Information processing device, information processing method, and information processing program

Abstract

To provide an information processing device, an information processing method, and an information processing program that can reduce the effort required to generate and update dedicated machine learning models. [Solution] The information processing device comprises an acquisition unit, an input information generation unit, and a communication analysis unit. The acquisition unit acquires communication information, including information about communication packets. The input information generation unit generates input information, including instruction information that instructs an analysis to determine whether or not the communication information is malicious communication information. Based on the input information, the communication analysis unit uses a large-scale language model to perform an analysis to determine whether or not the communication information is malicious communication information, and outputs the results of the analysis.

Description

[[Technical Field]]

[0001] The present invention relates to an information processing apparatus, an information processing method, and an information processing program. [[Background Art]]

[0002] Conventionally, techniques for detecting malicious communication, which is communication performed for malicious purposes in computer networks, are known (see, for example, Patent Document 1). As techniques for detecting malicious communication, for example, in addition to techniques for detecting malicious communication using signatures, techniques for detecting malicious communication using machine learning models are known. [[Prior Art Documents]] [[Patent Documents]]

[0003] [[Patent Document 1]] Japanese Unexamined Patent Application Publication No. 2019-148882 [[Summary of the Invention]] [[Problem to be Solved by the Invention]]

[0004] However, machine learning-based detection requires preparation of a large amount of labeled datasets, which has the problem that it takes time and effort to generate and update a dedicated machine learning model.

[0005] The present invention has been made in view of the above, and an object of the present invention is to provide an information processing apparatus, an information processing method, and an information processing program that can reduce the time and effort required to generate and update a dedicated machine learning model. [[Means for Solving the Problem]]

[0006] To solve the above-mentioned problems and achieve the objective, the information processing device of the present invention comprises an acquisition unit, an input information generation unit, and a communication analysis unit. The acquisition unit acquires communication information including information about communication packets. The input information generation unit generates input information including instruction information that instructs an analysis on whether or not the communication information is malicious communication information. The communication analysis unit uses a large-scale language model based on the input information to perform an analysis on whether or not the communication information is malicious communication information and outputs the results of the analysis. [Effects of the Invention]

[0007] According to the present invention, the effort required to generate and update dedicated machine learning models can be reduced. [Brief explanation of the drawing]

[0008] [Figure 1] Figure 1 shows an example of the configuration of an information processing device according to an embodiment. [Figure 2] Figure 2 shows an example of the configuration of the unknown communication analysis unit in the processing unit of the information processing device according to the embodiment. [Figure 3] Figure 3 shows an example of input information generated by the input information generation unit in the processing unit of the information processing device according to the embodiment. [Figure 4] Figure 4 shows an example of output information of a large-scale language model to which input information generated by the input information generation unit in the processing unit of the information processing device according to the embodiment has been input. [Figure 5] Figure 5 is a flowchart showing an example of information processing by the processing unit of the information processing device according to the embodiment. [Figure 6] Figure 6 is a flowchart showing an example of unknown communication analysis processing by the processing unit of the information processing device according to the embodiment. [Figure 7] Figure 7 shows an example of a computer that executes an information processing program. [Modes for carrying out the invention]

[0009] Hereinafter, one embodiment of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to this embodiment. Furthermore, in the drawings, the same parts are denoted by the same reference numerals.

[0010] [Embodiment] Figure 1 shows an example of the configuration of an information processing device according to an embodiment. As shown in Figure 1, the information processing device 1 comprises a communication unit 10, a storage unit 11, and a processing unit 12.

[0011] The communication unit 10 is connected to a communication network (not shown), and can transmit and receive information to and from external devices (not shown), such as a server or terminal device, via this communication network. The communication network (not shown) is, for example, a telecommunications line such as a LAN (Local Area Network) or the Internet, but is not limited to such examples.

[0012] The storage unit 11 stores data and programs used for various processes performed by the processing unit 12. The storage unit 11 includes a communication information storage unit 20, a processing result storage unit 21, and a signature storage unit 22.

[0013] The communication information storage unit 20 stores multiple pieces of communication information, including information about communication packets that are subject to detection as malicious communications. The communication information includes, but is not limited to, the communication packet number, communication direction, and payload information. The communication packet number indicates the order in a sequence of communication packets. For example, in a sequence of communication packets sent and received between the same communication partners, the number of the first communication packet is represented by the smallest number (e.g., "0"). Furthermore, the communication information includes, but is not limited to, information about multiple communication packets included in a sequence of communication packets.

[0014] The processing result storage unit 21 stores, for each piece of communication information, the processing result obtained by the processing unit 12 as to whether the communication information is information of malicious communication. The processing result includes, for example, information indicating whether the communication information is malicious communication information, information indicating the type of malicious communication, and the communication information or information for identifying the communication information.

[0015] Malicious communication is communication performed for malicious purposes in a computer network. Communication packets of malicious communication include, but are not limited to, for example, communication packets transmitted from a computer infected with malware, communication packets for DDoS (Distributed Denial of Service attack) attacks, etc.

[0016] The information indicating the type of malicious communication is information included in the processing result of the processing unit 12 when the communication information is malicious communication information. The types of malicious communication include known malicious communication and unknown malicious communication. Known malicious communication is communication that has been analyzed as malicious communication by entities other than the information processing apparatus 1. Unknown malicious communication is communication that has been newly analyzed as malicious communication by the information processing apparatus 1.

[0017] The signature storage unit 22 stores a plurality of signatures. Each signature is a signature of known malicious communication, includes information such as characteristic patterns used in known malicious communication, and is used to determine malicious communication. In addition, in the signature storage unit 22, each signature is associated with information indicating the reason for the signature, and may further be associated with a reliability score described later. Hereinafter, information including a signature and information indicating the reason for the signature may be referred to as signature information.

[0018] The processing unit 12 includes an acquisition unit 30, a known communication determination unit 31, an unknown communication analysis unit 32, a signature generation unit 33, and an output unit 34. The acquisition unit 30 acquires communication information via the communication unit 10, and stores the acquired communication information in the communication information storage unit 20. The acquisition unit 30 also acquires communication information stored in the communication information storage unit 20.

[0019] The known communication determination unit 31 uses the signature of known malicious communication stored in the signature storage unit 22 to determine whether the communication information acquired by the acquisition unit 30 is malicious communication information. Hereinafter, the communication information acquired by the acquisition unit 30 may be referred to as target communication information.

[0020] The known communication determination unit 31 compares the signature stored in the signature storage unit 22 with the target communication information. If the target communication information includes a pattern indicated by the signature, the known communication determination unit 31 determines that the target communication information is information of known malicious communication; otherwise, it determines that the target communication information is not information of known malicious communication.

[0021] For example, assume that a signature including "outbound communication" and "336699" is stored in the signature storage unit 22. In this case, if "336699" is included in the outbound communication packet contained in the target communication information, the known communication determination unit 31 determines that the target communication information is information of known malicious communication.

[0022] When the known communication determination unit 31 determines that the target communication information is information of known malicious communication, it stores information indicating that the target communication information is information of known malicious communication as a processing result in the processing result storage unit 21.

[0023] The unknown communication analysis unit 32 performs analysis on whether the target communication information, which has been determined by the known communication determination unit 31 not to be information of known malicious communication, is information of malicious communication, and stores the determination result as a processing result in the processing result storage unit 21. The unknown communication analysis unit 32 uses a large language model to determine whether the target communication information is information of malicious communication. The large language model is, for example, a transformer-based model, but is not limited to such an example.

[0024] Figure 2 shows an example of the configuration of the unknown communication analysis unit 32 in the processing unit 12 of the information processing device 1 according to the embodiment. As shown in Figure 2, the unknown communication analysis unit 32 comprises an input information generation unit 40, a communication analysis unit 41, and an output verification unit 42.

[0025] The input information generation unit 40 generates input information that includes instruction information instructing an analysis on whether or not the target communication information is malicious communication information, a signature, and the target communication information. The instruction information includes role information that defines the role of the large-scale language model, instruction information that defines commands for the large-scale language model, and so on.

[0026] Role information is a string that defines what role the large-scale language model should play. Instruction information is a string that specifically indicates what you want the large-scale language model to do. Instruction information includes, for example, output format information that defines the output format of the large-scale language model. Output format information is a string that defines what kind of output you want the large-scale language model to produce. The output format may be, for example, CSV, JSON, or list format, but is not limited to these examples.

[0027] The signature included in the input information is a signature that contains a pattern similar to the target communication information, and is selected from among multiple signatures stored in the signature storage unit 22.

[0028] The target communication information may be included in the input information as CSV format, JSON format, or list format, but is not limited to these examples.

[0029] Figure 3 shows an example of input information generated by the input information generation unit 40 in the processing unit 12 of the information processing device 1 according to the embodiment. The input information 70 shown in Figure 3 includes role information 71, instruction information 72, signature information 73, and target communication information 74. Note that the input information generated by the input information generation unit 40 is not limited to the input information 70 shown in Figure 3.

[0030] The role information 71 shown in Figure 3 indicates that the role of the large-scale language model is that of a security expert responsible for analyzing communication packets (network packets) to identify malicious communications. The instruction information 72 includes, as specific instructions, instructions to generate a report in JSON format in three steps.

[0031] The first step's instructions are commands to read signature information 73, which includes examples of malicious communication signatures, and target communication information 74, which is input data. These instructions include information describing the contents of each key ("sig", "reason", "n", "d", "p") in the JSON object of this information. "sig" is the key corresponding to the definition pattern used to detect malicious communication, and "reason" is the key corresponding to the reason why the definition pattern is malicious communication.

[0032] Furthermore, "n" is the key corresponding to the communication packet number, "d" is the key corresponding to the direction of communication (a value of "0" for outbound and a value of "1" for inbound), and "p" is the key corresponding to the payload of the communication packet (represented by an array of hexadecimal numbers).

[0033] The instruction for the second step is to analyze the provided target communication information 74 (input data) for identifying malicious communication using signature information 73, which includes examples of malicious communication signatures.

[0034] The third step instructs the system to output a JSON object, which is a JSON-formatted report, if malicious communication is detected; otherwise, it outputs an empty JSON-formatted object containing information describing the contents of each key ("confidence", "signature", "reason") in the JSON object.

[0035] "Confidence" is a score indicating the confidence level of the analysis that the target communication information is malicious communication information, and may be referred to as the confidence score below. "Signature" is the signature of the target communication information if the target communication information is malicious communication information. "Reason" is information indicating the reason for the analysis that the communication information is malicious communication information. Hereafter, the reason for the analysis that the communication information is malicious communication information may be referred to as the reason for analysis.

[0036] Signature information 73 is an example of malicious communication signature information and includes the malicious communication signature and reason information which indicates the reason for that signature. The signature included in signature information 73 shown in Figure 3 is an outgoing communication packet in which the first communication packet contains "33 66 99 01 63" in its payload, and information for the second and subsequent communication packets is omitted. The signature shown in signature information 73 is a signature that contains a pattern similar to the target communication information, for example, a signature that contains the pattern most similar to the target communication information.

[0037] Furthermore, the reason information included in the signature information 73 shown in Figure 3 indicates that "33 66 99" functions as a magic byte for malicious communication during the initial handshake, and "01 63" is additional information.

[0038] The target communication information 74 includes information from six communication packets, but in the example shown in Figure 3, the information from the third to fifth communication packets is omitted from the illustration. In the target communication information 74 shown in Figure 3, the first communication packet is an outbound communication with "33 66 99 01 63" in its payload, the second communication packet is an inbound communication with "00 0C 31 39 32 2E" in its payload, and the sixth communication packet is an inbound communication with "03 00 02 01" in its payload.

[0039] As shown in Figure 2, the input information generation unit 40 comprises a selection unit 50 and a generation unit 51. The selection unit 50 selects signatures of known malicious communications based on the target communication information. For example, the selection unit 50 selects one or more signatures containing patterns similar to the target communication information from among a large number of signatures stored in the signature storage unit 22.

[0040] The signature selected by the selection unit 50 is, for example, the signature with the greatest similarity between the target communication information and the vector, or the signature with a similarity between the target communication information and the vector that is equal to or greater than a threshold, but is not limited to such examples.

[0041] The signature storage unit 22 contains vectors of each communication information, and the selection unit 50 vectorizes the target communication information and compares the vector of the target communication information with the vector of the communication information stored in the signature storage unit 22, but is not limited to this example.

[0042] The generation unit 51 generates information as input information that includes the signature selected by the selection unit 50, instruction information, and target communication information. The instruction information is predetermined information, but may be, for example, instruction information linked to the type of signature selected by the selection unit 50.

[0043] The generation unit 51 can also generate information containing one or more predetermined signatures (for example, information containing signatures of multiple different malware types) as input information, instead of the signature selected by the selection unit 50.

[0044] The communication analysis unit 41 uses a large-scale language model to analyze whether the target communication information is malicious communication information based on the input information generated by the input information generation unit 40, and outputs the analysis result.

[0045] The communication analysis unit 41 inputs the input information generated by the input information generation unit 40 to the large-scale language model, for example, through an API (Application Programming Interface) for sending and receiving information with the large-scale language model, causing the large-scale language model to perform an analysis to determine whether the target communication information is malicious communication information. The communication analysis unit 41 obtains the analysis results from the large-scale language model in response to the input information as output information through the aforementioned API.

[0046] The communication analysis unit 41 may also have a configuration that includes a large-scale language model. In this case, the communication analysis unit 41 inputs the input information generated by the input information generation unit 40 into its internal large-scale language model and obtains the analysis results from the internal large-scale language model as output information.

[0047] Figure 4 shows an example of output information of a large-scale language model to which input information generated by the input information generation unit 40 in the processing unit 12 of the information processing device 1 according to the embodiment has been input. The output information 80 shown in Figure 4 includes a reliability score, a signature, and a reason for analysis. In the output information 80 shown in Figure 4, the reliability score is "9".

[0048] Furthermore, in the output information 80 shown in Figure 4, the signature is "[{"n": 0, "d": 0, "p": "33 66 99 01 63"}, {"n": 1, "d": 1, "p": "33 66 99"},{"n": 2, "d": 0, "p": "00 00"}]". Also, in the output information 80 shown in Figure 4, the reason for analysis is that the bidirectional communication packets are combined with the repetition of "33 66 99", which is known to be associated with malicious communication.

[0049] As shown in Figure 2, the communication analysis unit 41 outputs the output information of the large-scale language model to the output verification unit 42. The output verification unit 42 takes the output information of the large-scale language model as input and verifies whether the output information of the large-scale language model is information presented in a specified output format. The output verification unit 42 determines the verification result to be OK if the output information of the large-scale language model is information presented in the specified format, and NG otherwise.

[0050] For example, suppose the output information input from the communication analysis unit 41 is in the output format shown in the output information 80 in Figure 4. In this case, the output verification unit 42 determines the verification result to be OK if it contains the key and value (numeric) of "confidence", the key and value (string) of "signature", and the key and value (string) of "reason", and otherwise determines the verification result to be NG.

[0051] Furthermore, the output verification unit 42 will reject the verification result if the numerical value corresponding to the key "confidence" is outside a specific range (for example, the range from "0" to "10"), even if it is included. Also, the output verification unit 42 will reject the verification result if the string corresponding to the key "signature" is included, but the keys "n", "d", and "p" and the values ​​corresponding to these keys are not included in any part of the output.

[0052] Furthermore, the output verification unit 42 can also reject the verification result if the string contains a string corresponding to the key "reason" but does not contain a specific keyword or if the string is not in a specific language.

[0053] If the verification result is NG, the output verification unit 42 instructs the communication analysis unit 41 to generate output information again, and performs the above-described verification on the output information regenerated by the communication analysis unit 41. The output verification unit 42 repeats the process of instructing the communication analysis unit 41 to generate output information again, up to the maximum number of regenerations, until the verification result is OK.

[0054] The verification criteria used by the output verification unit 42 are not limited to the examples described above. Furthermore, the output verification unit 42 can also use a large-scale language model to verify output information instead of relying on rule-based verification results. For example, the output verification unit 42 inputs information into the large-scale language model that includes instruction information instructing the communication analysis unit 41 to determine whether its output information satisfies the verification criteria, along with the output information from the communication analysis unit 41. The output verification unit 42 then obtains information indicating the verification results output from the large-scale language model.

[0055] If the verification result is OK, the output verification unit 42 stores the result of the analysis regarding whether the target communication information is malicious communication information as the processing result of the communication analysis unit 41 in the processing result storage unit 21. In the processing result storage unit 21, the output information of the communication analysis unit 41 is stored in association with the target communication information.

[0056] Returning to Figure 1, let's continue the explanation of the processing unit 12. The signature generation unit 33 shown in Figure 1 generates a signature for the target communication information that has been determined to be malicious communication information, based on the results of the analysis by the communication analysis unit 41, in a format that allows the known communication determination unit 31 to determine if it is malicious communication. The signature generation unit 33 then stores the generated signature in the signature storage unit 22, thereby storing a new signature in the signature storage unit 22.

[0057] For example, the signature generation unit 33 generates a signature in a format that allows the known communication determination unit 31 to determine malicious communication, based on the results of the analysis by the communication analysis unit 41. For example, it generates a signature in a format that allows the known communication determination unit 31 to determine malicious communication from the signatures included in the results of the analysis by the communication analysis unit 41. The signature generation unit 33 stores the generated signature in the signature storage unit 22, associating it with information indicating the reason for the analysis of that signature. The information indicating the reason for the analysis of the signature is stored in the signature storage unit 22 as reason information, linked to the signature.

[0058] Furthermore, the signatures included in the analysis results by the communication analysis unit 41 may be in a format that allows the known communication determination unit 31 to determine malicious communication. In this case, the signature generation unit 33 can use the signatures included in the analysis results by the communication analysis unit 41 as signatures in a format that allows the known communication determination unit 31 to determine malicious communication, and generate signatures for storage in the signature storage unit 22.

[0059] Furthermore, the signature generation unit 33 can also cause the large-scale language model to generate signatures to be stored in the signature storage unit 22 based on the results of the analysis by the communication analysis unit 41. For example, the signature generation unit 33 includes the results of the analysis by the communication analysis unit 41, instruction information that instructs the generation of signatures based on the results of the analysis, and information that shows examples of signatures. By inputting such input information into the large-scale language model, the large-scale language model is caused to generate signatures to be stored in the signature storage unit 22. In this case, the signatures generated by the large-scale language model based on the results of the analysis by the communication analysis unit 41 are stored in the signature storage unit 22.

[0060] Furthermore, the signature generation unit 33 can also cause the large-scale language model to generate reason information based on the analysis results of the communication analysis unit 41. In this case, the reason information generated by the large-scale language model based on the analysis results of the communication analysis unit 41 is linked to the signature and stored in the signature storage unit 22. The signature generation unit 33 can also input information containing the results of multiple analyses output from the communication analysis unit 41 as input information to the large-scale language model, causing the large-scale language model to generate one or more signatures. In this case, the input information may include, for example, information concerning communications highly suspected of being malicious communications, and information that instructs the generation of one or more signatures based on the given information, but is not limited to this example.

[0061] The output unit 34 outputs the processing result stored in the processing result storage unit 21 or the signature stored in the signature storage unit 22. For example, the output unit 34 transmits the processing result stored in the processing result storage unit 21 or the signature stored in the signature storage unit 22 to an external terminal device or external server via the communication unit 10 and a network (not shown).

[0062] [Information Processing] Next, the procedure for information processing by the processing unit 12 of the information processing device 1 according to the embodiment will be described. Figure 5 is a flowchart showing an example of information processing by the processing unit 12 of the information processing device 1 according to the embodiment.

[0063] As shown in Figure 5, the processing unit 12 of the information processing device 1 acquires communication information, including communication packet information, from the communication information storage unit 20 of the storage unit 11 as target communication information (step S10), and performs known communication determination processing (step S11). Known communication determination processing is the processing of the known communication determination unit 31 described above.

[0064] The processing unit 12 determines whether the target communication information is known malicious communication information based on the determination result of the known communication determination process (step S12). If the processing unit 12 determines that the target communication information is known malicious communication information (step S12: Yes), it stores the determination result of the known communication determination process in the storage unit 11 as the processing result (step S13).

[0065] If the processing unit 12 determines that the target communication information is not information of a known malicious communication (step S12: No), it performs an unknown communication analysis process (step S14). The unknown communication analysis process in step S14 is the process shown in steps S20 to S24 in Figure 6, which will be described in detail later.

[0066] The processing unit 12 stores the analysis result from the unknown communication analysis process in step S14 in the storage unit 11 as the processing result (step S15). Subsequently, the processing unit 12 determines whether or not the analysis in the unknown communication analysis process determined that the target communication information is malicious communication information (step S16).

[0067] If the processing unit 12 determines that the target communication information is malicious communication information (step S16: Yes), it stores a signature in a format that allows for the determination of malicious communication in the storage unit 11 based on the analysis results of the unknown communication analysis process (step S17). If the processing unit 12 completes the process in step S17, or the process in step S13, or determines that the target communication information is not malicious communication information (step S16: No), it terminates the process shown in Figure 5.

[0068] Figure 6 is a flowchart showing an example of unknown communication analysis processing by the processing unit 12 of the information processing device 1 according to the embodiment. As shown in Figure 6, the processing unit 12 generates input information (step S20) and, based on the input information, uses a large-scale language model to analyze whether the target communication information is malicious communication information (step S21).

[0069] The processing unit 12 verifies the output of the large-scale language model (step S22) and determines whether the result of the verification is OK or not (step S23). If the result of the verification is not OK (step S23: No), the processing unit 12 returns to step S21. If the result of the verification is OK (step S23: Yes), the processing unit 12 stores the information indicated by the output information of the large-scale language model as an analysis result in the storage unit 11 (step S24), and terminates the process shown in Figure 6.

[0070] [Differentiation] The communication information stored in the communication information storage unit 20 may be associated with information indicating the malware type. In this case, the selection unit 50 selects the malware type signature associated with the communication information. If there are multiple malware type signatures associated with the communication information, the selection unit 50 selects these multiple signatures.

[0071] [Effects of the Embodiment] As described above, the information processing device 1 according to the embodiment comprises an acquisition unit 30, an input information generation unit 40, and a communication analysis unit 41. The acquisition unit 30 acquires communication information, including information about communication packets. The input information generation unit 40 generates input information, including instruction information that instructs an analysis on whether or not the communication information is malicious communication information. Based on the input information, the communication analysis unit 41 uses a large-scale language model to output the results of the analysis on whether or not the communication information is malicious communication information. As a result, the information processing device 1 can perform an analysis on whether or not the communication information is malicious communication information without using a dedicated machine learning model, thereby reducing the effort required to generate and update a dedicated machine learning model.

[0072] Furthermore, the instruction information includes information that instructs the output of a score indicating the confidence level of the analysis that the communication information is malicious communication information, and the reason for the analysis that the communication information is malicious communication information. The analysis result includes the score and the reason. As a result, the information processing device 1 can perform an analysis on whether or not the communication information is malicious communication information with high accuracy.

[0073] Furthermore, the instruction information includes information that instructs the generation of a signature for the communication information when the communication information is analyzed to be malicious communication information, and the analysis results further include the signature of the communication information. As a result, the information processing device 1 can automatically generate a signature.

[0074] Furthermore, the information processing device 1 includes a signature generation unit 33 that generates signatures based on the analysis results of the communication analysis unit 41. This allows the information processing device 1 to automatically set the generated signatures.

[0075] Furthermore, the information processing device 1 includes a known communication determination unit 31 that uses the signature generated by the signature generation unit 33 as a signature of known malicious communication to determine whether the communication information acquired by the acquisition unit 30 is malicious communication information. The input information generation unit 40 generates input information based on communication information that is not determined by the known communication determination unit 31 to be known malicious communication information. As a result, the information processing device 1 can perform analysis on whether or not the communication information is malicious communication information while reducing the processing load of the large-scale language model.

[0076] Furthermore, the input information generation unit 40 includes a selection unit 50 that selects a known malicious communication signature based on the communication information, and a generation unit 51 that generates information including the signature selected by the selection unit 50, instruction information, and communication information as input information. As a result, the information processing device 1 can accurately analyze whether or not the communication information is malicious communication information.

[0077] Furthermore, the selection unit 50 selects a signature that includes a pattern similar to the communication information. This allows the information processing device 1 to accurately analyze whether or not the communication information is malicious communication information.

[0078] [System configuration, etc.] Furthermore, the components of each part shown in the diagram are functional concepts and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown in the diagram, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. Moreover, each processing function performed by each device can be implemented, in whole or in any part, by a CPU and the program executed on that CPU, or by hardware using wired logic.

[0079] Furthermore, among the processes described in the embodiments above, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0080] [program] It is also possible to create a program in a computer-executable language that describes the processing performed by the information processing device 1 according to the above embodiment. In one embodiment, the information processing device 1 can be implemented by installing an information processing program that performs the above information processing as packaged software or online software on a desired computer. For example, by having the information processing device execute the above information processing program, the information processing device can be made to function as the information processing device 1. The information processing device referred to here is a general-purpose computer, but is not limited to this example; it may also be a general-purpose server (for example, an on-premise server or a cloud server), or any other computer.

[0081] Figure 7 shows an example of a computer that executes an information processing program. Computer 1000 includes, for example, memory 1010, CPU 1020, hard disk drive interface 1030, disk drive interface 1040, serial port interface 1050, video adapter 1060, and network interface 1070. These components are connected by bus 1080.

[0082] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. A removable storage medium, such as a magnetic disk or optical disk, is inserted into the disk drive 1041. A serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. A video adapter 1060 is connected to, for example, a display 1061.

[0083] Here, the hard disk drive 1031 stores, for example, the OS 1091, the application program 1092, the program module 1093, and the program data 1094. The information described in the above embodiment is stored, for example, in the hard disk drive 1031 or the memory 1010.

[0084] Furthermore, the information processing program is stored in the hard disk drive 1031 as a program module 1093 containing instructions to be executed by the computer 1000, for example. Specifically, the program module 1093 containing instructions for each process executed by the information processing device 1 described in the above embodiment is stored in the hard disk drive 1031.

[0085] Furthermore, the data used for information processing by the information processing program is stored as program data 1094, for example, in the hard disk drive 1031. The CPU 1020 then reads the program module 1093 and program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as needed and executes the procedures described above.

[0086] Furthermore, the program module 1093 and program data 1094 related to the information processing program are not limited to being stored on the hard disk drive 1031; for example, they may be stored on a removable storage medium and read by the CPU 1020 via a disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 related to the information processing program may be stored on another computer connected via a network such as a LAN or WAN and read by the CPU 1020 via a network interface 1070.

[0087] Although embodiments applying the invention made by the present inventors have been described above, the present invention is not limited by the descriptions and drawings that constitute part of the disclosure of the present invention in this embodiment. That is, all other embodiments, examples, and operational techniques made by those skilled in the art based on this embodiment are included in the scope of the present invention. [Explanation of symbols]

[0088] 1. Information Processing Device 10 Communications Department 11 Storage section 12 Processing Units 20 Communication Information Storage Unit 21 Processing result storage unit 22 Signature Memory Unit 30 Acquisition Department 31 Known Communication Determination Unit 32 Unknown Communication Analysis Department 33 Signature generation unit 34 Output section 40 Input Information Generation Unit 41 Communications Analysis Department 42 Output Verification Unit 50 Selection Section 51 Generation part 70 Input Information 71. Role Information 72 Instruction information 73 Signature Information 74 Target communication information 80 Output Information

Claims

1. An acquisition unit that acquires communication information including information about communication packets, An input information generation unit generates input information including instruction information that instructs an analysis on whether or not the aforementioned communication information is malicious communication information, The system includes a communication analysis unit that, based on the input information, uses a large-scale language model to analyze whether the communication information is malicious communication information and outputs the results of the analysis. An information processing device characterized by the following:

2. The instruction information is, The output includes a score indicating the confidence level of the analysis that the communication information is malicious communication information, and information indicating the reasons for the analysis that the communication information is malicious communication information. The results of the above analysis include: The score and the reason are included. The information processing apparatus according to feature 1.

3. The instruction information is, The system further includes information that instructs the generation of a signature for the communication information when the communication information is analyzed to be malicious communication information, The results of the above analysis include: The signature of the aforementioned communication information is further included. The information processing apparatus according to claim 1 or 2.

4. The system includes a signature generation unit that generates the signature based on the results of the analysis described above. The information processing apparatus according to claim 3.

5. The system includes a known communication determination unit that uses the signature generated by the signature generation unit to determine whether or not the communication information is malicious communication information. The aforementioned input information generation unit, Based on the communication information that is not determined by the known communication determination unit to be known malicious communication information, the input information is generated. The information processing apparatus according to feature 4.

6. The aforementioned input information generation unit, A selection unit that selects a signature of a known malicious communication based on the aforementioned communication information, The system includes a generation unit that generates information including the signature selected by the selection unit, the instruction information, and the communication information as input information. The information processing apparatus according to claim 1 or 2.

7. A method of information processing performed by a computer, The acquisition process involves obtaining communication information, including information about communication packets. An input information generation step generates input information that includes instruction information that instructs an analysis on whether or not the aforementioned communication information is malicious communication information, The process includes a communication analysis step in which, based on the input information, a large-scale language model is used to analyze whether the communication information is malicious communication information, and the results of the analysis are output. An information processing method characterized by the following:

8. Procedure for obtaining communication information, including information about communication packets, An input information generation procedure that generates input information including instruction information that instructs an analysis on whether or not the aforementioned communication information is malicious communication information, A computer is instructed to perform a communication analysis procedure that uses a large-scale language model to analyze whether the communication information is malicious based on the input information, and outputs the results of the analysis. An information processing program characterized by the following features.

Images