Information processing device, information processing method, and program

Abstract

We provide technology to appropriately deliver security news tailored to each business operator. [Solution] The system includes a news page generation unit that collects security-related news from websites, calculates the degree of relevance between each collected news item and the business-related information based on the business-related information of the business, and generates a news page that displays the news item viewable by the business's employees. The news page generation unit generates the news page based on the degree of relevance corresponding to each news item.

Description

Technical Field

[0001] The present disclosure relates to an information processing apparatus, an information processing method, and a program.

Background Art

[0002] Conventionally, there is a technique for collecting security news by searching from a news site that issues security-related events (security news) using a specified date or period and keywords (for example, Patent Document 1).

[0003] In addition, there is a technique that can ensure the transparency of the sender's position and distribute accurate and fair news (for example, Patent Document 2).

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0005] By using these techniques, it is possible to distribute accurate and fair security news.

[0006] However, among the security news to be distributed, there are security news that match each operator as well as security news that do not match. Therefore, there is a problem that it is difficult to view the security news that should be viewed by employees belonging to that operator.

[0007] An object of the present disclosure is to provide a technique for appropriately distributing security news that matches each operator.

Means for Solving the Problems

[0008] To solve the above problems, the information processing device disclosed herein comprises: a news information collection unit that collects security-related news from websites; a business-related information storage unit that stores business-related information relating to a business operator; a relevance calculation unit that calculates the degree of relevance between each of the collected news items and the business-related information based on the business-related information; and a news page generation unit that generates a news page that displays the news items viewable by the employees of the business operator. The news page generation unit generates the news page based on the degree of relevance corresponding to each of the news items.

[0009] Furthermore, the information processing method disclosed herein is an information processing method executed by a computer, comprising: a news information collection step of collecting security-related news from a website; a relevance calculation step of calculating the degree of relevance between each of the collected news items and the business-related information based on business-related information relating to a business stored in a business-related information storage unit; and a news page generation step of generating a news page that displays the news items viewable by the employees of the business, wherein the news page generation step generates the news page based on the degree of relevance corresponding to each of the news items.

[0010] Furthermore, the information processing program disclosed herein is an information processing program to be executed by a computer, comprising: a news information collection procedure for collecting security-related news from a website; a relevance calculation procedure for calculating the degree of relevance between each of the collected news items and the business-related information based on business-related information relating to a business stored in a business-related information storage unit; and a news page generation procedure for generating a news page that displays the news items viewable by the employees of the business, wherein the news page generation procedure generates the news page based on the degree of relevance corresponding to each of the news items. [Effects of the Invention]

[0011] According to the present disclosure, it is possible to provide a technology for appropriately distributing security news that matches each operator.

Brief Description of the Drawings

[0012] [Figure 1] It is a diagram showing an example of an information processing system in an embodiment of the present disclosure. [Figure 2] It is a diagram showing an example of a relevance calculation unit. [Figure 3] It is a diagram showing an example of the configuration of various databases. [Figure 4] It is a diagram showing an example of an image of an operator classification database. [Figure 5] It is a diagram showing an example of an image of an operator-related information database. [[ID=二十一]] [Figure 6] It is a diagram showing an example of an image of a news information database. [Figure 7] It is a diagram showing an example of an image of a trend level database. [Figure 8] It is a diagram showing an example of an image of a threat word database. [Figure 9] It is a diagram showing an example of an image of a tag database. [[ID=三十五]] [Figure 10] [[ID=三十五]]It is a diagram showing an example of an image of a browsing status database. [Figure 11] It is a diagram showing an example of an image of a focus tag database. [Figure 12] It is a diagram showing an example of an image of an attribute score database. [Figure 13] It is a diagram showing an example of an image of an interest score database. [Figure 14] It is a flowchart showing an example of preprocessing by a site generation unit. [Figure 15] It is a flowchart showing an example of news collection processing in preprocessing. [Figure 16] It is a flowchart showing an example of attribute score calculation processing in preprocessing. [Figure 17]It is a flowchart showing an example of threat score calculation processing in preprocessing. [Figure 18] It is a flowchart showing an example of trend score calculation processing in preprocessing. [Figure 19] It is a flowchart showing an example of interest score calculation processing in preprocessing. [Figure 20] It is a flowchart showing an example of trend level assignment processing in preprocessing. [Figure 21] It is a flowchart showing an example of attention tag assignment processing in preprocessing. [Figure 22] It is a flowchart showing an example of security information site generation processing. [Figure 23] It is a flowchart showing an example of news customization processing in security information site generation processing. [Figure 24] It is a flowchart showing an example of news summary generation processing in security information site generation processing. [Figure 25] It is a diagram showing an example of the image of the homepage in the security information site. [Figure 26] (a) is a diagram showing an example of the image of the homepage displayed when a tag is selected on the home screen, and (b) is a diagram showing an example of the image of the latest news page. [Figure 27] (a) is a diagram showing an example of the image of the news customization page, and (b) is a diagram showing an example of the image of the customized news page. [Figure 28] It is a diagram showing an example of the image of the news summary page in the security information site.

Embodiments for Carrying Out the Invention

[0013] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. However, overly detailed descriptions, for example, detailed descriptions of well-known matters or duplicate descriptions of substantially the same configurations may be omitted.

[0014] The drawings described and referenced below are provided to enable those skilled in the art to understand this disclosure and are not intended to limit the scope of the claims of this disclosure.

[0015] [Information Processing Systems] First, an example of an information processing system according to the embodiment of this disclosure will be described using Figures 1 and 2.

[0016] As shown in Figure 1, the information processing system 10 according to the embodiment of this disclosure consists of, for example, a server 100 that delivers security news tailored to each business operator, which is a customer, employee terminals 401... used by employees (users) of business operator A 400, employee terminals 501... used by employees (users) of business operator B 500, employee terminals 601... used by employees (users) of business operator C 600, and so on. There are no restrictions on the number of business operators or the number of employee terminals in each business operator. Business operators include corporations such as stock companies, the national government, prefectures and municipalities, public interest corporations such as public corporations and medical corporations, and associations and foundations, and employees are those who work for these corporations, etc.

[0017] Server 100 and employee terminals A 401, B 501, C 601, etc., can communicate with each other via communication network N. Communication network N consists of, for example, the internet, a LAN (Local Area Network), wireless base stations, provider equipment, etc. Since communication networks are well-known technologies, a detailed explanation is omitted.

[0018] Server 100 is an information processing device configured with a CPU, storage, ROM, RAM, input / output interface, communication unit, display unit, etc., such as a personal computer or server computer. Employee terminals A 401..., B 501..., C 601..., etc., are information processing devices configured with a CPU, storage, ROM, RAM, input / output interface, communication unit, display unit, etc., such as a personal computer, smartphone, or tablet device, and have web browsers and various applications installed. Detailed explanations of information processing devices are omitted as they are well-known technologies.

[0019] [Server 100 Configuration] Server 100 is, for example, a web server or application server, and provides web pages and the like that are displayed by a browser in response to requests from each employee terminal of each business operator. The web pages provided by Server 100 are mainly security-related information.

[0020] Server 100 includes a site generation unit 200 that generates the content of a security information site to be sent to each user. The site generation unit 200 functions as a news collection unit (news information collection unit) 201, a security information site provision unit 202, a news page generation unit 203, a relevance calculation unit 204, a trend level assignment unit 205, a attention tag level assignment unit 206, a vulnerability / countermeasure information collection unit 207, an industry-specific trend collection unit 208, a recommended countermeasure generation unit 209, and a summary generation unit 210. These functions are performed by the execution of corresponding programs (site generation programs (programs related to news collection, security information site provision, news page generation, relevance calculation, trend level assignment, attention tag assignment, vulnerability / countermeasure information collection, industry-specific trend collection, recommended countermeasure generation, and summary generation)) by a processor such as a CPU. In addition, the storage unit of Server 100 functions as various databases (various DBs) 300 in which various types of information are stored.

[0021] The news collection unit 201 periodically accesses news sites (Uniform Resource Locator) via URLs (for example, at midnight every day) that distribute security news, and collects security news articles from each publicly available security news site. It also refers to the tag database (tag DB, tag storage unit) 3006 (see Figure 9), described later, and assigns tags to each collected security news article. The collected security news articles are associated with their tags and stored in the folder corresponding to the collection date in the news information database (news information DB) 3003 (see Figure 6), described later. For example, if today's collection date is April 1, 2024, the folder corresponding to today's collection date is named "240401," and each security news article collected today is tagged and stored in that folder. Here, for example, if today's collection date is April 1, 2024, the folder corresponding to today, whose collection date folder name is "240401," will be referred to as the "today's folder" below. Details regarding the news collection process by news collection unit 201 will be described later.

[0022] The security information site provision unit 202 generates a security information site tailored to each user in response to access from each user's employee terminal, and transmits the generated security information site.

[0023] The news page generation unit 203 generates security news pages to be displayed on the security information site.

[0024] The relevance calculation unit 204 performs the processing to calculate various scores. As shown in Figure 2, the relevance calculation unit 204 consists of an attribute score calculation unit 2041, a threat score calculation unit 2042, a trend score calculation unit 2043, and an interest score calculation unit 2044.

[0025] The attribute score calculation unit 2041 calculates an attribute score (As) (the level of likelihood of matching a business) for each news article collected today, based on the attribute information of each business. When calculating the attribute score (As), it first refers to the industry classification (major classification, medium classification, minor classification) of each business stored in the business-related information database (business-related information DB) 3002 (see Figure 5), which will be described later, and calculates the major classification matching rate (major classification matching rate (Cf)), the medium classification matching rate (medium classification matching rate (SCf)), and the minor classification matching rate (minor classification matching rate (SSCf)) for each business. Next, based on the calculated major classification matching rate (Cf), medium classification matching rate (SCf), and minor classification matching rate (SSCf) for each business, it calculates the attribute score (As) for each business for each security news article. Then, it stores the calculated attribute score As for each business in the attribute score database (attribute score DB) 3009 (see Figure 12), which will be described later. Details of the attribute score calculation process performed by the attribute score calculation unit 2041 will be described later.

[0026] The Threat Score Calculation Unit (Threat Information Detection Unit) 2042 detects threat information related to each business operator and calculates a threat score (Ks) (level of potential threat) for each news article collected today based on the detected threat information related to each business operator. The Threat Score Calculation Unit 2042 extracts threat words contained in the content of each security news article stored in the folder today. It also searches for threat words related to information leakage, threat words related to vulnerabilities, and threat words related to IT assets that could pose a security threat to each business operator. If a threat word is detected, it is stored in the Threat Word Database (Threat Word DB) 3005 (see Figure 8), which will be described later. Then, the threat score (Ks) for each business operator is calculated based on each security news article and the threat words of each business operator. The calculated threat score Ks for each security news article is also stored in the Attribute Score DB 3009 (see Figure 12), which will be described later. Details of the threat score calculation process by the Threat Score Calculation Unit 2042 will be described later.

[0027] The trend score calculation unit (term level assignment unit, score assignment unit) 2043 refers to the trend level of each trend word (term) assigned based on the trend words (terms) selected from all news articles over a predetermined period (for example, the past week), and calculates a trend score (level of likelihood of becoming a trend) for each news article collected today. The trend score calculation unit 2043 refers to the trend levels stored in the trend level database (trend level DB) 3004 (see Figure 7), which will be described later, and calculates a trend score (main trend score (MTs), sub-trend score (STs)) for each security news article stored in the folder today. The calculated main trend score (MTs) and sub-trend score (STs) for each security news article are then stored in the news information database (news information DB) 3003 (see Figure 6), which will be described later. Details of the trend score calculation process by the trend score calculation unit 2043 will be described later.

[0028] The interest score calculation unit 2044 refers to the attention tag level assigned to each user based on their browsing information over a predetermined period (for example, the past week) and calculates an interest score (the level of likelihood that the user will be interested) for each news article collected today. The interest score calculation unit 2044 refers to the attention tag levels stored in the attention tag database (attention tag DB) 3008 (see Figure 11), which will be described later, and calculates an interest score (main interest score (MIs) and sub-interest score (SIs)) for each security news article collected by the news collection unit 201. The calculated main interest score (MIs) and sub-interest score (SIs) for each security news article are then stored in the interest score database (attention score DB) 3010 (see Figure 13), which will be described later. Details of the interest score calculation process by the interest score calculation unit 2044 will be described later.

[0029] The trend level assignment unit 205 constructs the trend level DB 3004 (see Figure 7), which will be referenced when the trend score calculation unit 2043 calculates the trend score. The trend level assignment unit 205 extracts words contained in the content of each security news article collected during a predetermined period (for example, the last week) stored in the news information DB 3003, and stores the extracted words as trend words in the news information DB 3003 (see Figure 6). It also aggregates the number of occurrences of each word during the predetermined period, assigns a trend level based on the number of occurrences of each word based on the aggregation result, and stores it in the trend level database (trend level DB) 3004 (see Figure 7), which will be described later. Details of the trend level assignment process by the trend level assignment unit 205 will be described later.

[0030] The attention tag level assignment unit 206 constructs the attention tag DB 3008 (see Figure 11), which will be referenced when the interest score is calculated by the interest score calculation unit 2044 described above. The attention tag level assignment unit 206 references the viewing information of each news article for each user during a predetermined period (for example, the last week) stored in the viewing status database (viewing status DB) 3007 (see Figure 10), which will be described later. It also extracts the tags assigned to each news article during a predetermined period (for example, the last week) stored in the news information DB 3003, which will be described later. Then, it assigns an attention tag level (attention tag level: 0 to 5) for each user based on the number of times each tag appears. Furthermore, the attention tag level database (attention tag level DB) 3008 (see Figure 11), which will be described later, stores the tag number for each tag corresponding to attention tag levels 1 to 5 for each user. Details of the attention tag level assignment process by the attention tag level assignment unit 206 will be described later.

[0031] The Vulnerability and Countermeasure Information Collection Unit 207 collects information from websites regarding how to resolve security vulnerabilities, product vulnerabilities, etc., or information regarding countermeasures, and stores it in the Vulnerability and Countermeasure Information Database (Vulnerability and Countermeasure Information DB) 3011, which will be described later.

[0032] The Industry Trends Collection Unit 208 collects information on security response trends in each industry from websites and stores it in the Industry Trends Database (Industry Trends DB) 3012, described later, separately for each industry.

[0033] The recommended countermeasure generation unit 209 performs a recommended countermeasure generation process that generates recommended countermeasure statements for each security news article stored in the folder today, by referring to the vulnerability / countermeasure information DB 3011 and the industry-specific trend DB 3012. A generation AI (not shown) is used to generate the recommended countermeasure statements. The recommended countermeasure generation unit 209 generates a prompt for the generation AI. The content of the prompt generated here is, for example, "Please provide a response if you have any recommended countermeasures for the news article with news ID 2404010001 in the 240401 folder. When responding, please refer to the information stored in the vulnerability / countermeasure information DB and the industry-specific trend DB." The response from the generation AI is then stored as recommended countermeasure information, associated with each news article in the news information DB 3003.

[0034] The summary generation unit 210 receives a time period and / or tag specification from the user on the security information site, and generates and displays a summary of the news articles based on the specified period and / or tag. A generation AI (not shown) is used to generate the summary. The summary generation unit 210 generates prompts for the generation AI. For example, if the user specifies (selects) "1 week" as the time period and "cybersecurity" as the tag, the generated prompt may say, "Please summarize the news articles on cybersecurity from the past week. When answering, please refer to the news information database," or "(After entering news articles (or the URLs of the news articles) for the past three days, including today, that are tagged with "cybersecurity"), please refer to these news articles (or the URLs of the news articles) and summarize the news articles on cybersecurity."

[0035] [Configuration of various databases] Next, we will explain the various databases (various DBs) 300. Figure 3 is a diagram showing an example of the configuration of the various databases 300. The various DBs 300 consist of the following: business classification database (business classification DB) 3001, business-related information database (business-related information DB (business-related information storage unit)) 3002, news information database (news information DB) 3003, trend level database (trend level DB) 3004, threat word database (threat word DB) 3005, tag database (tag DB) 3006, browsing information database (browsing information DB) 3007, attention tag level database (attention tag DB) 3008, attribute score database (attribute score DB) 3009, interest score database (interest score DB) 3010, vulnerability and countermeasure information database (vulnerability and countermeasure information DB) 3011, industry-specific trend database (industry-specific trend DB) 3012, etc. Furthermore, each DB300 includes a user information database (user information DB) (not shown in the diagram) that stores each user's user ID, password, etc., which are referenced when performing user authentication when each user logs in to the security information site.

[0036] Figure 4 shows an example of the image of the Business Classification DB3001. The Business Classification DB3001 stores the classification of businesses. The Business Classification DB3001 consists of "Major Classification" columns, "Medium Classification" columns, and "Minor Classification" columns. The "Major Classification" column stores a list of industries. The "Medium Classification" column stores a list of industries that fall under the major classification. The "Minor Classification" column stores a list of industries that fall under the medium classification. When registering a new business, the system administrator will execute a business registration process (not shown) on the server 100, and a business classification registration screen based on the Business Classification DB3001 will be displayed. The system administrator will refer to this business classification registration screen and then register each business in the Business Related Information DB3002, which will be described later.

[0037] Figure 5 shows an example of the image of the Business Operator Information DB3002. The Business Operator Information DB3002 stores the business attribute information of each business operator. The Business Operator Information DB3002 consists of the following columns: "Business Operator ID", "Business Operator Name", "Business Operator Attributes", "Business Operator Domain", and "Issued User ID". The "Business Operator ID" column stores identification information that identifies the registered business operator, and the "Business Operator Name" column stores the name of the registered business operator. The "Business Operator Attributes" column consists of the "Major Category", "Medium Category", and "Minor Category" columns, each storing the classification related to the business operator's industry. For example, if business operator A is a sushi restaurant, it would be stored as Major Category: 9, Medium Category: 59, and Minor Category: 3. The "Business Operator Domain" column stores the domain of the business operator. The "Issued User ID" column stores the starting and ending numbers of the identification numbers (User IDs) of users (employees) issued to the business operator. Note that this information stored in the Business Operator Information DB3002 is based on the information registered in the business operator registration process described above.

[0038] Figure 6 shows an example of the image of the news information DB3003. News information is stored in the news information DB3003. The news information DB3003 consists of columns: "News ID", "Collection Date", "News", "Tags", "Trend Words", "Trend Score", and "Recommended Actions". The "News ID" column stores identification information that identifies the news article, and the "Collection Date" column stores the collection date of the news article. The "News" column consists of a "Source" column that stores the name of the news article's distributor, a "URL" column that stores the URL of the news article, and a "News Article" column that stores the news article in, for example, text format, and stores information about the news article collected by the news collection unit 201 described above. The "Tags" column consists of "Tag 1", "Tag 2", and "Tag 3", and stores the tag numbers of the tags assigned by the news collection unit 201 described above. The "Trend Words" column consists of "Word 1" column, "Word 2" column, and so on, and stores the words extracted by the trend level assignment unit 205 described above as trend words. The "Trend Score" column consists of "Main (MTs)" column and "Sub (STs)" column, and stores the main trend score (MTs) and sub-trend score (STs) calculated by the trend score calculation unit 2043 described above. The "Recommended Countermeasures" column stores information on recommended countermeasures generated by the recommended countermeasures generation unit 209 described above. The news information DB 3003 stores folders corresponding to each collection date from today to 60 days ago, and each folder stores the news information collected on that day.

[0039] Figure 7 shows an example of the Trend Level DB3004. The Trend Level DB3004 consists of a "Trend Level" column and a "Trend Word" column, and stores the trend words corresponding to the trend levels assigned by the Trend Level Assignment Unit 205 described above. Trend words corresponding to Trend Level 5 are ranked 1st to 3rd in terms of occurrence count, trend words corresponding to Trend Level 4 are ranked 4th to 6th, trend words corresponding to Trend Level 3 are ranked 7th to 9th, trend words corresponding to Trend Level 2 are ranked 10th to 12th, and trend words corresponding to Trend Level 1 are ranked 13th to 15th. Trend words ranked 16th or lower in terms of occurrence count correspond to Trend Level 0.

[0040] Figure 8 shows an example of the Threat Word DB3005. The Threat Word DB3005 consists of three columns: "Business ID", "Business Name", and "Threat Word". The "Business ID" column stores identification information that identifies the registered business, and the "Business Name" column stores the name of the registered business. The "Threat Word" column consists of three columns: "Information Leakage", "Vulnerability", and "IT Asset", and stores threat words related to information leakage, threat words related to vulnerabilities, and threat words related to IT assets that may pose a security threat to each business, as extracted by the Threat Score Calculation Unit 2042 described above.

[0041] Figure 9 shows an example of the image of the tag DB3006. The tag DB3006 consists of a "Tag No." column and a "Tag Name" column, and the tag name is stored in association with each tag No. Each tag stored in the tag DB3006 is referenced by the news collection unit 201 mentioned above as a tag assigned to each security news article. Each tag stored here is pre-configured by the system administrator, and the tag names are updated as needed, and the number of tags is increased or decreased as needed.

[0042] Figure 10 shows an example of the image of the browsing status DB 3007. The browsing status DB 3007 consists of a "Business ID" column, a "User ID" column, and a "Browsing Status" column. The "Business ID" column stores identification information that identifies the registered business, and the "User ID" column stores identification information that identifies the user of each business. The "Browsing Status" column consists of a "News ID" column (for example, 2403250001) that identifies each news article, and the "News ID" column consists of a "Viewed" column and a "Like" column. This browsing status DB 3007 stores the browsing information of each user for a predetermined period including today (for example, from today to one week ago). For example, if today is April 1, 2024, the browsing information of each user for news articles from March 25, 2023 to April 1, 2024 will be stored. The browsing status DB 3007 is the information referenced by the attention tag level assignment unit 206 described above.

[0043] Figure 11 shows an example of the image of the Attention Tag DB 3008. The Attention Tag DB 3008 consists of a "Business ID" column, a "User ID" column, and a "Attention Tag Level" column. The "Business ID" column stores identification information that identifies the registered business, and the "User ID" column stores identification information that identifies the user of each business. The "Attention Tag Level" column consists of "5 (Attention Tag Level: 5)", "4 (Attention Tag Level: 4)", "3 (Attention Tag Level: 3)", "2 (Attention Tag Level: 2)", and "1 (Attention Tag Level: 1)", and stores the tag number corresponding to each attention tag level assigned by the Attention Tag Level Assignment Unit 206 described above.

[0044] Figure 12 shows an example of the Attribute Score DB3009. The Attribute Score DB3009 consists of a "News ID" column and a "Company ID" column. The "News ID" column consists of "Individual News ID" columns that identify each news article (e.g., 2404010001). The "Individual Company ID" column (e.g., S0001 (Company A)) consists of an "Attribute" column and a "Threat Score (Ks)" column. The "Attribute" column consists of a "Major Category (Cf)" column, a "Medium Category (SCf)" column, a "Small Category (SSCf)" column, and an "Attribute Score (As)" column. The "Major Category (Cf)", "Medium Category (SCf)", and "Minor Category (SSCf)" columns store the major category match rate (Major Category Match Rate (Cf)), medium category match rate (Medium Category Match Rate (SCf)), and minor category match rate (Minor Category Match Rate (SSCf)) for each business operator, respectively, calculated by the attribute score calculation unit 2041 described above. The "Attribute Score (As)" column stores the attribute score (As) for each business operator for each security news article, calculated by the attribute score calculation unit 2041 described above. The "Threat Score (Ks)" column stores the threat score (Ks) for each business operator, calculated by the threat score calculation unit 2042 described above. The attribute score DB3009 also stores the major category match rate (Cf), medium category match rate (SCf), and minor category match rate (SSCf) for each business operator, associated with the news ID of news articles from today to 60 days ago.

[0045] Figure 13 shows an example of the Interest Score DB3010. The Interest Score DB3010 consists of a "Business ID" column, a "User ID" column, and a "Interest Score" column. The "Business ID" column stores identification information that identifies the registered business, and the "User ID" column stores identification information that identifies the user of each business. The "Interest Score" column consists of a "News ID" column (for example, 2404010001) that identifies each news article, and the "News ID" column consists of a "Main (MIs)" column and a "Sub (SIs)" column. The "Main (MIs)" column and the "Sub (SIs)" column store the main interest score (MIs) and sub interest score (SIs) of each security news article calculated by the Interest Score Calculation Unit 2044 described above, respectively. The Interest Score DB3010 stores the main interest score (MIs) and sub interest score (SIs) associated with the news ID of news articles from today to 60 days ago, respectively.

[0046] The vulnerability and countermeasure information DB3011 stores information collected by the vulnerability and countermeasure information collection unit 207 mentioned above, which is used to resolve security vulnerabilities, product vulnerabilities, etc., or information on countermeasures.

[0047] The Industry Trends DB3012 stores information on security response trends in each industry, collected by the Industry Trends Collection Unit 208.

[0048] [Pre-processing for generating security information sites] Next, the preprocessing performed by the site generation unit 200 to generate security information sites tailored to each user will be explained using Figures 14 to 21.

[0049] Figure 14 is a flowchart showing an example of preprocessing. The site generation unit 200 first determines whether or not it is time to collect news articles (step S1). In this embodiment, the time to collect news articles is 0:00 AM every day. The time to collect news articles can be set as appropriate by the system administrator (for example, 3:00 AM every day, 1:00 AM every other day, etc.). If it is determined that it is time to collect news articles (YES), the process proceeds to step S2. On the other hand, if it is determined that it is not time to collect news articles (NO), the process proceeds to step S10.

[0050] If it is determined that it is time to collect news articles (Step S1: YES), the site generation unit 200 executes the news collection process by the news collection unit 201 (Step S2).

[0051] [News gathering and processing] Figure 15 is a flowchart showing an example of the news collection process in preprocessing. The news collection unit 201 first creates a folder (today's folder) in the news information DB 3003 (see Figure 6) corresponding to the date of collection of security news (step S201).

[0052] Next, the news collection unit 201 extracts the URLs of security news sites in the order they were registered (step S202). Here, the news collection unit 201 refers to a news site URL registration table (not shown) which stores the URLs of multiple security news sites, and extracts the URL of each security news site in the order they were registered.

[0053] Next, the news collection unit 201 accesses the security news site by entering the extracted URL into a web browser (step S203).

[0054] Next, the news collection unit 201 performs web scraping of article information (news articles) related to security news from the security news page of a security news site (step S204). Here, web scraping is a technique that explores a website and automatically extracts only specific information (in this embodiment, news articles) from a large amount of information. Note that crawling may also be used in this process.

[0055] Next, the news collection unit 201 stores each news article collected by web scraping in the "Today" folder (step S205).

[0056] Next, the news collection unit 201 determines whether or not web scraping of all registered security news sites has been completed (step S206). If it determines that web scraping of all registered security news sites has been completed (YES), it proceeds to step S207. On the other hand, if it determines that web scraping of all registered security news sites has not been completed (NO), it returns to step S202.

[0057] If it is determined that web scraping of all registered security news sites has been completed (step S206: YES), the news collection unit 201 refers to the tag DB 3006 (step S207).

[0058] Next, the news collection unit 201 assigns tags to each news article stored in the folder today (step S208). Then, once the process in step S208 is completed, the news collection unit 201 terminates the news collection process.

[0059] In step S2, once the news collection process is complete, the site generation unit 200 executes the vulnerability and countermeasures DB update process by the vulnerability and countermeasures information collection unit 207 (step S3). In the vulnerability and countermeasures DB update process, information is collected by web scraping websites that provide information on resolving security vulnerabilities, product vulnerabilities, etc., or information on countermeasures. This collected information is then stored in the vulnerability and countermeasures information DB 3011.

[0060] Next, the site generation unit 200 executes the industry-specific trend DB update process by the industry-specific trend collection unit 208 (step S4). In the industry-specific trend DB update process, information on security response trends in each industry is collected by web scraping websites that provide information on security response trends in each industry. The collected information on security response trends in each industry is then stored in the industry-specific trend DB 3012, categorized by industry.

[0061] Next, the site generation unit 200 executes the attribute score calculation process performed by the attribute score calculation unit 2041 of the relevance calculation unit 204 (step S5).

[0062] [Attribute score calculation process] Figure 16 is a flowchart showing an example of the attribute score calculation process in preprocessing. The attribute score calculation unit 2041 first references each business attribute associated with the business ID stored in the business-related information DB 3002 (see Figure 5) in the order of registration (step S501).

[0063] Next, the attribute score calculation unit 2041 sequentially references the news articles stored in the Today folder of the News Information DB 3003 (see Figure 6) (step S502).

[0064] Next, the attribute score calculation unit 2041 calculates the major category matching rate (Cf) (step S503).

[0065] Next, the attribute score calculation unit 2041 calculates the subcategory matching rate (SCf) (step S504).

[0066] Next, the attribute score calculation unit 2041 calculates the subcategory matching rate (SSCf) (step S505).

[0067] Next, the attribute score calculation unit 2041 calculates the attribute score (As) (step S506).

[0068] Here, we will explain how the attribute score calculation unit 2041 calculates the major category matching rate (Cf), the medium category matching rate (SCf), the minor category matching rate (SSCf), and the attribute score (As), using the example of a business being a "sushi restaurant."

[0069] If the business is a "sushi restaurant," the business attributes fall under "Major Category: 9 (Wholesale, Retail, and Food Service)," "Medium Category: 59 (General Restaurants)," and "Minor Category: Sushi Restaurant."

[0070] For example, if news article 1 is titled "XX Sushi has introduced a new 'store support system' that...", the attribute score calculation unit 2041 uses classification AI to calculate the major category matching rate (Cf) = 0.8, the medium category matching rate (SCf) = 0.7, and the minor category matching rate (SSCf) = 0.95 (maximum value of each matching rate = 1).

[0071] Next, the attribute score (As) is calculated. For example, the formula for calculating the attribute score (As) is "As = α × Cf + β × SCf + γ × SSCf". In this formula, the value of α is 1, the value of β is 2, and the value of γ is 4, and their respective weights are predetermined.

[0072] Therefore, if the business is a "sushi restaurant," the attribute score (As) for news article 1 is calculated to be 6.00 (As = 1 × 0.8 + 2 × 0.7 + 4 × 0.95). Also, for example, if news article 2 is about "aiming to be the world's number one SOC...", the attribute score calculation unit 2041 calculates the major category match rate (Cf) as 0. Note that if the major category match rate (Cf) is calculated to be 0, the intermediate category match rate (SCf) and the minor category match rate (SSCf) are not calculated. Therefore, if the business is a "sushi restaurant," the attribute score (As) for news article 2 is calculated to be 0.00. Using the above calculation method, the attribute score calculation unit 2041 calculates the attribute score (As) for each business for each news article.

[0073] Next, the attribute score calculation unit 2041 stores the calculated major category matching rate (Cf), medium category matching rate (SCf), minor category matching rate (SSCf), and attribute score (As) in the attribute score DB 3009 (see Figure 12), associating them with each news ID for each business operator (step S507).

[0074] Next, the attribute score calculation unit 2041 determines whether or not the calculation of attribute scores (As) for all news articles has been completed (step S508). If it determines that the calculation of attribute scores (As) for all news articles has been completed (YES), it proceeds to step S509. On the other hand, if it determines that the calculation of attribute scores (As) for all news articles has not been completed (NO), it returns to step S502.

[0075] If it is determined that the calculation of attribute scores (As) for all news articles is complete (step S508: YES), the attribute score calculation unit 2041 determines whether the calculation of attribute scores for all businesses is complete (step S509). If it is determined that the calculation of attribute scores (As) for all businesses is complete (YES), the attribute score calculation process is terminated. On the other hand, if it is determined that the calculation of attribute scores (As) for all businesses is not complete (NO), the process returns to step S501.

[0076] When the attribute score calculation process is completed in step S5, the site generation unit 200 executes the threat score calculation process performed by the threat score calculation unit 2042 of the relevance calculation unit 204 (step S6).

[0077] [Threat score calculation process] Figure 17 is a flowchart showing an example of the threat score calculation process in pre-processing. The threat score calculation unit 2042 first refers to the business domains associated with the business IDs stored in the business-related information DB 3002 (see Figure 5) in the order they were registered (step S601).

[0078] Next, the threat score calculation unit 2042 checks whether any of the leaked email addresses on the web contain a business domain (step S602). Here, the threat score calculation unit 2042 accesses the dark web by connecting server 100 to a VPN (Virtual Private Network) using a browser such as Tor (The Onion Router), I2P (Invisible Internet Project), or Freenet. Then, it uses a dark web-compatible search engine such as DuckDuckGo or Ahmia to check whether any of the leaked email addresses on the dark web contain a business domain.

[0079] Next, the threat score calculation unit 2042 determines whether or not there are email addresses containing the business domain among the email addresses leaked on the web (step S603). If it determines that there are email addresses containing the business domain among the email addresses leaked on the web (YES), the process proceeds to step S604. On the other hand, if it determines that there are no email addresses containing the business domain among the email addresses leaked on the web (NO), the process proceeds to step S605.

[0080] If the system determines that there are email addresses containing a business domain among the email addresses leaked on the web (Step S603: YES), the threat score calculation unit 2042 stores the service name of the service from which the email address was leaked as a threat word in the threat word DB 3005, associating it with the business ID, in the "Information Leak" column (Step S604). Here, for example, if email addresses containing a business domain are found in service names (or service company names) such as AB Company, CD Company, and Q-SNS, the threat score calculation unit 2042 stores these service names as threat words (Information Leak).

[0081] Next, the threat score calculation unit 2042 checks if there is a software name for vulnerable software from the software version (Ver.) used on the business operator's homepage (HP) (step S605).

[0082] Next, the threat score calculation unit 2042 determines whether or not there is a software name for vulnerable software (step S606). If it determines that there is a software name for vulnerable software (YES), it proceeds to step S607. On the other hand, if it determines that there is no software name for vulnerable software (NO), it proceeds to step S608.

[0083] If the system determines that there is a software name for vulnerable software (step S606: YES), the threat score calculation unit 2042 stores the software name as a threat word in the "Vulnerability" column of the threat word DB 3005, associating it with the business ID (step S607). Here, if the threat score calculation unit 2042 identifies vulnerable software names such as ABC and PJP, it stores these software names as threat words (vulnerabilities).

[0084] Next, the threat score calculation unit 2042 collects the names of IT assets used on the business's internal network (step S608). Here, for example, the names of IT assets used by the business are collected by pre-installing a software agent for collecting IT asset names on the business's internal network (servers owned by the business, etc.). IT assets refer to hardware, software, peripherals, USBs, etc. used within the business.

[0085] Next, the threat score calculation unit 2042 stores the collected IT asset names as threat words in the threat word DB 3005, associating them with the business ID, in the "IT Asset" column (step S609). For example, if the IT asset name "Azr" is identified as an IT asset used within the business, this IT asset name is stored as a threat word (IT Asset).

[0086] Next, the threat score calculation unit 2042 sequentially references the news articles stored in the "Today" folder of the news information DB 3003 (see Figure 6) (step S610).

[0087] Next, the threat score calculation unit 2042 calculates a threat score (Ks) for each news article (step S611). Here, the method of calculating the threat score by the threat score calculation unit 2042 will be explained using the example where the threat words (information leakage) are AB Company, CD Company, and Q-SNS, the threat words (vulnerability) are ABC and PJP, and the threat word (IT asset) is Azr.

[0088] For example, if news article 1 contains the content "Company AB has a new product equipped with generation AI...", the threat score calculation unit 2042 determines that the news article contains the threat word (information leakage) Company and calculates the threat score (Ks) of the news article to be 1. Similarly, if news article 2 contains the content "Setting up a search engine together with the PJP server and with Company CD...", the threat score calculation unit 2042 determines that the news article contains the threat word (vulnerability) PJP and the threat word (information leakage) Company AB and calculates the threat score (Ks) of the news article to be 2. Note that if the same threat word is included multiple times within the same news article, the threat score calculation unit 2042 counts the occurrence of the threat word as 1.

[0089] Next, the threat score calculation unit 2042 stores the calculated threat score (Ks) in the attribute score DB 3009 (see Figure 12) in association with each news ID for each business operator (step S612).

[0090] Next, the threat score calculation unit 2042 determines whether or not the calculation of threat scores (Ks) for all news articles has been completed (step S613). If it determines that the calculation of threat scores (Ks) for all news articles has been completed (YES), it proceeds to step 614. On the other hand, if it determines that the calculation of threat scores (Ks) for all news articles has not been completed (NO), it returns to step 610.

[0091] If the system determines that the calculation of threat scores (Ks) for all news articles is complete (step S613: YES), the threat score calculation unit 2042 determines whether the calculation of threat scores for all businesses is complete (step S614). If it determines that the calculation of threat scores (Ks) for all businesses is complete (YES), the threat score calculation process ends. On the other hand, if it determines that the calculation of threat scores (Ks) for all businesses is not complete (NO), the process returns to step S601.

[0092] When the threat score calculation process is completed in step S6, the site generation unit 200 executes the trend score calculation process performed by the trend score calculation unit 2043 of the relevance calculation unit 204 (step S7).

[0093] [Trend score calculation process] Figure 18 is a flowchart showing an example of the trend score calculation process in preprocessing. First, the trend score calculation unit 2043 sequentially references the news articles stored in the Today folder of the news information DB 3003 (see Figure 6) (step S701).

[0094] Next, the trend score calculation unit 2043 refers to the trend word associated with each trend level stored in the trend level DB 3004 (see Figure 7) (step S702).

[0095] Next, the trend score calculation unit 2043 calculates the main trend score (MTs) for each news article (step S703). If a news article contains multiple trend words, the trend score calculation unit 2043 calculates the main trend score (MTs) for the trend word with the highest trend level among these trend words.

[0096] Next, the trend score calculation unit 2043 calculates the sub-trend score (STs) for each news article (step S704). If a news article contains multiple trend words, the trend score calculation unit 2043 calculates the sub-trend score (STs) by summing the trend levels assigned to each trend word.

[0097] Here, we will explain how the trend score calculation unit 2043 calculates the main trend score (MTs) and sub-trend score (STs).

[0098] For example, if news article 1 is titled "A deepfake video of XX has spread on social media, and... This deepfake is...", the trend score calculation unit 2043 will determine that this news article contains "Deepfake" which corresponds to trend level 5 and "Social Media" which corresponds to trend level 4, and will calculate the main trend score (MTs) = 5 (Deepfake) and the sub-trend score (STs) = 5 (Deepfake) + 4 (Social Media) = 9. Also, for example, if news article 2 is titled "Anonymous has impersonated △△, and... The government...", the trend score calculation unit 2043 will determine that this news article contains "Anonymous" which corresponds to trend level 4, "Impersonation" which corresponds to trend level 3, and "Government" which corresponds to trend level 2, and will calculate the main trend score (MTs) = 4 (Anonymous) + 3 (Impersonation) + 2 (Government) = 9. Note that if the same trend word appears multiple times within the same news article, the trend score calculation unit 2043 counts the occurrence of the trend word as one time.

[0099] Next, the trend score calculation unit 2043 stores the main trend score (MTs) and sub-trend score (STs) in association with each news article in the news information DB 3003 (step S705).

[0100] Next, the trend score calculation unit 2043 determines whether or not the calculation of trend scores for all news articles has been completed (step S506). If it determines that the calculation of trend scores for all news articles has been completed (YES), the trend score calculation process ends. On the other hand, if it determines that the calculation of trend scores for all news articles has not been completed (NO), the process returns to step 701.

[0101] When the trend score calculation process is completed in step S7, the site generation unit 200 executes the interest score calculation process performed by the interest score calculation unit 2044 of the relevance calculation unit 204 (step S8).

[0102] [Interest score calculation process] Figure 19 is a flowchart showing an example of the interest score calculation process in preprocessing. First, the interest score calculation unit 2044 sequentially references the news articles stored in the Today folder of the News Information DB 3003 (step S801).

[0103] Next, the interest score calculation unit 2044 refers to the interest words associated with each interest tag level stored in the interest tag DB 3008 (see Figure 11) (step S802).

[0104] Next, the interest score calculation unit 2044 calculates the main interest score (MIs) for each news article (step S803). If a news article contains multiple attention words, the interest score calculation unit 2044 calculates the one with the highest attention tag level among these attention words as the main interest score (MIs).

[0105] Next, the interest score calculation unit 2044 calculates the sub-interest score (SIs) for each news article (step S804). If a news article contains multiple attention words, the interest score calculation unit 2044 calculates the sub-interest score (SIs) by summing the attention tag levels assigned to each attention word.

[0106] Here, we will explain how the interest score calculation unit 2044 calculates the main interest score (MIs) and sub-interest score (SIs).

[0107] For example, suppose the user's attention tag levels are Level 5:18 (Generating AI), Level 4:13 (Vulnerability), Level 3:08 (Malware), Level 2:03 (Dark Web), and Level 1:05 (Hacker). Then, if news article 1 contains the content "85,000 instances of the XX virus detected, ...", the interest score calculation unit 2044 will determine that this news article contains the "XX virus," which corresponds to malware corresponding to attention tag level 3, and calculate the main interest score (MIs) = 3 (Malware) and the sub-interest score (SIs) = 3 (Malware) + 0 (None) = 3. Furthermore, for example, if news article 2 contains the phrase "A crackdown project targeting dark web sites has been carried out...", the interest score calculation unit 2044 will determine that this news article contains "dark web," which corresponds to attention tag level 2, and "hackers," which corresponds to attention tag level 1, and will calculate the main interest score (MIs) as 2 (dark web) and the sub-interest score (SIs) as 2 (dark web) + 1 (hackers) = 3. Note that if the same attention word appears multiple times within the same news article, the interest score calculation unit 2044 will count the appearance of the attention word as 1 time.

[0108] Next, the interest score calculation unit 2044 stores the main interest score (MIs) and sub-interest score (SIs) in association with each user ID in the interest score DB 3010 (see Figure 13) (step S805).

[0109] Next, the interest score calculation unit 2044 determines whether or not the calculation of interest scores for all news articles has been completed (step S806). If it determines that the calculation of interest scores for all news articles has been completed (YES), the interest score calculation process ends. On the other hand, if it determines that the calculation of interest scores for all news articles has not been completed (NO), the process returns to step 801.

[0110] In step S8, once the interest score calculation process is completed, the site generation unit 200 executes the recommended countermeasure generation process by the recommended countermeasure generation unit 209 described above (step S9). Then, once the site generation unit 200 has finished the recommended countermeasure generation process, it terminates the preprocessing.

[0111] If it is determined in step S1 that it is not the time to collect news articles (NO), the site generation unit 200 determines whether it is the time to assign trend level / attention tags (step S10). In this embodiment, the time to assign trend level / attention tags is 0:00 AM every Monday. Note that the time to assign trend level / attention tags can be set as appropriate by the system administrator (for example, 3:00 AM every Monday, 0:00 AM every other Sunday, etc.). If it is determined that it is the time to assign trend level / attention tags (YES), the process proceeds to step S11. On the other hand, if it is determined that it is not the time to assign trend level / attention tags (NO), the process proceeds to step S13.

[0112] If it is determined that it is time to assign trend level and attention tags (step S10: YES), the site generation unit 200 executes the trend level assignment process by the trend level assignment unit 205 (step S11).

[0113] [Trend level assignment process] Figure 20 is a flowchart showing an example of the trend level assignment process in preprocessing. First, the trend level assignment unit 205 sequentially references news articles stored in folders corresponding to the collection dates for the most recent week in the news information DB 3003 (see Figure 6) (step S1101). For example, if today is April 1, 2024, the trend level assignment unit 205 sequentially references news articles stored in folders corresponding to collection dates from March 25, 2024 to March 31, 2024 (collection date corresponding folder names "240325" to "240331").

[0114] Next, the trend level assignment unit 205 extracts each word (noun) contained in the news article (step S1102). For extracting each word, part-of-speech analysis using morphological analysis is used, for example. If the same word appears multiple times in the same news article, it is extracted as a single word.

[0115] Next, the trend level assignment unit 205 determines whether or not word extraction for all news articles has been completed (step S1103). If it determines that word extraction for all news articles has been completed (YES), it proceeds to step S509. On the other hand, if it determines that word extraction for all news articles has not been completed (NO), it returns to step S1102.

[0116] If it is determined that word extraction for all news articles has been completed (step S1103: YES), the trend level assignment unit 205 tally the number of occurrences of each word (step S1104).

[0117] Next, the trend level assignment unit 205 assigns trend levels to the words in order of frequency of occurrence (step S1105). For example, suppose the ranking of each word is 1st: deepfake, 2nd: generative AI, 3rd: vulnerability, 4th: Anonymous, 5th: dark web, 6th: SNS, 7th: cyber attack, 8th: impersonation, 9th: illegal, 10th: ransomware, 11th: euro, 12th: government, 13th: encryption, 14th: plugin, 15th: lost, 16th: parliament... In this case, the trend level assignment unit 205 assigns a trend level of 5 to the words corresponding to the 1st to 3rd rankings (deepfake, generative AI, vulnerability). The trend level assignment unit 205 also assigns a trend level of 4 to the words corresponding to the 4th to 6th rankings (anonymous, dark web, SNS). The trend level assignment unit 205 assigns a trend level of 3 to words corresponding to the 7th to 9th word occurrence ranks (cyberattack, impersonation, illegal). The trend level assignment unit 205 also assigns a trend level of 2 to words corresponding to the 10th to 12th word occurrence ranks (ransomware, euro, government). The trend level assignment unit 205 also assigns a trend level of 1 to words corresponding to the 13th to 15th word occurrence ranks (encryption, plugin, lost). Finally, the trend level assignment unit 205 assigns a trend level of 0 (or does not assign a trend level) to words corresponding to the 16th word occurrence rank or lower (parliament, etc.).

[0118] Next, the trend level assignment unit 205 stores the respective trend words corresponding to each trend level in the trend level DB 3004 (see Figure 7) (step S1106). When the process in step S1106 is completed, the trend level assignment process is terminated.

[0119] When the trend level assignment process is completed in step S11, the site generation unit 200 executes the attention tag level assignment process by the attention tag level assignment unit 206 (step S12).

[0120] [Tags assigned to focus levels]

[0121] Figure 21 is a flowchart showing an example of the attention tag assignment process in preprocessing. The attention tag level assignment unit 206 first sequentially references the browsing information of each user for the past week stored in the browsing status DB 3007 (see Figure 10). For example, if today is April 1, 2024, the attention tag level assignment unit 206 references the browsing information ("Views" column, "Likes" column) of each user's news articles from March 25, 2023 to March 31, 2024.

[0122] Next, the attention tag level assignment unit 206 refers to the news information DB 3003 (see Figure 6) and extracts the tags assigned to news articles that the user has "viewed" or "liked" (step S1203).

[0123] Next, the attention tag level assignment unit 206 counts the number of occurrences of each extracted tag (step S1204).

[0124] Next, the attention tag level assignment unit 206 assigns attention tag levels to the tags in order of their frequency of occurrence (step S1205). For example, suppose the occurrence order of each tag is 1st: Generating AI, 2nd: Vulnerability, 3rd: Malware, 4th: Dark Web, 5th: Hacker, 6th: Tampering, etc. In this case, the attention tag level assignment unit 206 assigns attention tag level 5 to Generating AI, attention tag level 4 to Vulnerability, attention tag level 3 to Malware, attention tag level 2 to Dark Web, and attention tag level 1 to Hacker. Then, it assigns attention tag level 0 to the tags corresponding to 6th place and below (Tampering, etc.) (or does not assign a attention tag level at all).

[0125] Next, the attention tag level assignment unit 206 stores the respective tags corresponding to each attention tag level in the attention tag DB 3008 (see Figure 11) (step S1206).

[0126] Next, the attention tag level assignment unit 206 determines whether or not the assignment of attention tag levels to all users has been completed (step S1207). If it determines that the assignment of attention tag levels to all users has been completed (YES), the attention tag level assignment process ends. On the other hand, if it determines that the assignment of attention tag levels to all users has not been completed (NO), the process returns to step S1201.

[0127] The site generation unit 200 terminates preprocessing once it has finished the process of assigning attention tags.

[0128] If it is determined in step S10 that it is not time to assign trend level / attention tags (NO), the site generation unit 200 determines whether it is time for attribute assignment learning (step S13). If it is determined that it is time for attribute assignment learning (YES), the process proceeds to step S14. On the other hand, if it is determined that it is not time for attribute assignment learning (NO), the pre-processing is terminated. In this embodiment, the attribute assignment learning time is 3:00 AM on the 1st of every other month. The attribute assignment learning time can be set as appropriate by the system administrator (for example, 2:00 AM on the 20th of every month, 3:00 AM on the 1st of every three months, etc.).

[0129] Next, the site generation unit 200 executes attribute distribution learning processing (step S14).

[0130] The attribute classification learning process is described below. The attribute classification learning process is a process of updating the classification AI model used to calculate the major category match rate (Cf), medium category match rate (SCf), and minor category match rate (SSCf) in the attribute score calculation process by the attribute score calculation unit 2041 described above (see Figure 16). In the attribute classification learning process, new training data is prepared. This training data contains the major category, medium category, and minor category answers for business attributes for multiple news articles (which may include factual news or news articles that are not factual), and the classification AI learns the major category AI, medium category AI, and minor category AI based on these news articles. Alternatively, the classification AI may be programmed to predict the major category, medium category, and minor category of business attributes for unknown news articles (news articles that are not factual) once a day (for example, at 3 a.m. every day).

[0131] The site generation unit 200 terminates preprocessing once it has finished the attribute distribution learning process.

[0132] [Security information site provision processing] Next, the security information site provision process executed by the security information site provision unit 202 and the news page generation unit 203 in the site generation unit 200 to provide a security information site to each user will be explained using Figures 22 to 26.

[0133] Figure 22 is a flowchart showing an example of the security information site generation process. The security information site provision unit 202 determines whether or not there is a login (whether or not the user has been authenticated) (step S3001). If it determines that there is a login (YES), it proceeds to step S3002. On the other hand, if it determines that there is no login (NO), it proceeds to step S3003.

[0134] If it is determined that a login has occurred (Step S3001: YES), the security information site provision unit 202 has the news page generation unit 203 generate a week's worth of news pages and transmits the security information site homepage 711, which includes the generated week's worth of news pages (Step S3002).

[0135] Here, the news page generation unit 203 identifies the business ID of the business to which the user belongs based on the user ID obtained during user authentication. Then, it refers to each news ID from today to one week ago in the attribute score DB 3009 (see Figure 12) and extracts the news IDs whose attribute score (As) values ​​for the identified business ID are ranked in the top 1 to 20. It also refers to the news information DB 3003 (see Figure 6) and extracts information from the "News," "Tags," and "Recommended Measures" columns of the news IDs whose attribute score (As) values ​​are ranked in the top 1 to 20. It also refers to the tag DB (see Figure 9) and extracts the tag names for tags No. 1 to 20. Based on this extracted information, it generates a news page for the week. Once the news page generation unit 203 has generated the news page for the week, the security information site provision unit 202 sends the homepage 711 of the security information site, which includes the news page for the week, to the employee terminal.

[0136] Figure 25 shows an example of the homepage (top page) image of a security information site. The homepage 711 displayed on the screen 700 of an employee terminal consists of a menu display area 720 where each menu is displayed, a tag button display area 731 where each tag button representing the tag names of tags No. 1 to 20 is displayed, and a weekly news article display area 732 where news articles from the past week are displayed. The menu display area 720 displays a home button 721, a latest button 722, a trend 1 button 723, a trend 2 button 724, a threat button 725, an interest 1 button 726, an interest 2 button 727, a customize button 728, and a summary button 729.

[0137] Each news article displays the tags assigned to it (tags 1-3), the source of the news, and the publication date and time. Additionally, if there is recommended action information for the news article, action button 733 will be displayed. Selecting action button 733 will display the recommended action information.

[0138] Returning to Figure 22, the security information site provision unit 202 determines whether a tag has been selected (one or more tags have been selected from the tag button display area 731) (step S3003). If it is determined that a tag has been selected (YES), the process proceeds to step S3004. On the other hand, if it is determined that no tag has been selected (NO), the process proceeds to step S3005.

[0139] If it is determined that a "tag" has been selected (Step S3003: YES), the security information site provision unit 202 has the news page generation unit 203 extract news articles with the selected tag from among the news articles included in the currently displayed news page (This Week, Latest, Trend 1, Trend 2, Threats, Interest 1, Interest 2, or Customized News Page), and generate a news page that displays the news articles with the selected tag. Then, it transmits the news page of the security information site, including the generated news page (Step S3004).

[0140] Here, the news page generation unit 203 refers to the news information DB 3003 (see Figure 6) and extracts news IDs that have tags matching the selected tag from among the tags corresponding to the news IDs of each news article included in the currently displayed news page. It then extracts information from the "News," "Tags," and "Recommended Measures" columns of each extracted news ID. Based on this extracted information, it generates a news page corresponding to the selected tag. Once the news page corresponding to the selected tag has been generated by the news page generation unit 203, the security information site provision unit 202 sends the news page corresponding to the selected tag to the employee terminal.

[0141] Figure 26(a) shows an example of the homepage image displayed when a tag is selected on the home screen. For example, if the homepage 711, which displays a week's worth of news, is currently displayed, and the user selects the "Attack" button and the "Vulnerable" button from the tag button display area 731, then the homepage 711 will display only the news articles that have been tagged with either the Attack tag or the Vulnerable tag in the news article display area 732 of the week mentioned above.

[0142] Returning to Figure 22, the security information site provision unit 202 determines whether the latest button 722 has been selected from the menu display area 720 (step S3005). If it is determined that the latest button 722 has been selected (YES), the process proceeds to step S3006. On the other hand, if it is determined that the latest button 722 has not been selected (NO), the process proceeds to step S3007.

[0143] If it is determined that the latest button 722 has been selected (step S3005: YES), the security information site provision unit 202 has the news page generation unit 203 generate the latest news page 712 and transmit the generated latest news page 712 (step S3006).

[0144] Here, the news page generation unit 203 identifies the business ID of the business to which the user belongs based on the user ID. Then, it refers to the attribute score DB 3009 (see Figure 12) and extracts news IDs whose attribute score (As) values ​​are among the top 1 to 20 for the identified business IDs, targeting today's news IDs. It also refers to the "Today" folder in the news information DB 3003 (see Figure 6) and extracts information from the "News," "Tags," and "Recommended Measures" columns for news IDs whose attribute score (As) values ​​are among the top 1 to 20. It also refers to the tag DB (see Figure 9) and extracts the tag names for tags No. 1 to 20. Based on this extracted information, it generates the latest news page. Once the latest news page is generated by the news page generation unit 203, the security information site provision unit 202 sends the latest news page 712 to the employee's terminal.

[0145] Figure 26(b) shows an example of what the latest news page looks like. The homepage 711 displayed on the employee terminal screen 700 includes a latest news article display area 735 where the latest news articles are displayed. The other components are as explained in Figure 25.

[0146] Returning to Figure 22, the security information site provider unit 202 determines whether the Trend 1 button 723 has been selected from the menu display area 720 (step S3007). If it is determined that the Trend 1 button 723 has been selected (YES), the process proceeds to step S3008. On the other hand, if it is determined that the Trend 1 button 723 has not been selected (NO), the process proceeds to step S3009.

[0147] If it is determined that the Trend 1 button 723 has been selected (step S3007: YES), the security information site provision unit 202 has the news page generation unit 203 generate a news page related to Trend 1 and transmits the generated news page related to Trend 1 (step S3008).

[0148] Here, the news page generation unit 203 refers to the "Today" folder in the news information DB 3003 (see Figure 6), sorts each news ID in descending order of Main Trend Score (MTs) value, and extracts information from the "News," "Tags," and "Recommended Measures" columns of the news ID. Then, based on this extracted information, it generates a news page related to Trend 1. Once the news page generation unit 203 has generated a news page related to Trend 1, the security information site provision unit 202 sends the news page related to Trend 1 to the employee's terminal.

[0149] Next, the security information site provision unit 202 determines whether the Trend 2 button 724 has been selected from the menu display area 720 (step S3009). If it determines that the Trend 2 button 724 has been selected (YES), the process proceeds to step S3010. On the other hand, if it determines that the Trend 2 button 724 has not been selected (NO), the process proceeds to step S3011.

[0150] If it is determined that the Trend 2 button 724 has been selected (step S3009: YES), the security information site provision unit 202 has the news page generation unit 203 generate a news page about Trend 2 and transmits the generated news page about Trend 2 (step S3010).

[0151] Here, the news page generation unit 203 refers to the "Today" folder in the news information DB 3003 (see Figure 6), sorts each news ID in descending order of sub-trend score (STs) value, and extracts information from the "News," "Tags," and "Recommended Measures" columns of the news ID. Then, based on this extracted information, it generates a news page related to Trend 2. Once the news page generation unit 203 has generated a news page related to Trend 2, the security information site provision unit 202 sends the news page related to Trend 2 to the employee's terminal.

[0152] Next, the security information site provider unit 202 determines whether the threat button 725 has been selected from the menu display area 720 (step S3011). If it determines that the threat button 725 has been selected (YES), it proceeds to step S3012. On the other hand, if it determines that the threat button 725 has not been selected (NO), it proceeds to step S3013.

[0153] If it is determined that the threat button 725 has been selected (step S3011: YES), the security information site provision unit 202 has the news page generation unit 203 generate a news page about the threat and transmits the generated news page about the threat (step S3013).

[0154] Here, the news page generation unit 203 identifies the business ID of the business to which the user belongs based on the user ID. Then, it refers to the attribute score DB 3009 (see Figure 12) and extracts news IDs that have been assigned a threat score (Ks) value for the identified business ID. It also refers to the news information DB 3003 (see Figure 6) and extracts information from the "News," "Tags," and "Recommended Countermeasures" columns of the news IDs that have been assigned a threat score (Ks) value. Based on this extracted information, it generates a news page about the threat. Once the news page generation unit 203 has generated a news page about the threat, the security information site provision unit 202 sends the news page about the threat to the employee's terminal.

[0155] Next, the security information site provision unit 202 determines whether the "Interest 1" button 726 has been selected from the menu display area 720 (step S3013). If it determines that the "Interest 1" button 726 has been selected (YES), it proceeds to step S3014. On the other hand, if it determines that the "Interest 1" button 726 has not been selected (NO), it proceeds to step S3015.

[0156] If it is determined that the Interest 1 button 726 has been selected (step S3013: YES), the security information site provision unit 202 has the news page generation unit 203 generate a news page related to Interest 1 and transmits the generated news page related to Interest 1 (step S3014).

[0157] Here, the news page generation unit 203 refers to the interest score DB 3010 (see Figure 13) and extracts news IDs that have been assigned a Main Interest Score (MIs) value for the target user ID. It also refers to the news information DB 3003 (see Figure 6) and extracts news IDs that are ranked 1st to 20th in terms of Main Interest Score (MIs) value. It also refers to the news information DB 3003 (see Figure 6) and extracts information from the "News" column, "Tags" column, and "Recommended Measures" column for news IDs that are ranked 1st to 20th in terms of Main Interest Score (MIs) value. Based on this extracted information, it generates a news page related to interest 1. Once the news page generation unit 203 has generated a news page related to interest 1, the security information site provision unit 202 sends the news page related to interest 1 to the employee's terminal.

[0158] Next, the security information site provision unit 202 determines whether the Interest 2 button 727 has been selected from the menu display area 720 (step S3015). If it determines that the Interest 2 button 727 has been selected (YES), the process proceeds to step S3016. On the other hand, if it determines that the Interest 2 button 727 has not been selected (NO), the process proceeds to step S3017.

[0159] If it is determined that the Interest 2 button 727 has been selected (step S3015: YES), the security information site provision unit 202 has the news page generation unit 203 generate a news page related to Interest 2 and transmits the generated news page related to Interest 2 (step S3016).

[0160] Here, the news page generation unit 203 refers to the interest score DB 3010 (see Figure 13) and extracts news IDs that have been assigned sub-interest score (SIs) values ​​for the target user ID. It also refers to the news information DB 3003 (see Figure 6) and extracts news IDs with sub-interest score (SIs) values ​​that are ranked from 1st to 20th. It also refers to the news information DB 3003 (see Figure 6) and extracts information from the "News" column, "Tags" column, and "Recommended Measures" column for news IDs with sub-interest score (SIs) values ​​that are ranked from 1st to 20th. Based on this extracted information, it generates a news page related to interest 2. Once the news page generation unit 203 has generated a news page related to interest 2, the security information site provision unit 202 sends the news page related to interest 2 to the employee's terminal.

[0161] Next, the security information site provision unit 202 determines whether or not the customization button 728 has been selected from the menu display area 720 (step S3017). If it determines that the customization button 728 has been selected (YES), the process proceeds to step S3018. On the other hand, if it determines that the customization button 728 has not been selected (NO), the process proceeds to step S3019.

[0162] If it is determined that the customize button 728 has been selected (step S3017: YES), the security information site provision unit 202 executes the news customization process (step S3018).

[0163] Figure 23 is a flowchart showing an example of news customization processing in the security information site generation process. The security information site provision unit 202 first sends the news customization page (step S4001).

[0164] Figure 27(a) shows an example of a news customization page. The news customization page 713, displayed on the employee terminal screen 700, consists of a customization condition display area 736 that displays a list of customization conditions that can be set when customizing news. Customization conditions 1 to 15 are displayed in the customization condition display area 736. Each of the customization conditions 1 to 15 is set by a combination of the following: business attributes, business threats, trend score (main trend score (MTs), sub-trend score (STs)), and interest score (main interest score (MIs), sub-interest score (SIs)). Users who customize news select the desired customization conditions from conditions 1 to 15 and operate the confirm button 738. The other components of the news customization page 713 are explained in Figure 25.

[0165] Next, the security information site provision unit 202 determines whether or not it has received customization conditions (step S4002). If it determines that it has received customization conditions (YES), it proceeds to step S4003. On the other hand, if it determines that it has not received customization conditions (NO), it repeats the process in step S4002.

[0166] If it is determined that customization conditions have been received (step S4002: YES), the security information site provision unit 202 causes the news page generation unit 203 to refer to the customization conditions (step S4003).

[0167] When the customization conditions are referenced, the news page generation unit 203 determines whether the customization conditions include "attributes" (step S4004). If it determines that the customization conditions include "attributes" (YES), it proceeds to step S4005. On the other hand, if it determines that the customization conditions do not include "attributes" (NO), it proceeds to step S4006.

[0168] If it is determined that the customization conditions include "attributes" (step S4004: YES), the news page generation unit 203 refers to the attribute score DB 3009 (see Figure 12) and stores the attribute score (As) value of the business to which the user belongs, associating it with the news ID (step S4005). Here, the news page generation unit 203 refers to each news ID from today to one week ago in the attribute score DB 3009, extracts the attribute score (As) value of the business ID identified from the user ID, and stores it in the total score calculation table, associating it with each news ID.

[0169] Next, the news page generation unit 203 determines whether the customization conditions include "threat" (step S4006). If it determines that the customization conditions include "threat" (YES), it proceeds to step S4007. On the other hand, if it determines that the customization conditions do not include "threat" (NO), it proceeds to step S4008.

[0170] If the customization conditions are determined to include "threat" (step S4006: YES), the news page generation unit 203 refers to the attribute score DB 3009 (see Figure 12) and stores the threat score (Ks) value of the business operator to which the user belongs, associating it with the news ID (step S4005). Here, the news page generation unit 203 refers to each news ID from today to one week ago in the attribute score DB 3009, extracts the threat score (Ks) value of the business operator ID identified from the user ID, and stores it in the total score calculation table associating it with the news ID.

[0171] Next, the news page generation unit 203 determines whether or not the customization conditions include "Trend 1" (step S4008). If it determines that the customization conditions include "Trend 1" (YES), it proceeds to step S4009. On the other hand, if it determines that the customization conditions do not include "Trend 1" (NO), it proceeds to step S4010.

[0172] If it is determined that the customization conditions include "Trend 1" (Step S4008: YES), the news page generation unit 203 refers to the news information DB 3003 (see Figure 6) and stores the main trend score (MTs) value of each news ID in association with the news ID (Step S4009). Here, the news page generation unit 203 refers to each news ID in each folder corresponding to the collection date from today to one week ago in the news information DB 3003, extracts the main trend score (MTs) value of each news ID, and stores it in the total score calculation table in association with each news ID.

[0173] Next, the news page generation unit 203 determines whether or not the customization conditions include "Trend 2" (step S4010). If it determines that the customization conditions include "Trend 2" (YES), it proceeds to step S4011. On the other hand, if it determines that the customization conditions do not include "Trend 2" (NO), it proceeds to step S4012.

[0174] If it is determined that the customization conditions include "Trend 2" (Step S4010: YES), the news page generation unit 203 refers to the news information DB 3003 (see Figure 6) and stores the sub-trend score (STs) value of each news ID in association with the news ID (Step S4011). Here, the news page generation unit 203 refers to each news ID in each folder corresponding to the collection date from today to one week ago in the news information DB 3003, extracts the sub-trend score (STs) value of each news ID, and stores it in the total score calculation table in association with each news ID.

[0175] Next, the news page generation unit 203 determines whether or not the customization conditions include "Interest 1" (step S4012). If it determines that the customization conditions include "Interest 1" (YES), it proceeds to step S4013. On the other hand, if it determines that the customization conditions do not include "Interest 1" (NO), it proceeds to step S4014.

[0176] If it is determined that the customization conditions include "Interest 1" (step S4012: YES), the news page generation unit 203 refers to the interest score DB 3010 (see Figure 13) and stores the main interest score (MIs) value for each news ID of the user, associating it with the news ID (step S4013). Here, the news page generation unit 203 refers to the interest score DB 3010, extracts the main interest score (MIs) value for each news ID from today to one week ago, which is associated with the user ID, and stores it in the total score calculation table, associating it with each news ID.

[0177] Next, the news page generation unit 203 determines whether or not the customization conditions include "Interest 2" (step S4014). If it determines that the customization conditions include "Interest 2" (YES), it proceeds to step S4015. On the other hand, if it determines that the customization conditions do not include "Interest 2" (NO), it proceeds to step S4016.

[0178] If it is determined that the customization conditions include "Interest 2" (step S4014: YES), the news page generation unit 203 refers to the interest score DB 3010 (see Figure 13) and stores the sub-interest score (SIs) value for each news ID of the user, associating it with the news ID (step S4015). Here, the news page generation unit 203 refers to the interest score DB 3010, extracts the sub-interest score (MIs) value for each news ID from today to one week ago, which is associated with the user ID, and stores it in the total score calculation table, associating it with each news ID.

[0179] Next, the news page generation unit 203 calculates a total score (Ts) for each news ID (step S4016). Here, the news page generation unit 203 refers to the attribute score (As) value, threat score (Ks) value, main trend score (MTs) value, sub-trend score (STs) value, main interest score (MIs) value, and sub-interest score (SIs) value associated with each news ID stored in the total score calculation table, and calculates a total score (Ts) for each news ID (see Figure 23 for the calculation formula).

[0180] Next, the news page generation unit 203 refers to the news information database and extracts information from the "News" column, "Tags" column, and "Recommended Actions" column in descending order of total score (Ts) (step S4017).

[0181] Next, the news page generation unit 203 generates a news page for you. Once the news page for you is generated by the news page generation unit 203, the security information site provision unit 202 sends the news page for you to the employee terminal (step S4018).

[0182] Figure 27(b) shows an example of a customized news page (a news page for you). The news page for you 714 displayed on the employee terminal screen 700 includes a specified customization conditions display area 739 that displays the customization conditions specified by the user, and a news article display area 740 that displays each news article in a customized order according to the customization conditions specified by the user. The other configurations are as explained in Figure 25.

[0183] Returning to Figure 22, the security information site provision unit 202 then determines whether the summary button 729 has been selected (step S3019). If it determines that the summary button 729 has been selected (YES), the process proceeds to step S3020. On the other hand, if it determines that the summary button 729 has not been selected (NO), the process proceeds to step S3021.

[0184] If it is determined that the summary button 729 has been selected (step S3019: YES), the security information site provision unit 202 executes the news summary generation process (step S3020).

[0185] Figure 24 is a flowchart showing an example of the news summary generation process in the security information site generation process. The security information site provision unit 202 first sends the news summary page (step S4101).

[0186] Next, the security information site provision unit 202 determines whether or not it has received a summary designation (step S4102). If it determines that it has received a summary designation (YES), it proceeds to step S4103. On the other hand, if it determines that it has not received a summary designation (NO), it repeats the process in step S4102.

[0187] If it is determined that a summary specification has been received (step S4102: YES), the security information site provision unit 202 causes the summary generation unit 210 to refer to the specified content (step S4103).

[0188] Upon reviewing the specified content, the summary generation unit 210 determines whether the specified content consists only of a time period specification (step S4104). If it determines that the specified content consists only of a time period specification (YES), the process proceeds to step S4105. On the other hand, if it determines that the specified content does not consist only of a time period specification (NO), the process proceeds to step S4106.

[0189] If it is determined that the specified content is only a time period (step S4104: YES), the summary generation unit 210 refers to the news information DB 3003 (see Figure 6) and extracts news articles in the folder corresponding to the specified period (step S4105).

[0190] Next, the summary generation unit 210 determines whether the specified content consists only of tag specifications (step S4106). If it determines that the specified content consists only of tag specifications (YES), it proceeds to step S4107. On the other hand, if it determines that the specified content does not consist only of a period specification (NO), it proceeds to step S4108.

[0191] If it is determined that the specified content is only a tag specification (step S4106: YES), the summary generation unit 210 refers to the news information DB 3003 (see Figure 6) and extracts news articles with the specified tag from all folders (step S4107).

[0192] Next, the summary generation unit 210 determines whether the specified content is a period specification and a tag specification (step S4108). If it determines that the specified content is a period specification and a tag specification (YES), it proceeds to step S4109. On the other hand, if it determines that the specified content is not a period specification and a tag specification (NO), it proceeds to step S4110.

[0193] If the specified content is determined to be a period specification and a tag specification (step S4109: YES), the summary generation unit 210 refers to the news information DB 3003 (see Figure 6) and extracts news articles with the specified tags in the folder corresponding to the specified period (step S4107).

[0194] Next, the summary generation unit 210 generates a prompt according to the specified content (period, tags) and sends the generated prompt to the generation AI (step S4110). For example, if the period is specified as "3 days" and the tags are specified as "cybersecurity," "dark web," and "data breach," the summary generation unit 210 generates a prompt that says, "Please refer to these news articles (or the URLs of the news articles) and summarize news articles related to cybersecurity." The content of the prompt generated here is, "Please refer to news articles (or the URLs of the news articles) from the last 3 days and summarize news articles related to cybersecurity. When answering, please refer to news articles tagged with "cybersecurity," "dark web," or "data breach" in the Today folder (for example, the folder collected on April 1, 2024), the 1-Day-Ago folder (for example, the folder collected on March 31, 2024), and the 2-Day-Ago folder (for example, the folder collected on March 30, 2024) in the News Information DB 3003." You can also write it as ".

[0195] Next, the summary generation unit 210 sends the response from the generation AI to the employee terminal as a news summary according to the specified content.

[0196] Figure 28 shows an example of a news summary page on a security information website. The news summary page 715 displayed on the employee terminal screen 700 consists of a news summary display area 741 which includes a period selection button display area 742 where buttons for specifying a period are displayed, a tag selection button display area 743 where buttons for specifying tags are displayed, a confirmation button 744 for submitting the specified content, and a summary display area 745 that displays a summary of the news. The other components are as explained in Figure 25.

[0197] Returning to Figure 22, the security information site provision unit 202 then determines whether the home button 721 has been selected (step S3021). If it determines that the home button 721 has been selected (YES), the process proceeds to step S3022. On the other hand, if it determines that the home button 721 has not been selected (NO), the security information site provision process is terminated.

[0198] If it is determined that the home button 721 has been selected (YES), the security information site provision unit 202 generates the homepage (top page) described above and sends it to the employee terminal (step S3022). When the process in step S3022 is completed, the security information site provision process is terminated.

[0199] As described above, the embodiments of this disclosure can provide technology for appropriately distributing security news tailored to each business operator. Furthermore, it can provide technology for appropriately distributing security news tailored to each employee within each business operator.

[0200] While embodiments of this disclosure have been described above, this disclosure is not limited to these embodiments, and various modifications and changes are possible within the scope of the gist of this disclosure as described in the claims.

[0201] [Differentiation] In the embodiments of this disclosure, the configuration of various DB300s is not limited to these embodiments, and a wide variety of methods can be conceived by the designer.

[0202] Furthermore, in the embodiments of this disclosure, the method for calculating each score in the relevance calculation unit 204 is not limited to this embodiment, and a wide variety of methods can be conceived by the designer.

[0203] Furthermore, in the embodiments of this disclosure, the homepage of the security information site displayed news articles from the past week (see Figure 25). However, the system is not limited to this, and it may also store customization conditions specified by the user and display news articles tailored to the user based on these customization conditions.

[0204] The technology disclosed herein can take various forms, such as an information processing system, an information processing device, an information processing method, a program, or a recording medium. For example, a program for implementing software may be provided as a computer-readable, non-temporary recording medium, or it may be provided so that it can be downloaded from an external server. Alternatively, it may be provided by cloud computing, which enables the site generation function by having an external computer (e.g., a cloud server) launch the site generation program.

[0205] Furthermore, the following configurations also fall within the technical scope of this disclosure. (Composition 1) The news information gathering department collects security-related news from websites, A business-related information storage unit that stores business-related information concerning a business operator, A correlation calculation unit calculates the degree of correlation between each of the collected news items and the aforementioned business-related information, based on the aforementioned business-related information. The system includes a news page generation unit that generates a news page displaying the news that can be viewed by the employees of the business operator, The aforementioned news page generation unit, An information processing device that generates news pages based on the degree of relevance corresponding to each of the aforementioned news items. (Configuration 2) The aforementioned business-related information includes business attribute information related to the business of the aforementioned business, The aforementioned correlation calculation unit, An information processing device according to configuration 1, which calculates the degree of relevance based on the aforementioned business attribute information. (Composition 3) The system includes a threat information detection unit that detects threat information resulting from the employee's use of an employee terminal, The aforementioned business operator-related information includes the aforementioned threat information relating to the aforementioned business operator, The aforementioned correlation calculation unit, An information processing device according to configuration 1 or configuration 2, which calculates the degree of relevance based on the aforementioned threat information. (Composition 4) A term level assignment unit counts the number of occurrences of each term in the multiple news articles collected over a predetermined period, and assigns a level to each term based on the counted number of occurrences of each term. The system includes a scoring unit that assigns a score to the news based on the level of each term contained in the news, The aforementioned news page generation unit, An information processing device according to any one of configurations 1 to 3, which generates the news page based on a score corresponding to each of the aforementioned news items. (Composition 5) A tag storage unit that stores multiple tags, An information processing device according to any one of configurations 1 to 4, comprising a tagging unit that assigns one of the multiple tags to the news. (Composition 6) The system includes a tag level assignment unit that, in accordance with each employee's viewing of the news, aggregates the total number of tags assigned to the news for each employee, and assigns a level to each tag for each employee based on the aggregated total number of tags for each employee, The aforementioned news page generation unit, The information processing device according to configuration 5, which generates the news page based on the level for each of the tags for each of the employees. (Composition 7) The aforementioned news page generation unit, An information processing device according to configuration 5 or 6, which accepts the designation of the aforementioned tags and generates a summary of the news to which the accepted tags have been assigned. (Composition 8) The aforementioned news page generation unit, An information processing device according to any one of configurations 1 to 7, which accepts a specified period and generates a summary of the news collected during the accepted period. (Composition 9) The aforementioned news page generation unit, An information processing device according to any one of configurations 1 to 8, which generates proposed countermeasures for the aforementioned news. (Composition 10) A method of information processing performed by a computer, The news information gathering process involves collecting security-related news from websites, A correlation calculation step that calculates the degree of correlation between each of the collected news items and the business-related information based on the business-related information of the business stored in the business-related information storage unit, The process includes generating a news page that generates a news page that displays the news viewable by the employees of the business operator, The aforementioned news page generation process is as follows: An information processing method that generates news pages based on the degree of relevance corresponding to each of the aforementioned news items. (Composition 11) An information processing program that is executed by a computer, The procedure for gathering news information about security from websites, A correlation calculation procedure for calculating the correlation between each of the collected news items and the business-related information, based on the business-related information pertaining to the business stored in the business-related information storage unit, The procedure includes generating a news page that generates a news page that displays the news viewable by the employees of the business operator, The aforementioned news page generation procedure is as follows: An information processing program that generates news pages based on the degree of relevance corresponding to each of the aforementioned news items. [Explanation of Symbols]

[0206] 10 Information Processing System, 100 Server, 200 Site Generation Unit, 201 News Collection Unit, 202 Security Information Site Provision Unit, 203 News Page Generation Unit, 204 Relevance Calculation Unit, 205 Trend Level Assignment Unit, 206 Featured Tag Level Assignment Unit, 207 Vulnerability / Countermeasure Information Collection Unit, 208 Industry-Specific Trend Collection Unit, 209 Recommended Countermeasure Generation Unit, 210 Summary Generation Unit, 300 Various Databases (Various DBs), 400 Company A, 401 Company A Employee Terminal, 500 Company B, 501 Company B Employee Terminal, 600 Company C, 601 Company C Employee Terminal

Claims

1. The news information gathering department collects security-related news from websites, A business-related information storage unit that stores business-related information concerning a business operator, A correlation calculation unit calculates the degree of correlation between each of the collected news items and the aforementioned business-related information, based on the aforementioned business-related information. The system includes a news page generation unit that generates a news page displaying the news that can be viewed by the employees of the business operator, The aforementioned news page generation unit, An information processing device that generates news pages based on the degree of relevance corresponding to each of the aforementioned news items.

2. The aforementioned business-related information includes business attribute information related to the business of the aforementioned business, The aforementioned correlation calculation unit, The information processing device according to claim 1, which calculates the degree of relevance based on the business attribute information.

3. The system includes a threat information detection unit that detects threat information resulting from the employee's use of an employee terminal, The aforementioned business operator-related information includes the aforementioned threat information relating to the aforementioned business operator, The aforementioned correlation calculation unit, The information processing device according to claim 1, which calculates the degree of relevance based on the aforementioned threat information.

4. A term level assignment unit counts the number of occurrences of each term in the multiple news articles collected over a predetermined period, and assigns a level to each term based on the counted number of occurrences of each term. The system includes a scoring unit that assigns a score to the news based on the level of each term contained in the news, The aforementioned news page generation unit, The information processing apparatus according to claim 1, which generates the news page based on a score corresponding to each of the aforementioned news items.

5. A tag storage unit that stores multiple tags, The information processing device according to any one of claims 1 to 4, further comprising a tagging unit that assigns one of the multiple tags to the news item.

6. The system includes a tag level assignment unit that, in accordance with each employee's viewing of the news, aggregates the total number of tags assigned to the news for each employee, and assigns a level to each tag for each employee based on the aggregated total number of tags for each employee, The aforementioned news page generation unit, The information processing apparatus according to claim 5, which generates the news page based on the level for each of the tags for each of the employees.

7. The aforementioned news page generation unit, The information processing apparatus according to claim 5, which accepts the designation of the aforementioned tags and generates a summary of the news to which the accepted tags have been assigned.

8. The aforementioned news page generation unit, An information processing device according to any one of claims 1 to 4, which accepts a specified period and generates a summary of the news collected during the accepted period.

9. The aforementioned news page generation unit, An information processing device according to any one of claims 1 to 4, which generates proposed countermeasures for the aforementioned news.

10. A method of information processing performed by a computer, The news information gathering process involves collecting security-related news from websites, A correlation calculation step that calculates the degree of correlation between each of the collected news items and the business-related information based on the business-related information of the business stored in the business-related information storage unit, The process includes generating a news page that generates a news page that displays the news viewable by the employees of the business operator, The aforementioned news page generation process is as follows: An information processing method that generates news pages based on the degree of relevance corresponding to each of the aforementioned news items.

11. An information processing program that is executed by a computer, The procedure for gathering news information about security from websites, A correlation calculation procedure for calculating the correlation between each of the collected news items and the business-related information, based on the business-related information pertaining to the business stored in the business-related information storage unit, The procedure includes generating a news page that generates a news page that displays the news viewable by the employees of the business operator, The aforementioned news page generation procedure is as follows: An information processing program that generates news pages based on the degree of relevance corresponding to each of the aforementioned news items.

Images