Information processing device, information processing method, and information processing program

Abstract

To provide an information processing device, an information processing method, and an information processing program that can investigate the IP addresses of a scanned organization. [Solution] The information processing device comprises an acquisition unit and a scan organization analysis unit. The acquisition unit acquires information on the communication packets to be analyzed. The scan organization analysis unit uses a large-scale language model to analyze whether the source IP address is the IP address of a scan organization, which is an organization that sends communication packets for investigation purposes, based on IP address-related information, which is information related to the source IP address of the communication packet.

Description

[Technical Field]

[0001] The present invention relates to an information processing apparatus, an information processing method, and an information processing program. [Background Art]

[0002] Conventionally, scan communication by scanning organizations, which are organizations that transmit communication packets for investigation purposes, is known. Detecting scan communication from scanning organizations is important for ensuring the accuracy of communication analysis through passive observation. Scanning organizations are sometimes also referred to as investigation organizations.

[0003] Some scanning organizations accept processes such as disclosure of source IP (Internet Protocol) addresses of communication packets used for scanning, or applications for opt-out to be excluded from scanning. However, only some academic organizations disclose their source addresses, and there are also cases where opt-out applications are not reflected.

[0004] By detecting the source IP addresses of a large number of communication packets, it is possible to detect the IP addresses of scanning organizations, but this also results in detecting communication packets from bots or tools. Greynoise and Sans disclose IP address information of investigation organizations and the like as OSINT (Open-Source Intelligence) using network sensors they own in various countries around the world, so there is a method of excluding the publicly disclosed IP addresses (see, for example, Non-Patent Document 1). [Prior Art Documents] [Non-Patent Documents]

[0005] [Non-Patent Document 1] "Internet Storm Center", SANS Technology Institute, [online], [Retrieved January 31, 2025], Internet<URL:https: / / isc.sans.edu / > [Overview of the project] [Problems that the invention aims to solve]

[0006] However, OSINT does not cover the IP addresses of all scanning organizations, and because it takes time from detection to publication, OSINT filtering alone can miss some threats. The number of scanning organizations is increasing, and the IP ranges they use are constantly shifting, so if detection methods are not kept up-to-date, there will be many missed threats and false positives, compromising the accuracy of the analysis.

[0007] The present invention has been made in view of the above, and aims to provide an information processing device, an information processing method, and an information processing program that can investigate the IP address of a scanning organization. [Means for solving the problem]

[0008] To solve the above-mentioned problems and achieve the objective, the information processing device according to the present invention comprises an acquisition unit and a scan organization analysis unit. The acquisition unit acquires information on the communication packets to be analyzed. The scan organization analysis unit uses a large-scale language model to perform an analysis based on IP address-related information, which is information related to the source IP address of the communication packet, to determine whether the source IP address is the IP address of a scan organization, which is an organization that sends communication packets for investigation purposes. [Effects of the Invention]

[0009] According to the present invention, it is possible to investigate the IP address of the investigation organization. [Brief explanation of the drawing]

[0010] [Figure 1] Figure 1 shows an example of the configuration of an information processing device according to an embodiment. [Figure 2] Figure 2 shows an example of the configuration of the known scan tissue determination unit in the processing unit of the information processing device according to the embodiment. [Figure 3] Figure 3 shows an example of the configuration of the unknown scan tissue analysis unit in the processing unit of the information processing device according to the embodiment. [Figure 4] Figure 4 shows an example of input information generated by the generation unit in the processing unit of the information processing device according to the embodiment. [Figure 5] Figure 5 shows another example of the configuration of the unknown scan tissue analysis unit in the processing unit of the information processing device according to the embodiment. [Figure 6] Figure 6 is a flowchart showing an example of information processing by the processing unit of the information processing device according to the embodiment. [Figure 7] Figure 7 is a flowchart showing an example of unknown scan tissue analysis processing by the processing unit of the information processing device according to the embodiment. [Figure 8] Figure 8 shows an example of a computer that executes an information processing program. [Modes for carrying out the invention]

[0011] Hereinafter, one embodiment of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to this embodiment. Furthermore, in the drawings, the same parts are denoted by the same reference numerals.

[0012] [Embodiment] Figure 1 shows an example of the configuration of an information processing device according to an embodiment. As shown in Figure 1, the information processing device 1 comprises a communication unit 10, a storage unit 11, and a processing unit 12.

[0013] The communication unit 10 is connected to a communication network (not shown), and can transmit and receive information to and from external devices (not shown), such as a server or terminal device, via this communication network. The communication network (not shown) is, for example, a telecommunications line such as a LAN (Local Area Network) or the Internet, but is not limited to such examples.

[0014] The storage unit 11 stores data and programs used for various processes performed by the processing unit 12. The storage unit 11 includes a communication information storage unit 20, a scanned tissue information storage unit 21, and a processing result storage unit 22.

[0015] The communication information storage unit 20 stores information on multiple communication packets to be analyzed. For example, the communication information storage unit 20 includes a pcap file, which is a dump of a communication packet using the hexdump command, as communication packet information. The information on the communication packets to be analyzed only needs to include the source IP address contained in the communication packet, and is not limited to the example described above.

[0016] The scan organization information storage unit 21 stores known scan organization information for each scan organization, which is information about scan organizations whose IP range is known. A scan organization is an organization that transmits communication packets for investigative purposes and is also called an investigative agency. Examples of scan organizations include academic research institutions such as universities and research institutes, security companies such as security vendors, government agencies that conduct scans to strengthen national cybersecurity, and non-profit organizations aimed at improving security, but are not limited to these examples. In the following, scan organizations whose IP range is known may be referred to as known scan organizations.

[0017] Known scan organization information includes, but is not limited to, the IP range of a known scan organization, the domain name of a known scan organization, and the name of a known scan organization. Known scan organization information is generated from, but is not limited to, information published as OSINT or information published by a known scan organization.

[0018] The processing result storage unit 22 stores information indicating the processing result of the processing unit 12. The processing result of the processing unit 12 includes information indicating whether or not the source IP address of the communication packet to be analyzed belongs to the IP address of a scanning organization.

[0019] The processing unit 12 includes an acquisition unit 30, a scanning organization analysis unit 31, and an output unit 32. The acquisition unit 30 acquires information of a communication packet to be analyzed via the communication unit 10, and stores the acquired information of the communication packet in the communication information storage unit 20. The acquisition unit 30 also acquires information of communication packets stored in the communication information storage unit 20. Hereinafter, the source IP address of a communication packet from which information is acquired by the acquisition unit 30 may be referred to as a target source IP address.

[0020] The scanning organization analysis unit 31 performs an analysis on whether the target source IP address is an IP address of a scanning organization. When the scanning organization analysis unit 31 analyzes that the target source IP address is an IP address of a scanning organization, the scanning organization analysis unit 31 adds information including the target source IP address as an IP address of a scanning organization to the scanning organization information storage unit 21 as known scanning organization information.

[0021] The scanning organization analysis unit 31 includes a known scanning organization determination unit 34 and an unknown scanning organization analysis unit 35. The known scanning organization determination unit 34 uses the IP range of a known scanning organization to determine whether the source IP address of the communication packet indicated by the communication information acquired by the acquisition unit 30 is an IP address of a known scanning organization.

[0022] The IP range of a known scanning organization is stored in the scanning organization information storage unit 21 as described above. The known scanning organization determination unit 34 determines whether the target source IP address is an IP address of a known scanning organization based on the IP range of the known scanning organization stored in the scanning organization information storage unit 21.

[0023] Figure 2 shows an example of the configuration of the known scan tissue determination unit 34 in the processing unit 12 of the information processing device 1 according to the embodiment. As shown in Figure 2, the known scan tissue determination unit 34 includes an IP address inspection unit 40, a collection unit 41, and an IP address related information inspection unit 42.

[0024] The IP address inspection unit 40 determines that the target source IP address is an IP address of a known scan organization if the IP range containing the target source IP address is stored in the scan organization information storage unit 21.

[0025] For example, suppose the target source IP address is "xxx100" and the scanning organization's IP range is "xxx0 / 24". "x" is a number within the range of 0 to 255. In this case, since "xxx" is common to both the target source IP address and the scanning organization's IP range, and "100" is included in "0 / 24", the IP address inspection unit 40 determines that the target source IP address is an IP address of a known scanning organization.

[0026] If the IP address inspection unit 40 does not determine that the target source IP address is the IP address of a known scanning organization, the collection unit 41 collects IP address-related information, which is information related to the target source IP address.

[0027] For example, the collection unit 41 collects IP address-related information based on the target source IP address using methods such as reverse DNS (Domain Name System) lookup, WHOIS, search engine, and BGP (Border Gateway Protocol) lookup. The IP address-related information includes, for example, one or more pieces of information such as the domain name, FQDN (Fully Qualified Domain Name), organization name, organization type, registrant, and web page associated with the target source IP address.

[0028] For example, the collection unit 41 uses reverse DNS lookup to collect information on the FQDN associated with the target source IP address from the DNS PTR record as IP address-related information. In the following, the domain name included in the FQDN associated with the target source IP address may be referred to as the target domain name.

[0029] Furthermore, the collection unit 41 can collect information such as the organization name, organization type, and registrant associated with the target domain name from WHOIS as IP address-related information. In addition, the collection unit 41 can use a search engine to collect web pages related to the target domain name or the organization name associated with the target domain name as IP address-related information. Furthermore, the collection unit 41 can use BGP lookup to collect routing information related to the network to which the target source IP address belongs as IP address-related information.

[0030] If the IP address inspection unit 40 does not determine that the target source IP address is an IP address of a known scanning organization, the IP address-related information inspection unit 42 determines whether or not the target source IP address is an IP address of a known scanning organization based on the IP address-related information collected by the collection unit 41.

[0031] The IP address-related information inspection unit 42 compares the IP address-related information collected by the collection unit 41 with the known scan organization information stored in the scan organization information storage unit 21, and determines that the target source IP address is an IP address of a known scan organization based on the comparison result. For example, the IP address-related information inspection unit 42 determines that the target source IP address is an IP address of a known scan organization if the IP address-related information collected by the collection unit 41 is included in the known scan organization information.

[0032] For example, suppose the target source IP address is associated with the FQDN "scan-13.scanorgXXX.org" in a PTR record, and known scan organization information, including the scan organization's registered domain name "scanorgXXX.org", is stored in the scan organization information storage unit 21. In this case, the processing unit 12 determines that the target source IP address is an IP address of a known scan organization because the FQDN associated with the target source IP address includes the scan organization's registered domain name.

[0033] Returning to Figure 1, let's continue the explanation of the scan tissue analysis unit 31. The known scan tissue determination unit 34 shown in Figure 1 outputs information including the target source IP address and IP address-related information as undetected information to the unknown scan tissue analysis unit 35 if it does not determine that the target source IP address is the IP address of a known scan tissue.

[0034] If the known scan organization determination unit 34 determines that the target source IP address is not an IP address of a known scan organization, the unknown scan organization analysis unit 35 uses a large-scale language model to analyze whether the target source IP address is an IP address of a scan organization based on IP address-related information. The large-scale language model is, for example, a transformer-based model, but is not limited to such an example.

[0035] For example, the unknown scan organization analysis unit 35 uses a large-scale language model to analyze whether the target source IP address is an IP address of a scan organization based on IP address-related information, and outputs analysis information showing the results of the analysis. The analysis information includes, for example, the target organization which is the organization to which the target domain name is registered, the industry of the target organization, information indicating whether the target source IP address is an IP address of a scan organization, and information indicating the reason for the analysis that the target source IP address is an IP address of a scan organization.

[0036] Figure 3 shows an example of the configuration of the unknown scan tissue analysis unit 35 in the processing unit 12 of the information processing device 1 according to the embodiment. As shown in Figure 3, the unknown scan tissue analysis unit 35 comprises a generation unit 50, an analysis unit 51, and a verification unit 52.

[0037] The generation unit 50 obtains non-detection information from the known scan organization determination unit 34, which includes the target source IP address that was not determined to be the IP address of a scan organization by the known scan organization determination unit 34, and IP address-related information which is information about the target source IP address. Based on the obtained non-detection information, the generation unit 50 generates instruction information that instructs an analysis on whether or not the target source IP address is the IP address of a scan organization, and input information which includes the target source IP address and IP address-related information.

[0038] Instructional information includes role information, which defines the role of the large-scale language model, and instruction information, which defines commands to the large-scale language model. Role information is a string that defines what role the large-scale language model should play. Instruction information is a string that specifically indicates what you want the large-scale language model to do.

[0039] Furthermore, the instruction information includes, for example, output-related information that defines the output format of the large-scale language model. Output-related information is a string that specifies what kind of output is desired from the large-scale language model. Output-related information includes a string that shows an example of output and a string that specifies the output format. The output format may be, for example, CSV format, JSON format, or list format, but is not limited to these examples.

[0040] Figure 4 shows an example of input information generated by the generation unit 50 in the processing unit 12 of the information processing device 1 according to the embodiment. The input information 70 shown in Figure 4 includes role information 71, IP address 72, IP address-related information 73, command information 74, and output-related information 75. Note that the input information generated by the generation unit 50 is not limited to the input information 70 shown in Figure 4.

[0041] Role information 71 defines the role of an expert in identifying an IP address and the associated organization. IP address 72 is the target source IP address. In the example shown in Figure 4, IP address 72 is shown as "xxxx" for convenience, where "x" is a number within the range of 0 to 255. IP address-related information 73 is the IP address-related information described above, such as the domain name, FQDN, organization name, organization type, registrant, and web page associated with the target source IP address, but this is omitted from the illustration in the example shown in Figure 4.

[0042] The instruction information 74 includes, as specific instructions, information defining the first instruction, information defining the second instruction, information defining the third instruction, and scan organization information, which is information about the scan organization. The first instruction is an instruction to determine the industry type of the organization associated with the target source IP address based on the IP address-related information. The second instruction is an instruction to analyze whether the organization associated with the target source IP address is a scan organization based on the IP address-related information and to explain the basis for that analysis. The third instruction is an instruction to output the results of the analysis in JSON format, as shown in the output-related information 75.

[0043] The scan organization information indicates, for example, that scan organizations are often IT companies, information and communication companies, and academic institutions, while non-surveilled scan hosts are bots and poorly configured hosts, often hosting services, ISPs, and non-IT / information and communication companies, and that IP address-related information containing context related to internet scanning is likely to indicate a scan organization.

[0044] Output-related information 75 is information used to cause the large-scale language model to output information in a specific output format. The output format is a JSON format that shows the organization name corresponding to the target source IP address, the industry type of the organization corresponding to the target source IP address, whether or not the target source IP address is the IP address of a scanned organization, and the basis for determining whether or not the target source IP address is the IP address of a scanned organization. In the output-related information 75 shown in Figure 4, the target source IP address is shown as "yyyy" for convenience, where "y" is a number within the range of 0 to 255. Also, in the output-related information 75 shown in Figure 4, "AAA_org" is shown as the organization name corresponding to the target source IP address.

[0045] Furthermore, the instruction information 74 may include, in place of or in addition to the second instruction described above, an instruction to determine a score (e.g., a value in the range of 0 to 10) indicating the reliability of the analysis that the organization associated with the target source IP address is a scanning organization, based on the IP address-related information, and to explain the basis for that determination. In this case, the example output includes, in place of or in addition to information indicating whether or not the target source IP address is the IP address of a scanning organization, a score (e.g., a value in the range of 0 to 10) indicating the reliability of the analysis that the organization associated with the target source IP address is a scanning organization.

[0046] Furthermore, if the unknown scan tissue analysis unit 35 has a RAG (Retrieval-Augmented Generation) function, the generation unit 50 can also generate input information for input into a large-scale language model without using some or all of the IP address-related information.

[0047] Furthermore, the input information 70 shown in Figure 4 contains one IP address 72, which is the source IP address, but the input information 70 may contain multiple IP addresses 72. In this case, the results of the analysis by the large-scale language model will be output from the large-scale language model for each IP address 72 in the output format described above. The instruction information 74 may further include, for example, an instruction to perform an analysis for each IP address 72 regarding whether or not it is the IP address of the scanning organization.

[0048] Returning to Figure 3, let's continue the explanation of the unknown scan organization analysis unit 35. Based on the input information generated by the generation unit 50, the analysis unit 51 uses a large-scale language model to perform an analysis that provides information on whether or not the target source IP address is the IP address of the scan organization, and outputs the results of that analysis.

[0049] The analysis unit 51, for example, inputs the input information generated by the generation unit 50 to the large-scale language model via an API (Application Programming Interface) for sending and receiving information with the large-scale language model, causing the large-scale language model to perform an analysis that provides information on whether or not the target source IP address is the IP address of the scanning organization. The analysis unit 51 obtains the analysis results from the large-scale language model, corresponding to the input information, as output information via the aforementioned API.

[0050] The analysis unit 51 may also have a configuration that includes a large-scale language model. In this case, the analysis unit 51 inputs the input information generated by the generation unit 50 into its internal large-scale language model and obtains the analysis results from the internal large-scale language model as output information. Such analysis results include, for example, the organization name corresponding to the source IP address, the industry type of the organization corresponding to the target source IP address, the results of the analysis on whether or not the source IP address is the IP address of the scanned organization, and the basis for that analysis.

[0051] The verification unit 52 takes the output information of the large-scale language model as input and verifies whether the output information of the large-scale language model is information presented in a specified output format. The verification unit 52 determines the verification result to be OK if the output information of the large-scale language model is information presented in the specified format, and NG otherwise.

[0052] For example, suppose the output information input from the analysis unit 51 is in the output format shown in the output-related information 75 in Figure 4. In this case, the verification unit 52 determines the verification result to be OK if it contains the key and value (string) of "org", the key and value (string) of "type", the key and value (string) of "is_scanorg", and the key and value (string) of "reason", and the key and value (string) of "reason", and otherwise determines the verification result to be NG.

[0053] If the verification result is NG, the verification unit 52 instructs the analysis unit 51 to generate output information again, and performs the above-described verification on the output information regenerated by the analysis unit 51. The verification unit 52 repeats the process of instructing the analysis unit 51 to generate output information again, up to the maximum number of regenerations, until the verification result is OK.

[0054] The verification criteria used by the verification unit 52 are not limited to the examples described above. Furthermore, the verification unit 52 can also use a large-scale language model to verify the output information instead of relying on rule-based verification results. For example, the verification unit 52 inputs information into the large-scale language model, including instruction information that instructs the analysis unit 51 to determine whether its output information satisfies the verification criteria, and the output information from the analysis unit 51. The verification unit 52 then obtains information indicating the verification results output from the large-scale language model.

[0055] If the verification result is OK, the verification unit 52 stores part or all of the output information of the large-scale language model (for example, a key and its value defined in JSON) as scan organization information in the scan organization information storage unit 21. In the scan organization information storage unit 21, part or all of the output information of the analysis unit 51 is stored in association with the information of the communication packet or the target source IP address.

[0056] Furthermore, regardless of whether the verification result is OK or NG, the verification unit 52 stores the analysis result, which includes the output information of the large-scale language model and the verification result, in the processing result storage unit 22 as a processing result.

[0057] Furthermore, the unknown scan tissue analysis unit 35 may be an AI (Artificial Intelligence) agent having RAG functionality. Figure 5 shows another example of the configuration of the unknown scan tissue analysis unit 35 in the processing unit 12 of the information processing device 1 according to the embodiment. As shown in Figure 5, the unknown scan tissue analysis unit 35 includes a generation unit 50, an analysis unit 51, and a verification unit 52, in addition to a collection unit 53.

[0058] The generation unit 50 generates input information 70 which, for example, includes as part of the command information 74 information indicating a command to collect some or all of the IP address-related information. The analysis unit 51 inputs the input information 70 into a large-scale language model and causes the large-scale language model to output information for collecting some or all of the IP address-related information.

[0059] The analysis unit 51 outputs information to the information collection unit 53 for collecting some or all of the IP address-related information output from the large-scale language model. The collection unit 53 collects some or all of the IP address-related information based on the information output from the large-scale language model and outputs some or all of the collected IP address-related information to the analysis unit 51. The information output from the large-scale language model includes the target source IP address or information based on the target source IP address. The collection unit 53 may be included in the generation unit 50, in which case the generation unit 50 also functions as a collection unit.

[0060] The analysis unit 51 inputs information including the information collected by the collection unit 53 and at least some of the input information 70 into the large-scale language model, and causes the large-scale language model to perform an analysis to determine whether the target source IP address is the IP address of the scanning organization. The analysis unit 51 can also have the collection unit 53 collect information until it can respond to the instructions indicated in the input information 70.

[0061] Returning to Figure 1, let's continue the explanation of the processing unit 12. The output unit 32 of the processing unit 12 outputs the known scanned tissue information newly stored in the scanned tissue information storage unit 21 by the analysis unit 51 to a device (not shown) via the communication unit 10. The output unit 32 of the processing unit 12 can also output the processing results stored in the processing result storage unit 22 to a device (not shown) via the communication unit 10.

[0062] [Information Processing] Next, the procedure for information processing by the processing unit 12 of the information processing device 1 according to the embodiment will be described. Figure 6 is a flowchart showing an example of information processing by the processing unit 12 of the information processing device 1 according to the embodiment.

[0063] As shown in Figure 6, the processing unit 12 of the information processing device 1 acquires information of a communication packet from the communication information storage unit 20 of the storage unit 11 (step S10) and performs a known scan organization determination process (step S11). The known scan organization determination process includes a first determination process and a second determination process.

[0064] The first determination process determines that the source IP address of the communication packet whose information was obtained in step S10 is the IP address of the scan organization if it is included in the IP range of the scan organization stored in the scan organization information storage unit 21.

[0065] The second determination process is performed when the first determination process cannot determine that the source IP address is the IP address of the scanning organization. This process involves collecting IP address-related information and determining whether or not the source IP address is the IP address of the scanning organization based on the collected IP address-related information.

[0066] The processing unit 12 stores the determination result from the known scan tissue determination process in the processing result storage unit 22 as a processing result (step S12). Then, the processing unit 12 determines whether or not it determined in the known scan tissue determination process that the source IP address is the IP address of the scan tissue (step S13). If the processing unit 12 determines that the source IP address is not the IP address of the scan tissue (step S13: No), it performs the unknown scan tissue analysis process (step S14). The unknown scan tissue analysis process in step S14 is the process shown in steps S20 to S24 in Figure 2, which will be described in detail later.

[0067] The processing unit 12 stores the analysis results from the unknown scan tissue analysis process in the processing result storage unit 22 as processing results (step S15). Then, the processing unit 12 determines whether or not it has determined that the source IP address is the IP address of the scan tissue in the unknown scan tissue analysis process (step S16). If the processing unit 12 determines that the source IP address is the IP address of the scan tissue (step S16: Yes), it stores the scan tissue information corresponding to the analysis results from the unknown scan tissue analysis process in the scan tissue information storage unit 21 (step S17).

[0068] If the processing in step S17 is completed, the processing unit 12 determines that the source IP address is the IP address of the scanning organization (step S13: Yes), or determines that the source IP address is not the IP address of the scanning organization (step S16: No), then it terminates the processing shown in Figure 6.

[0069] Figure 7 is a flowchart showing an example of the unknown scan tissue analysis process performed by the processing unit 12 of the information processing device 1 according to the embodiment. As shown in Figure 7, the processing unit 12 generates input information based on the source IP address and IP address-related information (step S20).

[0070] Based on the input information generated in step S20, the processing unit 12 uses a large-scale language model to analyze whether the source IP address is the IP address of the scanning organization (step S21). Then, the processing unit 12 verifies the output of the large-scale language model (step S22).

[0071] The processing unit 12 determines whether the result of the verification in step S22 is OK or not (step S23). If the processing unit 12 determines that the result of the verification in step S22 is not OK (step S23: No), it returns to step S21. If the processing unit 12 determines that the result of the verification in step S22 is OK (step S23: Yes), it stores the analysis result of step S21 as the processing result storage unit 22 (step S24), and terminates the process shown in Figure 7.

[0072] [Differentiation] The input information generated by the generation unit 50 is not limited to the input information 70 shown in Figure 4. For example, the instruction information 74 may further include a fifth instruction that causes the system to determine whether the target source IP address is a bot's IP address based on IP address-related information, and to explain the basis for that determination.

[0073] Furthermore, the instruction information 74 may include, in place of or in addition to the fifth instruction described above, an instruction to determine a score (for example, a value in the range of 0 to 10) indicating the likelihood that the target source IP address is a bot's IP address, based on IP address-related information, and to explain the basis for that determination. In this case, the example output includes, in place of or in addition to information indicating whether or not the target source IP address is a bot's IP address, a score (for example, a value in the range of 0 to 10) indicating the likelihood that the target source IP address is a bot's IP address.

[0074] [Effects of the Embodiment] As described above, the information processing device 1 according to this embodiment comprises an acquisition unit 30 and a scan organization analysis unit 31. The acquisition unit 30 acquires information on the communication packets to be analyzed. The scan organization analysis unit 31 uses a large-scale language model to analyze whether the source IP address is the IP address of a scan organization, which is an organization that sends communication packets for investigation purposes, based on IP address-related information, which is information related to the source IP address of the communication packet. As a result, the information processing device 1 can investigate the IP address of the scan organization.

[0075] Furthermore, the scan organization analysis unit 31 includes collection units 41 and 53 that collect IP address-related information based on the source IP address. This allows the information processing device 1 to collect information related to the source IP address of the communication packet and investigate the IP address of the scanned organization.

[0076] Furthermore, the collection units 41 and 53 collect IP address-related information using one or more of the following: reverse DNS lookup, WHOIS, search engine, and BGP lookup. This allows the information processing device 1 to accurately collect information for investigating the IP addresses of the scanned organizations.

[0077] Furthermore, the scan organization analysis unit 31 outputs information including the results of the analysis of whether or not the source IP address is the IP address of the scan organization, and the basis for the analysis, to a large-scale language model. This enables the information processing device 1 to accurately investigate the IP address of the scan organization.

[0078] Furthermore, the scan organization analysis unit 31 includes a known scan organization determination unit 34 and an unknown scan organization analysis unit 35. The known scan organization determination unit 34 uses known scan organization information, including the IP range of scan organizations whose IP ranges are known, to determine whether the source IP address is an IP address of a scan organization. If the known scan organization determination unit 34 determines that the source IP address is not an IP address of a scan organization, the unknown scan organization analysis unit 35 uses a large-scale language model to perform an analysis based on IP address-related information. This allows the information processing device 1 to investigate the IP addresses of scan organizations while reducing the load on the large-scale language model.

[0079] Furthermore, the unknown scan tissue analysis unit 35 updates the known scan tissue information based on the analysis results. This allows the information processing device 1 to investigate the IP addresses of scan tissues while reducing the load on the large-scale language model.

[0080] [System configuration, etc.] Furthermore, the components of each part shown in the diagram are functional concepts and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown in the diagram, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. Moreover, each processing function performed by each device can be implemented, in whole or in any part, by a CPU and the program executed on that CPU, or by hardware using wired logic.

[0081] Furthermore, among the processes described in the embodiments above, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0082] [program] It is also possible to create a program in a computer-executable language that describes the processing performed by the information processing device 1 according to the above embodiment. In one embodiment, the information processing device 1 can be implemented by installing an information processing program that performs the above information processing as packaged software or online software on a desired computer. For example, by having the information processing device execute the above information processing program, the information processing device can be made to function as the information processing device 1. The information processing device referred to here is a general-purpose computer, but is not limited to this example; it may also be a general-purpose server (for example, an on-premise server or a cloud server), or any other computer.

[0083] Figure 8 shows an example of a computer that executes an information processing program. Computer 1000 includes, for example, memory 1010, CPU 1020, hard disk drive interface 1030, disk drive interface 1040, serial port interface 1050, video adapter 1060, and network interface 1070. These components are connected by bus 1080.

[0084] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. A removable storage medium, such as a magnetic disk or optical disk, is inserted into the disk drive 1041. A serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. A video adapter 1060 is connected to, for example, a display 1061.

[0085] Here, the hard disk drive 1031 stores, for example, the OS 1091, the application program 1092, the program module 1093, and the program data 1094. The information described in the above embodiment is stored, for example, in the hard disk drive 1031 or the memory 1010.

[0086] Furthermore, the information processing program is stored in the hard disk drive 1031 as a program module 1093 containing instructions to be executed by the computer 1000, for example. Specifically, the program module 1093 containing instructions for each process executed by the information processing device 1 described in the above embodiment is stored in the hard disk drive 1031.

[0087] Furthermore, the data used for information processing by the information processing program is stored as program data 1094, for example, in the hard disk drive 1031. The CPU 1020 then reads the program module 1093 and program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as needed and executes the procedures described above.

[0088] Furthermore, the program module 1093 and program data 1094 related to the information processing program are not limited to being stored on the hard disk drive 1031; for example, they may be stored on a removable storage medium and read by the CPU 1020 via a disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 related to the information processing program may be stored on another computer connected via a network such as a LAN or WAN and read by the CPU 1020 via a network interface 1070.

[0089] Although embodiments applying the invention made by the present inventors have been described above, the present invention is not limited by the descriptions and drawings that constitute part of the disclosure of the present invention in this embodiment. That is, all other embodiments, examples, and operational techniques made by those skilled in the art based on this embodiment are included in the scope of the present invention. [Explanation of symbols]

[0090] 1. Information Processing Device 10 Communications Department 11 Storage section 12 Processing Units 20 Communication Information Storage Unit 21 Scan Tissue Information Storage Unit 22 Processing result storage unit 30 Acquisition Department 31. Scanning Tissue Analysis Department 32 Output section 34. Known Scan Tissue Identification Unit 35 Unknown Scan Tissue Analysis Department 40 IP Address Inspection Department 41, 53 Collection Department 42 IP Address Related Information Inspection Department 50 Generation part 51 Analysis Department 52 Verification Department 70 Input Information 71. Role Information 72 IP addresses 73 IP Address Related Information 74 Instruction information

Claims

1. An acquisition unit that acquires information on the communication packets to be analyzed, The system includes a scan organization analysis unit that uses a large-scale language model to analyze whether the source IP address is the IP address of a scan organization, which is an organization that sends communication packets for investigation purposes, based on IP address-related information, which is information related to the source IP address of the communication packet. An information processing device characterized by the following:

2. The aforementioned scanning tissue analysis unit is The system includes a collection unit that collects IP address-related information based on the source IP address. The information processing apparatus according to feature 1.

3. The aforementioned collection unit is The IP address-related information is collected using one or more of the following: reverse DNS lookup, WHOIS, search engine, and BGP lookup. The information processing apparatus according to feature 2.

4. The aforementioned scanning tissue analysis unit is The large-scale language model outputs information including the results of the analysis to determine whether the source IP address is the IP address of the organization, and the basis for the analysis. The information processing apparatus according to any one of claims 1 to 3.

5. The aforementioned scanning tissue analysis unit is A known scan organization determination unit determines whether the source IP address is the IP address of a scan organization using known scan organization information including the IP range of a scan organization whose IP range is known, The system includes, when the known scan organization determination unit determines that the source IP address is not the organization's IP address, an unknown scan organization analysis unit that performs the analysis based on the IP address-related information using the large-scale language model. The information processing apparatus according to any one of claims 1 to 3.

6. The aforementioned unknown scan tissue analysis unit is: Based on the results of the above analysis, update the known scanned tissue information. The information processing apparatus according to feature 5.

7. A method of information processing performed by a computer, The acquisition process involves obtaining information about the communication packets to be analyzed, The process includes a scan organization analysis step, which uses a large-scale language model to analyze whether the source IP address is the IP address of a scan organization, which is an organization that sends communication packets for investigation purposes, based on IP address-related information, which is information related to the source IP address of the communication packet. An information processing method characterized by the following:

8. Procedure for obtaining information on the communication packets to be analyzed, The computer is instructed to perform a scan organization analysis procedure, which uses a large-scale language model to analyze whether the source IP address is the IP address of a scan organization, which is an organization that sends communication packets for investigation purposes, based on IP address-related information, which is information related to the source IP address of the communication packet. An information processing program characterized by the following features.

Images