Information analysis device, information analysis method, and program

Abstract

This process determines whether the information presented in multiple text data sets describing information security-related events is consistent. [Solution] The acquisition unit acquires multiple text data describing information security-related events, the analysis unit uses information security-related knowledge information to analyze whether the information shown in the multiple text data is consistent, and the output unit outputs information based on the analysis results regarding whether the information shown in the multiple text data is consistent.

Description

Technical Field

[0001] The present disclosure relates to an information analysis apparatus, an information analysis method, and a program, and particularly to an information analysis apparatus, an information analysis method, and a program for analyzing text data related to information security-related events.

Background Art

[0002] Information security-related events (including potential accidents and potential incidents related to information security), such as information leakage from an information system due to mistakes or negligence of employees, etc., and downtime of an information system due to natural disasters, are frequently reported. In recent years, information systems of government agencies, companies, etc. can be targeted by cyberattacks by actors / attackers and criminal organizations.

[0003] Under such circumstances, in order to ensure the security of information systems, it has become extremely important to quickly collect accurate information related to information security. In response to such demands, related technologies have been provided.

[0004] For example, the information analysis apparatus described in Patent Document 1 extracts specialized information related to cyberattack damage information included in news articles based on the occurrence time of cyberattack damage from a database storing specialized information related to cyberattacks.

[0005] Further, the information analysis apparatus described in Patent Document 1 calculates the similarity between damage information and specialized information, and based on the calculated similarity, identifies the specialized information corresponding to the damage information. Then, the information analysis apparatus complements the news article including the damage information with the identified specialized information.

Prior Art Documents

Patent Documents

[0006]

Patent Document 1

[0007] Numerous news articles are published daily regarding information security incidents and accidents. There is a need for technology to consolidate these news articles into a single source. However, some of these articles contain outdated information or errors (including erroneous and fake information).

[0008] This disclosure has been made in view of the above-mentioned issues, and its purpose is to determine whether the information presented in multiple text data describing information security-related events is consistent. [Means for solving the problem]

[0009] An information analysis device according to one aspect of this disclosure includes: an acquisition means for acquiring a plurality of text data describing information security-related events; an analysis means for analyzing whether the information indicated by the acquired plurality of text data is consistent using information security-related knowledge information; and an output means for outputting information based on the analysis results regarding whether the information indicated by the acquired plurality of text data is consistent.

[0010] In one aspect of the present disclosure, an information analysis method involves a computer acquiring multiple text data describing information security-related events, analyzing whether the information represented by the acquired text data is consistent using information security-related knowledge information, and outputting information based on the analysis results regarding whether the information represented by the acquired text data is consistent.

[0011] A program according to one aspect of this disclosure causes a computer to perform the following processes: acquiring a plurality of text data describing information security-related events; analyzing whether the information indicated by the acquired plurality of text data is consistent using information security-related knowledge information; and outputting information based on the analysis results regarding whether the information indicated by the acquired plurality of text data is consistent. [Effects of the Invention]

[0012] According to one aspect of this disclosure, it is possible to determine whether the information represented by multiple text data is consistent. [Brief explanation of the drawing]

[0013] [Figure 1] This block diagram shows the configuration of an information analysis device according to one embodiment. [Figure 2] This figure shows examples of news articles (News Articles A and B) stored in the article collection database. [Figure 3] This figure shows an example of knowledge information stored in a knowledge information database. [Figure 4] This figure shows an example of a prompt input to a Large Language Model (LLM). [Figure 5] This figure shows an example of the output from a Large-Scale Language Model (LLM). [Figure 6] This is a flowchart showing the operation of an information analysis device according to one embodiment. [Figure 7] This block diagram shows the configuration of an information analysis device according to one embodiment. [Figure 8] This is a flowchart showing the operation of an information analysis device according to one embodiment. [Figure 9] This figure shows an example of news articles (articles X, Y, and Z) collected from the internet and other sources. [Figure 10] This figure shows an example of the hardware configuration of an information analysis device according to one embodiment.

Embodiments for Carrying Out the Invention

[0014] Some embodiments of the present disclosure will be described below with reference to the drawings. In the following description, a "model" or "large language model (LLM)" (which may also be referred to as a natural language processing model) is a program (such as a generative AI) that uses artificial neural network technology to extract language and context features from a large amount of text data through machine learning or deep learning (deep neural network learning) and learn the word occurrence probabilities.

[0015]

Embodiment 1

[0016] (Configuration of Information Analysis Device 10) Referring to FIG. 1, the configuration of the information analysis device 10 according to the present Embodiment 1 will be described. FIG. 1 is a block diagram showing the configuration of the information analysis device 10. As shown in FIG. 1, the information analysis device 10 includes an acquisition unit 11, an analysis unit 12, and an output unit 13.

[0017] The acquisition unit 11 acquires a plurality of text data describing information security-related events. The acquisition unit 11 is an example of acquisition means.

[0018] For example, the acquisition unit 11 acquires, as a plurality of text data, a plurality of news articles related to one or more cases of events and accidents related to information security from the article collection database 100. The acquisition unit 11 outputs the acquired plurality of news articles to the analysis unit 12.

[0019] Alternatively, the acquisition unit 11 may acquire a plurality of news articles related to one or more cases that have been previously collected and selected by the user.

[0020] Figure 2 shows an example of articles stored in the article database 100. The article collection shown in Figure 2 includes news article A, which states, "An attack exploiting a vulnerability (CVE-oooo-ooooo) in Company A's equipment B-1 occurred, resulting in 20 billion yen in damages for Company N," and news article B, which states, "An attack exploiting a vulnerability (CVE-oooo-ooooo) in Company A's equipment B-1 occurred, resulting in 40 billion yen in damages for Company N." Here, CVE is an identifier (Common Vulnerability Identifier) ​​used to identify security weaknesses (vulnerabilities) in various software.

[0021] Figure 3 shows an example of knowledge information stored in the knowledge information database 200. Knowledge information provides information that complements the content of news articles. In the example shown in Figure 3, the knowledge information includes information about companies that provide or use information equipment ("Company N", "Company F", "Company A"), information about vulnerabilities in information systems (CVE-****), and information about information equipment ("Equipment α").

[0022] The analysis unit 12 retrieves information about companies represented by "company names" contained in each of the multiple news articles, information about the specifications and functions of devices represented by "device names," and information about the type of vulnerability indicated by "vulnerability identifiers" from the knowledge information database 200.

[0023] The analysis unit 12 uses information security-related knowledge to analyze whether the information presented by multiple text data is consistent, or in other words, whether it is not contradictory. The analysis unit 12 is an example of an analysis method.

[0024] In one example, the analysis unit 12 inputs the content or parts of (e.g., body text, summary, title) of multiple news articles acquired by the acquisition unit 11, along with knowledge information that complements the content of each news article, into the large-scale language model 300.

[0025] The analysis unit 12 then instructs the large-scale language model 300 to determine whether the content of the multiple news articles it has input, i.e., the information, is consistent. In one example, the analysis unit 12 inputs an instruction to the large-scale language model 300 to determine whether "article B is correct if article A is correct." Specifically, the content of the news articles refers to the "body," "summary," and "title" of the news articles. Each news article includes the "company name," "device name," and "vulnerability identifier" (see Figure 2).

[0026] The analysis unit 12 generates instruction sentences to give instructions to the large-scale language model 300. The analysis unit 12 then inputs a prompt containing the generated instruction sentences to the large-scale language model 300. An example of a prompt will be described later.

[0027] In another example, the analysis unit 12 has the large-scale language model 300 summarize the contents of multiple news articles (an example of text data), and then has the large-scale language model 300 determine whether the summaries of the multiple news articles are consistent. Alternatively, instead of summarizing the multiple news articles, the analysis unit 12 may input the titles of the multiple news articles to the large-scale language model 300. Or, as shown in one modification described later, instead of inputting instructions to the large-scale language model 300, the analysis unit 12 can determine whether the contents of the multiple news articles (an example of text data) are consistent based on a "first characteristic word" representing the cause of an information security-related event and a "second characteristic word" representing the result of an information security-related event. Specific examples of the "first characteristic word" and "second characteristic word" will be described later.

[0028] Figure 4 shows an example of a prompt that the analysis unit 12 inputs to the large-scale language model 300. In the example shown in Figure 4, the prompt includes the instruction, "Determine whether the following news articles A and B contradict each other. For the meaning of proper nouns appearing in each article, please refer to #Detailed explanation of proper nouns." Here, "#Detailed explanation of proper nouns" in the instruction refers to knowledge information.

[0029] Furthermore, the prompts shown in Figure 4 include the full text (or summary, title) of news articles A and B. In addition, the prompts shown in Figure 4 include knowledge information regarding the "company name," "device name," and "vulnerability identifier" that appear in the full text of news articles A and B.

[0030] The large-scale language model 300 uses the texts of news articles A and B included in the prompt, along with knowledge information, to determine whether the content of the multiple input news articles is consistent, following the instructions in the given prompt, and outputs the result of the determination.

[0031] Figure 5 shows an example of output from the large-scale language model 300. As shown in Figure 5, the large-scale language model 300 outputs text such as, "We will determine whether the input news articles A and B are contradictory. News article A states that the damages to company A for equipment B-1 amount to 20 billion yen, while news article B states that the total damages to company A's product B-1 amount to 40 billion yen. Since the damage amounts (20 billion yen vs. 40 billion yen) are different, it is considered a contradiction."

[0032] The analysis unit 12 obtains the judgment result (Figure 5) output from the large-scale language model 300. Based on the judgment result output from the large-scale language model 300, the analysis unit 12 determines whether the contents of multiple news articles are consistent. As shown in one modified example described later, the analysis unit 12 can also determine whether the contents of multiple news articles are consistent without using the large-scale language model 300.

[0033] For example, the analysis unit 12 determines whether the content of each of the multiple news articles is true or false based on the judgment results output from the large-scale language model 300.

[0034] If there are two or more news articles that have been analyzed as having inconsistent content, the analysis unit 12 determines that one or more of the two or more news articles have correct content.

[0035] In one example, the analysis unit 12 determines that the content of the news article with the most recent timestamp is correct among two or more news articles.

[0036] In another example, the analysis unit 12 determines that the content of the news article with the most consistent content among two or more news articles is correct. In yet another example, the analysis unit 12 determines that the content of the more reliable news article is correct, based on the reliability of the news site and the reliability of the media, which are defined separately.

[0037] The analysis unit 12 outputs to the output unit 13 the result of its determination of whether the content of each of the multiple news articles is correct or incorrect. Alternatively, the analysis unit 12 may simply output to the output unit 13 the result of its determination by the large-scale language model 300 regarding whether the content of the multiple news articles is consistent. The large-scale language model 300 is an example of a “model”. In the following description of this disclosure, another computer program for text data analysis (called a language model) may be used instead of the large-scale language model 300.

[0038] The output unit 13 receives the results of the analysis unit 12's determination of whether the content of each of the multiple news articles (an example of multiple text data) is correct or incorrect. The output unit 13 then outputs information based on the analysis results regarding whether the content of the multiple news articles is consistent.

[0039] For example, the output unit 13 outputs only the news articles that the analysis unit 12 determined to be correct from among the multiple news articles that were analyzed.

[0040] In another example, the output unit 13 outputs information indicating whether the contents of multiple news articles are consistent.

[0041] In another example, if the content of multiple news articles is consistent, the output unit 13 outputs a summary of the information presented in the multiple news articles.

[0042] (modified version) When the body text of a news article (an example of text data) is short, or when the subject of analysis is a summary or title of a news article, the amount of information being analyzed is limited. In such cases, the similarity score, which represents how similar the features of multiple news articles are, can be used to analyze whether the content of multiple news articles is consistent.

[0043] In one modified example, instead of using the large-scale language model 300, the analysis unit 12 calculates the similarity of features between multiple news articles A and B (Figure 2). The analysis unit 12 may then determine whether the content of the multiple news articles is consistent based on whether the magnitude of the calculated similarity exceeds a predetermined threshold.

[0044] According to this modified configuration, the analysis unit 12 can determine whether the content of multiple news articles is consistent without using a large-scale language model 300 (Figure 1).

[0045] In another variation, the analysis unit 12 extracts a first characteristic word representing the cause of an information security-related event and a second characteristic word representing the result of an information security-related event from each of several news articles. The analysis unit 12 compares the first characteristic words extracted from each of the several news articles with each other and with each other the second characteristic words to analyze whether both the first and second characteristic words are consistent.

[0046] Here, consistency between multiple news articles (an example of information shown by text data) means that the first characteristic words representing the cause of an information security-related event (e.g., "power outage," "email sent to the wrong recipient," "cyberattack") and the second characteristic words representing the result of an information security-related event (e.g., "data breach," "system downtime," "ransom demand," "scale and amount of damage") are consistent across multiple news articles. Note that a list of the first / second characteristic words representing the cause / result of information security-related events has been pre-programmed into the large-scale language model 300.

[0047] (Operation of the information analysis device 10) The operation of the information analysis device 10 according to this embodiment 1 will be explained with reference to Figure 6. Figure 6 is a flowchart showing the operation of the information analysis device 10.

[0048] As shown in Figure 6, first, the acquisition unit 11 acquires multiple text data (for example, news articles) related to information security-related events (accidents, incidents, or preventative incidents related to information security) (S101). The acquisition unit 11 outputs the acquired text data to the analysis unit 12.

[0049] Next, the analysis unit 12 uses information security-related knowledge to analyze whether the information shown by multiple text data (for example, the content of news articles) is consistent (S102). The analysis unit 12 outputs the analysis results regarding whether the information shown by the multiple text data is consistent to the output unit 13.

[0050] Finally, the output unit 13 outputs information based on the analysis results regarding whether the information shown by multiple text data is consistent (for example, news articles whose content has been determined to be correct) (S103).

[0051] This concludes the operation of the information analysis device 10.

[0052] (Effects of this embodiment) According to the configuration of this embodiment, the acquisition unit 11 acquires multiple text data describing information security-related events. The analysis unit 12 uses information security-related knowledge information to analyze whether the information indicated by the multiple text data is consistent. The output unit 13 outputs information based on the analysis results regarding whether the information indicated by the multiple text data is consistent.

[0053] This allows us to identify text data that is inconsistent with other text data, even if some of the information in the multiple text data sets is outdated or contains errors, by determining whether the information presented in the multiple text data sets is consistent.

[0054] [Embodiment 2] Embodiment 2 of this disclosure will be described with reference to Figures 7 to 9. In Embodiment 1, news articles A and B (Figure 2) are not necessarily related to the same information security incident or accident. In Embodiment 2, a configuration will be described for selecting news articles X, Y, and Z (Figure 9) that are related to the same information security incident or accident.

[0055] In this second embodiment, components common to the first embodiment are denoted by the same reference numerals as in the first embodiment, and their descriptions are omitted.

[0056] (Configuration of the information analysis device 20) Referring to Figure 7, the configuration of the information analysis device 20 according to this second embodiment will be described. Figure 7 is a block diagram showing the configuration of the information analysis device 20.

[0057] As shown in Figure 7, the information analysis device 20 includes an acquisition unit 11, an analysis unit 12, an output unit 13, and a sorting unit 24.

[0058] The sorting unit 24 selects multiple text data from the collected text data that are related to the same information security incident or accident (an example of an information security-related event). The sorting unit 24 is an example of a sorting method.

[0059] For example, the selection unit 24 collects arbitrary news articles (an example of text data) from the internet or a server. Then, the selection unit 24 uses text analysis technology to extract specific keywords from each of the collected news articles. These specific keywords include "company name," "device name," and "vulnerability identifier (or type)."

[0060] The sorting unit 24 determines whether all of the specific keywords extracted from each of the collected news articles ("company name," "device name," and "vulnerability identifier (or type)") match. If a news article contains multiple company names or multiple device names, the sorting unit 24 determines whether all of the company names and all of the device names match among the collected news articles.

[0061] Alternatively, the selection unit 24 can use a large-scale language model 300 (an example of a "selection model") to select multiple text data related to the same information security incident or accident. For example, the selection unit 24 inputs an instruction to the large-scale language model 300 to determine if the data is related to the same information security incident or accident, the body of the news article to be judged, and a prompt containing the meaning of unique information contained in the news article to be judged. The selection unit 24 then obtains the judgment result output from the large-scale language model 300. In another example, the selection unit 24 calculates the similarity between multiple text data and determines that those with a similarity above a certain threshold are related to the same information security incident or accident.

[0062] The selection unit 24 selects multiple news articles that all match the extracted specific keywords. The selection unit 24 then outputs the selected news articles to the acquisition unit 11 as being related to the same information security incident or accident case.

[0063] The acquisition unit 11 retrieves multiple news articles from the selection unit 24 that have been selected as being related to the same information security incident or accident case. Then, as in the first embodiment, the acquisition unit 11 outputs the text data of the retrieved news articles to the analysis unit 12.

[0064] (Operation of the information analysis device 20) The operation of the information analysis device 20 according to this second embodiment will be explained with reference to Figure 8. Figure 8 is a flowchart showing the operation of the information analysis device 20.

[0065] As shown in Figure 8, first, the selection unit 24 selects multiple text data (for example, news articles) from the text data collected from the internet and other sources that are related to the same information security incident or accident (an example of an information security-related event) (S201). The selection unit 24 outputs the selected text data to the acquisition unit 11.

[0066] Next, the acquisition unit 11 acquires multiple text data describing information security-related events (S202). The acquisition unit 11 outputs the acquired multiple text data to the analysis unit 12.

[0067] Next, the analysis unit 12 uses information security-related knowledge to analyze whether the information shown by multiple text data (for example, the content of news articles) is consistent (S203). The analysis unit 12 outputs the analysis results regarding whether the information shown by the multiple text data is consistent to the output unit 13.

[0068] Finally, the output unit 13 outputs information based on the analysis results regarding whether the information shown by multiple text data is consistent (for example, news articles whose content has been determined to be correct) (S204).

[0069] This concludes the operation of the information analysis device 20.

[0070] (Effects of this embodiment) According to the configuration of this embodiment, the selection unit 24 selects multiple text data from the collected text data that are related to the same information security incident or accident case. The acquisition unit 11 acquires the multiple text data that have been selected as being related to the same information security incident or accident case. The analysis unit 12 uses information security-related knowledge information to analyze whether the information indicated by the multiple text data is consistent. The output unit 13 outputs information based on the analysis results regarding whether the information indicated by the multiple text data is consistent.

[0071] This allows us to identify text data that is inconsistent with other text data, even if some of the information in the multiple text data sets is outdated or contains errors, by determining whether the information presented in the multiple text data sets is consistent.

[0072] (Regarding hardware configuration) Each component of the information analysis devices 10 and 20 described in Embodiments 1 and 2 above represents a functional unit block. Some or all of these components are realized by an information processing device, such as the one shown in Figure 10. Figure 10 is a block diagram showing an example of the hardware configuration of the information processing device.

[0073] As shown in Figure 10, the computer 110 comprises a CPU (Central Processing Unit) 111, main memory 112, storage device 113, input interface 114, display controller 115, data reader / writer 116, and communication interface 117. These components are connected to each other via a bus 121, enabling data communication. In addition to the CPU 111, or in place of the CPU 111, the computer 110 may also include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array).

[0074] The CPU 111 loads the program (code) in this embodiment, stored in the storage device 113, into the main memory 112 and performs various calculations by executing them in a predetermined order. The main memory 112 is typically a volatile storage device such as DRAM (Dynamic Random Access Memory). The program in this embodiment is provided stored on a computer-readable recording medium 120. The program in this embodiment may also be distributed over the internet connected via the communication interface 117.

[0075] Specific examples of the storage device 113 include hard disk drives and semiconductor storage devices such as flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and mouse. The display controller 115 is connected to the display device 119 and controls the display on the display device 119.

[0076] The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, reads programs from the recording medium 120, and writes processing results from the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and other computers.

[0077] Specific examples of the recording medium 120 include general-purpose semiconductor memory devices such as CF (Compact Flash®) and SD (Secure Digital), magnetic recording media such as Flexible Disks, and optical recording media such as CD-ROMs (Compact Disk Read Only Memory).

[0078] (Note) Some or all of the above embodiments may also be described as follows, but are not limited to the following:

[0079] (Note 1) A means for acquiring multiple text data describing information security-related events, An analysis means that uses information security-related knowledge to analyze whether the information shown in the acquired multiple text data is consistent, An output means that outputs information based on the results of an analysis of whether the information shown in the acquired plurality of text data is consistent, An information analysis device.

[0080] (Note 2) The acquisition means acquires, as the plurality of text data, one or more cases of information security incidents or accidents and multiple news articles related thereto. The information analysis device described in Appendix 1, characterized by the features described herein.

[0081] (Note 3) The aforementioned analytical means is The aforementioned multiple text data or a portion thereof is input into the model. The model is made to determine whether the information indicated by the plurality of text data is consistent. An information analysis device as described in Appendix 1 or 2, characterized by the features described herein.

[0082] (Note 4) The aforementioned analytical means is Along with the aforementioned plurality of text data or a portion thereof, knowledge information related to the plurality of text data or a portion thereof is further input into the model. The model is made to determine whether the information indicated by the plurality of text data is consistent. The information analysis device described in Appendix 3, characterized by the features described herein.

[0083] (Note 5) The analysis means causes the model to summarize the information shown by the plurality of text data, and then causes the model to determine whether the summaries of the information shown by the plurality of text data are consistent. The information analysis device described in Appendix 3, characterized by the features described herein.

[0084] (Note 6) The analysis means inputs the titles of each of the multiple text data into the model. The information analysis device described in Appendix 5, characterized by the features described herein.

[0085] (Note 7) If the information indicated by the multiple text data is inconsistent, the analysis means determines that one or more of the multiple text data indicate the correct information. An information analysis device as described in any one of the appendices 1 to 6, characterized by the above.

[0086] (Note 8) The analysis means determines that, among the multiple text data, the text data with the most recent timestamp is the text data that represents correct information. The information analysis device described in Appendix 7, characterized by the features described herein.

[0087] (Note 9) The analysis means determines that the text data with the largest number of text data points that show consistent information among the multiple text data is the text data that shows correct information. The information analysis device described in Appendix 7, characterized by the features described herein.

[0088] (Note 10) The output means outputs information indicating whether the information shown by the plurality of text data is consistent. An information analysis device according to any one of the appendices 1 to 9, characterized by the above.

[0089] (Note 11) If the information indicated by the multiple text data is consistent, the output means outputs a summary of the information indicated by the multiple text data. An information analysis device according to any one of the appendices 1 to 9, characterized by the above.

[0090] (Note 12) The system further includes a selection mechanism for identifying multiple text data entries related to the same information security incident or accident from among the collected text data. The acquisition means acquires the multiple text data selected as being related to the same information security incident or accident case. An information analysis device according to any one of the appendices 1 to 11, characterized by the features described herein.

[0091] (Note 13) The sorting means is, The collected text data or a portion thereof is input into the sorting model. The sorting model is used to determine whether the collected text data is related to the same information security incident or accident. The information analysis device described in Appendix 12, characterized by the features described herein.

[0092] (Note 14) The sorting means is, Along with the aforementioned multiple text data or a portion thereof, knowledge information related to the aforementioned multiple text data or a portion thereof is further input into the selection model. Using the aforementioned knowledge information, the selection model is instructed to determine whether the collected text data is related to the same information security incident or accident. The information analysis device described in Appendix 13, characterized by the features described herein.

[0093] (Note 15) If certain keywords are common to different text data, the selection means determines that the different text data are related to the same information security incident or accident. The information analysis device described in Appendix 12, characterized by the features described herein.

[0094] (Note 16) The aforementioned specific keywords include at least a company name, a type of vulnerability, and a device name. The information analysis device described in Appendix 15, characterized by the features described herein.

[0095] (Note 17) Computers We retrieve multiple text data sets describing information security-related incidents. Using information security-related knowledge, analyze whether the information shown in the multiple text data obtained is consistent. The system outputs information based on the analysis results regarding whether the information shown in the acquired multiple text data is consistent. Information analysis methods that include this.

[0096] (Note 18) A process to retrieve multiple text data describing information security-related incidents, A process that uses information security-related knowledge to analyze whether the information shown in the acquired multiple text data is consistent, A process that outputs information based on the analysis results regarding whether the information shown in the acquired multiple text data is consistent, A program that causes a computer to execute something.

[0097] (Note 19) The aforementioned analytical means is A first characteristic word representing the cause of an information security incident or accident, and a second characteristic word representing the outcome of an information security incident or accident, are extracted from each of the aforementioned multiple text data. The first and second feature words extracted from each of the multiple text data sets are compared to each other to analyze whether both the first and second feature words are consistent. An information analysis device as described in Appendix 1 or 2, characterized by the features described herein.

[0098] Furthermore, some or all of the configurations described in Appendices 2 to 16 and 19, which are dependent on Appendice 1 above, may also be dependent on Appendices 17 and 18 in the same way as in Appendices 2 to 16 and 19. Moreover, within the scope that does not deviate from each of the embodiments described above, some or all of the configurations described as appendices may also be dependent on various hardware, software, various recording means for recording software, or systems.

[0099] The present disclosure has been described above with reference to several embodiments. However, the present disclosure is not limited to the embodiments described above. Each embodiment can be combined with other embodiments as appropriate. Furthermore, various modifications to the configuration and details of the above embodiments can be made that will be understood by those skilled in the art within the scope of the present disclosure. [Industrial applicability]

[0100] This disclosure can be used, for example, in information analysis technologies that analyze text data such as news articles. [Explanation of Symbols]

[0101] 10 Information analysis device 11 Acquisition Department 12 Analysis Department 13 Output section 20 Information analysis device 24 Sorting Department

Claims

1. A means for acquiring multiple text data describing information security-related events, An analysis means that uses information security-related knowledge to analyze whether the information shown in the acquired multiple text data is consistent, An output means that outputs information based on the results of an analysis of whether the information shown by the plurality of text data is consistent, An information analysis device equipped with this device.

2. The acquisition means acquires, as the plurality of text data, one or more cases of information security incidents or accidents and multiple news articles related thereto. The information analysis apparatus according to feature 1.

3. The aforementioned analytical means is The aforementioned multiple text data or a portion thereof is input into the model. The model is made to determine whether the information indicated by the plurality of text data is consistent. The information analysis device according to claim 1 or 2.

4. The aforementioned analytical means is Along with the aforementioned plurality of text data or a portion thereof, knowledge information related to the plurality of text data or a portion thereof is further input into the model. The model is made to determine whether the information indicated by the plurality of text data is consistent. The information analysis apparatus according to feature 3.

5. The analysis means causes the model to summarize the information shown by the plurality of text data, and then causes the model to determine whether the summaries of the information shown by the plurality of text data are consistent. The information analysis apparatus according to feature 3.

6. The analysis means inputs the titles of each of the multiple text data into the model. The information analysis apparatus according to feature 5.

7. If the information indicated by the plurality of text data is inconsistent, the analysis means determines that one or more of the plurality of text data indicate the correct information. The information analysis apparatus according to feature 1.

8. The analysis means determines that, among the multiple text data, the text data with the most recent timestamp is the text data that represents correct information. The information analysis apparatus according to feature 7.

9. The analysis means determines that the text data with the largest number of text data points that show consistent information among the multiple text data is the text data that shows correct information. The information analysis apparatus according to feature 7.

10. The output means outputs information indicating whether the information shown by the plurality of text data is consistent. The information analysis apparatus according to feature 1.

11. If the information indicated by the multiple text data is consistent, the output means outputs a summary of the information indicated by the multiple text data. The information analysis apparatus according to feature 1.

12. The system further includes a selection mechanism for identifying multiple text data entries related to the same information security incident or accident from among the collected text data. The acquisition means acquires the multiple text data selected as being related to the same information security incident or accident. The information analysis apparatus according to feature 1.

13. The sorting means is, The collected text data or a portion thereof is input into the sorting model. The sorting model is used to determine whether the collected text data is related to the same information security incident or accident. The information analysis apparatus according to feature 12.

14. The sorting means is, Along with the aforementioned multiple text data or a portion thereof, knowledge information related to the aforementioned multiple text data or a portion thereof is further input into the selection model. Using the aforementioned knowledge information, the selection model is instructed to determine whether the collected text data is related to the same information security incident or accident. The information analysis apparatus according to feature 13.

15. If certain keywords are common to different text data, the selection means determines that the different text data are related to the same information security incident or accident. The information analysis apparatus according to feature 12.

16. The aforementioned specific keywords include at least a company name, a type of vulnerability, and a device name. The information analysis apparatus according to feature 15.

17. Computers We retrieve multiple text data sets describing information security-related incidents. Using information security-related knowledge, analyze whether the information shown in the multiple text data obtained is consistent. The system outputs information based on the analysis results regarding whether the information indicated by the multiple text data sets is consistent. Information analysis methods that include this.

18. A process to retrieve multiple text data describing information security-related incidents, A process that uses information security-related knowledge to analyze whether the information shown in the acquired multiple text data is consistent, A process that outputs information based on the results of an analysis of whether the information shown by the multiple text data is consistent, A program that causes a computer to execute something.

Images