Information processing device, information processing method, and information processing program

Abstract

To make it possible to easily and appropriately create a summary based on information from a plurality of sources.SOLUTION: In an information summary device 10 for collecting information from a plurality of sources to create a summary, the information summary device 10 includes a CPU 20, and the CPU 20 is configured to receive storage destination information indicating a storage destination of a plurality of sources including predetermined information, refer to the plurality of sources based on the storage destination information, extract item information that is information on a plurality of items related to predetermined content about each of the plurality of sources, determine item-based summary information that is a summary of each item based on the plurality of item information in the plurality of sources, and output a summary report including the item-based summary information on the plurality of items.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a technique for collecting and summarizing information from multiple sources. [Background technology]

[0002] In recent years, cybersecurity incidents have been increasing. Various information about such incidents is published in various sources. The information about incidents published in each source may contain different critical information depending on the source.

[0003] For example, a security analyst obtains information about an incident from multiple sources, identifies important information from the information, and responds to the incident based on the identified information.

[0004] As a method for collecting information on cybersecurity, for example, a framework for monitoring and analyzing tweets related to cyber attacks is known (see, for example, Non-Patent Document 1). In addition, a technology for recognizing malicious URLs using a neural network model is also known (see, for example, Non-Patent Document 2).

[0005] Furthermore, as a technique for searching for documents, a technique is known in which a document database is searched for using an input keyword and a keyword similar to the input keyword (for example, see Patent Document 1). [Prior art documents] [Patent documents]

[0006] [Patent Document 1] International Publication No. 2020 / 071252 [Non-patent literature]

[0007] [Non-Patent Document 1] Cybertwitter: Using twitter to generate alerts for cybersecurity threats and vulnerabilities. S. Mittal et al. In Proc. of the 8th IEEE / ACM ASONAM, 2016. [Non-Patent Document 2] "Detecting Malicious URLs via a Keyword-Based Convolutional Gated-Recurrent-Unit Neural Network," W. Yang, W. Zuo and B. Cui, in IEEE Access, vol. 7, pp. 29891-29900, 2019, doi: 10.1109 / ACCESS.2019.2895751. Summary of the Invention [Problem to be solved by the invention]

[0008] For example, there is a problem that it takes a lot of time to obtain information about an incident from multiple sources and identify important information. In addition, the task of obtaining information about an incident from multiple sources and identifying important information requires detailed information and experience about security, and is therefore not a task that can be performed by people with little experience.

[0009] Further, similar problems arise not only with regard to security-related information, but also with any information for which it is necessary to acquire information from a plurality of sources and specify desired information.

[0010] The present invention has been made in consideration of the above circumstances, and an object of the present invention is to provide a technique that enables a summary to be easily and appropriately created based on information from a plurality of sources. [Means for solving the problem]

[0011] In order to achieve the above-mentioned object, an information processing device according to one aspect is an information processing device that collects information from multiple sources and creates a summary, the information processing device includes a processor that accepts storage destination information indicating storage destinations of multiple sources containing specified information, references the multiple sources based on the storage destination information, extracts item information that is information on multiple items related to specified content for each of the multiple sources, determines item-by-item summary information that is a summary of each of the items based on the item information in the multiple sources, and outputs a summary report including the item-by-item summary information for the multiple items. Effect of the Invention

[0012] According to the present invention, summaries can be easily and appropriately generated based on information from multiple sources. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram showing the overall configuration of an information summary device according to an embodiment. [Diagram 2] FIG. 2 is a diagram illustrating the configuration of an information aggregation table according to an embodiment. [Diagram 3] FIG. 3 is a diagram showing an overview of the process of the extraction step in the information summary device according to one embodiment. [Figure 4] FIG. 4 is a diagram showing an overview of the summary processing steps in an information summary device according to an embodiment. [Diagram 5] FIG. 5 is a diagram illustrating a configuration of summary information according to an embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of an extraction process for a web page of a standard site according to an embodiment. [Figure 7] FIG. 7 is a diagram illustrating an example of an extraction process for a web page of an open site according to an embodiment. [Figure 8] FIG. 8 is a diagram illustrating a first example of a summary process according to an embodiment. [Figure 9]FIG. 9 is a diagram illustrating a second example of the summary process according to an embodiment. [Figure 10] FIG. 10 illustrates a multiple source summary screen according to one embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] The following embodiments will be described with reference to the drawings. Note that the following embodiments do not limit the scope of the invention, and not all of the elements and combinations thereof described in the embodiments are necessarily essential to the solution of the invention.

[0015] In the following description, information may be described using the expression "AAA table", but the information may be expressed in any data structure. In other words, to show that the information does not depend on the data structure, the "AAA table" may be called "AAA information".

[0016] In the following description, the processing may be described with a "program" as the operating subject, but since the program is executed by a processor to perform a defined processing while appropriately using at least one of the storage unit and the interface unit, the subject of the processing may be the processor (or a computer or computer system having a processor). The program may be installed in the computer from a program source. The program source may be, for example, a program distribution server or a non-volatile recording medium readable by the computer. In the following description, two or more programs may be realized as one program, or one program may be realized as two or more programs. At least a part of the processing realized by executing the program may be realized by a hardware circuit (for example, an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array)).

[0017] FIG. 1 is a diagram showing the overall configuration of an information summary device according to an embodiment.

[0018] The information summary device 10 is an example of an information processing device, and is configured by a computer such as a PC (Personal Computer), a general-purpose server, etc. The information summary device 10 includes a CPU (Central Processing Unit) 20, a communication interface (I / F) 30, an input device 40, a display device 50, a memory 60, and a storage device 70.

[0019] The communication I / F 30 is, for example, an interface such as a wired LAN card or a wireless LAN card, and communicates with various devices (such as servers at multiple sites on the Internet) via a network.

[0020] The CPU 20 is an example of a processor, and executes various processes using programs and data stored in the memory 60 and / or the storage device .

[0021] The memory 60 is an example of a storage unit, for example a RAM (RANDOM ACCESS MEMORY), and stores necessary information and programs executed by the CPU 20. In this embodiment, the memory 60 includes a standard site information extraction program 61, an open site information extraction program 62, an information aggregation program 63, a knowledge graph generation program 64, a knowledge graph conversion program 65, and a valid source recognition program 66.

[0022] When executed by the CPU 20, the standard site information extraction program 61 executes a process of extracting predetermined information from a web page of a site (standard site) that publishes a web page (standard page) created according to a predetermined template for publishing predetermined information. When executed by the CPU 20, the open site information extraction program 62 executes a process of extracting predetermined information from a web page of a site (open site) that publishes a web page (open page) that is not created according to a predetermined template. When executed by the CPU 20, the information aggregation program 63 executes a process of aggregating information (information for each source) obtained from multiple sources and creating a report (summary report) that serves as a summary. When executed by the CPU 20, the knowledge graph generation program 64 executes a process of creating a knowledge graph from multiple words. Note that a method of creating a knowledge graph from multiple words is well known, and for example, an open source program can be used as the knowledge graph generation program 64. When executed by the CPU 20, the knowledge graph conversion program 65 executes a process of converting a knowledge graph into text. Methods for converting a knowledge graph into text are known, and for example, an open source program can be used as the knowledge graph conversion program 65. The valid source recognition program 66 executes a process of recognizing valid sources from a plurality of sources by being executed by the CPU 20. Specifically, a score of a source may be calculated based on information of an item selected as summary information, and a source with the highest score, a source with a score within a predetermined number of the top scores, or a source with a score equal to or greater than a predetermined threshold may be determined as a valid source.

[0023] The storage device 70 is an example of a storage unit, such as a hard disk or a flash memory, and stores programs executed by the CPU 20 and data used by the CPU 20. In this embodiment, the storage device 70 stores a template group 71, a database group 72, and an information aggregation table 73.

[0024] The template group 71 stores templates that the web pages of the standard site follow. A template may be prepared for each site. The template is configured so that information about each item (item information) can be identified by a tag (item identification information) that indicates that the information is item information.

[0025] The database group 72 includes a product database (DB) 721 (see FIG. 7), an attack type DB 722 (see FIG. 7), an attack tactic DB 723 (see FIG. 7), an attack strategy DB 724 (see FIG. 7), a patch keyword DB 725 (see FIG. 7), a product-sector mapping DB 726 (see FIG. 7), and a cybersecurity keyword DB 727 (see FIG. 7).

[0026] The product database (DB) 721 is a database for managing products, and stores an entry for each product. An entry in the product DB 721 includes fields for ID, product name, vendor name, and version details. The ID stores the ID of the product corresponding to the entry. The product name stores the name of the product corresponding to the entry (product name). The vendor name stores the name (vendor name) of the vendor (provider) of the product corresponding to the entry. The version details store the version present in the product corresponding to the entry. The data in the product DB 721 can be acquired, for example, from a provider of a PSIRT (Product Security Incident Response Team).

[0027] The attack type DB722 is a database that manages types of attacks (attack types) in cybersecurity, and stores an entry for each attack type. An entry in the attack type DB722 includes fields of ID, attack type name, public ID / indicator, and description. The ID stores the ID of the attack type corresponding to the entry. The attack type name stores the name of the attack type corresponding to the entry (attack type name). The public ID / indicator stores information (public ID or indicator) that uniquely indicates the attack type corresponding to the entry. The description stores a description of the attack type corresponding to the entry. The data in the attack type DB722 can be obtained from, for example, MITRE.

[0028] The attack tactics DB723 is a database that manages attack tactics (attack tactics) in cybersecurity, and stores an entry for each attack tactic. An entry in the attack tactics DB723 includes fields of ID, attack tactics name, public ID / indicator, and description. The ID stores the ID of the attack tactic corresponding to the entry. The attack tactic name stores the name of the attack tactic corresponding to the entry (attack tactic name). The public ID / indicator stores information (public ID or indicator) that uniquely indicates the attack tactic corresponding to the entry. The description stores a description of the attack tactic corresponding to the entry. The data in the attack tactics DB723 can be acquired from, for example, MITRE.

[0029] The attack tactics DB724 is a database that manages attack tactics (attack tactics) in cybersecurity, and stores an entry for each attack tactic. An entry in the attack tactics DB724 includes fields of ID, attack tactic name, public ID / indicator, and description. The ID stores the ID of the attack tactic corresponding to the entry. The attack tactic name stores the name of the attack tactic corresponding to the entry (attack tactic name). The public ID / indicator stores information (public ID or indicator) that uniquely indicates the attack tactic corresponding to the entry. The description stores a description of the attack tactic corresponding to the entry. Data in the attack tactics DB724 can be obtained from, for example, MITRE.

[0030] The patch keyword DB725 is a database that manages patches in cybersecurity, and stores an entry for each patch. An entry in the patch keyword DB725 includes fields of ID, patch keyword, example, and description. The ID stores the ID of the patch keyword corresponding to the entry. The patch keyword stores the patch keyword corresponding to the entry. The example stores an example of the patch keyword corresponding to the entry. The description stores a description of the patch keyword corresponding to the entry. The data in the patch keyword DB725 may be created by, for example, a security analyst.

[0031] The product-sector mapping DB726 is a database that manages the correspondence between products and sectors (fields), and stores an entry for each product. An entry in the product-sector mapping DB726 includes fields of ID, product name, sector name, product ID, and sector ID. The ID stores an ID corresponding to the entry. The product name stores the name of the product (product name) corresponding to the entry. The sector name stores the name of the sector (sector name) corresponding to the product corresponding to the entry. The product ID stores the ID of the product corresponding to the entry. The sector ID stores the ID of the sector corresponding to the entry. The data in the product-sector mapping DB726 can be acquired, for example, from a provider of the PSIRT.

[0032] The cybersecurity keyword DB727 is a database that manages keywords related to cybersecurity, and stores an entry for each keyword. An entry in the cybersecurity keyword DB727 includes fields of ID and keyword. The ID stores an ID corresponding to the entry. The keyword stores a keyword related to cybersecurity. The keyword is, for example, a word included in DB722 to DB726.

[0033] The information aggregation table 73 manages the information acquired from each source. The information aggregation table 73 will be described in detail later.

[0034] The input device 40 is, for example, a mouse, a keyboard, etc., and accepts information input by a user. The display device 50 is, for example, a display, and displays and outputs a user interface including various information (for example, a multiple source summary screen 200 (see FIG. 10)).

[0035] Next, the information aggregation table 73 will be described.

[0036] FIG. 2 is a diagram illustrating the configuration of an information aggregation table according to an embodiment.

[0037] The information aggregation table 73 is a table for managing information obtained from multiple resources, and stores an entry for each resource (information for each resource). An entry in the information aggregation table 73 includes fields for the following items: public ID, priority, target product details, attack type, attack tactics, attack strategy, patch information / countermeasures, sector, summary, detection details, and title.

[0038] The public ID stores, for example, an ID (public ID) that uniquely indicates a vulnerability incident. The public ID may be a CVE (Common Vulnerabilities and Exposures) ID. The public ID can be identified from the source based on the expression format of the public ID. The priority stores a priority for dealing with the incident targeted by the resource corresponding to the entry. The priority may be based on a CVSS (Common Vulnerability Scoring System) score. The target product details store details about the product targeted by the source corresponding to the entry. The target product details can be obtained from the source based on a template of the source or by keyword matching using the product DB721.

[0039] The attack type stores the attack type described in the source corresponding to the entry. The attack type can be obtained from the source based on the source template or by keyword matching using the attack type DB722. The attack tactics stored in the attack tactics described in the source corresponding to the entry. The attack tactics can be obtained from the source based on the source template or by keyword matching using the attack tactics DB723. The attack tactics stored in the attack tactics described in the source corresponding to the entry. The attack tactics can be obtained from the source based on the source template or by keyword matching using the attack tactics DB724.

[0040] The patch information / countermeasures stores patch information or countermeasures described in the source corresponding to the entry. The patch information / countermeasures can be obtained based on a source-to-source template or by keyword matching using the patch keyword DB 725. The sector stores a sector affected by the incident described in the source corresponding to the entry. The sector may indicate an industry such as automobile, IT (Information Technology), OT (Operational Technology), energy, etc. The sector can be obtained based on a source-to-source template or based on a correspondence with a product using the product-sector mapping DB 726.

[0041] The summary stores a summary of the source corresponding to the entry. The summary can be obtained from the source based on a source template or by keyword matching using the cybersecurity keyword DB 727. The detection details store content (detection details) for detecting a vulnerability or attack of an incident in the source corresponding to the entry. The detection details can be obtained from the source based on a source template or by keyword matching. The title stores a title of the source corresponding to the entry. The title can be obtained from the source based on a source template or by keyword matching.

[0042] Next, the processing of the information summary device 10 will be described.

[0043] Fig. 3 is a diagram showing an outline of an extraction step process in an information summary device according to an embodiment Fig. 4 is a diagram showing an outline of a summary processing step process in an information summary device according to an embodiment.

[0044] The information summary device 10 executes an extraction step (S1) of extracting information relating to cybersecurity from a plurality of sources, and a summary processing step (S2) of summarizing the information obtained from the plurality of sources to prepare a report.

[0045] In the extraction step S1, as shown in FIG. 3, the information summary device 10 acquires each web page via a network based on a list of URLs (storage destination information) of the web pages of the resource that is the storage destination, which contains information (information security information) related to a specific incident (basically an incident corresponding to the same public ID) received from the analyst (S10). Next, the information summary device 10 executes an information extraction process (S11) for extracting necessary information from each of these web pages. Here, as the information extraction process, a process (S12) for extracting information from a source (standard source) of a standard website (standard site) created based on a predetermined template and a process (S13) for extracting information from a source of a website (open site) other than the standard site that does not follow the predetermined template are selected and executed. Examples of standard websites include sites such as NVD (National Vulnerability Database), Mitre CVE, and CVE details. In addition, the standard website may include a web page created in JSON, XML format, or the like.

[0046] In summary processing step S2, as shown in FIG. 4, the information summary device 10 performs a process of summarizing the information of the multiple resources into final information (word-based summary processing) for word-based item information (word-based information) in the multiple resource-specific information obtained from the multiple resources (S20), and performs a process of summarizing the information of the multiple resources into final information (sentence-based summary processing) for sentence-based item information (sentence-based information) in the multiple resource-specific information obtained from the multiple resources (S21), and creates a final report (summarized information, summary report).

[0047] In the sentence-based summary process (S21), it is possible to execute either or both of a keyword-based aggregation process (S22) that aggregates data based on the frequency of appearance of keywords and a knowledge graph-based aggregation process (S23) that aggregates data using a knowledge graph. Which one is executed may be determined according to a user setting.

[0048] Next, the summary information will be described.

[0049] FIG. 5 is a diagram illustrating a configuration of summary information according to an embodiment.

[0050] The summarized information includes the following items: public ID, priority, target product details, attack type, attack tactics, attack strategy, patch information / countermeasures, sector, summary, detection details, title, and most useful.

[0051] The public ID stores a public ID aggregated from multiple sources. The priority stores a priority aggregated from multiple sources. For example, the priority that exists most frequently in multiple sources is selected as the priority to be stored. The target product details store target product details aggregated from multiple sources. The target product details may be, for example, a combination of a vendor name and a product name, and may also include version information.

[0052] The attack type stores an attack type aggregated from multiple sources. The attack type may include all attack types detected from multiple sources. The attack tactics store an attack tactic aggregated from multiple sources. The attack tactic may be a combination of attack tactics detected from multiple sources. The attack tactics store an attack tactic aggregated from multiple sources. The stored attack tactics may be a combination of attack tactics detected from multiple sources, or may be a more detailed attack tactic among the multiple attack tactics.

[0053] The patch information / countermeasures stores patch information and / or countermeasures aggregated from multiple sources. The patch information / countermeasures may include all patch information and / or countermeasures aggregated from multiple sources. The sector stores sector information aggregated from multiple sources. The sector may include multiple sectors related to a product aggregated from multiple sources. The summary stores a summary aggregated from multiple sources. The summary stored may be, for example, the summary with the largest number of security keywords among the summaries from multiple sources.

[0054] The detection details include detection details aggregated from multiple sources, such as the detection details with the most security keywords or detection based keywords among the detection details from the multiple sources. The title includes a title aggregated from multiple sources, such as the title with the most keywords among the summaries in the summarized information. Most usefully, the score information from multiple sources is stored, calculated based on the content of other items included in the summarized information.

[0055] Next, the extraction process for the web pages of the standard site will be described.

[0056] FIG. 6 is a diagram illustrating an example of an extraction process for a web page of a standard site according to an embodiment.

[0057] The standard site information extraction program 61 (more precisely, the CPU 20 executing the standard site information extraction program 61) accesses the sites via the Internet using multiple URLs stored in the URL list input by the analyst, and obtains information on the multiple sites, i.e., multiple web contents (e.g., HTML contents) (S10).

[0058] Next, the standard site information extraction program 61 performs a process of extracting necessary information for the acquired web content from the standard site among the acquired web content, and performs a process of registering the extracted information in the information aggregation table 73 (S12). Here, whether or not a site is a standard site can be determined by whether or not the URL includes a domain name that provides a previously known standard site.

[0059] In step S12, specifically, the standard site information extraction program 61 acquires a public ID from the Web content based on the configuration of the standard site template 711 from which the Web content was acquired (S121), acquires the priority (S122), acquires the target product (S123), acquires the attack type, attack tactics, and attack strategy (S124), acquires patch information (S125), acquires the sector (S126), acquires a summary (S127), and extracts other information (detection details, title, etc.) (S128), and registers them in the information aggregation table 73.

[0060] Next, the standard site information extraction program 61 executes the process of step S12 for each web content of the standard site, thereby registering the information extracted from the web content of each standard site in the information aggregation table 73.

[0061] According to this process, it is possible to appropriately extract necessary information from the web contents (resources) of one or more standard sites stored in the URL list based on the template of the standard site, and store the information in the information aggregation table 73.

[0062] Next, the extraction process for the web pages of an open site will be described.

[0063] FIG. 7 is a diagram illustrating an example of an extraction process for a web page of an open site according to an embodiment.

[0064] The open site information extraction program 62 (more precisely, the CPU 20 executing the open site information extraction program 62) performs a process of extracting necessary information for the web content acquired from the open site among the acquired web content, and performs a process of registering the extracted information in the information aggregation table 73 (S13). Here, whether or not a site is an open site can be determined by whether or not the URL includes a domain name that provides a standard site that is known in advance.

[0065] In step S13, specifically, the open site information extraction program 62 acquires public IDs from the web content based on the pattern of the public IDs (S131). Next, the open site information extraction program 62 acquires priorities from the web content based on the priority pattern (S132). Next, the open site information extraction program 62 acquires target products from the web content using information in the product DB 721 as keywords (S133).

[0066] Next, the open site information extraction program 62 uses the information in the attack type DB722 as keywords to obtain attack types from the web content, uses the information in the attack tactics DB723 as keywords to obtain attack tactics from the web content, and uses the information in the attack tactics DB724 as keywords to obtain attack tactics from the web content (S134).

[0067] Next, the open site information extraction program 62 uses the information in the patch keyword DB 725 as keywords to acquire patch information from the web content (S135).

[0068] Next, the open site information extraction program 62 refers to the product-sector mapping DB 726 to obtain the sector corresponding to the target product (S136).

[0069] Next, the open site information extraction program 62 uses the information in the cybersecurity keyword DB 727 as keywords to obtain a summary from the web content (S137), extracts other information (detection details, title, etc.) (S138), and registers it in the information aggregation table 73.

[0070] According to this process, necessary information can be appropriately extracted from the web contents (resources) of one or more open sites stored in the URL list, and stored in the information aggregation table 73.

[0071] Next, the summary process (S2) will be described in detail.

[0072] FIG. 8 is a diagram illustrating a first example of a summary process according to an embodiment.

[0073] In this summary process, the information aggregation program 63 merges information obtained from multiple resources for the word-based information in the resource-specific information, namely, public ID, priority, target product, and sector items, and eliminates duplicate information to produce the contents of the corresponding items in the final summarized information (item-specific summary information) (S20).

[0074] Next, the information aggregation program 63 recognizes the number of predetermined keywords in each of the multiple pieces of resource information for each of the items of attack type, attack tactics, attack strategy, batch information, summary, and detection details, which are sentence-based information in the resource information (S222). For example, the information aggregation program 63 recognizes the count (number) of predetermined keywords for the item of attack type in the resource information for each of source 1, source 2, ... source n.

[0075] Next, the information aggregation program 63 selects, for each item, information from the source (source x) that contains the maximum number of keywords, and sets that information together with the keywords as the content of the corresponding item in the final summarized information (summary information for each item) (S224).

[0076] This summarization process allows source-specific information obtained from multiple sources to be appropriately aggregated into summarized information.

[0077] Next, a second example of the summary process will be described.

[0078] FIG. 9 is a diagram illustrating a second example of the summary process according to an embodiment.

[0079] In this summary process, the information aggregating program 63 executes the same process as that shown in FIG. 8 for the word-based information in the resource-specific information (S20).

[0080] Next, the information aggregation program 63 merges the text of each of the items of the multiple resource information for each of the items of attack type, attack tactics, attack strategy, batch information, summary, and detection details, which are sentence-based information in the resource information (S231). Next, the information aggregation program 63 causes the knowledge graph generation program 64 to create a knowledge graph for each item based on the merged text (S232). Next, the information aggregation program 63 causes the knowledge graph conversion program 65 to convert the knowledge graph created for each item into text (S233), and the content of the text is the content of the corresponding item of the summarized information (summary information for each item) (S233).

[0081] This summarization process allows source-specific information obtained from a plurality of sources to be appropriately aggregated into summarized information.

[0082] Next, the multiple source summary screen will be described.

[0083] FIG. 10 illustrates a multiple source summary screen according to one embodiment.

[0084] The multiple source summary screen 200 is a screen displayed on the display device 50 of the information summary device 10 in order to acquire and display summarized information that aggregates information from multiple resources, for example.

[0085] The multiple source summary screen 200 includes an ID selection input area 201 , a search condition input area 202 , a search button 203 , a summary information display area 204 , a source list display area 205 , and an add new source button 206 .

[0086] The ID selection input area 201 is an area for selecting and inputting a CVE ID, which is an example of a public ID, from a CVE list. When a CVE ID is selected in the ID selection input area 201, an extraction process (S1) and a summary process (S2) are executed based on information of multiple sources included in a source list corresponding to the CVE ID.

[0087] The search condition input area 202 is an area for inputting a CVE that is a condition for selecting a CVE ID. The search button 203 is a button for accepting a process for searching for a CVE ID corresponding to the condition input in the search condition input area 202. When the search button 203 is pressed, the information summary device 10 searches for a CVE ID corresponding to the condition input in the search condition input area 202, and executes an extraction process (S1) and a summary process (S2) based on information of a plurality of sources included in a source list corresponding to the CVE ID.

[0088] The summarized information display area 204 is an area for displaying summarized information related to a specific target CVD ID. In this embodiment, in the initial state, the target contents are displayed for the number and item, but the details and summary corresponding to each item are blank, and after the extraction process and summary process are executed, information corresponding to the details and summary corresponding to each item is displayed.

[0089] The source list display area 205 is an area that displays a list of URLs of sources that aggregate summary information of the target public ID. The add new source button 206 is a button that is pressed when adding a URL of a new source as a source that aggregates summary information of the target public ID. When the add new source button 206 is pressed, a screen for inputting the URL of the new source is displayed, and the URL can be input on that screen. When the URL of the new source is input, an extraction process (S1) and a summary process (S2) are executed based on the source list including the URL of the new resource, and the list with the added URL is displayed in the source list display area 205.

[0090] The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the present invention.

[0091] For example, in the above embodiment, an example was shown in which the URL list included URLs of standard sources and other sources, but the URL list may include only URLs of either standard sources or other types of sources.

[0092] In addition, the items constituting the summary information in the above embodiment are not limited to the above items, and may include, for example, any one or more of identification information (public ID) indicating a security vulnerability, a priority for the vulnerability, information on the product that is subject to the vulnerability (target product details), information on countermeasures against the vulnerability (patch information / countermeasures), and detection information for detecting the vulnerability (detection details). [Explanation of symbols]

[0093] 10...information summary device, 20...CPU, 30...communication 1 / F, 40...input device, 50...display device, 60...memory, 61...information extraction program for standard site, 62...information extraction program for open site, 63...information aggregation program, 64...knowledge graph generation program, 65...knowledge graph conversion program, 66...valid source recognition program, 70...storage device, 71...template group, 72...database group, 73...information aggregation table 73

Claims

1. An information processing device that collects information from multiple sources and creates a summary, The information processing device includes a processor, The processor, receiving storage destination information indicating storage destinations of a plurality of sources including predetermined information; Referencing the plurality of sources based on the storage location information, and extracting item information, which is information on a plurality of items relating to a predetermined content, for each of the plurality of sources; determining per-item summary information based on the plurality of item information in the plurality of sources, the per-item summary information being a summary for each of the items; Output a summary report including summary information for each of the plurality of items. Information processing device.

2. At least one of the sources is created in a format according to a predetermined template that can identify the item information; The processor extracts the item information from the source based on the template. The information processing device according to claim 1 .

3. the information processing device has a storage unit that stores item identification information for identifying at least a part of the item information; The processor extracts the item information corresponding to the item from the source based on the item identification information. The information processing device according to claim 1 .

4. The processor, determining whether or not the source is created in a format according to a predetermined template that can identify the item information, based on the storage destination information of the source; If the source is created in a format according to a predetermined template that can identify the item information, extracting the item information from the source based on the template; If the source is not created in a format according to a predetermined template that can identify the item information, the item information corresponding to the item is extracted from the source based on item identification information for identifying the item information. The information processing device according to claim 2 .

5. The processor, The summary information for each item is determined based on the frequency of occurrence of a predetermined keyword from among the item information for the same item obtained from a plurality of sources. The information processing device according to claim 1 .

6. The processor, A knowledge graph is created based on item information for the same item obtained from multiple sources, and summary information for each item is determined by converting the knowledge graph into text. The information processing device according to claim 1 .

7. The processor, determining summary information for each item by performing word deduplicating when the item information for the same item obtained from multiple sources is word-based information; When the item information for the same item obtained from a plurality of sources is sentence-based information, the summary information for each item is determined based on the frequency of appearance of a predetermined keyword from the item information for the same item obtained from a plurality of sources, or a knowledge graph is created based on the item information for the same item obtained from a plurality of sources, and the knowledge graph is converted into text to determine the summary information for each item. The information processing device according to claim 1 .

8. the predetermined information is information regarding information security, The plurality of items of information include identification information indicating a security vulnerability, Includes multiple items including priority, information on the product affected by the vulnerability, information on countermeasures against the vulnerability, and detection information for detecting the vulnerability. The information processing device according to claim 1 .

9. The processor, receiving storage destination information of a storage destination of a newly added source including the predetermined information; When storage destination information of the added source is received, the item information is extracted based on the storage destination information including the storage destination information of the added source, summary information for each item is determined, and the summary report is output. The information processing device according to claim 1 .

10. An information processing method for an information processing device that collects information from a plurality of sources and creates a summary, comprising: The information processing device, receiving storage destination information indicating storage destinations of a plurality of sources including predetermined information; Referencing the plurality of sources based on the storage location information, and extracting item information, which is information on a plurality of items relating to a predetermined content, for each of the plurality of sources; determining per-item summary information based on the plurality of item information in the plurality of sources, the per-item summary information being a summary for each of the items; Output a summary report including summary information for each of the plurality of items. Information processing methods.

11. An information processing program to be executed by a computer constituting an information processing device that collects information from a plurality of sources and creates a summary, The computer includes: receiving storage destination information indicating storage destinations of a plurality of sources including predetermined information; Referring to the plurality of sources based on the storage location information, and extracting item information, which is information on a plurality of items relating to a predetermined content, for each of the plurality of sources; determining summary information for each of the items based on the plurality of item information in the plurality of sources; outputting a summary report including summary information for each of the plurality of items; Information processing program.

Images