CTI analysis support system, CTI analysis support method

Abstract

To enable supporting work relating to CTI analysis and utilizing the CTI efficiently.SOLUTION: A CTI analysis support system: obtains information provided by a website providing CTI; stores the obtained information; analyzes the information for computing an importance level of the information; stores the computed importance level in association with the information; and outputs the importance level of the information as information related to the information. Moreover, the CTI analysis support system: extracts a unique expression included in the information; stores the extracted unique expression in association with the information; and outputs the extracted unique expression as information related to the information. In addition, the CTI analysis support system: estimates a potential meaning of the unique expression extracted from the information; stores the unique expression as a synonym for another unique expression having the estimated meaning; and outputs the synonym together with the extracted unique expression as information related to the information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a CTI analysis support system and a CTI analysis support method. [Background technology]

[0002] In recent years, against the backdrop of an increase in cyber attacks and their increasing sophistication, it has become increasingly important to obtain Cyber ​​Threat Intelligence (CTI), which compiles information on attackers' methods and characteristics, as well as the malware and vulnerabilities they use, and to keep up with the latest threat information.

[0003] By utilizing CTI, security department personnel at organizations such as companies and government agencies can, for example, learn about the latest attack trends and quickly determine whether there is any impact on the environment, their own products, customers, etc., enabling them to take the necessary defensive and countermeasures quickly and appropriately.

[0004] On the other hand, the number of published CTIs is increasing year by year, and it is not necessarily realistic to manually check all of them. Therefore, various methods are being explored to contribute to the efficient use of CTIs by supporting the task of selecting useful CTIs.

[0005] For example, non-patent document 1 describes a method for grasping the relevance (interdependence) between pieces of information implemented in MISP (Malware Information Sharing Platform), an information sharing platform for cyber threats, and a technology for scoring the importance of information shared in the MISP community.

[0006] For example, Non-Patent Document 2 describes the interdependence of IOCs (Indicators of Compromise) A technique for quantifying the relationships using Graph Convolutional Neural Networks (GCN) is described. [Prior art documents] [Non-patent literature]

[0007] [Non-Patent Document 1] M., Sami, et al: Taxonomy driven indicator scoring in MISP threat intelligence platforms, pages 1-10, [online], 2019-02-08, arXiv, 2021-1-25 Search, URL<https: / / arxiv.org / abs / 1902.03914> . [Non-Patent Document 2] Z., Jun, et al: Cyber ​​Threat Intelligence Modeling Based on Heterogeneous Graph Convolutional Network, pp. 241-256, [online], 2020-10-14, 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID) 2020, 2021-1-25 search, URL<https: / / www.usenix.org / conference / raid2020 / presentation / zhao> . Summary of the Invention [Problem to be solved by the invention]

[0008] In the above Non-Patent Document 1, the importance of IOCs included in CTI is calculated. However, the technology described in the document is premised on the use of MISP, which is structured information in which the contents of CTI are interpreted and registered by humans, and does not take into consideration, for example, CTIs described in natural language. In addition, the document calculates the importance on an IOC basis, and does not describe calculating the importance on a CTI basis.

[0009] In Non-Patent Document 2, CTI described in natural language is structured using natural language processing technology. Then, the importance of IOCs, which are indicators of cyber attacks (indicators of compromise, trace information, security indicators), is calculated. However, the paper does not describe the evaluation of importance in CTI units.

[0010] In this way, the technologies described in Non-Patent Documents 1 and 2 are both configured with a focus on IOC, which is a subset of CTI, and are not configured with the perspective of supporting the task of evaluating importance on a CTI basis and selecting useful CTI.

[0011] The present invention has been made in view of the above background, and has an object to provide a CTI analysis support system and a CTI analysis support method that are capable of supporting work related to CTI analysis. [Means for solving the problem]

[0012] One aspect of the present invention for achieving the above object is a CTI analysis support system, which supports analysis of CTI (Cyber ​​Threat Intelligence), and is configured using an information processing device, and includes an information acquisition unit that acquires information provided at a CTI provider site, a storage unit that stores the acquired information, and a named entity extraction unit that uses a machine learning model for extracting named entities to extract named entities contained in the information and store the extracted named entities in association with the information. 、 an information providing unit that outputs the named entity extracted for the information together with the information;and a latent meaning estimation unit that estimates the latent meaning of the named entity extracted from the information by using natural language processing or a machine learning model that estimates the latent meaning of the named entity, and stores the named entity as a synonym of another named entity having the estimated meaning, wherein the information providing unit outputs the synonym stored for the information together with the information, displays main information of the information, and automatically displays the synonym of the named entity when an operation is performed to specify a display portion of the named entity in the main information. .

[0013] Problems, configurations and effects other than those described above will become apparent from the following description of the preferred embodiment of the invention. Effect of the Invention

[0014] According to the present invention, it is possible to assist in the work involved in analyzing CTI. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a diagram illustrating a schematic configuration example of a CTI analysis support system. [Diagram 2] 13 is an example of acquisition source information TBL. [Diagram 3] 13 is an example of acquired information TBL. [Figure 4] This is an example of a named entity TBL. [Diagram 5] 1 is a sequence diagram illustrating an example of a main operation of the CTI analysis support system. [Figure 6] 13 is an example of an information provision screen. [Figure 7] 13 is a flowchart illustrating an example of an information acquisition and analysis process. [Figure 8] 11 is a flowchart illustrating an example of an information acquisition process. [Figure 9] 11 is a flowchart illustrating an example of a main body information extraction process. [Figure 10] 11 is a flowchart illustrating an example of an information classification process. [Figure 11] 11 is a flowchart illustrating an example of a named entity extraction process. [Figure 12] 11 is a flowchart illustrating an example of a latent meaning estimation process. [Figure 13] 13 is a flowchart illustrating an example of a relationship extraction process. [Figure 14] 11 is a flowchart illustrating an example of an importance calculation process. [Figure 15]11 is a flowchart illustrating an example of an information providing process. [Figure 16] 1 is a diagram illustrating another configuration example of a CTI analysis support system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. The present invention can be implemented in various other forms. The following description and drawings are merely examples for explaining the present invention, and are omitted and simplified as appropriate for clarity of explanation. Each component described below may be singular or plural unless otherwise specified.

[0017] The various information (data) in the following description may be expressed or managed in a manner other than the data structures and data types shown as examples. In the following description, when describing various types of identification information, expressions such as "identifier" and "ID" are used as appropriate, but these are interchangeable.

[0018] In the following description, a table may be written as "TBL." Also, in the following description, the same or similar configurations may be given the same reference numerals and duplicate explanations may be omitted. Also, in the following description, the letter "S" before a reference numeral indicates a processing step. Also, in the following description, the date and time data type is not necessarily limited.

[0019] 1 shows a schematic configuration of an information processing system (hereinafter referred to as "CTI analysis support system 1") that supports the analysis of Cyber ​​Threat Intelligence (CTI), which will be described as one embodiment of the present invention. The CTI analysis support system 1 acquires information provided by a CTI providing site (hereinafter referred to as "CTI providing site 7") on the Internet 5, and analyzes and structures the acquired information to reduce the workload of those who select and use the information, and to support the efficient use of the information.

[0020] The format for structuring the CTI is not necessarily limited, but examples include STIX (Structured Threat Information eXpression), OpenIOC, OTX (AlienVault Open Threat Exchange), MISP (Malware Information Sharing Platform), etc.

[0021] The types of CTI that the CTI analysis support system 1 analyzes are not necessarily limited, but examples include OSINT (Open Source INTelligence), which is intelligence that analyzes publicly available information, HUMINT (HUMan INTelligence), which is intelligence that analyzes information obtained from people, SIGINT (SIGnals INTelligence), which is intelligence that analyzes communications information, and IMINT (IMagery INTelligence), which is intelligence that analyzes image information.

[0022] As shown in the figure, the CTI analysis support system 1 is communicatively connected to a user terminal 3 operated by a user of the CTI analysis support system 1 via a communication network 6a. The CTI analysis support system 1 is also connected to the Internet 5 via a communication network 6b. The communication networks 6a and 6b are, for example, a Local Area Network (LAN), a Wide Area Network (WAN), the Internet, a leased line, a public communication network, etc.

[0023] The CTI analysis support system 1 is configured using an information processing device (computer) including a processor 11, a main memory device 14, an auxiliary memory device 15, communication devices 12a and 102b, an input / output device 16, and a communication path 107 that communicatively connects these devices. The communication path 107 is, for example, a system bus or a cable.

[0024] The information processing device constituting the CTI analysis support system 1 may be realized, in whole or in part, by using virtual information processing resources provided by using virtualization technology, process space separation technology, or the like, such as a virtual server provided by a cloud system. In addition, all or in part of the functions provided by the information processing device may be provided by services provided by the cloud system via an API (Application Programming Interface), for example. In addition, all or part of the functions provided by the information processing device may be realized by using, for example, Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), or the like. The CTI analysis support system 1 uses a plurality of information processing devices connected to each other so as to be able to communicate with each other. It may be configured.

[0025] The processor 11 is configured using, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), an AI (Artificial Intelligence) chip, an FPGA (Field Programmable Gate Array), an SoC (System on Chip), an ASIC (Application Specific Integrated Circuit), etc.

[0026] The processor 11 realizes various functions of the CTI analysis support system 1 by reading and executing programs stored in the auxiliary memory device 15 into the main memory device 14 at any time, or by using the functions of the hardware (FPGA, ASIC, AI chip, etc.) that constitutes the CTI analysis support system 1, or by both.

[0027] The main memory device 14 is a device for storing programs and data, and is, for example, a ROM (Read Only Memory). These include Non-volatile Memory (NORAM), Random Access Memory (RAM), and Non-volatile RAM (NVRAM).

[0028] The auxiliary storage device 15 is a device that stores (memorizes) programs (source code, object code, execution code, etc.) and data for realizing various functions of the CTI analysis support system 1, and is, for example, an SSD (Solid State Drive) or a hard disk drive. Programs and data can be read into the auxiliary storage device 15 from non-temporary storage media such as optical storage devices (CDs (Compact Discs), DVDs (Digital Versatile Discs), etc.), storage systems, IC cards, SD cards, or cloud server memory areas via a recording medium reading device or communication devices 12a, 102b.

[0029] The communication devices 12a and 12b are devices that communicate with other information processing devices via the communication networks 6a and 6b, and are wireless or wired communication modules (wireless communication modules, communication network adapters, USB modules, etc.).

[0030] The input / output device 16 includes a user interface (hereinafter referred to as an "input device") that accepts input from the user or data input from an external device, and a user interface (hereinafter referred to as an "output device") that provides various information to the user. The input device may be, for example, a keyboard, a mouse, a touch panel, a card reader, a voice input device (for example, The output device is, for example, a display device such as a liquid crystal display, These include audio output devices such as microphones, printing devices, etc.

[0031] The CTI analysis support system 1 may include, for example, an operating system, a file system, a DBMS (DataBase Management System) (relational database, NoSQL, etc.), a KVS (Key-Value Store), and the like.

[0032] As shown in the figure, the main memory device 14 stores the following main programs: an information acquisition program 111, a main information extraction program 112, a CTI determination program 113, a named entity extraction program 114, a latent meaning inference program 115, a relationship extraction program 116, a CTI importance calculation program 117, and an information provision program 118.

[0033] Of the above programs, the information acquisition program 111 realizes a function of acquiring information (including information not containing information that can be regarded as CTI) from the CTI providing site 7 (hereinafter referred to as "information acquisition unit 21").

[0034] The main information extraction program 112 performs pre-processing such as refang (to be described later) on the information acquired from the CTI providing site 7 (hereinafter referred to as "acquired information"). The system realizes a function (hereinafter referred to as "main information extraction unit 22") of extracting information corresponding to the main body from the acquired information (information corresponding to the main text (for example, information obtained by excluding promotional information, advertising information, HTML tags, etc. from the acquired information (information written on a Web page, etc.)). Hereinafter referred to as "main information").

[0035] The CTI determination program 113 realizes a function of determining whether the acquired information includes a CTI, and a function of classifying (categorizing (grouping)) the CTI when the acquired information includes a CTI (hereinafter, referred to as the "CTI determination unit 23"). The result of the CTI classification serves as a guide for the user to efficiently and appropriately grasp the contents of the CTI, for example.

[0036] The named entity extraction program 114 realizes a function of extracting named entities from acquired information (hereinafter referred to as the "named entity extraction unit 24"). The named entities extracted by the named entity extraction unit 24 serve as a guide for the user to efficiently and appropriately grasp the gist of the CTI, for example.

[0037] The latent meaning estimation program 115 realizes a function of estimating the latent meaning of each named entity described in the acquired information (hereinafter referred to as the "latent meaning estimation unit 25"). The latent meaning estimated by the latent meaning estimation unit 25 is used, for example, to search for synonyms of the named entity. By referring to the synonyms, the user can efficiently classify and grasp the overview of the CTI.

[0038] The relationship extraction program 116 realizes a function of extracting relationships between multiple named entities described in the acquired information (hereinafter referred to as the "relationship extraction unit 26"). By referring to the relationships extracted by the relationship extraction unit 26, the user can analyze the contents of the CTI and acquire useful information from the CTI efficiently and without omissions.

[0039] The CTI importance calculation program 117 realizes a function of calculating the importance of the CTI included in the acquired information (hereinafter referred to as the "importance calculation unit 27"). The information provision program 118 realizes a function of providing the user with information obtained by analyzing the acquired information (hereinafter referred to as the "information provision unit 28"). By referring to the importance calculated by the importance calculation unit 27, the user can efficiently identify, for example, the CTI that should be checked with priority.

[0040] Incidentally, among the functions described above, the main functions responsible for analysis to extract useful information from acquired information, namely, the main information extraction unit 22, the CTI determination unit 23, the named entity extraction unit 24, the latent meaning estimation unit 25, the relationship extraction unit 26, and the importance calculation unit 27, will hereinafter be collectively referred to as the analysis unit 20.

[0041] As shown in the figure, the auxiliary storage device 15 stores, as main information (data), an acquisition source information TBL 101, an acquired information TBL 102, a named entity TBL 103, and a main information TBL 104. The CTI analysis support system 1 manages the above information, for example, as a table of a database or a file managed by a file system.

[0042] 2 shows an example of the acquisition source information TBL 101. The acquisition source information TBL 101 manages information related to the location of the CTI providing site 7 and the collection frequency (access frequency). As shown in the figure, the illustrated acquisition source information TBL 101 includes one or more entries (records) each consisting of the data items (fields) of acquisition source ID 201, name 202, location 203, last acquisition date and time 204, and access frequency 205. One entry in the acquisition source information TBL 101 corresponds to one CTI providing site 7.

[0043] Among the above items, the acquisition destination ID 201 is an identification information that uniquely identifies the CTI provider site 7. Information about the acquisition destination (hereinafter referred to as "acquisition destination ID") is stored.

[0044] The name of the CTI provider site 7 is stored in the name 202. In this example, for example, the name 202 of the entry in which the acquisition destination ID 201 is "0" stores the name of the acquisition destination, "CTI site 1."

[0045] The location 203 stores the location of the CTI providing site 7 (URL (Uniform Resource Locator), IP address, path name, etc.). In the case of the same figure, for example, the location 203 of the entry whose acquisition destination ID 201 is "0" stores "example.com / cti.html", which is the location of the CTI providing site 7.

[0046] The last acquisition date and time 204 stores the most recent date and time when information was acquired from the CTI providing site 7. In the case of the same figure, for example, the last acquisition date and time 204 of the entry whose acquisition destination ID 201 is "0" stores "00:00:00 on January 1, 2020", which is the date and time when information was acquired from the CTI providing site 7.

[0047] The access frequency 205 stores information (access frequency) that specifies the timing at which the information acquisition unit 21 attempts to acquire information from the CTI providing site 7. In the case of the same figure, for example, the access frequency 205 of the entry with the acquisition destination ID 201 of "0" stores "every 48 hours" as the frequency at which the CTI providing site 7 is accessed. Note that the method of specifying the above timing is not necessarily limited, and other methods may be used.

[0048] 3 shows an example of the acquired information TBL 102. The acquired information TBL 102 manages information related to the acquired information and information related to the results of analysis of the acquired information by the analysis unit 20. As shown in the figure, the illustrated acquired information TBL 102 includes one or more entries (records) each consisting of data items (fields) of an acquired information ID 301, an acquisition date and time 302, a title 303, a CTI flag 304, a category 305, an importance level 306, a named entity 307, and a relationship 308. One entry in the acquired information TBL 102 corresponds to one piece of acquired information.

[0049] Among the above items, the acquired information ID 301 stores identification information that uniquely identifies the acquired information (hereinafter, referred to as the "acquired information ID").

[0050] The date and time when the acquired information was acquired is stored in the acquisition date and time 302. In the case of the same figure, for example, the acquisition date and time 302 of the entry whose acquired information ID 301 is "0" stores "00:00:00 on January 1, 2020", which is the date and time when the acquired information was acquired.

[0051] The title of the acquired information (information corresponding to the title included in the acquired information) is stored in the title 303. In the case of the same figure, for example, the title "New Threat" is stored in the title 303 of the entry whose acquired information ID 301 is "0".

[0052] The CTI flag 304 stores information indicating whether the acquired information includes a CTI. In this example, if the acquired information includes a CTI, "YES" is set, and if the acquired information does not include a CTI, "NO" is set. An example of a case in which the acquired information includes a CTI is when the entire main body information of the acquired information is merely "promotion information for a new product" or "publicity / advertising information." Note that if "YES" is stored in the CTI flag 304, the acquired information ID 301 becomes identification information (hereinafter referred to as "CTI_ID") that uniquely identifies the CTI contained in the acquired information.

[0053] The category 305 stores information indicating the category of the acquired information. For example, the category 305 of the entry with the acquired information ID 301 of "0" stores information indicating that the acquired information is "malware " information indicating that the information belongs to the category.

[0054] The importance 306 stores information indicating the importance of the acquired information calculated by the importance calculation unit 27. Although the method of expressing the importance is not necessarily limited, in this example, the importance 306 is expressed as a numerical value, and the larger the value, the higher the importance. In the case of the same figure, for example, the importance 306 of the entry with the acquired information ID 301 of "0" stores "0.8" as the importance.

[0055] The named entity 307 stores the named entities contained in the acquired information, which are extracted by the named entity extraction unit 24. In the case of the same figure, for example, the named entities "Mal1" and "example.com" are stored in the named entity 307 of the entry with the acquired information ID 301 of "0". .

[0056] The relationship 308 stores information indicating a relationship between named entities included in the acquired information, which is extracted by the relationship extraction unit 26. In the case of the same figure, for example, the relationship 308 of the entry with the acquired information ID 301 of "0" stores information indicating that there is a predetermined relationship between the named entities "Mal1" and "example.com", which are included in the acquired information.

[0057] 4 shows an example of the named entity TBL 103. The named entity TBL 103 manages information about named entities extracted by the named entity extraction unit 24 or registered by other methods such as user input. As shown in the figure, the illustrated named entity TBL 103 includes one or more entries (records) each consisting of data items (fields) of a named entity ID 401, a named entity 402, a type 403, a synonym 404, and a relationship 405. One entry in the named entity TBL 103 corresponds to one named entity.

[0058] Among the above items, the named entity ID 401 stores identification information that uniquely identifies a named entity (hereinafter, referred to as a "named entity ID").

[0059] A named entity is stored in the named entity 402. In the case of the same figure, for example, the named entity "Malware1" is stored in the named entity 402 of the entry whose named entity ID 401 is "0".

[0060] Information indicating the type of the relevant named entity is stored in the type 403. In the case of the same figure, for example, "Malware Name" is stored in the type 403 of the entry whose named entity ID 401 is "0".

[0061] In the synonym 404, information indicating a synonym of the named entity searched for by the latent meaning inference unit 25 or registered by other methods such as user input is stored. In the case of the same figure, for example, the named entity 402 of the entry with the named entity ID 401 of "0" stores "MalwareOne", which is a named entity synonymous with "Malware1" of the named entity 402.

[0062] The relationship 405 stores information indicating the relationship between the relevant named entity and other named entities extracted by the relationship extraction unit 26 or registered by other methods such as user input. In the case of the same figure, for example, the relationship 405 of the entry with the named entity ID 401 of "0" shows that the named entity 402 "Malware1" is related to the named entity "mal.example.com" with the named entity ID 401 of "2". Information indicating that there is a predetermined relationship is stored.

[0063] 1 stores main information extracted from information acquired from the CTI providing site 7. In the main information TBL 104, the main information is managed in association with the information from which the main information was extracted (e.g., acquired information ID).

[0064] Next, the main operations of the CTI analysis support system 1 will be described with reference to sequence diagrams and flowcharts.

[0065] 5 is a sequence diagram (hereinafter referred to as "sequence diagram 500") for explaining the main operation of the CTI analysis support system 1. Below, the main operation of the CTI analysis support system 1 will be explained with reference to sequence diagram 500.

[0066] The information acquisition unit 21 acquires information from each CTI providing site 7 by accessing the location of each CTI providing site 7 managed in the acquisition destination information TBL 101 at the timing specified in the access frequency 205 (S507-S508). The information acquisition unit 21 transmits the information acquired from the CTI providing site 7 to the auxiliary storage device 15 (S509), and receives a notification from the auxiliary storage device 15 that storage of the information (acquired information) has been completed (S510).

[0067] The information acquisition unit 21 transmits an instruction to analyze the acquired information acquired in S508 to the analysis unit 20 at a predetermined timing (S511). Note that the above timing is not necessarily limited, but from the viewpoint of providing information to the user early, it is preferable to transmit the analysis instruction to the analysis unit 20 promptly after acquiring the information from the CTI providing site 7.

[0068] When the analysis unit 20 receives the above analysis instruction from the information acquisition unit 21, it analyzes the information newly acquired from the CTI providing site 7 (hereinafter referred to as "new information"), transmits the analysis results to the auxiliary storage device 15 (S512), and receives a notification from the auxiliary storage device 15 that storage of the analysis results has been completed (S513).

[0069] By repeatedly performing the above steps S507 to S513, the acquired information TBL 102, the named entity TBL 103, and the main information TBL 104 are repeatedly updated, and information is automatically stored in these tables.

[0070] A user can use the information stored in each of the above tables by accessing the CTI analysis support system 1 via the user terminal 3. When using the above information, the user operates the user terminal 3 to send a request for providing the information to be used to the information providing unit 28 (S514). The request for providing includes, for example, information for searching each of the above tables, and the user can specify, for example, contents corresponding to each item of the acquired information TBL 102 (acquired information ID, acquisition date of the acquired information (may be a period specification), title of the acquired information, CTI flag (for example, only "YES"), category, importance (above a predetermined value, etc.), named entity, relationship) as keywords for search.

[0071] When the information providing unit 28 receives the provision request, it accesses the information stored in the auxiliary storage device 15 and acquires the information specified in the provision request (S515 to S516).

[0072] Next, the information providing unit 28 generates a screen (hereinafter referred to as "information providing screen 600") presenting the information acquired from the auxiliary storage device 15, and transmits the generated information providing screen 600 to the user terminal 3 (S517). Upon receiving the information providing screen 600, the user terminal 3 presents the information providing screen 600 to the user.

[0073] 6 shows an example of an information provision screen 600. As shown in the figure, the illustrated information provision screen 600 has a display field 611 for basic information, a display field 612 for main information, a display field 613 for named entities, and a display field 614 for relationships.

[0074] In the basic information display field 611, information based on the acquired information TBL 102 is displayed. In this example, the acquired information ID (CTI_ID), acquisition date, title, category, and importance of the acquired information TBL 102 are displayed. By referring to the basic information display field 611, the user can Good In addition, the user can judge the importance of the information by referring to the importance level.

[0075] The main information display field 612 displays the main information of the CTI displayed in the basic information display field 611. By referring to the main information display field 612, the user can check the contents of the CTI without opening another screen. As shown in the figure, the information providing unit 28 highlights (underlines, colors, boldface, italics, frames, etc.) the named entities described in the main information, so that the user can easily identify the named entities described in the main information. When the user hovers the mouse over a named entity, the information providing unit 28 displays information about the named entity (supplementary information such as type, synonyms, etc.) of Since the information is displayed, the user can easily check the information about the named entity.

[0076] As shown in the figure, the named entity display field 613 displays a list of information about each named entity contained in the main information. In this example, the named entities and their types (classification, expression format, data type, etc.) are displayed in a table format. By referring to the named entity display field 613, the user can check the named entities contained in the main information in a list. Furthermore, by referring to the type, the user can grasp an overview of the CTI (what information is described therein).

[0077] The relationship display field 614 displays a list of information indicating the relationships between each named entity contained in the main information. In this example, the relationships between each named entity (subject, relationship between named entities, object, etc.) are displayed in a table format. By referring to the relationship display field 614, the user can check information related to the named entities contained in the main information (for example, IOCs (Indicators of Compromise) described in the information in association with the named entities (IP addresses and domain names used in an attack)). It can easily reveal malware signatures (such as MD5 hashes and file names of malware, suspicious changes to registry or system files, consecutive failed login attempts or login attempts to non-existent accounts, processes used in the attack, etc.).

[0078] Furthermore, the information provision screen 600 may be provided with a screen for specifying keywords (acquired information ID, acquisition date of the acquired information, title of the acquired information, CTI flag, category, importance, named entity, relationship) to be set in the provision request sent from the user terminal in S514 of Figure 5, and the above provision request may be accepted via the information provision screen 600.

[0079] As described above, the CTI analysis support system 1 automatically analyzes information obtained from the CTI providing site 7, thereby determining whether the information is CTI, extracting named entities from the information, classifying the information into categories, extracting synonyms by inferring the latent meanings of named entities, extracting relationships between named entities in the information, calculating the importance of the information, and providing these results to the user via the information providing screen 600, thereby enabling the user to efficiently perform tasks related to CTI analysis.

[0080] Next, a more specific operation of the CTI analysis support system 1 will be described with reference to a flowchart.

[0081] Fig. 7 is a flowchart for explaining the process (hereinafter referred to as "information acquisition and analysis process S700") performed by the CTI analysis support system 1 in S507 to S513 in Fig. 5. The information acquisition and analysis process S700 will be explained below with reference to this figure.

[0082] When the time to acquire information arrives, the information acquisition unit 21 accesses the information acquisition source and acquires the information (hereinafter, this process is referred to as "information acquisition process S711"). )。 The information acquisition process S711 will be described later in detail.

[0083] Next, the information acquisition unit 21 judges whether or not there is new information in the acquired information TBL 102 (S712). The information acquisition unit 21 performs the above judgment by, for example, checking whether or not there is any information in the acquired information TBL 102 for which the CTI flag 304 is not set. If there is no new information in the acquired information TBL 102 (S712: NO), the information acquisition and analysis process S700 ends. On the other hand, if there is new information in the acquired information TBL 102 (S712: YES), the process proceeds to a loop process of S720S to S720E (hereinafter referred to as "analysis process S720S to S720E").

[0084] In the analysis processes S720S to S720E, the analysis unit 20 of the CTI analysis support system 1 performs processing related to the analysis of new information. The analysis processes S720S to S720E are repeatedly performed for each piece of new information (each entry of new information) in the acquired information TBL 102. As shown in the figure, the analysis processes S720S to S720E include each of the processes of an information classification process S721, a named entity extraction process S722, a latent meaning estimation process S723, a relationship extraction process S724, and an importance calculation process S725. Details of these processes will be described later. In the following description, new information selected during the processing of each loop of the analysis processes S720S to S720E is referred to as "selected new information". After the analysis processes are performed, the information acquisition and analysis process S700 ends.

[0085] Fig. 8 is a flowchart for explaining the information acquisition process S711 in Fig. 7. The information acquisition process S711 will be explained below with reference to the same figure.

[0086] First, the information acquiring unit 21 acquires a list of the CTI providing sites 7 from the acquisition source information TBL 101, and acquires information by accessing the CTI providing sites 7 at the timing designated in the access frequency 205 (S811).

[0087] After acquiring the information from the CTI providing site 7, the information acquiring unit 21 then judges whether the acquired information includes new information (S812). The information acquiring unit 21 makes the above judgment by, for example, comparing the acquired information with the acquired information TBL 102 stored in the auxiliary storage device 15. If new information is not included (S812: NO), the information acquisition process S711 ends and the process proceeds to S712 in Fig. 7. If new information is included (S812: YES), the process proceeds to S813.

[0088] In S813, the information acquiring unit 21 stores the acquired information as new information in the acquired information TBL 102. Specifically, the information acquiring unit 21 stores meta information of the new information in the acquired information TBL 102. That is, the information acquiring unit 21 adds one entry to the acquired information TBL 102, assigns an acquired information ID to the entry, stores it in acquired information ID 301, and stores the current date and time in acquisition date and time 302 of the entry and information corresponding to the title described in the new information in title 303.

[0089] Next, the main body information extraction unit 22 performs a process of extracting main body information from the information acquired by the information acquisition unit 21 and storing the main body information in the main body information TBL 104 (hereinafter referred to as "main body information extraction process S813"). After that, the process proceeds to S712 in FIG.

[0090] Fig. 9 is a flowchart illustrating the main body information extraction process S814 in Fig. 8. The main body information extraction process S814 will be described below with reference to this figure.

[0091] First, the main body information extraction unit 22 extracts main body information from the information acquired by the information acquisition unit 21. (S911). The main information extraction unit 22 extracts the main information by removing advertisements and HTML tags from the information (Web page) acquired by the information acquisition unit 21, for example.

[0092] Next, the main information extraction unit 22 refangs the defanged (neutralized) information (e.g., IOC) included in the main information extracted in S911 (S912). In CTI, IOCs such as malicious URLs are sometimes defanged so that they are not recognized as URLs, so that unintended access is not caused by accidentally clicking on them (e.g., "example.com" is replaced (defanged) with "example[.]com"). Therefore, in this process, the defanged information of the main information is refanged so that the various functions described above can correctly recognize the original information.

[0093] Next, the main information extraction unit 22 stores the main information for which refangling has been completed in the main information TBL 104 in association with the acquired information ID (S913). After that, the process proceeds to S712 in FIG.

[0094] Fig. 10 is a flowchart for explaining the information classification process S721 in Fig. 7. The information classification process S721 will be explained below with reference to this figure.

[0095] First, the CTI determining unit 23 acquires the main information of the selected new information from the main information TBL 104 (S1011).

[0096] Next, the CTI determination unit 23 determines whether the acquired main information includes a CTI (S1012), and reflects the result in the CTI flag 304 of the acquired information TBL 102 (S1013). The CTI determination unit 23 determines whether the main information is a CTI, for example, based on an IOC or a named entity described in the acquired main information. For example, the CTI determination unit 23 makes the above determination by comparing the terms included in the main information with a dictionary prepared in advance. The CTI determination unit 23 also makes the above determination using a machine learning model trained to make the above determination.

[0097] In the next S1014, the CTI determination unit 23 selects the next process depending on whether the acquired main information includes CTI. If the acquired main information includes CTI (S1014: YES), the process proceeds to S1015. On the other hand, if the acquired main information does not include CTI (S1014: NO), the information classification process S721 ends, and the process proceeds to S722 in FIG. 8.

[0098] In S1015, the CTI determination unit 23 estimates the category of the acquired main information, and reflects the estimation result in the category 305 of the acquired information TBL 102 (S1016). The CTI determination unit 23 performs the above estimation, for example, by comparing the IOCs and named entities included in the acquired main information with a category classification table prepared in advance. The CTI determination unit 23 also performs the above estimation using a machine learning model trained to perform the above estimation. Thereafter, the information classification process S721 ends, and the process proceeds to S722 in FIG. 8.

[0099] Fig. 11 is a flowchart for explaining the named entity extraction process S722 in Fig. 7. The named entity extraction process S722 will be explained below with reference to this figure.

[0100] First, the named entity extraction unit 24 acquires main information of the selected new information from the main information TBL 104, and extracts named entities contained in the acquired main information (S1111). For example, the named entity extraction unit 24 extracts words that match a dictionary constructed in advance as named entities. In addition, for example, the named entity extraction unit 24 extracts named entities using a statistical natural language processing technique or a machine learning model trained to extract named entities. Note that the machine learning model is When used, for example, it is possible to extract new words that frequently appear in texts (contexts) that describe security.

[0101] Next, the named entity extraction unit 24 reflects the extracted named entity in the named entity 307 of the acquired information TBL 102 (S1112).

[0102] Next, the named entity extraction unit 24 determines whether or not the named entities extracted in S1111 include a new named entity (S1113). If the extracted named entities do not include a new named entity (S1113: NO), the named entity extraction process S722 ends, and then the process proceeds to S723 in FIG.

[0103] On the other hand, if the extracted named entities include a new named entity (S1113: YES), the named entity extraction unit 24 adds the extracted new named entity to the named entity TBL 103 (S1120). Specifically, the named entity extraction unit 24 adds an entry to the named entity TBL 103, assigns a named entity ID to the added entry, and stores it in the named entity ID 401. The named entity extraction unit 24 also stores the extracted new named entity in the named entity 402 of the added entry. Thereafter, the named entity extraction process S722 ends, and the process proceeds to S723 in FIG. 7.

[0104] Fig. 12 is a flowchart for explaining the latent meaning estimation process S723 in Fig. 7. The latent meaning estimation process S723 will be explained below with reference to the same figure.

[0105] First, the latent meaning inference unit 25 acquires main information of the selected new information from the main information TBL 104, and infers the latent meaning of each named entity extracted by the named entity extraction unit 24 based on the acquired main information (S1211). The latent meaning inference unit 25 infers the latent meaning of the named entity based on, for example, the context before and after the named entity in the main information, or another named entity or IOC included in the vicinity. In addition, the latent meaning inference unit 25 performs the above estimation using, for example, a statistical natural language processing technique or a machine learning model trained to perform the above estimation.

[0106] Next, the latent meaning inference unit 25 determines whether or not there is a named entity having a new latent meaning (S1212). If there is no named entity having a new latent meaning (S1212: NO), the latent meaning inference process S723 ends, and the process proceeds to S724 in Fig. 7. On the other hand, if there is a named entity having a new latent meaning (S1212: YES), the process proceeds to S1220.

[0107] In S1220, for each named entity having a new latent meaning, a named entity corresponding to the estimated latent meaning is searched for in the named entity TBL 103, and the named entity having the new latent meaning is stored in the synonym 404 of the searched named entity. The latent meaning estimation unit 25 searches for the corresponding named entity using, for example, a statistical natural language processing technique or a machine learning model trained to perform the above search.

[0108] Fig. 13 is a flowchart for explaining the relationship extraction process S724 in Fig. 7. The relationship extraction process S724 will be explained below with reference to this figure.

[0109] First, the relationship extraction unit 26 acquires main information of the selected new information from the main information TBL 104, and extracts relationships between each named entity extracted by the named entity extraction unit 24 based on the acquired main information (S1311). For example, the relationship extraction unit 26 extracts relationships based on the context before and after the named entity. In addition, the relationship extraction unit 26 performs the above extraction using, for example, a statistical natural language processing technique or a machine learning model trained to perform the above extraction. Note that, depending on the CTI, related named entities may be listed together at the end of a sentence, for example. Even if natural language processing that extracts relationships based on the distance between general words (written positions) is applied because the words are written far away, the relationship between the two may not be extracted. Therefore, the relationship extraction unit 26, for example, selects an IOC at the end of a sentence as a candidate, and then extracts a topic (named entity) that is mainly mentioned in the main information by, for example, comparing it with a dictionary that lists named entities and important words (or by using natural language processing technology or a machine learning model), and extracts a long-distance relationship that is not taken into account by natural language processing by linking the two (the extracted named entity and the selected IOC at the end of a sentence).

[0110] Next, the relationship extraction unit 26 determines whether or not any of the extracted relationships is new (S1312). If there is no new relationship among the extracted relationships (S1312: NO), the relationship extraction process S724 ends, and the process proceeds to S725 in Fig. 7. On the other hand, if there is a new relationship among the extracted relationships (S1312: YES), the process proceeds to S1320.

[0111] In S1320, the relationship extraction unit 26 stores the extracted new relationship in the relationship 308 of the acquired information TBL 102. After that, the relationship extraction process S724 ends, and the process proceeds to S725 in FIG.

[0112] Fig. 14 is a flowchart for explaining the importance calculation process S725 in Fig. 7. The importance calculation process S725 will be explained below with reference to this figure.

[0113] The importance calculation unit 27 first acquires the main information of the new information being selected from the main information TBL 104, and calculates the importance based on the acquired main information (S1401). For example, the importance calculation unit 27 sets a higher importance to the new information when the main information of the new information being selected has a larger number of references from other CTIs (the larger the number of links from other CTIs). The above-mentioned number of references is obtained, for example, by statistically processing the information stored in the main information TBL 104. Also, the importance calculation unit 27 sets a higher importance to the new information when the risk of the vulnerability described in the main information of the new information being selected is higher. Also, when the main information of the new information being selected includes a vulnerability for which a PoC (Proof of Concept) code is made public, the importance calculation unit 27 sets a higher importance than when the main information of the new information does not include such a vulnerability.

[0114] In addition to calculating the importance based on the degree of threat of the information described in the main information of the new information being selected in this way, for example, the importance may be calculated based on the comprehensiveness of the information with respect to a specific threat, i.e., high importance may be given to new information with high comprehensiveness. Also, for example, the method of calculating the importance may be set according to the user or purpose of use of the CTI analysis support system 1 (for example, the importance may be set based on the magnitude of business impact when the user is a company manager).

[0115] Next, the importance calculation unit 27 stores the importance calculated in S1402 in the importance 306 of the selected acquired information in the acquired information TBL 102 (S1402). After that, the importance calculation process S725 ends, and the process returns to the first process (S711) of the information acquisition and analysis process S700 in FIG.

[0116] In addition, in the information classification process S721, the named entity extraction process S722, the latent meaning inference process S723, the relationship extraction process S724, and the importance calculation process S725 described above, for the purpose of improving processing efficiency and analysis accuracy, various techniques using known natural language processing and machine learning models, such as morphological analysis, syntactic analysis, semantic analysis, context analysis, information extraction, use of corpora, word segmentation, feature extraction, vector representation, word distributed representation, text classification, RNN (Recurrent Neural Network), sequence labeling, named entity extraction, etc. may be applied.

[0117] FIG. 15 is a flowchart for explaining the process (hereinafter referred to as "information provision process S1500") performed by the CTI analysis support system 1 in S514 to S517 in FIG. The analysis support system 1 executes the information provision process S1500, for example, when an information provision request is received from the user terminal 3.

[0118] When the information provision unit 28 receives an information provision request from the user terminal 3, it acquires the information specified in the information provision request from the acquired information TBL 102 and the main information TBL 104 of the auxiliary storage device 15 (S1511).

[0119] Next, the information providing unit 28 generates an information providing screen 600 on which the acquired information is described (S1512).

[0120] Next, the information providing unit 28 transmits the generated information providing screen 600 to the user terminal 3 (S1513). Upon receiving the information providing screen 1000, the user terminal 3 displays it on a display device (such as a display).

[0121] As described above in detail, the CTI analysis support system 1 of this embodiment automatically analyzes information acquired from the CTI providing site 7, thereby providing the user with useful information for efficiently and appropriately performing CTI analysis, and thus the user can efficiently perform the work related to the CTI analysis. Therefore, the user can quickly grasp, for example, the presence or absence of an impact on the environment, the company's products, customers, etc., and can promptly and appropriately take necessary measures for defense or countermeasures. Furthermore, because the analysis is performed automatically, the information acquired from the CTI providing site 7 can be efficiently and appropriately handled regardless of the user's knowledge, experience, ability, etc.

[0122] In addition, the CTI analysis support system 1 extracts named entities and IOCs, and links CTIs together using the common named entities and IOCs to provide information on cross-sectional analysis of CTIs, so that the user can easily obtain information necessary for an overall overview of threats and efficiently analyze CTIs. In addition, the CTI analysis support system 1 presents to the user synonyms of named entities obtained by estimating the latent meanings contained in the named entities, so that even if there are spelling variations depending on the CTI provider, for example, related CTIs can be associated, and analysis work can be efficiently carried out. In addition, the CTI analysis support system 1 detects the relationship between named entities written at different positions in the main information and presents it to the user, so that the user can grasp important information from the CTI without missing anything.

[0123] Although one embodiment of the present invention has been described above, it goes without saying that the present invention is not limited to the above embodiment and can be modified in various ways without departing from the gist of the present invention. For example, the above embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to an embodiment having all of the configurations described. In addition, it is possible to add, delete, or replace part of the configuration of the above embodiment with other configurations.

[0124] For example, as shown in FIG. 16, the CTI analysis support system 1 may provide information related to CTI to information processing devices (e.g., information processing devices of other organizations or other locations; in FIG. 16, external user terminals 4a and 4b) that exist outside the CTI analysis support system 1 and are connected via a communication network such as the Internet 5. This allows, for example, analysis of threats to be carried out while sharing information in collaboration with an analysis team outside the organization. Furthermore, with such a configuration, the CTI analysis support system 1 can also be used as a solution for providing the analysis results to external users.

[0125] The above-mentioned configurations, functional units, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. Also, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as programs, tables, files, etc. that realize each function may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. The information is provided for memory, hard disks, SSDs (Solid State Drives) and other storage devices, IC cards, etc. The files can be stored on a storage medium such as a smartphone, computer, SD card, or DVD.

[0126] The above-described layouts of the various functional units, processing units, and databases of each information processing device are merely examples. The layouts of the various functional units, processing units, and databases can be changed to optimal layouts in terms of the performance, processing efficiency, communication efficiency, and the like of the hardware and software that these devices are equipped with.

[0127] The configuration (schema, etc.) of the database that stores the various types of data described above can be flexibly changed from the viewpoints of efficient use of resources, improved processing efficiency, improved access efficiency, improved search efficiency, and the like. [Explanation of symbols]

[0128] 1 CTI analysis support system, 3 user terminal, 4 external user terminal, 5 Internet, 21 information acquisition unit, 22 main information extraction unit, 23 CTI judgment unit, 24 named entity extraction unit, 25 latent meaning inference unit, 26 relationship extraction unit, 27 importance calculation unit, 28 information provision unit, 101 acquisition source information TBL, 102 acquired information TBL, 103 named entity TBL, 104 main information TBL, 500 sequence diagram, 600 information provision screen, S700 information acquisition analysis process, S721 information classification process, S722 named entity extraction process, S723 latent meaning inference process, S724 relationship extraction process, S725 importance calculation process, S814 main information extraction process, 102 acquired information TBL, 103 named entity TBL, 104 main information TBL

Claims

1. A system for supporting analysis of Cyber ​​Threat Intelligence (CTI), comprising: The information processing device is configured to: an information acquisition unit for acquiring information provided on a CTI providing site; A storage unit that stores the acquired information; a named entity extraction unit that extracts named entities contained in the information by using a machine learning model for extracting named entities and stores the extracted named entities in association with the information; an information providing unit that outputs the named entity extracted for the information together with the information; and a latent meaning estimation unit that estimates the latent meaning of the named entity extracted from the information by using natural language processing or a machine learning model that estimates the latent meaning of the named entity, and stores the named entity as a synonym of another named entity having the estimated meaning; Equipped with The information providing unit is outputting the stored synonyms for the information together with the information; displaying a main body of the information, and when an operation of designating a display portion of a named entity in the main body of the information is performed, automatically displaying the synonym of the named entity; CTI analysis support system.

2. 2. The CTI analysis support system according to claim 1, a relationship extraction unit that extracts relationships between the plurality of named entities extracted from the information by using natural language processing or a machine learning model that extracts relationships between the named entities, and stores the extracted relationships in association with the named entities; the information providing unit outputs, together with the information, the relationship of the named entity extracted for the information. CTI analysis support system.

3. A method for supporting analysis of Cyber ​​Threat Intelligence (CTI), comprising: An information processing device constituting a system for supporting CTI analysis, acquiring information provided on a CTI providing site; storing the obtained information; extracting named entities contained in the information by using a machine learning model for extracting named entities, and storing the extracted named entities in association with the information; outputting the named entities extracted for the information together with the information; inferring a latent meaning of the named entity extracted from the information by using natural language processing or a machine learning model for inferring the latent meaning of the named entity, and storing the named entity as a synonym of another named entity having the inferred meaning; outputting the stored synonyms for the information together with the information; and displaying a main body of information of the information, and when an operation of designating a display portion of a named entity in the main body of information is performed, automatically displaying the synonym of the named entity; A CTI analysis support method for carrying out the above.

4. 4. The CTI analysis support method according to claim 3, The information processing device, extracting relationships between the plurality of named entities extracted from the information by using natural language processing or a machine learning model that extracts relationships between the named entities, and storing the extracted relationships in association with the named entities; and outputting the information together with the relationships of the named entities extracted for the information; The CTI analysis support method further executes the above.

Images