Information processing device, information processing method, and information processing program

Abstract

An information processing device (100) comprises: a decoy theme inference unit (130) that infers, on the basis of an access log (21) indicating an access in an object system by a high risk user who is a user of the object system, a decoy theme which is a theme of information which the high risk user is trying to leak to the outside; and a decoy placement unit (140) that places, in the object system, a decoy file corresponding to the inferred decoy theme.

Description

[Technical field]

[0001] The present disclosure relates to an information processing device, an information processing method, and an information processing program. [Background technology]

[0002] Patent Document 1 discloses a technology for generating decoy data (a specific example is a decoy email) containing information (a specific example is information indicating a uniform resource locator (URL), identification (ID), and password) to induce a third party intercepting emails on a network to access a decoy server, and placing the generated decoy data on a network. Here, any decoy file is placed on the decoy server. It is also preferable that the decoy file contains performance information, new product information, confidential information, new technology information, personal information, etc. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2010-134832 A Summary of the Invention [Problem to be solved by the invention]

[0004] If the attacker is a malicious third party, it is sufficient to prepare decoy data related to information in which the attacker is interested and specific information that is generally known to be attractive to the attacker, and place the prepared decoy data on the network as in the conventional technology. Specific examples of the specific information include information indicating at least one of ID, password, system configuration, personal information, and funds. However, when considering information leakage by an internal fraudster, information contained in various files created in daily work can also be the target of theft. An example of an internal fraudster is a malicious employee. If decoy data is prepared for all files, the amount of decoy data will be enormous. In addition, since an internal fraudster is considered to have the intention of leaking information that fits a certain theme, it is not effective to present a decoy file that does not fit the internal fraudster's theme. Specific examples of themes are "defense-related," "machine learning-related," or "design document-related." Furthermore, if a large number of decoy files that do not fit the internal fraudster's theme are presented, or if the contents of the decoy files are unrelated to the company's business, the internal fraudster is more likely to realize that they are decoy files, so the contents of the decoy files need to be devised.

[0005] The present disclosure aims to automatically place decoy files that match the presumed theme of information that an internal fraudster is attempting to leak to the outside in a deception system that uses decoy data. [Means for solving the problem]

[0006] The information processing device according to the present disclosure includes: a decoy theme estimation unit that estimates a decoy theme, which is a theme of information that a high-risk user is attempting to leak to the outside, based on an access log indicating access to the target system by the high-risk user who is a user of the target system; a decoy placement unit that places a decoy file that matches the estimated decoy theme in the target system; Equipped with. Effect of the Invention

[0007] According to the present disclosure, a decoy theme estimation unit estimates the theme of information that a high-risk user is about to leak to the outside based on an access log, and a decoy placement unit places a decoy file that matches the estimated theme in a target system. Here, the high-risk user may be an internal fraudster. Therefore, according to the present disclosure, in a deception system using decoy data, a decoy file that matches the estimated theme of information that an internal fraudster is about to leak to the outside can be automatically placed. [Brief description of the drawings]

[0008] [Figure 1] A diagram explaining file access by an internal malicious actor. [Diagram 2] 1 is a diagram showing an example of the configuration of an information processing device 100 according to a first embodiment. [Diagram 3] 1 is a diagram showing an example of the configuration of an information processing system 90 according to a first embodiment. [Figure 4] 1 is a diagram showing an example of a hardware configuration of an information processing device 100 according to a first embodiment. [Diagram 5] 4 is a flowchart showing the operation of the information processing device 100 according to the first embodiment. [Figure 6] 4 is a flowchart showing the operation of the decoy theme estimation unit 130 according to the first embodiment. [Figure 7] 4 is a flowchart showing the operation of the decoy theme estimation unit 130 according to the first embodiment. [Figure 8] 5 is a flowchart showing the operation of a decoy placement unit 140 according to the first embodiment. [Figure 9] 5 is a flowchart showing the operation of a decoy placement unit 140 according to the first embodiment. [Figure 10] FIG. 13 is a diagram showing an example of a hardware configuration of an information processing device 100 according to a modification of the first embodiment. [Figure 11] FIG. 13 is a diagram showing an example of the configuration of an information processing device 100 according to a second embodiment. [Figure 12] 10 is a flowchart showing the operation of the information processing device 100 according to the second embodiment. [Figure 13] FIG. 13 is a diagram showing an example of the configuration of an information processing device 100 according to a third embodiment. [Figure 14] FIG. 13 is a diagram showing an example of the configuration of an information processing device 100 according to a fourth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] In the description of the embodiments and the drawings, the same elements and corresponding elements are given the same reference numerals. Descriptions of elements given the same reference numerals are omitted or simplified as appropriate. Arrows in the drawings primarily indicate data flow or processing flow. In addition, "part" may be read as "circuit," "step," "procedure," "processing," or "circuitry" as appropriate.

[0010] Embodiment 1 Hereinafter, the present embodiment will be described in detail with reference to the drawings. Even for an internal malicious actor, it is difficult to target and view only files that contain the information he or she is looking for, so it is considered that the internal malicious actor searches for the file containing the information he or she is looking for while checking various files. An internal malicious actor is an entity that operates within an organization with the purpose of stealing data from the organization. A specific example of an internal malicious actor is an internal criminal in the target system 20, or malware that has stolen legitimate credentials and that infects a PC (Personal Computer) used in the organization that manages the target system 20. An internal criminal is a user who has legitimate access rights and is involved in security attacks within the organization. An internal criminal is also a user with malicious intent. A specific example of malware is one that operates autonomously by itself, or one that operates according to commands from an attacker outside the organization via a command and control server on the Internet. Figure 1 is a diagram explaining file access by an internal malicious actor. In Figure 1, an S in a circle indicates confidentiality. As shown in Figure 1, when searching for a file containing the information they are looking for, an internal malicious actor basically accesses files related to the information they want to leak and files that are not related to the information they want to leak. For this reason, it is desirable to predict the information an employee is looking for based on several files the employee viewed before being identified as an internal malicious actor, and to prepare a decoy file based on the predicted information. Here, it is not realistic to pre-label all files created in daily work with a theme. Specific examples of themes are "defense-related," "machine learning-related," or "design document-related." Furthermore, if a file is pre-labeled every time it is newly created or modified, this may cause problems in normal work. Therefore, in this embodiment, an employee believed to be an internal fraudster is identified, the themes of files viewed by the identified employee are checked, the themes in which the identified employee is interested are inferred based on the checked themes, a decoy file matching the inferred themes is prepared, and the prepared decoy file is placed.

[0011] ***Configuration Description*** Fig. 2 shows an example of the configuration of information processing device 100 according to this embodiment. As shown in Fig. 2, information processing device 100 includes log collection unit 110, risk value calculation unit 120, decoy theme estimation unit 130, decoy placement unit 140, and decoy monitoring unit 150. Information processing device 100 also stores an access log DB (Database) 180 and a decoy file DB 190.

[0012] The log collection unit 110 collects the access log 21 and the access log for the decoy file 191, and records the collected logs in the access log DB 180. The access log 21 is a log of file access in the target system 20.

[0013] The decoy file 191 is a file used to detect an internal fraudster, and specific examples thereof include a presentation material or a data set for image processing. The decoy file 191 is a file generated to match each theme that may be output as a decoy theme by the decoy theme estimation unit 130. The decoy file 191 may be a file generated manually, a file generated by modifying a regular file, a file generated according to a predetermined rule, a file generated using natural language processing, or a file generated using AI (Artificial Intelligence) technology. The decoy file 191 is basically a file that is generated so as not to appear suspicious to an internal malicious actor. As a specific example, the file name of the decoy file 191 follows a predetermined naming rule, the icon of the decoy file 191 is the same as the icon of a regular file, and the contents of the decoy file 191 are superficially similar to the contents of the regular file.

[0014] The target system 20 is a computer system used by multiple users in their work, and is a system that stores multiple files. As a specific example, the target system 20 is a system operated based on zero trust, and is composed of at least one of an on-premise system and a cloud system. The target system 20 manages each of the multiple files as a part of a file tree. The file tree is a file system that manages multiple files hierarchically. In the target system 20, each file is stored in a folder, and each user accesses each file managed by the target system 20 using a file access tool. The folder is also called a directory. The file access tool is a tool that allows each user to access each file, and as a specific example, it is an explorer or a browser. Each user is a user of the target system 20. Each user may be a human being or a computer.

[0015] The risk value calculation unit 120 calculates a risk value corresponding to each user based on a log of file accesses and the like in the target system 20. When the decoy file 191 is not arranged, the risk value calculation unit 120 typically calculates a risk value corresponding to each user based on the access pattern of each user in the target system 20. Even when the decoy file 191 is arranged, the risk value calculation unit 120 may calculate a risk value corresponding to each user based on the access pattern of each user in the target system 20. When the decoy file 191 is arranged in the target system 20, the risk value calculation unit 120 may use an access log for the decoy file 191 when calculating a risk value corresponding to each user. When the target user accesses at least one of one or more decoy files 191, the risk value calculation unit 120 may increase the risk value corresponding to the target user. The risk value corresponding to each user is a value calculated according to the behavior of each user in the target system 20, and is a value corresponding to the possibility that each user is actually an internal malicious actor. The behavior of each user in the target system 20 is the actions of each user in the target system 20. Specific examples of components of the behavior of each user are the files accessed by each user, the order of file access by each user, the time period during which each user performed file access, and the number of file accesses per unit time by each user. The risk value calculation unit 120 may model a normal behavior pattern in the target system 20 for each user from a log of file access etc. in advance, and calculate the degree to which the actual behavior of each user in the target system 20 deviates from the modeled normal behavior pattern as a risk value corresponding to each user. When modeling the normal behavior pattern, the risk value calculation unit 120 may utilize a technique such as machine learning, or may use a technique for detecting abnormal behavior for each user based on an access log such as User and Entity Behavior Analytics (UEBA). Moreover, the risk value calculation unit 120 generates high-risk user information 121 and outputs the generated high-risk user information 121. The high-risk user information 121 is information indicating each high-risk user and the characteristics of each high-risk user. The high-risk user information 121 includes, as a specific example, data indicating each high-risk user, a risk value corresponding to each high-risk user, and one or more files accessed by each high-risk user. A high-risk user is a user of the target system 20, a user whose corresponding risk value is equal to or greater than a risk reference value that is a predetermined threshold value, and a user who is relatively likely to be an internal fraudster. Note that when at least one of the access log 21 and the decoy file access information 151 is updated, the high-risk user information 121 may be updated based on the updated information.

[0016] The decoy theme estimation unit 130 estimates a decoy theme based on an access log indicating access to the target system 20 by a high-risk user, generates decoy theme information 131 indicating the estimated decoy theme, and outputs the generated decoy theme information 131. The decoy theme estimation unit 130 may estimate a decoy theme using at least one of natural language processing and a theme list consisting of a plurality of themes each of which is a candidate for a decoy theme. The theme list is a list consisting of a plurality of themes each of which is a candidate for a decoy theme. Each theme may be a word. Specific examples of the themes included in the theme list are the words "transportation," "defense," and "communications." A decoy theme is a theme that is presumed to be of interest to a high-risk user, and is a theme of information that a high-risk user is trying to leak to the outside. Specific examples of decoy themes include business-level themes such as "transportation", "defense", and "communications", technology-level themes such as "AI", "image processing", and "behavior detection", document-level themes such as "system design document" and "proposal", format-level themes such as "text document" and "presentation material", and combinations of these. Also, the decoy theme does not have to be a verbalized theme as described above. As a specific example, a file selected based on the degree of similarity between documents analyzed using natural language processing may be set as the decoy theme. As a detailed specific example, the decoy theme estimation unit 130 classifies files accessed by high-risk users using a clustering technique, and estimates the cluster that has the largest number of files among the generated clusters as the decoy theme. After that, the decoy file 191 that is most similar to the cluster corresponding to the decoy theme estimated by the decoy theme estimation unit 130 is selected from the decoy file DB 190. As a specific example, the decoy theme estimation unit 130 estimates a decoy theme by analyzing the theme based on the folder name of the folder that the high-risk user has viewed and the file name and content of the file that the high-risk user has viewed. Note that the decoy theme estimation unit 130 may estimate multiple decoy themes as decoy themes corresponding to a certain high-risk user. In addition, since a high-risk user does not necessarily access only files related to information that the high-risk user wants to leak, a theme unrelated to the theme in which the high-risk user is actually interested may be estimated as a decoy theme.

[0017] The decoy placement unit 140 selects one or more decoy files 191 from the decoy file DB 190 based on the decoy theme estimated by the decoy theme estimation unit 130, and places the selected one or more decoy files 191 in the placement target area. Placing the decoy file 191 includes instructing a plug-in or the like to place the decoy file 191. The placement target area is an area corresponding to a part of a file tree managed by the target system 20. The placement target area may be an area including a folder in which a file matching the decoy theme estimated by the decoy theme estimation unit 130 is placed, an area including the periphery of an area accessed by a high-risk user, or an area including an area expected to be accessed by a high-risk user in the future. The decoy placement unit 140 may select the decoy file 191 from the decoy file DB 190 using at least one of natural language processing and a theme list. Specifically, decoy placement unit 140 selects one or more decoy files 191 that match the decoy theme estimated by decoy theme estimation unit 130 from decoy file DB 190, issues an instruction to target system 20 to place each selected decoy file 191 in the placement target area, generates decoy file information 141 corresponding to the executed instruction, and outputs the generated decoy file information 141. Decoy file information 141 corresponding to a certain decoy file 191 is information indicating the file name and placement location of the certain decoy file 191. Decoy placement unit 140 may place decoy file 191 in target system 20 instead of issuing an instruction to target system 20 to place decoy file 191. The decoy placement unit 140 may extract topics from the contents and file names of files accessed by high-risk users, further narrow down the area where files or directories related to the extracted topics exist, and place the decoy file 191 in the narrowed down area. At this time, the decoy placement unit 140 may extract topics using a topic model such as Top2Vec. The decoy placement unit 140 may create a decoy folder and instruct the target system 20 to place the decoy file 191 in the created decoy folder. The decoy placement unit 140 may add information indicating that the decoy file 191 has been accessed to the access log 21 corresponding to each user.

[0018] The decoy monitoring unit 150 monitors access to each decoy file 191 indicated by the decoy file information 141 for each high-risk user indicated by the high-risk user information 121, generates decoy file access information 151 corresponding to the monitoring result, and outputs the generated decoy file access information 151. As a specific example, when there is a high-risk user who has accessed the decoy file 191 a predetermined number of times or more, the decoy file access information 151 is information indicating that the high-risk user has accessed the decoy file 191 a predetermined number of times or more. The decoy file access information 151 may be information indicating that a user other than the high-risk user has accessed the decoy file 191. As a specific example, a method of selecting the decoy file 191 based on the estimated decoy theme is a method using a rule base or a method using natural language processing technology. The analyst may narrow down the high-risk users based on the decoy file access information 151 and the high-risk user information 121, and may reflect the narrowed down result in the high-risk user information 121. The analyst is, as a specific example, a person or a computer that analyzes security attacks in the target system 20.

[0019] The access log DB 180 is a database that stores information indicating the access logs in the target system 20 .

[0020] The decoy file DB 190 is a database that stores one or more decoy files 191, and is a database that stores files that are candidates for the decoy file 191. The decoy file DB 190 stores decoy files 191 corresponding to each decoy theme that the decoy theme estimation unit 130 can output.

[0021] Fig. 3 shows an example of an information processing system 90 according to this embodiment. The example of the information processing system 90 will be described with reference to Fig. 3. In Fig. 3, the information processing device 100 is illustrated divided by function. Here, it is assumed that an internal malicious actor investigates files in the target system 20. The risk-based authentication function utilizes risk-based authentication technology to receive the access log 21 of each user from the target system 20 and calculate a risk value corresponding to each user based on the received log. In addition, when the decoy file 191 has already been placed, the risk value calculation unit 120 refers to the access log for the decoy file 191 when calculating the risk value of each user. The internal fraud prevention platform is a system having a function for preventing internal fraud, and has a decoy dynamic distribution function and a file access function. The decoy dynamic distribution function is a function for selecting a folder in which a decoy file 191 is to be placed, selecting a decoy file 191, and placing the selected decoy file 191 in the selected folder. The decoy placement unit 140 instructs the internal fraud prevention plug-in to place a decoy file 191 . The internal tamper prevention plug-in is a software module that realizes additional functions for the file access tool. The function of the decoy monitor 150 is realized by the internal tamper prevention plug-in. The file access tool that realizes the file access function uses an internal fraud prevention plug-in based on an instruction from the decoy dynamic distribution function to place the decoy file 191. The internal fraud prevention plug-in may actually place the decoy file 191 in the target system 20, or may display the decoy file 191 on the operation screen of the file access tool when each user accesses a folder in which the decoy file 191 should be placed, without actually placing the decoy file 191 in the target system 20.

[0022] 4 shows an example of a hardware configuration of the information processing device 100 according to the present embodiment. The information processing device 100 is composed of a general computer. The information processing device 100 may be composed of multiple computers. The target system 20 and the information processing device 100 may be integrally configured.

[0023] As shown in the figure, the information processing device 100 is a computer including hardware such as a processor 11 and a storage device 12. These pieces of hardware are appropriately connected via signal lines.

[0024] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of the computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), and a graphics processing unit (GPU). The information processing device 100 may include a plurality of processors that replace the processor 11. The plurality of processors share the role of the processor 11.

[0025] The storage device 12 is composed of at least one of a volatile storage device and a non-volatile storage device. A specific example of the volatile storage device is a RAM (Random Access Memory). A specific example of the non-volatile storage device is a ROM (Read Only Memory), a HDD (Hard Disk Drive), or a flash memory. Data stored in the storage device 12 is loaded into the processor 11 as necessary.

[0026] The information processing device 100 may include an input / output IF (Interface) and hardware such as a communication device. The input / output IF is a port to which an input device and an output device are connected. An example of the input / output IF is a Universal Serial Bus (USB) terminal. An example of the input device is a keyboard and a mouse. An example of the output device is a display. The communication device is a receiver and a transmitter. Specific examples of the communication device include a communication chip and a NIC (Network Interface Card). Each unit of the information processing device 100 may use an input / output IF and a communication device as appropriate when communicating with other devices.

[0027] The storage device 12 stores an information processing program. The information processing program is a program that causes a computer to realize the functions of each unit of the information processing device 100. The information processing program is loaded into the storage device 12 and executed by the processor 11. The functions of each unit of the information processing device 100 are realized by software. The storage device 12 may store files managed by the target system 20 .

[0028] Data used when executing the information processing program and data obtained by executing the information processing program are appropriately stored in the storage device 12. Each unit of the information processing device 100 appropriately uses the storage device 12. Note that the terms "data" and "information" may have the same meaning. The storage device 12 may be independent of the computer. Each database may be stored in an external server or the like.

[0029] The information processing program may be recorded in a computer-readable non-volatile recording medium. Specific examples of the non-volatile recording medium include an optical disk and a flash memory. The information processing program may be provided as a program product.

[0030] ***Explanation of Operation*** The operation procedure of the information processing device 100 corresponds to an information processing method, and the program that realizes the operation of the information processing device 100 corresponds to an information processing program.

[0031] 5 is a flowchart showing an example of the operation of the information processing device 100. The operation of the information processing device 100 will be described with reference to FIG.

[0032] (Step S101: Risk value calculation process) The risk value calculation unit 120 refers to the access log DB 180 and calculates a risk value relating to the behavior of each user based on the file access log.

[0033] (Step S102: Decoy theme estimation process) The decoy theme estimation unit 130 estimates a decoy theme based on a log of file accesses by high-risk users.

[0034] Fig. 6 is a flowchart showing an example of the process of the decoy theme estimation unit 130 when estimating the decoy theme using natural language processing technology in step S102. The process of the decoy theme estimation unit 130 will be described with reference to Fig. 6. It is assumed that a word embedding model is prepared in advance in this example. The word embedding model may be a publicly available model, a model created using a file in the target system 20, or a model in which information on a file in the target system 20 is added to a publicly available word embedding model.

[0035] (Step S121) The decoy theme estimation unit 130 selects one file that is indicated by the high-risk user information 121 and that has been accessed by the target user.

[0036] (Step S122) The decoy theme estimation unit 130 extracts words whose parts of speech are nouns from the file names and written contents of the files selected in step S121.

[0037] (Step S123) The decoy theme inference unit 130 vectorizes each word extracted in step S122 using a word embedding model, and clusters the generated vectors.

[0038] (Step S124) The decoy theme inference unit 130 extracts words that exist near the center of gravity of the cluster that contains the largest number of words.

[0039] (Step S125) The decoy theme estimation unit 130 records the words extracted in step S124 as themes.

[0040] (Step S126) The decoy theme estimation unit 130 repeats the processes from step S121 to step S125 until all files accessed by the target user among the files indicated by the high-risk user information 121 are confirmed.

[0041] (Step S127) After checking all files accessed by the target user, the decoy theme estimation unit 130 performs clustering on all the themes recorded in step S125.

[0042] (Step S128) The decoy theme estimation unit 130 estimates a word existing near the center of gravity of a cluster containing the most themes as a decoy theme.

[0043] Fig. 7 is a flowchart showing an example of the process of the decoy theme estimation unit 130 when the decoy theme is estimated using both the rule base and natural language processing in step S102. The process of the decoy theme estimation unit 130 will be explained with reference to Fig. 7. In this example, it is assumed that a word embedding model is prepared in advance and a theme list is created in advance.

[0044] (Step S131) The decoy theme estimation unit 130 selects one file that is indicated by the high-risk user information 121 and that has been accessed by the target user.

[0045] (Step S132) The decoy theme estimation unit 130 extracts words whose parts of speech are nouns from the file names and written contents of the files selected in step S131.

[0046] (Step S133) The decoy theme inference unit 130 vectorizes each word extracted in step S132 using a word embedding model. Then, the decoy theme inference unit 130 calculates the similarity between each generated vector and the vector corresponding to each word included in the theme list.

[0047] (Step S134) Based on the similarity calculated in step S133, the decoy theme estimation unit 130 records, among the themes included in the theme list, a theme that has a relatively large number of words whose corresponding similarity is equal to or greater than a predetermined threshold as the theme of the file selected in step S131.

[0048] (Step S135) The decoy theme estimation unit 130 repeats the processes from step S131 to step S134 until all files accessed by the target user among the files indicated by the high-risk user information 121 are confirmed.

[0049] (Step S136) After processing all files accessed by the target user, the decoy theme estimation unit 130 estimates the most frequently appearing theme among all the themes recorded in step S134 as the decoy theme.

[0050] (Step S103: Decoy file placement process) The decoy placement unit 140 selects a decoy file 191 that matches the decoy theme estimated by the decoy theme estimation unit 130 from the decoy file DB 190 , and places the selected decoy file 191 in the target system 20 .

[0051] Fig. 8 is a flowchart showing an example of the process of the decoy placement unit 140 when a natural language processing technique is used to select the decoy file 191 in step S103. The process of the decoy placement unit 140 will be described with reference to Fig. 8. In this example, it is assumed that a word embedding model is prepared in advance.

[0052] (Step S141) The decoy placement unit 140 selects a decoy file 191 from the decoy file DB 190 .

[0053] (Step S142) The decoy placement unit 140 extracts words whose part of speech is a noun from the file name and written contents of the decoy file 191 selected in step S141.

[0054] (Step S143) The decoy placement unit 140 vectorizes each word extracted in step S142 using a word embedding model. Then, the decoy placement unit 140 calculates the similarity between each generated vector and a vector corresponding to a word estimated as a decoy theme.

[0055] (Step S144) Based on the similarity calculated in step S143, the decoy placement unit 140 calculates the number of words whose corresponding similarity exceeds a predetermined threshold value among the words extracted in step S142.

[0056] (Step S145) When the number of words whose corresponding similarities exceed a predetermined threshold value exceeds a predetermined threshold value, the decoy placement unit 140 selects the decoy file 191 selected in step S141 as the decoy file 191 to be placed. The selected decoy file 191 is the decoy file 191 that matches the decoy theme.

[0057] (Step S146) The decoy placement unit 140 repeats the process from step S141 to step S145 until all the decoy files 191 that match the decoy theme among the decoy files 191 stored in the decoy file DB 190 are confirmed.

[0058] Fig. 9 is a flowchart showing an example of the process of the decoy placement unit 140 when the decoy file 191 is selected using both the rule base and natural language processing in step S103. The process of the decoy placement unit 140 will be described with reference to Fig. 9. In this example, it is assumed that a theme list has been created in advance.

[0059] (Step S151) The decoy placement unit 140 receives information indicating the decoy theme from the decoy theme estimation unit 130.

[0060] (Step S152) The decoy placement unit 140 selects a decoy file 191 that matches the decoy theme indicated by the received information from the decoy file DB 190. It is assumed that a decoy file 191 is created for each theme indicated by the theme list.

[0061] (Step S104: Decoy monitoring process) The decoy monitor unit 150 monitors access to the decoy file 191, generates decoy file access information 151 indicating the monitoring results, and outputs the generated decoy file access information 151.

[0062] (Step S105: High-risk user information correction process) The risk value calculation unit 120 modifies the high-risk user information 121 based on the output decoy file access information 151 .

[0063] ***Explanation of the Effects of the First Embodiment*** In conventional technology, even if there was an internal actor attempting to leak information contained in files created during daily work, there was a problem in that it was not possible to automatically select a decoy file related to the information the internal actor was seeking and to place the selected decoy file. On the other hand, according to this embodiment, the themes of files, folders, etc. viewed by a high-risk user are analyzed based on the high-risk user information 121, themes in which the high-risk user is interested are inferred, and a decoy file 191 matching the inferred theme is placed in the target system 20. Therefore, according to this embodiment, the themes of files, folders, etc. viewed by an internal malicious user are analyzed to infer the themes in which the internal malicious user is interested, a decoy file 191 related to information sought by the internal malicious user is automatically selected based on the inferred theme, and the selected decoy file is placed.

[0064] ***Other configurations*** <Variation 1> FIG. 10 shows an example of the hardware configuration of an information processing device 100 according to this modification. The information processing device 100 includes a processing circuit 18 instead of the processor 11 or instead of the processor 11 and the storage device 12 . The processing circuitry 18 is hardware that realizes at least a part of each unit included in the information processing device 100. The processing circuitry 18 may be dedicated hardware, or may be a processor that executes a program stored in the storage device 12 .

[0065] When processing circuitry 18 is dedicated hardware, processing circuitry 18 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The information processing device 100 may include a plurality of processing circuits that replace the processing circuit 18. The plurality of processing circuits share the role of the processing circuit 18.

[0066] In the information processing device 100, some of the functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0067] Processing circuitry 18 is illustratively implemented in hardware, software, firmware, or a combination thereof. The processor 11, the storage device 12, and the processing circuit 18 are collectively referred to as the “processing circuitry.” In other words, the functions of the functional components of the information processing device 100 are realized by the processing circuitry. The information processing device 100 according to other embodiments may have a similar configuration to this modified example.

[0068] Embodiment 2 The following mainly describes the differences from the above-described embodiment with reference to the drawings.

[0069] ***Configuration Description*** Fig. 11 shows an example of the configuration of the information processing device 100 according to the present embodiment. As shown in Fig. 11, the information processing device 100 further includes a decoy content generation unit 160 in comparison with the information processing device 100 according to the first embodiment.

[0070] The decoy content generating unit 160 selects a file from the decoy file DB 190 as the decoy file 191 that matches the decoy theme based on the decoy theme estimated by the decoy theme estimating unit 130, generates a decoy file name of the selected decoy file 191 using a natural language processing technique or the like based on the decoy theme estimated by the decoy theme estimating unit 130, and outputs the selected decoy file 191 and information indicating the generated decoy file name. The decoy file name is a file name devised to increase the possibility that an internal malicious person will confirm the decoy file 191 corresponding to the decoy file name. A specific example of a method for generating a decoy file name based on a decoy theme is a method using rule-based or natural language processing technology. Specifically, there is a method of adding characters to the file name of each file accessed by a high-risk user corresponding to the decoy theme in a rule-based manner. Specific examples of characters added to the file name are "_update" or "_(date)". Another example is a method of generating a decoy file name by extracting words that are nouns from multiple file names corresponding to the decoy theme using natural language processing, extracting common words from the extracted words, and modifying the nouns included in the file names of existing decoy files 191 to include the extracted words.

[0071] The decoy placement unit 140 according to this embodiment uses the decoy file 191 and the file name output by the decoy content generation unit 160. That is, the decoy placement unit 140 sets the file selected by the decoy content generation unit 160 as the decoy file 191, and sets the file name of the decoy file 191 to the file name generated by the decoy content generation unit 160.

[0072] ***Explanation of Operation*** 12 is a flowchart showing an example of the operation of the information processing device 100. The operation of the information processing device 100 will be described with reference to FIG.

[0073] (Step S201: Decoy content generation process) The decoy content generation unit 160 selects a decoy file 191 that matches the decoy theme estimated by the decoy theme estimation unit 130 from the decoy file DB 190, generates a decoy file name based on the decoy theme, and sets the generated decoy file name as the file name of the selected decoy file 191.

[0074] (Step S202: Decoy file placement process) The decoy placement unit 140 places the decoy file 191 selected by the decoy content generation unit 160 in the target system 20. At this time, the decoy placement unit 140 sets the file name of the decoy file 191 to the decoy file name generated by the decoy content generation unit 160.

[0075] ***Explanation of the Effects of the Second Embodiment*** According to this embodiment, the decoy content generating unit 160 generates a file name of the decoy file 191 based on a decoy theme. Therefore, according to this embodiment, the decoy file 191 that is relatively likely to be checked by an internal malicious user can be automatically generated and placed in the target system 20.

[0076] Embodiment 3 The following mainly describes the differences from the above-described embodiment with reference to the drawings.

[0077] ***Configuration Description*** Fig. 13 shows a configuration example of the information processing device 100 according to the present embodiment. As shown in Fig. 13, the information processing device 100 includes a decoy content generating unit 160 and does not store a decoy file DB 190, as compared with the information processing device 100 according to the first embodiment.

[0078] The decoy content generation unit 160 generates the decoy file 191 based on the decoy theme by utilizing natural language processing technology or the like. Specifically, the decoy content generation unit 160 generates the contents and file name of the decoy file 191. The contents and file name of the decoy file 191 are devised so as to increase the possibility that an internal malicious person will check the decoy file 191.

[0079] The decoy placement unit 140 according to this embodiment uses a file generated by the decoy content generation unit 160 as the decoy file 191 .

[0080] ***Explanation of Operation*** The elements of the flowchart showing the operation of information processing device 100 according to the present embodiment are the same as the elements of the flowchart showing the operation of information processing device 100 according to embodiment 2. The differences from embodiment 2 will be described below.

[0081] (Step S201: Decoy content generation process) The decoy content generating unit 160 generates the contents and file name of the decoy file 191 based on the decoy theme estimated by the decoy theme estimating unit 130 .

[0082] (Step S202: Decoy file placement process) The decoy placement unit 140 places the decoy file 191 generated by the decoy content generation unit 160 in the target system 20 .

[0083] ***Explanation of the Effects of the Third Embodiment*** According to this embodiment, the decoy content generating unit 160 generates the decoy file 191 based on the decoy theme. Therefore, according to this embodiment, the decoy file 191 that is relatively likely to be checked by an internal malicious user can be automatically generated and placed in the target system 20.

[0084] ***Other configurations*** <Variation 2> It is considered that the viewing time of each file by the target user varies depending on the strength of the interest of the target user. Specifically, it is considered that the target user will view files related to a theme that he or she is more interested in for a longer period of time. Therefore, in this modified example, the viewing time of each file by the target user is taken into consideration.

[0085] The configuration of the information processing device 100 according to this modification is similar to the configuration of the information processing device 100 according to the third embodiment.

[0086] The decoy theme estimation unit 130 according to this modification estimates a decoy theme corresponding to the target user based on each file indicated by the high-risk user information 121 and accessed by the target user and the viewing time of each file stored in the target system 20 by the target user. The decoy theme estimation unit 130 may estimate a decoy theme corresponding to the target user based on the difference between the standard viewing time of each file and the viewing time of each file by the target user. The decoy theme estimation unit 130 may also estimate a decoy theme corresponding to the target user based on the time the target user stayed in each folder, or may estimate a decoy theme corresponding to the target user by considering the number or frequency of access by the target user to each folder or each file. When estimating a decoy theme corresponding to the target user, the decoy theme estimation unit 130 may not use each file whose viewing time by the target user is equal to or less than a threshold value. When the decoy theme estimation unit 130 estimates a decoy theme corresponding to a target user using a theme list as described with reference to FIG. 7, instead of simply counting the number of occurrences of each theme, when each theme is set as a target theme, the decoy theme estimation unit 130 may count a value corresponding to the browsing time by the target user of each file corresponding to the target theme as the number of occurrences of the target theme. In this case, as a specific example, when the browsing time of the target file by the target user is equal to or less than a threshold, the decoy theme estimation unit 130 sets the number of occurrences of the theme corresponding to the target file to 0.5, and when the browsing time of the target file by the target user is greater than the threshold, the number of occurrences of the theme corresponding to the target file to 1.5. Here, the target file is a file accessed by the target user. In addition, the decoy theme estimation unit 130 may count the number of occurrences of the theme corresponding to each file by setting a coefficient whose value increases as the browsing time of the file increases.

[0087] The decoy content generator 160 according to this modification generates the contents and file name of the decoy file 191 based on the decoy theme and the browsing time of each file. When the decoy content generation unit 160 uses natural language processing technology to generate the contents of a decoy file 191 that matches a decoy theme corresponding to a target user, as a specific example, among the files that match the decoy theme, files that have been viewed by the target user for a time period equal to or longer than a threshold are used as input for the natural language processing. When generating file names of decoy files 191 that match the decoy theme corresponding to the target user, the decoy content generating unit 160 uses, as a specific example, the file names of files that match the decoy theme and that have been browsed by the target user for a threshold or more as a base for the file names. In addition, the decoy content generating unit 160 may select the top X files that have been browsed by the target user for the longest time among the files that match the decoy theme, and use the file names of the selected files as a base for the file names.

[0088] According to this modification, the decoy file 191 is a file generated based on the browsing time of the high-risk user. Therefore, according to this modification, the decoy file 191 that is relatively likely to be accessed by the high-risk user can be placed in the target system 20. The method for estimating a decoy theme according to this modified example may be appropriately combined with the method for selecting or generating the decoy file 191 according to other embodiments.

[0089] Embodiment 4 The following mainly describes the differences from the above-described embodiment with reference to the drawings.

[0090] ***Configuration Description*** Fig. 14 shows a configuration example of the information processing device 100 according to the present embodiment. As shown in Fig. 14, the information processing device 100 includes a decoy content generating unit 160, and stores a template file DB200 instead of the decoy file DB190, as compared with the information processing device 100 according to the first embodiment.

[0091] Decoy content generation unit 160 selects a template file from template file DB 200 based on the decoy theme estimated by decoy theme estimation unit 130, modifies the selected template file based on the decoy theme estimated by decoy theme estimation unit 130, and outputs the modified template file as decoy file 191. At this time, as a specific example, decoy content generation unit 160 modifies the content and file name of the template file to content and file name suitable for the decoy theme. Decoy content generation unit 160 may select a template file according to the decoy theme.

[0092] The decoy placement unit 140 according to this embodiment uses the template file modified by the decoy content generation unit 160 as the decoy file 191 .

[0093] The template file DB 200 is a database that stores candidates for template files corresponding to the decoy file 191. The template file corresponding to the decoy file 191 is a file that is used as a template for the decoy file 191. The template file DB 200 may store template files corresponding to each decoy theme that the decoy theme estimation unit 130 can output.

[0094] ***Explanation of Operation*** The elements of the flowchart showing the operation of information processing device 100 according to the present embodiment are the same as the elements of the flowchart showing the operation of information processing device 100 according to the second embodiment.

[0095] (Step S201: Decoy content generation process) The decoy content generation unit 160 selects a template file from the template file DB 200, modifies the content and file name of the selected template file to content and file name appropriate for the decoy theme estimated by the decoy theme estimation unit 130, and outputs the template file with the modified content and file name as a decoy file 191.

[0096] (Step S202: Decoy file placement process) The decoy placement unit 140 places the decoy file 191 generated by the decoy content generation unit 160 in the target system 20 .

[0097] ***Explanation of the effect of the fourth embodiment*** According to this embodiment, the decoy content generating unit 160 generates the decoy file 191 based on the decoy theme and the template file. Therefore, according to this embodiment, the decoy file 191 that is relatively likely to be checked by an internal malicious user can be automatically generated and placed in the target system 20.

[0098] ***Other embodiments*** The above-described embodiments may be freely combined, or any of the components in each embodiment may be modified, or any of the components in each embodiment may be omitted. Moreover, the embodiments are not limited to those shown in the first to fourth embodiments, and various modifications are possible as necessary. The procedures explained using the flowcharts and the like may be modified as appropriate. [Explanation of symbols]

[0099] 11 processor, 12 storage device, 18 processing circuit, 20 target system, 21 access log, 90 information processing system, 100 information processing device, 110 log collection unit, 120 risk value calculation unit, 121 high-risk user information, 130 decoy theme estimation unit, 131 decoy theme information, 140 decoy placement unit, 141 decoy file information, 150 decoy monitoring unit, 151 decoy file access information, 160 decoy content generation unit, 180 access log DB, 190 decoy file DB, 191 decoy file, 200 template file DB.

Claims

1. a decoy theme estimation unit that estimates a decoy theme, which is a theme of information that a high-risk user is attempting to leak to the outside, based on an access log indicating access to the target system by the high-risk user who is a user of the target system; a decoy placement unit that places a decoy file that matches the estimated decoy theme in the target system; a risk value calculation unit that calculates a risk value corresponding to each user based on an access pattern of each user in the target system; An information processing device comprising: The high-risk user is an information processing device that is a user of the target system whose corresponding risk value is equal to or greater than a risk standard value.

2. The information processing apparatus according to claim 1 , wherein the risk value calculation unit increases the risk value corresponding to a target user who is a user of the target system, when the target user accesses the decoy file.

3. 3 . The information processing apparatus according to claim 1 , wherein the decoy placement unit selects, as the decoy file, a file from a database that stores files that are candidates for the decoy file based on the estimated decoy theme.

4. The decoy theme estimation unit estimates the decoy theme using at least one of natural language processing and a theme list including a plurality of themes each of which is a candidate for the decoy theme; The information processing apparatus according to claim 3 , wherein the decoy placement unit selects the decoy file from the database using at least one of natural language processing and the theme list.

5. The information processing device further includes: a decoy content generation unit that selects a file as the decoy file from a database that stores files that are candidates for the decoy file based on the estimated decoy theme, and generates a file name for the decoy file based on the estimated decoy theme; Equipped with 3 . The information processing apparatus according to claim 1 , wherein the decoy arrangement unit sets the selected file as the decoy file and sets the file name of the decoy file as the generated file name.

6. The information processing device further includes: a decoy content generating unit for generating a file based on the estimated decoy theme as the decoy file; Equipped with The information processing apparatus according to claim 1 , wherein the decoy arrangement unit sets the generated file as the decoy file.

7. The information processing device further includes: A decoy content generating unit that selects a template file from a database storing candidates of template files corresponding to the decoy file based on the estimated decoy theme, and modifies the selected template file based on the estimated decoy theme. Equipped with The information processing apparatus according to claim 1 , wherein the decoy arrangement unit sets a modified template file as the decoy file.

8. The information processing apparatus according to claim 1 , wherein the decoy theme estimation unit estimates the decoy theme based on a viewing time of each file stored in the target system by the high-risk user.

9. The computer estimates a decoy theme, which is a theme of information that a high-risk user is attempting to leak to the outside, based on an access log indicating access to the target system by the high-risk user who is a user of the target system; the computer placing a decoy file on the target system that matches the estimated decoy theme; An information processing method in which the computer calculates a risk value corresponding to each user of the target system based on an access pattern of each user of the target system, the information processing method comprising: An information processing method in which the high-risk user is a user of the target system whose corresponding risk value is equal to or greater than a risk standard value.

10. a decoy theme estimation process for estimating a decoy theme, which is a theme of information that a high-risk user is about to leak to the outside, based on an access log indicating access to the target system by the high-risk user who is a user of the target system; A decoy placement process for placing a decoy file that matches the estimated decoy theme in the target system; a risk value calculation process for calculating a risk value corresponding to each user based on an access pattern of each user in the target system; An information processing program for causing an information processing device that is a computer to execute the above, The high-risk user is an information processing program that is a user of the target system whose corresponding risk value is equal to or greater than a risk standard value.

Images