Information processing device, information processing method, and program

Abstract

To improve the efficiency of an intelligence cycle in CTI.SOLUTION: An information processing device 10 is equipped with an information presentation unit 11 configured to convert rules for detecting cyber-attacks written in a specific format into a format that can be implemented in a system and present the number of rules for which the conversion processing by a tool has been successful and the number of rules for which the conversion processing has failed.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device and an information processing method that present information for utilizing CTI (Cyber Threat Intelligence), and further relates to a program for realizing these. [Background technology]

[0002] In recent years, various computer systems have been proposed to protect against increasingly complex and sophisticated cyber attacks (see, for example, Patent Document 1). Furthermore, in such computer systems, the use of CTI (Cyber Threat Intelligence) has been attracting attention.

[0003] CTI refers to efforts to counter the threat of cyber attacks by collecting, accumulating, and analyzing vast amounts of information related to cyber attacks, such as open source information, vulnerability information, malware analysis results, fraudulent IP information, fraudulent domain information, etc. Intelligence is a military term that refers to espionage or analytical activities.

[0004] To utilize CTI, it is important to go through the intelligence cycle, which is a series of processes from the collection of threat intelligence to its consumption (implementation), and is mainly composed of "collection," "processing," and "implementation."

[0005] Specifically, the first step in the "collection" of threat intelligence is to collect Sigma rules. Sigma is a general-purpose signature format for describing log events in an easy-to-understand manner. Sigma rules are detection rules for malicious files such as malware, and are written in Sigma.

[0006] Next, in the "processing" stage, the collected Sigma rules are converted into detection rules that can be implemented in the system. This conversion process is performed automatically using existing tools. Sigma rules are updated daily, so converting the updated Sigma rules into detection rules is extremely important.

[0007] The detection rules converted from the Sigma rules are then implemented in the system. These "collection," "processing," and "implementation" steps are performed periodically. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Japanese Patent Publication No. 2023-023000 Summary of the Invention [Problem to be solved by the invention]

[0009] However, as mentioned above, because collected Sigma rules are updated daily, there are cases where they cannot be automatically converted using existing tools. In such cases, the system administrator must perform the conversion manually, but the administrator has no way of knowing the automation efficiency of the conversion process. For this reason, in the conventional intelligence cycle, the conversion process may stagnate, resulting in a problem in which the efficiency of the entire intelligence cycle cannot be improved.

[0010] One example of the purpose of the present disclosure is to improve the efficiency of the intelligence cycle in CTI. [Means for solving the problem]

[0011] In order to achieve the above object, an information processing device according to one aspect of the present disclosure includes: The system further includes an information presentation means for converting rules for detecting cyber-attacks written in a specific format into a format that can be implemented in the system, and presenting the number of rules for which the conversion process by the tool was successful and the number of rules for which the conversion process failed. It is characterized by:

[0012] In order to achieve the above object, an information processing method according to one aspect of the present disclosure includes: converting rules for detecting cyber-attacks written in a specific format into a format that can be implemented in the system, and presenting the number of rules for which the conversion process by the tool was successful and the number of rules for which the conversion process failed; It is characterized by:

[0013] Furthermore, in order to achieve the above object, a program according to one aspect of the present disclosure includes: On the computer, converting rules for detecting cyber-attacks written in a specific format into a format that can be implemented in the system, and displaying the number of rules for which the conversion process by the tool was successful and the number of rules for which the conversion process failed; It is characterized by: [Effects of the Invention]

[0014] As described above, according to the present disclosure, it is possible to improve the efficiency of the intelligence cycle in CTI. [Brief explanation of the drawings]

[0015] [Figure 1] FIG. 1 is a diagram illustrating an example of a schematic configuration of an information processing device. [Figure 2] FIG. 2 is a configuration diagram showing the configuration of the information processing device in more detail. [Figure 3] FIG. 3 is a diagram showing a specific example of the processing performed by the information presenting unit, the rule collecting unit, the first converting unit, the second converting unit, and the index calculating unit. [Figure 4]FIG. 4 is a diagram showing a specific example of a case where the conversion process in the first conversion unit fails. [Figure 5] FIG. 5 is a diagram showing a specific example of data input to the generation AI, which is the second conversion unit, and data output from the generation AI. [Figure 6] FIG. 6 is a diagram showing a specific example of a case where the conversion process in the second conversion unit fails. [Figure 7] FIG. 7 is a diagram showing a specific example of information presented by the information presenting unit. [Figure 8] FIG. 8 is a flow diagram illustrating an example of the operation of the information processing device. [Figure 9] FIG. 9 is a diagram illustrating an example of an application of an information processing device. [Figure 10] FIG. 10 is a diagram illustrating an example of processing in the malware information sharing platform. [Figure 11] FIG. 11 is a block diagram illustrating an example of a computer that realizes the information processing device according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0016] (Embodiment) An information processing device, an information processing method, and a program according to an embodiment will be described below with reference to FIGS.

[0017] [Device configuration] First, the schematic configuration of an information processing device will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the schematic configuration of an information processing device.

[0018] 1 is a device for presenting information required to execute an intelligence cycle in CTI to a system administrator. As shown in FIG. 1, the information processing device 10 includes an information presentation unit 11.

[0019] The information presentation unit 11 presents the number of cases where the tool successfully converted rules for detecting cyber-attacks written in a specific format and the number of cases where the tool failed to convert the rules. Here, the tool is a tool for converting the rules into a format that can be implemented in a target system.

[0020] In this way, the information processing device 10 can present the number of rules that were automatically converted using the tool and the number of rules that were not automatically converted to the system administrator, which allows the system administrator to smoothly run the intelligence cycle and improves the efficiency of the intelligence cycle in CTI.

[0021] Next, the configuration and functions of the information processing device 10 will be specifically described with reference to Fig. 2. Fig. 2 is a configuration diagram showing the configuration of the information processing device in more detail.

[0022] 2, the information processing device 10 includes, in addition to the information presenting unit 11 described above, a rule collecting unit 12, a first converting unit 13, a second converting unit 14, and an index calculating unit 15. The information processing device 10 is also connected via a network 20 to a system 30 that is the target of the intelligence cycle, a server device 40 that manages the rules, and a terminal device 50 of an administrator of the system 30.

[0023] The system 30 is a computer system composed of multiple computers. The system 30 is not particularly limited, but may be a system that is primarily a target of cyber attacks. An example of a format that can be implemented in the system 30 is a query format that can be used with M365D (Microsoft 365 Defender). M365D is a security service for enterprises (see Reference 1).

[0024] Reference 1: https: / / learn.microsoft.com / ja-jp / microsoft-365 / security / defender / microsoft-365-defender?view=o365-worldwide

[0025] The server device 40 stores rules for detecting cyber-attacks written in a specific format. The above-mentioned Sigma rules are examples of rules for detecting cyber-attacks written in a specific format. The server device 40 updates the stored rules (Sigma rules) as needed.

[0026] The rule collection unit 12 accesses the server device 40 and collects the stored rules. The rule collection unit 12 collects rules periodically or in response to an instruction from an administrator.

[0027] The first conversion unit 13 uses a tool (hereinafter referred to as the "first tool") to convert the rules collected by the rule collection unit 12 into a format that can be implemented in the system 30. Specifically, the tool may be a tool for converting Sigma rules into detection rules (M365 queries) that can be implemented in the system, such as a converter written in Python.

[0028] The second conversion unit 14 uses a tool (hereinafter referred to as the “second tool”) other than the first tool used by the first conversion unit 13. The second conversion unit 14 uses the second tool to convert the rule for which the conversion process by the first conversion unit 13 failed into a format that can be implemented in the system 30.

[0029] Specifically, the second conversion unit 14 can use a generation AI as the second tool. In this case, the second conversion unit 14 inputs the rule for which the conversion process by the first conversion unit 13 failed into the generation AI, and executes the conversion process.

[0030] For rules for which conversion processing by both the first conversion unit 13 and the second conversion unit 14 has failed, the administrator manually converts the rules into a format that can be implemented in the system 30. The index calculation unit 15 calculates an index indicating the degree of reduction in manual conversion processing in order to show the administrator how successful the conversion processing by the first conversion tool and the second conversion tool has been.

[0031] The information presenting unit 11 presents the number of rules for which the conversion process by the first tool was successful, as well as the number of rules for which the conversion process by the second tool was successful and the number of rules for which the conversion process by the second tool was unsuccessful. The information presenting unit 11 can also present the number of rules that were manually converted as the number of rules for which the conversion process by the second tool was unsuccessful. Furthermore, the information presenting unit 11 can also present an index indicating the degree of reduction in the manual conversion process described above.

[0032] Next, the processing by each unit of the information processing device 10 will be specifically described with reference to Fig. 3 to Fig. 7. Fig. 3 is a diagram showing a specific example of processing performed by each of the information presenting unit, the rule collecting unit, the first converting unit, the second converting unit, and the index calculating unit.

[0033] 3, the rule collection unit 12 accesses the server device 40 and collects Sigma rules. The collected Sigma rules are stored by the information processing device 10.

[0034] The first conversion unit 13 uses the first tool to perform a conversion process on the collected Sigma rules. Rules that have been successfully converted by the first tool become M365D queries. On the other hand, rules that have not been successfully converted by the first tool are sent to the second conversion unit 14.

[0035] Figure 4 shows a specific example of a case where the conversion process in the first conversion unit fails. The example in Figure 4 shows a case where the conversion process fails due to an error in the way the Sigma rule is written. Specifically, a field called NewName is used in the Sigma rule, but there is no corresponding field available in M365D, so the conversion process fails.

[0036] The second conversion unit 14 uses a generation AI as a second tool to perform conversion processing on rules for which the first tool failed to change. FIG. 5 is a diagram showing specific examples of data input to the generation AI, which is the second conversion unit, and data output from the generation AI. As shown in FIG. 5, the second conversion unit 14 inputs the rule for which the first tool failed to change as a query to the generation AI. As a result, the converted rule is output as an answer.

[0037] Rules that are successfully converted by the second tool, the generation AI, become M365D queries, while rules that are unsuccessful in the conversion process by the second tool are sent to an external terminal device.

[0038] FIG. 6 is a diagram showing a specific example of when the conversion process in the second conversion unit fails. If there is an error in the Sigma rule, the generation AI can correct it and output an answer. However, there may be an error in the correction, which may result in the conversion process failing. In the example in FIG. 6, the generation AI detects that M365D does not have a field corresponding to NewName and changes it to a field called NewPath. However, in reality, there is no field corresponding to NewPath among the fields available in M365D, so the conversion process fails.

[0039] In an external terminal device, an expert skilled in manual conversion processing manually performs conversion processing on the rules for which the conversion processing by the second tool failed. As a result, the rules for which the conversion processing by the second tool failed are also converted into M365D queries. The M365D queries converted in this manner are finally implemented in the system 30.

[0040] The index calculation unit 15 calculates an index (hereinafter referred to as an "efficiency index" or "man-hour reduction rate") that indicates the degree of reduction in the manual conversion process. Specifically, the index calculation unit 15 calculates the efficiency index using the following Equation 1.

[0041] (Number 1) Efficiency index [%] = number of rules that were successfully converted / total number of collected rules x 100

[0042] When the processing by the rule collection unit 12, the first conversion unit 13, the second conversion unit 14, and the index calculation unit 15 is completed, the information presentation unit 11 creates data for presenting the calculated values and transmits the created data to the terminal device 50 of the administrator of the system 30. As a result, a screen 51 shown in Fig. 7 is displayed on the screen of the terminal device 50. Fig. 7 is a diagram showing a specific example of information presented by the information presentation unit.

[0043] [Device operation] Next, the operation of the information processing device 10 will be described with reference to FIG. 8. FIG. 8 is a flow diagram showing an example of the operation of the information processing device. In the following description, reference will be made to FIGS. 1 to 7 as appropriate. In addition, in the first embodiment, an information processing method is implemented by operating the information processing device 10. Therefore, in the embodiment, the description of the information processing method will be replaced with the following description of the operation of the information processing device 10.

[0044] 8, first, the rule collection unit 12 collects rules for detecting cyber-attacks written in a specific format (step A1). Specifically, in step A1, the rule collection unit 12 accesses the server device 40 and collects the stored Sigma rules.

[0045] Next, the first conversion unit 13 uses the first tool to convert the rules collected by the rule collection unit 12 in step A1 into a format that can be implemented in the system 30 (step A2). Specifically, in step A2, the first conversion unit 13 converts the Sigma rules into M365 queries.

[0046] Next, the second conversion unit 14 identifies the rule for which the conversion process in step A2 failed, and converts the identified rule into a format that can be implemented in the system 30 using a second tool (step A3).

[0047] Specifically, the second conversion unit 14 inputs the rules for which the conversion process failed in step A2 into the generation AI, which serves as the second tool, and executes the conversion process. After the conversion process is completed, the second conversion unit 14 notifies the administrator's terminal device 50 of the rules for which the conversion process failed in step A3.

[0048] Next, the index calculation unit 15 identifies the number of rules for which the conversion process in step A3 has failed, and calculates an efficiency index using the identified number and the number of rules collected in step A1 (step A4).

[0049] Next, the information presentation unit 11 presents the number of rules for which the conversion process by the first tool in step A2 was successful, the number of rules for which the conversion process by the second tool in step A3 was successful, and the number of rules for which the conversion process by the second tool in step A3 was not successful (step A6).

[0050] Specifically, the information presenter 11 obtains the number of each rule, creates data for presenting the obtained number, and transmits the created data to the terminal device 50 of the administrator of the system 30. As a result, a screen 51 shown in FIG. 7 is displayed on the screen of the terminal device 50.

[0051] [Effects of the embodiment] As described above, in the embodiment, the number of rules automatically converted using the tool, the number of rules automatically converted by the generation AI, and the number of rules not automatically converted are presented to the administrator of system 30. The administrator is also presented with an efficiency index as an indicator of the degree of reduction in manual conversion processing. Therefore, according to the embodiment, the system administrator can smoothly operate the intelligence cycle, and the efficiency of the intelligence cycle in CTI is improved.

[0052] [program] The program in the embodiment may be any program that causes a computer to execute steps A1 to A5 shown in Fig. 8. By installing and executing this program on a computer, the information processing device 10 and the information processing method can be realized. In this case, the processor of the computer functions as an information presenter 11, a rule collector 12, a first converter 13, a second converter 14, and an index calculator 15, and performs processing. Examples of the computer include a general-purpose PC, a smartphone, and a tablet terminal device.

[0053] The program in the embodiment may be executed by a computer system constructed by a plurality of computers, in which case, for example, each computer may function as any one of the information presenting unit 11, the rule collecting unit 12, the first converting unit 13, the second converting unit 14, and the index calculating unit 15.

[0054] [Application example] Next, application examples of the information processing device 10 will be described with reference to Fig. 9 and Fig. 10. Fig. 9 is a diagram showing an example of an application example of the information processing device. Fig. 10 is a diagram showing an example of processing in a malware information sharing platform.

[0055] 9, the information processing device 10 is connected to a malware information sharing platform 60 via a network 20. The information processing device 10 can cooperate with the malware information sharing platform (MISP) 60.

[0056] The Malware Information Sharing Platform 60 is an open-source platform for sharing cybersecurity-related information. Computer Security Incident Response Teams (CSIRTs), government agencies, companies, and the cybersecurity community use the Malware Information Sharing Platform 60 to collect, organize, and share malware-related information such as indicators of compromise (IoCs) and tactics, techniques, and procedures (TTPs).

[0057] 10, the cooperation between the information processing device 10 and the malware information sharing platform 60 will be described. First, the administrator of the system 30 transmits threat information related to cyber attacks to the malware information sharing platform 60 via the terminal device 50. The malware information sharing platform 60 registers the transmitted threat information.

[0058] Next, the information processing device 10 uses the MISP data conversion script to acquire threat information registered in the malware information sharing platform 60. Furthermore, the information processing device 10 converts the acquired threat information into display data. Specifically, the information processing device 10 converts the acquired threat information into CSV data.

[0059] Furthermore, the administrator can appropriately update the content of the display data converted by the information processing device 10. After that, the information processing device 10 transmits the display data to the viewer's terminal device, allowing the viewer to check the registered threat information on the screen of the terminal device.

[0060] In this way, when the information processing device 10 works in conjunction with the malware information sharing platform 60, it can convert the threat information registered there into display data that can be displayed on a terminal device, and transmit the converted display data to the terminal device.

[0061] [Physical configuration] A computer that implements the information processing device 10 by executing the program in the embodiment will now be described with reference to Fig. 11. Fig. 11 is a block diagram showing an example of a computer that implements the information processing device in the embodiment.

[0062] 11, a computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other.

[0063] Furthermore, the computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to or instead of the CPU 111. In this aspect, the GPU or FPGA can execute the programs in the embodiments.

[0064] The CPU 111 loads a program in the embodiment, which is composed of a group of codes and stored in the storage device 113, into the main memory 112 and executes each code in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

[0065] The program in the embodiment is provided in a state stored in a computer-readable recording medium 120. The program in the embodiment may be distributed over the Internet connected via the communication interface 117.

[0066] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0067] The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, reads programs from the recording medium 120, and writes processing results from the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and other computers.

[0068] Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as flexible disks, or optical recording media such as CD-ROMs (Compact Disk Read Only Memory).

[0069] Note that the information processing device 10 in this embodiment can be realized not by a computer on which a program is installed, but by hardware corresponding to each unit, for example, an electronic circuit. Furthermore, the information processing device 10 may be partially realized by a program and the remaining unit by hardware. In the embodiment, the computer is not limited to the computer shown in FIG. 11.

[0070] Some or all of the above-described embodiments can be expressed by (Supplementary Note 1) to (Supplementary Note 12) described below, but are not limited to the following descriptions.

[0071] (Appendix 1) The system further includes an information presentation means for converting rules for detecting cyber-attacks written in a specific format into a format that can be implemented in the system, and presenting the number of rules for which the conversion process by the tool was successful and the number of rules for which the conversion process failed. Information processing device.

[0072] (Appendix 2) the information presentation means presents, for the rule in which the conversion process by the tool has failed, the number of cases in which the conversion process by a second tool different from the tool has been successful and the number of cases in which the conversion process by the second tool has not been successful; the second tool is a tool for converting the rules into the format; 10. The information processing device according to claim 1.

[0073] (Appendix 3) a rule collection means for collecting the rules; a first conversion means for converting the rules into the format using the tool; a second conversion means for inputting the rule for which the conversion process by the tool failed into the generation AI, which is the second tool, and converting it into the format; Further comprising: 3. The information processing device according to claim 2.

[0074] (Appendix 4) the information presentation means further presents an index indicating a degree of reduction in the manual conversion process in the rule. 10. The information processing device according to claim 1.

[0075] (Appendix 5) converting rules for detecting cyber-attacks written in a specific format into a format that can be implemented in the system, and presenting the number of rules for which the conversion process by the tool was successful and the number of rules for which the conversion process failed; Information processing methods.

[0076] (Appendix 6) Further presenting the number of cases in which the conversion process by the tool failed and the number of cases in which the conversion process by the second tool was successful and the number of cases in which the conversion process by the second tool was unsuccessful, the second tool is a tool for converting the rules into the format; 1. The information processing method described in Appendix 5.

[0077] (Appendix 7) Collecting the rules, converting the rules to the format using the tool; The rule for which the conversion process by the tool failed is input to the second tool, which is the generation AI, and the rule is converted into the format. 1. The information processing method described in Appendix 6.

[0078] (Appendix 8) and further presenting an indicator indicating the degree of reduction in the manual conversion process in the rule. 1. The information processing method described in Appendix 5.

[0079] (Appendix 9) On the computer, converting rules for detecting cyber-attacks written in a specific format into a format that can be implemented in the system, and displaying the number of rules for which the conversion process by the tool was successful and the number of rules for which the conversion process failed; program.

[0080] (Appendix 10) The computer, further displaying the number of cases in which the conversion process by a second tool different from the tool was successful and the number of cases in which the conversion process by the second tool was unsuccessful, for the rule in which the conversion process by the tool was unsuccessful; the second tool is a tool for converting the rules into the format; 10. The program described in Appendix 9.

[0081] (Appendix 11) The computer, collecting said rules; converting the rules to the format using the tool; The rule for which the conversion process by the tool failed is input to the second tool, which is the generation AI, and the second tool is converted into the format. 10. The program described in Appendix 10.

[0082] (Appendix 12) The computer, further displaying an indicator showing the degree of reduction in the manual conversion process in the rule; 10. The program described in Appendix 9. [Industrial Applicability]

[0083] As described above, the present disclosure can improve the efficiency of the intelligence cycle in CTI. The present disclosure is useful for various systems related to cybersecurity. [Explanation of symbols]

[0084] 10. Information processing equipment 11 Information presentation section 12 Rule Collection Department 13 First conversion unit 14 Second conversion unit 15 Indicator calculation section 20 Network 30 systems 40 Server device 50 Terminal Equipment 110 Computer 111 CPU 112 main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display Device 120 Recording Media 121 Bus

Claims

1. The system further includes an information presentation means for converting rules for detecting cyber-attacks written in a specific format into a format that can be implemented in the system, and presenting the number of rules for which the conversion process by the tool was successful and the number of rules for which the conversion process failed. Information processing device.

2. the information presentation means presents, for the rule in which the conversion process by the tool has failed, the number of cases in which the conversion process by a second tool different from the tool has been successful and the number of cases in which the conversion process by the second tool has not been successful; the second tool is a tool for converting the rules into the format; The information processing device according to claim 1 .

3. a rule collection means for collecting the rules; a first conversion means for converting the rules into the format using the tool; a second conversion means for inputting the rule that the conversion process by the second tool failed into a generation AI, which is the second tool, and converting it into the format; Further comprising: The information processing device according to claim 2 .

4. the information presentation means further presents an index indicating a degree of reduction in the manual conversion process in the rule. The information processing device according to claim 1 .

5. converting rules for detecting cyber-attacks written in a specific format into a format that can be implemented in the system, and presenting the number of rules for which the conversion process by the tool was successful and the number of rules for which the conversion process failed; Information processing methods.

6. Further presenting the number of cases in which the conversion process by the tool failed and the number of cases in which the conversion process by the second tool was successful and the number of cases in which the conversion process by the second tool was unsuccessful, the second tool is a tool for converting the rules into the format; The information processing method according to claim 5 .

7. Collecting the rules, converting the rules to the format using the tool; The rule for which the conversion process by the tool failed is input to the generation AI, which is the second tool, and converted into the format. The information processing method according to claim 6.

8. and further presenting an indicator indicating the degree of reduction in the manual conversion process in the rule. The information processing method according to claim 5 .

9. On the computer, converting rules for detecting cyber-attacks written in a specific format into a format that can be implemented in the system, and displaying the number of rules for which the conversion process by the tool was successful and the number of rules for which the conversion process failed; program.

10. The computer, further displaying the number of cases in which the conversion process by a second tool different from the tool was successful and the number of cases in which the conversion process by the second tool was unsuccessful, for the rule in which the conversion process by the tool was unsuccessful; the second tool is a tool for converting the rules into the format; The program according to claim 9.

11. The computer, collecting said rules; converting the rules to the format using the tool; The rule for which the conversion process by the tool failed is input to the generation AI, which is the second tool, and converted into the format. The program according to claim 10.

12. The computer, further displaying an indicator showing the degree of reduction in the manual conversion process in the rule; The program according to claim 9.

Images