustrating an example of an information processing device. [Diagram 5] FIG. 5 is a diagram for explaining the backward inference operation. [Figure 6] FIG. 6 is a diagram for explaining how conjunctions are handled in backward reasoning operations. [Figure 7] FIG. 7 is a diagram for explaining a case where conjunctions are explicitly handled. [Figure 8] FIG. 8 is a diagram for explaining a case where conjunctions are not distinguished. [Figure 9] FIG. 9 is a diagram for explaining the unification operation. [Figure 10] FIG. 10 is a diagram showing an example of the result (solution hypothesis) of executing weighted abductive reasoning. [Figure 11]FIG. 11 is a diagram illustrating an example of a union of literals. [Figure 12] FIG. 12 is a diagram showing an example of a union of a literal and a backward inference operation. [Figure 13] FIG. 13 is a diagram showing an example of a union of a literal, a backward inference operation, and a unification operation. [Figure 14] FIG. 14 is a diagram for explaining a comparison of integrated solution hypotheses. [Figure 15] FIG. 15 is a diagram for explaining the disappearance and appearance of a hypothetical literal. [Figure 16] FIG. 16 is a diagram illustrating an example of a system having an information processing device. [Figure 17] FIG. 17 is a diagram for explaining the presentation of disappearances and appearances of hypothesis literals. [Figure 18] FIG. 18 is a diagram for explaining the presentation of changes in the occurrence locations of hypothesis literals. [Figure 19] FIG. 19 is a diagram for explaining the presentation of change 1 in the structure of the backward reasoning operation. [Figure 20] FIG. 20 is a diagram for explaining the presentation of change 2 in the structure of the backward reasoning operation. [Figure 21] FIG. 21 is a diagram for explaining the indication of the presence or absence of unification. [Figure 22] FIG. 22 is a diagram for explaining the operation of the information processing device. [Diagram 23] FIG. 23 is a diagram illustrating an example of a computer that realizes the information processing device in the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Explain hypothetical reasoning. Hypothetical reasoning is a method of reasoning that uses observed events (observed events or observations) and inference knowledge (rules) to derive a hypothesis that best explains the observed events.

[0017] Observational events are a set of logical expressions in which facts that are known through observation or from common sense are expressed as first-order predicate logical expressions.

[0018] A rule is a logical formula, or a set of logical formulas, that expresses a relationship (causal or implication relationship) between two events expressed as first-order predicate logical formulas, in which if one event is true, the other event is also necessarily true. A rule is expressed as the logical formula "A⇒B", where the logical formula for one event is "A" and the logical formula for the other event is "B". In what follows, the left-hand side of the rule (the side to the left of the logical symbol "⇒") is called the antecedent, and the right-hand side (the side to the right of "⇒") is called the consequent.

[0019] Specifically, abductive reasoning is an inference that, given the rule "A ⇒ B" ("If A is true, then B is true"), if an observed event "B" ("B is true") is observed, it infers that "B is true" because "A is true", and thus forms the hypothesis that "A is true".

[0020] If "p" is a predicate symbol and "t1, t2..." are terms, then "p(t1, t2...)" is an elementary logical formula (atomic logical formula). An elementary logical formula or an elementary logical formula with a negation symbol attached is a literal.

[0021] Also, if "P" and "Q" are logical formulas, then "￢P", "P∧Q", "P∨Q", and "P⇒Q" are also logical formulas. The logical symbol "∧" represents conjunction, the logical symbol "∨" represents disjunction, the logical symbol "￢" represents negation, and "⇒" represents causation or implication.

[0022] Predicate symbols represent relationships and properties related to objects. Terms have constant symbols and variable symbols. Constant symbols represent individual objects that exist in the world you want to express. Variable symbols represent objects in the world you want to express, but are used when it is not specifically decided what they correspond to. In what follows, constant symbols will be called constants and variable symbols will be called variables. Constants will be represented by strings beginning with a capital letter or enclosed in quotation marks. Variables will be represented by any other string.

[0023] Weighted a priori reasoning is a method of inference in which candidate hypotheses are output based on observed events and rules, and the candidate hypothesis with the smallest total sum of costs is selected as the solution hypothesis (the hypothesis that provides the best explanation: the inference result).

[0024] In weighted abductive reasoning, a cost is assigned to the literal of an observed event (observation literal). For example, if the observation literals are the following "murder(A)", "police(B)", and "arrest(B,A)", and a cost of "10" is assigned to each observation literal, they can be expressed as "murder(A):10", "police(B):10", and "arrest(B,A):10". The cost is an index that indicates to what extent the observation literal should be explained.

[0025] In addition, a weight is assigned to each literal in the antecedent of a rule. For example, if the rules are as follows: "kill(x,y)⇒arrest(z,x)" and "kill(x,y)⇒murder(x)", and the antecedent literals "kill(x,y)" and "kill(x,y)" are assigned weights of "1.4" and "1.2", respectively, the rules are expressed as "kill(x,y):1.4⇒arrest(z,x)" and "kill(x,y):1.2⇒murder(x)". Weights are indicators of how unreliable it is to infer the antecedent from the consequent. In the following, costs and weights may be omitted if they are not necessary for the explanation.

[0026] A hypothesis candidate is generated by combining a backward inference operation and a unification operation. Fig. 1 is a diagram for explaining the generation of a hypothesis candidate. Fig. 1A is a diagram for explaining the backward inference operation. Fig. 1B is a diagram for explaining the unification operation.

[0027] A backward reasoning operation is an operation that follows the rules backwards to make a hypothesis. In other words, a backward reasoning operation generates a literal (hypothesis literal) that represents a hypothetical event. In the example in Figure 1, shapes (rounded rectangles: see the explanation in Figure 1) that represent observation literals and hypothesis literals are shown, and a cost ("$ __") is added above the shapes. "$" is the symbol that represents the cost, and the number (__) next to the "$" represents the cost.

[0028] The cost of the observation literal (the cost of the inference basis) is propagated to the hypothesis literal. The cost of the hypothesis literal is the cost of the inference basis multiplied by the weight of the rule. For example, if the cost of the observation literal is "10" and the weight is "1.2", the cost of the hypothesis literal is "12".

[0029] A unification operation is an operation that makes a hypothesis that literals with the same predicate symbol are the same as each other. For example, in the case of the hypothesis literals "kill(A,u1)" and "kill(A,u2)", when these hypothesis literals are unified, they are considered to be the same. Therefore, the variables "u1" and "u2" contained in each hypothesis literal are considered to be the same.

[0030] When performing a unification operation, the higher of the costs of the two unified hypothesis literals is cancelled. In the example of B in Figure 1, "$12" and "$14" represent costs, and since "$14" has a higher cost, it is cancelled and becomes "$0".

[0031] The sum of the costs of all the candidate hypotheses is calculated using, for example, Equation 1.

[0032]

number

[0033] In the example in Figure 1B, the total cost would be $22 (= $10 + $12).

[0034] The solution hypothesis is the candidate hypothesis that has the smallest total sum of all the costs among the candidate hypotheses. The derivation of the solution hypothesis will be specifically explained. Figure 2 is a diagram for explaining the derivation of the solution hypothesis. Figure 2 shows the results (candidate hypotheses 1 to 5) of applying weighted abductive reasoning to the rule "X(t1): 0.6 ∧ Y(t1): 0.6 ⇒ Q(n), X(t2): 0.6 ∧ Z(t2): 0.6 ⇒ Q(n)" and the observed event "X(T1): 10 ∧ Q(N): 100". For example, candidate hypothesis 1 is a candidate hypothesis to which no backward reasoning operation or unification operation has been applied.

[0035] Of the candidate hypotheses 1 to 5 in Figure 2, the candidate hypothesis with the smallest total sum of costs is the solution hypothesis, so the solution hypotheses are candidate hypotheses 4 and 5. In this way, there may be multiple solution hypotheses with the same cost but different configurations.

[0036] An explanation will be given to facilitate understanding of the embodiment. For example, if the weighted abductive reasoning performed before the conditions (observed events and rules) were changed is called inference A, and the weighted abductive reasoning performed after the conditions were changed is called inference B, then the number of solution hypotheses (hypotheses with the lowest cost) for inference A is called KA (multiple), and the number of solution hypotheses for inference B is called KB (multiple).

[0037] In this case, simply comparing the multiple solution hypotheses of hypothesis A with the multiple solution hypotheses of hypothesis B requires KA × KB comparisons. A comparison is, for example, an operation for finding the common parts and differences of the solution hypotheses.

[0038] Furthermore, if a simple comparison is made, the following problems (1) and (2) arise: (1) The more solution hypotheses there are, the more exponentially the comparison results that can be obtained, so it is not easy to list the comparison results. (2) When the number of comparison results increases explosively, it is not easy to grasp the overall trend of the differences between the solution hypotheses of inference A and inference B from the individual comparison results.

[0039] In other words, it is difficult to understand which hypothesis parts will disappear and which hypothesis parts will appear overall as a result of changing the conditions.

[0040] One example is a case where a hypothesis literal that was generally included in multiple solution hypotheses of inference A disappears in the solution hypothesis of inference B.

[0041] Figure 3 is a diagram for explaining a comparison of individual solution hypotheses. The two solution hypotheses SHA1 and SHA2 of inference A in Figure 3 are inference results obtained by applying weighted abductive reasoning to the rule "X(t1): 0.6 ∧ Y(t1): 0.6 ⇒ Q(n), X(t2): 0.6 ∧ Z(t2): 0.6 ⇒ Q(n)" and the observed event "X(T1): 10 ∧ Q(N): 100".

[0042] The two solution hypotheses SHB1 and SHB2 of inference B in Figure 3 are the inference results obtained by applying weighted abductive reasoning to the rule “X(t1): 0.6 ∧ Y(t1): 0.6 ⇒ Q(n), X(t2): 0.6 ∧ W(t2): 0.6 ⇒ Q(n)” and the observed event “X(T1): 10 ∧ Q(N): 100”.

[0043] In the example of Figure 3, the borders of the nodes representing the disappearing hypothesis literals "Y" and "Z" are dotted, and the borders of the nodes representing the appearing hypothesis literals "Y" and "W" are shaded. The directed links (arrows) of the disappearing backward inference operations "Y → Q" and "Z → Q" are dotted. In the following, directed links are represented as "→".

[0044] That is, in inference B, the rule "X(t2): 0.6 ∧ Z(t2): 0.6 ⇒ Q(n)" used in inference A is deleted, and a new rule "X(t2): 0.6 ∧ W(t2): 0.6 ⇒ Q(n)" is added. Note that in the example of Figure 3, terms and costs are omitted to make the explanation easier to understand. Note that, in the following, terms and costs may be omitted in other figures as well.

[0045] In addition, in the example of Figure 3, when solution hypotheses SHA1 and SHB1 are compared, SHA1 and SHB2 are compared, SHA2 and SHB1 are compared, and SHA2 and SHB2 are compared, the comparison results shown in Figure 3 are SHA1:SHB1, SHA1:SHB2, SHA2:SHB1, and SHA2:SHB2.

[0046] Looking at the comparison result SHA1:SHB1, there is no difference between the configuration of solution hypothesis SHA1 and the configuration of solution hypothesis SHB1. In the comparison result SHA1:SHB2, the configuration in which the hypothesis literal "Y" has disappeared from the configuration of solution hypothesis SHA1 and the hypothesis literal "W" has appeared is solution hypothesis SHB1. In the comparison result SHA2:SHB1, the configuration in which the hypothesis literal "Z" has disappeared from the configuration of solution hypothesis SHA2 and the hypothesis literal "Y" has appeared is solution hypothesis SHB1. In the comparison result SHA2:SHB2, the configuration in which the hypothesis literal "Z" has disappeared from the configuration of solution hypothesis SHA2 and the hypothesis literal "W" has appeared is solution hypothesis SHB2.

[0047] However, as mentioned above, it is difficult to grasp the overall trend of the differences between the solution hypotheses of inference A and inference B from the results of individual comparisons.

[0048] One of the reasons for the difficulty in the example in Figure 3 is that in the comparison result SHA1:SHB2 and the comparison result SHA2:SHB1 in Figure 3, the hypothesis literal "Y" disappears in the comparison result SHA1:SHB2, but "Y" appears in the comparison result SHA2:SHB1, so such a hypothesis literal "Y" must be considered as canceling out. This is because, as mentioned above, there is no difference in structure between the solution hypothesis for deduction A that includes the hypothesis literal "Y", SHA1, and the solution hypothesis for deduction B that includes the hypothesis literal "Y", SHB1.

[0049] In other words, in order to grasp the difference between the entire solution hypothesis of inference A and the entire solution hypothesis of inference B, it is necessary to cancel out the hypothesis literal "Y" as described above. Therefore, it becomes very complicated to derive the difference between the entire solution hypothesis of inference A and the entire solution hypothesis of inference B.

[0050] Furthermore, using an example different from that in Figure 3, we will show that the differences cannot be seen by simply piling up the KA × KB individual comparison results. For example, consider the result of comparing one of the solution hypotheses of hypothesis A (called SHA1) with all of the KB solution hypotheses of hypothesis B. The comparison yields KB comparison results.

[0051] If the solution hypotheses for deduction B include one that is exactly the same as solution hypothesis SHA1, then the comparison will be between identical hypotheses (solution hypotheses SHA1 and SHA1), and there will be no difference in the comparison results. In other words, even if the conditions are changed, the solution hypothesis SHA1 can be obtained without any effect.

[0052] In this case, there are differences between the remaining (KB-1) comparison results (the comparison results between the remaining solution hypotheses of hypothesis B (≠SHA1) and SHA1), but whether these comparison results are meaningful depends on whether there are other solution hypotheses in hypothesis A.

[0053] For example, if KA=1 (only SHA1 is the solution hypothesis) and KB>1 (there is one or more solution hypotheses other than SHA1), the remaining (KB-1) comparison results will simply be the difference between hypothesis A and hypothesis B. However, if KA=KB and all solution hypotheses in hypothesis A are the same as those in hypothesis B, we want to see whether there are differences between all the solution hypotheses in hypothesis A and all the solution hypotheses in hypothesis B, so hypothesis A and hypothesis B should be considered to have no differences.

[0054] However, the remaining (KB-1) comparison results mentioned above are the results of comparisons between solution hypotheses different from solution hypothesis SHA1, so there are naturally differences.Similarly, if we simply add up the differences in the KA × KB comparison results, we arrive at the strange conclusion that there is a difference between hypothesis A and hypothesis B.

[0055] This means that the results of individual comparisons should not simply be added together, but that one comparison result must take into account cancellations between the results of other comparisons. For example, if one comparison result shows that the literal "X" is missing, but another comparison result shows that the literal "X" appears, then adding them together will result in no difference.

[0056] Furthermore, if there are identical solution hypotheses between inference A and inference B, then it is sufficient to match them with each other, and there is no need to compare them with other solution hypotheses (there is no need to derive a comparison result with differences). However, if there are no identical hypotheses, there will always be multiple comparison results with differences, and these comparison results must be compared to distinguish between those that cancel each other out and those that are true differences. Therefore, if differences are derived from KA × KB individual comparison results, the process of deriving the differences becomes extremely cumbersome.

[0057] Through this process, the inventor discovered a problem with the method described above, in that when there are multiple solution hypotheses both before and after the change in conditions, it is not easy to grasp the difference between the inference results before and after the change in conditions, and he also came to derive a means for solving this problem.

[0058] That is, the inventor has derived a means for easily grasping the difference between the inference results before and after the change of conditions by using the comparison result (comparison result in which overlaps are eliminated) between an integrated solution hypothesis that integrates multiple solution hypotheses before the change of conditions and an integrated solution hypothesis that integrates multiple solution hypotheses after the change of conditions. As a result, the difference in the inference results due to the change of conditions can be presented to the user in an easy-to-understand manner.

[0059] (Embodiment) The configuration of the information processing device 10 in the embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram for explaining an example of the information processing device.

[0060] [Device configuration] The information processing device 10 shown in Fig. 4 is a device that presents a difference in inference results due to changes in conditions in an easily understandable manner to a user. As shown in Fig. 4, the information processing device 10 includes an integration unit 11 and a detection unit 12.

[0061] The integration unit 11 integrates a plurality of pieces of solution hypothesis information generated by the weighted hypothetical reasoning process, using observed event information representing observed events and rule information representing reasoning knowledge.

[0062] The following describes the integration of multiple solution hypothesis information. The process of integrating solution hypothesis information is a process of deriving a union of each of the elements (literals, backward reasoning operations, and unification operations) that compose multiple solution hypothesis information generated under the same conditions.

[0063] (A) Literal integration If a literal included in one solution hypothesis and a literal included in another solution hypothesis have the same predicate symbol, term value, and the presence or absence of a negation symbol, they are determined to be the same literal. In other words, they are considered to be duplicates when deriving the union.

[0064] Regarding the presence or absence of a negation symbol, a case without a negation symbol (positive literal "X(N,M)": N and M are constants) is determined to be different from a case with a negation symbol (negative literal "￢X(N,M)")

[0065] However, if both literals for a certain term are variables, the term may be determined to be equal. Also, an observation literal and a hypothesis literal are not determined to be the same literal.

[0066] For example, for a hypothetical literal "X(N,M)" contained in a solution hypothesis, the only literal contained in another solution hypothesis that is considered to be identical is the hypothetical literal "X(N,M)". Even if another solution hypothesis contains the observation literal "X(N,M)", it is not judged to be identical.

[0067] In addition, if the second term of the hypothesis literal "X(N,m)" included in a solution hypothesis is a variable, and another solution hypothesis also contains a hypothesis literal "X(N,p)" whose second term is also a variable, the values ​​of the second terms are determined to be equal. Therefore, these literals are determined to be the same.

[0068] However, the hypothesis literal “X(N,m)” is not determined to be identical to the hypothesis literal “X(N,M)” (the second term of which is a constant) contained in another solution hypothesis, or to the observation literal “X(N,p).”

[0069] (B) Integration of backward reasoning operations When a (one or more) hypothesis literal corresponding to the consequent is generated by a backward inference operation using a rule, or when a (one or more) hypothesis literal corresponding to the antecedent is generated from an observation literal, a directed link is attached from each literal in the antecedent to each literal in the consequent, thereby forming a backward inference operation.

[0070] For example, when the rule "X(a) ∧ Y(b) ∧ Z(c) ⇒ Q(n) ∧ R(m)" is used for observation literals Q(N) and R(M) and hypothesis literals X(a), Y(b) and Z(c) are generated by a backward inference operation, as shown in Figure 5, the backward inference operation is treated as individual directed links such as from "X" to "Q" and from "Y" to "R". Figure 5 is a diagram for explaining the backward inference operation. The links (arrow lines) in Figure 5 represent the backward inference operation. The direction of the links is from the antecedent to the consequent.

[0071] In addition, if the literals at the link source of a solution hypothesis and the literals at the link destination of a solution hypothesis are the same, they are considered to be the same link. In other words, they are considered to be duplicates when deriving the union.

[0072] The conditions for determining whether a literal is the same are as described above. In the example shown in Figure 5, the rule for the link from "X" to "Q" is that "X" in the link source of a certain solution hypothesis is linked to "Q". destination "Q" in the answer is linked to "X" which is the link source of another solution hypothesis. destination If the two are determined to be identical to each other, then the link is also determined to be identical.

[0073] The following describes how conjunctions are handled in backward inference operations. As described above, regarding each literal as having a directed link means that the presence or absence of conjunctions is not distinguished when deriving the union of the backward inference operation.

[0074] Fig. 6 is a diagram for explaining how to handle conjunctions in a backward inference operation. When explicitly distinguishing whether or not a conjunction exists, the backward inference operation may be treated as a directed hyperlink connecting a hypernode 61 including "X", "Y", and "Z" with a hypernode 62 including "Q" and "R", as shown in Fig. 6A. Alternatively, as shown in Fig. 6B, the backward inference operation may be treated as a set of links from "X", "Y", and "Z" toward a node 63 and links from the node 63 toward "Q" and "R".

[0075] Furthermore, when explicitly distinguishing between the presence or absence of conjunctions as described above, if the literals in the antecedent and the literals in the consequent of a given solution hypothesis are all identical, they are determined to be the same backward reasoning operation. In what follows, we will not explain the case where explicitly distinguishing between the presence or absence of conjunctions, but it is self-evident that this can be handled in the same way as the case of directed links that do not distinguish between the presence or absence of conjunctions.

[0076] Fig. 7 is a diagram for explaining a case where the presence or absence of conjunctions is explicitly distinguished. In Fig. 7, backward inference operations are handled by the method shown in B of Fig. 6. Fig. 8 is a diagram for explaining a case where the presence or absence of conjunctions is not distinguished.

[0077] In Figures 7 and 8, in solution hypothesis 1, hypothesis literal X(a) is generated by a backward inference operation using the rule "X(a) ⇒ Q(n)" for observation literal Q(N), while in solution hypothesis 2, hypothesis literals X(a) and Y(b) are generated by a backward inference operation using the rule "X(a) ∧ Y(b) ⇒ Q(n)" for observation literal Q(N). When explicitly distinguishing conjunctions, focusing on "X" and "Q" in Figure 7, in solution hypothesis 1, a directed link is connected directly from "X" to "Q," while in solution hypothesis 2, a directed link is connected from "X" to the node, and further a directed link is connected from the node to "Q."

[0078] Therefore, when solution hypotheses 1 and 2 in Figure 7 are combined, a direct directed link from "X" representing "X⇒Q" to "Q" is distinguished from a directed link from "X" representing a part of "X∧Y⇒Q" to a node, and a directed link from the node to "Q" is distinguished as shown in Figure 7. If conjunctions are not distinguished, focusing on "X" and "Q" in Figure 8, a direct directed link is connected from "X" to "Q" in both solution hypotheses 1 and 2. Therefore, when solution hypotheses 1 and 2 in Figure 8 are combined, a directed link from "X" representing "X⇒Q" to "Q" and a directed link from "X" representing a part of "X∧Y⇒Q" to "Q" are regarded as the same as each other as shown in Figure 8, and so these are combined as the "X→Q" link.

[0079] (C) Integration of unification operations When a unification operation is applied to a pair of literals that have the same predicate symbol, the unification operation is treated as an undirected link connecting those literals.

[0080] For example, when a unification operation is applied to an observation literal X(N,M) and a hypothesis literal X(N,m), it is expressed as shown in Figure 9. Figure 9 is a diagram for explaining the unification operation. The dashed lines in Figure 9 represent the unification operation.

[0081] If a unification operation (link) of a solution hypothesis and a unification operation (link) of another solution hypothesis have the same literals at one end of each link and the same literals at the other end of each link, they are determined to be the same link. In other words, they are considered to be duplicates when deriving the union. The conditions for literals to be considered the same are as described above.

[0082] The generation of the integrated solution hypothesis information will now be described in detail. The integration unit 11 uses literal information representing literals, backward reasoning operation information representing a backward reasoning operation, and unification operation information representing a unification operation, which are included in solution hypothesis information representing multiple solution hypotheses generated by the weighted abductive reasoning process, to find the union of literals, the union of backward reasoning operations, and the union of unification operations, and generates integrated solution hypothesis information representing an integrated solution hypothesis, which is a set consisting of the union of literals, the union of backward reasoning operations, and the union of unification operations.

[0083] That is, the integration unit 11 uses literal information representing literals, backward reasoning operation information representing a backward reasoning operation, and unification operation information representing a unification operation, which are included in solution hypothesis information representing multiple solution hypotheses generated by the same weighted abductive reasoning process, to find the union of literals, the union of backward reasoning operations, and the union of unification operations using the processes shown in (A), (B), and (C) above, and generates a set consisting of these unions (integrated solution hypothesis information).

[0084] The integrated solution hypothesis information has literal information (observation literal information and hypothesis literal information) representing a literal, backward inference operation information representing a relationship between the literal and a backward inference operation, and unification operation information representing the literal and a unification operation.

[0085] The observation literal information includes observation literal identification information for identifying the observation literal information, and information representing the contents of the observation literal (logical formula). The hypothesis literal information includes hypothesis literal identification information for identifying the hypothesis literal information, and information representing the contents of the hypothesis literal (logical formula).

[0086] Specifically, first, the integration unit 11 acquires solution hypothesis information representing one or more solution hypotheses that is generated based on condition information (observation event information and rule information) stored in the storage device.

[0087] The solution hypothesis information is information about a solution hypothesis generated by executing a weighted abductive reasoning process using, for example, the following condition information. Note that the following condition information is merely an example and is not limiting.

[0088] rule: X(t1):0.5 ∧ Y(t1):0.5 ⇒ Q(n) X(t2): 0.5 ∧ Z(t2): 0.5 ⇒ Q(n) W(t3):0.5∧Z(t3):0.5⇒Q(n)∧R(n) V(t4): 0.5 ∧ Z(t4): 0.5 ⇒ Q(n) U(t5): 1.0⇒V(t5) S(t6):1.0⇒V(t6) U(t5):1.0⇒S(t5) Observed phenomena: X(T1):10∧U(T2):10∧W(T3):10∧W(T4):10∧Q(N):100∧R(N):0

[0089] For example, in the field of cybersecurity, X, Y, Z, W, V, U, and S are predicates that indicate traces that may be left behind when a cyber attack is carried out. Examples of traces include "execution of suspicious programs," "large amounts of data communication," and "registration of periodic tasks."

[0090] These traces are extracted from logs stored in computers, proxy servers, etc.; that is, an observation literal is generated as one of the observed events by being observed. Q is a predicate indicating a query for hypothetical reasoning, i.e., a query as to whether or not there has been a cyber attack. R is a predicate indicating constraints on the query (such as the target time or domain). Since Q and R are queries for hypothetical reasoning, they are treated as given observations. t1 to t6 and T1 to T4 are terms indicating time. n and N are formal terms given to the query.

[0091] Next, the integration unit 11 uses one or more pieces of solution hypothesis information to obtain (a) the union of literals, (b) the union of backward reasoning operations, and (c) the union of unification operations, and generates integrated solution hypothesis information.

[0092] For example, when solution hypotheses 1 to 6 as shown in FIG. 10 are obtained as a result of the weighted abductive reasoning, the integration unit 11 executes the process of generating integrated solution hypothesis information as follows.

[0093] Fig. 10 is a diagram showing an example of the result (solution hypothesis) of executing weighted abductive reasoning. Note that in Fig. 10, backward reasoning operation is handled without distinguishing whether conjunctions are present or not.

[0094] (a) Explain the process of deriving the union of literals. For example, it is determined that all the observation literals included in solution hypotheses 1 to 6 in Figure 10 are identical. In other words, since they are solution hypotheses for inference under the same conditions, the observation literals do not differ between solution hypotheses.

[0095] In addition, for the hypothetical literals included in solution hypotheses 1 to 6 in Figure 10, "X(t11)" in solution hypothesis 1 and "X(t12)" in solution hypothesis 2 are determined to be identical because the value of the term is a variable.

[0096] Similarly, "Z(t12)" of solution hypothesis 2, "Z(t13)" of solution hypothesis 3, and "Z(t14)" of solution hypothesis 4, "W(t13)" of solution hypothesis 3 and "W(t14)" of solution hypothesis 4, "V(t15)" of solution hypothesis 5 and "V(t16)" of solution hypothesis 6, "U(t15)" of solution hypothesis 5, "U(t16)" of solution hypothesis 6, "Z(N)" of solution hypothesis 5 and "Z(N)" of solution hypothesis 6 are determined to be identical. Note that "Z(t12)" of solution hypothesis 2 and "Z(N)" of solution hypothesis 5 are not determined to be identical because the values ​​of the terms are a variable and a constant, respectively.

[0097] By the above-mentioned process, the union of literals is obtained as shown in Fig. 11. Note that all variables are unified to "t". Fig. 11 is a diagram showing an example of the union of literals.

[0098] (b) Explain the process of deriving the union of backward inference operations. In a plurality of solution hypotheses, if the literals at the source of a directional link (backward inference operation) and the literals at the destination of the directional link are determined to be the same, then the directional link is also determined to be the same.

[0099] For example, in Figure 10, "X(t11) → Q(N)" in solution hypothesis 1 and "X(t12) → Q(N)" in solution hypothesis 2 are determined to be identical because the link source, "X(t11)" in solution hypothesis 1 and "X(t12)" in solution hypothesis 2, and the link destination, "Q(N)" in solution hypothesis 1 and "Q(N)" in solution hypothesis 2, are each determined to be identical, and therefore the links are also identical.

[0100] Similarly, "Z(t12) → Q(N)" in solution hypothesis 2, "Z(t13) → Q(N)" in solution hypothesis 3, and "Z(t14) → Q(N)" in solution hypothesis 4, "W(t13) → Q(N)" in solution hypothesis 3 and "W(t14) → Q(N)" in solution hypothesis 4, "Z(t13) → R(N)" in solution hypothesis 3 and "Z(t14) → R(N)" in solution hypothesis 4, "W(t13) → R(N)" in solution hypothesis 3 and "W(t14) → R(N)" in solution hypothesis 4, "V(t15) → Q(N)" in solution hypothesis 5 and "V(t16) → Q(N)" in solution hypothesis 6, and "Z(N) → Q(N)" in solution hypothesis 5 and "Z(N) → Q(N)" in solution hypothesis 6 are determined to be identical.

[0101] Through the above process, a union of backward inference operations combined with literals is obtained, as shown in Fig. 12. Fig. 12 is a diagram showing an example of a union of a literal and a backward inference operation.

[0102] (c) Explain the process of deriving the union of unification operations. In a plurality of solution hypotheses, if the literals at one end of an undirected link (unification operation) and the literals at the other end are determined to be identical, then the link is also determined to be identical.

[0103] For example, in FIG. 10, "X(t11)-X(T1)" of solution hypothesis 1 and "X(t12)-X(T1)" of solution hypothesis 2 are the same because "X(t11)" of solution hypothesis 1 and "X(t12)" of solution hypothesis 2, which are one end of the link, and "X(T1)" of solution hypothesis 1 and "X(T1)" of solution hypothesis 2, which are the other end of the link, are each determined to be the same, and therefore the links are also the same.

[0104] Similarly, "U(t15)~U(T2)" in solution hypothesis 3 and "U(t16)~U(T2)" in solution hypothesis 4 are determined to be the same. Note that hereafter, undirected links will be represented as "~".

[0105] Through the above-mentioned processing, a union of unification operations, which is a combination of literals and backward inference operations, is obtained, as shown in Fig. 13. Fig. 13 is a diagram showing an example of a union of a literal, a backward inference operation, and a unification operation.

[0106] In this manner, the integration unit 11 performs the processes shown in (a), (b), and (c) above, and generates integrated solution hypothesis information using the results of the processes.

[0107] The detection unit 12 detects a difference between first integrated solution hypothesis information generated by integrating by the integrating unit 11 one or more first solution hypothesis information (information representing solution hypotheses before the conditions are changed) generated using the observed event information and the rule information, and second integrated solution hypothesis information generated by integrating by the integrating unit 11 one or more second solution hypothesis information (information representing solution hypotheses after the conditions are changed) generated when the observed event information and the rule information, or either one of them, is changed.

[0108] When there is only one first solution hypothesis and one second solution hypothesis, detection unit 12 detects the difference between the first solution hypothesis and the second solution hypothesis.

[0109] Furthermore, when there is one first solution hypothesis and a plurality of second solution hypotheses, detection unit 12 sets the first solution hypothesis as first integrated solution hypothesis information, and detects the difference between this and the second integrated solution hypothesis information.

[0110] Furthermore, when there are multiple first solution hypotheses and one second solution hypothesis, detection unit 12 sets the second solution hypothesis as second integrated solution hypothesis information, and detects the difference from the first integrated solution hypothesis information.

[0111] Specifically, the detection unit 12 uses observation literal information representing an observation literal, hypothesis literal information representing a hypothesis literal, backward inference operation information representing a backward inference operation, and unification operation information representing a unification operation, which are contained in the first integrated solution hypothesis information and the second integrated solution hypothesis information, respectively, as elements, derives a difference set and an intersection set of the first integrated solution hypothesis information and the second integrated solution hypothesis information, and detects a difference between the first integrated solution hypothesis information and the second integrated solution hypothesis information based on the derived results.

[0112] Detection of differences in integrated solution hypothesis information will now be described. Fig. 14 is a diagram for explaining comparison of integrated solution hypotheses. The example of Fig. 14 shows a comparison between integrated solution hypothesis HA obtained by integrating KA solution hypotheses of inference A and integrated solution hypothesis HB obtained by integrating KB solution hypotheses of inference B.

[0113] The detection unit 12 derives a product set (HA∩HB: a common part that remains unchanged even if the conditions are changed) using the integrated solution hypotheses HA and HB.

[0114] Furthermore, detection unit 12 derives a difference set (HA-HB: a part that disappears when the conditions are changed) and a difference set (HB-HA: a part that appears when the conditions are changed) using integrated solution hypotheses HA and HB.

[0115] That is, the detection unit 12 derives the disappearing elements based on the difference set obtained by subtracting the elements of the second integrated solution hypothesis information from the elements of the first integrated solution hypothesis information. The detection unit 12 also derives the appearing elements based on the difference set obtained by subtracting the elements of the first integrated solution hypothesis information from the elements of the second integrated solution hypothesis information.

[0116] Note that the intersection is a set of elements that are considered to be identical. The difference is a set of elements that are not identical, as opposed to the intersection. The determination of whether or not two elements are identical is the same as in the case of integrating solution hypotheses described above.

[0117] Fig. 15 is a diagram for explaining the disappearance and appearance of hypothesis literals. In the example of Fig. 15, the common parts of integrated solution hypothesis HA and integrated solution hypothesis HB are the observation literals "Q(N)" and "X(T1)", the hypothesis literals "X(t)" and "Y(t)", the backward inference operations "X(t) → Q(N)" and "Y(t) → Q(N)", and the unification operation "X(t) ~ X(T1)".

[0118] 15, the difference (HA-HB) between integrated solution hypothesis HA and integrated solution hypothesis HB is the hypothesis literal "Z(t)" and the backward inference operation "Z(t)→Q(N)". The difference (HB-HA) between integrated solution hypothesis HB and integrated solution hypothesis HA is the hypothesis literal "W(t)" and the unification operation "W(t)→Q(N)".

[0119] As described above, in the embodiment, first, multiple solution hypotheses generated using the same weighted abductive reasoning process are integrated to generate integrated solution hypothesis information, which combines overlapping parts of the multiple solution hypotheses into one by deriving a union for each of the elements (literals, backward reasoning operations, unification operations) that make up each solution hypothesis information.

[0120] Next, in an embodiment, comparing an integrated solution hypothesis HA that integrates multiple solution hypotheses before the condition change with an integrated solution hypothesis HB that integrates multiple solution hypotheses after the condition change means comparing a set (from which duplications have been eliminated) of elements (literals, backward inference operations, unification operations) that constitute all of the solution hypotheses obtained in inference A with a set (from which duplications have been eliminated) of elements (literals, backward inference operations, unification operations) that constitute all of the solution hypotheses obtained in inference B.

[0121] Furthermore, deriving the common part or difference between integrated solution hypothesis HA and integrated solution hypothesis HB is equivalent to deriving the common part or difference between all solution hypotheses of deduction A and all solution hypotheses of deduction B. In other words, the common part is the hypothesis part that can be obtained regardless of changing the conditions, and the difference is the overall difference between the solution hypotheses that arise due to changing the conditions.

[0122] Therefore, according to the embodiment, by comparing sets in which overlaps have been eliminated in advance, i.e., by comparing integrated solution hypothesis information obtained by integrating multiple solution hypotheses before the condition change with integrated solution hypothesis information obtained by integrating multiple solution hypotheses after the condition change, the offset of disappearance and appearance of hypothesis literals between individual comparison results as described above is eliminated, making it possible to easily detect differences in inference results before and after the condition change. As a result, the differences in inference results before and after the condition change can be presented to the user in an easy-to-understand manner.

[0123] [System Configuration] Next, the configuration of the information processing device 10 in the embodiment will be described in more detail with reference to Fig. 16. Fig. 16 is a diagram showing an example of a system having an information processing device.

[0124] 16, the system 100 includes an information processing device 10, a storage device 20, and an output device 30. The information processing device 10 includes an acquisition unit 13, an integration unit 11, a detection unit 12, and an output information generation unit 14.

[0125] The information processing device 10 is, for example, a CPU (Central Processing Unit), or a programmable device such as an FPGA (Field-Programmable Gate Array), or a GPU (Graphics Processing Unit), or a circuit equipped with any one or more of these, a server computer, a personal computer, a mobile terminal, or other device used to compare inference results (inference result comparison device).

[0126] The storage device 20 is a database, a server computer, a circuit having a memory, etc. The storage device 20 stores at least observed event information 21, rule information 22, and solution hypothesis information 23. In the example of Fig. 16, the storage device 20 is provided outside the information processing device 10, but it may be provided inside the information processing device 10.

[0127] The solution hypothesis information 23 includes one or more pieces of solution hypothesis information corresponding to a state before a condition is changed and one or more pieces of solution hypothesis information corresponding to a state after a condition is changed. Each piece of solution hypothesis information includes literal information (observation literal information and hypothesis literal information), backward inference operation information, and unification operation information.

[0128] The output device 30 acquires output information (to be described later) that has been converted into an outputtable format by the output information generating unit 14, and outputs generated images and sounds based on the output information. The output device 30 is, for example, an image display device using a liquid crystal, an organic EL (Electro Luminescence), or a CRT (Cathode Ray Tube). Furthermore, the image display device may also include an audio output device such as a speaker. The output device 30 may also be a printing device such as a printer.

[0129] The information processing device will be described. Based on conditions specified by a user using an input device (not shown), the acquiring unit 13 acquires solution hypothesis information corresponding to the specified conditions from the solution hypothesis information stored in the storage device 20. For example, the acquiring unit 13 acquires one or more pieces of first solution hypothesis information before the condition change and one or more pieces of second solution hypothesis information after the condition change.

[0130] The integration unit 11 integrates one or more pieces of first solution hypothesis information before the condition change, and integrates one or more pieces of second solution hypothesis information after the condition change.

[0131] Specifically, the integration unit 11 acquires first solution hypothesis information before the condition change and second solution hypothesis information corresponding to the condition change from the acquisition unit 13. Next, the integration unit 11 integrates one or more pieces of first solution hypothesis information to generate first integrated solution hypothesis information. Also, the integration unit 11 integrates one or more pieces of second solution hypothesis information to generate second integrated solution hypothesis information.

[0132] When it is detected that the condition information stored in the storage device 20 has been changed, a weighted abductive reasoning process may be executed based on the changed condition information to generate solution hypothesis information, and the generated solution hypothesis information may be stored in association with the changed condition information.

[0133] The detection unit 12 compares first integrated solution hypothesis information generated by integrating one or more solution hypothesis information before the condition change with second integrated solution hypothesis information generated by integrating one or more solution hypothesis information after the condition change, and detects the comparison result (difference).

[0134] In order to present to a user the comparison result (difference) between the first integrated solution hypothesis information and the second integrated solution hypothesis information, the output information generation unit 14 generates output information to be output to the output device 30, using the elements of the intersection set (common part) and the elements of the difference set (disappearing elements and appearing elements).

[0135] Furthermore, the output information generating unit 14 generates output information that distinguishes between elements of the intersection set (common part) and elements of the difference set (disappearing elements and appearing elements) and outputs them.

[0136] The presentation of the comparison result (difference) between the first integrated solution hypothesis information and the second integrated solution hypothesis information will be described.

[0137] As examples of the presentation of the comparison results, (i) presentation of the disappearance and appearance of a hypothesis literal, (ii) presentation of the change in the location where the hypothesis literal appears, (iii) presentation of the structural change 1 of the backward inference operation, (iv) presentation of the structural change 2 of the backward inference operation, and (v) presentation of the presence or absence of a unification operation will be explained. Note that (i) to (v) are examples of the comparison results to be presented, and the actually presented comparison results may be a combination of these, and are not limited to these. The comparison results are presented to the user.

[0138] For example, we present a graph in which literals are represented using nodes (rounded rectangles), backward inference operations (directed links (arrow lines)), and unification operations (undirected links (dashed lines)). In this case, we make it possible to distinguish between elements that belong to the intersection and difference sets.

[0139] (i) On the presentation of the disappearance and appearance of hypothetical literals Fig. 17 is a diagram for explaining the presentation of disappearance and appearance of a hypothesis literal. In the example of Fig. 17, the disappearance and appearance of a hypothesis literal are presented as a comparison result between the integrated solution hypothesis HA and the integrated solution hypothesis HB in Fig. 15 described above.

[0140] In the example of Figure 17, the common parts of integrated solution hypothesis HA and integrated solution hypothesis HB are the observation literals “Q(N)” and “X(T1)”, the hypothesis literals “X(t)” and “Y(t)”, the backward inference operations “X(t) → Q(N)” and “Y(t) → Q(N)”, and the unification operation “X(t) ~ X(T1)”.

[0141] 17, the difference (HA-HB) between integrated solution hypothesis HA and integrated solution hypothesis HB is the hypothesis literal "Z(t)" and the backward inference operation "Z(t)→Q(N)", which corresponds to an element that disappears due to a change in conditions. Also, the difference (HB-HA) between integrated solution hypothesis HB and integrated solution hypothesis HA is the hypothesis literal "W(t)" and the unification operation "W(t)→Q(N)", which corresponds to an element that appears due to a change in conditions.

[0142] In the example of Figure 17, the border of the node representing the disappearing hypothesis literal "Z(t)" is dotted, and the directed link (arrow) of the disappearing backward inference operation "Z(t) → Q(N)" is dotted.

[0143] In addition, the frame of the node representing the hypothesis literal "W(t)" that appears is shaded, and the directed link (arrow line) of the unification operation "W(t)→Q(N)" is made thick.

[0144] However, the manner in which disappearance and appearance are expressed is not limited to the above-mentioned manner, and for example, the color scheme may be changed.

[0145] By presenting the data as shown in FIG. 17 to the user, the user can easily understand that a certain hypothesis literal has disappeared or appeared due to a change in conditions.

[0146] For example, in the field of cyber security, let us say that Q is a predicate indicating a query for hypothetical reasoning (a query as to whether or not a cyber attack has occurred), Z is a predicate indicating an trace of "file compression", and W is a predicate indicating an trace of "file encryption". From Figure 17, we can see that the hypothesis literal generated from the observation literal Q(N) has disappeared from "Z(t)" and "W(t)" has appeared due to a change in conditions. In other words, it is easy to understand that the hypothesis of the trace generated from Q="a query as to whether or not a cyber attack has occurred" has changed from Z="file compression" to W="file encryption".

[0147] (ii) Presenting changes in the location of hypothetical literals Fig. 18 is a diagram for explaining the presentation of changes in the appearance locations of hypothesis literals. In the example of Fig. 18, the common parts of integrated solution hypothesis HA and integrated solution hypothesis HB are the observation literals "Q(N)" and "X(T1)", the hypothesis literals "X(t)", "Y(t)", and "Z(t)", the backward inference operations "X(t) → Y(t)", "Y(t) → Z(t)", and "Z(t) → Q(N)", and the unification operation "X(t) ~ X(T1)".

[0148] Also, in the example of FIG. 18, the difference (HA-HB) between integrated solution hypothesis HA and integrated solution hypothesis HB is the hypothesis literal "W(t)" and the backward inference operation "W(t)→Y(t)", which corresponds to an element that disappears due to a change in conditions. Also, the difference (HB-HA) between integrated solution hypothesis HB and integrated solution hypothesis HA is the hypothesis literal "W(t)" and the backward inference operation "W(t)→Z(t)", which corresponds to an element that appears due to a change in conditions. In other words, the appearance position of the hypothesis literal "W(t)" changes.

[0149] In the example of Figure 18, the border of the node representing the disappearing hypothesis literal "W(t)" is dotted, and the directed link (arrow) of the backward inference operation "W(t) → Y(t)" is dotted.

[0150] In addition, the frame of the hypothesis literal "W(t)" that appears is shaded, and the directed link (arrow line) of the backward inference operation "W(t) → Z(t)" is made thick.

[0151] However, the manner in which disappearance and appearance are expressed is not limited to the above-mentioned manner, and for example, the color scheme may be changed.

[0152] By presenting the hypothesis literal as shown in Fig. 18 to the user, the user can easily understand the change in the positional relationship of the hypothesis literal in the solution hypothesis. In other words, the user can easily understand which literal is the starting point from which the hypothesis literal was generated by the backward inference operation.

[0153] For example, in the field of cybersecurity, let Y be a predicate indicating the trace "communication with a suspicious server", Z be a predicate indicating the trace "downloading a suspicious file", and W be a predicate indicating the trace "registration of a periodic task". From Figure 18, it can be seen that the hypothesis literal generating "W(t)" has changed from "Y(t)" to "Z(t)" due to a change in conditions. In other words, it can be easily understood that the hypothesis of the trace W = "registration of a periodic task" has changed to be premised on the hypothesis of the trace Z = "downloading a suspicious file" rather than the hypothesis of the trace Y = "communication with a suspicious server".

[0154] (iii) Presentation of change 1 in the structure of backward reasoning operations Fig. 19 is a diagram for explaining the presentation of change 1 in the structure of the backward inference operation. In the example of Fig. 19, the common parts of integrated solution hypothesis HA and integrated solution hypothesis HB are the observation literals "Q(N)" and "X(T1)", the hypothesis literals "X(t)", "Y(t)", "Z(t)", and "W(t)", the backward inference operation "W(t) → Y(t)", and the unification operation "X(t) ~ X(T1)".

[0155] In the example of FIG. 19, the difference (HA-HB) between the integrated solution hypothesis HA and the integrated solution hypothesis HB is the backward inference operation "X(t)→Y(t)", "Z(t)→Q(N)", "Y(t)→Z(t)", which corresponds to an element that disappears due to a change in conditions. In addition, the difference (HB-HA) between the integrated solution hypothesis HB and the integrated solution hypothesis HA is the backward inference operation "X(t)→Z(t)", "Z(t)→Y(t)", "Y(t)→Q(N)", which corresponds to an element that appears due to a change in conditions. In other words, the order in which the hypothesis literals "X(t)", "Y(t)", and "Z(t)" are generated by the backward inference operation changes. Note that there is no increase or decrease in the hypothesis literals.

[0156] In the example of Figure 19, the directed links (arrows) of the disappearing backward inference operations "X(t) → Y(t)", "Z(t) → Q(N)", and "Y(t) → Z(t)" are shown as dotted lines.

[0157] In addition, the directed links (arrows) of the backward inference operations "X(t) → Z(t)", "Z(t) → Y(t)", and "Y(t) → Q(N)" that appear are shown in thick lines.

[0158] However, the manner in which disappearance and appearance are expressed is not limited to the above-mentioned manner, and for example, the color scheme may be changed.

[0159] By presenting the hypothesis literals as shown in Fig. 19 to the user, the user can easily understand the direction of the backward inference operation that links them even if the hypothesis literals are the same. In other words, the user can understand the difference in the order in which the hypothesis literals are generated.

[0160] For example, in the field of cybersecurity, let us say that X is a predicate indicating the trace of "suspicious program execution", Y is a predicate indicating the trace of "regular communication with a suspicious server", and Z is a predicate indicating the trace of "file encryption". From Figure 19, we can see that the order along the links of the hypothesis literals has changed from "X(t)" → "Y(t)" → "Z(t)" to "X(t)" → "Z(t)" → "Y(t)" due to the change in conditions. In other words, it is easy to understand that the order of the actions taken in the attack has changed.

[0161] (iv) Presentation of change 2 in the structure of backward reasoning operations Fig. 20 is a diagram for explaining the presentation of change 2 in the structure of the backward inference operation. In the example of Fig. 20, the common parts of integrated solution hypothesis HA and integrated solution hypothesis HB are the observation literals "Q(N)" and "X(T1)", the hypothesis literals "X(t)", "Y(t)", and "W(t)", the backward inference operations "X(t) → Y(t)", "W(t) → Y(t)", and the unification operation "X(t) ~ X(T1)".

[0162] Also, in the example of FIG. 20, the difference (HA-HB) between integrated solution hypothesis HA and integrated solution hypothesis HB is the hypothesis literal "Z(t)" and the backward inference operations "Y(t) → Z(t)" and "Z(t) → Q(N)", which correspond to elements that disappear due to a change in conditions. Also, the difference (HB-HA) between integrated solution hypothesis HB and integrated solution hypothesis HA is the backward inference operation "Y(t) → Q(N)", which corresponds to an element that appears due to a change in conditions. In other words, the generation of the hypothesis literal by the backward inference operation changes from "Y(t) → Z(t) → Q(N)" to "Y(t) → Q(N)".

[0163] In the example of Figure 20, the border of the node representing the disappearing hypothesis literal "Z(t)" is dotted, and the directed links (arrows) of the backward inference operations "Y(t) → Z(t)" and "Z(t) → Q(N)" are dotted. Also, the directed link (arrow) of the appearing backward inference operation "Y(t) → Q(N)" is thick.

[0164] However, the manner in which disappearance and appearance are expressed is not limited to the above-mentioned manner, and for example, the color scheme may be changed.

[0165] By presenting the example shown in Figure 20 to the user, the user can understand the difference in the number of backward reasoning operations, that is, one backward reasoning operation has been shortened, and the resulting difference in structure. Furthermore, if we consider another example in which integrated solution hypothesis HB in this example corresponds to the state before the condition change, and integrated solution hypothesis HA corresponds to the state after the condition change, the elements that disappear and the elements that appear are reversed from the example in Figure 20. This means that one backward reasoning operation has been added. In this case as well, the user can understand the difference in the number of backward reasoning operations and the resulting difference in structure, as in the example in Figure 20.

[0166] For example, in the field of cybersecurity, let us say that X is a predicate indicating the trace of "suspicious program execution", Y is a predicate indicating the trace of "regular communication with a suspicious server", and Z is a predicate indicating the trace of "downloading a suspicious file". From Figure 20, we can see that the order along the links of the hypothesis literals has changed from "X(t)" → "Y(t)" → "Z(t)" to "X(t)" → "Y(t)" ("Z(t)" has disappeared) due to the change in conditions. In other words, it is easy to understand that the behavior performed in the attack has changed so that Z = "downloading a suspicious file" is no longer performed.

[0167] (v) Regarding the indication of the presence or absence of unification Fig. 21 is a diagram for explaining the presentation of the presence or absence of unification. In the example of Fig. 21, the common parts of the integrated solution hypothesis HA and the integrated solution hypothesis HB are the observation literals "Q(N)", "Y(T)", and "Z(T)", the hypothesis literals "X(t)", "Y(t)", and "Z(t)", the backward inference operations "X(t) → Q(N)", "Y(t) → Q(N)", and "Z(t) → Q(N)", and the unification operations "Y(t) ~ Y(T1)" and "Z(t) ~ Z(T1)".

[0168] Also, in the example of Figure 21, the difference (HA-HB) between integrated solution hypothesis HA and integrated solution hypothesis HB is the observation literal "X(T1)" and the unification operation "X(t)~X(T1)", which correspond to the elements that disappear due to the change in conditions.

[0169] In the example of FIG. 21, the vanishing undirected link (dashed line) between the observation literal "X(T1)" and the unification operation "X(t)~X(T1)" is shown as a dotted line.

[0170] However, the manner in which the disappearance is expressed is not limited to the above-mentioned manner, and for example, the color scheme may be changed.

[0171] By presenting the data as shown in Figure 21 to the user, the user can understand that while before the change the hypothesis literal was unified with the observation literal, this unification is no longer present after the change, meaning that a change has occurred in which the hypothesis literal remains merely a hypothesis (it is not linked to any observed fact).

[0172] For example, in the field of cybersecurity, let us say that X is a predicate indicating the trace "suspicious program execution", Y is a predicate indicating the trace "regular communication with a suspicious server", and Z is a predicate indicating the trace "download of a suspicious file". From Figure 21, we can see that the observation literal that unifies with the hypothesis literal "X(t)" has disappeared due to the change in conditions. In other words, it is easy to see that there is no observation that corresponds to the hypothesis of trace X = "suspicious program execution" (so it may be necessary to search more closely for a corresponding observation from logs, etc.).

[0173] [Device operation] Next, the operation of the information processing device in the embodiment will be described with reference to FIG. 22. FIG. 22 is a diagram for explaining the operation of the information processing device. In the following description, the diagram will be referred to as appropriate. Also, in the embodiment, the information processing method is implemented by operating the information processing device. Therefore, the description of the information processing method in the embodiment will be replaced with the following description of the operation of the information processing device.

[0174] As shown in FIG. 22, the acquisition unit 13 acquires solution hypothesis information corresponding to a specified condition from the solution hypothesis information stored in the storage device 20, based on the condition specified by a user using an input device (not shown) (step A1).

[0175] In step A1, the acquiring section 13 acquires one or more pieces of first solution hypothesis information before the condition change and one or more pieces of second solution hypothesis information after the condition change.

[0176] The integration unit 11 integrates one or more pieces of first solution hypothesis information before the condition change (step A2), and integrates one or more pieces of second solution hypothesis information after the condition change (step A3). Note that the order of the processes in steps A2 and A3 may be reversed.

[0177] Specifically, in step A2, first, integrating unit 11 acquires first solution hypothesis information before the condition change from acquiring unit 13. Next, in step A2, integrating unit 11 integrates one or more pieces of first solution hypothesis information to generate first integrated solution hypothesis information.

[0178] Also, in step A3, first, integration unit 11 acquires second solution hypothesis information after the condition change from acquisition unit 13. Next, in step A3, integration unit 11 integrates one or more pieces of second solution hypothesis information to generate second integrated solution hypothesis information.

[0179] The detection unit 12 compares first integrated solution hypothesis information generated by integrating one or more solution hypothesis information before the condition change with second integrated solution hypothesis information generated by integrating one or more solution hypothesis information after the condition change, and detects the comparison result (difference) (step A4).

[0180] The output information generating unit 14 generates output information to be output to the output device 30 in order to present the comparison result (difference) between the first integrated solution hypothesis information and the second integrated solution hypothesis information to the user (step A5).

[0181] In step A5, the user is presented with the above-mentioned (i) disappearance and appearance of hypothesis literals, (ii) changes in the locations where hypothesis literals appear, (iii) change 1 in the structure of the backward inference operation, (iv) change 2 in the structure of the backward inference operation, and (v) the presence or absence of a unification operation.

[0182] [Effects of this embodiment] As described above, according to the embodiment, the integrated solution hypothesis information generated by integrating multiple solution hypotheses generated using the weighted abductive reasoning process can combine overlapping parts of the multiple solution hypotheses into one by deriving a union for each of the elements (literals, backward reasoning operations, unification operations) that make up each solution hypothesis information.

[0183] Furthermore, in an embodiment, comparing an integrated solution hypothesis HA that integrates multiple solution hypothesis information before the condition change with an integrated solution hypothesis HB that integrates multiple solution hypothesis information after the condition change means comparing a set (from which duplications have been eliminated) made up of elements (literals, backward inference operations, unification operations) that constitute all of the solution hypothesis information obtained in inference A with a set (from which duplications have been eliminated) made up of elements (literals, backward inference operations, unification operations) that constitute all of the solution hypothesis information obtained in inference B.

[0184] Furthermore, deriving the common part or difference between integrated solution hypothesis HA and integrated solution hypothesis HB is equivalent to deriving the common part or difference between all the solution hypothesis information of deduction A and all the solution hypothesis information of deduction B. In other words, the common part is the hypothesis part that can be obtained regardless of changing the conditions, and the difference is the overall difference in the solution hypothesis information that occurs due to the change in the conditions.

[0185] Therefore, according to the embodiment, by comparing sets in which overlaps have been eliminated in advance, i.e., by comparing integrated solution hypothesis information obtained by integrating multiple solution hypothesis information before the condition change with integrated solution hypothesis information obtained by integrating multiple solution hypothesis information after the condition change, the offset of disappearance and appearance of hypothesis literals between individual comparison results as described above is eliminated, making it possible to easily detect differences between inference results before and after the condition change. As a result, the differences between inference results before and after the condition change can be presented to the user in an easy-to-understand manner.

[0186] In addition, when conditions are changed, the user can easily grasp the following changes: The user can easily understand the disappearance and appearance of hypothesis literals, including their positional relationship in the solution hypothesis (which literal was the starting point of the backward reasoning operation that resulted in the hypothesis literal).

[0187] Users can also understand differences in how hypothesis literals are generated by backward reasoning operations, such as an increase or decrease in the number of backward reasoning operations, or structural differences such as the direction of directed links (for example, when the hypothesis literals are identical but the backward reasoning operations that link them are different).

[0188] Users can also understand the difference between whether a generated hypothesis literal is linked to observed facts or remains a hypothesis.

[0189] Here is an example of a specific effect in the field of cybersecurity. If important attack vectors such as the spread of infection emerge in the hypotheses based on changes in observations over time, it will become clear that action is needed.

[0190] Furthermore, if the traces of an attack remain hypotheses and cannot be unified by deleting or modifying observations, it becomes clear that it is necessary to search for corresponding traces.

[0191] Furthermore, if the order or structure of the attack methods were changed by modifying the rules, the flow of the attack could be interpreted more rationally.

[0192] [program] The program in the embodiment may be a program that causes a computer to execute steps A1 to A5 shown in Fig. 22. By installing and executing this program in a computer, the information processing device and information processing method in the embodiment can be realized. In this case, the processor of the computer functions as the acquisition unit 13, the integration unit 11, the detection unit 12, and the output information generation unit 14, and performs processing.

[0193] The program in the embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the acquisition unit 13, the integration unit 11, the detection unit 12, and the output information generation unit 14.

[0194] [Physical configuration] Here, a computer that realizes an information processing device by executing a program in the embodiment will be described with reference to Fig. 23. Fig. 23 is a diagram illustrating an example of a computer that realizes an information processing device in the embodiment.

[0195] 23, the computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other. Note that the computer 110 may include a GPU or an FPGA in addition to the CPU 111 or instead of the CPU 111.

[0196] The CPU 111 loads the programs (codes) in the embodiment stored in the storage device 113 into the main memory 112 and executes them in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a dynamic random access memory (DRAM). The programs in the embodiment are provided in a state stored in a computer-readable recording medium 120. The programs in the embodiment may be distributed on the Internet connected via the communication interface 117. The recording medium 120 is a non-volatile recording medium.

[0197] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0198] Data reader / writer 116 mediates data transmission between CPU 111 and recording medium 120, reads programs from recording medium 120, and writes processing results in computer 110 to recording medium 120. Communication interface 117 mediates data transmission between CPU 111 and other computers.

[0199] Specific examples of recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as a flexible disk, or optical recording media such as a CD-ROM (Compact Disk Read Only Memory).

[0200] The information processing device 10 in the embodiment can be realized by using hardware corresponding to each part, instead of a computer with a program installed. Furthermore, the information processing device 10 may be partially realized by a program and the remaining part by hardware.

[0201] Although the above description has been given with reference to the embodiment, the embodiment is not limited to the above embodiment. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the embodiment within the scope of the embodiment. [Industrial Applicability]

[0202] According to the above description, even if there are multiple solution hypotheses before and after a condition change, it is possible to detect differences between inference results before and after a condition change. This is also useful in fields where cyber attacks need to be analyzed. [Explanation of symbols]

[0203] 10. Information processing device 11 Integration Department 12 Detection section 13 Acquisition Department 14 Output information generation unit 20 Storage device 21 Observation Event Information 22 Rules Information 23 Solution hypothesis information 30 Output Device 110 Computer 111 CPU 112 Main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display device 120 Recording media 121 Bus

Claims

1. an integration means for integrating a plurality of pieces of solution hypothesis information generated by the weighted abductive reasoning process using observed event information representing observed observation events and rule information representing reasoning knowledge; a detection means for detecting a difference between first integrated solution hypothesis information generated by integrating, by the integration means, one or more first solution hypothesis information generated using the observed event information and the rule information, and second integrated solution hypothesis information generated by integrating, by the integration means, one or more second solution hypothesis information generated when the observed event information and / or the rule information are changed; An information processing device having the above configuration.

2. 2. The information processing device according to claim 1, the detection means uses, as elements, observation literal information representing an observation literal, hypothesis literal information representing a hypothesis literal, backward inference operation information representing a backward inference operation, and unification operation information representing a unification operation, which are included in the first integrated solution hypothesis information and the second integrated solution hypothesis information, respectively, derives a product set and a difference set of the first integrated solution hypothesis information and the second integrated solution hypothesis information, and detects a difference between the first integrated solution hypothesis information and the second integrated solution hypothesis information based on the derived results. Information processing device.

3. 3. The information processing device according to claim 2, the detection means derives a disappearing element based on a difference set obtained by subtracting an element of the second integrated solution hypothesis information from an element of the first integrated solution hypothesis information, and derives an appearing element based on a difference set obtained by subtracting an element of the first integrated solution hypothesis information from an element of the second integrated solution hypothesis information. Information processing device.

4. 4. The information processing device according to claim 3, an output information generating means for generating output information representing a difference between the first integrated solution hypothesis information and the second integrated solution hypothesis information, for output to an output device, using the elements of the intersection, the disappearing elements, and the appearing elements; An information processing device having the above configuration.

5. 5. The information processing device according to claim 4, the output information generating means generates output information for outputting the elements of the intersection set, the disappearing elements, and the appearing elements while distinguishing between them. An information processing device having the above configuration.

6. An information processing device, generating first integrated solution hypothesis information by integrating one or more first solution hypothesis information generated by the weighted abductive reasoning process using condition information having observed event information representing an observed observation event and rule information representing inference knowledge; when the observed event information and / or the rule information included in the condition information is changed, using the changed condition information to integrate one or more pieces of second solution hypothesis information generated by the weighted abductive reasoning process to generate second integrated solution hypothesis information; detecting a difference between the first integrated solution hypothesis information and the second integrated solution hypothesis information; An information processing method for performing processing.

7. On the computer, generating first integrated solution hypothesis information by integrating one or more first solution hypothesis information generated by the weighted abductive reasoning process using condition information having observed event information representing an observed observation event and rule information representing reasoning knowledge; when the observed event information and / or the rule information included in the condition information is changed, using the changed condition information to integrate one or more second solution hypothesis information generated by the weighted abductive reasoning process to generate second integrated solution hypothesis information; detecting a difference between the first integrated solution hypothesis information and the second integrated solution hypothesis information; program.

Images