Security report creation support system, and security report creation support method

Abstract

To provide a technique capable of supporting creation of a security report according to a report partner and a purpose.SOLUTION: A security report creation support system has a processor 103 and a storage device 105, wherein the storage device 105 stores a rule table 113 storing a rule corresponding to a reporting object and a reporting type, the processor 103 acquires a reporting content, the reporting object and the reporting type input by a user, read out the rule corresponding to the reporting object and the reporting type input by the user, from the rule table 113, and generates a report on the basis of the rule read out from the rule table 113 and the reporting content input by the user.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a security report creation support device and a security report creation support method. [Background technology]

[0002] In cybersecurity operations, it is important to create security reports on discovered and dealt with threats and situations, and to request responses and share information with management, employees, security engineers, etc. Currently, creating security reports is often done manually.

[0003] Patent Document 1 discloses a technology that makes it possible to reduce the workload required to create service reports for incident management. Patent Document 1 describes a technology that selects incident statistical information that corresponds to predetermined conditions from statistical information on each incident included in management reports that have been generated in the past, generates template information consisting of each selected item, assigns identification information to the template, performs statistical processing on each piece of incident information recorded in a storage device, and generates a management report. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-203909 Summary of the Invention [Problem to be solved by the invention]

[0005] Security reports are created for various audiences, such as management, employees, security engineers, etc. Security reports are also created for various purposes, such as incident reporting and information sharing.

[0006] Depending on the audience and purpose, the expressions used in the report may differ, and graphical illustrations may be required. Therefore, it is necessary to create a report that is appropriate for the audience and purpose.

[0007] However, Patent Document 1 does not describe support for creating security reports according to the recipients and purposes of the reports.

[0008] Therefore, an object of the present invention is to provide a technique that can support the creation of a security report according to the reporting party and purpose. [Means for solving the problem]

[0009] In order to solve the above problems, one representative security report creation support system of the present invention is a security report creation support system having a processor and a storage device, in which the storage device stores a rule table that holds rules corresponding to the report subject and report type, and the processor acquires the report content, report subject, and report type input by the user, reads rules from the rule table that correspond to the report subject and report type input by the user, and generates a report based on the rules read from the rule table and the report content input by the user. [Effects of the Invention]

[0010] According to the present invention, it is possible to support the creation of a security report according to the reporting party and purpose.

[0011] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a block diagram illustrating an example of a configuration of a security report creation support system according to a first embodiment. [Figure 2] FIG. 10 is a diagram illustrating an example of a report creation support screen displayed on a user terminal according to the first embodiment. [Figure 3] FIG. 10 is a diagram illustrating an example of a data configuration of a created report table. [Figure 4] FIG. 4 is a diagram illustrating an example of a data configuration of a rule table. [Figure 5] FIG. 10 is a diagram illustrating an example of a data configuration of a template table. [Figure 6] 10 is a flowchart illustrating an example of a rule analysis process for each report according to the first embodiment. [Figure 7] 10 is a flowchart illustrating an example of a report creation support process according to the first embodiment. [Figure 8] 10 is a flowchart illustrating an example of a report generation process according to the first embodiment. [Figure 9] 10 is a flowchart illustrating an example of a screen drawing process according to the first embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of the configuration of a security report creation support system according to a second embodiment. [Figure 11] 10 is a flowchart illustrating an example of a data output process according to the second embodiment. [Figure 12] FIG. 10 is a diagram illustrating an example of the configuration of a security report creation support system according to a third embodiment. [Figure 13] FIG. 11 is a diagram showing an example of a report creation support screen displayed on a user terminal according to the third embodiment. [Figure 14] FIG. 10 is a diagram illustrating an example of a data configuration of an input recommendation table. [Figure 15] 11 is a flowchart illustrating an example of a report creation support process according to a third embodiment. [Figure 16] FIG. 10 is a diagram illustrating an example of the configuration of a security report creation support system according to a fourth embodiment. [Figure 17] FIG. 10 is a diagram illustrating an example of a data configuration of a conversion data table. [Figure 18] 13 is a flowchart illustrating an example of an input format conversion process according to the fourth embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, embodiments of the present invention will be described with reference to the drawings. The examples are merely examples for explaining the present invention and are simplified. The present invention can also be implemented in various other forms. While various types of information will be described using expressions such as "tables" as examples, the various types of information may also be expressed using data structures other than these. [Example]

[0014] The security report creation support system of the first embodiment is a system that supports the creation of a security report according to the report recipient (report target) and purpose (report type).

[0015] FIG. 1 is a block diagram illustrating an example of the configuration of a security report creation support system according to a first embodiment.

[0016] The security report creation support system includes one or more user terminals 101 and a report creation support computer 102. The user terminals 101 and the report creation support computer 102 are connected to each other via a network.

[0017] The user terminal 101 is a terminal operated by a user such as an analyst.

[0018] The user terminal 101 has a function for inputting information necessary for creating a report, such as the report subject, purpose of the report, and report content, through user operation, and a function for presenting a report created by the report creation support computer 102. The user terminal 101 realizes these functions, for example, by displaying on the display screen a report creation support screen 200, which will be described later with reference to FIG.

[0019] The user terminal 101 can be realized by an information processing device such as a general server device, a personal computer, or a mobile terminal.

[0020] The report creation support computer 102 has a function of creating a security report according to the report subject and report type. The report creation support computer 102 can be realized by an information processing device such as a general server device, a personal computer, or a mobile terminal.

[0021] The report creation support computer 102 has, as its hardware configuration, a processor 103, a main memory 104, a storage device 105, an input / output device 106, a network interface 107, a bus 108 connecting these, and the like.

[0022] The processor 103 controls each unit of the report creation support computer 102. The processor 103 also reads data and programs stored in the storage device 105 into the main memory 104 and executes the processing determined by the programs.

[0023] The main memory 104 is configured with a volatile storage element such as a RAM (Random Access Memory), and stores programs executed by the processor 103 and data.

[0024] The main memory 104 also has a report-specific rule analysis unit 109, a report generation unit 110, and a screen drawing unit 111. These functions are realized by the processor 103 reading out a program stored in the storage device 105 into the main memory 104 and executing the processing.

[0025] The storage device 105 is configured with a nonvolatile storage element such as a hard disk drive (HDD) or a solid state drive (SSD), etc. The storage device 105 stores a production report table 112, a rule table 113, and a template table 114.

[0026] The input / output device 106 includes input devices such as a keyboard and a mouse that accept user operations, and output devices such as a touch panel, a display, and a speaker that output information.

[0027] The report creation support computer 102 acquires information input by a user through an input device, and presents the information to the user, for example, by displaying it on a screen, using an output device.

[0028] The NWIF 107 is an interface used by the report creation support computer 102 to communicate with the user terminal 101. The NWIF 107 is connected to a network and transmits and receives data to and from the user terminal 101 via the network.

[0029] The bus 108 connects the main memory 104, the storage device 105, the processor 103, and the NWIF 107. The bus 108 is an information transmission medium such as a bus or a cable.

[0030] The report-specific rule analysis unit 109 executes the report-specific rule analysis process described later in FIG. 6, derives rules according to the report subject and report type from previously created reports stored in the created report table 112, and records them in the rule table 113.

[0031] The report generation unit 110 executes the report generation process described later in FIG. 8, and generates a report based on the report content entered by the user via the user terminal 101, the rules stored in the rule table 113, and the templates stored in the template table 114.

[0032] The screen rendering unit 111 executes a screen rendering process, which will be described later with reference to FIG. 9, and displays the report generated by the report generating unit 110 on the user terminal 101.

[0033] The created report table 112 stores information about created reports. The data structure of the created report table 112 will be explained with reference to FIG.

[0034] The rule table 113 stores information on rules for writing reports according to the report subject and report type. The data structure of the rule table 113 will be explained with reference to FIG.

[0035] Template table 114 stores information on templates according to the purpose of the report. The data structure of template table 114 will be explained with reference to FIG.

[0036] FIG. 2 is a diagram showing an example of a report creation support screen 200 displayed on the user terminal 101 according to the first embodiment.

[0037] The report creation support screen 200 has an input section 201, an output section 202, and a template presentation section 203. The report creation support screen 200 is implemented, for example, by an executable application, a web page, or a browser extension function.

[0038] The input unit 201 has various input fields and buttons for the user to input information necessary for creating a report, such as the report subject, the report purpose, and the report content.

[0039] The input section 201 has a report target input field 204 , a report type input field 205 , a tag input field 206 , a report content input field 207 , a report generation button 208 , and an end button 209 .

[0040] In the report target input field 204, information on the report target, which indicates the person to whom the report is to be submitted, such as management, security engineers, employees, etc., is input.

[0041] In the report type input field 205, information on the report type indicating the purpose of the report, such as an incident handling report or information sharing, is input.

[0042] In the tag input field 206, tag information indicating the attributes of the report is input.

[0043] Information about the report content, which is the content to be written in the report, is input into the report content input field 207. The report content may be input in a descriptive format using technical terms, etc., taking into consideration the subject of the report, or may be input using simple language that anyone can understand.

[0044] The report generation button 208 is a button that is input by the user after inputting information in each input field to cause the report creation support computer 102 to start creating a report. When the report generation button 208 is input by the user, the report creation support computer 102 accepts the information input in each input field from the user terminal 101 and starts creating a report.

[0045] The report generation button 208 is not required, and when a predetermined time has passed since information was entered into each input field of the input section 201, or when text is entered into the report content input field 207, the information entered into each input field may be accepted from the user terminal 101 and report creation may begin.

[0046] The finish button 209 is a button that the user presses when he or she has completed inputting information into each input field and wants to save the created report.

[0047] When the end button 209 is pressed, the report creation support computer 102 determines that input into each input field of the input section 201 is complete, and stores the generated report in the created report table 112 .

[0048] The end button 209 is not essential, and the method of determining whether input to the input unit 201 has been completed is not limited to this.

[0049] The report generated by the report generating unit 110 is displayed on the output unit 202 by the screen drawing unit 111 .

[0050] The template presentation section 203 displays the template used to generate the report for reference.

[0051] The report creation support screen 200 in FIG. 2 is an example, and the contents can be changed as appropriate.

[0052] 3 to 5, various data tables used in the security report creation support system will be described.

[0053] FIG. 3 is a diagram showing an example of the data configuration of the created report table 112. As shown in FIG.

[0054] The created report table 112 stores information about the created reports.

[0055] The created report table 112 stores records having the following fields: created report ID 301, case ID 302, date and time 303, report target 304, report type 305, tag 306, and report content 307.

[0056] The information stored in the created report table 112 may be information on reports created in the past by the organization itself, or may be publicly available security reports, and the information source is not limited.

[0057] The created report ID 301 is a field that stores an identifier assigned to uniquely identify one report. The created report ID 301 is assigned a number as an example, but is not limited to this format as long as it can uniquely identify one report.

[0058] The case ID 302 is a field that stores an identifier assigned to uniquely identify one incident that is the source of the report. Although a number is assigned to the case ID 302 as an example, the format is not limited to this as long as it can uniquely identify one incident.

[0059] In Figure 3, the reports with created report IDs 301 of "1" and "2" both have case ID 302 of "1." This indicates that an incident occurred, and reports on this incident were created for management and security engineers, respectively.

[0060] The date and time 303 stores the date and time when the report was created.

[0061] Information about the report target of the report is stored in the report target 304. Information stored in the report target 304 is, for example, management, security engineers, employees, and the like.

[0062] The report type 305 stores information about the report type of the report. Information stored in the report type 305 is, for example, an incident handling report, information sharing, and the like.

[0063] The tag 306 stores report attribute information freely added and input by the user. The information stored in the tag 306 includes information representing report attributes not included in the report target 304 or the report type 305.

[0064] The report created is stored in the report content 307. The information stored in the report content 307 is not limited to text format, and may be in the form of a table, a diagram, or the like.

[0065] FIG. 4 is a diagram showing an example of the data configuration of the rule table 113. As shown in FIG.

[0066] The rule table 113 stores information on rules for creating reports according to report targets and report types.

[0067] The rule table 113 stores records having rule ID 401, report target 402, report type 403, other attributes 404, and rule 405 as fields.

[0068] The information stored in the rule table 113 may be created by a report-specific rule analysis process, which will be described later with reference to FIG. 6, or may be created and edited manually by the user.

[0069] The rule ID 401 is a field that stores an identifier assigned to uniquely identify one rule. The rule ID 401 is assigned a number as an example, but is not limited to this format as long as it can uniquely identify one rule.

[0070] Information about the report target of the report is stored in the report target 402. Information stored in the report target 402 is, for example, management, security engineers, employees, and the like.

[0071] This report target 402 corresponds to the field of report target 304 in the created report table 112. When a rule is created in the rule analysis process by report in Fig. 6, the value of report target 304 in the created report table 112 that had the greatest influence when creating the rule is stored in report target 402.

[0072] The report type 403 stores information about the report type of the report. Information stored in the report type 403 is, for example, an incident handling report, information sharing, etc.

[0073] This report type 403 corresponds to the field of the report type 305 in the created report table 112 .

[0074] When a rule is created in the rule analysis process by report in FIG. 6, the value of the report type 305 in the created report table 112 that had the greatest influence when creating the rule is stored in the report type 403 .

[0075] The other attribute 404 is a field that can store the attribute to which the rule applies. This other attribute 404 corresponds to the field of the tag 306 in the created report table 112. When a rule is created in the rule-by-report analysis process (see FIG. 6), the value of the tag 306 in the created report table 112 that had the greatest influence on the creation becomes the other attribute 404.

[0076] The rule 405 stores rules describing how to convert a report from the information of the report content entered by the user when generating the report. The rule 405 may be, for example, a one-to-one conversion rule such as "the word "malware" should be written as the word "suspicious file", or a rule related to the creation policy such as "information about files should be illustrated using a file diagram to show the relationships". The rule 405 may be written in a format that expresses substitutions such as regular expressions, or in a format that is written in natural language.

[0077] FIG. 5 is a diagram showing an example of the data configuration of template table 114. As shown in FIG.

[0078] The template table 114 stores information about templates related to report creation.

[0079] The template table 114 stores records having a template ID 501, a report type 502, and a template content 503 as fields.

[0080] The information stored in the template table 114 may be manually created and edited by the user, and the method for creating the template is not limited.

[0081] The template ID 501 is a field that stores an identifier assigned to uniquely identify one template. Although a number is assigned to the template ID 501 as an example, the format is not limited to this as long as it can uniquely identify one template.

[0082] The report type 502 stores information about the report type of the report. Information stored in the report type 502 is, for example, an incident handling report, information sharing, etc.

[0083] This report type 502 corresponds to the field of the report type 305 in the created report table 112 .

[0084] Templates used for creating reports are stored in the template content 503. Information stored in the template content 503 is not limited to text format, and may be in the form of tables, figures, or the like.

[0085] The field configurations of the created report table 112, the rule table 113, and the template table 114 shown in FIGS. 3 to 5 are merely examples, and the contents can be changed as appropriate.

[0086] The processing executed in the security report creation support system will be described with reference to Figures 6 to 9. The following processing is realized by the processor 103 of the report creation support computer 102 reading data and programs stored in the storage device 105 into the main memory 104 and executing the processing defined by the programs.

[0087] FIG. 6 is a flowchart illustrating an example of the report-specific rule analysis process according to the first embodiment.

[0088] The report-specific rule analysis process, an example of which is shown in FIG. 6, is executed by the report-specific rule analysis unit 109 of the report creation support computer 102.

[0089] The report-specific rule analysis process is a process that updates the rule table 113 used in the report creation support process, which will be described later in Fig. 7. Therefore, the report-specific rule analysis process is independent of the report creation support process, which is executed in response to a user input as a trigger, and the timing of execution does not matter.

[0090] In FIG. 6, the report creation support computer 102 calls up a report stored in the created report table 112 (step S601).

[0091] Next, the report creation support computer 102 classifies the reports by attribute, using the report target 304, report type 305, and tag 306 in the created report table 112 as the attributes of the report, and creates clusters (step S602). Note that the classification method may be to classify into clusters with the same combination of report target 304, report type 305, and tag 306, or a clustering method may be used.

[0092] Next, the report creation support computer 102 compares the characteristics of the reports belonging to one cluster with the characteristics of the reports in other clusters and extracts the differences between the characteristics of the reports and the characteristics of other clusters (step S603). This clarifies the characteristic report creation rules for each cluster created in step S602.

[0093] The feature difference extraction in step S603 is performed using machine learning. The difference extraction method may use, for example, Bidirectional Encoder Representations from Transformers (BERT) or Large Language Models (LLM).

[0094] Here, the characteristics of the report include, for example, the use of different terms for the same subject depending on the cluster.

[0095] Next, the report creation support computer 102 records the difference in features extracted in step S603 in the rule 406 of the rule table 113, and records the report target 304, report type 305, and tag 306 of the report belonging to the cluster in the report target 402, report type 403, and other attributes 404, respectively (step S604).

[0096] Next, it is determined whether or not the processes of steps S603 and S604 have been completed for all clusters created in step S602 (step S605).

[0097] In step S605, if the processes in steps S603 and S604 have not been completed for all the clusters created in step S602, the process returns to step S603, and the difference in features between the next cluster and other clusters is extracted.

[0098] In step S605, when the processes in steps S603 and S604 have been completed for all clusters created in step S602, this process ends.

[0099] FIG. 7 is a flowchart illustrating an example of the report creation support process according to the first embodiment.

[0100] 7, the report creation support computer 102 determines whether or not the report generation button 208 on the report creation support screen 200 in Fig. 2 has been pressed as a trigger to start report generation (step S701). Note that the trigger is not limited to the press of the report generation button 208, and report creation may be started when a predetermined time has elapsed since information was entered into the input unit 201, or when text is entered into the report content input field 207.

[0101] If the report generation button 208 is pressed in step S701, the report creation support computer 102 receives information input to the input section 201 of the report creation support screen 200 from the user terminal 101 (step S702).

[0102] The report creation support computer 102 executes a report generation process (step S703) which will be described later in Fig. 8. In the report generation process, a report is generated based on the report content entered by the user in the report content input field 207 of the input unit 201 of the report creation support screen 200, according to the report target entered in the report target input field 204.

[0103] Next, the report creation support computer 102 executes a screen drawing process (step S704) which will be described later with reference to Fig. 9. In the screen drawing process, the report generated in step S703 is presented on the output unit 202 of the report creation support screen 200.

[0104] Next, the report creation support computer 102 determines whether the user has completed input to the input unit 201 (step S705). Here, it determines that the input to the input unit 201 has been completed by pressing the end button 209 on the report creation support screen 200 in Fig. 2. Note that the method for determining whether the input to the input unit 201 has been completed is not limited to this.

[0105] If it is determined in step S705 that input to the input unit 201 is complete, the process proceeds to step S706.

[0106] On the other hand, if it is determined in step S705 that input to the input unit 201 is not complete, the process proceeds to step S702, where the report creation support computer 102 receives the content input to the input unit and repeats the process.

[0107] In step S706, the report creation support computer 102 stores the report created in step S703 in the created report table 112, and ends this process.

[0108] FIG. 8 is a flowchart illustrating an example of a report generation process according to the first embodiment.

[0109] The report generation process, an example of which is shown in FIG. 8, is executed by the report generation unit 110 of the report generation support computer 102.

[0110] 8, the report creation support computer 102 acquires the report target, report type, and report content input in the input section 201 of the report creation support screen 200 (step S801). At the same time, the computer 102 may also acquire the tag input in the tag input field 206.

[0111] Next, the report creation support computer 102 calls the rule 405 from the rule table 113, in which the field values ​​of the report target 402 and the report type 403 match the report target and report type acquired in step S801 (step S802).

[0112] Next, the report creation support computer 102 calls up from the template table 114 the template content 503 whose field value of the report type 502 matches the report type acquired in step S801 (step S803).

[0113] Next, the report creation support computer 102 generates a report from the report content acquired in step S801, the rule called in step S802, and the template called in step S803 (step S804), and ends this processing.

[0114] The report generation method in step S804 can be, for example, generation by LLM or generation by substitution using heuristic rules. In generation by LLM, the report content, clearly stated rules as conditions, and a template are input as prompts, and the completed report is output.

[0115] FIG. 9 is a flowchart illustrating an example of a screen drawing process according to the first embodiment.

[0116] The screen drawing process, an example of which is shown in FIG. 9, is executed by the screen drawing unit 111 of the report creation support computer 102.

[0117] 9, the report creation support computer 102 renders the report generated in step S804 in the output section 202 of the report creation support screen 200 (step S901), thereby allowing the user to check the generated report.

[0118] In this case, any drawing method can be used.

[0119] Next, the report creation support computer 102 calls up the template content 503 from the template table 114, which has a field value of the report type 502 that matches that of the report in question (step S902).

[0120] Next, the template content 503 called up in step S902 is rendered on the template presentation unit 203 (step S903), and this processing ends. This allows the user to check the template used to create the report.

[0121] According to the first embodiment, rules for creating a report are extracted according to the report target and report type, and a report is generated based on the report content entered by the user, the rules according to the report target and report type, and a template according to the report type. This makes it possible to support the creation of a security report according to the report recipient and purpose. [Example]

[0122] The security report creation support system of the second embodiment differs from the first embodiment in that, in addition to the functions of the first embodiment, the report creation support computer 102 converts the created report into a specified output format and outputs it. As a result, in the second embodiment, the report created by the report creation support computer 102 can be used in other media.

[0123] Hereinafter, the second embodiment will be described with reference to FIGS. 10 and 11, focusing on the differences from the first embodiment.

[0124] FIG. 10 is a diagram illustrating an example of the configuration of a security report creation support system according to the second embodiment.

[0125] In FIG. 10, the report creation support computer 102 has a data output unit 1001 in addition to the functions of the first embodiment.

[0126] The data output unit 1001 converts the report created by the report generation unit 110 into a specified output format and outputs it.

[0127] FIG. 11 is a flowchart illustrating an example of a data output process according to the second embodiment.

[0128] The data output process, an example of which is shown in FIG. 11, is executed by the data output unit 1001 of the report creation support computer 102.

[0129] In FIG. 11, the report creation support computer 102 determines whether or not a data output format has been specified in the user terminal 101 for the report created in the report creation support processing of FIG. 7 (step S1101).

[0130] The data output format is, for example, PDF, PowerPoint, etc. The data output format can be specified, for example, by presenting a select box in the report creation support screen 200 in Fig. 2 that allows the user to select the output format, and prompting the user to specify the format.

[0131] If the data output format is not specified in step S1101, this process ends.

[0132] On the other hand, if the data output format is specified in step S1101, the report creation support computer 102 converts the report created in the report creation support processing of FIG. 7 into the specified output format (step S1102).

[0133] Next, the report creation support computer 102 outputs the converted report to the user terminal 101 (step S1103), and this process ends.

[0134] According to the second embodiment, the security report creation support system converts the created report into a specified output format and outputs it. This allows the created report to be used in other media, making it easier to provide the security report to the person to whom the report is to be sent. [Example]

[0135] The security report creation support system of the third embodiment differs from the first embodiment in that, in addition to the functions of the first embodiment, the report creation support computer 102 can accept an input of an instruction to create a report using diagrams from a user and create a report using diagrams. As a result, in the third embodiment, it is possible to create a more effective report using diagrams.

[0136] Hereinafter, the third embodiment will be described with reference to FIGS. 12 to 15, focusing on the differences from the first embodiment.

[0137] FIG. 12 is a diagram illustrating an example of the configuration of a security report creation support system according to the third embodiment.

[0138] 12, the report creation support computer 102 has an input support unit 1002 in addition to the functions of the first embodiment. Also, the storage device 105 stores an input recommendation table 1004 in addition to the configuration of the first embodiment.

[0139] The input support unit 1002 extracts input recommendations that are recommended for report creation from the input recommendation table 1004 based on the input status of the user's report content, and presents them to the user.

[0140] The input recommendation table 1004 is a table for managing input recommendations extracted by the input support unit 1002. The data structure of the input recommendation table 1004 will be described with reference to FIG.

[0141] FIG. 13 is a diagram showing an example of a report creation support screen 200 displayed on the user terminal 101 according to the third embodiment.

[0142] The report creation support screen 200 of the third embodiment has an input support indicator 1202 in addition to the configuration of the report creation support screen 200 of the first embodiment shown in Fig. 2. Furthermore, the report creation support screen 200 of the third embodiment has a report content input field 1201 instead of the report content input field 207 of the first embodiment.

[0143] The report creation support screen 200 is implemented, for example, as an executable application, a web page, or a browser extension function.

[0144] 2 in that the report content input field 1201 allows the user to input a report creation instruction using diagrams in a predetermined input format. This allows the user to instruct the creation of a report using diagrams as exemplified in the output unit 202. The input format for the report creation instruction is an intermediate language in which the report creation instruction can be input, such as a unique input format such as Markdown.

[0145] The input support indicator 1202 displays input recommendations extracted in the report creation support process described later in Fig. 15. By checking the input support indicator 1202, the user can learn about missing information and more desirable input formats. This enables the creation of precise and useful reports.

[0146] In FIG. 13, the input assistance indicator 1202 is displayed as a balloon as an example, but the format of the input assistance indicator 1202 is not limited to this.

[0147] Note that a method for creating a report from data in a predetermined input format can be realized by describing a rule 405 that takes the input format into consideration, so a description thereof will be omitted.

[0148] Furthermore, the report creation support screen 200 in FIG. 13 is an example, and the contents can be changed as appropriate.

[0149] FIG. 14 is a diagram showing an example of the data configuration of the input recommendation table 1004. As shown in FIG.

[0150] The input recommendation table 1004 stores information on input recommendations that are recommended for report creation.

[0151] The input recommendation table 1004 stores records having the following fields: input format ID 1301, report target 1302, report type 1303, target 1304, attribute 1305, condition 1306, and input recommendation 1307.

[0152] The information stored in the input recommendation table 1004 may be created and edited manually by the user as rules.

[0153] The input format ID 1301 is a field for storing an identifier assigned to uniquely identify one input recommendation. Although a number is assigned to the input format ID 1301 as an example, the input format ID is not limited to this format as long as it can uniquely identify one input recommendation.

[0154] The report target 1302 stores information about the report target of the report. Information stored in the report target 1302 is, for example, management, security engineers, employees, and the like.

[0155] The report type 1303 stores information about the report type of the report. Information stored in the report type 1303 is, for example, an incident handling report, information sharing, and the like.

[0156] The target 1304 stores information about the target of the condition for displaying input recommendations in the input assistance indicator 1202. The target is, for example, the subject of the condition, such as an attacker, an attack group, a victim, a terminal, a file, a process, a registry, an IP address, or a domain name.

[0157] The attribute 1305 stores information about the attributes of the target 1304. The attributes are, for example, the properties or behavior of the target 1304, such as the execution format, hash value, or file drop.

[0158] The condition 1306 stores information on the condition for displaying input recommendations in the input assistance indicator 1202. The condition indicates the state of the attribute 1305 of the target 1304, such as small, large, included, or not included.

[0159] The input recommendation 1307 stores information about the input recommendation displayed on the input assistance indicator 1202. The input recommendation is an item that the user is advised to input into the report content input field 1201, such as "The report will be more useful if you include file format information for [file name]."

[0160] In the example of FIG. 14, if "file" is stored in the target 1304, "executable" is stored in the attribute 1305, and "does not contain" is stored in the condition 1306, and the file does not contain an executable format, the message "The report will be more useful if there is file format information for [file name]" stored in the input recommendation 1307 is displayed in the input assistance indicator 1202.

[0161] The field configuration of the input recommendation table 1004 is an example, and the contents can be changed as appropriate.

[0162] FIG. 15 is a flowchart illustrating an example of a report creation support process according to the third embodiment.

[0163] The report creation support process in Fig. 15 is a modified example of the report creation support process in Fig. 7. In Fig. 15, the input support process of steps S1401 to S1403 is executed by the input support unit 1002 of the report creation support computer 102. In Fig. 15, the same processes as those in Fig. 7 are denoted by the same reference numerals, and their explanations will be omitted.

[0164] In FIG. 15, when the report creation support computer 102 receives information entered into the report creation support screen 200 of the user terminal 101 in step S702, it reads from the input recommendation table 1004 input recommendations whose report target 1302 and report type 1303 match the report action and report type included in the information received in step S702 (step S1401).

[0165] Next, the report creation support computer 102 determines whether or not there is an input recommendation 1307 among the input recommendations read in step S402, in which the information entered in the report content input field 1201 matches the target 1304, attribute 1305, and condition 1306 (step S1402).

[0166] In step S1402, if there is no input recommendation 1307 among the input recommendations read in step S402 that matches the information entered in the report content input field 1201 with the target 1304, attribute 1305, and condition 1306, the processing from step S703 onwards is executed.

[0167] On the other hand, if there is an input recommendation 1307 among the input recommendations read in step S1402, in which the information entered in the report content input field 1201 matches the target 1304, attribute 1305, and condition 1306, that input recommendation 1307 is extracted (step S1403).

[0168] Next, the report creation support computer 102 displays the input support indicator 1202 on the report creation support screen 200, displays the input recommendations 1307 extracted in step S1403 on the input support indicator 1202 (step S1404), and executes the processing from step S703 onwards.

[0169] According to the third embodiment, the user inputs instructions for creating a report using diagrams in a specified input format, and a report is generated based on the input information, so that a precise report using diagrams can be created.

[0170] Furthermore, input recommendations are displayed in the input assistance indicator 1202 based on the information entered by the user, so that the user can be prompted to enter information necessary to generate a more useful report. [Example]

[0171] The security report creation support system of the fourth embodiment differs from the third embodiment in that, in addition to the functions of the third embodiment, the report creation support computer 102 creates data in a predetermined input format for inputting instructions for creating a report using diagrams from security-related data such as logs and tickets. As a result, in the fourth embodiment, data in a predetermined input format can be easily created.

[0172] Hereinafter, the fourth embodiment will be described with reference to FIGS. 16 to 18, focusing on the differences from the third embodiment.

[0173] FIG. 16 is a diagram illustrating an example of the configuration of a security report creation support system according to the fourth embodiment.

[0174] The report creation support computer 102 has an input format conversion unit 1003 in addition to the functions of the third embodiment. The storage device 105 stores a conversion data table 1005 in addition to the configuration of the first embodiment.

[0175] The input format conversion unit 1003 creates data in a predetermined input format for inputting instructions for creating a report using diagrams from security-related data such as logs and tickets.

[0176] The conversion data table 1005 is a table for managing information on input format conversions that have been performed in the past. The data structure of the conversion data table 1005 will be described with reference to FIG.

[0177] FIG. 17 is a diagram showing an example of the data configuration of the conversion data table 1005. As shown in FIG.

[0178] Conversion data table 1005 stores data before and after input format conversion when the input format was converted in the past. Conversion data table 1005 is stored in advance in storage device 105 and is used in the input format conversion process described with reference to FIG.

[0179] The conversion data table 1005 stores records having conversion data ID 1501, raw data 1502, and converted data 1503 as fields.

[0180] The information stored in the conversion data table 1005 may be stored in a format in which the user manually creates and edits rules.

[0181] The converted data ID 1501 is a field that stores an identifier assigned to uniquely identify a set of data before and after input format conversion. Although a number is assigned to the converted data ID 1501 as an example, the format is not limited to this as long as it can uniquely identify a set of data before and after input format conversion.

[0182] The raw data 1502 stores data before conversion when the input format was converted in the past. The raw data 1502 is, for example, a log or a ticket.

[0183] The post-conversion data 1503 stores the post-conversion data when the input format was converted in the past.

[0184] The field configuration of the conversion data table 1005 is an example, and the contents can be changed as appropriate.

[0185] FIG. 18 is a flowchart illustrating an example of the input format conversion process according to the fourth embodiment.

[0186] The input format conversion process, an example of which is shown in FIG. 18, is executed by the input format conversion unit 1003 of the report creation support computer 102.

[0187] 18, the report creation support computer 102 determines whether input of data to be converted into an input format such as a log or an incident ticket has been received from the user terminal 101 (step S1601). The data received at this time is data related to security reports, such as logs, malware analysis data, and incident tickets.

[0188] When input of data to be converted is accepted in step S1601, the report creation support computer 102 reads out the raw data 1502 and the converted data 1503 from the conversion data table 1005 (step S1602).

[0189] Next, the report creation support computer 102 converts the data received in step S1601 into a predetermined input format for inputting a report creation instruction based on the read raw data 1502 and converted data 1503 (step S1603).

[0190] In step S1603, the received data is converted into a predetermined input format using the LLM with the received data, raw data 1502, and converted data 1503 as prompts. Note that the method of converting the input format is not limited to this.

[0191] Next, the report creation support computer 102 stores the data before and after conversion in the conversion data table 1005 as raw data 1502 and converted data 1503 (step S1604).

[0192] Next, the report creation support computer 102 outputs the converted data 1503 to the user terminal 101 (step S1605), and ends this process. The user inputs a report creation instruction to the report creation support computer 102 by inputting the data in a predetermined input format output from the report creation support computer 102 into the report content input field 1201 in Figure 3.

[0193] According to the fourth embodiment, data related to security reports, such as logs and incident tickets, are converted into a predetermined input format for inputting instructions for creating reports using diagrams. This reduces the workload of creating data in the predetermined input format.

[0194] The present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0195] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The above-described configurations, functions, etc. may also be implemented in software, with a processor interpreting and executing a program that implements each function. Information such as the programs, tables, and files that implement each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD. [Explanation of symbols]

[0196] 101: User terminal 102: Report writing support computer 103: Processor 104: Main memory 105: Storage device 106: Input / output device 107: Network interface 108: Bus 109: Report-specific rule analysis section 110: Report generation section 111:Screen drawing section 112: Create Report Table 113: Rule table 114: Template table

Claims

1. A security report creation support system having a processor and a storage device, The storage device A rule table is stored that stores rules corresponding to report targets and report types, The processor: Acquire the report content, report target, and report type entered by the user, Read out a rule from the rule table corresponding to the report subject and report type input by the user; A security report creation support system that generates a report based on the rules read from the rule table and the report content input by the user.

2. 2. The security report creation support system according to claim 1, The storage device A template table is stored in which templates according to the report type of the report are stored, The processor: Reads a template corresponding to the report type input by the user from the template table; A security report creation support system that creates a report based on the read template.

3. 2. The security report creation support system according to claim 1, The storage device Stores the created report table that stores the created reports, The processor: A security report creation support system that creates the rules corresponding to the report targets and report types based on the reports stored in the created report table.

4. 4. The security report creation support system according to claim 3, The processor: A security report creation support system that creates the rules using machine learning.

5. 2. The security report creation support system according to claim 1, The processor: A security report creation support system that presents the generated report to the user.

6. 4. The security report creation support system according to claim 3, The processor: The security report creation support system stores the created report in the created report table.

7. 2. The security report creation support system according to claim 1, The processor: Obtaining an output format input by the user; A security report creation support system that converts the generated report into an output format input by the user.

8. 2. The security report creation support system according to claim 1, The processor: Acquires report creation instructions entered by the user in a predetermined input format, A security report creation support system that generates a report based on the report creation instruction.

9. 9. The security report creation support system according to claim 8, The storage device storing an input recommendation table that stores input recommendations and conditions for presenting the input recommendations; The processor: extracting, from the input recommendation table, input recommendations for which the report creation instruction input by the user matches the conditions; A security report creation support system that presents the extracted input recommendations to a user.

10. 9. The security report creation support system according to claim 8, The storage device Stores a conversion data table that stores data before and after input format conversion, The processor: Obtaining data entered by the user; reads the data before and after the input format conversion from the conversion data table; A security report creation support system that converts the data entered by the user into the predetermined input format based on the data before and after the input format conversion.

11. A security report creation support method for a security report creation support system having a processor and a storage device, comprising: In the storage device, A rule table is stored that stores rules corresponding to report targets and report types, The processor: Acquire the report content, report target, and report type entered by the user, Read out from the rule table a rule corresponding to the report subject and report type input by the user; A security report creation support method for generating a report based on the rules read from the rule table and the report content input by the user.

Images