Document creation support device, document creation support method, and program

Abstract

One of the purposes of this disclosure is to provide document creation support devices, etc., that can assist in the creation of cybersecurity reports tailored to specific needs. [Solution] A document creation support device according to one aspect of the present disclosure includes: a receiving means for receiving input of instruction information including instructions regarding the content of a report related to cybersecurity and reader information indicating the type of reader; a generating means for generating a report that includes information on threats corresponding to the instruction information, based on the result of referencing information related to the instruction information, and which includes matters of interest of the reader according to the type of reader; and an output means for outputting the generated report.

Description

Technical Field

[0001] This disclosure relates to a document creation support device, a document creation support method, and a program.

Background Art

[0002] In order to prevent cybercrime, it is necessary to grasp various types of information related to cybersecurity, such as attack methods and countermeasure methods. For this purpose, analysts may create reports on cybersecurity. At this time, a report may be created when an analyst manually collects information related to cybersecurity and analyzes the collected information.

[0003] Patent Document 1 discloses a technique for outputting information about cybersecurity events. For example, Patent Document 1 describes collecting events and network flow data and generating a report.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] Depending on the situation, the information required for the report may vary. For example, regarding a predetermined security incident, the information that a person wants to know may differ. Therefore, it is required to create a report that takes into account the needs in various situations.

[0006] One of the objectives of this disclosure is made in view of the above problems, and to provide a document creation support device and the like that can support the creation of a report on cybersecurity according to needs. [Means for solving the problem]

[0007] A document creation support device according to one aspect of this disclosure includes: a receiving means for receiving instruction information including instructions regarding the content of a cybersecurity-related report and reader information indicating the type of reader; a generating means for generating a report that includes information on threats corresponding to the instruction information, based on the result of referencing information related to the instruction information, and which includes matters of interest for the reader according to the type of reader; and an output means for outputting the generated report.

[0008] A document creation support method according to one aspect of this disclosure receives input of instruction information including instructions regarding the content of a cybersecurity-related report and reader information indicating the type of reader, generates a report that includes information on threats corresponding to the instruction information, based on the result of referencing information related to the instruction information, and includes the reader's interests according to the type of reader, and outputs the generated report.

[0009] A program according to one aspect of this disclosure causes a computer to perform the following processes: receiving input of instruction information including instructions regarding the content of a cybersecurity-related report and reader information indicating the type of reader; generating a report that includes information on threats corresponding to the instruction information, based on the results of referencing information related to the instruction information, and that includes matters of interest for the reader according to the type of reader; and outputting the generated report. [Effects of the Invention]

[0010] This disclosure indicates that we can assist in creating cybersecurity reports tailored to specific needs. [Brief explanation of the drawing]

[0011] [Figure 1]This block diagram shows an example of the functional configuration of the document creation support device disclosed herein. [Figure 2] This is the first flowchart illustrating an example of the operation of the document creation support device described herein. [Figure 3] This diagram schematically shows an example of a configuration including the document creation support device described herein. [Figure 4] This is a first block diagram including an example of the functional configuration of the document creation support device of this disclosure. [Figure 5] This figure shows an example of the input display for this disclosure. [Figure 6] This figure shows an example of prompt pattern information in this disclosure. [Figure 7] This figure shows an example of synonym data in this disclosure. [Figure 8] This figure shows an example of a report in this disclosure. [Figure 9] This is a second flowchart illustrating an example of the operation of the document creation support device described herein. [Figure 10] An example of authenticity pattern information for this disclosure is shown below. [Figure 11] This is a diagram showing an example of the hardware configuration of a computer device that implements the document creation support device of this disclosure. [Modes for carrying out the invention]

[0012] Embodiments of this disclosure will be described below with reference to the drawings.

[0013] <First Embodiment> An overview of the document creation support device of the first embodiment will be described.

[0014] The document creation support device of the present disclosure generates a report related to cybersecurity in response to an input instruction. Hereinafter, cybersecurity may also be simply referred to as "security". The document creation support device also outputs the generated report. Here, the document creation support device may be communicably connected to the terminal device via a network. For example, the document creation support device outputs the report to the terminal device. The terminal device is a device having an input / output function that is used by a user. The user may be, for example, a person in charge of creating a report, such as a security analyst, or a reader of the distributed report. That is, the report generated by the document creation support device may be a report draft editable by the person in charge for report creation, or a report directly distributed to the reader.

[0015] FIG. 1 is a first block diagram showing an example of the functional configuration of the document creation support device. As shown in FIG. 1, the document creation support device 100 includes a reception unit 110, a generation unit 120, and an output unit 130.

[0016] The reception unit 110 receives an input of instruction information including an instruction regarding the content of the report. The instruction information includes, for example, information indicating the theme of the report. The theme shows characteristics in a cyber attack, such as an attacker, an attack method, a target, a vulnerability, a damage situation, and the type of malware used. Hereinafter, the characteristics in a cyber attack are also referred to as information regarding threats. Note that the theme may indicate an information source including information regarding threats, and a language task for the information source, such as a summary and a translation. The example of the language task is not limited to this example. For example, the language task may include keyword extraction and text structuring. The instruction information is not limited to these examples.

[0017] In addition, the reception unit 110 receives an input of information indicating the type of the reader of the report. The type of the reader is, for example, a manager, an incident responder, and an operator of the system. The type of the reader is not limited to this example. The information indicating the type of the reader is also referred to as reader information.

[0018] The reception unit 110 may receive, for example, the instruction information and the reader information input by a user's operation by acquiring them from the terminal device.

[0019] In this way, the reception unit 110 receives the input of the instruction information including an instruction regarding the content of the report related to cyber security and the reader information indicating the type of the reader. The reception unit 110 is an example of reception means.

[0020] The generation unit 120 generates a report. Specifically, the generation unit 120 may generate a report based on the instruction information and the reader information.

[0021] [[ID=IS]]Here, the generation unit 120 may utilize a learning model. For example, the generation unit 120 may generate a report using a generated sentence output from a natural language processing model such as a large language model (LLM). As an example, the generation unit 120 inputs a prompt based on the instruction information and the reader information into the natural language processing model and acquires the generated sentence output by the natural language processing model. At this time, the generated sentence includes information regarding a threat corresponding to the instruction information. Also, a prompt corresponding to the type of the reader may be input. For example, an instruction to output the generated sentence including the reader's concerns may be included in the prompt. Thereby, the generated sentence output from the natural language processing model includes the reader's concerns. Then, the generation unit 120 may generate a report by converting the acquired generated sentence into a report format.

[0022] Furthermore, the generation unit 120 may generate a report based on the results of referencing information related to the instruction information. For example, the generation unit 120 may refer to information related to the instruction information from a predetermined database. Then, the generation unit 120 may generate a report using a generated sentence obtained by inputting the reference results and prompts to the natural language processing model described above. In this case, the generation unit 120 may search the predetermined database for information about threats contained in the instruction information. Then, the generation unit 120 may input the search results and prompts to a natural language processing model such as a large-scale language model. Note that the report generation method is not limited to this example.

[0023] Thus, the generation unit 120 generates a report that includes information about threats corresponding to the instruction information, based on the results of referencing information related to the instruction information, and that includes matters of interest to the reader according to the type of reader. The generation unit 120 is an example of a generation means.

[0024] The output unit 130 outputs the generated report. For example, the report may be output to a terminal device by the output unit 130, and the report may be displayed on the display of the terminal device. The output unit 130 is an example of an output means.

[0025] Next, an example of the operation of the document creation support device 100 will be explained using Figure 2. In this disclosure, each step of the flowchart will be represented by a number assigned to each step, such as "S1".

[0026] Figure 2 is a first flowchart illustrating an example of the operation of the document creation support device 100.

[0027] The reception unit 110 accepts input of instruction information, which includes instructions regarding the content of reports related to cybersecurity, and reader information, which indicates the type of reader (S1).

[0028] The generation unit 120 generates a report that includes information about threats corresponding to the instruction information, based on the results of referencing information related to the instruction information, and that includes matters of interest for readers according to the type of reader (S2).

[0029] The output unit 130 outputs the generated report (S3).

[0030] Thus, the document creation support device 100 of the first embodiment receives instruction information, which includes instructions regarding the content of a report related to cybersecurity, and reader information, which indicates the type of reader. The document creation support device 100 also generates a report that includes information about threats corresponding to the instruction information, based on the results of referencing information related to the instruction information, and that includes the reader's interests according to the type of reader. The document creation support device 100 then outputs the generated report.

[0031] This allows the document creation support device 100 to generate reports that anticipate the reader's needs. In other words, the document creation support device 100 can assist in creating cybersecurity reports that meet specific needs.

[0032] <Second Embodiment> Next, a document creation support device according to a second embodiment will be described. In the second embodiment, further examples relating to the document creation support device described in the first embodiment will be described. Note that some explanations that overlap with the first embodiment will be omitted.

[0033] Figure 3 is a schematic diagram illustrating an example of a configuration including a document creation support device. As shown in Figure 3, the document creation support device 100 is connected to the model management server 200, the collection server 300, and the terminal device 400 via a wired or wireless network.

[0034] The model management server 200 is a device that has a learning model. An example of a learning model is a natural language processing model that generates text in response to an input sentence and outputs the generated text. For example, the learning model is a large-scale language model. A large-scale language model is a language model constructed using a large dataset and techniques such as deep learning. A large-scale language model may have the capability to perform complex language tasks such as text generation, question answering, and summarization. In this disclosure, an example is described in which the model management server 200 is a device that has a large-scale language model.

[0035] The collection server 300 is a device that collects information. Specifically, the collection server 300 collects cybersecurity-related information from external servers and other sources via a network.

[0036] Terminal device 400 is a device used by a user. The user is, for example, a person involved in creating cybersecurity reports. The user may be an analyst, a Security Operation Center (SOC) operator, a security incident responder, or a system operator.

[0037] Note that the configuration is not limited to this example, and the document creation support device 100 may be connected in a way that allows it to communicate with the distribution server. For example, the document creation support device 100 may be able to communicate with the distribution server. The distribution server has the function of distributing reports output from the document creation support device 100. In this case, the distribution server may distribute the reports generated by the document creation support device 100 as they are, or it may distribute reports that have been modified or reviewed by the person responsible for creating the reports. Note that the distribution server and the document creation support device 100 may be the same device. The document creation support device 100 may also have the function of distributing reports.

[0038] Figure 4 is a first block diagram including an example of the functional configuration of a document creation support device. Specifically, Figure 4 shows a document creation support system 1000 including a document creation support device 100 and a terminal device 400. The document creation support system 1000 comprises the document creation support device 100, a model management server 200, and a collection server 300.

[0039] The model management server 200 includes a model management unit 210. The model management unit 210 stores large-scale language models and related programs. When a prompt is input, the model management unit 210 generates a sentence indicating the answer corresponding to the prompt. The model management unit 210 then outputs the generated sentence. At this time, the sentence generated by the model management unit 210 is called a generated sentence. The large-scale language model may be, for example, GPT-2, GPT-3, GPT-3.5, GPT-4, or GPT-4o. The large-scale language model may also be Claude3, Claude3.5, T5, BERT, RoBERTa, or ELECTRA. The large-scale language model is not limited to these examples. The model management server 200 may also be a device of the document creation support device 100. In this case, the document creation support device 100 may have the model management unit 210. The model management server 200 may also be an external device capable of communicating with the document creation support system 1000.

[0040] The collection server 300 includes a collection unit 310. The collection unit 310 collects various types of information via the network from devices that store information, such as external servers. At this time, the collection unit 310 collects security-related information. The information collected by the collection unit 310 is also referred to as external information. External information includes, for example, news distributed by mass media, information stored by relevant organizations such as government agencies and private organizations that oversee security, and security-related posts on SNS (Social Networking Service). As an example, the collection unit 310 may collect information using technologies such as crawlers. That is, the collection unit 310 may periodically collect security-related information via the network. The collection unit 310 stores the collected external information in the storage device 190, which will be described later.

[0041] The terminal device 400 has input devices 410 such as a keyboard and a touch panel. The terminal device 400 also has output devices 420 such as a display and a speaker. The terminal device 400 is, for example, a personal computer, a smartphone, and a tablet terminal, but is not limited to these examples. The terminal device 400 only needs to have an input device 410 that can input instruction information and reader information, and an output device 420 that can output information output by the document creation support device 100.

[0042] The document creation support device 100 includes a reception unit 110, a generation unit 120, and an output unit 130. The document creation support device 100 also includes a storage device 190.

[0043] The storage device 190 stores various types of information. The storage device 190 may also function as a database server. In the example shown in Figure 4, the storage device 190 includes an internal information storage unit 191, an external information storage unit 192, a prompt storage unit 193, and a synonym data storage unit 194.

[0044] The storage device 190 may be an external device capable of communicating with the document creation support device 100. Furthermore, the storage device 190 may be composed of multiple storage devices. In this case, some of the multiple storage devices may be external devices capable of communicating with the document creation support device 100. Additionally, some of the multiple functional units of the storage device 190 may be implemented by external devices capable of communicating with the document creation support device 100.

[0045] The reception unit 110 receives instruction information and reader information. For example, a user inputs instruction information and reader information using the input device 410 of the terminal device 400. The information entered in the terminal device 400 is received by the reception unit 110.

[0046] Instruction information and reader information may be entered by the user as text data. Specifically, the user may enter a sentence as instruction information. For example, the user may enter the sentence, "Please summarize the news about the recent attacker ABC10." The reception unit 110 may accept the entered sentence as instruction information. Alternatively, the user may enter a word such as "ABC10," which is the name of the attacker. The reception unit 110 may accept the entered word as instruction information. Or, the user may enter information indicating a source, such as a URL (Uniform Resource Locator). In other words, the reception unit 110 may accept information indicating a source as instruction information. The information included in the instruction information is not limited to these examples.

[0047] Similarly, the user may enter text indicating the type of reader. For example, the user may enter text indicating the type of reader, such as an SOC operator or a manager. The reception unit 110 may accept the entered text as reader information.

[0048] This example is not limited to this one; the input of instruction information and reader information may be performed by the user selecting from options. For example, the user may select from a number of pre-configured instruction information and reader information. The reception unit 110 may accept the selected instruction information and reader information as input.

[0049] Figure 5 shows an example of an input display. Specifically, Figure 5 shows an example of an interface for receiving user input. In this example, information prompting input of instruction information and reader information is displayed. For example, in the input field for instruction information, "Attacker's Name" is selected as the type of information. In this way, the user may be allowed to select from the options for the type of information to be entered in the instruction information. In this example, the user enters the name of the attacker. Also, in the input field for reader information, "Manager" is selected. In this way, the user may be allowed to select from the options for the type of reader. In this example, the user enters the reader information by selecting one of the options. An input display like the example in Figure 5 may be displayed on the terminal device 400 by, for example, the output unit 130.

[0050] The generation unit 120 generates a report. As shown in Figure 4, the generation unit 120 includes a determination unit 121, a search unit 122, an input unit 123, and a report generation unit 124.

[0051] The decision unit 121 determines prompts to be input to the large-scale language model based on the instruction information and reader information. The determined prompts indicate content corresponding to the instruction information and reader information. The instruction information includes information indicating the theme of the report. That is, the decision unit 121 determines prompts that include instructions to generate text that is in line with the theme of the report indicated in the instruction information. The decision unit 121 also determines prompts according to the type of reader.

[0052] The decision unit 121 may determine the prompt using the prompts stored in the prompt storage unit 193. In this case, the prompt storage unit 193 stores prompt pattern information including the prompt. Figure 6 shows an example of prompt pattern information. In the example in Figure 6, the type of reader and the prompt are shown in association. Specifically, when the type of reader is "SOC operator", the prompt "Please summarize the information on the following topics. In addition, please extract information useful for configuring security devices, such as malicious URLs and malicious IP addresses, in a table format." is associated. In other words, in this example, if the reader is a SOC operator, the prompt includes instructions to output information related to configuring security devices. Similarly, if the reader is a person in management, the prompt includes instructions to output the scale of the damage, the industry of the affected organization, and past damage cases. In this way, the prompt includes instructions to output information that is of interest to the reader, depending on the type of reader. The reader's interests may be information that indicates the information desired by the reader from among the information related to threats, as in these examples.

[0053] Note that the types of readers and corresponding prompts are not limited to these examples. For example, suppose the reader is an incident responder. In this case, the corresponding prompt may include instructions to output details about the operation of the software (malware) used in the attack. Also, for example, if the reader is a system operator, the instructions may include instructions to output peripheral information about the attack method, such as information about software similar to the software used in the attack, and information about the network of the affected system.

[0054] For example, suppose the instruction information includes a theme called "ABC10" with the name of the attacker. Also, suppose the reader information includes a type called "SOC Operator". In this case, the decision unit 121 selects a prompt that corresponds to the type "SOC Operator". Then, the decision unit 121 determines a prompt that integrates the theme "Attacker ABC10" included in the instruction information with the selected prompt, and uses this as the prompt to be input to the model management unit 210 (large-scale language model).

[0055] The prompt may include further instructions. For example, the prompt may include instructions on the output format.

[0056] Thus, the decision unit 121 determines a prompt that includes instructions for generating text in line with the theme, and that corresponds to the type of reader. The decision unit 121 is an example of a decision means.

[0057] Here, the decision unit 121 may determine a prompt that takes synonyms for the term into consideration. A term may have synonyms. For example, names such as attacker, attack method, and malware may have alternative names. Such alternative names, or other words that represent the same or similar concepts to a term, are called synonyms.

[0058] In this case, the decision unit 121 identifies synonyms of the term included in the instruction information using synonym data. The synonym data is stored in the synonym data storage unit 194. Figure 7 shows an example of synonym data. In the example in Figure 7, synonyms related to the name of an attacker are shown. For example, the attacker "ABC10" is associated with synonyms such as "Gold" and "Rock". If the instruction information includes a predetermined term "ABC10", the decision unit 121 identifies synonyms such as "Gold" and "Rock" associated with "ABC10" from the synonym data. The decision unit 121 may then reflect in the prompt that the identified synonyms exist as synonyms of the predetermined term. That is, if synonyms exist for a term used in the information indicating a theme included in the instruction information, the decision unit 121 may determine a prompt indicating that the term and its synonyms should be treated similarly.

[0059] For example, suppose a prompt is determined based on the instructions to organize information about the attacker "ABC10". In this case, the prompt may include instructions such as, "ABC10 has synonyms such as 'Gold', 'Rock', 'X123', ... Please replace these synonyms with 'ABC10'."

[0060] The decision unit 121 may also identify synonyms for the term from the prompt determined based on the instruction information. In this case, the decision unit 121 may reflect a sentence in the determined prompt indicating that the identified synonyms exist.

[0061] Thus, the decision unit 121 may use synonym data, in which synonyms are defined for each term, to identify synonyms for the terms included in the instruction information. The decision unit 121 may then determine a prompt that includes a sentence indicating that the identified synonyms exist for the terms used in the information indicating the theme.

[0062] The prompt may include instructions to output a unified generated sentence for terms that have synonyms. For example, the prompt may include a sentence such as, "For terms with synonyms, unify them into a single term and output the generated sentence."

[0063] The search unit 122 searches for information related to the instruction information. The search unit 122 is an example of a search means.

[0064] Specifically, the search unit 122 generates a search query based on the instruction information. At this time, the search unit 122 may extract keywords from the instruction information. Keywords may be single words or sentences. For example, the search unit 122 may use a learning model that has learned information about threats contained in sentences to extract information about threats as keywords from the instruction information. Then, the search unit 122 may generate a search query using the extracted keywords. Furthermore, the search unit 122 may generate a search query that takes synonyms of terms into consideration. For example, the search unit 122 may use synonym data to identify synonyms of terms contained in the keywords extracted from the instruction information. Then, the search unit 122 may generate a search query using keywords that include the identified synonyms. The method of generating a search query is not limited to this example.

[0065] The search unit 122 searches the internal information storage unit 191 and the external information storage unit 192 using a search query. The internal information storage unit 191 stores reports created in the past. For example, the internal information storage unit 191 stores reports that have been distributed in the past. In this case, the internal information storage unit 191 may store reports created based on reports output by the document creation support device 100, reports created by other devices, or reports created manually. As a result, the search unit 122 retrieves, for example, a report corresponding to the search query as a search result.

[0066] The external information storage unit 192 stores external information collected by the collection server 300. Specifically, as described above, the collection unit 310 collects external information, which is security-related information, via the network. The collection unit 310 then stores the external information in the external information storage unit 192. In other words, the external information storage unit 192 stores cybersecurity-related information provided by an external server, which is acquired via the network. The search unit 122 searches the external information storage unit 192 using a search query. As a result, the search unit 122 obtains external information corresponding to the search query as a search result.

[0067] In this manner, the search unit 122 searches for information related to the instruction information in the internal information storage unit 191 and the external information storage unit 192.

[0068] The input unit 123 inputs the prompt determined by the decision unit 121 and the search results from the search unit 122 to the model management unit 210. In other words, the input unit 123 inputs the prompt and the search results to the large-scale language model. As a result, the model management unit 210 outputs a generated sentence that is the answer to the prompt and reflects the search results. The input unit 123 is an example of an input means.

[0069] Furthermore, the processing of the search unit 122 and the input unit 123 may be performed based on the RAG (Retrieval-Augmented Generation) framework. That is, the large-scale language model refers to the information contained in the search results and outputs a generated sentence according to the prompt.

[0070] The report generation unit 124 generates a report based on the generated text output by the model management unit 210. Specifically, the report generation unit 124 obtains the outputted generated text. Then, the report generation unit 124 converts the obtained generated text into a report format. For example, suppose the report format includes items such as title, details, source, and attacker. The report generation unit 124 may generate the report by extracting information corresponding to each item from the generated text and inputting it into the report format.

[0071] In this case, the report generation unit 124 may generate a report using a learning model that has learned a predetermined text and the result of converting the predetermined text into a report format. Specifically, the report generation unit 124 may consider the output obtained by inputting the acquired generation proposal into the learning model as a report. Alternatively, suppose the prompt includes instructions to organize the information by item. In this case, the report generation unit 124 may generate a report by extracting information for each item and inputting the extracted information into each item in the report format.

[0072] Note that the method of generating the report is not limited to this example. For example, the report generation unit 124 may treat the generated text as the report itself.

[0073] Figure 8 shows an example of a report. In the example in Figure 8, the report includes a status and a body. The status is metadata about the content of the report. In the example in Figure 7, the status includes the items of severity, CVE-ID (Common Vulnerabilities and Exposures-IDentifier), TLP (Traffic Light Protocol), and category. Severity indicates the scale of damage related to the incident summarized in the report. CVE-ID is information that identifies the vulnerability in the product. TLP is information that defines the boundaries of information sharing. Category indicates keywords related to the incident summarized in the report. The status information may be information that can be extracted from search results, or it may be information that is generated from the relationship between the body and status in past reports. The status information is not limited to these examples.

[0074] Furthermore, in the example in Figure 8, the main text includes items such as title, summary, details, and information sources. The title, summary, and details may contain different information depending on the reader. For example, if the reader is in management, the scale of the damage would be a matter of concern for management. In the example in Figure 7, the scale of the damage is shown as the leakage of patient information for 50,000 people and the loss of more than 1 billion yen. On the other hand, if the reader is an incident responder, the details of the attack and countermeasures would be matters of concern for the incident responder. Therefore, the report would show which vulnerability was exploited in the attack and how to address that vulnerability. Note that the information in the main text of the report is not limited to these examples.

[0075] Thus, the report generation unit 124 generates a report based on the generated sentences produced by the large-scale language model. The report generation unit 124 is an example of a report generation means.

[0076] The output unit 130 outputs a report. Specifically, the output unit 130 outputs the generated report to the terminal device 400. The report output to the terminal device 400 is then output by the output device 420. For example, a report like the one shown in Figure 8 is displayed on the display of the output device 420, which is an example of such a display.

[0077] Next, an example of the operation of the document creation support device 100 will be explained using Figure 9. Figure 9 is a second flowchart illustrating an example of the operation of the document creation support device 100.

[0078] The reception unit 110 receives instruction information and reader information (S101). For example, the reception unit 11 may receive instruction information and reader information by receiving input from the user in response to an input display as shown in Figure 5.

[0079] The decision unit 121 determines a prompt based on the instruction information and the reader information (S102). For example, the decision unit 121 uses the input instruction information and reader information to identify a prompt corresponding to the reader information from the prompt storage unit 193. The decision unit 121 then determines a prompt that integrates the identified prompt and the instruction information as the prompt to be input to the model management unit 210.

[0080] The search unit 122 searches the internal information storage unit 191 and the external information storage unit 192 (S103). Specifically, the search unit 122 generates a search query. For example, the search unit 122 generates a keyword based on instruction information or a prompt as a search query. Then, the search unit 122 searches the internal information storage unit 191 and the external information storage unit 192 using the generated search query.

[0081] The input unit 123 inputs the search results and prompts to the model management unit 210 (S104). For example, the input unit 123 inputs the search results and determined prompts to the large-scale language model based on the RAG framework.

[0082] The report generation unit 124 obtains the generated text from the model management unit 210 (S105). The report generation unit 124 then generates a report based on the generated text (S106). Finally, the output unit 130 outputs the generated report (S107).

[0083] Note that the operation of the document creation support device 100 is not limited to this example. For example, the order of the processes in S102 and S103 may be reversed, or they may be performed simultaneously.

[0084] Thus, the document creation support device 100 of the second embodiment receives input of instruction information, which includes instructions regarding the content of a report related to cybersecurity, and reader information, which indicates the type of reader. The document creation support device 100 also generates a report that includes information about threats corresponding to the instruction information, based on the results of referencing information related to the instruction information, and includes the reader's interests according to the type of reader. The document creation support device 100 then outputs the generated report.

[0085] This allows the document creation support device 100 to generate reports that anticipate the reader's needs. In other words, the document creation support device 100 can assist in creating cybersecurity reports that meet specific needs.

[0086] Furthermore, the instruction information may include information indicating the theme of the report. In this case, the document creation support device 100 may determine a prompt that includes instructions for generating text in line with the theme, and that corresponds to the type of reader. The document creation support device 100 may also search for information related to the instruction information. Furthermore, the document creation support device 100 may input the determined prompt and the search results into a large-scale language model. The document creation support device 100 may then generate a report based on the generated text produced by the large-scale language model.

[0087] As a result, the document creation support device 100 can obtain generated text that reflects the search results for information related to the instruction information, and can generate a report specifically for information related to the instruction information. In other words, the document creation support device 100 can assist in creating a report that meets the needs of the user who input the instruction information.

[0088] Furthermore, at this time, the document creation support device 100 may search for information related to the instruction information in the internal information storage unit 191 and the external information storage unit 192. In this case, the internal information storage unit 191 stores reports created in the past, and the external information storage unit 192 stores cybersecurity-related information provided by an external server and acquired via the network.

[0089] As a result, the document creation support device 100 can output reports based on the results of referencing previously created reports and security information obtained from external sources. In other words, the document creation support device 100 can assist in creating reports that meet the user's needs.

[0090] Furthermore, the document creation support device 100 may use synonym data, in which synonyms are defined for each term, to identify synonyms for terms included in the instruction information, and determine a prompt that includes a sentence indicating that the identified synonyms exist for the terms used in the information indicating the theme.

[0091] As a result, the document creation support device 100 can generate reports by considering not only specific terms but also words that represent concepts similar to those specific terms.

[0092] [Example 1] In the above-described embodiment, an example was explained in which the prompt is determined using prompt pattern information stored in the prompt storage unit 193 based on instruction information and reader information. However, the example is not limited to this, and the prompt may be input from the terminal device 400.

[0093] Specifically, the user inputs a prompt using the input device 410 of the terminal device 400. The reception unit 110 receives the input prompt. The prompt includes instruction information and reader information. At this time, the terminal device 400 may display an interface that prompts the user to input a prompt containing instruction information and reader information. For example, it may display text prompting the user to input information indicating the report's theme and the type of reader.

[0094] The decision unit 121 extracts reader information from the input prompt. The decision unit 121 then integrates instructions to output matters of interest corresponding to the extracted reader information into the input prompt. The decision unit 121 may then decide that the integrated prompt is to be input to the large-scale language model.

[0095] [Differentiation 2] The report output by the document creation support device 100 is distributed by a distribution server (not shown). That is, the document creation support device 100 sends the report to the distribution server. At this time, the document creation support device 100 may send the report generated by the generation unit 120 as is to the distribution server, or it may send a modified version of the generated report to the distribution server. In other words, the document creation support device 100 may accept modifications from the user to the generated report.

[0096] Specifically, the report generated by the output unit 130 is output to the terminal device 400. A user of the terminal device 400, such as a person responsible for creating reports, makes modifications to the outputted report. In other words, the report output by the document creation support device 100 may be treated as a draft report for the user's report creation process. For example, suppose a report like the one shown in Figure 8 is output to the terminal device 400. The user uses the terminal device 400 to make modifications to each item in the report. For example, the user may change the status. Or, the user may add or delete content to the body of the report. The reception unit 110 accepts the report modifications. Then, the output unit 130 outputs the modified report to the terminal device 400.

[0097] The user reviews the generated report. If there are no corrections needed, the user confirms the report. The confirmed report is sent to the distribution server as a confirmed report. For example, the document creation support device 100 sends a confirmed report to the distribution server. The distribution server distributes the sent report.

[0098] [Difference 3] The document creation support device 100 may generate multiple reports corresponding to the input instruction information. Specifically, the document creation support device 100 may generate reports corresponding to the input instruction information, with separate reports for each type of reader.

[0099] For example, the reception unit 110 receives instruction information. The decision unit 121 then determines prompts that include instructions to generate text in line with the theme indicated in the instruction information, for each pre-configured reader type. In other words, prompts are determined for each configured reader type. The input unit 123 inputs each of the determined prompts in order into the model management unit 210. The report generation unit 124 obtains the generated text corresponding to each of the input prompts. The report generation unit 124 then generates a report for each generated text.

[0100] The document creation support device 100 sends the finalized report corresponding to each generated report to a distribution server (not shown). The distribution server distributes each report. At this time, the distribution server may change the report to be distributed depending on the information of the user who will be reading the report. For example, suppose a user can view the report by logging into a web application built by the distribution server. At this time, the distribution server may decide which report to distribute to the user based on the registered user's reader type information.

[0101] [Differentiation Example 4] The document creation support device 100 may cause a large-scale language model to refer to the information contained in the search results based on a pre-set degree of reference required.

[0102] Specifically, the input unit 123 sets a priority for each piece of information included in the search results. Priority indicates the degree to which the information should be referenced. Priority is set based on various pieces of information.

[0103] For example, the internal information storage unit 191 stores reports created in the past. Each report is associated with evaluation information indicating its rating. This evaluation information may be, for example, information assigned by users who have previously read the report. The evaluation information may be multi-level ratings. The search results include evaluation information for each report that matches the search criteria.

[0104] The input unit 123 sets a priority for each report based on the evaluation information. For example, the input unit 123 sets a higher priority for reports with higher evaluations.

[0105] Furthermore, for example, the external information storage unit 192 contains cybersecurity-related information provided by an external server, which is collected by the collection unit 310. In this case, the information source is indicated for each piece of cybersecurity-related information. An example of an information source is a URL (Uniform Resource Locator). The search results include information indicating the information source for the cybersecurity-related information provided by the external server.

[0106] The input unit 123 sets the priority using credibility pattern information. Credibility pattern information is information that associates information source patterns with credibility. Figure 10 shows an example of credibility pattern information. In the example in Figure 10, URL patterns are shown as information sources. Specifically, wildcards and regular expressions are used as URL patterns. A numerical value indicating credibility is associated with each URL pattern.

[0107] The input unit 123 identifies the credibility of information using credibility pattern information and information sources for each piece of cybersecurity-related information. Then, based on the identified credibility, the input unit 123 sets a priority for each piece of cybersecurity-related information that hits the search. For example, the input unit 123 sets a higher priority for information with higher credibility.

[0108] The input unit 123 inputs the determined prompt and search results, along with the set priority, to the model management unit 210. In other words, the input unit 123 instructs the model management unit 210 to refer to the search results, taking the priority into consideration.

[0109] Thus, the internal information storage unit 191 stores evaluation information indicating the evaluation of the reports, and the search results may include evaluation information for each report that hits the search. The document creation support device 100 then sets a priority indicating the degree to which each report that hits the search should be referenced, based on the evaluation information, and inputs the determined prompt, search results, and priority into the large-scale language model.

[0110] Furthermore, the search results may include information indicating the source of cybersecurity-related information provided on an external server. The document creation support device 100 uses credibility pattern information, which associates information source patterns with credibility, to set a priority indicating the degree to which each piece of cybersecurity-related information found in the search should be referenced, based on the information indicating the source. The document creation support device 100 may then input the determined prompt, search results, and priority into a large-scale language model.

[0111] This allows the document creation support device 100 to more easily reference information with higher priority in its large-scale language model. As a result, the document creation support device 100 can generate more useful reports.

[0112] Furthermore, the document creation support device 100 may generate a report that includes a cautionary note indicating that low-priority information has been referenced. Specifically, when the decision unit 121 references information in the search results where the priority is below a threshold, it determines a prompt that includes an instruction to output a cautionary note indicating that the information contains low-use information.

[0113] The input unit 123 inputs the determined prompt. Specifically, the input unit 123 inputs a prompt to the large-scale language model that includes an instruction to output a cautionary note when referring to information in the search results where the priority is below the threshold. Therefore, if information with a priority below the threshold is referred to among the search results, a generated statement including a cautionary note is output.

[0114] This allows the document creation support device 100 to inform the user, who created the report, of the high usefulness of the generated report.

[0115] <Example of hardware configuration for document creation support device> The hardware constituting the document creation support devices of the first and second embodiments described above will now be explained. Figure 11 is a block diagram showing an example of the hardware configuration of the computer device constituting the document creation support device in each embodiment. The computer device 90 realizes the document creation support device and document creation support method described in each embodiment and each modified example. For example, the document creation support devices etc. described in each embodiment and each modified example may have the hardware configuration shown in Figure 11.

[0116] As shown in Figure 11, the computer device 90 includes a processor 91, RAM (Random Access Memory) 92, ROM (Read Only Memory) 93, storage device 94, input / output interface 95, bus 96, and drive device 97. Note that document creation support devices, etc., may be implemented using multiple electrical circuits.

[0117] The storage device 94 stores the program (computer program) 98. The processor 91 executes the program 98 of the document creation support device using the RAM 92. Specifically, for example, the program 98 includes a program that causes the computer to execute the processes shown in Figures 2 and 9. The functions of each component of the document creation support device are realized in response to the execution of the program 98 by the processor 91. The program 98 may also be stored in the ROM 93. Alternatively, the program 98 may be recorded on the recording medium 80 and read using the drive device 97, or it may be transmitted to the computer device 90 from an external device (not shown) via a network (not shown).

[0118] The input / output interface 95 exchanges data with peripheral devices (keyboard, mouse, display device, etc.) 99. The input / output interface 95 functions as a means of acquiring or outputting data. The bus 96 connects each component.

[0119] Furthermore, there are various variations in how a document creation support system can be implemented. For example, each component included in a document creation support system can be implemented as a dedicated device. Also, each document creation support system can be implemented based on a combination of multiple devices.

[0120] The processing method for recording a program to realize each configuration in the function of each embodiment on a recording medium, reading the program recorded on the recording medium as code, and executing it on a computer is also included in the scope of each embodiment. In other words, a computer-readable recording medium is also included in the scope of each embodiment. Furthermore, the recording medium on which the above-mentioned program is recorded, and the program itself, are also included in each embodiment.

[0121] The recording medium in question is, but is not limited to, a floppy disk, hard disk, optical disk, magneto-optical disk, CD (Compact Disc)-ROM, magnetic tape, non-volatile memory card, or ROM. Furthermore, the programs recorded on the recording medium are not limited to programs that perform processing independently, but also include programs that operate on an OS (Operating System) in cooperation with other software and the functions of expansion boards to perform processing, and these are also included in the scope of each embodiment.

[0122] Although the present invention has been described above with reference to embodiments, the present invention is not limited to the above embodiments. Various modifications to the structure and details of the present invention can be made within the scope of the present invention as can be understood by those skilled in the art.

[0123] Furthermore, the above embodiments and modifications can be combined as appropriate.

[0124] <Note> Some or all of the above embodiments may also be described as follows, but are not limited to the following:

[0125] [Note 1] A receiving means for receiving instruction information, which includes instructions regarding the content of a cybersecurity-related report, and reader information indicating the type of reader, A generating means for generating a report that includes information relating to the instruction information, based on the results of referencing information related to the instruction information, and which includes matters of interest to the reader according to the type of reader, The system includes an output means for outputting the generated report, Document creation support device.

[0126] [Note 2] The aforementioned areas of interest indicate the information the reader desires from among the threat-related information. The document creation support device described in Appendix 1.

[0127] [Note 3] The aforementioned instruction information includes information indicating the theme of the report. The generating means is A prompt including instructions for generating text in line with the aforementioned theme, comprising a determination means for determining a prompt corresponding to the type of reader, A search means for searching for information related to the aforementioned instruction information, An input means for inputting the determined prompt and search results into a large-scale language model, The system includes a report generation means that generates the report based on the generated sentences generated by the large-scale language model, The document creation support device described in Appendix 1.

[0128] [Note 4] The search means performs a search for information related to the instruction information in the internal information storage means and the external information storage means. The aforementioned internal information storage means stores reports created in the past. The external information storage means stores cybersecurity-related information obtained via the network and provided by an external server. Document creation support device as described in Appendix 3.

[0129] [Note 5] The aforementioned determination means is Using synonym data in which synonyms are defined for each term, synonyms for the terms included in the instruction information are identified. Determine a prompt that includes a sentence indicating that there are specific synonyms for the terms used in the information relating to the aforementioned theme. A document creation support device as described in Appendix 3 or 4.

[0130] [Note 6] The internal information storage means stores evaluation information indicating the evaluation of the report. The search results include evaluation information for each report that was found in the search. The aforementioned input means is Based on the evaluation information, a priority is set for each report that appears in the search results, indicating how much it should be referenced. The determined prompt, the search results, and the priority are input to the large-scale language model. Document creation support device as described in Appendix 4.

[0131] [Note 7] The aforementioned search results include information indicating the source of cybersecurity-related information provided on external servers. The aforementioned input means is Using credibility pattern information that associates information source patterns with credibility, a priority is set for each cybersecurity-related piece of information found in a search, based on the information indicating the source, to indicate the degree to which it should be referenced. The determined prompt, the search results, and the priority are input to the large-scale language model. Document creation support device as described in Appendix 4.

[0132] [Note 8] The input means, when referring to information in the search results whose priority is below a threshold, inputs a prompt to the large-scale language model that includes an instruction to output a cautionary note. A document creation support device as described in Appendix 6 or 7.

[0133] [Note 9] The system accepts input of instruction information, which includes instructions regarding the content of cybersecurity-related reports, and reader information, which indicates the type of reader. A report is generated that includes information on threats corresponding to the instruction information, based on the results of referencing information related to the instruction information, and includes the reader's interests according to the type of reader. Output the generated report. Document creation support methods.

[0134] [Note 10] A process that accepts input of instruction information, which includes instructions regarding the content of a cybersecurity-related report, and reader information, which indicates the type of reader. A process for generating a report that includes information relating to the instruction information, based on the results of referencing information related to the instruction information, and which includes matters of interest to the reader according to the type of reader, The process of outputting the generated report, and the process of causing the computer to execute program.

[0135] Furthermore, some or all of the configurations described in Appendices 2 through 8, which are dependent on Appendice 1 above, may also be dependent on Appendices 9 and 10 in the same way as those described in Appendices 2 through 8. Moreover, within the scope that does not depart from each of the embodiments described above, some or all of the configurations described as appendices may also be dependent on various hardware, software, various recording means for recording software, or systems. [Explanation of Symbols]

[0136] 100 Document creation support devices 110 Reception Department 120 Generation part 121 Decision Section 122 Search Section 123 Input section 124 Report Generation Section 130 Output section 190 Storage device 191 Internal information storage unit 192 External Information Storage Unit 193 Prompt Memory Unit 194 Synonym Data Storage Unit 200 Model Management Servers 210 Model Management Department 300 collection servers 310 Collection Department 400 terminal devices 410 Input device 420 Output device

Claims

1. A receiving means for receiving instruction information, which includes instructions regarding the content of a cybersecurity-related report, and reader information indicating the type of reader, A generating means for generating a report that includes information relating to the instruction information, based on the results of referencing information related to the instruction information, and which includes matters of interest to the reader according to the type of reader, The system includes an output means for outputting the generated report, Document creation support device.

2. The aforementioned areas of interest indicate the information the reader desires from among the threat-related information. The document creation support device according to claim 1.

3. The aforementioned instruction information includes information indicating the theme of the report. The generating means is A prompt including instructions for generating text in line with the aforementioned theme, comprising a determination means for determining a prompt corresponding to the type of reader, A search means for searching for information related to the aforementioned instruction information, An input means for inputting the determined prompt and search results into a large-scale language model, The system includes a report generation means that generates the report based on the generated sentences generated by the large-scale language model, The document creation support device according to claim 1.

4. The search means performs a search for information related to the instruction information in the internal information storage means and the external information storage means. The aforementioned internal information storage means stores reports created in the past. The external information storage means stores cybersecurity-related information obtained via the network and provided by an external server. The document creation support device according to claim 3.

5. The aforementioned determination means is Using synonym data in which synonyms are defined for each term, synonyms for the terms included in the instruction information are identified. Determine a prompt that includes a sentence indicating that there are specific synonyms for the terms used in the information relating to the aforementioned theme. The document creation support device according to claim 3 or 4.

6. The internal information storage means stores evaluation information indicating the evaluation of the report. The search results include evaluation information for each report that was found in the search. The aforementioned input means is Based on the evaluation information, a priority is set for each report that appears in the search results, indicating how much it should be referenced. The determined prompt, the search results, and the priority are input to the large-scale language model. The document creation support device according to claim 4.

7. The aforementioned search results include information indicating the source of cybersecurity-related information provided on external servers. The aforementioned input means is Using credibility pattern information that associates information source patterns with credibility, a priority is set for each cybersecurity-related piece of information found in a search, based on the information indicating the source, to indicate the degree to which it should be referenced. The determined prompt, the search results, and the priority are input to the large-scale language model. The document creation support device according to claim 4.

8. The input means, when referring to information in the search results whose priority is below a threshold, inputs a prompt to the large-scale language model that includes an instruction to output a cautionary note. The document creation support device according to claim 6 or 7.

9. The system accepts input of instruction information, which includes instructions regarding the content of cybersecurity-related reports, and reader information, which indicates the type of reader. A report is generated that includes information on threats corresponding to the instruction information, based on the results of referencing information related to the instruction information, and includes the reader's interests according to the type of reader. Output the generated report. Document creation support methods.

10. A process that accepts input of instruction information, which includes instructions regarding the content of a cybersecurity-related report, and reader information, which indicates the type of reader. A process for generating a report that includes information relating to the instruction information, based on the results of referencing information related to the instruction information, and which includes matters of interest to the reader according to the type of reader, The process of outputting the generated report, and the process of causing the computer to execute program.

Images