Information analysis device, information analysis method, and program

Abstract

This information analysis device (10) comprises: a professional information extraction unit (11) for extracting professional information associated with damage information of cyber attacks included in news articles from a database (30) that stores professional information regarding cyber attacks, on the basis of cyber attack damage occurrence timing; a similarity degree calculation unit (12) for calculating the degree of similarity between the damage information and the extracted professional information; and an information complementing unit (13) for identifying professional information that corresponds to the damage information on the basis of the calculated degree of similarity and complementing the identified professional information to the new articles that include the damage information.

Description

[Technical field]

[0001] The present invention relates to an information analysis device and an information analysis method for analyzing information on cyber attacks, and further relates to a program for implementing these. To Regarding. [Background technology]

[0002] In recent years, systems in government agencies, companies, etc. have often become targets of cyber attacks, making it extremely important to ensure the security of those systems. For this reason, when operating a system, it is necessary to collect information on cyber attacks, such as information on the vulnerability of the system and the methods of attack, and to use this information to implement necessary measures. In addition, since measures to ensure security require investment in the system, collecting information on cyber attacks is also necessary for management decisions.

[0003] For this reason, information on cyber attacks, such as victim organizations, industries, time periods, and damage details, is collected from the latest news articles. Patent Document 1 discloses a system for extracting specific information from the latest news articles. The system disclosed in Patent Document 1 calculates the similarity between feature words extracted from the latest news articles and feature words extracted from existing past news articles, and assigns tags to feature words with higher similarity among the former feature words. According to the system disclosed in Patent Document 1, tags are assigned to feature words related to cyber attacks, making it possible to collect information on cyber attacks.

[0004] Non-Patent Document 1 also discloses a technique for extracting information (event information) related to cyber attacks from security reports. Here, the security reports are mainly provided by security vendors who develop software related to security measures and provide related services. Unlike news written in general natural language, security reports can provide specialized information related to cyber attacks, such as the name of the software used in the attack, Common Vulnerabilities and Exposures (CVE) IDs, and attack methods, in a structured state. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2010-224622 A [Non-patent literature]

[0006] [Non-Patent Document 1] Shunta Nakagawa, Tatsuya Nagai, Hideaki Kanehara, Keisuke Furumoto, Shin Takita, Yoshiaki Shiraishi, Takeshi Takahashi, Kumi Mori, Yasuhiro Takano, Masakatsu Morii, "Extracting Event Information from Security Reports for Threat Information Modeling," IEICE Technical Report, vol. 118, no. 486, ICSS2018-78, pp. 89-94, March 2019. Summary of the Invention [Problem to be solved by the invention]

[0007] However, the system disclosed in Patent Document 1 is unable to provide specialized information about cyber attacks, such as the method of the cyber attack, the IP address of the server that conducted the cyber attack, the name of the malware, information identifying vulnerabilities, etc. For this reason, it is difficult to take necessary measures against cyber attacks using only the information provided by the system disclosed in Patent Document 1.

[0008] On the other hand, the technology disclosed in Non-Patent Document 1 makes it impossible to obtain information characteristic of cyber attacks, such as the number of victims and the amount of damage. Therefore, it is difficult to make the above-mentioned management decisions based only on the information obtained by the technology disclosed in Non-Patent Document 1.

[0009] An example of the object of the present invention is to provide an information analysis device, an information analysis method, and program The purpose of this invention is to provide [Means for solving the problem]

[0010] In order to achieve the above object, an information analysis device according to one aspect of the present invention comprises: A specialized information extraction unit extracts specialized information related to the cyber-attack damage information included in a news article based on the time of occurrence of the cyber-attack damage from a database that accumulates specialized information on the cyber-attack; a similarity calculation unit that calculates a similarity between the damage information and the extracted specialized information; an information complementing unit that identifies specialized information corresponding to the damage information based on the calculated similarity and complements the news article including the damage information with the identified specialized information; Equipped with It is characterized by:

[0011] In order to achieve the above object, an information analysis method according to one aspect of the present invention includes: A specialized information extraction step of extracting specialized information related to the cyber-attack damage information included in the news article based on the time of occurrence of the cyber-attack damage from a database storing specialized information on the cyber-attack; a similarity calculation step of calculating a similarity between the damage information and the extracted specialized information; an information complementation step of identifying the specialized information corresponding to the damage information based on the calculated similarity and complementing the news article including the damage information with the identified specialized information; having It is characterized by:

[0012] Further, in order to achieve the above object, in one aspect of the present invention, program teeth, On the computer, A specialized information extraction step of extracting specialized information related to the cyber-attack damage information included in the news article based on the time of occurrence of the cyber-attack damage from a database storing specialized information on the cyber-attack; a similarity calculation step of calculating a similarity between the damage information and the extracted specialized information; an information complementation step of identifying the specialized information corresponding to the damage information based on the calculated similarity and complementing the news article including the damage information with the identified specialized information; Run 、 It is characterized by: Effect of the Invention

[0013] As described above, according to the present invention, it is possible to supplement missing information in news articles related to cyber attacks. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram showing a schematic configuration of an information analysis device according to an embodiment. [Diagram 2] FIG. 2 is a diagram specifically showing the configuration of the information analysis device according to the embodiment. [Diagram 3] FIG. 3 is a diagram for explaining the process of extracting damage information and specialized information and the preprocessing for calculating the similarity in the embodiment. [Figure 4] FIG. 4 is a diagram illustrating the similarity calculation process according to the embodiment. [Diagram 5] FIG. 5 is a flowchart showing the operation of the information analysis device in the embodiment. [Figure 6] FIG. 6 is a diagram showing an example of a news article supplemented with specialized information in the embodiment. [Figure 7] FIG. 7 is a diagram showing a configuration of a first modification of an information analyzing device according to an embodiment. [Figure 8] FIG. 8 is a diagram showing a configuration of the information analyzing device according to the second modification of the embodiment. [Figure 9] FIG. 9 is a block diagram illustrating an example of a computer that realizes the information analysis apparatus according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] (Embodiment) Hereinafter, an information analysis device, an information analysis method, and a program according to an embodiment will be described with reference to FIGS.

[0016] [Device configuration] First, a schematic configuration of an information analysis device in an embodiment will be described with reference to Fig. 1. Fig. 1 is a configuration diagram showing a schematic configuration of an information analysis device in an embodiment.

[0017] 1, an information analysis device 10 according to an embodiment of the present invention is a device for analyzing information related to cyber attacks. As shown in FIG. 1, the information analysis device 10 includes a specialized information extraction unit 11, a similarity calculation unit 12, and an information complementation unit 13.

[0018] The specialized information extraction unit 11 extracts specialized information related to cyber-attack damage information contained in news articles from a database that accumulates specialized information on cyber-attacks (hereinafter referred to as "specialized information"), based on the time when the cyber-attack damage occurred.

[0019] The similarity calculation unit 12 calculates the similarity between the damage information and the extracted specialized information. The information complementation unit 13 identifies specialized information corresponding to the damage information based on the calculated similarity, and complements the identified specialized information with respect to the news article including the damage information.

[0020] In this manner, in the embodiment, similar specialized information is supplemented to the news article, i.e., in the embodiment, missing information is supplemented to the news article regarding the cyber attack.

[0021] Next, the configuration and functions of the information analysis device 10 in the embodiment will be specifically described with reference to Fig. 2 to Fig. 4. Fig. 2 is a configuration diagram specifically showing the configuration of the information analysis device in the embodiment. Fig. 3 is a diagram explaining the extraction process of damage information and specialized information and the pre-processing for similarity calculation in the embodiment. Fig. 4 is a diagram explaining the similarity calculation process in the embodiment.

[0022] As shown in FIG. 2, in the embodiment, an information analysis device 10 is connected to a news database 20 and a specialized information database 30 via a network 40 such as the Internet so as to be capable of data communication.

[0023] The news database 20 is a database that stores news articles provided on the Internet. The stored news articles are read by a Web server and presented on a Web site. Note that, although only a single news database 20 is shown in the example of Figure 2, in reality, multiple news databases 20 exist.

[0024] The specialized information database 30 is a database that accumulates the specialized information described above. In the embodiment, the specialized information is, for example, indicators of compromise (IOCs) of cyber attacks. IOCs are information related to the vulnerability of a system that has been attacked by a cyber attack. This includes information about common vulnerabilities and exposures (Common Vulnerabilities and Exposures: CVE), the names of software used in cyber attacks, and the methods used in cyber attacks.

[0025] IOCs may be provided by public institutions, vendors, etc., or may be generated from the above-mentioned security reports using existing tools (e.g., Threat Report ATT&CK Mapper: TRAM). IOCs may be created by hand or written by hand. In addition, IOCs may be expressed in STIX (Structured Threat Information eXpression) format and may include MITRE ATT&CK Technique IDs as Tactics, Techniques and Procedures (TTPs) (see https: / / www.ipa.go.jp / security / vuln / STIX.html).

[0026] In the STIX format, technical information is expressed in eight information groups: cyber attack activities (Campaigns), attackers (Threat_Actors), attack techniques (TTPs), detection indicators (Indicators), observed events (Observables), incidents (Incidents), countermeasures (Courses_Of_Action), and attack targets (Exploit_Targets). These information groups are related to each other to express threat information.

[0027] As shown in FIG. 2, the information analysis device 10 includes a damage information extraction unit 14, a search processing unit 15, and an information storage unit 16 in addition to the specialized information extraction unit 11, similarity calculation unit 12, and information complementation unit 13 described above.

[0028] The damage information extraction unit 14 accesses the news database 20, acquires accumulated news articles, and extracts damage information relating to damage caused by cyber attacks from the acquired news articles.

[0029] In an embodiment, the damage information is information regarding cyber attack activities (Campaigns). The damage information includes at least the time when the damage occurred T, the organization that was affected O, and the details of the damage D1. In addition, the damage information corresponds to the STIX format and includes information such as the attacker (Threat Actors), the attack technique (TTPs), It may include information on each of the following: Indicators, Observables, Incidents, Courses of Action, and Exploit Targets.

[0030] Specifically, as shown in FIG. 3, the damage information extraction unit 14 extracts, from the news article, words or phrases that represent the time T of the damage, the organization O that was damaged, and the details D1 of the damage, etc., as damage information, using a dictionary in which words or phrases corresponding to the damage information to be extracted are registered. Put out.

[0031] In addition, the damage information extraction unit 14 extracts, from the news article using a machine learning model, words or sentences that indicate the time T when the damage occurred, the organization O that was damaged, and the details D1 of the damage, as damage information. It is also possible to extract phrases. In this case, the machine learning model is constructed by machine learning using documents that have been created in advance as training data, and that have labels attached to them indicating whether or not each word or phrase is a target for extraction.

[0032] Furthermore, in the embodiment, the damage information extraction unit 14 can specify the content of the damage caused by the vulnerability indicated in the diagnosis result based on the result of the diagnosis of the vulnerability present in the computer system that is the subject of the information analysis. In this case, the damage information extraction unit 14 extracts damage information including the content of the specified damage from the news article. The content of the damage caused by the vulnerability can be specified by using a preset rule.

[0033] In the embodiment, the specialized information extraction unit 11 first accesses the specialized information database 30 to acquire the accumulated specialized information. Then, the specialized information extraction unit 11 calculates the difference between the time of occurrence of the damage included in the acquired specialized information and the time of occurrence of the damage T included in the previously extracted damage information, and extracts specialized information in which the calculated difference is within a set range (for example, within 2 days). Put out.

[0034] For example, assume that the specialized information database 30 stores IOCs generated in the STIX format as specialized information. In this case, as shown in Fig. 3, the specialized information extraction unit 11 extracts a group of information related to damage information in accordance with the STIX format.

[0035] In the embodiment, the similarity calculation unit 12 calculates a cosine similarity as the similarity using, for example, a word included in the damage information and a word included in the specialized information corresponding to the damage information. In addition, when there are multiple pieces of damage information and / or specialized information, the similarity calculation unit 12 sets expected combinations of damage information and specialized information and calculates the similarity for each combination.

[0036] Specifically, as shown in Fig. 3, the similarity calculation unit 12 first identifies words included in the damage information and words included in the extracted specialized information, merges duplicated words among the identified words into one, and sets an ID (Identifier) ​​number for each word. Next, the similarity calculation unit 12 calculates tf-idf, which indicates the importance of each word, using the following formulas 1 to 3 for each word to which an ID is set in the damage information and specialized information, respectively.

[0037]

number

[0038]

number

[0039]

number

[0040] Next, the similarity calculation unit 12 sets the number of words with IDs set in each of the damage information and the specialized information as the number of dimensions (12 in the example of FIG. 3), and generates a vector having the calculated tf-idf of each word as an element. In the example of FIG. 3, there are two pieces of damage information and one piece of specialized information, so a total of three vectors are generated: two vectors V1 for the damage information and one vector V2 for the specialized information.

[0041] Then, the similarity calculation unit 12 calculates the weight w from the weight for each word that is set in advance. i Then, as shown in FIG. 4, a weight w is applied to the vector V1 of the damage information and the vector V2 of the expert information to calculate the similarity between them. Specifically, the similarity is calculated using the following formula 4. In formula 4, the similarity is expressed as similarity(a,b,w). Also, in formula 4, , a, b are elements of the vector of the document for which the similarity is to be calculated, and w i indicates the weight for each word. In addition, in Fig. 4, two vectors are generated as vector V1, so two values ​​are calculated as the similarity.

[0042]

number

[0043] In the embodiment, as shown in FIG. i is stored in the information storage unit 16 as weight information 17. i A value manually set in advance may be used for , or an output value of a neural network may be used. In this case, machine learning of the neural network is performed by inputting vectors of two documents as training data and updating the parameters of the neural network so that the output value at that time becomes an appropriate weight w.

[0044] The similarity calculation unit 12 can also input the words included in the damage information and the words included in the specialized information corresponding to the damage information into a learning model that has machine-learned the similarity relationship between the words indicating the damage of a cyber-attack and the words included in the specialized information, and calculate the similarity based on the output result from the learning model. In this case, the learning model is constructed by machine learning using training data in which a similarity that serves as correct answer data is assigned to a combination of a group of words indicating the damage of a cyber-attack and a group of words included in the specialized information.

[0045] In the embodiment, the information complementing unit 13 identifies specialized information with the highest similarity for each piece of damage information, and complements the identified specialized information to a news article including the damage information (from which the damage information is extracted). Specifically, the information complementing unit 13 compares the identified specialized information with the damage information, and further identifies information that is missing in the damage information from the identified specialized information. For example, if the missing information is a CVE ID, which is information regarding the vulnerability of a system that has been subjected to a cyber attack, the information complementing unit 13 complements the CVE ID to the news article.

[0046] Furthermore, the information complementing section 13 stores the news article, which has been complemented with the specialized information, in the information storage section 16 as complemented news information 18.

[0047] The search processing unit 15 receives a search query input via an input device such as a keyboard or an external terminal device, and performs a search of the complemented news information 18 stored in the information storage unit 16 based on the received search query.

[0048] Specifically, the search processing unit 15 identifies news articles that include damage information that matches or is similar to the search query from among the supplemented news information stored in the information storage unit 16. After that, the search processing unit 15 displays the identified news articles as search results, with the specialized information supplemented, on the screen of an external display device, the screen of a terminal device, or the like.

[0049] [Device operation] Next, the operation of the information analysis device 10 in the embodiment will be described with reference to FIG. 5. FIG. 5 is a flow diagram showing the operation of the information analysis device in the embodiment. In the following description, FIGS. 1 to 4 will be referred to as appropriate. Also, in the embodiment, an information analysis method is implemented by operating the information analysis device 10. Therefore, the description of the information analysis method in the embodiment will be replaced with the following description of the operation of the information analysis device 10.

[0050] As shown in FIG. 5, first, the damage information extraction unit 14 accesses the news database 20 to acquire accumulated news articles, and extracts damage information relating to damage caused by cyber attacks from the acquired news articles (step A1).

[0051] Next, the specialized information extraction unit 11 extracts specialized information related to the cyber-attack damage information contained in the news article based on the time when the cyber-attack damage occurred from the specialized information database 30 that stores specialized information (step A2).

[0052] Specifically, in step A2, the specialized information extraction unit 11 obtains a difference between the time of occurrence of the damage included in the acquired specialized information and the time of occurrence of the damage T included in the previously extracted damage information. Therefore, specialized information in which the calculated difference is within a set range (for example, within 2 days) is extracted.

[0053] Next, the similarity calculation unit 12 first sets combinations of expected damage information and specialized information. Then, for each combination, the similarity calculation unit 12 calculates the tf-idf of each word for each of the damage information and specialized information to generate a vector, and applies the generated vector and weight information 17 to the above formula 4 to calculate the similarity between them (step A3).

[0054] Next, the information complementing unit 13 identifies, for each piece of damage information, specialized information that has the highest similarity (step A4).

[0055] Next, the information complementation unit 13 compares the specialized information identified in step A4 with the damage information, and further identifies information that is missing in the damage information from the identified specialized information, and complements the missing information in the news article from which the damage information was extracted (step A5).

[0056] Thereafter, the information complementing section 13 stores the news article, which has been complemented with the specialized information in step A5, in the information storage section 16 as complemented news information 18 (step A6).

[0057] After step A6 is completed, the search processing unit 15 accepts a search query input via an input device such as a keyboard or an external terminal device. The search processing unit 15 then identifies news articles that contain damage information that matches or is similar to the search query from among the supplemented news information 18 stored in the information storage unit 16. The identified news articles are supplemented with specialized information. The search processing unit 15 then displays the news articles supplemented with specialized information as search results on the screen of an external display device, the screen of a terminal device, or the like.

[0058] A specific example of a news article supplemented with specialized information will now be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of a news article supplemented with specialized information in the embodiment.

[0059] In the example of FIG. 6, the part enclosed in a frame in the news article is damage information. Furthermore, in the news article, a label indicating a corresponding attribute is attached to the damage information. The specialized information shown below the news article in FIG. 6 is the specialized information to be complemented. Of this specialized information, only the ID of "CVE", which is information regarding a vulnerability, is missing in the damage information. Therefore, in the example of FIG. 6, the information complementing unit 13 complements the news article with "CVE-2012-0611".

[0060] As described above, in the embodiment, the missing specialized information is supplemented for news articles about cyber attacks. Therefore, since specialized information about cyber attacks cannot be obtained from ordinary news articles alone, the system administrator cannot grasp the sequence of events that caused the cyber attack, but according to the embodiment, such understanding becomes possible.

[0061] [Variation 1] Next, a first modification of the information analysis device in the embodiment will be described with reference to Fig. 7. Fig. 7 is a configuration diagram showing the configuration of the first modification of the information analysis device in the embodiment.

[0062] 7, the information analysis device 10 in the first modification is different from the example shown in Fig. 2 in that it includes a specialized information generation unit 19 in addition to a specialized information extraction unit 11, a similarity calculation unit 12, an information complementation unit 13, a damage information extraction unit 14, a search processing unit 15, and an information storage unit 16. The information analysis device 10 is also connected to a computer system 50 to be analyzed so as to be capable of data communication.

[0063] The specialized information generating unit 19 acquires log information generated by the computer system 50, and generates specialized information from the acquired log information. In addition, the specialized information generating unit 19 newly accumulates the generated specialized information in the specialized information database 30.

[0064] In this way, in the first modification, new specialized information can be created from a new event that occurs in the computer system, and the information stored in the specialized information database 30 can be updated. Therefore, according to the first modification, news articles can be supplemented more appropriately. The newly created specialized information may be stored in a database other than the specialized information database 30.

[0065] [Variation 2] Variation 2 of the information analyzing device 10 in the embodiment will be described with reference to Fig. 8. Fig. 8 is a configuration diagram showing the configuration of Variation 2 of the information analyzing device in the embodiment.

[0066] As shown in Fig. 8, in the second modification, the information analysis device 10 does not include a search processing unit, unlike the example shown in Fig. 2. In other respects, the information analysis device 10 is similar to the example shown in Fig. 2.

[0067] In the second modification, the information analysis device 10 is connected to a terminal device 60 used by a searcher via a network 40. The terminal device 60 includes a search processing unit 61 similar to the search processing unit 15 shown in FIG. 2, and an information storage unit 62.

[0068] In the second modification, when the news article is supplemented with specialized information, the information analysis device 10 transmits the supplemented news article 18 to the terminal device 60 via the network 40. When the complemented news article 18 is received, the terminal device 60 stores it in the information storage unit 62.

[0069] This configuration allows a searcher to input a search query on the terminal device 60. In this case, the search processing unit 61 accesses the information storage unit 62 of the terminal device 60 and identifies news articles that match or are similar to the search query from among the complemented news articles 18 stored in the information storage unit 62. The search processing unit 61 then displays the identified news articles on the screen of the terminal device 60.

[0070] According to the second modification, it is not necessary to provide the information analysis device 10 itself with a search function, and therefore the cost of the information analysis device 10 can be reduced. Furthermore, since the search query is not transmitted from the terminal device 60 to the information analysis device 10, according to the second modification, the possibility that the search query will be known to the administrator of the information analysis device 10 is eliminated.

[0071] [program] The program in the embodiment may be any program that causes a computer to execute steps A1 to A6 shown in Fig. 5. By installing and executing this program in a computer, the information analysis device 10 and information analysis method in the present embodiment can be realized. In this case, the processor of the computer functions as the specialized information extraction unit 11, the similarity calculation unit 12, the information complementation unit 13, and the damage information extraction unit 14 and performs the processing. Examples of the computer include a general-purpose PC, a smartphone, and a tablet terminal device.

[0072] In addition, in the embodiment, the information storage unit 16 may be realized by storing the data files that constitute it in a storage device such as a hard disk provided in the computer, or may be realized by a storage device of another computer.

[0073] The program in the embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the specialized information extraction unit 11, the similarity calculation unit 12, the information complementation unit 13, and the damage information extraction unit 14.

[0074] [Physical configuration] Here, a computer that realizes the information analysis device 10 by executing a program in the embodiment will be described with reference to Fig. 9. Fig. 9 is a block diagram showing an example of a computer that realizes the information analysis device in the embodiment.

[0075] As shown in FIG. 9, a computer 110 includes a CPU (Central Processing Unit) 11 The computer includes a power supply 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other.

[0076] The computer 110 may further include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to or instead of the CPU 111. In this aspect, the GPU or FPGA can execute the program in the embodiment.

[0077] The CPU 111 loads a program in the embodiment, which is composed of a group of codes and is stored in the storage device 113, into the main memory 112, and executes each code in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

[0078] Moreover, the program in the embodiment is provided in a state stored in a computer-readable recording medium 120. The program in the embodiment may be distributed on the Internet connected via the communication interface 117.

[0079] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0080] Data reader / writer 116 mediates data transmission between CPU 111 and recording medium 120, reads programs from recording medium 120, and writes processing results in computer 110 to recording medium 120. Communication interface 117 mediates data transmission between CPU 111 and other computers.

[0081] Specific examples of the recording medium 120 include a CF (Compact Flash (registered trademark)) and a Examples of such storage media include general-purpose semiconductor storage devices such as Secure Digital (D), magnetic recording media such as flexible disks, and optical recording media such as compact disk read only memories (CD-ROMs).

[0082] The information analysis device 10 in the embodiment can be realized by using hardware corresponding to each part, instead of a computer with a program installed. Furthermore, the information analysis device 10 may be partially realized by a program and the remaining part by hardware.

[0083] A part or all of the above-described embodiment can be expressed by (Addendum 1) to (Addendum 18) described below, but is not limited to the following description.

[0084] (Appendix 1) A specialized information extraction unit extracts specialized information related to the cyber-attack damage information included in a news article based on the time of occurrence of the cyber-attack damage from a database that accumulates specialized information on the cyber-attack; a similarity calculation unit that calculates a similarity between the damage information and the extracted specialized information; an information complementing unit that identifies specialized information corresponding to the damage information based on the calculated similarity and complements the news article including the damage information with the identified specialized information; Equipped with 1. An information analysis device comprising:

[0085] (Appendix 2) 2. The information analysis apparatus according to claim 1, The damage information includes at least the time when the damage occurred, the organization that suffered the damage, and the details of the damage; The specialized information extraction unit calculates a difference between a time when the damage occurred that is included in the specialized information and a time when the damage occurred that is included in the damage information, and extracts the specialized information in which the calculated difference is within a set range. 1. An information analysis device comprising:

[0086] (Appendix 3) 3. The information analysis apparatus according to claim 1, An information analysis device characterized in that the similarity calculation unit calculates a cosine similarity as the similarity using words contained in the damage information and words contained in the specialized information corresponding to the damage information.

[0087] (Appendix 4) 3. The information analysis apparatus according to claim 1, the similarity calculation unit inputs words included in the damage information and words included in the specialized information corresponding to the damage information into a learning model that performs machine learning on similarity relationships between words indicating damage caused by cyber-attacks and words included in the specialized information, and calculates the similarity based on an output result from the learning model; 1. An information analysis device comprising:

[0088] (Appendix 5) An information analysis device according to any one of appendix 1 to 4, a specialized information generating unit that generates the specialized information from log information generated by a computer system and accumulates the generated specialized information in the database; In addition, 1. An information analysis device comprising:

[0089] (Appendix 6) An information analysis device according to any one of Supplementary Notes 1 to 5, A damage information extraction unit extracts damage information related to damage caused by a cyber attack from a news article, the damage information extraction unit, based on a result of a diagnosis of vulnerabilities present in the computer system, identifies details of damage caused by the vulnerability indicated in the diagnosis result, and extracts the damage information including the identified details of the damage from the news article; 1. An information analysis device comprising:

[0090] (Appendix 7) A specialized information extraction step of extracting specialized information related to the cyber-attack damage information included in the news article based on the time of occurrence of the cyber-attack damage from a database storing specialized information on the cyber-attack; a similarity calculation step of calculating a similarity between the damage information and the extracted specialized information; an information complementation step of identifying the specialized information corresponding to the damage information based on the calculated similarity and complementing the news article including the damage information with the identified specialized information; having 1. An information analysis method comprising:

[0091] (Appendix 8) 8. The information analysis method according to claim 7, further comprising: The damage information includes at least the time when the damage occurred, the organization that suffered the damage, and the details of the damage; In the specialized information extraction step, a difference between a time when the damage occurred included in the specialized information and a time when the damage occurred included in the damage information is calculated, and the specialized information in which the calculated difference is within a set range is extracted. 1. An information analysis method comprising:

[0092] (Appendix 9) The information analysis method according to claim 7 or 8, In the similarity calculation step, a cosine similarity is calculated as the similarity using a word included in the damage information and a word included in the specialized information corresponding to the damage information. 1. An information analysis method comprising:

[0093] (Appendix 10) The information analysis method according to claim 7 or 8, In the similarity calculation step, the words included in the damage information and the words included in the specialized information corresponding to the damage information are input to a learning model that performs machine learning on the similarity relationship between the words indicating the damage of a cyber-attack and the words included in the specialized information, and the similarity is calculated based on the output result from the learning model. 1. An information analysis method comprising:

[0094] (Appendix 11) The information analysis method according to any one of Supplementary Notes 7 to 10, a specialized information generating step of generating the specialized information from log information generated by a computer system and storing the generated specialized information in the database; Further, 1. An information analysis method comprising:

[0095] (Appendix 12) An information analysis method according to any one of appendix 7 to 11, The method further includes a damage information extraction step of extracting damage information related to damage caused by a cyber attack from the news article, In the damage information extraction step, based on a result of a diagnosis of vulnerabilities present in the computer system, a content of the damage caused by the vulnerability indicated in the diagnosis result is identified, and the damage information including the identified content of the damage is extracted from the news article. 1. An information analysis method comprising:

[0096] (Appendix 13) On the computer, A specialized information extraction step of extracting specialized information related to the cyber-attack damage information included in the news article based on the time of occurrence of the cyber-attack damage from a database storing specialized information on the cyber-attack; a similarity calculation step of calculating a similarity between the damage information and the extracted specialized information; an information complementation step of identifying the specialized information corresponding to the damage information based on the calculated similarity and complementing the news article including the damage information with the identified specialized information; Run R, Program Hmm.

[0097] (Appendix 14) As described in Appendix 13 program And, The damage information includes at least the time when the damage occurred, the organization that suffered the damage, and the details of the damage; In the specialized information extraction step, a difference between a time when the damage occurred included in the specialized information and a time when the damage occurred included in the damage information is calculated, and the specialized information in which the calculated difference is within a set range is extracted. Characterized by program .

[0098] (Appendix 15) The method described in Appendix 13 or 14 program And, In the similarity calculation step, a cosine similarity is calculated as the similarity using a word included in the damage information and a word included in the specialized information corresponding to the damage information. Characterized by program .

[0099] (Appendix 16) The method described in Appendix 13 or 14 program And, In the similarity calculation step, the words included in the damage information and the words included in the specialized information corresponding to the damage information are input to a learning model that performs machine learning on the similarity relationship between the words indicating the damage of a cyber-attack and the words included in the specialized information, and the similarity is calculated based on the output result from the learning model. Characterized by program .

[0100] (Appendix 17) Any of Supplementary Notes 13 to 16 program And, before The computer, a specialized information generating step of generating the specialized information from log information generated by a computer system and storing the generated specialized information in the database; Furthermore, Run R, Characterized by program .

[0101] (Appendix 18) Any of Supplementary Notes 13 to 17 program And, before The computer, A damage information extraction step of extracting damage information about damage caused by cyber attacks from news articles. Furthermore, Run height, In the damage information extraction step, based on a result of a diagnosis of vulnerabilities present in the computer system, a content of the damage caused by the vulnerability indicated in the diagnosis result is identified, and the damage information including the identified content of the damage is extracted from the news article. Characterized by program .

[0102] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Industrial Applicability]

[0103] As described above, according to the present invention, it is possible to supplement missing information in news articles about cyber attacks. The present invention is useful in various fields where analysis of cyber attacks is required. [Explanation of symbols]

[0104] 10 Information analysis device 11 Specialized Information Extraction Department 12 Similarity calculation unit 13 Information Complementary Department 14 Damage information extraction unit 15 Search processing section 16 Information storage section 17 Weight Information 18 Supplemented news information 19 Specialized Information Generation Department 20 News Database 30 Specialized Information Database 40 Network 50 Computer Systems 60 Terminal Equipment 61 Search processing unit 62 Information Storage Unit 110 Computer 111 CPU 112 Main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display device 120 Recording media 121 Bus

Claims

1. A specialized information extraction unit that extracts specialized information related to the cyber-attack damage information included in a news article based on the time of occurrence of the cyber-attack damage from a database that accumulates specialized information on the cyber-attack; a similarity calculation unit that calculates a similarity between the damage information and the extracted specialized information; an information complementing unit that identifies specialized information corresponding to the damage information based on the calculated similarity and complements the news article including the damage information with the identified specialized information; Equipped with 1. An information analysis device comprising:

2. The information analysis device according to claim 1 , The damage information includes at least the time when the damage occurred, the organization that suffered the damage, and the details of the damage; The specialized information extraction unit calculates a difference between a time when the damage occurred that is included in the specialized information and a time when the damage occurred that is included in the damage information, and extracts the specialized information in which the calculated difference is within a set range.

1. An information analysis device comprising:

3. The information analysis device according to claim 1 , the similarity calculation unit calculates a cosine similarity as the similarity using a word included in the damage information and a word included in the specialized information corresponding to the damage information; 1. An information analysis device comprising:

4. The information analysis device according to claim 1 , the similarity calculation unit inputs words included in the damage information and words included in the specialized information corresponding to the damage information into a learning model that performs machine learning on similarity relationships between words indicating damage caused by cyber-attacks and words included in the specialized information, and calculates the similarity based on an output result from the learning model; 1. An information analysis device comprising:

5. The information analysis device according to claim 1 , a specialized information generating unit that generates the specialized information from log information generated by a computer system and accumulates the generated specialized information in the database; In addition, 1. An information analysis device comprising:

6. The information analysis device according to claim 1 , A damage information extraction unit extracts damage information related to damage caused by a cyber attack from a news article, the damage information extraction unit, based on a result of a diagnosis of vulnerabilities present in the computer system, identifies details of damage caused by the vulnerability indicated in the diagnosis result, and extracts the damage information including the identified details of the damage from the news article; 1. An information analysis device comprising:

7. A computer-implemented method comprising: Extracting specialized information related to the cyber-attack damage information contained in the news article based on the time of occurrence of the cyber-attack damage from a database that accumulates specialized information on cyber-attacks; Calculating a similarity between the damage information and the extracted specialized information; identifying the specialized information corresponding to the damage information based on the calculated similarity, and complementing the news article including the damage information with the identified specialized information; 1. An information analysis method comprising:

8. The information analysis method according to claim 7, The damage information includes at least the time when the damage occurred, the organization that suffered the damage, and the details of the damage; In the extraction of the specialized information, a difference is calculated between a time when the damage occurred that is included in the specialized information and a time when the damage occurred that is included in the damage information, and the specialized information in which the calculated difference is within a set range is extracted.

1. An information analysis method comprising:

9. The information analysis method according to claim 7, In the calculation of the similarity, a cosine similarity is calculated as the similarity using a word included in the damage information and a word included in the specialized information corresponding to the damage information.

1. An information analysis method comprising:

10. The information analysis method according to claim 7, In calculating the degree of similarity, the words included in the damage information and the words included in the specialized information corresponding to the damage information are input to a learning model that performs machine learning on the similarity relationship between the words indicating the damage of a cyber-attack and the words included in the specialized information, and the degree of similarity is calculated based on the output result from the learning model.

1. An information analysis method comprising:

11. The information analysis method according to claim 7, Furthermore, the specialized information is generated from the log information generated by the computer system, and the generated specialized information is stored in the database.

1. An information analysis method comprising:

12. The information analysis method according to claim 7, In addition, we extract damage information about cyber attacks from news articles, In the extraction of the damage information, based on a result of a diagnosis of vulnerabilities present in the computer system, the content of the damage caused by the vulnerability indicated in the diagnosis result is identified, and the damage information including the identified content of the damage is extracted from the news article.

1. An information analysis method comprising:

13. On the computer, Extracting specialized information related to cyber-attack damage information contained in news articles based on the time of occurrence of the cyber-attack damage from a database that accumulates specialized information on cyber-attacks; Calculating a similarity between the damage information and the extracted specialized information; identifying the specialized information corresponding to the damage information based on the calculated similarity, and complementing the news article including the damage information with the identified specialized information; program.

14. The program according to claim 13, The damage information includes at least the time when the damage occurred, the organization that suffered the damage, and the details of the damage; In the extraction of the specialized information, a difference is calculated between a time when the damage occurred that is included in the specialized information and a time when the damage occurred that is included in the damage information, and the specialized information in which the calculated difference is within a set range is extracted. A program characterized by:

15. The program according to claim 13, In the calculation of the similarity, a cosine similarity is calculated as the similarity using a word included in the damage information and a word included in the specialized information corresponding to the damage information. A program characterized by:

16. The program according to claim 13, In calculating the degree of similarity, the words included in the damage information and the words included in the specialized information corresponding to the damage information are input to a learning model that performs machine learning on the similarity relationship between the words indicating the damage of a cyber-attack and the words included in the specialized information, and the degree of similarity is calculated based on the output result from the learning model. A program characterized by:

17. The program according to claim 13, The computer further comprises: generating said specialized information from log information generated by a computer system, and storing said generated specialized information in said database; A program characterized by:

18. The program according to claim 13, The computer further comprises: Extract damage information about cyber attacks from news articles, In the extraction of the damage information, based on a result of a diagnosis of vulnerabilities present in the computer system, the content of the damage caused by the vulnerability indicated in the diagnosis result is identified, and the damage information including the identified content of the damage is extracted from the news article. A program characterized by:

Images