Information analysis device, information analysis method, and program

Abstract

An information analysis device (10) is provided with: a characteristic information extraction unit (11) which extracts, from a news article, characteristic information indicating a characteristic matter in a cyber attack; and a characteristic information association unit (12) which extracts specialized information related to the extracted characteristic information from a database (30) that stores specialized information regarding cyber attacks that have already occurred, and associates the characteristic information with the extracted specialized information.

Description

[Technical field]

[0001] The present invention relates to an information analysis device and an information analysis method for analyzing information on cyber attacks, and further relates to a program for implementing these. To Regarding. [Background technology]

[0002] In recent years, systems in government agencies, companies, etc. have often become targets of cyber attacks, making it extremely important to ensure the security of those systems. For this reason, when operating a system, it is necessary to collect information on cyber attacks, such as information on the vulnerability of the system and the methods of attack, and to use this information to implement necessary measures. In addition, since measures to ensure security require investment in the system, collecting information on cyber attacks is also necessary for management decisions.

[0003] In view of these points, specialized information (event information) on cyber attacks is being shared. Specialized information on cyber attacks includes information such as the name of the software used in the attack, Common Vulnerabilities and Exposures (CVE) IDs, and attack methods. In addition, this information may be structured or written in natural language. Non-Patent Document 1 discloses a technique for extracting information on cyber attacks from security reports written in natural language. Here, the security reports are mainly reports provided by security vendors that develop software and provide related services regarding security measures.

[0004] However, the technology disclosed in Non-Patent Document 1 has a problem in that it is not possible to obtain characteristic information about a cyber attack, such as the number of victims and the amount of damage. Such characteristic information is particularly necessary for the above-mentioned business decisions.

[0005] On the other hand, Patent Document 1 discloses a system for identifying important feature words from the latest news articles. This system calculates the similarity between feature words extracted from the latest news articles and feature words extracted from existing past news articles, and assigns tags to feature words with higher similarity among the former feature words. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2010-224622 A [Non-patent literature]

[0007] [Non-Patent Document 1] Shunta Nakagawa, Tatsuya Nagai, Hideaki Kanehara, Keisuke Furumoto, Shin Takita, Yoshiaki Shiraishi, Takeshi Takahashi, Kumi Mori, Yasuhiro Takano, Masakatsu Morii, "Extracting Event Information from Security Reports for Threat Information Modeling," IEICE Technical Report, vol. 118, no. 486, ICSS2018-78, pp. 89-94, March 2019. Summary of the Invention [Problem to be solved by the invention]

[0008] It is believed that if the system disclosed in the above-mentioned Patent Document 1 is applied to the field of security, it will be possible to identify important characteristic words related to cyber attacks from articles related to security. However, the system disclosed in the above-mentioned Patent Document 1 only identifies characteristic words, and it is difficult to identify specialized information related to cyber attacks, such as the name of the software used in the attack, the Common Vulnerabilities and Exposures (CVE) ID, and the attack method, when such information is not explicitly included in the article. The system disclosed in the above-mentioned Patent Document 1 has a problem in that it is not possible to obtain detailed information related to cyber attacks.

[0009] An example of the object of the present invention is to provide an information analysis device, an information analysis method, and program The purpose of this invention is to provide [Means for solving the problem]

[0010] In order to achieve the above object, an information analysis device according to one aspect of the present invention comprises: a feature information extraction unit that extracts feature information indicating characteristic aspects of a cyber attack from a news article; A characteristic information linking unit that extracts specialized information related to the extracted characteristic information from a database that accumulates specialized information on cyber attacks that have already occurred, and links the characteristic information with the specialized information; It is equipped with:

[0011] In order to achieve the above object, an information analysis method according to one aspect of the present invention includes: A feature information extraction step of extracting feature information indicating characteristic aspects of a cyber attack from the news article; A characteristic information linking step of extracting specialized information related to the extracted characteristic information from a database that accumulates specialized information on cyber attacks that have already occurred, and linking the characteristic information with the specialized information; having It is characterized by:

[0012] Further, in order to achieve the above object, in one aspect of the present invention, program teeth, On the computer, A feature information extraction step of extracting feature information indicating characteristic aspects of a cyber attack from the news article; A characteristic information linking step of extracting specialized information related to the extracted characteristic information from a database that accumulates specialized information on cyber attacks that have already occurred, and linking the characteristic information with the specialized information; Run R,Program Hmm. Effect of the Invention

[0013] As described above, according to the present invention, characteristic information about cyber attacks can be obtained together with specialized information about cyber attacks. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram showing a schematic configuration of an information analysis device according to an embodiment. [Diagram 2] FIG. 2 is a diagram specifically showing the configuration of the information analysis device according to the embodiment. [Diagram 3] FIG. 3 is a flowchart showing the operation of the information analyzing device in the embodiment. [Figure 4] FIG. 4 is a diagram showing examples of news articles, specialized information, and the results of linking a feature method with specialized information. [Diagram 5] FIG. 5 is a configuration diagram showing a configuration of a modified example of an information analyzing device in the embodiment. [Figure 6] FIG. 6 is a block diagram illustrating an example of a computer that realizes the information analysis apparatus according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] (Embodiment) Hereinafter, an information analysis device, an information analysis method, and a program according to an embodiment will be described with reference to FIGS.

[0016] [Device configuration] First, a schematic configuration of an information analysis device in an embodiment will be described with reference to Fig. 1. Fig. 1 is a configuration diagram showing a schematic configuration of an information analysis device in an embodiment.

[0017] 1, an information analysis device 10 according to an embodiment is a device for analyzing information related to cyber attacks. As shown in FIG. 1, the information analysis device 10 includes a characteristic information extraction unit 11 and a characteristic information linking unit 12.

[0018] The characteristic information extraction unit 11 extracts characteristic information indicating characteristic aspects of a cyber-attack from news articles related to the cyber-attack. The characteristic information linking unit 12 extracts specialized information related to the cyber-attack that is related to the characteristic information extracted by the characteristic information extraction unit 11 from a database that accumulates specialized information related to cyber-attacks that have already occurred, and links the characteristic information with the specialized information. In the following, the specialized information related to the cyber-attack will be referred to as "specialized information", and the above-mentioned database will be referred to as the "specialized information database".

[0019] As described above, according to the embodiment, the feature information extracted from the news article is linked to the specialized information, so that it is possible to simultaneously obtain the feature information and the specialized information related thereto.

[0020] Next, the configuration and functions of the information analysis device in the embodiment will be specifically described with reference to Fig. 2. Fig. 2 is a configuration diagram specifically showing the configuration of the information analysis device in the embodiment.

[0021] As shown in FIG. 2, in the embodiment, an information analysis device 10 is connected to a news database 20 and a specialized information database 30 via a network 40 such as the Internet so as to be capable of data communication.

[0022] The news database 20 is a database that stores news articles provided on the Internet. The stored news articles are read by a Web server and presented on a Web site. Note that, although only a single news database 20 is shown in the example of Figure 2, in reality, multiple news databases 20 exist.

[0023] The specialized information database 30 is a database that accumulates specialized information, as described above. In the embodiment, the specialized information is, for example, cyber-attack trace information (IOC: Indicator of Compromise). The IOC is information related to the vulnerability of a system that has been subjected to a cyber-attack. The cyber-attack information includes information on the vulnerability of a software used in a cyber-attack (Common Vulnerabilities and Exposures: CVE), the name of the software used in the cyber-attack, the method of the cyber-attack, etc. Furthermore, in the specialized information database 30, associations between specialized information may be performed. For example, the name of the software used in the cyber-attack and the Common Vulnerabilities and Exposures of the vulnerability exploited by the software may be stored in association with each other.

[0024] IOCs may be provided by public institutions, vendors, etc., or may be generated from the above-mentioned security reports using existing tools (e.g., Threat Report ATT&CK Mapper: TRAM). In addition, IOCs may be expressed in Structured Threat Intelligence (STIX) format and may include MITRE ATT&CK Technique IDs as attack techniques (TTPs) (see https: / / www.ipa.go.jp / security / vuln / STIX.html).

[0025] As shown in FIG. 2, the information analysis device 10 includes a news article collection unit 13, a search processing unit 14, and an information storage unit 15 in addition to the characteristic information extraction unit 11 and characteristic information linking unit 12 described above.

[0026] The news article collection unit 13 accesses the news database 20 via the network 40 to collect news articles. The news articles to be collected may be those published within a specified period, or may be all news articles that have not yet been collected. The news article collection unit 13 also stores the collected news articles in the information storage unit 15.

[0027] Specifically, the news article collection unit 13 crawls news sites on the Internet according to a list of URLs of news sites prepared in advance to collect news articles. The news article collection unit 13 can also delete elements other than the main text of the news article from each news site and collect only the main text by using a processing method defined for each news site. An example of a news article is "Company A suffered damages of xx billion yen due to malware X."

[0028] In the embodiment, the characteristic information extraction unit 11 first reads out the collected news articles from the information storage unit 15. Then, in the embodiment, the characteristic information extraction unit 11 extracts at least one of the names of the victims of the cyber-attack, the details of the damage, and the amount of the damage from the news articles as characteristic information.

[0029] Specific examples of the characteristic information include the following. Note that the characteristic information may overlap with the specialized information. When specialized information is included in a news article, the characteristic information extraction unit 11 may extract the specialized information as the characteristic information. Victim's name Damage details Damage amount Article type (incident cases, vulnerability information, product update information, product introductions, service introductions, threat trends, research results, political trends, etc.) Attacker name Attack campaign name Malware Name Attack tool name Target of damage (product name, service name, site name) TTP (Tactics, Techniques and Procedures) information (ATT&CK Tactics, Techniques, Kill Chain stages) Common Vulnerabilities and Exposures (CVE) ·Vulnerability name Indicator Information Observed events Attack date and time

[0030] For example, if the news article is the example described above, the characteristic information extraction unit 11 extracts Company A (name of the victim), XXX billion yen (amount of damage), and Malware X (name of the software used in the cyber attack) as characteristic information.

[0031] The feature information extraction unit 11 may extract feature information using, for example, the following four extraction methods. First, a first extraction method is an extraction method using regular expressions. For example, assume that the CVE ID, indicator information, date, etc. to be extracted are converted into regular expressions in advance, and each regular expression is registered as a feature. In this case, the feature information extraction unit 11 converts each word included in a news article into a regular expression, and if the obtained regular expression matches a regular expression registered in advance, the feature information extraction unit 11 extracts the corresponding word as feature information.

[0032] The second extraction method is an extraction method using a dictionary. For example, a dictionary is prepared in which attacker names to be extracted are registered in advance. In this case, the characteristic information extraction unit 11 checks each word included in the news article against the dictionary, and if there is a match with a registered attacker name, extracts the corresponding word as characteristic information. Note that the extraction target registered in the dictionary may be something other than the attacker name.

[0033] A third extraction method is an extraction method using a trained NER (Named Entity Recognition) model. The NER model is constructed by performing machine learning using training data of words that are labeled to indicate whether they are targets for extraction. The feature information extraction unit 11 inputs words contained in news articles to the NER model, and extracts the corresponding words as feature information based on the output result from the NER model.

[0034] Extract No. 4 method One such method is an extraction method that uses a combination of Doc2Vec and a support vector machine (SVM). Doc2Vec is an algorithm that converts word information in a text into vectors, and extracts the relevant text from the input text. chapter The support vector machine generates and outputs a vector representation of the vectors output by Doc2Vec, to which a label indicating whether or not the vector is an extraction target is added. The support vector machine is constructed by performing machine learning using the training data, which is the vectors output by Doc2Vec, to which a label indicating whether or not the vector is an extraction target is added.

[0035] The feature information extraction unit 11 inputs the news article to Doc2Vec, and inputs the vector output from Doc2Vec to SVM. Then, the feature information extraction unit 11 extracts the relevant words as feature information based on the output result of SVM. method In this case, a machine learning algorithm other than SVM may be used.

[0036] In the embodiment, the feature information extraction unit 11 can also determine whether or not a news article includes a case of damage caused by a cyber-attack. In this case, when the feature information extraction unit 11 determines that a case of damage caused by a cyber-attack is included, it extracts feature information from the news article.

[0037] Specifically, the feature information extraction unit 11 can use a machine learning model to determine whether a news article contains a case of damage caused by a cyber attack. An example of the machine learning model is a topic model such as LDA (Latent Dirichlet Allocation). Topic models can be constructed through unsupervised machine learning using news articles as training data.

[0038] The machine learning model for the above-mentioned determination may be a combination of Doc2Vec and a support vector machine (SVM), and in this case, a machine learning algorithm other than SVM may be used. In this case, the support vector machine is constructed by performing machine learning using, as training data, vectors output from Doc2Vec to which labels indicating whether or not a damage case is included.

[0039] In the embodiment, the characteristic information linking unit 12, for example, compares the date (specifically, the description related to the IOC date) given to the specialized information in the specialized information database 30 with the publication date and time of the news article. Then, when the difference between the date given to the specialized information and the publication date and time of the news article is within a set range, the characteristic information linking unit 12 links the characteristic information extracted from the corresponding news article with the corresponding specialized information.

[0040] Furthermore, when the feature information extracted by the feature information extraction unit 11 includes expertise information, the feature information linking unit 12 may search the expertise information database 30 using the expertise information included in the feature information, and link expertise information related to the queried expertise information to the feature information. The search for expertise information may be performed by simple character string comparison, or may be performed by vectorizing the search term and the searched term, respectively, and using the cosine similarity between them.

[0041] In addition, when the expert information includes information on a vulnerability, the characteristic information linking unit 12 can identify an event caused by the vulnerability and link the characteristic information including the identified event with the expert information including the information on the vulnerability. Examples of the information on the vulnerability include a common vulnerability identifier and a vulnerability name.

[0042] Furthermore, the feature information linking unit 12 can also calculate the similarity between the specialized information and the feature information that are linked to each other. An example of the similarity is cosine similarity. The feature information linking unit 12 can also calculate the similarity using a learning model that has previously learned the similarity between the specialized information and the feature information by machine learning.

[0043] The feature information linking unit 12 may also perform snowball sampling. Specifically, after linking feature information and specialty information by the above-mentioned method, the feature information linking unit 12 searches for further related specialty information or feature information using one or both of the linked specialty information and feature information. Then, the feature information linking unit 12 recursively links the newly searched specialty information or feature information to the previously linked feature information and specialty information.

[0044] When performing linking by snowball sampling, the feature information linking unit 12 can obtain the cosine similarity between pieces of information in the same manner as in the above example. In addition, the feature information linking unit 12 can calculate the cosine similarity for each pair of a search term and a searched term used in the snowball sampling process, and can treat the calculated similarity as the similarity in snowball sampling.

[0045] The feature information linking unit 12 stores the specialty information and the feature information linked thereto in a linked state in a storage area of ​​the storage device, i.e., in the information storage unit 15. In addition, when the feature information linking unit 12 has calculated the similarity as described above, it can also link the related similarity to the specialty information and the feature information.

[0046] The search processing unit 14 receives a search query input via an input device such as a keyboard or an external terminal device, and performs a search of specialized information and feature information stored in the information storage unit 15 based on the received search query.

[0047] Specifically, the search processing unit 14 identifies feature information that matches or is similar to the search query from among the feature information stored in the information storage unit 15, and further identifies specialized information linked to the identified feature information. The search processing unit 14 can also identify specialized information that matches or is similar to the search query from among the specialized information stored in the information storage unit 15, and identify feature information linked to the identified specialized information.

[0048] Thereafter, the search processing unit 14 displays the identified feature information and specialized information as a result of the search on the screen of an external display device, the screen of a terminal device, etc. Furthermore, if similarity is associated with the specialized information and feature information, the search processing unit 14 also identifies the associated similarity and displays the identified similarity.

[0049] [Device operation] Next, the operation of the information analysis device 10 in the embodiment will be described with reference to FIG. 3. FIG. 3 is a flow diagram showing the operation of the information analysis device in the embodiment. In the following description, FIGS. 1 and 2 will be referred to as appropriate. Also, in the embodiment, an information analysis method is implemented by operating the information analysis device 10. Therefore, the description of the information analysis method in the embodiment will be replaced by the following description of the operation of the information analysis device 10.

[0050] 3, first, the news article collection unit 13 accesses the news database 20 via the network 40 to collect news articles (step A1). In step A1, for example, news articles published within a specified period are collected. The collected news articles are stored in the information storage unit 15.

[0051] Next, the feature information extraction unit 11 judges whether the news articles collected in step A1 include cases of damage caused by cyber attacks (step A2). If the result of the judgment in step A2 is that the news articles collected in step A1 do not include cases of damage caused by cyber attacks (step A2: No), the processing in the information analysis device 10 ends.

[0052] On the other hand, if the result of the judgment in step A2 is that the news articles collected in step A1 include cases of damage caused by cyber-attacks (step A2: Yes), the characteristic information extraction unit 11 reads out the news articles collected in step A1 from the information storage unit 15. Then, the characteristic information extraction unit 11 extracts characteristic information from the read out news articles (step A3). In step A3, for example, the names of victims of cyber-attacks, the details of the damage, and the amount of the damage are extracted as characteristic information.

[0053] Next, the feature information linking unit 12 acquires from the specialized information database 30 specialized information to which a date identical to or close to the publication date of the news article from which the feature information was extracted in step A3 has been added (step A4). Note that a date close to the publication date means that the difference between the two is within a set range, for example, within 3 days, or in the same month, etc.

[0054] Next, the characteristic information linking unit 12 links the specialized information acquired in step A4 to the characteristic information extracted in step A3 (step A5).Then, the characteristic information linking unit 12 stores the specialized information and the characteristic information linked thereto in the information storage unit 15 in a mutually linked state (step A6).

[0055] After step A6 is completed, the search processing unit 14 receives a search query input via an input device such as a keyboard or an external terminal device. The search processing unit 14 then identifies feature information that matches or is similar to the search query from among the feature information stored in the information storage unit 15, and further identifies specialized information linked to the identified feature information. The search processing unit 14 then displays the identified feature information and specialized information on the screen of an external display device, the screen of the terminal device, or the like as a search result.

[0056] A specific example will be described with reference to Fig. 4. Fig. 4 is a diagram showing examples of news articles, specialized information, and the results of linking a feature method with specialized information.

[0057] Assume that news articles including examples of damage caused by cyber attacks are collected, as shown in the upper part of Fig. 4. Assume that specialized information with the same month as the news article is stored in specialized information database 30, as shown in the middle part of Fig. 4. The specialized information may be written in a natural language or may be generated in a structured format.

[0058] In the case of the news article shown in the upper part of Fig. 4, the characteristic information extraction unit 11 extracts "Wannacry", "damage of xx billion yen", "Company A", "Company B", "file server", and "encryption" as characteristic information. Then, the characteristic information linking unit 12 links the extracted characteristic information with specialized information. The result is as shown in the lower part of Fig. 4.

[0059] According to the embodiment described above, the feature information extracted from the news article is linked to the specialized information, so that a searcher can simultaneously obtain the feature information and the specialized information related thereto by inputting a search query.

[0060] [Variations] A modified example of the information analysis device 10 in the embodiment will be described with reference to Fig. 5. Fig. 5 is a configuration diagram showing the configuration of the modified example of the information analysis device in the embodiment.

[0061] As shown in Fig. 5, in the modified example, the information analysis device 10 does not include a search processing unit, unlike the example shown in Fig. 2. In other respects, the information analysis device 10 is similar to the example shown in Fig. 2.

[0062] In the modified example, the information analysis device 10 is connected to a terminal device 50 used by a searcher via a network 40. The terminal device 50 includes a search processing unit 51 similar to the search processing unit 14 shown in FIG. 2, and an information storage unit 52.

[0063] In the modified example, when the characteristic information and the specialized information are linked, the information analyzing device 10 transmits the linked characteristic information and specialized information to the terminal device 50 via the network 40. When the linked characteristic information and specialized information are transmitted, the terminal device 50 stores them in the information storage unit 52.

[0064] This configuration allows a searcher to input a search query on the terminal device 50. In this case, the search processing unit 51 accesses the information storage unit 52 of the terminal device 50, and identifies characteristic information that matches or is similar to the search query and specialized information linked thereto from among the characteristic information stored in the information storage unit 52. Thereafter, the search processing unit 51 displays the identified characteristic information and specialized information on the screen of the terminal device 50.

[0065] According to the modified example, it is not necessary to provide the information analysis device 10 itself with a search function, which reduces the cost of the information analysis device 10. Furthermore, since the search query is not transmitted from the terminal device 50 to the information analysis device 10, according to the modified example, the possibility that the search query will be known to the administrator of the information analysis device 10 is eliminated.

[0066] [program] The program in the embodiment may be any program that causes a computer to execute steps A1 to A6 shown in Fig. 3. By installing and executing this program in a computer, the information analysis device 10 and information analysis method in the embodiment can be realized. In this case, the processor of the computer functions as the characteristic information extraction unit 11, the characteristic information linking unit 12, and the news article collection unit 13 to perform the processes. Examples of the computer include a general-purpose PC, a smartphone, and a tablet terminal device.

[0067] In addition, in the embodiment, the information storage unit 15 may be realized by storing the data files that constitute it in a storage device such as a hard disk provided in the computer, or may be realized by a storage device of another computer.

[0068] The program in the embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the feature information extraction unit 11, the feature information linking unit 12, and the news article collection unit 13.

[0069] [Physical configuration] Here, a computer that realizes the information analysis device by executing the program in the embodiment will be described with reference to Fig. 6. Fig. 6 is a block diagram showing an example of a computer that realizes the information analysis device in the embodiment.

[0070] As shown in FIG. 6, a computer 110 includes a CPU (Central Processing Unit) 11 The computer includes a power supply 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other.

[0071] The computer 110 may further include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to or instead of the CPU 111. In this aspect, the GPU or FPGA can execute the program in the embodiment.

[0072] The CPU 111 loads a program in the embodiment, which is composed of a group of codes and is stored in the storage device 113, into the main memory 112, and executes each code in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

[0073] Moreover, the program in the embodiment is provided in a state stored in a computer-readable recording medium 120. The program in the embodiment may be distributed on the Internet connected via the communication interface 117.

[0074] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0075] Data reader / writer 116 mediates data transmission between CPU 111 and recording medium 120, reads programs from recording medium 120, and writes processing results in computer 110 to recording medium 120. Communication interface 117 mediates data transmission between CPU 111 and other computers.

[0076] Specific examples of the recording medium 120 include a CF (Compact Flash (registered trademark)) and a Examples of such storage media include general-purpose semiconductor storage devices such as Secure Digital (D), magnetic recording media such as flexible disks, and optical recording media such as compact disk read only memories (CD-ROMs).

[0077] The information analysis device 10 in the embodiment can be realized not by a computer with a program installed, but by hardware corresponding to each part, for example, an electronic circuit. Furthermore, the information analysis device 10 may be partially realized by a program and the remaining part by hardware.

[0078] A part or all of the above-described embodiment can be expressed by (Additional Notes 1) to (Additional Notes 21) described below, but is not limited to the following descriptions.

[0079] (Appendix 1) a feature information extraction unit that extracts feature information indicating characteristic aspects of a cyber attack from a news article; A characteristic information linking unit that extracts specialized information related to the extracted characteristic information from a database that accumulates specialized information on cyber attacks that have already occurred, and links the characteristic information with the specialized information; Equipped with 1. An information analysis device comprising:

[0080] (Appendix 2) 2. The information analysis apparatus according to claim 1, The characteristic information extraction unit extracts, from the news article, at least one of the name of the victim of the cyber-attack, the details of the damage, and the amount of the damage, as the characteristic information. 1. An information analysis device comprising:

[0081] (Appendix 3) 3. The information analysis apparatus according to claim 1, the feature information extraction unit determines whether the news article includes a case of damage caused by a cyber-attack, and extracts the feature information from the news article if the case of damage caused by a cyber-attack is included as a result of the determination; 1. An information analysis device comprising:

[0082] (Appendix 4) An information analysis device according to any one of Supplementary Notes 1 to 3, the characteristic information linking unit stores the specialized information and the characteristic information linked thereto in a storage area of ​​a storage device in a state where the specialized information and the characteristic information linked thereto are linked to each other; 1. An information analysis device comprising:

[0083] (Appendix 5) 5. The information analysis apparatus according to claim 1, the feature information linking unit compares a date given to the specialized information in the database with a publication date and time of the news article, and when a difference between the date given to the specialized information and the publication date and time of the news article is within a set range, links the feature information extracted from the corresponding news article with the corresponding specialized information; 1. An information analysis device comprising:

[0084] (Appendix 6) 6. The information analysis apparatus according to claim 1, The specialized information includes at least one of information on the vulnerability of the system subjected to the cyber attack, the name of the software used in the cyber attack, and the method of the cyber attack; 1. An information analysis device comprising:

[0085] (Appendix 7) 7. The information analysis apparatus according to claim 1, the characteristic information linking unit, when the specialized information includes information on a vulnerability, identifies an event caused by the vulnerability, and links the characteristic information including the identified event with the specialized information including the information on the vulnerability; 1. An information analysis device comprising:

[0086] (Appendix 8) A feature information extraction step of extracting feature information indicating characteristic aspects of a cyber attack from the news article; A characteristic information linking step of extracting specialized information related to the extracted characteristic information from a database that accumulates specialized information on cyber attacks that have already occurred, and linking the characteristic information with the specialized information; having 1. An information analysis method comprising:

[0087] (Appendix 9) 9. The information analysis method according to claim 8, further comprising: In the feature information extraction step, at least one of the name of a victim of the cyber-attack, details of the damage, and the amount of the damage is extracted from the news article as the feature information. 1. An information analysis method comprising:

[0088] (Appendix 10) The information analysis method according to claim 8 or 9, In the feature information extraction step, it is determined whether the news article includes a case of damage caused by a cyber-attack, and if the result of the determination indicates that the news article includes a case of damage caused by a cyber-attack, the feature information is extracted from the news article. 1. An information analysis method comprising:

[0089] (Appendix 11) The information analysis method according to any one of appendix 8 to 10, In the feature information linking step, the specialized information and the feature information linked thereto are stored in a storage area of ​​a storage device in a state where the specialized information and the feature information linked thereto are linked to each other. 1. An information analysis method comprising:

[0090] (Appendix 12) 12. The information analysis method according to any one of claims 8 to 11, In the feature information linking step, a date given to the specialized information in the database is compared with a publication date and time of the news article, and when a difference between the date given to the specialized information and the publication date and time of the news article is within a set range, the feature information extracted from the corresponding news article is linked with the corresponding specialized information. 1. An information analysis method comprising:

[0091] (Appendix 13) 13. The information analysis method according to any one of claims 8 to 12, The specialized information includes at least one of information on the vulnerability of the system subjected to the cyber attack, the name of the software used in the cyber attack, and the method of the cyber attack; 1. An information analysis method comprising:

[0092] (Appendix 14) 14. The information analysis method according to any one of claims 8 to 13, In the characteristic information linking step, when the specialized information includes information on a vulnerability, an event caused by the vulnerability is identified, and the characteristic information including the identified event is linked to the specialized information including the information on the vulnerability. 1. An information analysis method comprising:

[0093] (Appendix 15) On the computer, A feature information extraction step of extracting feature information indicating characteristic aspects of a cyber attack from the news article; A characteristic information linking step of extracting specialized information related to the extracted characteristic information from a database that accumulates specialized information on cyber attacks that have already occurred, and linking the characteristic information with the specialized information; Run R, Program Hmm.

[0094] (Appendix 16) As described in Appendix 15 program And, In the feature information extraction step, at least one of the name of a victim of the cyber-attack, details of the damage, and the amount of the damage is extracted from the news article as the feature information. Characterized by program .

[0095] (Appendix 17) The method described in Appendix 15 or 16 program And, In the feature information extraction step, it is determined whether the news article includes a case of damage caused by a cyber-attack, and if the result of the determination indicates that the news article includes a case of damage caused by a cyber-attack, the feature information is extracted from the news article. Characterized by program .

[0096] (Appendix 18) Any of Supplementary Notes 15 to 17 program And, In the feature information linking step, the specialized information and the feature information linked thereto are stored in a storage area of ​​a storage device in a state where the specialized information and the feature information linked thereto are linked to each other. Characterized by program .

[0097] (Appendix 19) Any of the items 15 to 18 program And, In the feature information linking step, a date given to the specialized information in the database is compared with a publication date and time of the news article, and when a difference between the date given to the specialized information and the publication date and time of the news article is within a set range, the feature information extracted from the corresponding news article is linked with the corresponding specialized information. Characterized by program .

[0098] (Appendix 20) Any of the items 15 to 19 program And, The specialized information includes at least one of information on the vulnerability of the system subjected to the cyber attack, the name of the software used in the cyber attack, and the method of the cyber attack; Characterized by program .

[0099] (Appendix 21) Any of the items 15 to 20 program And, In the characteristic information linking step, when the specialized information includes information on a vulnerability, an event caused by the vulnerability is identified, and the characteristic information including the identified event is linked to the specialized information including the information on the vulnerability. Characterized by program .

[0100] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Industrial Applicability]

[0101] As described above, according to the present invention, it is possible to obtain characteristic information of a cyber attack together with specialized information on the cyber attack. The present invention is useful in various fields where analysis of cyber attacks is required. [Explanation of symbols]

[0102] 10 Information analysis device 11 Feature information extraction unit 12. Feature information linking section 13 News Article Collection Department 14 Search processing section 15 Information storage section 20 News Database 30 Specialized Information Database 40 Network 50 Terminal Equipment 51 Search processing unit 52 Information storage section 110 Computer 111 CPU 112 Main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display device 120 Recording media 121 Bus

Claims

1. a feature information extraction unit that extracts feature information indicating characteristic aspects of a cyber attack from a news article; A characteristic information linking unit that extracts specialized information related to the extracted characteristic information from a database that accumulates specialized information on cyber attacks that have already occurred, and links the characteristic information with the specialized information; Equipped with 1. An information analysis device comprising:

2. The information analysis device according to claim 1 , The characteristic information extraction unit extracts, from the news article, at least one of the name of a victim of the cyber-attack, details of the damage, and an amount of the damage, as the characteristic information.

1. An information analysis device comprising:

3. The information analysis device according to claim 1 , the feature information extraction unit determines whether the news article includes a case of damage caused by a cyber-attack, and extracts the feature information from the news article if the case of damage caused by a cyber-attack is included as a result of the determination; 1. An information analysis device comprising:

4. The information analysis device according to claim 1 , the characteristic information linking unit stores the specialized information and the characteristic information linked thereto in a storage area of ​​a storage device in a state where the specialized information and the characteristic information linked thereto are linked to each other; 1. An information analysis device comprising:

5. The information analysis device according to claim 1 , the feature information linking unit compares a date given to the specialized information in the database with a publication date and time of the news article, and when a difference between the date given to the specialized information and the publication date and time of the news article is within a set range, links the feature information extracted from the corresponding news article with the corresponding specialized information; 1. An information analysis device comprising:

6. The information analysis device according to claim 1 , The specialized information includes at least one of information regarding the vulnerability of the system subjected to the cyber attack, the name of the software used in the cyber attack, and the method of the cyber attack; 1. An information analysis device comprising:

7. The information analysis device according to claim 1 , the characteristic information linking unit, when the specialized information includes information on a vulnerability, identifies an event caused by the vulnerability, and links the characteristic information including the identified event with the specialized information including the information on the vulnerability; 1. An information analysis device comprising:

8. A computer-implemented method comprising: Extract feature information from news articles that indicates characteristic aspects of cyber attacks, Extracting specialized information related to the extracted characteristic information from a database that accumulates specialized information on cyber attacks that have already occurred, and linking the characteristic information with the specialized information; 13. An information analysis method comprising:

9. The information analysis method according to claim 8, In the extraction of the characteristic information, at least one of the name of the victim of the cyber-attack, the details of the damage, and the amount of the damage is extracted from the news article as the characteristic information.

13. An information analysis method comprising:

10. The information analysis method according to claim 8, In the extraction of the characteristic information, it is determined whether the news article includes an example of damage caused by a cyber-attack, and if the result of the determination indicates that the news article includes an example of damage caused by a cyber-attack, the characteristic information is extracted from the news article.

1. An information analysis method comprising:

11. The information analysis method according to claim 8, In the linking of the characteristic information, the specialized information and the characteristic information linked thereto are stored in a storage area of ​​a storage device in a state where they are linked to each other.

13. An information analysis method comprising:

12. The information analysis method according to claim 8, In linking the characteristic information, a date given to the specialized information in the database is compared with a publication date and time of the news article, and when a difference between the date given to the specialized information and the publication date and time of the news article is within a set range, the characteristic information extracted from the corresponding news article is linked with the corresponding specialized information.

13. An information analysis method comprising:

13. The information analysis method according to claim 8, The specialized information includes at least one of information regarding the vulnerability of the system subjected to the cyber attack, the name of the software used in the cyber attack, and the method of the cyber attack; 1. An information analysis method comprising:

14. The information analysis method according to claim 8, In the linking of the characteristic information, when the specialized information includes information on a vulnerability, an event caused by the vulnerability is identified, and the characteristic information including the identified event is linked to the specialized information including the information on the vulnerability.

13. An information analysis method comprising:

15. On the computer, Extract characteristic information from news articles that indicates characteristic aspects of cyber attacks, Extracting specialized information related to the extracted characteristic information from a database that accumulates specialized information on cyber attacks that have already occurred, and linking the characteristic information with the specialized information; program.

16. The program according to claim 15, The computer includes: In the extraction of the characteristic information, at least one of the name of a victim of the cyber-attack, details of the damage, and the amount of the damage is extracted from the news article as the characteristic information. A program characterized by:

17. The program according to claim 15, The computer includes: In the extraction of the characteristic information, it is determined whether the news article includes an example of damage caused by a cyber-attack, and if the result of the determination indicates that the news article includes an example of damage caused by a cyber-attack, the characteristic information is extracted from the news article. A program characterized by:

18. The program according to claim 15, The computer includes: In the linking of the characteristic information, the specialized information and the characteristic information linked thereto are stored in a storage area of ​​a storage device in a state where they are linked to each other. A program characterized by:

19. The program according to claim 15, The computer includes: In linking the characteristic information, a date given to the specialized information in the database is compared with a publication date and time of the news article, and when a difference between the date given to the specialized information and the publication date and time of the news article is within a set range, the characteristic information extracted from the corresponding news article is linked with the corresponding specialized information. A program characterized by:

20. The program according to claim 15, The specialized information includes at least one of information regarding the vulnerability of the system subjected to the cyber attack, the name of the software used in the cyber attack, and the method of the cyber attack; A program characterized by:

21. The program according to claim 15, The computer includes: In the linking of the characteristic information, when the specialized information includes information on a vulnerability, an event caused by the vulnerability is identified, and the characteristic information including the identified event is linked to the specialized information including the information on the vulnerability. A program characterized by:

Images