Information Completion Device, Information Completion Method, and Program

Abstract

An information complementing device 10 comprises: a named entity extraction unit 11 for extracting a named entity from news articles regarding cyber attacks; a dependency parsing unit 12 for parsing a dependency relationship between words or between phrases in a news article; and a complementary processing unit 13 for identifying a named entity, among the extracted named entities, that satisfies a set condition and complementing for the identified named entity a modifying word that corresponds thereto, on the basis of the result of having parsed the dependency relationship.

Description

Technical Field

[0001] The present invention relates to an information completion device and an information completion method for assisting in the search for information related to cyberattacks, and further relates to a program for realizing these. Iber to

Background Art

[0002] In recent years, in government agencies, companies, etc., systems are often targeted by cyberattacks, and it has become extremely important to ensure the security of the systems. For this reason, in the operation of systems, it is necessary to collect information related to cyberattacks, such as information on system vulnerabilities and information on attack methods. Furthermore, it is also necessary to search for useful information from the collected information and take necessary measures based on the useful information. In addition, since measures for ensuring security involve investment in systems, obtaining useful information is also necessary in business judgment.

[0003] In view of these points, for example, Non-Patent Document 1 proposes a method for structuring information related to cyberattacks from security reports by using named entity recognition (NER). Here, a security report is mainly a report provided by a security vendor that develops software and provides related services regarding security measures. Different from general news articles, a security report provides specialized information such as the name of the software used in the attack, the ID of the common vulnerability identifier (CVE), and the attack method.

[0004] An example of the information structured by the method disclosed in Non-Patent Document 1 is as follows. In the following example, the information is composed of the type of named entity on the left side and the named entity on the right side. {"Victim": "Company A", "Attack Method": "Targeted Email Attack", "Damage Content": "Customer Information"}

Prior Art Documents

Non-Patent Documents

[0005]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0006] By the way, when information related to cyberattacks is structured using the method disclosed in Non-Patent Document 1 described above, the information obtained by search is, for example, "customer information" when "damage content" is used as a search query. However, from the perspective of investment judgment for taking necessary measures in security, the specific content of customer information is also required.

[0007] An example of the object of the present invention is to provide an information complementing apparatus, an information complementing method, and a program capable of complementing the content of information in the search for information related to cyberattacks. program to provide.

Means for Solving the Problems

[0008] To achieve the above object, an information complementing apparatus according to an aspect of the present invention includes a named entity extraction unit that extracts named entities from news articles related to cyberattacks, a dependency analysis unit that analyzes the dependency relationship between words or clauses in the news articles, a complementing processing unit that specifies named entities that satisfy set conditions among the extracted named entities and complements a modifier corresponding thereto based on the result of the analysis of the dependency relationship, characterized by comprising.

[0009] In addition, to achieve the above object, an information complementing method according to an aspect of the present invention is as follows: a specific expression extraction step of extracting specific expressions from news articles related to cyberattacks; a dependency analysis step of analyzing the dependency relationship between words or clauses in the news article; a complement processing step of identifying specific expressions that meet the set conditions among the extracted specific expressions, and complementing the corresponding modifiers for the identified specific expressions based on the result of the analysis of the dependency relationship; characterized by comprising the above steps.

[0010] Furthermore, to achieve the above object, an aspect of the present invention program is to cause a computer to execute a specific expression extraction step of extracting specific expressions from news articles related to cyberattacks; a dependency analysis step of analyzing the dependency relationship between words or clauses in the news article; a complement processing step of identifying specific expressions that meet the set conditions among the extracted specific expressions, and complementing the corresponding modifiers for the identified specific expressions based on the result of the analysis of the dependency relationship; characterized by the above. 、

Advantages of the Invention

[0011] As described above, according to the present invention, it is possible to complement the content of information in the search for information related to cyberattacks.

Brief Description of the Drawings

[0012]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

DETAILED DESCRIPTION OF THE INVENTION

[0013] (Embodiment) Hereinafter, an information completion device, an information completion method, and a program according to the embodiment will be described with reference to FIGS. 1 to 6.

[0014] [Device Configuration] First, the schematic configuration of the information completion device according to the embodiment will be described with reference to FIG. 1. FIG. 1 is a configuration diagram showing the schematic configuration of the information completion device according to the embodiment.

[0015] The information completion device 10 according to the embodiment shown in FIG. 1 is a device that supports the search for information related to Iber cyberattacks. As shown in FIG. 1, the information completion device 10 includes a named entity extraction unit 11, a dependency analysis unit 12, and a completion processing unit 13.

[0016] The named entity extraction unit 11 extracts named entities from news articles related to cyberattacks. The dependency analysis unit 12 analyzes the dependency relationships between words or clauses in the news articles. The completion processing unit 13 identifies named entities that satisfy the set conditions among the extracted named entities, and complements the identified named entities with corresponding modifiers based on the results of the dependency relationship analysis. As described above, in the embodiment, modifiers are complemented for the proper nouns extracted from news articles related to cyberattacks. Therefore, when obtaining information related to cyberattacks from news articles related to cyberattacks and structuring the information, the content of the information can be made easier for people to understand. As a result, according to the embodiment, the content of the information is complemented in the search for information related to cyberattacks.

[0017] Subsequently, with reference to FIG. 2, the configuration and functions of the information complementing apparatus in the embodiment will be specifically described. FIG. 2 is a configuration diagram specifically showing the configuration of the information complementing apparatus in the embodiment.

[0018] As shown in FIG. 2, in the embodiment, the information complementing apparatus 10 is communicably connected to the news database 20 via a network 30 such as the Internet.

[0019] The news database 20 is a database that stores news articles provided on the Internet. The stored news articles are read by a web server and presented on a website. In the example of FIG. 2, only a single news database 20 is shown, but actually, there are a number of news databases 20.

[0020] Also, as shown in FIG. 2, in addition to the above-described proper noun extraction unit 11, dependency analysis unit 12, and complement processing unit 13, the information complementing apparatus 10 includes a news article collection unit 14, a search processing unit 15, and an information storage unit 16.

[0021] The news article collection unit 14 accesses the news database 20 via the network 30 to collect news articles. The news articles to be collected may be those published within a specified period, or may be all news articles that have not yet been collected. Also, the news article collection unit 14 stores the collected news articles in the information storage unit 16.

[0022] Specifically, the news article collection unit 14 crawls news sites on the Internet and collects news articles according to a list of URLs of news sites prepared in advance. The news article collection unit 14 can also delete elements other than the text of the news article from each news site and collect only the text by using a processing method defined for each news site. As an example of a news article, "Damage of ○ billion yen occurred at Company A due to malware X." etc. can be mentioned.

[0023] In the embodiment, the specific expression extraction unit 11 extracts specific expressions from the news articles stored in the information storage unit 16 by using a dictionary 17 in which words or phrases corresponding to the specific expressions to be extracted are registered. The extracted specific expressions are stored in the information storage unit 16. The dictionary is stored in the information storage unit 16.

[0024] Examples of the types of specific expressions to be extracted include attackers, attack campaign names, malware names, attack tool names, product names that have suffered damage, site names that have suffered damage, victim names, damage details, damage amounts, attack methods (e.g., ATT&CK Technique ID), vulnerability names, etc. Specific examples of the specific expressions extracted include, for example, Company A, Company B, targeted email attack, customer information, ○ billion yen, etc.

[0025] In addition, the specific expression extraction unit 11 can also extract specific expressions from news articles by using a machine learning model. In this case, the machine learning model is constructed by performing machine learning using, as pre-created training data, documents in which labels indicating whether a word or phrase is to be the extraction target are assigned.

[0026] Also, in the creation of training data, if a modifier is included in a labeled word or phrase, the accuracy of machine learning may decrease. Therefore, in the creation of training data, it is better to add labels excluding modifiers. For example, when a label is given to "personal information including my number", it is better to correct it so that the label is given only to personal information.

[0027] Furthermore, in the embodiment, the named entity extraction unit 11 extracts a named entity and also identifies the type of the extracted named entity. In this case, in the above-described dictionary, the type is also registered together with the named entity. Also, when a machine learning model is used, a label indicating the type is also given to the training data and machine learning is performed. The named entity extraction unit 11 further stores the extracted named entity in the storage area of the storage device, that is, the information storage unit 16.

[0028] In the embodiment, the dependency analysis unit 12 analyzes the dependency relationship between words or phrases by using a dependency analysis algorithm for the news article collected by the news article collection unit 14. Also, when the news article is described in a language that does not include spaces, such as Japanese, the dependency analysis unit 12 can execute morphological analysis and then analyze the dependency relationship.

[0029] As an example of the dependency analysis algorithm, using a learning model, for each pair of words included in the sentence, a likelihood indicating whether they are in a dependency relationship is calculated, and when the likelihood exceeds a threshold value, it is determined that there is a dependency relationship between the words constituting the pair. The learning model is constructed by performing machine learning using, as training data, a sentence and information indicating word pairs in a dependency relationship in the sentence.

[0030] For example, when there is an expression such as "customer information including personal information such as name", the named entity extraction unit 11 extracts "customer information" as a named entity, and the other words become modifiers. In this case, the dependency analysis unit 12 analyzes that "such as name" modifies "personal information", "personal information" modifies "including", and "including" modifies "customer information".

[0031] In addition, the dependency analysis unit 12 can calculate a score representing the strength of the connection between two words, between a word and a modifier, and between modifiers, respectively, based on the dependencies analyzed by the dependency analysis. The calculated score is used in the processing by the complement processing unit 13. The dependency analysis unit 12 stores the result of the dependency analysis in the information storage unit 16.

[0032] For example, when there is the above-mentioned expression "customer information including personal information such as name", the dependency analysis unit 12 calculates a score for each of the connections between "such as name" and "personal information", between "personal information" and "including", and between "including" and "customer information".

[0033] When the above-mentioned dependency analysis algorithm is used, the dependency analysis unit 12 can use the calculated likelihood as the score. Even when an algorithm other than the above-mentioned dependency analysis algorithm is used, a numerical value representing the connection between words, etc. is calculated. In this case, the dependency analysis unit 12 can use the calculated numerical value as the above-mentioned score.

[0034] In the embodiment, the complement processing unit 13 uses a list (hereinafter referred to as the "named entity type list") 18 in which the types of named entities to be extracted in advance are registered. The named entity type list 18 is stored in the information storage unit 16.

[0035] The completion processing unit 13 compares the list of specific expression types 18 with the type of each specific expression extracted by the specific expression extraction unit 11, and identifies, as specific expressions that satisfy the set conditions, those specific expressions among the extracted specific expressions whose types are registered in the list of specific expression types 18.

[0036] Then, the completion processing unit 13 identifies the modifiers related to the identified specific expressions from the result of the dependency analysis by the dependency analysis unit 12, and complements the identified specific expressions with the identified modifiers. Specifically, the completion processing unit 13 adds the identified modifiers to the specific expressions stored in the information storage unit 16 and associates the modifiers with the specific expressions. Also, in this case, the completion processing unit 13 can complement only those modifiers whose above-described scores are equal to or higher than the threshold value. This avoids a situation where incorrect modifiers are complemented.

[0037] The search processing unit 15 receives a search query input via an input device such as a keyboard or an external terminal device, and executes a search for the specific expressions stored in the information storage unit 16 based on the received search query.

[0038] Specifically, the search processing unit 15 identifies specific expressions that match or are similar to the search query from among the specific expressions stored in the information storage unit 16, and further identifies the modifiers associated with the identified specific expressions. Then, as a result of the search, the search processing unit 15 displays the identified specific expressions and modifiers on the screen of an external display device, the screen of a terminal device, etc.

[0039] The completion processing unit 13 can also perform the above-described complementation of modifiers at the timing when the search by the search processing unit 15 is performed. Specifically, when a specific expression is searched by the search by the search processing unit 15, the completion processing unit 13 identifies a specific expression that satisfies the set conditions from among the searched specific expressions, and based on the result of the analysis of the dependency relationship, complements the identified specific expression with the corresponding modifier.

[0040] [Device Operation] Next, the operation of the information completion device 10 in the embodiment will be described with reference to FIG. 3. FIG. 3 is a flowchart showing the operation of the information completion device in the embodiment. In the following description, FIGS. 1 and 2 will be referred to as appropriate. In the embodiment, by operating the information completion device 10, an information completion method is implemented. Therefore, the description of the information completion method in the embodiment will be replaced by the following description of the operation of the information completion device 10.

[0041] As shown in FIG. 3, first, the news article collection unit 14 accesses the news database 20 via the network 30 and collects news articles (step A1). In step A1, for example, news articles published within a specified period are the targets of collection. The collected news articles are stored in the information storage unit 16.

[0042] Next, the named entity extraction unit 11 extracts named entities from the news articles collected in step A1 using, for example, a dictionary 17 in which words or phrases corresponding to the named entities to be extracted are registered (step A2).

[0043] In step A2, the named entity extraction unit 11 extracts named entities and also identifies the types of the extracted named entities. Further, the named entity extraction unit 11 stores the extracted named entities in the information storage unit 16.

[0044] Next, the dependency analysis unit 12 analyzes the dependency relationship between words or phrases in the news articles collected by the news article collection unit 14 in step A1 (step A3).

[0045] In step A3, the dependency analysis unit 12 calculates a score representing the strength of the connection between each pair of words, between a word and a modifier, and between modifiers, as analyzed by the dependency analysis.

[0046] Next, the complement processing unit 13 acquires the unique expression type list 18 stored in the information storage unit 16. Then, the complement processing unit 13 compares the unique expression type list 18 with the type of each unique expression extracted in step A2, and identifies the unique expressions among the extracted unique expressions whose types are registered in the unique expression type list 18 (step A4). The identified unique expressions correspond to the unique expressions that satisfy the set conditions.

[0047] Next, the complement processing unit 13 identifies the modifiers related to the unique expressions identified in step A4 from the result of the dependency analysis in step A3, and complements the identified modifiers to the identified unique expressions (step A5).

[0048] Next, the complement processing unit 13 stores the modifiers identified in step A5 in the information storage unit 16 in a state associated with the corresponding unique expressions (step A6). Thereafter, the unique expressions stored in the information storage unit 16 and the modifiers associated with the corresponding unique expressions are collectively referred to as "unique expression information".

[0049] After the end of step A6, when a search query is input via an input device such as a keyboard or an external terminal device, the search processing unit 15 accepts it. Then, the search processing unit 15 identifies the unique expressions that match or are similar to the search query from among the unique expressions stored in the information storage unit 16, and further identifies the modifiers associated with the identified unique expressions. Thereafter, as a result of the search, the search processing unit 15 displays the identified unique expressions and modifiers on the screen of an external display device, the screen of a terminal device, etc.

[0050] A specific example will be described with reference to FIG. 4. FIG. 4 is a diagram showing an example of a news article, a unique expression extraction result, an analysis result of dependency analysis, and a unique expression with a modifier added.

[0051] In the example of FIG. 4, the news article collection unit 14 collects, as a news article including a case of damage caused by a cyberattack, "Company A, the largest in the pharmaceutical industry, was the target of a targeted email attack, and customer information including names and email addresses was leaked."

[0052] The named entity extraction unit 11 extracts, as named entities from this news article, "Company A", "targeted email attack", and "customer information". The named entity extraction unit 11 also identifies the type of each named entity. In the example of FIG. 4, the named entity extraction unit 11 identifies, as the type of each of the above named entities, "victim", "attack method", and "damage content".

[0053] The dependency analysis unit 12 analyzes the dependency relationship between words or clauses in the above-described news article. As a result, "the largest in the pharmaceutical industry" depends on "Company A", and "Company A" and "was the target of a targeted email attack" depend on "received". Also, "names" and "including email addresses" depend on "customer information", and "customer information" depends on "was leaked".

[0054] And in the example of FIG. 4, it is assumed that only "damage content" is registered in the named entity type list. For this reason, the complement processing unit 13 determines that "customer information" is a target for complementing modifiers among the extracted named entities, and complements the direct and indirect modifiers related to "customer information". In the example of FIG. 4, the complement processing unit 13 corrects "including names and email addresses" to "customer information".

[0055] As described above, according to the embodiment, modifiers are complemented for the named entities extracted from the news article. Therefore, when a search is performed on the named entities for acquiring information related to cyberattacks, the content of the information will be complemented. As a result, the complemented information is also useful in investment decisions for taking necessary measures in security.

[0056] [Modification Example] Using FIG. 5, a modified example of the information completion device 10 in the embodiment will be described. FIG. 5 is a configuration diagram showing the configuration of a modified example of the information completion device in the embodiment.

[0057] As shown in FIG. 5, in the modified example, unlike the example shown in FIG. 2, the information completion device 10 is configured not to include a search processing unit. In other respects, the information completion device 10 is the same as the example shown in FIG. 2.

[0058] In the modified example, the information completion device 10 is connected to the terminal device 40 used by the searcher via the network 30. The terminal device 40 includes a search processing unit 41 similar to the search processing unit 15 shown in FIG. 2 and an information storage unit 42.

[0059] And in the modified example, when the complement of the modifier to the proper expression is performed, the information completion device 10 transmits, via the network 30, the news article and the proper expression information including the complemented modifier to the terminal device 40. When the news article and the proper expression information are transmitted, the terminal device 40 stores them in the information storage unit 42.

[0060] With this configuration, the searcher can input a search query on the terminal device 40. In this case, the search processing unit 41 accesses the information storage unit 42 of the terminal device 40 and identifies a proper expression that matches or is similar to the search query and the modifier associated therewith from among the proper expressions stored in the information storage unit 42. Thereafter, the search processing unit 41 displays the identified proper expression and modifier on the screen of the terminal device 40.

[0061] According to the modified example, it is not necessary to provide the information completion device 10 itself with a search function, and the cost of the information completion device 10 can be reduced. Also, since the search query is not transmitted from the terminal device 40 to the information completion device 10, according to the modified example, the possibility that the search query will be known to the administrator of the information completion device 10 is eliminated.

[0062] [Program] The program in the embodiment may be any program that causes a computer to execute steps A1 to A6 shown in FIG. 3. By installing and executing this program on a computer, the information complementing apparatus 10 and the information complementing method in the embodiment can be realized. In this case, the processor of the computer functions as the unique expression extraction unit 11, the dependency analysis unit 12, the complement processing unit 13, and the news article collection unit 14, and performs processing. Examples of the computer include a general-purpose PC, a smartphone, and a tablet terminal device in addition to a general-purpose PC.

[0063] Further, in the embodiment, the information storage unit 16 may be realized by storing data files constituting these in a storage device such as a hard disk provided in the computer, or may be realized by a storage device of another computer.

[0064] The program in the present embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the unique expression extraction unit 11, the dependency analysis unit 12, the complement processing unit 13, and the news article collection unit 14.

[0065] [Physical Configuration] Here, a computer that realizes the information complementing apparatus 10 by executing the program in the embodiment will be described with reference to a diagram. FIG. 6 is a block diagram showing an example of a computer that realizes the information complementing apparatus in the embodiment.

[0066] As shown in FIG. 6, the computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These units are connected to each other via a bus 121 so as to be capable of data communication with each other.

[0067] In addition to, or instead of, the CPU 111, the computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array). In this embodiment, the GPU or FPGA can execute the program in the embodiment.

[0068] The CPU 111 expands the program in the embodiment, which is composed of a code group stored in the storage device 113, into the main memory 112, and executes each code in a predetermined order to perform various operations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

[0069] Also, the program in the embodiment is provided in a state stored in a computer-readable recording medium 120. Note that the program in the present embodiment may be distributed on the Internet connected via the communication interface 117.

[0070] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to the display device 119 and controls the display on the display device 119.

[0071] The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, and reads the program from the recording medium 120 and writes the processing result in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and other computers.

[0072] As specific examples of the recording medium 120, general-purpose semiconductor memory devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as Flexible Disk, or optical recording media such as CD-ROM (Compact Disk Read Only Memory) can be mentioned.

[0073] Note that the information complementing device 10 in the embodiment can also be realized by using hardware corresponding to each part, for example, an electronic circuit, instead of a computer installed with a program. Furthermore, part of the information complementing device 10 may be realized by a program and the remaining part may be realized by hardware.

[0074] Some or all of the above-described embodiments can be expressed by (Appendix 1) to (Appendix 15) described below, but are not limited to the following description.

[0075] (Appendix 1) A proper noun extraction unit that extracts proper nouns from news articles related to cyberattacks, A dependency analysis unit that analyzes the dependency relationships between words or clauses in the news article, Identifies proper nouns that meet the set conditions among the extracted proper nouns, and based on the result of the analysis of the dependency relationships, complements the corresponding modifiers for the identified proper nouns, An information complementing device characterized by comprising the above.

[0076] (Appendix 2) The information complementing device according to Appendix 1, wherein the proper noun extraction unit extracts the proper nouns and identifies the types of the extracted proper nouns, The completion processing unit compares a list in which types of specific expressions to be extracted in advance are registered with the type of each of the extracted specific expressions, and identifies, as specific expressions that satisfy the setting conditions, the specific expressions among the extracted specific expressions whose types are registered in the list. An information completion device characterized by the above.

[0077] (Appendix 3) An information completion device according to Appendix 1 or 2, wherein the specific expression extraction unit stores the extracted specific expressions in a storage area of a storage device, when a search process is performed on the specific expressions stored in the storage area and a specific expression is searched, the completion processing unit identifies, from among the searched specific expressions, specific expressions that satisfy the setting conditions, and based on the result of the analysis of the dependency relationship, complements a modifier corresponding to the identified specific expression. An information completion device characterized by the above.

[0078] (Appendix 4) An information completion device according to any one of Appendices 1 to 3, wherein the specific expression extraction unit extracts specific expressions from the news article using a dictionary in which words or phrases corresponding to the specific expressions to be extracted are registered. An information completion device characterized by the above.

[0079] (Appendix 5) An information completion device according to any one of Appendices 1 to 4, wherein the specific expression extraction unit extracts specific expressions from the news article using a machine learning model, and the machine learning model is constructed using, as training data, a document in which a label indicating whether a word or phrase is to be an extraction target is assigned. An information completion device characterized by the above.

[0080] (Appendix 6) An entity extraction step of extracting entity expressions from news articles related to cyberattacks, A dependency analysis step of analyzing the dependency relationships between words or clauses in the news article, A complement processing step of identifying entity expressions that meet the set conditions among the extracted entity expressions and complementing the corresponding modifiers for the identified entity expressions based on the result of the analysis of the dependency relationships, Having An information complement method characterized by the above.

[0081] (Appendix 7) The information complement method described in Appendix 6, wherein In the entity extraction step, while extracting the entity expressions, the types of the extracted entity expressions are identified, In the complement processing step, a list in which the types of entity expressions to be extracted in advance are registered is compared with the types of the extracted entity expressions, and among the extracted entity expressions, the entity expressions whose types are registered in the list are identified as the entity expressions that meet the set conditions, An information complement method characterized by the above.

[0082] (Appendix 8) The information complement method described in Appendix 6 or 7, wherein In the entity extraction step, the extracted entity expressions are stored in the storage area of the storage device, When a search process is performed on the entity expressions stored in the storage area and an entity expression is searched, In the complement processing step, among the searched entity expressions, the entity expressions that meet the set conditions are identified, and based on the result of the analysis of the dependency relationships, the corresponding modifiers are complemented for the identified entity expressions, An information complement method characterized by the above.

[0083] (Appendix 9) The information complement method described in any one of Appendices 6 to 8, wherein In the specific expression extraction step, a specific expression is extracted from the news article by using a dictionary that registers words or phrases corresponding to the specific expression to be extracted. An information completion method characterized by the above.

[0084] (Appendix 10) An information completion method according to any one of Appendices 6 to 9, In the specific expression extraction step, a specific expression is extracted from the news article by using a machine learning model. The machine learning model is constructed by using, as training data, a document in which a label indicating whether a word or phrase is an extraction target is assigned to the word or phrase. An information completion method characterized by the above.

[0085] (Appendix 11) To a computer, A specific expression extraction step of extracting a specific expression from a news article related to a cyber attack, A dependency analysis step of analyzing the dependency relationship between words or phrases in the news article, Identifying a specific expression that satisfies a set condition among the extracted specific expressions, and based on the result of the analysis of the dependency relationship, complementing a modifier corresponding to the identified specific expression. Causing to execute is Program to

[0086] (Appendix 12) As described in Appendix 11 program And In the specific expression extraction step, while extracting the specific expression, identifying the type of the extracted specific expression. In the complementation processing step, comparing a list in which the types of specific expressions to be extracted in advance are registered with the types of the extracted specific expressions, and identifying, as the specific expressions that satisfy the set condition, the specific expressions among the extracted specific expressions whose types are registered in the list. Characterized by the aboveprogram .

[0087] (Appendix 13) as described in Appendix 11 or 12 program and in the specific expression extraction step, storing the extracted specific expression in a storage area of a storage device when a search process is performed on the specific expression stored in the storage area and a specific expression is searched in the complement processing step, identifying a specific expression that satisfies the set conditions from the searched specific expressions, and complementing a corresponding modifier for the identified specific expression based on the result of the parsing of the dependency relationship characterized by program .

[0088] (Appendix 14) as described in any one of Appendices 11 to 13 program and in the specific expression extraction step, extracting a specific expression from the news article using a dictionary that registers words or phrases corresponding to the specific expression to be extracted characterized by program .

[0089] (Appendix 15) as described in any one of Appendices 11 to 14 program and in the specific expression extraction step, extracting a specific expression from the news article using a machine learning model the machine learning model is constructed using, as training data, a document in which a label indicating whether a word or phrase is an extraction target is assigned characterized by program .

[0090] The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

Industrial Applicability

[0091] As described above, according to the present invention, it is possible to complement the content of information in the search for information related to cyberattacks. The present invention is useful in various fields where analysis of cyberattacks is required.

Explanation of Signs

[0092] 10 Information Completion Device 11 Specific Expression Extraction Unit 12 Dependency Analysis Unit 13 Completion Processing Unit 14 News Article Collection Unit 15 Search Processing Unit 16 Information Storage Unit 17 Dictionary 18 Specific Expression Type List 20 News Database 30 Network 40 Terminal Device 41 Search Processing Unit 42 Information Storage Unit 110 Computer 111 CPU 112 Main Memory 113 Storage Device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Device 119 Display Device 120 Recording Medium 121 Bus

Claims

1. An entity expression extraction unit that extracts entity expressions from news articles related to cyberattacks and identifies the types of the extracted entity expressions; A dependency analysis unit that analyzes the dependency relationships between words or phrases in the news article; Compare a list in which types of entity expressions to be extracted in advance are registered with the types of the extracted entity expressions, and identify, as entity expressions that satisfy the set conditions, the entity expressions among the extracted entity expressions whose types are registered in the list. Based on the result of the analysis of the dependency relationships, complement the identified entity expressions with corresponding modifiers, a complement processing unit; It is provided with An information complement device characterized by this.

2. The information complement device according to claim 1, wherein The entity expression extraction unit stores the extracted entity expressions in a storage area of a storage device, When a search process is performed on the entity expressions stored in the storage area and an entity expression is searched, The complement processing unit identifies, from the searched entity expressions, entity expressions that satisfy the set conditions, and based on the result of the analysis of the dependency relationships, complements the identified entity expressions with corresponding modifiers. An information complement device characterized by this.

3. The information complement device according to claim 1, wherein The entity expression extraction unit extracts entity expressions from the news article using a dictionary that registers words or phrases corresponding to entity expressions to be extracted. An information complement device characterized by this.

4. The information complement device according to claim 1, wherein The entity expression extraction unit extracts entity expressions from the news article using a machine learning model, The machine learning model is constructed using, as training data, a document in which labels indicating whether a word or a phrase is to be an extraction target are assigned to the word or the phrase. An information completion device characterized by the above.

5. A method executed by a computer, extracting an entity from a news article related to a cyber attack, identifying the type of the extracted entity, analyzing the dependency relationship between words or phrases in the news article, comparing a list in which types of entities to be extracted in advance are registered with the type of each of the extracted entities, identifying, among the extracted entities, the entities whose types are registered in the list as entities satisfying set conditions, and complementing a modifier corresponding to the identified entity based on the result of the analysis of the dependency relationship. An information completion method characterized by the above.

6. The information completion method according to claim 5, in the extraction of the entity, storing the extracted entity in a storage area of a storage device, performing a search process on the entity stored in the storage area, and when the entity is searched, in the complementing, identifying an entity satisfying the set conditions from among the searched entities, and complementing a modifier corresponding to the identified entity based on the result of the analysis of the dependency relationship. An information completion method characterized by the above.

7. The information completion method according to claim 5, in the extraction of the entity, extracting the entity from the news article using a dictionary registering words or phrases corresponding to the entity to be extracted. An information completion method characterized by the above.

8. The information completion method according to claim 5, In the extraction of the specific expressions, a machine learning model is used to extract specific expressions from the news article, and the machine learning model is constructed using, as training data, a document in which a label indicating whether or not a word or a phrase is to be an extraction target is assigned to the word or the phrase. An information complementation method characterized by the above.

9. causing a computer to extract specific expressions from a news article related to a cyber attack, identify the types of the extracted specific expressions, analyze the dependency relationship between words or phrases in the news article, compare a list in which types of specific expressions to be extracted in advance are registered with the types of the respective extracted specific expressions, and identify, as specific expressions that satisfy the set conditions, the specific expressions among the extracted specific expressions whose types are registered in the list, and based on the result of the analysis of the dependency relationship, complement a modifier corresponding to the identified specific expression. A program.

10. The program according to claim 9, wherein in the extraction of the specific expressions, the extracted specific expressions are stored in a storage area of a storage device, when a search process is performed on the specific expressions stored in the storage area and a specific expression is searched, in the complementation, specific expressions that satisfy the set conditions are identified from among the searched specific expressions, and based on the result of the analysis of the dependency relationship, a modifier corresponding to the identified specific expression is complemented. A program characterized by the above.

11. The program according to claim 9, wherein in the extraction of the specific expressions, a dictionary in which words or phrases corresponding to specific expressions to be extracted are registered is used to extract specific expressions from the news article. A program characterized by the above.

12. The program according to claim 9, in the extraction of the specific expression, using a machine learning model, extracting the specific expression from the news article, wherein the machine learning model is constructed using, as training data, a document in which a label indicating whether or not a word or a clause is to be an extraction target is assigned, a program characterized by the above.

Images