Inference analysis device, inference analysis method, and program

Abstract

An inference analysis device 10 is provided with: a hypothetical logical expression specification unit 11 which, when one of the hypothetical logical expressions constituting a hypothesis is specified, receives the specified hypothetical logical expression, said hypothesis having been generated by inference that applies inferential knowledge to observation logical expressions; a knowledge extraction unit 12 which extracts, from the inferential knowledge, inferential knowledge, the consequent of which includes the specified hypothetical logical expression; and an observation logical expression extraction unit 13 which identifies, from among the observation logical expressions, a logical expression included in the antecedent of the extracted inferential knowledge, and extracts an observation logical expression having the same predicate as the identified logical expression.

Description

[Technical field]

[0001] The present invention relates to an inference analysis device for analyzing the results of hypothetical inferences made to observed events, an inference device including the same, and an inference analysis method, and further relates to a method for realizing the same. program Regarding. [Background technology]

[0002] For example, in the field of cyber security, when an event is observed in a computer system, it is necessary to determine whether the observed event is the result of a cyber attack. The most promising method for making such a determination is abductive reasoning.

[0003] Hypothetical reasoning involves deriving a valid hypothesis from inference knowledge (rules) given in logical formulas and observed events (hereafter referred to as "observed events"). Therefore, in the above example, if a hypothesis is derived by applying the observed events to the rules prepared in advance for the computer system, it is easy to determine whether or not a cyber attack has occurred.

[0004] In addition, in general abductive reasoning, the more concise the hypothesis, the better, so when multiple hypotheses are assumed, it is necessary to identify the best hypothesis. In other words, in general abductive reasoning, the restriction is imposed that "there can be at most one backward inference that can be applied to a single logical formula."

[0005] Weighted abductive reasoning is a method for identifying the best hypothesis (see, for example, Non-Patent Document 1). In weighted abductive reasoning, a weight is assigned to each rule, and a cost is assigned to each observed event. Then, backward inference is performed on the weighted rules and the observed events with costs to generate candidate hypotheses, and the cost of each candidate hypothesis is calculated by a unification operation. Among the generated candidate hypotheses, the one with the smaller cost is considered to be a better hypothesis, and the hypothesis with the smallest cost is called the solution hypothesis.

[0006] Here, weighted abductive reasoning will be specifically explained with reference to FIG. 9. FIG. 9 is a diagram showing an example of conventional weighted abductive reasoning. Assume that observed events and rules are as shown in FIG. 9. In this case, a solution hypothesis obtained from the observed events and rules will be considered. In addition, in the observed events and rules shown in FIG. 9, X is a predicate indicating an attack means. A to G are predicates indicating evidence. In FIG. 9, black boxes indicate observation literals, and white boxes indicate hypothesis literals. Also, arrows indicate backward inference along the direction of the arrow, and dashed lines indicate unification.

[0007] Furthermore, literals with A through G as predicates are events that can be observed, that is, they can be "observational literals." The term values ​​"t1," "T21," etc. indicate time. "Query" is a predicate that indicates a query for making hypothetical inference. In the following, literals may be written with only the predicate, such as "X" or "A," omitting the term. Also, the numbers in the rules indicate weights, and the numbers in each observational literal indicate costs.

[0008] By applying the observed events shown in Fig. 9 to the rules shown in Fig. 9, the solution hypothesis shown in Fig. 9 is obtained. In this solution hypothesis, hypothesis literals A and B are derived as evidence of attack method X by backward inference operations, and are unified with observed literals A(T11) and B(T11), respectively. In other words, X is linked to observed literals A(T11) and B(T11). [Prior art documents] [Non-patent literature]

[0009] [Non-Patent Document 1] J.R. Hobbs, M. Stickel, P. Martin, and D. Edwards, “Interpretation as abduction”, Artificial Intelligence, Vol. 63, pp. 69-142, 1993. Summary of the Invention [Problem to be solved by the invention]

[0010] In the example of FIG. 9, since there is also a rule "C(t2):0.5^D(t2):0.5 => X(t2)", X may be linked to the observation literals C(T21) and D(T21). However, since the solution hypothesis shown in FIG. 9 is obtained due to the above-mentioned constraints, hypothesis 1 shown in FIG. 10 cannot be obtained. FIG. 10 shows another example of a hypothesis that may be obtained from the rule and the observed event shown in FIG. 9. In FIG. 10, the black boxes also indicate observation literals, and the white boxes indicate hypothesis literals. Moreover, the arrows indicate backward inference along the direction of the arrow, and the dashed lines indicate unification.

[0011] In other words, the conventional abductive reasoning disclosed in Non-Patent Document 1 has a problem in that even when there are multiple rules leading to the same consequent and there are observation literals corresponding to those antecedents, only one solution hypothesis, i.e., one rule, is presented.

[0012] In the above example, from the rule "E(t3):0.5^F(t3):0.5 => X(t3)", E and F may also be extracted as hypothesis literals, but as described above, if the solution hypothesis shown in Fig. 9 is obtained, the cost of hypothesis 2 is higher than that of the solution hypothesis, so the possibility of E and F being extracted as hypothesis 2 is zero. In particular, since F is not included in the observed events, the result is that the existence of F is not indicated at all.

[0013] In other words, although some literals are not observed, a hypothesis may be established by a rule that includes them. However, in the conventional abductive reasoning disclosed in Non-Patent Document 1, even if such a possibility exists, there is a problem that the hypothetical literal that is not observed but is included in the rule is not indicated due to the establishment of other hypotheses.

[0014] Furthermore, when applying abductive reasoning to cybersecurity, these problems may make it difficult for computer system administrators to respond quickly and reliably to cyber attacks, since they will not be able to grasp all possible hypotheses.

[0015] An example of the object of the present invention is to provide an inference analysis device, an inference analysis method, and program The purpose of this invention is to provide [Means for solving the problem]

[0016] In order to achieve the above object, an inference analysis device according to one aspect of the present invention comprises: a hypothesis logical formula designation unit that accepts a specified hypothesis logical formula when any of the hypothesis logical formulas constituting a hypothesis is specified in a hypothesis generated by inference in which inference knowledge is applied to an observation logical formula; a knowledge extraction unit for extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction unit that identifies a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracts an observation logical formula that is the same predicate as the identified logical formula; The present invention is characterized in that it is equipped with:

[0017] In order to achieve the above object, an inference device according to one aspect of the present invention comprises: a hypothesis generation unit that performs inference by applying inference knowledge to an observation logical formula to generate hypotheses; a hypothesis logical expression designation unit that accepts a specified hypothesis logical expression when any of the hypothesis logical expressions constituting the hypothesis is specified in the generated hypothesis; a knowledge extraction unit for extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction unit that identifies a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracts an observation logical formula that is the same predicate as the identified logical formula; The present invention is characterized in that it is equipped with:

[0018] In order to achieve the above object, an inference analysis method according to one aspect of the present invention comprises: a hypothesis logical formula specification step of accepting a specified hypothesis logical formula when any of the hypothesis logical formulas constituting a hypothesis is specified in a hypothesis generated by inference in which inference knowledge is applied to an observation logical formula; a knowledge extraction step of extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction step of identifying a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracting an observation logical formula having the same predicate as the identified logical formula; The present invention is characterized in that it has the following features:

[0019] Further, in order to achieve the above object, in one aspect of the present invention, program teeth, On the computer, a hypothesis logical formula specification step of accepting a specified hypothesis logical formula when any of the hypothesis logical formulas constituting a hypothesis is specified in a hypothesis generated by inference in which inference knowledge is applied to an observation logical formula; a knowledge extraction step of extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction step of identifying a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracting an observation logical formula having the same predicate as the identified logical formula; Run R,Program Hmm. Effect of the Invention

[0020] As described above, according to the present invention, it is possible to comprehensively present hypotheses derived from abductive reasoning performed on observed events. [Brief description of the drawings]

[0021] [Figure 1] FIG. 1 is a diagram showing a schematic configuration of an inference analysis device according to an embodiment. [Diagram 2] FIG. 2 is a configuration diagram specifically showing the configuration of the inference analysis apparatus and the inference apparatus according to the embodiment. [Diagram 3] FIG. 3 is a diagram showing an example of an observation literal presented by a presentation unit in the embodiment. [Figure 4] FIG. 4 is a flow diagram showing the operation of the inference analysis apparatus and the inference apparatus in the embodiment. [Diagram 5] FIG. 5 shows the observation literals presented in Example 1. [Figure 6] FIG. 6 shows the observation literals presented in Example 2. [Figure 7] FIG. 7 shows the observed events and rules used in Example 4 and the solution hypotheses generated from them. [Figure 8] FIG. 8 is a block diagram showing an example of a computer that realizes the inference analysis device and the inference device according to the embodiment. [Figure 9] FIG. 9 is a diagram showing an example of conventional weighted abductive reasoning. [Figure 10] FIG. 10 shows other examples of hypotheses that may be derived from the rules and observed events shown in FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] (Embodiment) Hereinafter, an inference analysis device, an inference analysis method, and a program according to embodiments will be described with reference to FIGS. 1 to 8. FIG.

[0023] [Device configuration] First, a schematic configuration of an inference analysis device in an embodiment will be described with reference to Fig. 1. Fig. 1 is a configuration diagram showing a schematic configuration of an inference analysis device in an embodiment.

[0024] An inference analysis device 10 shown in Fig. 1 is a device that analyzes the results of hypothetical inference performed on observed events. As shown in Fig. 1, the inference analysis device 10 includes a hypothetical logical formula designation unit 11, a knowledge extraction unit 12, and an observation logical formula extraction unit 13.

[0025] First, in the embodiment, a hypothesis is generated by inference that applies inference knowledge (hereinafter, referred to as "rule") to an observation logical formula that constitutes an observed event. Here, the observation logical formula that constitutes an observed event is a conjunction of observed literals as shown in Fig. 9 and the like. However, in the following, the term "observed literal" will be used to refer to both a conjunction indicating the entire observed event and an individual literal.

[0026] When any of the hypothetical logical formulas constituting the hypothesis is specified in this hypothesis, the hypothetical logical formula specification unit 11 accepts the specified hypothetical logical formula. In the embodiment, a single hypothetical literal (hereinafter, referred to as a "hypothetical literal") is handled as the hypothetical logical formula, but it is self-evident that it can be easily extended even when multiple hypothetical literals are specified or when a conjunction of multiple hypothetical literals is specified.

[0027] The knowledge extraction unit 12 extracts rules that include a specified hypothesis literal in the consequent from among the rules. The observation logical formula extraction unit 13 identifies a logical formula (in the embodiment, each literal constituting the antecedent) included in the antecedent of the extracted rule from among the observation literals, and extracts an observation literal that is the same predicate as the identified literal.

[0028] In this way, the inference analysis device 10 extracts rules that include the specified hypothetical literal in the consequent, and further identifies the literal included in the antecedent of the extracted rule from among the observed literals. The identified literal makes it possible to identify possible hypotheses other than the solution hypothesis obtained by the abductive reasoning. As a result, the inference analysis device 10 makes it possible to comprehensively present hypotheses derived from the abductive reasoning performed on the observed events.

[0029] Next, the configuration and functions of the inference analysis device in the embodiment will be specifically described with reference to Fig. 2. Fig. 2 is a configuration diagram specifically showing the configuration of the inference analysis device and the inference device in the embodiment.

[0030] 2, in the embodiment, inference analysis device 10 constitutes a part of inference device 20. In addition to the components of inference analysis device 10, inference device 20 includes a hypothesis generation unit 21 and a storage unit 22.

[0031] In the inference device 20, the memory unit 22 stores the observed event 31 and the rule 32 used to generate a hypothesis. The hypothesis generation unit 21 acquires the observed event 31 and the rule 32 from the memory unit 22. The hypothesis generation unit 21 then applies the rule 32 to the observation literal that constitutes the observed event 31 to execute inference. As a result, a hypothesis 33 is generated. The hypothesis generation unit 21 also stores the generated hypothesis 33 in the memory unit 22.

[0032] 9 as observed event 31 and rule 32. In this case, hypothesis generator 21 generates the hypothesis (solution hypothesis 1) shown in FIG.

[0033] Also, in the embodiment, in the inference analysis device 10, when a hypothesis literal is specified by the user, the hypothesis logical formula specification unit 11 accepts the hypothesis literal and inputs the accepted hypothesis literal to the knowledge extraction unit 12. Also, in the embodiment, the specification of the hypothesis literal by the user is performed via the user's terminal device or via an input device such as a keyboard.

[0034] In the embodiment, the knowledge extraction unit 12 accesses the storage unit 22 and extracts, from the stored rules 32, rules that include the hypothesis literal input from the hypothesis logical formula designation unit 11 in their consequents. The knowledge extraction unit 12 also inputs the extracted rules to the observation logical formula extraction unit 13.

[0035] In the embodiment, the observation logical formula extraction unit 13 first identifies a literal included in the antecedent of the input rule. Then, the observation logical formula extraction unit 13 accesses the storage unit 22 and extracts an observation literal that is the same predicate as the identified literal from the observation logical formula that constitutes the observation event 31.

[0036] 2, in the embodiment, the inference analysis device 10 includes a presentation unit 14 in addition to the above-mentioned hypothesis logical formula designation unit 11, knowledge extraction unit 12, and observation logical formula extraction unit 13. The presentation unit 14 presents the observation literal extracted by the observation logical formula extraction unit 13. In the embodiment, the presentation is performed by outputting the observation literal to an external terminal device or by displaying the observation literal on the screen of an external display device. In the former case, the observation literal is displayed on the screen of the terminal device.

[0037] For example, as described above, it is assumed that the hypothesis (solution hypothesis 1) shown in Fig. 9 has been generated as the hypothesis 33. It is also assumed that the user has specified "X" as the hypothesis literal. In this case, the knowledge extraction unit 12 extracts the following rule. A(t1):0.5^B(t1):0.5 => X(t1) C(t2):0.5^D(t2):0.5 => X(t2) E(t3):0.5^F(t3):0.5 => X(t3)

[0038] Next, the observation logical formula extraction unit 13 identifies "A", "B", "C", "D", "E", and "F" as literals included in the antecedents of the above three rules extracted by the knowledge extraction unit 12. Then, the observation logical formula extraction unit 13 extracts "A(T11)", "B(T11)", "B(T12)", "C(T21)", "D(T21)", and "E(T31)" as observation literals that are the same predicate as the identified literal, from the observation logical formulas that constitute the observation event 31.

[0039] In addition, the observation logical expression extraction unit 13 can select literals that satisfy a set condition from the identified literals, and extract observation literals that are the same predicate as the selected literal only. The set condition can be, for example, that the literal has not been excluded in advance.

[0040] Thereafter, the presenting unit 14 presents the extracted "A(T11)", "B(T11)", "B(T12)", "C(T21)", "D(T21)", and "E(T31)". The function of the presenting unit 14 will be described in detail with reference to Fig. 3. Fig. 3 is a diagram showing an example of an observation literal presented by the presenting unit in the embodiment.

[0041] 3, the presenting unit 14 classifies the extracted observation literals for each rule, and presents the extracted observation literals in the classified state as evidence. The rules at this time are rules that include the literals identified when extracting the observation literals.

[0042] Furthermore, the presentation unit 14 presents literals that have not been extracted as observation literals among the literals identified by the observation logical formula extraction unit 13, in a manner that distinguishes them from the extracted observation literals. In the example of Fig. 3, "F" is presented surrounded by a dashed line so that it can be distinguished from other literals.

[0043] In addition, it is assumed that a plurality of literals are specified and a plurality of observation literals are extracted by the observation logical formula extraction unit 13. In this case, the presentation unit 14 can determine whether the extracted observation literals are related to each other according to a set rule, and present the observation literals that are determined to be related together. Examples of the rule include that the values ​​of the terms included in the literals are the same, that the time difference is within a set range, and the like.

[0044] [Device operation] Next, the operation of the inference analysis device 10 and the inference device 20 in the embodiment will be described with reference to FIG. 4. FIG. 4 is a flow diagram showing the operation of the inference analysis device and the inference device in the embodiment. In the following description, FIGS. 1 to 3 will be referred to as appropriate. In the embodiment, the inference analysis method is implemented by operating the inference analysis device 10, and the inference method is implemented by operating the inference device 20. Therefore, the description of the inference analysis method and the inference method in the embodiment will be replaced by the following description of the operation of the inference analysis device 10 and the inference device 20.

[0045] 4, in inference device 20, hypothesis generation unit 21 applies rule 32 to observation literals constituting observation event 31 to execute inference and generate hypothesis 33 (step A1). Hypothesis generation unit 21 also stores hypothesis 33 generated in step A1 in memory unit 22.

[0046] Next, in the inference analysis device 10, when a user specifies a hypothesis literal via a terminal device or the like, the hypothesis logical formula specification unit 11 accepts the specified hypothesis literal (step A2). Then, the hypothesis logical formula specification unit 11 inputs the accepted hypothesis literal to the knowledge extraction unit 12.

[0047] Next, the knowledge extraction unit 12 extracts rules that include the hypothesis literal accepted in step A2 in their consequents from among the rules 32 stored in the storage unit 22 (step A3). The knowledge extraction unit 12 also inputs the extracted rules to the observation logical formula extraction unit 13.

[0048] Next, the observation logical formula extraction unit 13 identifies a literal included in the antecedent of the rule extracted in step A3 (step A4).

[0049] Next, the observation logical formula extraction unit 13 uses the literal identified in step A4 to extract an observation literal that is the same predicate as the literal identified in step A4 from the observation logical formula that constitutes the observation event 31 stored in the memory unit 22 (step A5).

[0050] Next, the presentation unit 14 presents the observation literals extracted in step A5 on the screen of the display device or terminal device (step A6). Specifically, as shown in Fig. 3, the presentation unit 14 classifies the extracted observation literals for each rule, and presents the extracted observation literals in the classified state. In addition, the presentation unit 14 presents literals that have not been extracted as observation literals, among those identified by the observation logical formula extraction unit 13, separately from the extracted observation literals.

[0051] [Effects of the embodiment] As described above, in the embodiment, not only the solution hypotheses but also hypotheses derived from the hypothetical reasoning performed on the observed events are presented comprehensively. In addition, in the embodiment, the extracted observation literals are presented as evidence for each rule used for extraction, making it easy to understand the logic when a hypothesis is established by a combination of evidence. Furthermore, in the embodiment, literals that are not actually observed are also presented, making it easy to understand observed events that are not observed but may exist. In addition, in the embodiment, related evidence can be presented together, making it easy to understand the association between evidence.

[0052] [Specific example] Next, a specific example of processing by the inference analysis device 10 in the embodiment will be described with reference to Fig. 5 to Fig. 7. In the following specific example, the rules are constructed using MITRE's "ATT&CK Matrix for Enterprise" (reference: https: / / attack.mitre.org / ). The "ATT&CK Matrix for Enterprise" has a hierarchical structure in which various tactics of cyber attacks are placed at the upper layer, and techniques for implementing each tactic are placed at the lower layer.

[0053] Example 1: Concrete example 1 will be described with reference to Fig. 5. Fig. 5 shows observation literals presented in concrete example 1.

[0054] In specific example 1, the following rules with "Exfiltration" as the consequent have been constructed using the "ATT&CK Matrix for Enterprise." Each rule means that when the literal of the antecedent is observed, the tactic "Exfiltration" is realized by the technique represented by the rule name. ·DataCompression(t1) ^ createSuspiciousFile(t2) ⇒ Exfiltration(t1) Rule name:T1002_DataCompressed ·accessC2Server(t3) ^ sendLargeData(t4) ⇒ Exfiltration(t3) Rule name: T1041_ExfiltrationOverCommandandControlChannel

[0055] The meaning of the literals in the antecedent of each rule is as follows: DataCompression: Data compression was performed createSuspiciousFile: A suspicious file was created accessC2Server: Accessed the C2 (Command and Control) server sendLargeData: Sends large amount of data

[0056] Let us also assume that "Exfiltration" is specified as the hypothesis literal. In this case, the presented observation literal is as shown in Figure 5.

[0057] As shown in Figure 5, in Specific Example 1, a list of techniques that may have been used to achieve "Exfiltration" in cyber attacks is displayed. As a result, the system administrator can get an overview of the characteristics of the cyber attacks that the system has received, and can learn, for example, the methods typically used by a specific attacker group.

[0058] In addition, the system administrator can identify a list of rules for which a hypothesis may be established from the "Rules" column shown in Figure 5. Furthermore, the system administrator can understand the logic by which a hypothesis is established by a combination of evidence from the "Rules" and "Evidence".

[0059] In addition, the system administrator can compare rules based on the content presented in Figure 5, and can also set priorities for countermeasures against cyber attacks based on the comparison results. In other words, when there is a large amount of evidence, the system administrator can determine which evidence should be given top priority. For example, in Figure 5, if rule T1041 (large-volume communication with C2 servers) should be given priority over rule T1002 (creation of suspicious compressed files), the system administrator will first take action against evidence related to rule T1041.

[0060] Example 2: Specific example 2 will be described with reference to Fig. 6. Fig. 6 shows observation literals presented in specific example 2.

[0061] In Specific Example 2, the following rules are constructed based on the "ATT&CK Matrix for Enterprise." As in Specific Example 1, each rule means that when the literal of the antecedent is observed, the "Lateral Movement" Tactics is realized by the Technique represented by the rule name. executeProgramForPassTheHash(t1) ⇒ LateralMovement(t1) Rule name: T1075_PasstheHash scheduleTaskRemotely(t3) ^ registerTask(t4) ⇒ LateralMovement(t3) Rule name: T1053_ScheduledTask

[0062] The meaning of the literals in the antecedent of each rule is as follows: executeProgramForPassTheHash: A program to achieve Pass The Hash was executed. scheduleTaskRemotely: A scheduled task was set on the remote destination registerTask: A registered task

[0063] In addition, in the specific example 2, it is assumed that the observed events include "executeProgramForPassTheHash" and "scheduleTaskRemotely". And it is assumed that "LateralMovement" is specified as the hypothesis literal. In this case, the presented observed literal is as shown in FIG. 6.

[0064] As shown in Figure 6, in Example 2, "registerTask" does not exist in the observed event, but by referring to the antecedent of rule T1053, "registerTask" is presented surrounded by a dashed line so that it can be distinguished from the observed literal extracted from the observed event. This suggests to the system administrator as a hypothesis evidence that is not currently observed but may become clear through further detailed investigation.

[0065] In other words, in Example 2, it is observed that "a scheduled task is set at the remote destination", but it is unknown whether "a registered task" exists at the remote destination. In this case, the system administrator can determine whether it is necessary to investigate the existence of the registered task.

[0066] In the conventional abductive reasoning described in the Background section, hypotheses that have a hypothesis literal that does not cause unification generally have a high cost, so a solution hypothesis is obtained in which "executeProgramForPassTheHash" is linked as evidence for "LateralMovement" (rule T1075 is adopted). For this reason, the hypothesis literal "registerTask" based on rule T1053 is not presented at all, so the system administrator does not notice the possibility of "registerTask".

[0067] A rule in which none of the literals in the antecedent are observed may not be presented. In other words, in the above-mentioned concrete example 2, assume that the observed event only includes "executeProgramForPassTheHash". In this case, for rule T1053, none of the literals in the antecedent are observed, so there is no clue for investigation. Therefore, such a rule may not be presented.

[0068] Example 3: The presentation unit 14 can also determine whether or not there is a relationship between the extracted observation literals according to a set rule, and present the observation literals that are determined to be related together.

[0069] For example, assume that the following rule exists and that "trail1" and "trail2" exist in the observed events. ·trail1(time1,pc,filename) ^ trail2(time2,pc,user) => Tactic1(time1)

[0070] In this case, the above rule specifies that the term value "pc" is the same for trail1 and trail2. Therefore, if the observation literals are "trail1(*,PC1,*)" and "trail2(*,PC1,*)", they can be presented together. However, if the observation literals are "trail1(*,PC1,*)" and "trail2(*,PC2,*)", they cannot be presented together. Here, "*" represents any value. Note that the term values ​​"time1" and "time2" are times. Therefore, if the difference between "time1" and "time2" is within the set range, "trail1" and "trail2" can be presented together.

[0071] In this way, according to the concrete example 3, the system administrator may be able to find a relationship between "filename" and "user" which are not directly associated by the above-mentioned rules.

[0072] Example 4: Specific example 4 will be described with reference to Fig. 7. Fig. 7 shows observed events and rules used in specific example 4, and solution hypotheses generated from them. In Fig. 7 as well, black boxes indicate observation literals, and white boxes indicate hypothesis literals. Moreover, arrows indicate backward inference along the direction of the arrow, and dashed lines indicate unification.

[0073] 7, if "Tactic2(t2)" is specified as a hypothesis literal, the knowledge extraction unit 12 extracts rules (2) and (3). The observation logical formula extraction unit 13 also identifies "Tactic1", "Technique2-1", and "Technique2-2" as literals included in the antecedents of the rules.

[0074] In the example of Figure 7, "Tactic1" is not observed in principle, so there is no meaning in identifying it as a literal. For this reason, it is better not to extract all literals contained in the antecedent of the rule, but to set literals to be excluded from extraction in advance for each rule. In the example of Figure 7, it is better to exclude "Tactic1" from extraction in advance. Also, in the example of Figure 7, the rules are designed so that "Tactic" is chained as a solution hypothesis. For this reason, it is sufficient to extract only the Technique portion as the "evidence" of each "Tactic."

[0075] [program] The first program in the embodiment may be a program that causes a computer to execute steps A2 to A6 shown in Fig. 4. By installing and executing this program in a computer, the inference analysis device 10 and the inference analysis method in the embodiment can be realized. In this case, the processor of the computer functions as a hypothesis logical formula designation unit 11, a knowledge extraction unit 12, an observation logical formula extraction unit 13, and a presentation unit 14 to perform processing. Examples of the computer include a general-purpose PC, a smartphone, and a tablet terminal device.

[0076] The first program in the embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the hypothesis logical formula designation unit 11, the knowledge extraction unit 12, the observation logical formula extraction unit 13, and the presentation unit 14.

[0077] The second program in the embodiment may be a program that causes a computer to execute steps A1 to A6 shown in Fig. 4. By installing and executing this program in a computer, the inference device 20 and the inference method in the embodiment can be realized. In this case, the processor of the computer functions as a hypothesis generation unit 21, a hypothesis logical formula designation unit 11, a knowledge extraction unit 12, an observation logical formula extraction unit 13, and a presentation unit 14 to perform processing. In this case, examples of the computer include a general-purpose PC, a smartphone, and a tablet terminal device.

[0078] In addition, in the embodiment, the memory unit 22 may be realized by storing the data files that constitute it in a storage device such as a hard disk provided in the computer, or may be realized by a storage device of another computer.

[0079] Furthermore, the second program may also be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the hypothesis generation unit 21, the hypothesis logical formula designation unit 11, the knowledge extraction unit 12, the observation logical formula extraction unit 13, and the presentation unit 14.

[0080] [Physical configuration] Here, a computer that realizes the inference analysis device 10 and the inference device 20 by executing the program in the embodiment will be described with reference to Fig. 8. Fig. 8 is a block diagram showing an example of a computer that realizes the inference analysis device and the inference device in the embodiment.

[0081] 8, the computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other.

[0082] Furthermore, the computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to or instead of the CPU 111. In this embodiment, the GPU or FPGA can execute the programs in the embodiments.

[0083] The CPU 111 loads a program composed of a group of codes stored in the storage device 113 into the main memory 112 and executes each code in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

[0084] Moreover, the program in the embodiment is provided in a state stored in a computer-readable recording medium 120. The program in the embodiment may be distributed on the Internet connected via the communication interface 117.

[0085] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0086] Data reader / writer 116 mediates data transmission between CPU 111 and recording medium 120, reads programs from recording medium 120, and writes processing results in computer 110 to recording medium 120. Communication interface 117 mediates data transmission between CPU 111 and other computers.

[0087] Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as a flexible disk, or optical recording media such as a CD-ROM (Compact Disk Read Only Memory).

[0088] The inference analysis device 10 and the inference device 20 in the embodiments can be realized by using hardware corresponding to each part, rather than a computer on which a program is installed. Furthermore, the inference analysis device 10 and the inference device 20 may be partially realized by a program and the remaining part by hardware.

[0089] A part or all of the above-described embodiment can be expressed by (Additional Notes 1) to (Additional Notes 21) described below, but is not limited to the following descriptions.

[0090] (Appendix 1) a hypothesis logical formula designation unit that accepts a specified hypothesis logical formula when any of the hypothesis logical formulas constituting a hypothesis is specified in a hypothesis generated by inference in which inference knowledge is applied to an observation logical formula; a knowledge extraction unit for extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction unit that identifies a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracts an observation logical formula that is the same predicate as the identified logical formula; An inference analysis device comprising:

[0091] (Appendix 2) 2. The inference analysis apparatus of claim 1, a presentation unit that presents the observation logical formula extracted by the observation logical formula extraction unit, An inference analysis device characterized by:

[0092] (Appendix 3) 3. An inference analysis apparatus as claimed in claim 2, comprising: the presentation unit classifies the extracted observation logical formulas for each of the inference knowledges including the logical formulas specified at the time of extraction, and presents the extracted observation logical formulas in a classified state. An inference analysis device characterized by:

[0093] (Appendix 4) 4. An inference analysis apparatus according to claim 2 or 3, comprising: the presentation unit presents, among the logical formulas identified by the observation logical formula extraction unit, those that have not been extracted as the observation logical formula, separately from the extracted observation logical formulas. An inference analysis device characterized by:

[0094] (Appendix 5) An inference analysis device according to any one of appendixes 2 to 4, the presentation unit, when a plurality of logical formulas are identified by the observation logical formula extraction unit and a plurality of the observation logical formulas are further extracted, determines whether or not there is a relationship between the extracted observation logical formulas, and presents the observation logical formulas determined to be related together. An inference analysis device characterized by:

[0095] (Appendix 6) An inference analysis device according to any one of claims 1 to 5, the observation logical formula extraction unit extracts an observation logical formula that is the same predicate as the identified logical formula only for a logical formula that satisfies a set condition from among the identified logical formulas; An inference analysis device characterized by:

[0096] (Appendix 7) a hypothesis generation unit that performs inference by applying inference knowledge to an observation logical formula to generate hypotheses; a hypothesis logical expression designation unit that accepts a specified hypothesis logical expression when any of the hypothesis logical expressions constituting the hypothesis is specified in the generated hypothesis; a knowledge extraction unit for extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction unit that identifies a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracts an observation logical formula that is the same predicate as the identified logical formula; An inference device comprising:

[0097] (Appendix 8) a hypothesis logical formula specification step of accepting a specified hypothesis logical formula when any of the hypothesis logical formulas constituting a hypothesis is specified in a hypothesis generated by inference in which inference knowledge is applied to an observation logical formula; a knowledge extraction step of extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction step of identifying a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracting an observation logical formula having the same predicate as the identified logical formula; 13. An inference analysis method comprising:

[0098] (Appendix 9) 9. The inference analysis method of claim 8, further comprising: The method further includes a presentation step of presenting the observation logical formula extracted by the observation logical formula extraction step. 13. An inference analysis method comprising:

[0099] (Appendix 10) 10. The inference analysis method of claim 9, further comprising: In the presenting step, the extracted observation logical formulas are classified for each inference knowledge including the logical formula specified at the time of extraction, and the extracted observation logical formulas are presented in a classified state. 13. An inference analysis method comprising:

[0100] (Appendix 11) 11. The inference analysis method according to claim 9 or 10, further comprising: In the presenting step, among the logical formulas identified in the observation logical formula extraction step, those which have not been extracted as the observation logical formula are presented separately from the extracted observation logical formulas. 13. An inference analysis method comprising:

[0101] (Appendix 12) An inference analysis method according to any one of claims 9 to 11, In the presenting step, when a plurality of logical formulas are identified by the observation logical formula extraction step and a plurality of the observation logical formulas are further extracted, the presence or absence of relevance between the extracted observation logical formulas is determined, and the observation logical formulas determined to be relevance are presented together. 13. An inference analysis method comprising:

[0102] (Appendix 13) An inference analysis method according to any one of appendices 8 to 12, In the observation logical formula extraction step, an observation logical formula having the same predicate as that of only a logical formula that satisfies a set condition among the identified logical formulas is extracted. 13. An inference analysis method comprising:

[0103] (Appendix 14) On the computer, a hypothesis logical formula specification step of accepting a specified hypothesis logical formula when any of the hypothesis logical formulas constituting a hypothesis is specified in a hypothesis generated by inference in which inference knowledge is applied to an observation logical formula; a knowledge extraction step of extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction step of identifying a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracting an observation logical formula having the same predicate as the identified logical formula; Run R, Program Hmm.

[0104] (Appendix 15) As described in Appendix 14 program And, before The computer, a presentation step of presenting the observation logical formula extracted by the observation logical formula extraction step; Furthermore Run R, Characterized by program .

[0105] (Appendix 16) As described in Appendix 15 program And, In the presenting step, the extracted observation logical formulas are classified for each inference knowledge including the logical formula specified at the time of extraction, and the extracted observation logical formulas are presented in a classified state. Characterized by program .

[0106] (Appendix 17) The method described in Appendix 15 or 16 program And, In the presenting step, among the logical formulas identified in the observation logical formula extraction step, those which have not been extracted as the observation logical formula are presented separately from the extracted observation logical formulas. Characterized by program .

[0107] (Appendix 18) Any of Supplementary Notes 15 to 17 program And, In the presenting step, when a plurality of logical formulas are identified by the observation logical formula extraction step and a plurality of the observation logical formulas are further extracted, the presence or absence of relevance between the extracted observation logical formulas is determined, and the observation logical formulas determined to be relevance are presented together. Characterized by program .

[0108] (Appendix 19) Any of Supplementary Notes 14 to 18 program And, In the observation logical formula extraction step, an observation logical formula having the same predicate as that of only a logical formula that satisfies a set condition among the identified logical formulas is extracted. Characterized by program .

[0109] (Appendix 20) a hypothesis generation step of performing inference by applying inference knowledge to the observation formula to generate hypotheses; a hypothesis logical expression designation step of accepting a designated hypothesis logical expression when any of the hypothesis logical expressions constituting the hypothesis is designated in the generated hypothesis; a knowledge extraction step of extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction step of identifying a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracting an observation logical formula having the same predicate as the identified logical formula; 13. An inference method comprising:

[0110] (Appendix 21) On the computer, a hypothesis generation step of performing inference by applying inference knowledge to the observation formula to generate hypotheses; a hypothesis logical expression designation step of accepting a designated hypothesis logical expression when any of the hypothesis logical expressions constituting the hypothesis is designated in the generated hypothesis; a knowledge extraction step of extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction step of identifying a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracting an observation logical formula having the same predicate as the identified logical formula; Run R, Program Hmm.

[0111] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Industrial Applicability]

[0112] As described above, according to the present invention, it is possible to comprehensively present hypotheses derived from hypothetical reasoning performed on observed events. The present invention is useful in various fields where hypothetical reasoning is performed. [Explanation of symbols]

[0113] 10 Inference analysis device 11. Hypothesis formula specification section 12 Knowledge extraction part 13 Observation formula extraction section 14 Presentation part 20 Reasoning device 21 Hypothesis Generation Unit 22 Memory section 31 Observed Events 32 Rules 33 Hypothesis 110 Computer 111 CPU 112 Main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display device 120 Recording media 121 Bus

Claims

1. a hypothesis logical formula designation unit that accepts a specified hypothesis logical formula when any of the hypothesis logical formulas constituting a hypothesis is specified in a hypothesis generated by inference in which inference knowledge is applied to an observation logical formula; a knowledge extraction unit for extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction unit that identifies a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracts an observation logical formula that is the same predicate as the identified logical formula; An inference analysis device comprising:

2. 2. The inference analysis apparatus of claim 1, a presentation unit that presents the observation logical formula extracted by the observation logical formula extraction unit, An inference analysis device characterized by:

3. 3. The inference analysis apparatus according to claim 2, the presentation unit classifies the extracted observation logical formulas for each of the inference knowledges including the logical formulas identified at the time of extraction, and presents the extracted observation logical formulas in a classified state. An inference analysis device characterized by:

4. 3. The inference analysis device according to claim 2, the presentation unit presents, among the logical formulas identified by the observation logical formula extraction unit, those that have not been extracted as the observation logical formula, separately from the extracted observation logical formulas. An inference analysis device characterized by:

5. 3. The inference analysis device according to claim 2, the presentation unit, when a plurality of logical formulas are identified by the observation logical formula extraction unit and a plurality of the observation logical formulas are further extracted, determines whether or not there is a relationship between the extracted observation logical formulas, and presents the observation logical formulas determined to be related together. An inference analysis device characterized by:

6. 2. The inference analysis apparatus of claim 1, the observation logical formula extraction unit extracts an observation logical formula that is the same predicate as the identified logical formula only for a logical formula that satisfies a set condition from among the identified logical formulas; An inference analysis device characterized by:

7. a hypothesis generation unit that performs inference by applying inference knowledge to an observation logical formula to generate hypotheses; a hypothesis logical expression designation unit that accepts a specified hypothesis logical expression when any of the hypothesis logical expressions constituting the hypothesis is specified in the generated hypothesis; a knowledge extraction unit for extracting inference knowledge including the specified hypothetical logical formula in its consequent from the inference knowledge; an observation logical formula extraction unit that identifies a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracts an observation logical formula that is the same predicate as the identified logical formula; An inference device comprising:

8. A computer-implemented method comprising: In a hypothesis generated by inference that applies inference knowledge to an observation logical formula, when any of the hypothesis logical formulas that constitute the hypothesis is specified, the specified hypothesis logical formula is accepted; extracting inference knowledge that includes the specified hypothetical logical formula in its consequent from the inference knowledge; Identifying a logical formula included in the antecedent of the extracted inference knowledge from the observation logical formulas, and extracting an observation logical formula having the same predicate as the identified logical formula; 13. An inference analysis method comprising:

9. 9. The method of inference analysis according to claim 8, further comprising: Presenting the extracted observation formula; 13. An inference analysis method comprising:

10. 10. The method of inference analysis according to claim 9, further comprising: The extracted observation logical formulas are classified into inference knowledges each including the logical formula specified at the time of extraction, and the extracted observation logical formulas are presented in a classified state.

13. An inference analysis method comprising:

11. 10. The method of inference analysis according to claim 9, further comprising: Among the identified logical expressions, those that have not been extracted as the observation logical expressions are presented separately from the extracted observation logical expressions.

13. An inference analysis method comprising:

12. 10. The method of inference analysis according to claim 9, further comprising: When a plurality of the logical expressions are identified and a plurality of the observation logical expressions are extracted, the presence or absence of relevance between the extracted observation logical expressions is determined, and the observation logical expressions determined to be relevance are presented together.

13. An inference analysis method comprising:

13. 9. The method of inference analysis according to claim 8, further comprising: extracting an observation logical formula, which is the same predicate as the identified logical formula, only for a logical formula that satisfies a set condition from among the identified logical formulas; 13. An inference analysis method comprising:

14. On the computer, In a hypothesis generated by inference that applies inference knowledge to an observation logical formula, when any of the hypothesis logical formulas that constitute the hypothesis is specified, the specified hypothesis logical formula is accepted; extracting inference knowledge that includes the specified hypothetical logical formula in its consequent from the inference knowledge; A logical formula included in the antecedent of the extracted inference knowledge is identified from the observation logical formulas, and an observation logical formula having the same predicate as the identified logical formula is extracted. program.

15. The program according to claim 14, The computer includes: Furthermore, the extracted observation formula is presented. A program characterized by:

16. The program according to claim 15, The computer includes: classifying the extracted observation logical formulas for each of the inference knowledges including the logical formulas specified at the time of extraction, and presenting the extracted observation logical formulas in a classified state; A program characterized by:

17. The program according to claim 15, The computer includes: Among the identified logical expressions, those that have not been extracted as the observation logical expressions are presented separately from the extracted observation logical expressions. A program characterized by:

18. The program according to claim 15, The computer includes: When a plurality of the logical expressions are identified and a plurality of the observation logical expressions are extracted, the presence or absence of relevance between the extracted observation logical expressions is determined, and the observation logical expressions determined to be relevance are collectively presented. A program characterized by:

19. The program according to claim 14, The computer includes: extracting an observation logical formula, which is the same predicate as the identified logical formula, only for a logical formula that satisfies a set condition from among the identified logical formulas; A program characterized by:

Images