Information processor, information processing method, and information processing program

Abstract

To properly determine whether or not a set of alerts to a specific event can be aggregated into an existing report.SOLUTION: An information processor 100 has a weighting part 121, a similarity calculation part 123, and a determination part 124. The weighting part 121 imparts weighting showing correlation with the content of a report of an aggregation destination for each of alerts to a specific event. The similarity calculation part 123 calculates similarity between sets of a first set being a set of alerts of the report of the aggregation destination and a second set being a set of alerts of the aggregation destination on the basis of the weighting imparted by the weighting part 121. The determination part 124 determines whether or not alerts of the aggregation destination can be aggregated into the report the aggregation destination by the similarity calculated by the similarity calculation part 123.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to an information processing device, an information processing method, and an information processing program. [Background technology]

[0002] In recent years, the spread of connected cars has led to an increase in cyberattacks on automobiles. As a result, when a cyberattack on an automobile occurs, it is important to analyze the set of alerts issued by the security sensors installed in the automobile and compile the analysis results into a report.

[0003] When cars are made by the same manufacturer, model, and year, their vehicle configurations, such as network configuration, ECU (Electronic Controller Unit), and software, as well as their inherent vulnerabilities, are very similar. Therefore, when an attack is carried out on a certain car, the same attack can be carried out on a large scale on multiple other cars with very similar configurations and vulnerabilities.

[0004] If the same attack is carried out on multiple vehicles, compiling reports for each vehicle will result in a large number of reports with very similar content. Therefore, one possible method is to determine whether a new report can be aggregated with already created reports by calculating similarity such as the Jaccard coefficient, and then reduce the number of newly created reports. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Jaccard, Paul, “The Distribution of the Flora in the Alpine Zone.” New Phytologist, Vol.11, No.2, pp.37-50, 1912. Summary of the Invention [Problem to be solved by the invention]

[0006] However, with the above-mentioned conventional technology, it may not be possible to appropriately determine whether a collection of alerts for a specific event can be aggregated into an existing report. For example, with the above-mentioned conventional technology, if there are many identical elements between an alert collection and the elements of the alert collection in the aggregated report, the alerts may be aggregated even if the elements that are highly correlated with the content of the report are different. Conversely, if there are few identical elements between an alert collection and the elements of the alert collection in the aggregated report, the alerts may not be aggregated even if the elements that are highly correlated with the content of the report are the same. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems and achieve the objectives, the information processing device of the present invention is characterized by having a weighting unit that assigns a weight to each alert for a specific event that indicates a correlation with the contents of the report to be aggregated, a similarity calculation unit that calculates the similarity between a first set, which is a set of alerts in the report to be aggregated, and a second set, which is a set of alerts that are candidates for aggregation, based on the weights assigned by the weighting unit, and a judgment unit that judges whether the alerts that are candidates for aggregation can be aggregated into the report to be aggregated based on the similarity calculated by the similarity calculation unit. [Effects of the Invention]

[0008] The present invention provides an advantage in that it is possible to appropriately determine whether a group of alerts for a specific event can be aggregated into an existing report. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating the relationship between alerts and reports according to the embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of a method for aggregating alerts according to the prior art. [Figure 3]FIG. 3 is a diagram illustrating a problem with the alert aggregation method according to the prior art. [Figure 4] FIG. 4 is a diagram illustrating an alert aggregation system according to an embodiment. [Figure 5] FIG. 5 is a diagram illustrating an example of the configuration of an information processing device according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of data stored in the information processing device according to the embodiment. [Figure 7] FIG. 7 is a diagram illustrating a specific example of processing by the weighting unit according to the embodiment. [Figure 8] FIG. 8 is a diagram showing a specific example of a dataset used for training a large-scale language model according to the embodiment. [Figure 9] FIG. 9 is a diagram illustrating a specific example of the process of the alert adding unit according to the embodiment. [Figure 10] FIG. 10 is a diagram illustrating a specific example of the process of the determination unit according to the embodiment. [Figure 11] FIG. 11 is a diagram showing the overall processing flow of the information processing device according to the embodiment. [Figure 12] FIG. 12 is a flowchart showing an example of the flow of information processing according to the embodiment. [Figure 13] FIG. 13 is a flowchart showing an example of the flow of information processing according to the embodiment. [Figure 14] FIG. 14 is a diagram illustrating an example of a computer that executes an information processing program. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of an information processing device, an information processing method, and an information processing program according to the present application will be described in detail with reference to the accompanying drawings. Note that the information processing device, the information processing method, and the information processing program according to the present application are not limited to these embodiments.

[0011] 1. Introduction (1-1. Overview of Prior Art) First, an overview of the prior art in regard to alerts for specific events and reports to be created according to this embodiment will be described. Note that, while the following mainly describes processing when an alert is issued due to a cyberattack on an automobile (connected car), the present invention is not limited to this, and can be applied to, for example, processing when an alert is issued due to a large-scale cyberattack on a computer or server device monitored by a security operations center (SOC) in the IT field, or processing when an alert is issued due to a malfunction of industrial machinery, home appliances, etc.

[0012] The spread of connected cars has led to an increase in cyberattacks on automobiles. Accordingly, in order to respond appropriately to cyberattacks on automobiles, it has become important to analyze the set of alerts issued by security sensors installed in automobiles and to compile the analysis results into a report written in natural language.

[0013] Here, the relationship between alerts and reports in response to cyber-attacks will be described with reference to Fig. 1. Fig. 1 is a diagram showing the relationship between alerts and reports according to an embodiment. As shown in Fig. 1, when a car is subjected to a cyber-attack from an external network, the car's on-board security sensor issues an alert corresponding to the details of the cyber-attack.

[0014] A specialized analyst then analyzes the set of alerts that are made up of multiple alerts and creates a report on the attack. The report includes information such as an overview of the cyber attack, the detection history of security sensors, and countermeasures, and will be used to develop future security measures.

[0015] However, when cars are made by the same manufacturer, model, and year, their vehicle configurations, such as network configuration, ECU, and software, as well as their inherent vulnerabilities, are very similar. Therefore, when a cyberattack using the same method is carried out on multiple cars, a large number of reports with very similar content will be created. Therefore, when an attack identical to a previous attack is carried out, it is important to aggregate the set of alerts that have been issued into the report that has already been created.

[0016] Here, a technique for determining whether newly issued alerts can be aggregated based on the similarity of alert sets will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of a method for aggregating alerts according to conventional technology. In the example shown in Fig. 2, the conventional technology calculates the similarity between alert set A, which was the basis for creating the aggregated report, and newly issued alert set B, which is a candidate for aggregation, and determines whether aggregation is possible based on the value of that similarity.

[0017] In the example of Figure 2, the Jaccard coefficient is calculated for set A consisting of alerts 1 to 6 and set B consisting of alerts 1 to 3 and alerts 6 to 10. As a result, J(A,B) = 0.4 is calculated, and since this calculated value is greater than a preset threshold (for example, set to 0.3), it is determined that the alerts in set B can be aggregated into the report of set A.

[0018] However, in conventional technology, there are cases where it is not possible to appropriately determine whether a set of alerts for a specific event can be aggregated into an existing report. Here, with reference to Figure 3, an example will be described in which a set of alerts that should not be aggregated in conventional technology is determined to be aggregateable. Figure 3 is a diagram showing the problems with the alert aggregation method according to the conventional technology.

[0019] In the example shown in Figure 3, the summary of the aggregated report contains the phrase "Sent to C&C server." Therefore, since Set B, which does not have the alert "Data upload to C&C server detected" that Set A has, is an alert set that contradicts the report summary, it is reasonable to determine that it should not be aggregated into the report of Set A.

[0020] However, in the conventional technology, by performing the same process as that described in Fig. 2, J(A, B) = 0.83 is calculated for set A and set B. As a result, because the calculated value is greater than the threshold value of 0.3, it is determined that set B can be aggregated into the report of set A.

[0021] In other words, in the prior art, even if a set does not have elements that are highly correlated with the contents of a report, it may be determined that the set can be aggregated.Similarly, even if a set has elements that are highly correlated with the contents of a report, it may be determined that the set cannot be aggregated if there are many differences in elements that are weakly correlated.

[0022] (1-2. Overview of the information processing device according to this embodiment) The information processing device of this embodiment was invented with the aim of solving the above-mentioned problems, and has the effect of being able to appropriately determine whether a collection of alerts for a specific event can be aggregated into an existing report.

[0023] Next, an information processing device according to this embodiment will be described. Fig. 4 is a diagram showing an alert aggregation system according to this embodiment. The information processing device 100 is a server device that stores information such as reports that have been created so far and the corresponding alert sets, and is realized by a computer or the like.

[0024] In the system shown in Fig. 4, first, an analyst creates a new report from a set of alerts issued from the first vehicle. Then, by connecting to a network or the like, the information processing device 100 acquires sets of alerts issued from the second to nth vehicles. The information processing device 100 then calculates the similarity between each set of alerts and the report created by the analyst, and determines whether each set of alerts can be aggregated into a report. Specific processing performed by the information processing device 100 is described below.

[0025] The information processing device 100 assigns a weight to each alert for a specific event, indicating the correlation with the content of the aggregation destination report.The information processing device 100 then calculates the similarity between a first set, which is a set of alerts in the aggregation destination report, and a second set, which is a set of aggregation candidate alerts, based on the assigned weight.The information processing device 100 then determines, based on the calculated similarity, whether the aggregation candidate alerts can be aggregated into the aggregation destination report.

[0026] For example, the information processing device 100 acquires a set of alerts issued by a security sensor in response to a cyber-attack targeting a connected car, etc. Then, the information processing device 100 assigns a weight indicating a correlation with the content of the aggregation target report to each alert in a first set, which is a set of alerts in the aggregation target report, and to each alert in a second set, which is a set of alerts in the acquired aggregation candidates.

[0027] Next, the information processing device 100 calculates, for example, a Jaccard coefficient using the weight of each alert for a first set in which a weight is assigned to each alert and a second set, and determines the similarity between the sets. Thereafter, if the calculated similarity is equal to or greater than a preset threshold, the information processing device 100 determines that the aggregation candidate alerts can be aggregated into the aggregation destination report. On the other hand, if the calculated similarity is smaller than the preset threshold, the information processing device 100 determines that the aggregation candidate alerts cannot be aggregated into the aggregation destination report.

[0028] As a result, the information processing device 100 assigns a weight to each alert indicating the correlation with the content of the aggregated report, and then calculates the similarity between alert sets using the weight, so it can determine that alert sets that are highly correlated with the content of the report can be aggregated.In other words, it can be said that the information processing device 100 can appropriately determine whether or not a set of alerts regarding cyber-attacks can be aggregated into an existing report.

[0029] 2. Configuration of Information Processing Device 100 Next, the configuration of the information processing device 100 shown in Fig. 4 will be described with reference to Fig. 5. Fig. 5 is a block diagram showing an example configuration of the information processing device according to an embodiment. The information processing device 100 has a communication unit 110, a control unit 120, and a storage unit 130, and the information processing device 100 is connected to external devices via a network so that they can communicate with each other.

[0030] The communication unit 110 is realized by, for example, a network interface card (NIC). The communication unit 110 is connected to a network N and transmits and receives information to and from external devices such as connected cars, computers, server devices, and a wide variety of IoT devices. The communication unit 110, for example, mediates the acquisition of alerts issued from external devices and accepts settings such as thresholds used in processing by the determination unit 124, which will be described later.

[0031] The storage unit 130 is realized by a storage device such as a RAM (Random Access Memory) or a hard disk, for example. The storage unit 130 stores data and programs required for various processes by the control unit 120. The storage unit 130 has a report information storage unit 131 and a weighting model storage unit 132, which are closely related to the present invention.

[0032] The report information storage unit 131 stores information about reports that have been created in the past. Here, the information about reports stored in the report information storage unit 131 will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of data stored in the information processing device according to the embodiment.

[0033] As shown in Fig. 6, the report information storage unit 131 stores, for example, a "report number," an "overview," a "detection history," and a "measure." The "report number" stores a number assigned to identify each report, and the "overview" stores a summary comment of the content described in the corresponding report. The "detection history" stores the detection history of the alert that was the basis for creating the corresponding report, and the "measure" stores comments on how to deal with the malfunction corresponding to the issued alert.

[0034] For example, for the report "Report number: 1", the report information storage unit 131 stores a summary comment such as "Summary: ECU accessed a suspicious site...", an alert detection history such as "Detection history: Access to a suspicious site detected on 2023 / 6 / 29 / 9:00...", and a comment on how to deal with the issue such as "How to deal with the issue: Disconnect the ECU from the network".

[0035] The weighting model storage unit 132 stores weighting models used by the weighting unit 121, which will be described later. For example, the weighting model storage unit 132 stores machine learning models such as large-scale language models used to assign weights indicating the correlation between reports and alerts. Note that an example of a large-scale language model is Sentence BERT, and possible large-scale language models used for embedding in the Sentence BERT model include ALBERT and GPT, but the large-scale language model used is not particularly limited.

[0036] Returning to the explanation of Fig. 5, the control unit 120 is realized by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like executing various programs stored in a storage device within the device using RAM as a work area. The control unit 120 is also realized by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 120 has a weighting unit 121, an alert adding unit 122, a similarity calculation unit 123, a determination unit 124, and a learning unit 125.

[0037] The weighting unit 121 assigns a weight indicating the correlation with the content of the report to which the alert is aggregated to each alert for a specific event. For example, the weighting unit 121 assigns a weight that increases when the correlation between the summary comment written in the report to which the alert is aggregated and the wording indicating the content of the alert (the probability that the alert will be written as a detection history in the report) is high for each alert acquired via the communication unit 110.

[0038] Specifically, the weighting unit 121 assigns a weight to each alert, for example, using a large-scale language model, based on the cosine similarity of the vectors between the alert and the content of the aggregated report corresponding to the type of cyber attack.

[0039] Here, a case where a large-scale language model is used to weight alerts will be described with reference to Fig. 7. Fig. 7 is a diagram showing a specific example of processing by the weighting unit according to the embodiment. As shown in Fig. 7, the weighting unit 121 vectorizes each token of a report and an alert using a large-scale language model such as BERT or ALBERT, for example.

[0040] Next, the weighting unit 121 applies a pooling layer to the vectors for each token, for example, to obtain "u", which is a vector of the analysis comments of the report, and "v", which is a vector of the alert. Note that the report vector "u" may be obtained using any description that is closely related to the content of the report, other than the analysis comments. Next, the weighting unit 121 calculates the cosine similarity (u,v)) between the vectors "u" and "v", normalizes it so that the minimum value is "-1" and the maximum value is "1", and then applies a sigmoid function to set the weight of each alert.

[0041] Here, in the process described in Fig. 7, as mentioned above, the large-scale language model is not limited to a specific machine learning model. Also, although Fig. 7 describes an example in which weights are set using a large-scale language model, the present invention is not limited to this. For example, the weights according to the embodiment may be set manually by an analyst, automatically according to some predetermined rule, or automatically using a machine learning model other than a large-scale language model.

[0042] Here, the large-scale language model described above can be one that has been fine-tuned by the learning unit 125. The learning unit 125 learns the large-scale language model using, for example, a set of training data consisting of reports created in the past, alerts associated with the reports, and alerts not associated with the reports.

[0043] Here, a specific example of a training method for a large-scale language model will be described with reference to Fig. 8. Fig. 8 is a diagram showing a specific example of a dataset used for training a large-scale language model according to the embodiment. First, the training unit 125 extracts, for example, a summary comment of a report, "When the ECU accessed a suspicious site, a DBD attack occurred...", from a created report, and defines it as an Anchor.

[0044] Next, the learning unit 125 defines the alert "Access to a suspicious site detected" that is recorded in the detection history of the report extracted as the Anchor as Positive, and defines the alert "An abnormal login attempt detected" that is not recorded in the detection history of the report but is recorded in the detection history of other reports as Negative, and creates a dataset in which Anchor, Positive, and Negative are one set.

[0045] Thereafter, the learning unit 125 performs metric learning by triplet loss using multiple data sets created by the same method. This allows learning to be performed so that the distance between a sample defined as an anchor and a sample defined as a positive becomes closer (the degree of similarity becomes higher), and so that the distance between a sample defined as an anchor and a sample defined as a negative becomes longer (the degree of similarity becomes lower). As a result, it becomes possible to distinguish between positive alerts and negative alerts, and by using the large-scale language model that has undergone this learning, the weighting unit 121 can assign more accurate weights to each alert.

[0046] In the above-described processing, an example has been shown in which the learning unit 125 automatically collects information on Anchor, Positive, and Negative to create a dataset, but the present invention is not limited to this, and the dataset may be created manually by an analyst or the like, and the created dataset may have a structure different from the data structure shown in Fig. 8. Furthermore, the fine-tuning method is not limited to the above-described example, and a loss function and learning method other than Metric Learning using Triplet Loss may be used.

[0047] The alert addition unit 122 adds some of the alerts contained in one set, which is a set of alerts in the report to be aggregated, to the other set, which is a set of alerts that are candidates for aggregation, based on the weight assigned by the weighting unit 121.

[0048] For example, the alert addition unit 122 refers to the weight assigned to each alert in the first set, which is the set of alerts to be aggregated, and the weight assigned to each alert in the second set, which is the set of alerts that are acquired as aggregation candidates, and adds alerts whose weights satisfy a specific condition and do not exist in the other set to the other set, thereby reducing the difference between the sets.

[0049] Here, the process of adding an alert to another set by the alert adding unit 122 will be described with reference to Fig. 9. Fig. 9 is a diagram showing a specific example of the process of the alert adding unit according to the embodiment. Fig. 9 shows an example in which, for set A, which is a first set, and set B, which is a second set, the difference between the sets is alleviated by sequentially performing a process of adding an alert from set B to set A and a process of adding an alert from set A to set B.

[0050] In the example of Fig. 9, first, the weighting unit 121 sets a weight indicating the correlation with the aggregated report for each alert in set A and each alert in set B. Then, the alert adding unit 122 stores the minimum weight value "0.5" in alert set A. Here, an alert that is equal to or greater than the minimum value "0.5" and that is not included in set A is an alert that would not be surprising if observed when an attack described in a report is actually carried out, and therefore it is determined that there will be no problem if the alert is added to alert set A of the aggregated report.

[0051] Therefore, the alert addition unit 122 adds three alerts, "Detection of an abnormal login attempt," "Detection of the launch of a suspicious process," and "Detection of the execution of a suspicious script," which are included only in alert set B and have a minimum value of "0.5" or more, to alert set A.

[0052] Next, the alert adding unit 122 stores the maximum weight value "0.7" among the alerts added to alert set A. Here, alerts that are equal to or less than the maximum weight value "0.7" and that are not included in set B are alerts that were accidentally observed in alerts in set A, but would not be surprising if they were observed in set B if the attack described in the report was carried out, and therefore it is determined that there will be no problem if they are added to alert set B, which is a candidate for aggregation.

[0053] Therefore, the alert adding unit 122 adds the "Port scan detected" alert, which is equal to or less than the maximum value "0.7", from among the alerts included only in alert set A, to alert set B. By performing the series of processes described above, the alert adding unit 122 adds alerts whose weights are within a predetermined range to each other's sets, thereby reducing the difference between sets A and B.

[0054] As a result, the information processing device 100 can mitigate differences between sets that arise due to accidental observation errors or differences in security sensors, even when the same attack is carried out, and can therefore calculate a high similarity between the two sets when the same attack is carried out, and determine that they can be appropriately aggregated.

[0055] The method for calculating the maximum or minimum weight value is not limited to the process described above; for example, a predetermined specific value may be used as the maximum or minimum value. Furthermore, in the process described above, an example in which alerts are added to both sets is described, but it is also possible to execute only one of the addition processes. Furthermore, in the process described above, an example in which differences between sets are reduced by adding alerts is described, but this is not limited thereto; for example, differences between sets may be reduced by deleting alerts that are included only in one of the sets.

[0056] The similarity calculation unit 123 calculates the similarity between a first set, which is a set of alerts in the aggregation destination report, and a second set, which is a set of alerts that are candidates for aggregation, based on the weights assigned by the weighting unit 121. For example, the similarity calculation unit 123 refers to the weights assigned to each alert in both sets and calculates a weighted Jaccard coefficient for both sets.

[0057] Specifically, the similarity calculation unit 123 calculates the sum of the weights of each alert included in the union of both sets as the denominator and the sum of the weights of each alert included in the intersection of both sets as the numerator, and sets the calculated value as the similarity between both sets.

[0058] Furthermore, the similarity calculation unit 123 calculates the similarity between the first set and the second set to which some alerts have been added by the alert adding unit 122. For example, the similarity calculation unit 123 calculates a simple Jaccard coefficient without reference to weights for both sets whose differences have been alleviated by the alert adding unit 122 described above.

[0059] Furthermore, the similarity calculation unit 123 calculates the similarity between the first set and the second set to which some alerts have been added by the alert adding unit 122, based on the weight assigned to each alert. For example, the similarity calculation unit 123 refers to the weight assigned to each alert in both sets, the differences of which have been alleviated by the alert adding unit 122, and calculates the weighted Jaccard coefficient for both sets.

[0060] The method for calculating the similarity is not limited to the method using the Jaccard coefficient, and for example, the final similarity between both sets may be calculated by combining similarities calculated by multiple methods.

[0061] The determination unit 124 determines whether or not the aggregation candidate alerts can be aggregated into the aggregation destination report based on the similarity calculated by the similarity calculation unit 123. For example, the determination unit 124 compares the similarity between both sets calculated by the similarity calculation unit 123 with a preset threshold. If the similarity is equal to or greater than the threshold, the determination unit 124 determines that the acquired aggregation candidate alerts can be aggregated into the aggregation destination report. On the other hand, if the similarity is less than the threshold, the determination unit 124 determines that the acquired aggregation candidate alerts cannot be aggregated into the aggregation destination report.

[0062] Here, the determination process performed by the determination unit 124 will be described with reference to Fig. 10. Fig. 10 is a diagram showing a specific example of the process of the determination unit according to the embodiment. Fig. 10 shows a case of determination example 1 in which alerts can be aggregated, and a case of determination example 2 in which alerts cannot be aggregated.

[0063] First, a description will be given of determination example 1. The determination unit 124 receives the Jaccard coefficient "J(A,B)=0.85..." between set A and set B notified by the similarity calculation unit 123. The determination unit 124 then compares the received similarity "0.85" with a threshold value "0.81" and determines that the received similarity is equal to or greater than the threshold value. As a result, the determination unit 124 determines that the alerts in the acquired aggregation candidate set B can be aggregated into the aggregation destination report corresponding to set A.

[0064] Next, a description will be given of determination example 2. The determination unit 124 receives the Jaccard coefficient "J(A,B)=0.80..." between set A and set B notified by the similarity calculation unit 123. The determination unit 124 then compares the received similarity "0.80" with a threshold value "0.81" and determines that the received similarity is smaller than the threshold value. As a result, the determination unit 124 determines that the alerts in the acquired aggregation candidate set B cannot be aggregated into the aggregation destination report corresponding to set A.

[0065] The threshold value used in the processing of the determination unit 124 may be, for example, any value set in advance by an analyst, etc. The determination processing performed by the determination unit 124 is not limited to using similarity, and may be performed by using, for example, a trained machine learning model to determine whether aggregation is possible.

[0066] In addition, the determination unit 124 compares the similarity calculated for each of the multiple first sets with the second set, and determines that the alerts that are candidates for aggregation can be aggregated into the aggregation destination report of the first set whose similarity is greater than or equal to a threshold and is the maximum value.

[0067] For example, the determination unit 124 receives the calculated similarity between each of the alert sets of the created reports stored in the report information storage unit 131 and the aggregation candidate alert set. As a result, the determination unit 124 receives the similarity with each of the created reports. The determination unit 124 then compares the received similarities and determines that the aggregation candidate alerts can be aggregated into the report corresponding to the alert set with the largest similarity that is equal to or greater than a threshold.

[0068] [3. Specific Examples] Here, a series of processes from weighting each alert to determining whether acquired alerts can be aggregated by the information processing device 100 will be described with reference to Fig. 11. Fig. 11 is a diagram showing the overall flow of processes of the information processing device according to the embodiment.

[0069] First, the weighting unit 121 assigns weights indicating correlation with the created reports to, for example, each alert in alert set A (first set) linked to the created report to be aggregated, and each alert in alert set B (second alert set) of aggregation candidates acquired via the communication unit 110, using a large-scale language model that has been fine-tuned using past reports and alerts.

[0070] This results in a weighted alert set A and a weighted alert set B. Note that in Fig. 11, the larger the symbol indicating each alert in the weighted alert set, the greater the weight assigned to it.

[0071] Next, the alert adding unit 122 reduces the difference between the weighted alert set A and the weighted alert set B, for example, by adding some of the alerts included in only one set to the other (see FIG. 9). As a result, difference-mitigated weighted alert set A and difference-mitigated weighted alert set B are obtained, in which the alerts included in only one set have been reduced.

[0072] Then, the similarity calculation unit 123 calculates the similarity (J(A, B)) between the difference-mitigated weighted alert set A and the difference-mitigated weighted alert set B, for example, by calculating the weighted Jaccard coefficient.

[0073] Thereafter, the determination unit 124, for example, compares the similarity between the two sets with a preset threshold value to determine whether the alerts in the aggregation candidate alert set B can be aggregated into the report of the aggregation destination set A, and outputs the determination result.

[0074] Through the series of processes described above, the information processing device 100 can appropriately determine whether a set of alerts for a specific event can be aggregated into an existing report by referring to the weights that indicate the correlation between the contents of the report set for each alert and performing processes to mitigate the differences between sets and calculate the similarity between sets.

[0075] 11 is merely an example, and the processing of the information processing device 100 is not limited to the above-described processing. For example, the information processing device 100 may omit the processing of the alert adding unit 122 and calculate the similarity between both sets in which the difference between the sets has not been alleviated. Furthermore, the information processing device 100 may calculate a simple similarity without considering the weight for the weighted alert set in which the difference has been alleviated.

[0076] [4. Example of estimation process] Next, the processing flow of the information processing device 100 will be described with reference to Fig. 12 and Fig. 13. Fig. 12 and Fig. 13 are flowcharts showing an example of the flow of the estimation process according to the embodiment. Note that the steps in the flowcharts shown in Fig. 12 and Fig. 13 may be executed in a different order, and some processes may be omitted.

[0077] First, the process of determining whether acquired alerts can be aggregated in one aggregation destination report will be described with reference to Fig. 12. The learning unit 125 acquires past reports and sets of alerts associated with them, and learns a weighting model (S101). Then, the information processing device 100 acquires a set of alerts that are candidates for aggregation from an external device or the like (S102).

[0078] When an alert set of an aggregation candidate is acquired (S102; Yes), the weighting unit 121 assigns weights to each of the alerts of the first set, which is the alert set of the report to be aggregated, and the second set, which is the alert set of the acquired aggregation candidate (S103). Note that when the information processing device 100 has not acquired an alert of an aggregation candidate (S102; No), it waits until it acquires an alert of an aggregation candidate.

[0079] After the process of S103, the alert adding unit 122 adds some of the alerts from one set to the other to reduce the difference between the weighted alerts of both sets (S104). Subsequently, the similarity calculation unit 123 calculates the similarity between the sets whose difference has been reduced (S105).

[0080] Then, the determination unit 124 determines whether the calculated similarity is equal to or greater than a preset threshold (S106). If the similarity is equal to or greater than the threshold (S106; Yes), the determination unit 124 determines that the aggregation candidate alerts can be aggregated into the aggregation destination report (S107), and the information processing device 100 ends the process. On the other hand, if the similarity is not equal to or greater than the threshold (S106; No), the determination unit 124 determines that the aggregation candidate alerts cannot be aggregated into the aggregation destination report (S108), and the information processing device 100 ends the process.

[0081] Next, the process of determining whether acquired alerts can be aggregated into the most suitable report for aggregation among multiple aggregation destination reports will be described with reference to Fig. 13. The information processing device 100 sets the number of past reports to n, i = 1 (S201). Then, the information processing device 100 acquires a set of alerts that are candidates for aggregation from an external device or the like (S202).

[0082] When the aggregation candidate alert set is acquired (S202; Yes), the weighting unit 121 selects the first set A, which is the alert set of the report to be aggregated. i and a second set B, which is a set of alerts of the acquired aggregation candidates, and assigns a weight to each of the alerts (S203). Note that, if the information processing device 100 has not acquired any alerts of the aggregation candidates (S202; No), it waits until it acquires the alerts of the aggregation candidates.

[0083] After the process of S203, the alert adding unit 122 adds some of the alerts from one set to the other to reduce the difference between the weighted alerts of both sets (S204). Subsequently, the similarity calculation unit 123 calculates the similarity between the sets whose difference has been reduced (S205).

[0084] Then, the determination unit 124 determines whether aggregation is possible by determining whether the calculated similarity is equal to or greater than a preset threshold, and stores the similarity and the determination result (S206). Then, the information processing device 100 sets i=i+1 and determines whether i is equal to or less than n (S207). If i is equal to or less than n (S207; Yes), the information processing device 100 returns to S203 and continues the process. On the other hand, if i is not equal to or less than n (S207; No), the determination unit 124 selects the first set A in which the similarity is equal to or greater than the threshold and is the maximum value. i The information processing device 100 determines that the aggregation candidate alerts can be aggregated into this report (S208), and ends the process.

[0085] 5. Effects of the embodiment As described above, the information processing device 100 according to this embodiment includes a weighting unit 121, a similarity calculation unit 123, and a determination unit 124. The weighting unit 121 assigns a weight to each alert for a specific event that indicates a correlation with the content of the aggregation destination report. The similarity calculation unit 123 calculates the similarity between a first set, which is a set of alerts in the aggregation destination report, and a second set, which is a set of aggregation candidate alerts, based on the weight assigned by the weighting unit 121. The determination unit 124 determines whether the aggregation candidate alerts can be aggregated into the aggregation destination report, based on the similarity calculated by the similarity calculation unit 123.

[0086] As a result, even if different events have occurred but the similarity is calculated to be high because the alerts have a low correlation with the report content in common, the information processing device 100 can calculate the similarity between both sets to be low by taking into account the weight indicating the correlation with the report content, and can appropriately determine that aggregation is not possible. In other words, the information processing device 100 can appropriately determine whether or not a set of alerts for a specific event can be aggregated into an existing report.

[0087] The information processing device 100 also has an alert adding unit 122. The alert adding unit 122 adds some of the alerts in one set, which is a set of alerts in reports to be aggregated, to the other set, based on the weight assigned by the weighting unit 121. In this case, the similarity calculation unit 123 calculates a simple similarity, without taking the weight into consideration, between the first set to which some of the alerts have been added by the alert adding unit 122 and the second set.

[0088] As a result, even when the same event occurs, the information processing device 100 can mitigate differences between the sets that arise due to chance observation errors, differences in security sensors, etc., and can therefore calculate a high similarity between the two sets and appropriately determine that they can be aggregated. In other words, the information processing device 100 can appropriately determine whether a set of alerts for a specific event can be aggregated into an existing report.

[0089] Furthermore, the similarity calculation unit 123 calculates the similarity between the first set and the second set, to which some alerts have been added by the alert adding unit 122, based on the weight assigned to each alert. This allows the information processing device 100 to calculate the similarity between both sets after mitigating the differences between the sets, taking the weight into consideration, and therefore makes it possible to more accurately determine whether or not to aggregate.

[0090] The determination unit 124 also compares the similarities calculated for each of the multiple first sets with the second set, and determines that the aggregation candidate alerts can be aggregated into the aggregation destination report of the first set for which the similarity is equal to or greater than a threshold and is the maximum value.As a result, the information processing device 100 can select, from the already created reports, the report with the highest similarity and appropriate as the aggregation destination, by sequentially calculating and comparing the similarities between each of the alert sets in the already created reports and the acquired alert set.

[0091] Furthermore, the weighting unit 121 assigns a weight to each alert based on the cosine similarity between the vectors of the alert and the content of the aggregated report using a large-scale language model. This allows the information processing device 100 to easily and accurately set a weight indicating a correlation with the content of the aggregated report by using a large-scale language model.

[0092] The information processing device 100 also includes a learning unit 125. The learning unit 125 learns a large-scale language model using a set of teacher data consisting of reports created in the past, alerts associated with the reports, and alerts not associated with the reports. As a result, the information processing device 100 allows the large-scale language model to learn alerts associated with reports created in the past as data that are closer in distance (higher in similarity) than alerts not associated with the reports, thereby enabling the information processing device 100 to appropriately set weights indicating correlation with the contents of the reports.

[0093] [6. System Configuration, etc.] Of the processes described in the above embodiments, some of the processes described as being performed automatically can also be performed manually. Alternatively, all or some of the processes described as being performed manually can be performed automatically using known methods. In addition, the information including the processing procedures, specific names, various data, and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified. For example, the various information shown in each drawing is not limited to the information shown in the drawings.

[0094] Furthermore, the components of each device shown in the figure are functional concepts and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads and usage conditions. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0095] 5 may be held in a storage server or the like, rather than being held by the information processing device 100. In this case, the information processing device 100 acquires various pieces of information by accessing the storage server.

[0096] [7. Hardware Configuration] 14 is a diagram showing an example of a hardware configuration The information processing apparatus 100 according to the embodiment described above is realized by a computer 1000 having a configuration as shown in FIG.

[0097] 14 is a diagram showing an example of a computer that executes an information processing program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0098] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0099] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the information processing device 100 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same process as the functional configuration of the information processing device 100 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0100] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0101] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1041. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN, WAN, etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070. [Explanation of symbols]

[0102] 100 Information processing device 110 Communications Department 120 control section 121 Weighting section 122 Add Alert 123 Similarity calculation part 124 Judgment section 125 Learning Department 130 Storage section 131 Report information storage unit 132 Weighting model memory unit

Claims

1. a weighting unit that assigns a weight indicating a correlation between each alert for a specific event and the content of the report to be aggregated; a similarity calculation unit that calculates a similarity between a first set, which is a set of alerts in the report to be aggregated, and a second set, which is a set of alerts that are candidates for aggregation, based on the weights assigned by the weighting unit; a determination unit that determines whether the aggregation candidate alerts can be aggregated into the aggregation destination report based on the similarity calculated by the similarity calculation unit; An information processing device comprising:

2. a weighting unit that assigns a weight indicating a correlation between each alert for a specific event and the content of the report to be aggregated; an alert adding unit that adds a portion of alerts contained in a first set, which is a set of alerts in a report to be aggregated, to a second set, which is a set of alerts that are candidates for aggregation, based on the weights assigned by the weighting unit; a similarity calculation unit that calculates a similarity between the first set to which some alerts have been added by the alert adding unit and the second set; a determination unit that determines whether the aggregation candidate alerts can be aggregated into the aggregation destination report based on the similarity calculated by the similarity calculation unit; An information processing device comprising:

3. The similarity calculation unit calculates the similarity between the first set to which some alerts have been added by the alert adding unit and the second set based on the weight assigned to each alert.

3. The information processing apparatus according to claim 2, wherein:

4. The determination unit compares the calculated similarities between each of the plurality of first sets and the second set, and determines that the aggregation candidate alerts can be aggregated into the aggregation destination report of the first set for which the similarity is equal to or greater than a threshold and is the maximum value.

4. The information processing device according to claim 1, wherein the information processing device is a computer.

5. The weighting unit assigns a weight to each of the alerts based on the cosine similarity of the vectors of the alerts and the content of the aggregated report corresponding to the type of cyber attack using a large-scale language model.

3. The information processing apparatus according to claim 1, wherein the information processing apparatus is a computer.

6. The system further includes a learning unit that uses a set of training data consisting of a report created in the past, an alert associated with the report, and an alert not associated with the report to learn the large-scale language model.

6. The information processing apparatus according to claim 5,

7. An information processing method executed by an information processing device, a weighting step of assigning a weight to each alert for a specific event that indicates a correlation with the content of the aggregated report; a similarity calculation step of calculating a similarity between a first set, which is a set of alerts of the report to be aggregated, and a second set, which is a set of alerts that are candidates for aggregation, based on the weights assigned in the weighting step; a determination step of determining whether or not the aggregation candidate alerts can be aggregated into the aggregation destination report based on the similarity calculated in the similarity calculation step; An information processing method comprising:

8. a weighting procedure for assigning a weight to each alert for a particular event that indicates its correlation with the content of the aggregated report; a similarity calculation step of calculating a similarity between a first set, which is a set of alerts of reports to be aggregated, and a second set, which is a set of alerts that are candidates for aggregation, based on the weights assigned by the weighting step; a determination step of determining whether or not the aggregation candidate alerts can be aggregated into the aggregation destination report based on the similarity calculated by the similarity calculation step; An information processing program that causes a computer to execute the above.

Images