Information processing device, information processing method, and program

Abstract

To provide support to reduce a time required for analyzing abnormalities in a network.SOLUTION: An information processing device includes: an acquisition unit that acquires environmental information indicating an environment of communication monitored by a monitoring device for detection information indicating an abnormal event detected by the monitoring device that monitors communication in a network; a query unit that sends query information inquiring about a cause of the event included in the detection information to a language model and acquires response information to the query information from the language model; and a display unit that displays the detection information, the environmental information, and the response information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, an information processing method, and a program that support analysis after an abnormality is detected. [Background technology]

[0002] To minimize damage to networks caused by anomalies such as targeted attacks, unknown threats, and internal threats, there are known technologies that collect logs from networks and detect anomalies. However, currently, after an anomaly is detected, the collected logs are used to manually analyze the anomaly, which takes a lot of time.

[0003] As a related technique, Patent Document 1 discloses a network anomaly detection device that detects network anomalies. The network anomaly detection device in Patent Document 1 acquires scenario information including a scenario in which the chronological order of events related to a plurality of flows is set in advance, and flow statistical information collected from header information of network packets over a predetermined period, and determines whether there is a network anomaly based on whether there is flow statistical information in the scenario information that matches an event in the scenario. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2020-092332 Summary of the Invention [Problem to be solved by the invention]

[0005] However, while the network anomaly detection device in Patent Document 1 associates a scenario with a flow and improves the accuracy of anomaly detection for matching flows, it does not help reduce the time required for anomaly analysis after an anomaly is detected from the network.

[0006] An example of a purpose of the present disclosure is to help reduce the time required for anomaly analysis on a network. [Means for solving the problem]

[0007] In order to achieve the above object, an information processing device according to one aspect of the present disclosure includes: an acquisition unit that acquires, for detection information indicating an abnormal event detected by a monitoring device that monitors communications on a network, environment information indicating an environment of the communications monitored by the monitoring device; an inquiry unit that transmits inquiry information inquiring about a cause of an event included in the detection information to a language model, and acquires response information to the inquiry information from the language model; a display unit that displays the detection information, the environmental information, and the response information; The present invention is characterized by having the following.

[0008] In order to achieve the above object, an information processing method according to one aspect of the present disclosure includes: The information processing device acquiring environmental information indicating an environment of the communication monitored by a monitoring device for detection information indicating an abnormal event detected by the monitoring device; transmitting query information to a language model inquiring about a cause of the event included in the detection information; obtaining response information to the inquiry information from the language model; displaying the detection information, the environmental information, and the response information; It is characterized by:

[0009] Furthermore, in order to achieve the above object, a program according to one aspect of the present disclosure comprises: On the computer, acquiring environmental information indicating an environment of the communication monitored by a monitoring device for detection information indicating an abnormal event detected by the monitoring device; transmitting query information to a language model inquiring about a cause of the event included in the detection information; obtaining response information to the inquiry information from the language model; displaying the detection information, the environmental information, and the response information; The present invention is characterized in that it causes the processing to be executed. [Effects of the Invention]

[0010] As described above, the present disclosure can help reduce the time required for analyzing anomalies in a network. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an information processing device. [Figure 2] FIG. 2 is a diagram illustrating an example of a system including an information processing device. [Figure 3] FIG. 3 is a diagram illustrating an example of an information processing device and an in-house network. [Figure 4] FIG. 4 is a diagram illustrating an example of the operation of the anomaly detection model. [Figure 5] FIG. 5 is a diagram illustrating an example of an anomaly detection model. [Figure 6] FIG. 6 is a diagram illustrating an example of the environment information. [Figure 7] FIG. 7 is a diagram illustrating an example of history information. [Figure 8] FIG. 8 is a diagram illustrating an example of inquiry information. [Figure 9] FIG. 9 is a diagram illustrating an example of the response information. [Figure 10] FIG. 10 is a diagram illustrating an example of the operation of the information processing device. [Figure 11] FIG. 11 is a diagram for explaining the first embodiment. [Figure 12] FIG. 12 is a diagram for explaining the second embodiment. [Figure 13] FIG. 13 is a diagram for explaining an example of a modified example. [Figure 14]FIG. 14 is a diagram illustrating an example of a computer that realizes an information processing device according to the embodiment and the modification. DETAILED DESCRIPTION OF THE INVENTION

[0012] (Embodiment) The configuration of an information processing device in an embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram illustrating an example of the configuration of an information processing device.

[0013] [Device configuration] 1 is a device (anomaly analysis support device) that supports reducing the time required for anomaly analysis on a network. Also, as shown in FIG. 1, the information processing device 10 includes an acquisition unit (acquisition means) 11, an inquiry unit (inquiry means) 12, and a display unit (display means) 13.

[0014] The acquisition unit 11 acquires environmental information indicating the environment of communications monitored by a monitoring device for detection information indicating an abnormal event detected by the monitoring device that monitors communications on a network. The query unit 12 transmits query information inquiring about the cause of the event included in the detection information to a language model, and acquires response information to the query information from the language model. The display unit 13 displays the detection information, environmental information, and response information.

[0015] Furthermore, the acquisition unit 11 acquires history information indicating the history of abnormalities detected by the monitoring device from the detection information, and displays the history information on the display unit 13.

[0016] In this way, in the embodiment, by presenting the detection information, environmental information, and response information to users (such as monitoring analysts, CSIRT (Computer Security Incident Response Team), SOC (Security Operation Center), and other workers who respond when a security incident occurs), it is possible to help reduce the time required to analyze anomalies in a network.

[0017] [System Configuration] Next, the information processing device 10 in the embodiment will be described in more detail with reference to Fig. 2. Fig. 2 is a diagram illustrating an example of a system including an information processing device.

[0018] 2, the system 100 in the embodiment includes an information processing device 10, a storage device 20, an information processing device 30, a base 40, and a monitoring device 50. In the example of FIG. 2, the information processing device 10, the storage device 20, the information processing device 30, the base 40, and the monitoring device 50 are communicably connected via a network 60.

[0019] The information processing device 10 is a device used by a user for anomaly analysis, such as a CPU (Central Processing Unit), a programmable device such as an FPGA (Field-Programmable Gate Array), a GPU (Graphics Processing Unit), or a circuit equipped with one or more of these, a server computer, a personal computer, a mobile terminal, etc.

[0020] The storage device 20 is a database, a server computer, a circuit having a memory, etc. The storage device 20 stores, for example, at least environmental information 21, history information 22, etc. In the example of Fig. 2, the storage device 20 is provided outside the information processing device 10, but it may also be provided inside the information processing device 10.

[0021] The information processing device 30 is, for example, a CPU, a programmable device such as an FPGA, a GPU, or a circuit equipped with one or more of these, a server computer, or the like, in which a language model 31 is installed.

[0022] The base 40 is one of the in-house networks established in Japan or overseas. The monitoring device 50 collects communication logs from the in-house network established at the base 40, and when the anomaly detection model 51 detects an anomaly based on the collected communication logs, it transmits the detection information to the information processing device 10. The monitoring device 50 is, for example, a CPU, a programmable device such as an FPGA, a GPU, or a circuit or computer equipped with one or more of these. Note that, although the anomaly detection model 51 is provided in the monitoring device 50 in the example of FIG. 2, it may also be provided outside the monitoring device 50.

[0023] FIG. 3 is a diagram illustrating an example of an information processing device and an in-house network. The system 100 is, for example, an in-house network established domestically or overseas. The system 100 in FIG. 3 includes an information processing device 10, bases 40 (40a to 40e), and monitoring devices 50 (50a to 50e). In the example of FIG. 3, the information processing device 10 and the monitoring devices 50 (50a to 50e) are connected to each other so as to be able to communicate with each other via a network 60.

[0024] The bases 40a to 40e are networks constructed in, for example, an intranet 40a, a data center 40b, a remote location (USA) 40c, a remote location (China) 40d, and a remote location (India) 40e.

[0025] The monitoring devices 50a to 50e collect, for example, communication logs of the networks established at the respective bases 40a to 40e. For example, the monitoring device 50a in FIG. 3 collects communication logs of the intranet 40a.

[0026] Network 60 is a communication network constructed using communication lines such as the Internet, a LAN (Local Area Network), a dedicated line, a telephone line, an in-house network, a mobile communication network, Bluetooth (registered trademark), and Wi-Fi (Wireless Fidelity) (registered trademark).

[0027] The monitoring device 50 will now be described in detail. The monitoring device 50 first collects communication logs from the bases 40 of the in-house network. Next, the monitoring device 50 inputs the collected communication logs into an anomaly detection model 51 for detecting predetermined anomalies to detect the anomaly. Next, if the anomaly detection model 51 detects an anomaly, the monitoring device 50 notifies the acquisition unit 11 and the query unit 12 that an anomaly has been detected (sends anomaly detection information).

[0028] The anomaly detection model aggregates specific attributes of communication logs (text logs) by time, converts them into time-series data, and detects anomalies based on the converted time-series data. Note that a machine learning model or the like may also be used as the anomaly detection model.

[0029] Figure 4 is a diagram illustrating an example of the operation of an anomaly detection model. Example A in Figure 4 shows a text log that can be acquired by NDR (Network Detection and Responding). Note that the text log is a variable-length log with multiple attributes for multiple protocols. Example B in Figure 4 is time-series data obtained by performing appropriate preprocessing on the text log. In example B in Figure 4, an anomaly is determined to have occurred when the value exceeds a preset threshold (dashed line). The time-series data is obtained by aggregating specific attributes of the text log by time and converting them into time-series data.

[0030] Examples of abnormalities include an abnormal number of true / false results in Kerberos user authentication, or an abnormal number of connection attempts in an SSH (Secure Shell) connection (login). Abnormalities also include authentication access from environments that would not normally occur, such as multiple unintended authentication attempts while on an overseas business trip. Furthermore, abnormalities include events that impair availability, such as a large number of connection attempts from multiple users due to an unintended shutdown of an SSH server.

[0031] Figure 5 is a diagram illustrating an example of an anomaly detection model. In the example of Figure 5, "model," which indicates the anomaly detection model, is associated with "installation environment," "installation IP segment," and "anomaly detection target." "Model" indicates identification information for identifying the anomaly detection model. In the example of Figure 5, "Model A," "Model B," "Model C," etc. are shown as identification information. "Installation environment" indicates the base that is the target of monitoring for the anomaly detection model. In the example of Figure 5, "international gateway" is shown as the base. "Installation IP segment" indicates the name of the country where the base that is the target of monitoring is located. In the example of Figure 5, "North America," "China," and "India" are shown.

[0032] The "Anomaly Detection Target" column shows the type of anomaly that the anomaly detection model detects. The example in Figure 5 shows a "model that detects anomalies in the number of SSH connection attempts (specific attribute)," a "model that detects anomalies in the number of false (specific attribute) results in Kerberos user authentication," and a "model that detects anomalies in the number of false (specific attribute) results in NTLM (New Technology LAN Manager) user authentication." However, the anomaly detection models are not limited to those mentioned above.

[0033] ●The information processing device (abnormality analysis support device) will be explained in detail. The information processing device 10 in FIG. 2 includes an acquisition unit 11, an inquiry unit 12, a generation unit 14 (a prompt generation unit 141, an analysis support information generation unit 142), an output information generation unit 15, and a display unit 13.

[0034] When the acquisition unit 11 receives detection information indicating an abnormal event detected by the monitoring device 50, it searches using search conditions set in advance for each monitoring device 50 (abnormality detection model) and acquires from the storage device 20 environmental information 21 indicating the communication environment of the monitoring device 50 that detected the abnormality, and history information 22 indicating the history of abnormalities previously detected by the monitoring device 50.

[0035] Figure 6 is a diagram illustrating an example of environmental information. In the example of Figure 6, "Monitored IP Segment," "Responsible Local Subsidiary," and "Business Division" are associated with "Model," which indicates an anomaly detection model. "Model" indicates identification information that identifies the anomaly detection model. In the example of Figure 6, the identification information is displayed as "Model A," "Model B," "Model C," etc. "Monitored IP Segment" indicates the IP segment of the monitoring device. The monitored IP segment is the network range monitored by the "Model," and is a segment that covers all IP addresses under the corresponding subnet. In the example of Figure 6, the monitored IP segments are displayed as "10.133.20.1 / 22," "10.151.50.1 / 24," and "10.172.30.1 / 20." "Responsible Local Subsidiary" indicates the name of the country where the local subsidiary under the jurisdiction of the monitoring device is located. In the example of Figure 6, the following are displayed: "North America," "China," and "India." The "Division" column indicates the divisions that the monitoring device is responsible for. In the example of Figure 6, "Network Division," "Finance Division," and "Enterprise Division" are shown.

[0036] FIG. 7 is a diagram illustrating an example of history information. In the example of FIG. 7, "Occurrence Date and Time" and "Abnormal Event" are associated with "Model," which indicates an anomaly detection model. "Model" indicates identification information that identifies the anomaly detection model. In the example of FIG. 7, the identification information includes "Model A," "Model A," "Model B," "Model B," and "Model C." "Occurrence Date and Time" indicates the date and time when the anomaly detection model detected the anomaly. In the example of FIG. 7, the occurrence dates and times include "2023 / 08 / 10 04:00," "2023 / 10 / 21 18:00," "2023 / 07 / 05 12:00," "2023 / 09 / 22 15:00," and "2024 / 01 / 22 07:00."

[0037] "Abnormal events" shows the details of events that the anomaly detection model has detected in the past. In the example of Figure 7, "a sudden increase in authentication denials due to unintended access by employees of the Japanese headquarters on a business trip overseas," "a sudden increase in confirmation communications due to inconsistencies with server-side information following changes in terminal settings," "a sudden increase in connection denials and reconnection attempts due to unintended server-side outages," "a sudden increase in retransmission requests due to bandwidth instability following network facility construction," and "network connection interruptions due to changes in server-side settings" are shown. However, abnormal events are not limited to those mentioned above.

[0038] When the query unit 12 receives detection information indicating an abnormal event detected by the monitoring device 50, it generates query information (prompt) based on the detected abnormal event, inquiring about the cause of the event included in the detection information to be input to the language model 31. The language model 31 is, for example, a large-scale language model (LLM) such as ChatGPT or BERT.

[0039] Fig. 8 is a diagram illustrating an example of inquiry information. In the example of Fig. 8, an "inquiry prompt" indicating inquiry information corresponding to a "model" indicating an anomaly detection model is shown. The "model" indicates identification information that identifies the anomaly detection model. In the example of Fig. 8, "model A," "model B," "model C," etc. are shown as the identification information.

[0040] "Query prompt" is a prompt to be input to the language model. In the example of Figure 8, the query prompts are "Please tell me the technical possibility based on the RFC (Request for Comment) about the phenomenon of a sudden increase in the number of 0s in the SSH connection attempt count attribute," "Please tell me the technical possibility based on the RFC about the phenomenon of a sudden increase in the number of false Kerberos authentication denials," and "Please tell me the technical possibility based on the RFC about the phenomenon of a sudden increase in false in NTLM user authentication." However, query prompts are not limited to the prompts mentioned above.

[0041] Next, the inquiry unit 12 transmits the generated inquiry information to the language model 31. After that, the inquiry unit 12 acquires response information to the inquiry information output by the language model 31.

[0042] FIG. 9 is a diagram illustrating an example of answer information. In the example of FIG. 9, "Answer" indicates answer information corresponding to "Model," which indicates an anomaly detection model. "Model" indicates identification information that identifies the anomaly detection model. In the example of FIG. 9, the identification information is "Model A," "Model B," etc. The "Answer" is the language model's response to the input prompt. In the example of FIG. 9, the answers are as follows: "1. If the SSH server does not support the authentication method selected by the client, the corresponding parameter may be 0. / 2. If the connection is terminated before the authentication method is selected, the corresponding parameter may be 0." "1. If the host name is changed on the terminal side and the host name change is not synchronized on the AD side, authentication attempts may be repeated. / 2. If the Kerberos authentication certificate is not updated after it expires, authentication may return false, resulting in a large number of unintended connection attempts." However, the answers are not limited to the answers described above.

[0043] The generation unit 14 uses the detection information, the environmental information 21, and the response information to generate analysis support information (an abnormality detection alert) for supporting an abnormality analysis by a user who monitors and manages an in-house network. Alternatively, the generation unit 14 may generate analysis support information using the detection information, the environmental information 21, the history information 22, and the response information. Alternatively, the generation unit 14 may generate analysis support information using the environmental information 21, the history information 22, and the response information.

[0044] Specifically, the generation unit 14 has a prompt generation unit 141 and an analysis support information generation unit 142. The prompt generation unit 141 generates a prompt for analysis support information (an abnormality detection alert) using the detection information, the environment information 21, the history information 22, and the response information.

[0045] An example of a prompt would be, "Generate an anomaly detection alert using the following: detection information: 'Anomaly detected on Model A at 4:00 on 2023 / 12 / 20', environment information: 'North American IP segment under the jurisdiction of the Network Business Division', history information: 'Anomaly cases occurred in 2023 / 8 where an unintended sudden increase in access was caused by an employee on a business trip and in 2023 / 10 where an access sudden increase was caused by a change in terminal settings', and response information: '1. If the SSH server does not support the authentication method selected by the client, the relevant parameter may become 0. / 2. If the connection is disconnected before the authentication method is selected, the relevant parameter may become 0'."

[0046] Furthermore, the analysis support information generation unit 142 transmits the generated prompt to the language model 31, and acquires the analysis support information (an abnormality detection alert) generated in response to the prompt from the language model 31. Note that the language model used may be different from the language model used by the query unit 12.

[0047] An example of analysis support information (anomaly detection alert) that can be generated is, "An anomaly was detected in Model A at 4:00 on 2023 / 12 / 20. This event occurred in the North American IP segment under the jurisdiction of the Network Business Division. In the past, in the same environment, there have been abnormal cases of an unintended sudden increase in access by an employee on a business trip in 2023 / 8 and a sudden increase in access due to a change in terminal settings in 2023 / 10. The technical causes of this event include "1. If the SSH server does not support the authentication method selected by the client, the relevant parameter may become 0" and "2. If the connection is disconnected before the authentication method is selected, the relevant parameter may become 0."

[0048] In order to display the contents of the analysis support information (alert for abnormality detection) on the display unit 13, the output information generation unit 15 generates output information converted into a format that can be output to the display unit 13, and outputs the generated output information to the display unit 13.

[0049] The display unit 13 acquires output information and outputs a generated image or the like based on the output information. The display unit 13 is, for example, an image display device using a liquid crystal, an organic EL (Electro Luminescence), or a CRT (Cathode Ray Tube). The display unit 13 may be provided outside the information processing device 10. Furthermore, the display unit 13 may include an audio output device such as a speaker. The display unit 13 may also be a printing device such as a printer.

[0050] [Device operation] Next, the operation of the information processing device in the embodiment will be described with reference to FIG. 10. FIG. 10 is a diagram for explaining an example of the operation of the information processing device. In the following description, the diagram will be referenced as appropriate. Furthermore, in the embodiment, an information processing method is implemented by operating the information processing device. Therefore, the description of the information processing method in the embodiment will be replaced with the description of the operation of the information processing device below.

[0051] 10, first, the acquiring unit 11 receives detection information indicating an abnormal event detected by the monitoring device 50 (step A1). Next, when the acquiring unit 11 receives the detection information, it performs a search using search conditions set in advance for each monitoring device 50 (anomaly detection model), and acquires, from the storage device 20, environment information 21 indicating the communication environment of the monitoring device 50 that detected the abnormality, and history information 22 indicating the history of abnormalities detected in the past by the monitoring device 50 (step A2).

[0052] Next, when the query unit 12 receives detection information indicating an abnormal event detected by the monitoring device 50, the query unit 12 generates query information (prompt) for inquiring about the cause of the event included in the detection information to be input to the language model 31 based on the detected abnormal event (step A3). Next, the query unit 12 transmits the generated query information to the language model 31 (step A4). Next, the query unit 12 obtains response information to the query information output by the language model 31 (step A5).

[0053] The process of step A2 may be executed after the processes of steps A3 to A5, or may be executed in parallel.

[0054] Next, the generation unit 14 uses the detection information, the environment information 21, the history information 22, and the response information to generate analysis support information for supporting anomaly analysis by a user who monitors and manages the in-house network (step A6). Alternatively, the generation unit 14 may generate the analysis support information using the detection information, the environment information 21, and the response information. Alternatively, the generation unit 14 may generate the analysis support information using the environment information 21, the history information 22, and the response information.

[0055] Specifically, in step A6, prompt generation unit 141 generates a prompt for analysis support information (an alert for abnormality detection) using the detection information, environment information 21, history information 22, and response information. Next, analysis support information generation unit 142 transmits the generated prompt to language model 31, and obtains, from language model 31, the analysis support information (an alert for abnormality detection) generated in response to the prompt.

[0056] Next, the output information generation unit 15 generates output information converted into a format that can be output to the display unit 13 in order to display the contents of the analysis support information (alert for abnormality detection) on the display unit 13, and outputs the generated output information to the display unit 13 (step A7).

[0057] Next, the display unit 13 acquires the output information and displays the generated analysis support information (alert of abnormality detection) and the like based on the output information (step A8).

[0058] Example 1 Fig. 11 is a diagram for explaining embodiment 1. In the example of Fig. 11, first, in step B1, (1) "Model A detecting an abnormality in the number of SSH authentication attempts is 2023 / 12 / 10 12:00" is acquired as detection information.

[0059] Next, in step B2, the environmental information of Model A is searched for using the search criteria of Model A. Next, in step B3, (2) "The relevant environment is the Taipei segment, which is the offshore location of the Financial Business Division" is acquired as the environmental information of Model A.

[0060] Next, in step B4, the historical information of model A is searched using the search conditions of model A. Next, in step B5, (3) "1. 2023 / 8 / 10 An abnormality was detected due to a power outage in the SSH server used by XX project / 2. 2023 / 10 / 30 An abnormality was detected due to a configuration error in the SSH server used by △△" is acquired as the historical information of model A.

[0061] Next, in step B6, the query information is generated as "Please tell me the reason why the SSH authentication attempt count parameter, which is an event monitored by model A, suddenly becomes "0". Next, in step B7, the answer information (4) "1. If the SSH server does not support the authentication method selected by the client, the parameter may become 0. / 2. If the connection is terminated before the authentication method is selected, the parameter may become 0" is obtained.

[0062] Next, in step B8, a prompt for generating analysis support information (an anomaly detection alert) is generated: "In the environmental information (2), there is a possibility of (4) as an event, and there has been an anomaly detection case of (3) in the past." The prompt is then input to a language model, and analysis support information (anomaly detection alert) for the prompt is obtained from the language model.

[0063] Next, in step B9, analysis support information (anomaly detection alert) is displayed on the display unit 13: "An anomaly in the number of SSH authentication attempts was detected at 12:00 on December 10, 2023 in the Taipei segment, which is the offshore location of the Financial Business Division. This anomaly may occur when each server setting is set to ..., and in the past, in this environment, an anomaly of type XX occurred in August 2023, and an anomaly of type △△ occurred in October."

[0064] Example 2 Fig. 12 is a diagram for explaining embodiment 2. In the example of Fig. 12, first, in step C1, (1) "'Model B', which detects an anomaly of Kerberos authentication denial false, detected an anomaly at 4:00 on 2023 / 12 / 20" is acquired as detection information.

[0065] Next, in step C2, the environmental information of model B is searched for using the search conditions of model B. Next, in step C3, (2) "The corresponding environment is a Wi-Fi segment for overseas business travelers from the American branch" is acquired as the environmental information of model B.

[0066] Next, in step C4, the history information of model B is searched using the search conditions of model B. Next, in step C5, (3) "1. 2023 / 11 / 5 A large number of unintended authentication attempts occurred due to a setting change on the terminal side / 2. 2024 / 1 / 10 A large number of authentication requests occurred after the long holiday, and the number of false attempts also increased" is acquired as the history information of model B.

[0067] Next, in step C6, the query information is generated as "Question about the cause of the sudden increase in the number of false Kerberos authentication denials, which is an event monitored by model B." Next, in step C7, the answer information (4) is obtained as "1. If the host name on the terminal side is changed and the host name change is not synchronized on the AD side, there is a possibility that authentication attempts will be repeated. / 2. If the Kerberos authentication certificate is not updated after it has expired and authentication is performed, it may become false, resulting in a large number of unintended connection attempts."

[0068] Next, in step C8, a prompt for generating analysis support information (an anomaly detection alert) is generated: "In the environmental information (2), there is a possibility of (4) as an event, and there has been an anomaly detection case of (3) in the past." The prompt is then input into a language model, and the analysis support information (anomaly detection alert) for the prompt is obtained from the language model.

[0069] Next, in step C9, analysis support information (anomaly detection alert) is displayed on the display unit 13, saying, "An anomaly of a large number of false Kerberos packets was detected at 4:00 on December 20, 2023 in the Wi-Fi segment for overseas business travelers from the American branch. This anomaly may also occur due to an unintentional setting change made by the user, and in the past, an anomaly of type XX occurred in August 2023 and an anomaly of type △△ occurred in October in this environment."

[0070] (Variation) Fig. 13 is a diagram for explaining an example of a modified example. As a modified example, an anomaly avoidance control unit 16 may be added to the information processing device 10 of Fig. 13. The anomaly avoidance control unit 16 generates control instruction information for avoiding an anomaly based on the analysis support information, and controls devices that are provided on the network 60 and are subject to anomaly detection.

[0071] Control of devices that are subject to anomaly detection (anomaly avoidance control) may involve, for example, blocking them with a firewall, isolating endpoints, etc. Furthermore, anomaly avoidance control may involve storing anomaly detection information in a database, creating a whitelist, and using these to compare with the anomaly detection information.

[0072] [Effects of the embodiment] Traditionally, time-series anomaly detection data is used to detect anomalies in various protocols, and users (such as monitoring analysts) conduct peripheral investigations, interviews, and incident response. In other words, after an anomaly is detected, humans perform specialized analysis of time-series data peaks. For example, during anomaly analysis, an increase in the number of Kerberos user authentications is detected → the environment and terminal devices are identified from the IP addresses → differences from the normal state are identified or supplemented by interviews, etc.

[0073] Therefore, if only the detection output of time-series anomaly detection data is used, it takes a significant amount of time to investigate and collect information such as environmental information, technical information, and past cases to identify the event from the detection information.

[0074] Furthermore, the information output from time-series anomaly detection data alone is often limited to the date and time of the occurrence and the protocol or error being targeted for anomaly detection, resulting in a lack of explanatory power.

[0075] However, according to the embodiment, by automatically generating a verbalized anomaly detection alert and presenting it to the user, the time required for analyzing an anomaly in a network can be reduced. In other words, by automatically integrating already standardized technical information, past cases, and knowledge information accumulated within the company to generate an anomaly detection alert, the time required for analysis by the user after an anomaly is detected can be reduced. In addition, new insights can be provided to the user.

[0076] In addition, anomaly detection alerts are rich information that adds environmental information, history information, and response information (events that can be considered from standard technical information such as RFCs) to the detection information, thereby increasing the descriptive power.

[0077] [program] The program in the embodiment and modified examples may be any program that causes a computer to execute steps A1 to A8 shown in Fig. 10. By installing and executing this program on a computer, the information processing device and information processing method in the embodiment and modified examples can be realized. In this case, the processor of the computer functions as an acquisition unit 11, an inquiry unit 12, a generation unit 14 (prompt generation unit 141, analysis support information generation unit 142), an output information generation unit 15, and anomaly avoidance control unit 16, and performs processing.

[0078] The programs in the embodiments and modifications may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as one of the acquisition unit 11, the inquiry unit 12, the generation unit 14 (prompt generation unit 141, analysis support information generation unit 142), the output information generation unit 15, and the anomaly avoidance control unit 16.

[0079] [Physical configuration] Here, a computer that realizes an information processing device by executing a program in the embodiment and modified examples will be described with reference to Fig. 14. Fig. 14 is a diagram for explaining an example of a computer that realizes an information processing device in the embodiment and modified examples.

[0080] 14, the computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other. Note that the computer 110 may include a GPU or an FPGA in addition to or instead of the CPU 111.

[0081] The CPU 111 loads a program in the embodiment, which is composed of a group of codes and stored in the storage device 113, into the main memory 112 and executes each code in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

[0082] The program in the embodiment is provided in a state stored in a computer-readable recording medium 120. The program in the embodiment may be distributed over the Internet connected via the communication interface 117.

[0083] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0084] The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, reads programs from the recording medium 120, and writes processing results from the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and other computers.

[0085] Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as flexible disks, or optical recording media such as CD-ROMs (Compact Disk Read Only Memory).

[0086] Note that the information processing device 10 in the embodiment can be realized not by a computer on which a program is installed, but by hardware corresponding to each unit, for example, an electronic circuit. Furthermore, the information processing device 10 may be partially realized by a program and the remaining unit by hardware. In the embodiment, the computer is not limited to the computer shown in FIG. 13.

[0087] [Note] The following supplementary notes are further provided regarding the above-described embodiments and modifications. Some or all of the above-described embodiments and modifications can be expressed by (Supplementary Note 1) to (Supplementary Note 15) described below, but are not limited to the following descriptions.

[0088] (Appendix 1) an acquisition unit that acquires, for detection information indicating an abnormal event detected by a monitoring device that monitors communications on a network, environment information indicating an environment of the communications monitored by the monitoring device; an inquiry unit that transmits inquiry information inquiring about a cause of an event included in the detection information to a language model, and acquires response information to the inquiry information from the language model; a display unit that displays the detection information, the environmental information, and the response information; An information processing device having the above.

[0089] (Appendix 2) the acquisition unit further acquires history information indicating a history of abnormalities detected by the monitoring device from the detection information; the display unit displays information including the history information. 10. The information processing device according to claim 1.

[0090] (Appendix 3) a prompt generation unit that generates a prompt for generating analysis support information for supporting an analysis of an abnormality, using the detection information, the environmental information, the history information, and the response information; an analysis support information generation unit that transmits the prompt to the language model and acquires the analysis support information for the prompt from the language model; 3. The information processing device according to claim 2.

[0091] (Appendix 4) further comprising an anomaly avoidance control unit that generates control instruction information for avoiding the anomaly based on the analysis support information and controls a device that is a target of anomaly detection and is provided on the network. 4. The information processing device according to claim 3.

[0092] (Appendix 5) The monitoring devices are provided at a plurality of locations on the network, and each of the monitoring devices executes a preset anomaly detection. 5. An information processing device according to any one of appendices 1 to 4.

[0093] (Appendix 6) The information processing device acquiring environmental information indicating an environment of the communication monitored by a monitoring device for detection information indicating an abnormal event detected by the monitoring device; transmitting query information to a language model inquiring about a cause of the event included in the detection information; obtaining response information to the inquiry information from the language model; displaying the detection information, the environmental information, and the response information on a display unit; Information processing methods.

[0094] (Appendix 7) The information processing device, Furthermore, history information indicating a history of abnormalities detected by the monitoring device is acquired for the detection information; displaying information including the history information on a display unit; 1. The information processing method described in Appendix 6.

[0095] (Appendix 8) The information processing device, generating a prompt for generating analysis support information for supporting an analysis of an abnormality using the detection information, the environmental information, the history information, and the response information; sending the prompt to the language model and obtaining the analysis support information for the prompt from the language model; 7. The information processing method described in Appendix 7.

[0096] (Appendix 9) The information processing device, Furthermore, based on the analysis support information, control instruction information for avoiding the abnormality is generated, and a device that is a target of abnormality detection and is provided on the network is controlled. 10. The information processing method according to claim 8.

[0097] (Appendix 10) The information processing device, The monitoring devices are provided at a plurality of locations on the network, and each of the monitoring devices executes a preset anomaly detection. 10. An information processing method according to any one of appendices 6 to 9.

[0098] (Appendix 11) On the computer, acquiring environmental information indicating an environment of the communication monitored by a monitoring device for detection information indicating an abnormal event detected by the monitoring device; transmitting query information to a language model inquiring about a cause of the event included in the detection information; obtaining response information to the inquiry information from the language model; displaying the detection information, the environmental information, and the response information on a display unit; A program that executes a process.

[0099] (Appendix 12) The computer, Furthermore, history information indicating a history of abnormalities detected by the monitoring device is acquired for the detection information; displaying information including the history information on a display unit; 12. The program according to claim 11, which causes the processing to be executed.

[0100] (Appendix 13) The computer, generating a prompt for generating analysis support information for supporting an analysis of an abnormality using the detection information, the environmental information, the history information, and the response information; sending the prompt to the language model and obtaining the analysis support information for the prompt from the language model; 13. The program according to claim 12, which causes the processing to be executed.

[0101] (Appendix 14) The computer, Furthermore, based on the analysis support information, control instruction information for avoiding the abnormality is generated, and a device that is a target of abnormality detection and is provided on the network is controlled. 14. The program according to claim 13, which executes processing.

[0102] (Appendix 15) The computer, The monitoring devices are provided at a plurality of locations on the network, and each of the monitoring devices executes a preset anomaly detection. 15. A program according to any one of appendices 11 to 14, which causes processing to be executed.

[0103] Although the invention has been described above with reference to the embodiments and modifications, the invention is not limited to the above-described embodiments and modifications. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the invention within the scope of the invention. [Industrial Applicability]

[0104] According to the above description, it is possible to help reduce the time required for analyzing an abnormality in a network, and the present invention is useful in fields where an abnormality analysis in a network is required. [Explanation of symbols]

[0105] 10. Information processing equipment 11 Acquisition Department 12 Inquiry Department 13 Display section 14 Generation part 141 Prompt Generation Unit 142 Analysis support information generation section 15 Output information generation unit 16 Abnormality avoidance control unit 20 Storage device 21 Environmental information 22 Historical Information 30 Information processing equipment 31 Language Models 40 locations 40a Intranut 40b Data Center 40c, 40d, 40e Remote Location 50, 50a, 50b, 50c, 50d, 50e monitoring equipment 51 Anomaly Detection Model 100 systems 110 Computer 111 CPU 112 main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display Device 120 Recording Media 121 Bus

Claims

1. an acquisition means for acquiring environmental information indicating an environment of communication monitored by a monitoring device in response to detection information indicating an abnormal event detected by the monitoring device; an inquiry means for transmitting inquiry information inquiring about a cause of an event included in the detection information to a language model, and for acquiring response information to the inquiry information from the language model; a display means for displaying the detection information, the environmental information, and the response information; An information processing device having the above.

2. The acquisition means further acquires history information indicating a history of abnormalities detected by the monitoring device from the detection information, the display means displays information including the history information. The information processing device according to claim 1 .

3. a prompt generating means for generating a prompt for generating analysis support information for supporting an analysis of an abnormality, using the detection information, the environmental information, the history information, and the response information; an analysis support information generating means for transmitting the prompt to the language model and acquiring the analysis support information for the prompt from the language model; The information processing device according to claim 2 .

4. Further, an anomaly avoidance control means is provided for generating control instruction information for avoiding the anomaly based on the analysis support information and controlling a device that is a target of anomaly detection and is provided on the network. The information processing device according to claim 3 .

5. The monitoring devices are provided at a plurality of locations on the network, and each of the monitoring devices executes a preset anomaly detection. The information processing device according to claim 1 .

6. The information processing device acquiring environmental information indicating an environment of the communication monitored by a monitoring device for detection information indicating an abnormal event detected by the monitoring device; transmitting query information to a language model inquiring about a cause of the event included in the detection information; obtaining response information to the inquiry information from the language model; displaying the detection information, the environmental information, and the response information on a display unit; Information processing methods.

7. The information processing device, Furthermore, history information indicating a history of abnormalities detected by the monitoring device is acquired for the detection information; displaying information including the history information on a display unit; The information processing method according to claim 6.

8. On the computer, acquiring environmental information indicating an environment of the communication monitored by a monitoring device for detection information indicating an abnormal event detected by the monitoring device; transmitting query information to a language model inquiring about a cause of the event included in the detection information; obtaining response information to the inquiry information from the language model; displaying the detection information, the environmental information, and the response information on a display unit; A program that executes a process.

9. The computer, Furthermore, history information indicating a history of abnormalities detected by the monitoring device is acquired for the detection information; displaying information including the history information on a display unit; The program according to claim 8, which causes processing to be executed.

Images