Information processing device, information processing method, and information processing program

Abstract

An information processing device (100) comprises: a decoy theme inference unit (130) that infers, on the basis of an access log (21) indicating an access in an object system by a high risk user who is a user of the object system, a decoy theme which is a theme of information which the high risk user is trying to leak to the outside; and a decoy placement unit (140) that places, in the object system, a decoy file corresponding to the inferred decoy theme.

Description

Information processing device, information processing method, and information processing program

[0001] The present disclosure relates to an information processing device, an information processing method, and an information processing program.

[0002] Patent Document 1 discloses a technology for generating decoy data (a decoy email as a specific example) containing information (a specific example of information indicating a URL (Uniform Resource Locator), an ID (Identification), and a password) to trick a third party intercepting emails on a network into accessing a decoy server, and placing the generated decoy data on a network. Here, an arbitrary decoy file is placed on the decoy server. Preferably, the decoy file contains business performance information, new product information, confidential information, new technology information, personal information, and the like.

[0003] JP 2010-134832 A

[0004] If the attacker is a malicious third party, it is sufficient to prepare decoy data related to information of interest to the attacker and specific information generally known to be attractive to the attacker, and place the prepared decoy data on the network as in conventional techniques. Specific information includes, for example, information indicating at least one of IDs, passwords, system configurations, personal information, and funds. However, considering information leaks by internal fraudsters, information contained in various files created during daily work could also be targeted for theft. A specific example of an internal fraudster is a malicious employee. Preparing decoy data for every file would result in an enormous amount of decoy data. Furthermore, since internal fraudsters are likely to leak information that fits a certain theme, presenting decoy files that do not fit the internal fraudster's theme is ineffective. Specific examples of themes include "defense-related," "machine learning-related," and "design documents-related." Furthermore, if a large number of decoy files that do not match the internal fraudster's theme are presented, or if the contents of the decoy files are unrelated to the company's business, the internal fraudster is more likely to realize that they are decoy files, so the contents of the decoy files must be carefully considered.

[0005] The present disclosure aims to automatically place decoy files that match the presumed theme of information that an internal fraudster is attempting to leak to the outside in a deception system that uses decoy data.

[0006] The information processing device according to the present disclosure includes a decoy theme estimation unit that estimates a decoy theme, which is the theme of information that a high-risk user who is a user of a target system is attempting to leak to the outside, based on an access log indicating access to the target system by the high-risk user, and a decoy placement unit that places a decoy file that matches the estimated decoy theme in the target system.

[0007] According to the present disclosure, a decoy theme estimation unit estimates the theme of information that a high-risk user is attempting to leak to the outside based on the access log, and a decoy placement unit places a decoy file matching the estimated theme in the target system. Here, the high-risk user may be an internal fraudster. Therefore, according to the present disclosure, in a deception system using decoy data, it is possible to automatically place a decoy file matching the estimated theme of information that an internal fraudster is attempting to leak to the outside.

[0008] 1 is a diagram explaining file access by an internal malicious actor. A diagram illustrating a configuration example of an information processing device 100 according to the first embodiment. A diagram illustrating a configuration example of an information processing system 90 according to the first embodiment. A diagram illustrating a hardware configuration example of an information processing device 100 according to the first embodiment. A flowchart illustrating the operation of an information processing device 100 according to the first embodiment. A flowchart illustrating the operation of a decoy theme estimation unit 130 according to the first embodiment. A flowchart illustrating the operation of a decoy theme estimation unit 130 according to the first embodiment. A flowchart illustrating the operation of a decoy placement unit 140 according to the first embodiment. A flowchart illustrating the operation of a decoy placement unit 140 according to the first embodiment. A diagram illustrating a hardware configuration example of an information processing device 100 according to a variation of the first embodiment. A diagram illustrating a configuration example of an information processing device 100 according to a second embodiment. A flowchart illustrating the operation of an information processing device 100 according to the second embodiment. A diagram illustrating a configuration example of an information processing device 100 according to a third embodiment. A diagram illustrating a configuration example of an information processing device 100 according to a fourth embodiment.

[0009] In the description of the embodiments and the drawings, the same elements and corresponding elements are given the same reference numerals. The description of elements given the same reference numerals will be omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, "unit" may be read as "circuit," "step," "procedure," "process," or "circuitry" as appropriate.

[0010] Embodiment 1. This embodiment will be described in detail below with reference to the drawings. Even an internal malicious actor would find it difficult to target and view only files containing the desired information. Therefore, it is likely that the internal malicious actor searches for the file containing the desired information while reviewing various files. An internal malicious actor is an entity operating within an organization with the purpose of stealing data from the organization. Specific examples of an internal malicious actor include an insider in the target system 20, or malware that has stolen legitimate credentials and infected a PC (Personal Computer) used by the organization managing the target system 20. An insider is a user with legitimate access rights who engages in security attacks within the organization. An insider can also be a user with malicious intent. Specific examples of malware include malware that operates autonomously on its own or that operates in response to commands from an attacker outside the organization via a command and control server on the Internet. Figure 1 is a diagram illustrating file access by an internal malicious actor. In Figure 1, the circled "S" indicates confidentiality. As shown in FIG. 1 , when searching for a file containing the desired information, an internal malicious actor generally accesses both files related to the information to be leaked and files unrelated to the information to be leaked. Therefore, it is desirable to predict the information an employee is seeking based on several files the employee viewed before being identified as an internal malicious actor, and prepare decoy files based on the predicted information. However, it is not realistic to pre-label all files created in daily work with a theme. Specific examples of themes include "defense-related," "machine learning-related," and "design document-related." Furthermore, pre-labeling files every time a file is created or modified could disrupt normal business operations. Therefore, in this embodiment, an employee suspected of being an internal malicious actor is identified, the themes of files viewed by the identified employee are checked, the themes of the identified employee's interests are estimated based on the themes, decoy files matching the estimated themes are prepared, and the prepared decoy files are placed.

[0011] 2 shows an example of the configuration of information processing device 100 according to this embodiment. As shown in FIG. 2, information processing device 100 includes log collection unit 110, risk value calculation unit 120, decoy theme estimation unit 130, decoy placement unit 140, and decoy monitoring unit 150. Information processing device 100 also stores access log database (DB) 180 and decoy file DB 190.

[0012] The log collection unit 110 collects the access log 21 and the access log for the decoy file 191, and records the collected logs in the access log DB 180. The access log 21 is a log of file accesses in the target system 20.

[0013] The decoy file 191 is a file used to detect internal fraudsters, and a specific example is a presentation document or a dataset for image processing. The decoy file 191 is a file generated to match each theme that can be output as a decoy theme by the decoy theme estimation unit 130. The decoy file 191 may be a file generated manually, a file generated by modifying a legitimate file, a file generated according to predetermined rules, a file generated using natural language processing, or a file generated using AI (Artificial Intelligence) technology. The decoy file 191 is basically a file generated so as not to appear suspicious to internal fraudsters. As a specific example, the file name of the decoy file 191 follows a predetermined naming rule, the icon of the decoy file 191 is the same as the icon of the legitimate file, and the content of the decoy file 191 is superficially similar to the content of the legitimate file.

[0014] The target system 20 is a computer system used by multiple users in their work and stores multiple files. As a specific example, the target system 20 is a system operated based on zero trust, and is composed of at least one of an on-premise system and a cloud system. The target system 20 manages each of multiple files as part of a file tree. A file tree is a file system that manages multiple files hierarchically. In the target system 20, each file is stored in a folder, and each user accesses each file managed by the target system 20 using a file access tool. A folder is also called a directory. The file access tool is a tool that each user uses to access each file, and as a specific example, it is an explorer or a browser. Each user is a user of the target system 20. Each user may be a human or a computer.

[0015] The risk value calculation unit 120 calculates a risk value corresponding to each user based on a log of file accesses and the like in the target system 20. When a decoy file 191 is not provided, the risk value calculation unit 120 typically calculates a risk value corresponding to each user based on the access patterns of each user in the target system 20. Even when a decoy file 191 is provided, the risk value calculation unit 120 may calculate a risk value corresponding to each user based on the access patterns of each user in the target system 20. When a decoy file 191 is provided in the target system 20, the risk value calculation unit 120 may use an access log for the decoy file 191 when calculating a risk value corresponding to each user. The risk value calculation unit 120 may increase the risk value corresponding to a target user when the target user accesses at least one of one or more decoy files 191. The risk value corresponding to each user is a value calculated based on the behavior of each user in the target system 20 and is a value corresponding to the possibility that each user is actually an internal malicious actor. The behavior of each user in the target system 20 is the actions of each user in the target system 20. Specific examples of components of each user's behavior include the files accessed by each user, the order in which each user accessed the files, the time periods in which each user accessed files, and the number of file accesses per unit time for each user. The risk value calculation unit 120 may model a normal behavior pattern for each user in the target system 20 in advance based on logs such as file accesses, and calculate the degree to which each user's actual behavior in the target system 20 deviates from the modeled normal behavior pattern as a risk value corresponding to each user. When modeling the normal behavior pattern, the risk value calculation unit 120 may utilize techniques such as machine learning, or may use techniques such as User and Entity Behavior Analytics (UEBA) that detect abnormal behavior for each user based on access logs. Furthermore, the risk value calculation unit 120 generates high-risk user information 121 and outputs the generated high-risk user information 121 .The high-risk user information 121 is information indicating each high-risk user and the characteristics of each high-risk user. Specifically, the high-risk user information 121 includes data indicating each high-risk user, a risk value corresponding to each high-risk user, and one or more files accessed by each high-risk user. A high-risk user is a user of the target system 20 whose corresponding risk value is equal to or exceeds a predetermined threshold, a risk reference value, and who is relatively likely to be an internal fraudster. When at least one of the access log 21 and the decoy file access information 151 is updated, the high-risk user information 121 may be updated based on the updated information.

[0016] The decoy theme estimation unit 130 estimates a decoy theme based on an access log indicating access to the target system 20 by a high-risk user, generates decoy theme information 131 indicating the estimated decoy theme, and outputs the generated decoy theme information 131. The decoy theme estimation unit 130 may estimate a decoy theme using at least one of natural language processing and a theme list consisting of multiple themes, each of which is a decoy theme candidate. The theme list is a list of multiple themes, each of which is a decoy theme candidate. Each theme may be a word. Specific examples of themes included in the theme list are the words "transportation," "defense," and "communications." A decoy theme is a theme in which a high-risk user is estimated to be interested, and is a theme of information that the high-risk user is attempting to leak to the outside. Specific examples of decoy themes include business-level themes such as "transportation," "defense," and "communications," technical-level themes such as "AI," "image processing," and "behavior detection," document-level themes such as "system design document" and "proposal," and format-level themes such as "text document" and "presentation materials," as well as combinations of these. Furthermore, decoy themes do not have to be verbalized themes as described above. Specifically, files selected based on the degree of similarity between documents analyzed using natural language processing may be used as decoy themes. As a more detailed example, the decoy theme estimation unit 130 uses clustering technology to classify files accessed by high-risk users and estimates the cluster with the largest number of files as the decoy theme. Then, a decoy file 191 most similar to the cluster corresponding to the decoy theme estimated by the decoy theme estimation unit 130 is selected from the decoy file DB 190. As a specific example, the decoy theme estimation unit 130 estimates a decoy theme by analyzing the folder name of the folder that the high-risk user has viewed and the file name and content of the file that the high-risk user has viewed. Note that the decoy theme estimation unit 130 may estimate multiple decoy themes as decoy themes corresponding to a certain high-risk user.Furthermore, since high-risk users do not necessarily access only files related to the information they wish to leak, the decoy themes may be assumed to be unrelated to the themes in which the high-risk users are actually interested.

[0017] The decoy placement unit 140 selects one or more decoy files 191 from the decoy file DB 190 based on the decoy theme estimated by the decoy theme estimation unit 130 and places the selected one or more decoy files 191 in the placement target area. Placing the decoy file 191 includes instructing a plug-in or the like to place the decoy file 191. The placement target area is an area corresponding to a part of the file tree managed by the target system 20. The placement target area may be an area including a folder in which a file matching the decoy theme estimated by the decoy theme estimation unit 130 is placed, an area including the vicinity of an area accessed by a high-risk user, or an area including an area expected to be accessed by a high-risk user in the future. The decoy placement unit 140 may select the decoy file 191 from the decoy file DB 190 using at least one of natural language processing and a theme list. Specifically, decoy placement unit 140 selects one or more decoy files 191 that match the decoy theme estimated by decoy theme estimation unit 130 from decoy file DB 190, issues an instruction to target system 20 to place each selected decoy file 191 in a placement target area, generates decoy file information 141 corresponding to the executed instruction, and outputs the generated decoy file information 141. Decoy file information 141 corresponding to a certain decoy file 191 is information that indicates the file name and placement location of the certain decoy file 191. Decoy placement unit 140 may place decoy file 191 in target system 20 instead of issuing an instruction to target system 20 to place decoy file 191. The decoy placement unit 140 may extract topics from the content and file names of files accessed by high-risk users, further narrow down the area to which files or directories related to the extracted topics exist, and place the decoy file 191 in the narrowed down area. In this case, the decoy placement unit 140 may extract topics using a topic model such as Top2Vec. The decoy placement unit 140 may create a decoy folder and instruct the target system 20 to place the decoy file 191 in the created decoy folder. The decoy placement unit 140 may add information indicating that the decoy file 191 has been accessed to the access log 21 corresponding to each user.

[0018] The decoy monitoring unit 150 monitors access to each decoy file 191 indicated by the decoy file information 141 for each high-risk user indicated by the high-risk user information 121, generates decoy file access information 151 corresponding to the monitoring results, and outputs the generated decoy file access information 151. For example, if a high-risk user accesses the decoy file 191 a predetermined number of times or more, the decoy file access information 151 is information indicating that the high-risk user has accessed the decoy file 191 a predetermined number of times or more. The decoy file access information 151 may also be information indicating that a user other than the high-risk user has accessed the decoy file 191. Specific examples of methods for selecting the decoy file 191 based on the estimated decoy theme include a rule-based method or a natural language processing technique. The analyst may narrow down the high-risk users based on the decoy file access information 151 and the high-risk user information 121, and the narrowed-down results may be reflected in the high-risk user information 121. The analyst is illustratively a person or computer that analyzes security attacks in the target system 20 .

[0019] The access log DB 180 is a database that stores information indicating the access log in the target system 20 .

[0020] The decoy file DB 190 is a database that stores one or more decoy files 191, and is a database that stores files that are candidates for the decoy file 191. The decoy file DB 190 stores a decoy file 191 that corresponds to each decoy theme that the decoy theme estimation unit 130 can output.

[0021] FIG. 3 illustrates an example of an information processing system 90 according to this embodiment. The example of the information processing system 90 will be described using FIG. 3. In FIG. 3, the information processing device 100 is illustrated divided into various functions. Here, an internal malicious actor investigates files in the target system 20. The risk-based authentication function utilizes risk-based authentication technology to receive access logs 21 for each user from the target system 20 and calculate a risk value for each user based on the received logs. Furthermore, if a decoy file 191 has already been placed, the risk value calculation unit 120 references the access log for the decoy file 191 when calculating the risk value for each user. The internal malicious actor countermeasure platform is a system having internal malicious actor countermeasure functions and includes a decoy dynamic distribution function and a file access function. The decoy dynamic distribution function selects a folder in which to place the decoy file 191, selects the decoy file 191, and places the selected decoy file 191 in the selected folder. The decoy placement unit 140 instructs the internal malicious actor countermeasure plugin to place the decoy file 191. The internal fraud prevention plug-in is a software module that realizes additional functions for the file access tool. The function of the decoy monitoring unit 150 is realized by the internal fraud prevention plug-in. The file access tool that realizes the file access function uses the internal fraud prevention plug-in to place the decoy file 191 based on instructions from the decoy dynamic distribution function. The internal fraud prevention plug-in may actually place the decoy file 191 in the target system 20, or may display the decoy file 191 on the operation screen of the file access tool when each user accesses the folder where the decoy file 191 is to be placed, without actually placing the decoy file 191 in the target system 20.

[0022] 4 shows an example of the hardware configuration of the information processing device 100 according to this embodiment. The information processing device 100 is composed of a general computer. The information processing device 100 may be composed of multiple computers. The target system 20 and the information processing device 100 may be configured integrally.

[0023] As shown in the figure, the information processing device 100 is a computer that includes hardware such as a processor 11 and a storage device 12. These pieces of hardware are connected as appropriate via signal lines.

[0024] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of the computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The information processing device 100 may include multiple processors that replace the processor 11. The multiple processors share the role of the processor 11.

[0025] The storage device 12 is composed of at least one of a volatile storage device and a non-volatile storage device. A specific example of the volatile storage device is RAM (Random Access Memory). A specific example of the non-volatile storage device is ROM (Read Only Memory), HDD (Hard Disk Drive), or flash memory. Data stored in the storage device 12 is loaded into the processor 11 as needed.

[0026] The information processing device 100 may include hardware such as an input / output IF (Interface) and a communication device. The input / output IF is a port to which an input device and an output device are connected. A specific example of the input / output IF is a USB (Universal Serial Bus) terminal. A specific example of the input device is a keyboard and a mouse. A specific example of the output device is a display. A specific example of the communication device is a receiver and a transmitter. A specific example of the communication device is a communication chip or a NIC (Network Interface Card). Each part of the information processing device 100 may use the input / output IF and the communication device as appropriate when communicating with other devices, etc.

[0027] The storage device 12 stores an information processing program. The information processing program is a program that causes a computer to realize the functions of each unit of the information processing device 100. The information processing program is loaded into the storage device 12 and executed by the processor 11. The functions of each unit of the information processing device 100 are realized by software. The storage device 12 may store files managed by the target system 20.

[0028] Data used when executing the information processing program and data obtained by executing the information processing program are stored in the storage device 12 as appropriate. Each unit of the information processing device 100 uses the storage device 12 as appropriate. Note that the terms "data" and "information" may have the same meaning. The storage device 12 may be independent of the computer. Each database may be stored on an external server or the like.

[0029] The information processing program may be recorded on a computer-readable non-volatile recording medium. Specific examples of the non-volatile recording medium include an optical disk and a flash memory. The information processing program may be provided as a program product.

[0030] ***Description of Operation*** The operational procedure of the information processing device 100 corresponds to an information processing method. Also, the program that realizes the operation of the information processing device 100 corresponds to an information processing program.

[0031] 5 is a flowchart showing an example of the operation of the information processing device 100. The operation of the information processing device 100 will be described with reference to FIG.

[0032] (Step S101: Risk Value Calculation Process) The risk value calculation unit 120 refers to the access log DB 180 and calculates a risk value related to the behavior of each user based on the file access log.

[0033] (Step S102: Decoy Theme Inference Process) The decoy theme inference unit 130 infers a decoy theme based on the file access logs of high-risk users.

[0034] FIG. 6 is a flowchart showing an example of the processing of the decoy theme estimation unit 130 when a decoy theme is estimated using natural language processing technology in step S102. The processing of the decoy theme estimation unit 130 will be described using FIG. 6 . In this example, it is assumed that a word embedding model has been prepared in advance. The word embedding model may be a publicly available model, a model created using files in the target system 20, or a model in which information about files in the target system 20 has been added to a publicly available word embedding model.

[0035] (Step S121) The decoy theme estimation unit 130 selects one file indicated by the high-risk user information 121 and accessed by the target user.

[0036] (Step S122) The decoy theme estimation unit 130 extracts words whose parts of speech are nouns from the file names and written contents of the files selected in step S121.

[0037] (Step S123) The decoy theme estimation unit 130 vectorizes each word extracted in step S122 using a word embedding model, and clusters the generated vectors.

[0038] (Step S124) The decoy theme estimation unit 130 extracts words that exist near the center of gravity of the cluster that contains the largest number of words.

[0039] (Step S125) The decoy theme estimation unit 130 records the word extracted in step S124 as a theme.

[0040] (Step S126) The decoy theme estimation unit 130 repeats the processes from step S121 to step S125 until all files accessed by the target user among the files indicated by the high-risk user information 121 have been confirmed.

[0041] (Step S127) After checking all files accessed by the target user, the decoy theme estimation unit 130 clusters all the themes recorded in step S125.

[0042] (Step S128) The decoy theme estimation unit 130 estimates, as a decoy theme, a word that exists near the center of gravity of the cluster containing the most themes.

[0043] 7 is a flowchart showing an example of the process of the decoy theme estimation unit 130 when a decoy theme is estimated using both a rule base and natural language processing in step S102. The process of the decoy theme estimation unit 130 will be explained using FIG. 7. In this example, it is assumed that a word embedding model is prepared in advance and a theme list is created in advance.

[0044] (Step S131) ​​The decoy theme estimation unit 130 selects one file indicated by the high-risk user information 121 and accessed by the target user.

[0045] (Step S132) The decoy theme estimation unit 130 extracts words whose parts of speech are nouns from the file names and written contents of the files selected in step S131.

[0046] (Step S133) The decoy theme estimation unit 130 vectorizes each word extracted in step S132 using a word embedding model. Then, the decoy theme estimation unit 130 calculates the similarity between each generated vector and the vector corresponding to each word included in the theme list.

[0047] (Step S134) Based on the similarity calculated in step S133, the decoy theme estimation unit 130 records, among the themes included in the theme list, a theme that has a relatively large number of words whose corresponding similarity is equal to or greater than a predetermined threshold, as the theme of the file selected in step S131.

[0048] (Step S135) The decoy theme estimation unit 130 repeats the processes from step S131 to step S134 until all files accessed by the target user among the files indicated by the high-risk user information 121 have been confirmed.

[0049] (Step S136) After processing all files accessed by the target user, the decoy theme estimation unit 130 estimates the most frequently appearing theme among all the themes recorded in step S134 as the decoy theme.

[0050] (Step S103 : Decoy File Placement Process) The decoy placement unit 140 selects a decoy file 191 that matches the decoy theme estimated by the decoy theme estimation unit 130 from the decoy file DB 190 , and places the selected decoy file 191 in the target system 20 .

[0051] 8 is a flowchart showing an example of the process of the decoy placement unit 140 when natural language processing technology is used to select the decoy file 191 in step S103. The process of the decoy placement unit 140 will be explained using FIG. 8. In this example, it is assumed that a word embedding model is prepared in advance.

[0052] (Step S141 ) The decoy placement unit 140 selects a decoy file 191 from the decoy file DB 190 .

[0053] (Step S142) The decoy placement unit 140 extracts words whose part of speech is a noun from the file name and written content of the decoy file 191 selected in step S141.

[0054] (Step S143) The decoy placement unit 140 vectorizes each of the words extracted in step S142 using a word embedding model. Then, the decoy placement unit 140 calculates the similarity between each of the generated vectors and the vectors corresponding to the words estimated as the decoy themes.

[0055] (Step S144) Based on the similarity calculated in step S143, the decoy placement unit 140 calculates the number of words whose corresponding similarity exceeds a predetermined threshold value among the words extracted in step S142.

[0056] (Step S145) If the number of words whose corresponding similarities exceed a predetermined threshold value exceeds a predetermined threshold value, the decoy placement unit 140 selects the decoy file 191 selected in step S141 as the decoy file 191 to be placed. The selected decoy file 191 is the decoy file 191 that matches the decoy theme.

[0057] (Step S146) The decoy placement unit 140 repeats the processes of steps S141 to S145 until all of the decoy files 191 stored in the decoy file DB 190 that match the decoy theme have been confirmed.

[0058] 9 is a flowchart showing an example of the processing of the decoy placement unit 140 when the decoy file 191 is selected in step S103 using both the rule base and natural language processing. The processing of the decoy placement unit 140 will be explained using FIG. 9. In this example, it is assumed that a theme list has been created in advance.

[0059] (Step S151 ) The decoy placement unit 140 receives information indicating a decoy theme from the decoy theme estimation unit 130 .

[0060] (Step S152) The decoy placement unit 140 selects a decoy file 191 that matches the decoy theme indicated by the received information from the decoy file DB 190. It is assumed that a decoy file 191 has been created for each theme indicated in the theme list.

[0061] (Step S104: Decoy Monitoring Process) The decoy monitoring unit 150 monitors access to the decoy file 191, generates decoy file access information 151 indicating the monitoring results, and outputs the generated decoy file access information 151.

[0062] (Step S105: High-Risk User Information Correction Process) The risk value calculation unit 120 corrects the high-risk user information 121 based on the output decoy file access information 151.

[0063] ***Description of Effect of First Embodiment*** In the prior art, even if there was an internal malicious actor attempting to leak information contained in files created in daily work, there was a problem in that it was not possible to automatically select a decoy file related to the information sought by the internal malicious actor and to deploy the selected decoy file. On the other hand, according to this embodiment, the themes of files, folders, etc. viewed by a high-risk user are analyzed based on the high-risk user information 121, the themes in which the high-risk user is interested are inferred, and a decoy file 191 matching the inferred themes is deployed in the target system 20. Therefore, according to this embodiment, the themes of files, folders, etc. viewed by an internal malicious actor can be analyzed to infer the themes in which the internal malicious actor is interested, and a decoy file 191 related to the information sought by the internal malicious actor can be automatically selected based on the inferred themes, and the selected decoy file can be deployed.

[0064] ***Other Configurations*** <Modification 1> Fig. 10 shows an example of the hardware configuration of an information processing device 100 according to this modification. The information processing device 100 includes a processing circuit 18 instead of the processor 11, or instead of the processor 11 and the storage device 12. The processing circuit 18 is hardware that realizes at least a part of the components included in the information processing device 100. The processing circuit 18 may be dedicated hardware, or may be a processor that executes a program stored in the storage device 12.

[0065] When the processing circuitry 18 is dedicated hardware, the processing circuitry 18 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The information processing device 100 may include multiple processing circuits that replace the processing circuitry 18. The multiple processing circuits share the role of the processing circuitry 18.

[0066] In the information processing device 100, some of the functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0067] The processing circuitry 18 is realized by, for example, hardware, software, firmware, or a combination of these. The processor 11, the storage device 12, and the processing circuitry 18 are collectively referred to as the "processing circuitry." In other words, the functions of the functional components of the information processing device 100 are realized by the processing circuitry. Information processing devices 100 according to other embodiments may also have a configuration similar to that of this modified example.

[0068] Second Embodiment The following mainly describes the differences from the above-described embodiment with reference to the drawings.

[0069] ***Description of Configuration*** Fig. 11 shows an example configuration of information processing device 100 according to this embodiment. As shown in Fig. 11, information processing device 100 further includes a decoy content generation unit 160 compared to information processing device 100 according to embodiment 1.

[0070] The decoy content generation unit 160 selects a file from the decoy file DB 190 as a decoy file 191 that matches the decoy theme based on the decoy theme estimated by the decoy theme estimation unit 130, generates a decoy file name based on the file name of the selected decoy file 191 using natural language processing technology or the like based on the decoy theme estimated by the decoy theme estimation unit 130, and outputs the selected decoy file 191 and information indicating the generated decoy file name. The decoy file name is a file name designed to increase the likelihood that an internal malicious actor will identify the decoy file 191 corresponding to the decoy file name. Specific examples of methods for generating decoy file names based on the decoy theme include rule-based methods or methods using natural language processing technology. Specifically, one example is a method in which characters are added to the file names of each file accessed by a high-risk user corresponding to the decoy theme based on a rule. Specific examples of characters added to the file name are "_update" or "_ (date)." Another method is to use natural language processing to extract noun words from multiple file names corresponding to a decoy theme, extract common words from the extracted words, and generate decoy file names by modifying the nouns contained in the file names of existing decoy files 191 so that they include the extracted words.

[0071] Decoy placement unit 140 according to this embodiment uses decoy file 191 and the file name output by decoy content generation unit 160. That is, decoy placement unit 140 sets the file selected by decoy content generation unit 160 as decoy file 191, and sets the file name of decoy file 191 to the file name generated by decoy content generation unit 160.

[0072] ***Explanation of Operation*** Fig. 12 is a flowchart showing an example of the operation of the information processing device 100. The operation of the information processing device 100 will be described with reference to Fig. 12 .

[0073] (Step S201: Decoy content generation process) The decoy content generation unit 160 selects a decoy file 191 from the decoy file DB 190 that matches the decoy theme estimated by the decoy theme estimation unit 130, generates a decoy file name based on the decoy theme, and sets the generated decoy file name as the file name of the selected decoy file 191.

[0074] (Step S202: Decoy File Placement Process) The decoy placement unit 140 places the decoy file 191 selected by the decoy content generation unit 160 in the target system 20. At this time, the decoy placement unit 140 sets the file name of the decoy file 191 to the decoy file name generated by the decoy content generation unit 160.

[0075] ***Explanation of Effects of Embodiment 2*** According to this embodiment, the decoy content generation unit 160 generates a file name of the decoy file 191 based on a decoy theme. Therefore, according to this embodiment, it is possible to automatically generate the decoy file 191 that is relatively likely to be checked by an internal malicious actor, and place it in the target system 20.

[0076] Third Embodiment Hereinafter, differences from the above-described embodiments will be mainly described with reference to the drawings.

[0077] *** Description of Configuration *** Fig. 13 shows an example configuration of information processing device 100 according to the present embodiment. As shown in Fig. 13, information processing device 100, unlike information processing device 100 according to embodiment 1, includes decoy content generation unit 160 and does not store decoy file DB 190.

[0078] The decoy content generation unit 160 generates the decoy file 191 based on the decoy theme by using natural language processing technology or the like. Specifically, the decoy content generation unit 160 generates the content and file name of the decoy file 191. The content and file name of the decoy file 191 are devised to increase the possibility that an internal malicious individual will check the decoy file 191.

[0079] The decoy placement unit 140 according to this embodiment uses the file generated by the decoy content generation unit 160 as the decoy file 191 .

[0080] ***Description of Operation*** The elements of the flowchart showing the operation of information processing device 100 according to the present embodiment are the same as the elements of the flowchart showing the operation of information processing device 100 according to embodiment 2. The differences from embodiment 2 will be explained below.

[0081] (Step S201: Decoy Content Generation Process) The decoy content generation unit 160 generates the contents and file name of the decoy file 191 based on the decoy theme estimated by the decoy theme estimation unit 130.

[0082] (Step S202: Decoy File Placement Process) The decoy placement unit 140 places the decoy file 191 generated by the decoy content generation unit 160 in the target system 20.

[0083] ***Explanation of Effects of Embodiment 3*** According to this embodiment, the decoy content generation unit 160 generates the decoy file 191 based on a decoy theme. Therefore, according to this embodiment, the decoy file 191 that is relatively likely to be checked by an internal malicious actor can be automatically generated and placed in the target system 20.

[0084] ***Other Configurations*** <Variation 2> The viewing time of each file by the target user is considered to vary depending on the level of interest of the target user, etc. Specifically, the target user is considered to view files related to themes in which he or she is more interested for a longer period of time. Therefore, this variation takes into consideration the viewing time of each file by the target user.

[0085] The configuration of the information processing device 100 according to this modification is the same as the configuration of the information processing device 100 according to the third embodiment.

[0086] The decoy theme estimation unit 130 according to this modification estimates a decoy theme corresponding to the target user based on each file indicated in the high-risk user information 121 and accessed by the target user, and the viewing time of each file stored in the target system 20 by the target user. The decoy theme estimation unit 130 may estimate a decoy theme corresponding to the target user based on the difference between the standard viewing time of each file and the viewing time of each file by the target user. The decoy theme estimation unit 130 may also estimate a decoy theme corresponding to the target user based on the time the target user spent in each folder, or may estimate a decoy theme corresponding to the target user by taking into account the number or frequency of accesses by the target user to each folder or each file. When estimating a decoy theme corresponding to the target user, the decoy theme estimation unit 130 may not use files whose viewing time by the target user is below a threshold. When the decoy theme estimation unit 130 estimates a decoy theme corresponding to a target user using a theme list as described with reference to FIG. 7 , instead of simply counting the number of occurrences of each theme, the decoy theme estimation unit 130 may count a value corresponding to the target user's browsing time for each file corresponding to the target theme when each theme is set as a target theme. In this case, as a specific example, the decoy theme estimation unit 130 may set the number of occurrences of a theme corresponding to a target file to 0.5 if the target user's browsing time for the target file is equal to or less than a threshold, and set the number of occurrences of a theme corresponding to the target file to 1.5 if the target user's browsing time for the target file is greater than the threshold. Here, the target file is a file accessed by the target user. Alternatively, the decoy theme estimation unit 130 may count the number of occurrences of a theme corresponding to each file by setting a coefficient whose value increases as the file's browsing time increases.

[0087] The decoy content generation unit 160 according to this modification generates the contents and filename of the decoy file 191 based on the decoy theme and the viewing time of each file. When the decoy content generation unit 160 uses natural language processing technology to generate the contents of the decoy file 191 that matches the decoy theme corresponding to the target user, as a specific example, files that match the decoy theme and whose viewing time by the target user is equal to or greater than a threshold are used as input for the natural language processing. When generating filenames for the decoy file 191 that matches the decoy theme corresponding to the target user, the decoy content generation unit 160 uses, as a specific example, the filenames of files that match the decoy theme and whose viewing time by the target user is equal to or greater than a threshold as the base for the filename. Alternatively, the decoy content generation unit 160 may select the top X files that match the decoy theme in descending order of the length of viewing time by the target user, and use the filenames of the selected files as the base for the filename.

[0088] According to this modification, the decoy file 191 is a file generated based on the browsing time of a high-risk user. Therefore, according to this modification, it is possible to place a decoy file 191 that is relatively likely to be accessed by a high-risk user in the target system 20. Note that the decoy theme estimation method according to this modification may be appropriately combined with the decoy file 191 selection method or decoy file generation method according to other embodiments.

[0089] Fourth Embodiment Hereinafter, differences from the above-described embodiments will be mainly described with reference to the drawings.

[0090] ***Description of Configuration*** Fig. 14 shows an example configuration of information processing device 100 according to the present embodiment. As shown in Fig. 14, information processing device 100, compared to information processing device 100 according to embodiment 1, includes decoy content generation unit 160, and stores template file DB 200 instead of decoy file DB 190.

[0091] Decoy content generation unit 160 selects a template file from template file DB 200 based on the decoy theme estimated by decoy theme estimation unit 130, modifies the selected template file based on the decoy theme estimated by decoy theme estimation unit 130, and outputs the modified template file as decoy file 191. At this time, as a specific example, decoy content generation unit 160 modifies the content and file name of the template file to content and file name appropriate for the decoy theme. Decoy content generation unit 160 may select a template file according to the decoy theme.

[0092] The decoy placement unit 140 according to this embodiment uses the template file modified by the decoy content generation unit 160 as the decoy file 191 .

[0093] Template file DB200 is a database that stores candidate template files that correspond to decoy file 191. A template file that corresponds to decoy file 191 is a file that is used as a template for decoy file 191. Template file DB200 may store template files that correspond to each decoy theme that decoy theme estimation unit 130 can output.

[0094] ***Description of Operation*** Each element in the flowchart showing the operation of information processing device 100 according to the present embodiment is the same as each element in the flowchart showing the operation of information processing device 100 according to the second embodiment.

[0095] (Step S201: Decoy content generation process) The decoy content generation unit 160 selects a template file from the template file DB 200, modifies the content and file name of the selected template file to content and file name appropriate for the decoy theme estimated by the decoy theme estimation unit 130, and outputs the template file with the modified content and file name as the decoy file 191.

[0096] (Step S202: Decoy File Placement Process) The decoy placement unit 140 places the decoy file 191 generated by the decoy content generation unit 160 in the target system 20.

[0097] ***Explanation of Effects of the Fourth Embodiment*** According to this embodiment, the decoy content generation unit 160 generates the decoy file 191 based on the decoy theme and the template file. Therefore, according to this embodiment, the decoy file 191 that is relatively likely to be checked by an internal malicious actor can be automatically generated and placed in the target system 20.

[0098] ***Other Embodiments*** The above-described embodiments can be freely combined, or any of the components of each embodiment can be modified, or any of the components can be omitted from each embodiment. Furthermore, the embodiments are not limited to those shown in embodiments 1 to 4, and various modifications are possible as needed. The procedures described using flowcharts, etc., can be modified as appropriate.

[0099] 11 Processor, 12 Storage device, 18 Processing circuit, 20 Target system, 21 Access log, 90 Information processing system, 100 Information processing device, 110 Log collection unit, 120 Risk value calculation unit, 121 High-risk user information, 130 Decoy theme estimation unit, 131 Decoy theme information, 140 Decoy placement unit, 141 Decoy file information, 150 Decoy monitoring unit, 151 Decoy file access information, 160 Decoy content generation unit, 180 Access log DB, 190 Decoy file DB, 191 Decoy file, 200 Template file DB.

Claims

1. a decoy theme estimation unit that estimates a decoy theme, which is a theme of information that a high-risk user is attempting to leak to the outside, based on an access log indicating access to the target system by the high-risk user who is a user of the target system; a decoy placement unit that places a decoy file that matches the estimated decoy theme in the target system; An information processing device comprising:

2. The information processing device further includes: a risk value calculation unit that calculates a risk value corresponding to each user based on an access pattern of each user in the target system in the target system; Equipped with The information processing apparatus according to claim 1 , wherein the high-risk users are users of the target system whose corresponding risk values ​​are equal to or greater than a risk reference value.

3. The information processing apparatus according to claim 2 , wherein the risk value calculation unit increases the risk value corresponding to a target user who is a user of the target system, when the target user accesses the decoy file.

4. The information processing apparatus according to claim 1 , wherein the decoy placement unit selects, as the decoy file, a file from a database that stores files that are candidates for the decoy file based on the estimated decoy theme.

5. The decoy theme estimation unit estimates the decoy theme using at least one of natural language processing and a theme list including a plurality of themes each of which is a candidate for the decoy theme; The information processing apparatus according to claim 4 , wherein the decoy placement unit selects the decoy file from the database using at least one of natural language processing and the theme list.

6. The information processing device further includes: a decoy content generation unit that selects a file as the decoy file from a database that stores files that are candidates for the decoy file based on the estimated decoy theme, and generates a file name for the decoy file based on the estimated decoy theme; Equipped with The information processing apparatus according to claim 1 , wherein the decoy arrangement unit sets the selected file as the decoy file and sets the file name of the decoy file as the generated file name.

7. The information processing device further includes: a decoy content generating unit for generating a file based on the estimated decoy theme as the decoy file; Equipped with The information processing apparatus according to claim 1 , wherein the decoy arrangement unit sets the generated file as the decoy file.

8. The information processing device further includes: A decoy content generating unit that selects a template file from a database storing candidates of template files corresponding to the decoy file based on the estimated decoy theme, and modifies the selected template file based on the estimated decoy theme. Equipped with The information processing apparatus according to claim 1 , wherein the decoy arrangement unit sets a modified template file as the decoy file.

9. The information processing device according to claim 1 , wherein the decoy theme estimation unit estimates the decoy theme based on a viewing time of each file stored in the target system by the high-risk user.

10. The computer estimates a decoy theme, which is a theme of information that a high-risk user is attempting to leak to the outside, based on an access log indicating access to the target system by the high-risk user who is a user of the target system; An information processing method in which the computer places a decoy file that matches an estimated decoy theme on the target system.

11. a decoy theme estimation process for estimating a decoy theme, which is a theme of information that a high-risk user is about to leak to the outside, based on an access log indicating access to the target system by the high-risk user who is a user of the target system; A decoy placement process for placing a decoy file that matches the estimated decoy theme in the target system; An information processing program that causes an information processing device, which is a computer, to execute the above.