Text processing device, text processing method, and program

Abstract

The summary of a document describing an incident related to a specific information security vulnerability should include information about that incident. [Solution] The extraction unit extracts damage information, including keywords related to the content of the damage case, from a document describing an example of damage caused by a specific vulnerability in information security. The generation unit generates an explanation of the damage case using the damage information extracted from the document. The output unit outputs information based on the generated explanation.

Description

Technical Field

[0001] The present disclosure relates to a text processing device, a text processing method, and a program, and particularly relates to a text processing device, a text processing method, and a program for generating a summary of a sentence.

Background Art

[0002] In an example of related technology, a learned language model (such as LLM (Large Language Model), SLM (Small Language Model), etc.) is used to generate a summary (a summary of key points) of a document. Specifically, in the related technology, together with the sentence data, a prompt instructing the summary of the sentence is input to the language model. The language model generates and outputs a summary of the input sentence based on the content of the instruction.

[0003] Patent Document 1 describes extracting one or more matching chunks that match a query from one or more target chunks by referring to the input query, and inputting an instruction for generating a summary of the one or more target chunks to a language model.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] There may be many sentences (for example, news articles, reports) describing cases of damage related to certain vulnerabilities in information security. If such a large amount of sentence data is directly input to the language model that generates a summary, some of the main contents of the damage cases may be missing in the summary generated by the language model.

[0006] This disclosure is made in view of the above-mentioned issues, and its purpose is to ensure that summaries of documents describing incidents of damage related to a particular vulnerability in information security include information about those incidents. [Means for solving the problem]

[0007] A text processing device according to one aspect of this disclosure includes: an extraction means for extracting damage information, including keywords related to the content of the damage case, from a document describing an example of damage caused by a specific vulnerability in information security; a generation means for generating an explanation of the damage case using the damage information extracted from the document; and an output means for outputting information based on the generated explanation.

[0008] In one aspect of the present disclosure, a computer extracts damage information, including keywords related to the content of the damage incident, from a document describing an example of damage caused by a specific vulnerability in information security; generates an explanation of the damage incident using the damage information extracted from the document; and outputs information based on the generated explanation.

[0009] A program according to one aspect of this disclosure causes a computer to perform the following processes: extract damage information, including keywords related to the content of the damage case, from a document describing an example of damage caused by a specific vulnerability in information security; generate an explanation of the damage case using the damage information extracted from the document; and output information based on the generated explanation. [Effects of the Invention]

[0010] According to one aspect of this disclosure, a summary of a document describing an incident related to a particular vulnerability in information security may include information about that incident. [Brief explanation of the drawing]

[0011] [Figure 1] It is a block diagram showing the configuration of a text processing device according to an embodiment. [Figure 2] Examples of sentences (Article A, Article B) in which damage cases are described are shown. [Figure 3] Examples of damage information are shown. [Figure 4] Examples of explanations about damage cases are shown. [Figure 5] It is a flowchart showing the operation of a text processing device according to an embodiment. [Figure 6] It is a diagram showing an example of a system including a text processing device according to an embodiment. [Figure 7] An example of a first prompt is shown. [Figure 8] An example of a damage information database (DB) is shown. [Figure 9] It is a flowchart showing the operation of a text processing device according to an embodiment. [Figure 10] It is a diagram showing an example of a system including a text processing device according to an embodiment. [Figure 11] An example of a second prompt is shown. [Figure 12] Another example of a second prompt is shown. [Figure 13] Examples of knowledge information stored in the knowledge information DB are shown. [Figure 14] It is a flowchart showing the operation of a text processing device according to an embodiment. [Figure 15] It is a diagram showing an example of a system including a text processing device according to an embodiment. [Figure 16] It is a flowchart showing the operation of a text processing device according to an embodiment. [Figure 17] It is a diagram showing an example of the hardware configuration of a text processing device according to an embodiment.

Mode for Carrying Out the Invention

[0012] 〔Embodiment 1〕 Referring to FIGS. 1 to 5, Embodiment 1 of the present disclosure will be described.

[0013] (Configuration of Text Processing Device 10) FIG. 1 is a block diagram showing the configuration of a text processing device 10 according to Embodiment 1. As shown in FIG. 1, the text processing device 10 includes an extraction unit 11, a generation unit 12, and an output unit 13.

[0014] The extraction unit 11 extracts damage information (FIG. 3) including keywords related to the content of the damage case from a text (FIG. 2) in which a case of damage due to a certain specific vulnerability in information security is described. The extraction unit 11 is an example of extraction means. For example, keywords related to the content of the damage case are the name of the damaged company, the name of the damaged product, the name of the vendor, and the name of the damaged country.

[0015] Alternatively, the extraction unit 11 inputs a first prompt (FIG. 7) including a first instruction sentence specifying keywords related to the content of the damage case and the text to the first language model 100 (FIG. 6). Then, the extraction unit 11 may cause the first language model 100 to output damage information including keywords related to the content of the damage case from the input text.

[0016] In another example, the extraction unit 11 causes the first language model 100 to refer to basic information regarding a certain specific vulnerability in information security, and extracts keywords related to the content of the damage case from the input text.

[0017] Alternatively, the extraction unit 11 may further input knowledge information (FIG. 13) regarding the content of the damage case to the first language model 100, cause the first language model 100 to refer to the input knowledge information, and extract keywords related to the content of the damage case from the input text (a modification example of Embodiment 2).

[0018] The extraction unit 11 outputs the damage information including the keywords extracted from the input text to the generation unit 12.

[0019] The generation unit 12 generates a description of the damage case using damage information extracted from the text. The generation unit 12 is an example of a generation means. A description of a damage case refers to written information indicating the target of the damage (e.g., the affected company), the nature of the damage (e.g., the scale and scope of the damage), the date and time the damage occurred, and the location where the damage occurred (e.g., the country or region), all stemming from a specific vulnerability in information security. Specific examples of descriptions of damage cases will be described later (Figure 4).

[0020] For example, the generation unit 12 receives damage information from the extraction unit 11. The generation unit 12 refers to the damage information received from the extraction unit 11 and generates a description of the damage case.

[0021] In another example, the generation unit 12 inputs a second instruction sentence instructing the second language model 300 (Figure 10) to describe the damage case, and a second prompt (Figure 11) containing damage information and basic information, causing the second language model 300 to output a description of the damage case (Embodiment 3).

[0022] Alternatively, the generation unit 12 may further input basic information regarding a specific vulnerability in information security to the second language model 300, and cause the second language model 300 to refer to the basic information and output the damage information and the above-mentioned explanation of the damage case from the basic information (Embodiment 3).

[0023] Alternatively, the generation unit 12 may refer to the knowledge information DB 400 (Figure 10) and further input knowledge information (Figure 13) regarding the content of the damage cases into the second language model 300, causing the second language model 300 to refer to the knowledge information and output an explanation of the damage cases from the damage information and knowledge information (modification of Embodiment 3).

[0024] The generation unit 12 outputs an explanation of the damage case to the output unit 13.

[0025] The output unit 13 outputs information based on the description generated by the generation unit 12. The output unit 13 is an example of an output means. The information based on the description of the damage case is an example of a summary of the text describing the damage case, for example, the description of the damage case described above converted according to settings such as format, display format, character limit, and language. Note that the user may freely change these settings.

[0026] For example, the output unit 13 receives a description of the damage case from the generation unit 12. The output unit 13 outputs information based on the description of the damage case, or the description of the damage case itself generated by the generation unit 12, to an external device (not shown), such as a user terminal.

[0027] As described above, the text processing device 10 first extracts damage information from the text, then uses the extracted damage information to generate a description of the damage case, and outputs it. Therefore, the output description (summary) includes damage information that contains keywords related to the content of the damage case. This allows the user to accurately understand information about the damage case.

[0028] (Example of a document describing a case of damage) Figure 2 shows examples of articles describing damage cases. Figure 2 shows two articles, A and B (examples of articles describing damage cases). Article A states, "An attack exploiting a vulnerability (CVE-oooo-ooooo) in Company A's equipment B-1 occurred, resulting in 20 billion yen in damages at Company N in Japan." Article B states, "An attack exploiting a vulnerability (CVE-oooo-ooooo) in Company A's equipment B-1 occurred, resulting in 40 billion yen in damages at Company F in the United States."

[0029] Articles A and B both describe examples of damage caused by the same vulnerability. Note that Articles A and B shown in Figure 2 are merely examples of texts describing examples of damage caused by vulnerabilities.

[0030] (Example of damage information) Figure 3 shows an example of damage information extracted by the extraction unit 11 from a document (Figure 2) describing damage cases. In the example shown in Figure 3, the damage information includes "affected company," "amount of damage," "name of affected product," "name of vendor," and "affected country." The damage information may also include other information.

[0031] Figure 3 shows the damage information extracted from article A (Figure 2) mentioned above, which includes "Affected company: Company N", "Amount of damage: 20 billion", "Affected product name: B-1", "Vendor name: Company A", and "Affected country: Japan". Additionally, the damage information extracted from article B (Figure 2) mentioned above includes "Affected company: Company F", "Amount of damage: 40 billion", "Affected product name: B-1", "Vendor name: Company A", and "Affected country: United States".

[0032] (Example of an explanation of a case of damage) Figure 4 shows an example of a description of damage cases generated by the generation unit 12. In the example shown in Figure 4, it states, "This vulnerability is caused by the setting △△△ in the source code of product xx of Company A, and allows for privilege escalation and arbitrary code execution. To date, Company N has suffered damages of 20 billion yen in Japan, and Company F has suffered damages of 40 billion yen in the United States." This description was generated by the generation unit 12 based on the damage information exemplified in Figure 3.

[0033] (Operation of text processing device 10) The operation of the text processing device 10 according to this embodiment 1 will be explained with reference to Figure 5. Figure 5 is a flowchart showing the operation of the text processing device 10 according to this embodiment 1.

[0034] As shown in Figure 5, first, the extraction unit 11 extracts damage information, including keywords related to the content of the damage case, from a document describing an example of damage caused by a specific vulnerability in information security (S101). The extraction unit 11 outputs the damage information extracted from the document to the generation unit 12.

[0035] Next, the generation unit 12 generates a description of the damage case using the damage information extracted from the text describing the damage case (S102). The generation unit 12 outputs the description of the damage case to the output unit 13.

[0036] Subsequently, the output unit 13 outputs information based on the generated explanation (S103).

[0037] This concludes the operation of the text processing device 10 according to this embodiment 1.

[0038] (Effects of this embodiment) According to the configuration of this embodiment, the extraction unit 11 extracts damage information, including keywords related to the content of the damage incident, from a document describing an example of damage caused by a specific vulnerability in information security. The generation unit 12 generates an explanation of the damage incident using the damage information extracted from the document. The output unit 13 outputs information based on the generated explanation. In this way, the text processing device 10 first extracts damage information from the document, then uses the extracted damage information to generate an explanation of the damage incident, and outputs it. Therefore, the output explanation (summary) includes damage information, including keywords related to the content of the damage incident.

[0039] This allows summaries of documents describing incidents of damage related to a specific information security vulnerability to include information about those incidents.

[0040] [Embodiment 2] Embodiment 2 of this disclosure will be described with reference to Figures 6 to 9. In Embodiment 2, components common to Embodiment 1 may be denoted by the same reference numerals as in Embodiment 1, and their descriptions may be omitted.

[0041] (Configuration of the text processing device 20) Figure 6 is a block diagram showing the configuration of the text processing device 20 according to this second embodiment. As shown in Figure 6, the text processing device 20 includes an extraction unit 21, a generation unit 22, and an output unit 13.

[0042] The extraction unit 21 inputs a first prompt (Figure 7) to the first language model 100, which includes a first instruction sentence specifying keywords related to the content of the damage case and a sentence describing the damage case. The extraction unit 21 then causes the first language model 100 to output damage information, including keywords related to the content of the damage case, from the input sentence. The extraction unit 21 is an example of an extraction means. For example, keywords related to the content of the damage case may include the name of the affected company, the name of the affected product, the vendor name, and the name of the affected country.

[0043] Alternatively, the extraction unit 21 inputs basic information about a specific vulnerability in information security into the first language model 100, and causes the first language model 100 to refer to the input basic information and extract keywords related to the content of the damage case from the text describing the damage case.

[0044] In one modified example, the extraction unit 21 may further input knowledge information (Figure 10) regarding the content of the damage cases into the first language model 100, and then use the input knowledge information to have the first language model 100 extract keywords related to the content of the damage cases from the text describing the damage cases. For example, the knowledge information may include the "name" of an organization such as a company, and a "description" of the organization (Figure 13).

[0045] The extraction unit 21 stores damage information, including keywords extracted from texts describing damage cases, in the damage information database (DB) 200.

[0046] The generation unit 22 generates a description of the damage case by referring to the damage information stored in the damage information DB 200.

[0047] For example, the generation unit 22 refers to the damage information stored in the damage information DB 200 by the extraction unit 21 and generates a description of the damage case (Figure 4).

[0048] The generation unit 22 outputs an explanation of the damage case generated based on the damage information to the output unit 13.

[0049] The output unit 13 outputs information based on the description generated by the generation unit 22, similar to the first embodiment.

[0050] For example, the output unit 13 receives a description of the damage case from the generation unit 22. The output unit 13 outputs information based on the description of the damage case, or the description of the damage case itself generated by the generation unit 22, to an external device (not shown), such as a user terminal.

[0051] (Example of the first prompt) Figure 7 shows an example of a first prompt that includes a first instruction specifying the content of the damage case and related keywords, and a sentence describing the damage case. In the example shown in Figure 7, the first instruction is, "Extract all the content written under #Type of Damage Information from the following #News Article." Here, "Affected Company" is specified as "#Type of Damage Information." The sentence describing the damage case is, "#News Article An attack occurred that exploited a vulnerability (CVE-oooo-ooooo) in Company A's equipment B-1, resulting in 20 billion yen in damages at Company N in Japan."

[0052] (Example from Damage Information DB200) Figure 8 shows an example of the data structure of the damage information DB200, which stores damage information generated by the first language model 100 (Figure 6). In the example shown in Figure 8, the damage information DB200 contains damage information including "article title," "affected company," "amount of damage," "name of affected product," and "affected country." For example, in the second row of the damage information DB200, the "article title" is "article A," the "affected company" is "Company N," the "amount of damage" is "20 billion," the "name of affected product" is "B-1," and the "affected country" is "Japan."

[0053] (Operation of the text processing device 20) The operation of the text processing device 20 according to this second embodiment will be explained with reference to Figure 9. Figure 9 is a flowchart showing the operation of the text processing device 20 according to this second embodiment.

[0054] As shown in Figure 9, first, the extraction unit 21 causes the first language model 100 to output damage information that includes the content of the damage case and related keywords from a document describing an example of damage caused by a specific vulnerability in information security (S201). The extraction unit 21 stores the damage information extracted from the document in the damage information DB 200.

[0055] Next, the generation unit 22 generates a description of the damage case using the damage information stored in the damage information DB 200 (S202). The generation unit 22 outputs the description of the damage case to the output unit 13.

[0056] Subsequently, the output unit 13 outputs information based on the generated explanation (S203).

[0057] This concludes the operation of the text processing device 20 according to this second embodiment.

[0058] (Effects of this embodiment) According to the configuration of this embodiment, the extraction unit 21 causes the first language model 100 to output damage information, including keywords related to the content of the damage case, from a document describing an example of damage caused by a specific vulnerability in information security. The generation unit 22 generates an explanation of the damage case using the damage information stored in the damage information DB 200. The output unit 13 outputs information based on the generated explanation.

[0059] Thus, the text processing device 20 first extracts damage information from the text, then uses the extracted damage information to generate a description of the damage case, and outputs it. Therefore, the output description (summary) includes damage information that contains keywords related to the content of the damage case.

[0060] This allows summaries of documents describing incidents of damage related to a specific information security vulnerability to include information about those incidents.

[0061] [Embodiment 3] Embodiment 3 of this disclosure will be described with reference to Figures 10 to 14. In Embodiment 3, components common to Embodiment 1 are denoted by the same reference numerals as in Embodiment 1, and their descriptions may be omitted.

[0062] (Configuration of the text processing device 30) Figure 10 is a block diagram showing the configuration of the text processing device 30 according to this third embodiment. As shown in Figure 10, the text processing device 30 includes an extraction unit 31, a generation unit 32, and an output unit 13.

[0063] The extraction unit 31 extracts damage information (Figure 3) from text (Figure 2) describing examples of damage caused by vulnerabilities, including keywords related to the content of the damage cases.

[0064] Alternatively, similar to the extraction unit 21 in Embodiment 2, the extraction unit 31 may further input knowledge information regarding the content of the damage cases into the first language model 100 (Figure 6), and use the input knowledge information to have the first language model 100 extract keywords related to the content of the damage cases from the text describing the damage cases. For example, the knowledge information may include the "name" of an organization such as a company, and a "description" of the organization (Figure 13).

[0065] The extraction unit 31 outputs damage information containing keywords extracted from the input text to the generation unit 12.

[0066] The generation unit 32 inputs a second instruction sentence instructing the second language model 300 to describe the damage case, along with a second prompt containing damage information. The generation unit 32 then causes the second language model 300 to output a description of the damage case (Figure 4).

[0067] Alternatively, the generation unit 32 further inputs basic information about a specific vulnerability in information security to the second language model 300. The generation unit 32 may also cause the second language model 300 to refer to the basic information stored in the basic information DB (not shown) and output damage information and a description of the damage case based on the basic information.

[0068] Furthermore, in one modified example, the generation unit 32 may refer to the knowledge information DB 400 (Figure 10) and, in addition to the damage information, or in addition to the damage information and basic information, use the knowledge information to cause the second language model 300 to output an explanation of the damage case. For example, the knowledge information may include the "name" of an organization such as a company, and a "description" of the organization (Figure 13).

[0069] Furthermore, in another variation, if there is a large amount of information in one piece of damage information, such as 100 affected companies, the generation unit 32 may consolidate that information and generate a natural summary. In this case, for example, "#Summary of each type of damage information / higher-level concept Affected company: IT service company, Affected product name: Firewall" is added to the second prompt, and the instruction statement is updated with the sentence, "#Refer to the summary of each type of damage information / higher-level concept, consolidate the types of damage information, and extract them as a higher-level concept."

[0070] The generation unit 32 outputs to the output unit 13 an explanation of the damage case generated by the second language model 300 based on the damage information.

[0071] The output unit 13 outputs information based on the description generated by the generation unit 32, similar to the first embodiment.

[0072] For example, the output unit 13 receives a description of the damage case from the generation unit 32. The output unit 13 outputs information based on the description of the damage case, or the description of the damage case itself generated by the second language model 300, to an external device (not shown), such as a user terminal.

[0073] (Example of a second prompt: Part 1) Figure 11 shows an example of a second instruction statement that specifies the content of the damage case and related keywords, and a second prompt that includes basic information and damage information. In the example shown in Figure 11, the second instruction statement is: "The following information is a description of "CVE-oooo-xxxxx". Summarize and output the latest information on the vulnerability from the following #basic information and #damage information. #The damage information refers to each case, so output the description in a way that does not lose the relationship between each case." The "basic information" is: "This is a vulnerability that allows privilege escalation and arbitrary code execution due to the setting of △△△ in the source code of product xx of company ○○." The "damage information" is: "Article A: {Affected company: Company N, Damage amount: 20 billion yen, Affected product name: B-1, Vendor name: Company A, Affected country: Japan}, Article B: {Affected company: Company F, Damage amount: 40 billion yen, Affected product name: B-1, Vendor name: Company A, Affected country: United States}."

[0074] (Example of the second prompt: Part 2) Figure 12 shows another example of a second prompt that includes a second instruction specifying the content of the damage case and related keywords, as well as basic information and damage information. In the example shown in Figure 12, the second instruction is: "The following information is a description of "CVE-oooo-xxxxx". Summarize and output the latest information on the vulnerability from the following #basic information and #damage information. Also, refer to the #knowledge information for the meaning of proper nouns that appear in the article. The #damage information refers to each case, so output the explanation in a way that does not lose the relationship between each case." The "basic information" and "damage information" are the same as in the example above (Figure 11).

[0075] In the example of the second prompt shown in Figure 12, in addition to damage information and basic information, knowledge information is further used to cause the second language model 300 to output a description of the damage case. In this example, the "knowledge information" is "Company N is headquartered in M ​​Ward, Tokyo...", "Company A is...", and "CVE-oooo-xxxxx is a privilege escalation vulnerability."

[0076] (Examples of knowledge information) Figure 13 shows an example of knowledge information as described in the example of the second prompt (Figure 12). In the example shown in Figure 13, the knowledge information includes the company name, product name, and vulnerability category, as well as a description of them.

[0077] (Operation of the text processing device 30) The operation of the text processing device 30 according to this third embodiment will be explained with reference to Figure 14. Figure 14 is a flowchart showing the operation of the text processing device 30 according to this third embodiment.

[0078] As shown in Figure 14, first, the extraction unit 31 extracts damage information, including keywords related to the content of the damage cases, from the text describing the damage cases (Figure 2) (S301). The extraction unit 31 outputs the damage information extracted from the text describing the damage cases to the generation unit 32.

[0079] Next, the generation unit 32 inputs a second prompt containing the damage information extracted from the text by the extraction unit 31 to the second language model 300, causing the second language model 300 to output a description of the damage case (S302). The generation unit 32 then outputs the description of the damage case output by the second language model 300 to the output unit 13.

[0080] Subsequently, the output unit 13 outputs information based on the generated explanation (S303).

[0081] This concludes the operation of the text processing device 30 according to this third embodiment.

[0082] (Effects of this embodiment) According to the configuration of this embodiment, the extraction unit 31 extracts damage information, including keywords related to the content of the damage case, from a document describing a case of damage caused by a vulnerability. The generation unit 32 inputs a second prompt, including a second instruction and damage information, to the second language model 300, causing the second language model 300 to output an explanation of the damage case. The output unit 13 outputs information based on the explanation generated by the second language model 300.

[0083] Thus, the text processing device 30 first extracts damage information from the text, then uses the extracted damage information to generate a description of the damage case, and outputs it. Therefore, the output description (summary) includes damage information that contains keywords related to the content of the damage case.

[0084] This allows summaries of documents describing incidents of damage related to a specific information security vulnerability to include information about those incidents.

[0085] [Embodiment 4] Embodiment 4 of this disclosure will be described with reference to Figures 15 to 16. In Embodiment 4, components common to Embodiment 1 are denoted by the same reference numerals as in Embodiment 1, and their descriptions may be omitted.

[0086] (Configuration of the text processing device 40) Figure 15 is a block diagram showing the configuration of the text processing device 40 according to this fourth embodiment. As shown in Figure 15, the text processing device 40 includes an extraction unit 41, a generation unit 42, and an output unit 13.

[0087] The extraction unit 41 inputs a first prompt (Figure 7) to the first language model 100, which includes a first instruction sentence specifying keywords related to the content of the damage case and a sentence describing the damage case. The extraction unit 41 then causes the first language model 100 to output damage information, including keywords related to the content of the damage case, from the input sentence. The extraction unit 41 is an example of an extraction means. For example, keywords related to the content of the damage case may include the name of the affected company, the name of the affected product, the vendor name, and the name of the affected country.

[0088] Alternatively, the extraction unit 41 inputs basic information about a specific vulnerability in information security into the first language model 100, and causes the first language model 100 to refer to the input basic information and extract keywords related to the content of the damage case from the text describing the damage case.

[0089] The extraction unit 41 stores damage information, including keywords extracted from texts describing damage cases, in the damage information database (DB) 200.

[0090] The generation unit 42 inputs a second instruction sentence instructing the second language model 300 to describe the damage case, and a second prompt containing damage information, to the second language model 300. The generation unit 42 then causes the second language model 300 to output a description of the damage case (Figure 4).

[0091] Alternatively, the generation unit 42 may further input knowledge information regarding the content of the damage case into the second language model 300. The generation unit 42 may also cause the second language model 300 to refer to the knowledge information stored in the knowledge information DB 400 (Figure 15) and output a description of the damage case from the damage information and knowledge information. For example, the knowledge information may include the "name" of an organization such as a company, and a "description" of the organization (Figure 13).

[0092] Furthermore, in one modified example, the generation unit 42 may use, in addition to the damage information, or in addition to the damage information and knowledge information, basic information regarding a specific vulnerability in information security to cause the second language model 300 to output an explanation of the damage case.

[0093] The generation unit 42 outputs to the output unit 13 an explanation of the damage case generated by the second language model 300 based on the damage information.

[0094] The output unit 13 outputs information based on the description generated by the generation unit 42, similar to the first embodiment.

[0095] For example, the output unit 13 receives a description of the damage case from the generation unit 42. The output unit 13 outputs information based on the description of the damage case, or the description of the damage case itself generated by the second language model 300, to an external device (not shown), such as a user terminal.

[0096] (Operation of the text processing device 40) The operation of the text processing device 40 according to this embodiment 4 will be explained with reference to Figure 16. Figure 16 is a flowchart showing the operation of the text processing device 40 according to this embodiment 4.

[0097] As shown in Figure 16, first, the extraction unit 41 causes the first language model 100 to output damage information that includes the content of the damage case and related keywords from a document describing an example of damage caused by a specific vulnerability in information security (S401). The extraction unit 41 stores the damage information extracted from the document in the damage information DB 200.

[0098] Next, the generation unit 42 inputs a second prompt containing damage information stored in the damage information DB 200 to the second language model 300, causing the second language model 300 to output a description of the damage case (S402). The generation unit 42 then outputs the description of the damage case output by the second language model 300 to the output unit 13.

[0099] Subsequently, the output unit 13 outputs information based on the generated explanation (S403).

[0100] This concludes the operation of the text processing device 40 according to this fourth embodiment.

[0101] (Effects of this embodiment) According to the configuration of this embodiment, the extraction unit 41 causes the first language model 100 to output damage information, including the content of the damage case and related keywords, from a document describing an example of damage caused by a specific vulnerability in information security. The generation unit 42 inputs a second prompt, including a second instruction and damage information, to the second language model 300, causing the second language model 300 to output a description of the damage case. The output unit 13 outputs information based on the description generated by the second language model 300.

[0102] Thus, the text processing device 40 first extracts damage information from the text, then uses the extracted damage information to generate a description of the damage case, and outputs it. Therefore, the output description (summary) includes damage information that contains keywords related to the content of the damage case.

[0103] This allows summaries of documents describing incidents of damage related to a specific information security vulnerability to include information about those incidents.

[0104] (Hardware configuration) The components of the text processing devices 10, 20, 30, and 40 described in Embodiments 1 to 4 above represent functional units. Some or all of these components are realized by an information processing device, for example, as shown in Figure 17. Figure 17 is a block diagram showing an example of the hardware configuration of the information processing device.

[0105] As shown in Figure 17, the computer 110 comprises a CPU (Central Processing Unit) 111, main memory 112, storage device 113, input interface 114, display controller 115, data reader / writer 116, and communication interface 117. Each of these components is connected to each other via a bus 121 to enable data communication. In addition to the CPU 111, or in place of the CPU 111, the computer 110 may also include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array).

[0106] The CPU 111 loads the program (code) in this embodiment, stored in the storage device 113, into the main memory 112 and performs various calculations by executing them in a predetermined order. The main memory 112 is typically a volatile storage device such as DRAM (Dynamic Random Access Memory). The program in this embodiment is provided stored on a computer-readable recording medium 120. The program in this embodiment may also be distributed over the internet connected via the communication interface 117.

[0107] Specific examples of the storage device 113 include hard disk drives and semiconductor storage devices such as flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and mouse. The display controller 115 is connected to the display device 119 and controls the display on the display device 119.

[0108] The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, reads programs from the recording medium 120, and writes processing results from the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and other computers.

[0109] Specific examples of the recording medium 120 include general-purpose semiconductor memory devices such as CF (Compact Flash®) and SD (Secure Digital), magnetic recording media such as Flexible Disks, and optical recording media such as CD-ROMs (Compact Disk Read Only Memory).

[0110] (Note) Some or all of the above embodiments may also be described as follows, but are not limited to the following:

[0111] (Note 1) An extraction means for extracting damage information containing keywords related to the content of the damage incident from a document describing an example of damage caused by a specific vulnerability in information security, A generation means that generates an explanation of the damage case using the damage information extracted from the aforementioned text, The system includes an output means for outputting information based on the generated description. Text processing device.

[0112] (Note 2) The extraction means inputs a first prompt, which includes a first instruction sentence specifying the keywords related to the content of the damage case and the text, into the first language model, thereby causing the first language model to output damage information, including the keywords related to the content of the damage case, from the text. The text processing device according to Appendix 1, characterized in that it is a text processing device.

[0113] (Note 3) The extraction means is Further input of knowledge information regarding a specific vulnerability in information security into the first language model, The first language model is made to refer to the knowledge information and extract keywords from the text that are related to the content of the damage cases. The text processing device described in Appendix 2, characterized in that it is a text processing device.

[0114] (Note 4) The extraction means stores the damage information, including the keywords extracted from the text, in the damage information database. The text processing device according to Appendix 1, characterized in that it is a text processing device.

[0115] (Note 5) The generation means generates the description of the damage case by referring to the damage information stored in the damage information database. The text processing device described in Appendix 4, characterized in that it is a text processing device.

[0116] (Note 6) The generating means is A second instruction sentence instructing the model to describe the aforementioned damage case, and a second prompt containing the aforementioned damage information, are input to the second language model. The second language model is made to output the explanation regarding the aforementioned damage case. A text processing device according to any one of the appendices 1 to 4, characterized in that it is a text processing device.

[0117] (Note 7) The generating means is Further input of basic information regarding a specific vulnerability in information security into the second language model, The second language model is made to refer to the basic information and output the description of the damage case from the damage information and the basic information. The text processing device according to Appendix 6, characterized in that it is a text processing device.

[0118] (Note 8) The generating means is Knowledge information regarding the details of the aforementioned damage cases is further input into the second language model. The second language model is made to refer to the knowledge information and output the description of the damage case from the damage information and the knowledge information. A text processing device according to appendix 6 or 7, characterized in that it is a text processing device.

[0119] (Note 9) The output means outputs information regarding a specific vulnerability in information security, and information regarding the incident. The text processing device according to Appendix 1, characterized in that it is a text processing device.

[0120] (Note 10) The aforementioned text includes an article describing an example of damage caused by a specific vulnerability in information security. The text processing device according to Appendix 1, characterized in that it is a text processing device.

[0121] (Note 11) The aforementioned keywords include at least one of the following: the name of an organization affected by a specific information security vulnerability, the amount of damage, the name of the product affected, and the country where the damage occurred. The text processing device according to Appendix 1, characterized in that it is a text processing device.

[0122] (Note 12) The aforementioned basic information includes characteristics of a specific vulnerability in information security, The text processing device according to Appendix 1, characterized in that it is a text processing device.

[0123] (Note 13) Computers From a document describing an example of damage caused by a specific vulnerability in information security, we extract damage information that includes keywords related to the content of the aforementioned damage case. Using the damage information extracted from the aforementioned text, a description of the damage case is generated. Output information based on the generated description. Text processing methods.

[0124] (Note 14) On the computer, A process to extract damage information containing keywords related to the content of the damage incident from a document describing an example of damage caused by a specific vulnerability in information security, and A process to generate an explanation of the damage case using the damage information extracted from the aforementioned text, A process to output information based on the generated description, A program to execute.

[0125] Furthermore, some or all of the configurations described in Appendices 2 to 12, which are dependent on Appendice 1 (e.g., text processing device) as described above, may also be dependent on Appendice 13 (e.g., text processing method) and Appendice 14 (e.g., program) in the same dependent relationship as Appendices 2 to 12. Moreover, within the scope that does not deviate from each of the embodiments described above, some or all of the configurations described as appendices may also be dependent on various hardware, software, various recording means for recording software, or systems.

[0126] The present disclosure has been described above with reference to several embodiments. However, the present disclosure is not limited to the embodiments described above. Each embodiment can be combined with other embodiments as appropriate. Furthermore, various modifications to the configuration and details of the above embodiments can be made that will be understood by those skilled in the art within the scope of the present disclosure. [Industrial applicability]

[0127] This disclosure can be used in a text processing device that generates a summary of input text. [Explanation of Symbols]

[0128] 10 Text Processing Device 11 Extraction part 12 Generation part 13 Output section 20 Text Processing Devices 21 Extraction part 22 Generation part 30 Text Processing Devices 31 Extraction part 32 Generation part 40 Text Processing Devices 41 Extraction part 42 Generation part 100 First Language Models 200 Damage Information Database 300 Second Language Models 400 Knowledge information DB

Claims

1. An extraction means for extracting damage information containing keywords related to the content of the damage incident from a document describing an example of damage caused by a specific vulnerability in information security, A generation means that generates an explanation of the damage case using the damage information extracted from the aforementioned text, The system includes an output means for outputting information based on the generated description. Text processing device.

2. The extraction means inputs a first prompt, which includes a first instruction sentence specifying the keywords related to the content of the damage case and the text, into the first language model, thereby causing the first language model to output damage information, including the keywords related to the content of the damage case, from the text. The text processing device according to feature 1.

3. The extraction means is Further input of knowledge information regarding a specific vulnerability in information security into the first language model, The first language model is made to refer to the knowledge information and extract keywords from the text that are related to the content of the damage cases. The text processing device according to claim 2.

4. The extraction means stores the damage information, including the keywords extracted from the text, in the damage information database. The text processing device according to feature 1.

5. The generation means generates the description of the damage case by referring to the damage information stored in the damage information database. The text processing device according to feature 4.

6. The generating means is A second instruction sentence instructing the model to describe the aforementioned damage case, and a second prompt containing the aforementioned damage information, are input into the second language model. The second language model is made to output the explanation regarding the aforementioned damage case. A text processing device according to any one of claims 1 to 4.

7. The generating means is Further input of basic information regarding a specific vulnerability in information security into the second language model, The second language model is made to refer to the basic information and output the description of the damage case from the damage information and the basic information. The text processing device according to claim 6.

8. The generating means is Knowledge information regarding the details of the aforementioned damage cases is further input into the second language model. The second language model is made to refer to the knowledge information and output the description of the damage case from the damage information and the knowledge information. The text processing device according to claim 6.

9. Computers From a document describing an example of damage caused by a specific vulnerability in information security, we extract damage information that includes keywords related to the content of the aforementioned damage case. Using the damage information extracted from the aforementioned text, a description of the damage case is generated. Output information based on the generated description. Text processing methods.

10. On the computer, A process to extract damage information containing keywords related to the content of the damage incident from a document describing an example of damage caused by a specific vulnerability in information security, A process to generate an explanation of the damage case using the damage information extracted from the aforementioned text, A process to output information based on the generated description, A program to execute.

Images