Information processing device, information processing method, and information processing program

Abstract

An information processing device (100) is characterized by comprising: an extraction unit (153) that, upon receiving a message regarding an alert, extracts a question item related to the message from a storage unit; a generation unit (154) that, on the basis of the question item, generates a hypothesis regarding whether or not a factor to the message is a security incident, and generates a response sentence to collect information regarding the hypothesis from a user; an assessment unit (155) that receives an answer sentence for the response sentence and assesses whether or not the answer sentence is reliable; and a determination unit (information processing unit (156)) that, in the case where the answer sentence is reliable, determines, on the basis of the answer sentence, whether or not to transmit the message to a prescribed terminal device.

Description

Information processing device, information processing method, and information processing program

[0001] The present invention relates to an information processing device, an information processing method, and an information processing program.

[0002] Early detection of security incidents and appropriate response are extremely important. Part of this is "detecting" abnormal events, which includes antivirus software, security anomaly detection devices, and inquiries from related parties.

[0003] Detected information (alerts) are sent to the CSIRT (Computer Security Incident Response Team) for triage, which involves assessing the importance and impact of the alert, determining whether a response is necessary, and prioritizing when multiple security incidents are occurring simultaneously.

[0004] Figure 19 is a diagram for explaining the general flow of triage. As shown in Figure 19, the scope of triage begins when CSIRT 11 receives an alert (including contact) from a specialist / stakeholder 10, including the detection of a system anomaly, and ends when CSIRT 11 determines whether it should be treated as a security incident and assesses the impact. There are three important tasks performed by CSIRT 11:

[0005] 1. Content confirmation: CSIRT 11 refers to past cases 5 and confirms the facts from the information obtained. 2. Information collection: If there is insufficient information and it is difficult to make a judgment, CSIRT 11 requests information from the relevant parties and confirms the details. 3. Decision: CSIRT 11 decides whether or not a response is required for the alert and prioritizes the response. If no response is required, CSIRT 11 responds to the parties and relevant parties. On the other hand, if a response is required, CSIRT 11 analyzes the alert.

[0006] As attacks become more diverse and systems become more complex, triage tends to result in an increase in detection events that do not require a response. This can be due to an increase in heuristic signatures used to detect virus variants, or temporary false positives caused by simple operator error. When there are a large number of detection events, triage work may not proceed smoothly, raising concerns that this will worsen the shortage of personnel. To address this concern, there is conventional technology that automates triage work.

[0007] FIG. 20 is a diagram illustrating a conventional technique for automating triage work. As shown in FIG. 20, in the conventional technique, a system 12 is installed between the parties concerned 10 and a CSIRT 11. When the system 12 receives an alert from the parties concerned 10, it references a DB 12a and extracts case information and asset management information. The case information includes response information linked to the alert ID. The asset management information includes information such as the IP (Internet Protocol) address and OS (Operating System) of the terminal used by the parties concerned 10.

[0008] The system 12 determines whether or not an automatic response is possible based on the extracted case information and asset management information. If an automatic response is possible, the system 12 performs the automatic response. On the other hand, if an automatic response is not possible, the system 12 notifies the CSIRT 11 of the alert, and the CSIRT 11 performs the triage work described in FIG. 19 . Note that even if no case information or the like corresponding to the alert ID exists in the DB 12a, the system 12 notifies the CSIRT 11 of the alert and requests triage work.

[0009] International Publication No. 2020 / 240641

[0010] However, with the above-mentioned conventional technology, an appropriate security response may not be possible because the response is not automatically based on the information obtained by examining the content of the alert and collecting information. Furthermore, with the conventional technology, if there is no prior information corresponding to the alert, the CSIRT 11 is requested to perform triage work.

[0011] In other words, conventional technologies have room for improvement in terms of automating triage work, and there is a demand for improved security responses when alerts occur.

[0012] The present invention has been made in view of the above, and has an object to provide an information processing device, an information processing method, and an information processing program that can improve security measures when an alert occurs.

[0013] In order to solve the above-mentioned problems and achieve the objectives, the information processing device is characterized by having an extraction unit that, when it receives a message regarding an alert, extracts question items related to the message from a memory unit; a generation unit that generates a hypothesis regarding whether the cause of the message is a security incident based on the question items and generates a response message to collect information regarding the hypothesis from the user; an evaluation unit that receives a response message to the response message and evaluates whether the response message is credible; and an information processing unit that, if the response message is credible, determines whether or not to send the message to a specified terminal device based on the response message.

[0014] According to the present invention, it is possible to improve security measures when an alert occurs.

[0015] FIG. 1 is a diagram illustrating an example of the configuration of an information processing system. FIG. 2 is a flowchart illustrating the processing procedure of the information processing system. FIG. 3 is a diagram illustrating processing by an information processing device. FIG. 4 is a diagram illustrating an example of the data structure of a table. FIG. 5 is a diagram illustrating an example of a hypothesis prompt. FIG. 6 is a diagram illustrating an example of hypothesis information. FIG. 7 is a diagram illustrating an example of a response message prompt. FIG. 8 is a diagram illustrating an example of a response message. FIG. 9 is a diagram illustrating an example of a re-generated response message. FIG. 10 is a diagram illustrating an example of a credibility prompt. FIG. 11 is a flowchart illustrating the processing procedure of an information processing unit. FIG. 12 is a functional block diagram illustrating the configuration of an information processing device. FIG. 13 is a diagram illustrating an example of a correction prompt. FIG. 14 is a flowchart illustrating the processing procedure of an information processing device. FIG. 15 is a flowchart illustrating the processing procedure of a generation unit and an evaluation unit (1). FIG. 16 is a flowchart illustrating the processing procedure of the generation unit and the evaluation unit (2). FIG. 17 is a flowchart illustrating the processing procedure of a feedback unit. FIG. 18 is a diagram illustrating an example of a computer that executes an information processing program. FIG. 19 is a diagram illustrating a general flow of triage. FIG. 20 is a diagram illustrating a conventional technique for automating triage work.

[0016] Hereinafter, an information processing apparatus, an information processing method, and an information processing program disclosed in the present application will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to these embodiments.

[0017] (Embodiment) (Information Processing System) An example of an information processing system according to an embodiment will be described below. Fig. 1 is a diagram showing an example of the configuration of an information processing system.

[0018] 1, the information processing system 1 includes a monitoring terminal 20, user terminals 21a and 21b, a CSIRT terminal 22, a large-scale language model server 40, a ticket system server 50, and an information processing device 100. While user terminals 21a and 21b are shown in Fig. 1, other user terminals may also be included.

[0019] The monitoring terminal 20 , user terminals 21 a and 21 b , CSIRT terminal 22 , large-scale language model server 40 , ticket system server 50 , and information processing device 100 are each connected to a network 30 .

[0020] The monitoring terminal 20 monitors the user terminals 21 a and 21 b. When the monitoring terminal 20 detects an abnormality in either of the user terminals 21 a and 21 b, it transmits a “message” to the information processing device. For example, the message includes an alert ID (identifier), the contents of the alert, and the like.

[0021] The user terminals 21a and 21b are terminals used by users. For example, the user terminals 21a and 21b may have antivirus software installed, and if the antivirus software detects an abnormality in the user terminals, it may send a message to the information processing device 100. In the following description, the user terminals 21a and 21b will be collectively referred to as "user terminal 21."

[0022] The CSIRT terminal 22 is a terminal used by a CSIRT staff member. In the following description, the CSIRT staff member will be referred to simply as the "staff member." When the CSIRT terminal 22 receives an inference result from the information processing device 100 for a message, it displays the inference result. The staff member refers to the inference result and operates the CSIRT terminal 22 to provide feedback to the information processing device 100.

[0023] The large-scale language model server 40 has a large-scale language model (LLM), and when it receives a prompt from the information processing device 100, it inputs the prompt into the large-scale language model to generate information. The large-scale language model server 40 transmits the generated information to the information processing device 100.

[0024] The large-scale language model held by the large-scale language model server 40 is a large-scale deep learning language model that has been trained in advance on a huge amount of data. Various models have been proposed as large-scale language models, including GPT (OpenAI), Bard (Google), and Llama2 (Meta).

[0025] Large-scale language models are based on a mechanism called a transformer (specifically, only the decoder section is used). Transformers are a technology for understanding context by identifying how words and phrases in a sentence are related. Their basic operation involves inputting text (a prompt) and passing it through the transformer to output appropriate text. After the initial question is input, the LLM predicts the next character (strictly speaking, a token) from the input sentence, adds that character to the end of the prompt, and then predicts the next character. The output is the result of this process, until a termination condition is reached. Therefore, the way the input text questions and instructions are presented is extremely important, and careful consideration can lead to more appropriate answers from the LLM. These LLM capabilities are utilized for predicting the rest of the sentence, as well as for text summarization, translation, question answering, and text search.

[0026] The ticket system server 50 manages, as tickets, information related to messages issued from the monitoring terminal 20 and the user terminal 21 while communicating with the information processing device 100. For example, the ticket system server 50 manages tickets by linking them with past cases related to the tickets, the results of the impact of the messages, and the like.

[0027] When the information processing device 100 receives a message from the monitoring terminal 20 or the user terminal 21, it automatically performs triage work, determines whether the message is a security incident, and estimates the impact of the message.

[0028] For example, the information processing device 100 has a question item DB 141, a response history DB 142, and a prompt DB 143. The question item DB 141 stores question items related to alerts. The response history DB 142 stores a history of information related to responses sent by the information processing device 100 to the user terminal 21 and responses received from the user terminal 21. The prompt DB 143 stores standard phrases for various prompts.

[0029] Next, an example of the processing procedure of the information processing system 1 will be described. Fig. 2 is a flowchart showing the processing procedure of the information processing system. Fig. 2 describes a case where the user terminal 21 detects an abnormality and transmits a message to the information processing device 100, but the monitoring terminal 20 may also detect an abnormality in the user terminal 21 and transmit a message to the information processing device 100.

[0030] 2, when the user terminal 21 detects an abnormality, it transmits a message to the information processing device 100 (step S10). The information processing device 100 receives the message from the user terminal 21 (step S11).

[0031] The information processing device 100 communicates with the ticket system server 50 and manages the ticket (step S12). The information processing device 100 extracts information from the question item DB 141 based on the message.

[0032] The information processing device 100 extracts information from the question item DB 141 based on the message (step S13). For example, the information extracted by the information processing device 100 in step S13 is information to be collected from users (parties or interested parties) regarding the message (alert).

[0033] The information processing device 100 communicates with the large-scale language model server 40 and generates a response message for collecting information (step S14). The information processing device 100 transmits the response message to the user terminal 21 (step S15).

[0034] The user terminal 21 receives the response message from the information processing device 100 (step S16). The user terminal 21 accepts the input of a reply message from the user and transmits the reply message to the information processing device 100 (step S17).

[0035] The information processing device 100 receives the answer sentence from the user terminal 21 and evaluates the answer sentence (step S18). The information processing device 100 updates the question items based on the evaluation result of the answer sentence (step S19).

[0036] If the information processing device 100 decides to end the call (Yes at step S20), the process proceeds to step S21. On the other hand, if the information processing device 100 decides not to end the call (No at step S20), the process proceeds to step S14 again.

[0037] The process proceeding to step S21 will be described. The information processing device 100 determines whether a security incident has occurred and estimates the impact (step S21). The information processing device 100 transmits the determination result of the security incident to the user terminal 21 (step S22). The user terminal 21 receives the determination result (step S23).

[0038] If the degree of impact is not equal to or greater than the threshold (step S24, No), the information processing device 100 ends the process. On the other hand, if the degree of impact is equal to or greater than the threshold (step S24, Yes), the information processing device 100 transmits a response to the CSIRT terminal 22 (step S25). The CSIRT terminal 22 receives the response (step S26).

[0039] (Processing of Information Processing Device) Next, the processing of the information processing device 100 shown in Fig. 1 will be described in more detail. Fig. 3 is a diagram for explaining the processing of the information processing device. For example, the information processing device 100 has an extraction unit 153, a generation unit 154, an evaluation unit 155, and an information processing unit 156. In the explanation of Fig. 3, a case will be described in which the information processing device 100 acquires a message from the user terminal 21, but the information processing device 100 may also acquire a message from the monitoring terminal 20.

[0040] When the extraction unit 153 acquires a message from the user terminal 21, it extracts question items related to the message (alert) from the question item DB 141 and sets the question items in the table 153a. The extraction unit 153 extracts question items corresponding to the message using a rule base. The extraction unit 153 may communicate with the large-scale language model server 40 and estimate question items corresponding to the message using a large-scale language model. The extraction unit 153 outputs the table 153a to the generation unit 154.

[0041] FIG. 4 is a diagram showing an example of the data structure of a table. As shown in FIG. 4, table 153a has question items and common management information items. The question items shown in FIG. 4 are set to correspond to the messages of alert emails. For example, the question items corresponding to the messages of alert emails include "Did you click on the URL in question (true or false)?", "Did you perform a virus scan (true or false)?", and "Virus scan results (true or false)." Columns 60-1, 60-2, and 60-3 corresponding to the question items are set to "true" or "false" by processing by the evaluation unit 155, which will be described later. Note that natural language sentences other than "true" or "false" may also be set in columns 60-1, 60-2, and 60-3. For example, the natural language sentence may be "unknown."

[0042] The number of responses, emotion, and setting information are set in the common management information items of the table 153a. The common management information items are set in the table in advance, regardless of the message. The number of responses from the user terminal 21 is set in the column 60-4 corresponding to the number of responses by the evaluation unit 155. The initial value of the number of responses is set to "0." The emotion of the user is set in the column 60-5 corresponding to the emotion by the evaluation unit 155. For example, "unpleasant" or "not unpleasant" is set as the user's emotion. Various setting information (such as information to be added to the prompt) is set in advance in the setting information 60-6.

[0043] When the extraction unit 153 receives a re-extraction request from the evaluation unit 155 (described later), the extraction unit 153 executes the above process again to extract new question items. The extraction unit 153 sets the new question items in a table and outputs the table to the generation unit 154.

[0044] Returning to the explanation of Fig. 3, the generation unit 154 acquires the table 153a from the extraction unit 153, and executes a hypothesis generation process and a response sentence generation process.

[0045] First, a description will be given of the hypothesis generation process executed by the generation unit 154. The generation unit 154 performs the following process to generate "hypothesis A" that the message received by the information processing device 100 is caused by a security incident and "hypothesis B" that the message is not caused by a security incident. Note that the generation unit 154 may generate two or more hypotheses.

[0046] The generation unit 154 acquires, from the prompt DB 143, a prepared prompt that instructs the large-scale language model to generate hypotheses A and B. The generation unit 154 generates a prompt (hereinafter referred to as a hypothesis prompt) by adding information about the table 153 a and the message to the acquired prompt.

[0047] Fig. 5 is a diagram showing an example of a hypothesis prompt. In the example shown in Fig. 5, the hypothesis prompt 154a includes areas 61-1, 61-2, 61-3, and 61-4. The content of the alert message included in the message is set in area 61-1. The information in areas 61-2 and 61-4 is information that is set in advance in the hypothesis prompt 154a. The information in table 153a is set in area 61-3.

[0048] The generation unit 154 transmits the hypothesis prompt 154a to the large-scale language model server 40. The large-scale language model server 40 generates hypothesis information by inputting the hypothesis prompt 154a into the large-scale language model, and transmits the hypothesis information to the generation unit 154 of the information processing device 100. The generation unit 154 receives the hypothesis information.

[0049] Fig. 6 is a diagram showing an example of hypothesis information. In the example shown in Fig. 6, hypothesis information 70 includes information on hypothesis A and information on hypothesis B. The generation unit 154 outputs the hypothesis information to the information processing unit 156, which will be described later.

[0050] The information regarding hypothesis A is 1 to 3 below. 1. The user clicked on the URL (Yes). 2. A virus scan was performed (Yes). 3. An anomaly was detected in the virus scan results (number of detections: 1 or more).

[0051] The information regarding hypothesis B is 1 to 3 below. 1. The user did not click on the URL in question (X) 2. A virus scan was performed (O) 3. No abnormalities were detected in the virus scan results (Number of detections: 0)

[0052] Next, a description will be given of the response sentence generation process executed by the generation unit 154. The generation unit 154 acquires a prepared prompt, which is used to instruct the large-scale language model to generate a response sentence, from the prompt DB 143. The generation unit 154 generates a prompt (hereinafter referred to as a response sentence prompt) by adding hypothesis information 70 to the acquired prompt.

[0053] Fig. 7 is a diagram showing an example of a response message prompt. In the example shown in Fig. 7, the response message prompt 154b includes areas 62-1, 62-2, 62-3, and 62-4. The information in the areas 62-1 and 62-3 is information that is set in advance in the response message prompt. The information of hypothesis B in the hypothesis information 70 is set in the area 62-2. The information of hypothesis B in the hypothesis information 70 is set in the area 62-4.

[0054] The generation unit 154 transmits the response sentence prompt 154b to the large-scale language model server 40. The large-scale language model server 40 generates a response sentence (information on the response sentence) by inputting the response sentence prompt 154b into the large-scale language model, and transmits the response sentence to the generation unit 154 of the information processing device 100. The generation unit 154 receives the response sentence.

[0055] 8 is a diagram showing an example of a message. As shown in FIG. 8, the message includes a plurality of questions. For example, question 1 is, "Could you please tell me whether the URL listed in the received alert email was accessed and what the access results were?" Other questions are not shown in the figures.

[0056] The generation unit 154 transmits the response message 75 to the user terminal 21. After transmitting the response message 75 to the user terminal 21, if the generation unit 154 receives a "regeneration request" for the response message from the user terminal 21, the generation unit 154 executes the following process.

[0057] The generation unit 154 adds an instruction to the response sentence prompt 154b to update the response sentence prompt 154b. For example, the generation unit 154 adds a preset instruction to the response sentence prompt 154b, such as "Please reduce technical terms," ​​"Please change the language," or "Please provide a manual." The generation unit 154 may also associate the attributes of the user of the user terminal 21 with the instructions in advance, select an instruction from the association, and add it to the response sentence prompt 154b.

[0058] The generation unit 154 regenerates the response sentence by sending the response sentence prompt 154b with the added instruction to the large-scale language model server 40 and receiving the response sentence again. The generation unit 154 sends the regenerated response sentence to the user terminal 21.

[0059] 9 is a diagram showing an example of a regenerated response message. The regenerated response message 75a shown in FIG. 9 has a specific URL added to area 75a-1, making it easier for the user to generate a response message compared to the response message shown in FIG. 8.

[0060] The generation unit 154 repeatedly executes the above process each time it receives a request to regenerate a message from the user terminal 21 .

[0061] The generation unit 154 registers the history of the responses (responses, regenerated responses, response prompts, etc.) in the response history DB 142. The generation unit 154 outputs the table 153a to the evaluation unit 155.

[0062] Returning to the explanation of Fig. 3, when the evaluation unit 155 receives a response message (information that serves as a response to the response message) from the user terminal 21, the evaluation unit 155 registers the response message in the response history DB 142 in association with the response message.

[0063] When a confidentiality request is set in the answer message, the evaluation unit 155 imposes access control on the answer message. Users who can access the answer message may be set in advance, or users who can access the answer message may be dynamically changed according to the attributes of the users.

[0064] The evaluation unit 155 evaluates whether the answer sentence is credible by performing the following process: The evaluation unit 155 acquires, from the prompt DB 143, a prepared prompt that requests a large-scale language model to evaluate the credibility of the answer sentence. The evaluation unit 155 generates a prompt (hereinafter referred to as a credibility prompt) by adding information about the answer sentence to the acquired prompt.

[0065] 10 is a diagram showing an example of a credibility prompt. In the example shown in FIG. 10, the credibility prompt 155a includes areas 63-1 and 63-2. The information in area 63-1 is information that is set in advance in the credibility prompt 155a. The information of the answer sentence is set in area 63-2.

[0066] The evaluation unit 155 transmits the credibility prompt 155a to the large-scale language model server 40. The large-scale language model server 40 generates "credibility information" by inputting the credibility prompt 155a into the large-scale language model. For example, the credibility information generated by the credibility prompt 155a shown in FIG. 10 includes one of the pieces of information (1), (2), and (3).

[0067] Information (1): Information of the response message requesting the user to explain again. Information (2): Information of the email message requesting the submission of a summary and evidence. Information (3): Information of the thank-you message.

[0068] For example, if the answer sentence set in the credibility prompt 155a is not related to the hypothesis, the credibility information is set to information (1). If the answer sentence set in the credibility prompt 155a is not credible, the credibility information includes information (2). If the answer sentence set in the credibility prompt 155a is related to the hypothesis and is credible, the credibility information includes information (3).

[0069] The large-scale language model server 40 transmits the credibility information generated by the large-scale language model to the evaluation unit 155 of the information processing device 100 .

[0070] The evaluation unit 155 receives the credibility information, and if the credibility information includes information (1), it transmits the response text included in information (1) to the user terminal 21. Furthermore, the evaluation unit 155 receives the credibility information, and if the credibility information includes information (2), it transmits the email text included in information (2) to the user terminal 21.

[0071] After sending a response message, the evaluation unit 155 receives a response message to the response message from the user terminal 21, generates a credibility prompt based on the response message, sends the credibility prompt to the large-scale language model server 40, and receives credibility information from the large-scale language model server 40. This process is repeated until an "end condition" is satisfied. During the process, the evaluation unit 155 counts the number of times a response message has been sent to the user terminal 21 (hereinafter referred to as the number of responses). The evaluation unit 155 associates the response message sent to the user terminal 21 with the response message to this response message and registers them in the response history DB 142.

[0072] For example, the evaluation unit 155 determines that the "termination condition is satisfied" when the number of responses is equal to or less than a predetermined number and the reply text is credible. Note that the evaluation unit 155 evaluates the reply text as "credible" when the credibility information includes information on the email text or information on the thank-you message.

[0073] If the number of responses exceeds a predetermined number, but the reliability of the answer sentence is low, the evaluation unit 155 determines that the "termination condition is not satisfied" and outputs a "re-extraction request" to the extraction unit 153 to request extraction of question items again. In this case, the information processing device 100 starts the process over again from the extraction unit 153 described above.

[0074] On the other hand, if the evaluation unit 155 determines that the "termination condition is satisfied," it executes the following process to update the table 153a. The evaluation unit 155 sets "◯" or "X" in the question item columns 60-1 to 60-3 of the table 153a based on the answer sentences (for example, credible answer sentences) registered in the response history DB 142.

[0075] For example, if the reply message contains information indicating that the URL has been clicked, the evaluation unit 155 sets "◯" in the column 60-1. On the other hand, if the reply message contains information indicating that the URL has not been clicked, the evaluation unit 155 sets "×" in the column 60-1.

[0076] The evaluation unit 155 sets "◯" in the column 60-2 when the reply message contains information that a virus scan has been performed. On the other hand, the evaluation unit 155 sets "×" in the column 60-2 when the reply message contains information that a virus scan has not been performed.

[0077] The evaluation unit 155 sets "◯" in the column 60-3 when the reply message contains information indicating that the result of the virus scan indicates that the message is not infected with a virus. On the other hand, the evaluation unit 155 sets "×" in the column 60-3 when the reply message contains information indicating that the result of the virus scan indicates that the message is infected with a virus.

[0078] The evaluation unit 155 enters the counted number of responses in the column 60-4 of the table 153a.

[0079] The evaluation unit 155 estimates the user's emotion based on reply sentences (for example, credible reply sentences) registered in the response history DB 142. The evaluation unit 155 may estimate the user's emotion in any way, but if a reply sentence contains a keyword associated with a preset unpleasant emotion a predetermined number of times or more, the evaluation unit 155 determines the user's emotion as "unpleasant" and sets this in column 60-5 of table 153a. On the other hand, if a reply sentence does not contain a keyword associated with a preset unpleasant emotion a predetermined number of times or more, the evaluation unit 155 determines the user's emotion as "not unpleasant" and sets this in column 60-5 of table 153a.

[0080] The evaluation unit 155 updates the table 153a by executing the above process, and outputs the updated table 153a to the information processing unit 156. The evaluation unit 155 may also register a history of data updates to the table 153a in the response history DB 142.

[0081] The information processing unit 156 executes the following processing to determine whether a message corresponds to a security incident, and if so, estimates the impact of the message. The information processing unit 156 acquires the updated table 153a from the evaluation unit 155. The information processing unit 156 acquires hypothesis information from the generation unit 154. The information processing unit 156 acquires past case information (impact estimation results) linked to tickets similar to the message from the ticket system server 50. The information processing unit 156 corresponds to the determination unit.

[0082] For example, the information processing unit 156 uses a pre-trained AI (Artificial Intelligence) to determine whether a message corresponds to a security incident and estimate the impact of the message in three levels (high, medium, low). The inputs of this AI are "table 153a," "hypothesis information," and "past case information," and the outputs are "information on whether a message corresponds to a security incident" and "impact of the message." Note that the information processing unit 156 may use an AI dedicated to determining whether a message corresponds to a security incident and an AI dedicated to estimating the impact of the message, respectively.

[0083] The information processing unit 156 may determine whether a message corresponds to a security incident by sending a prompt to the large-scale language model server 40 to request a determination as to whether the message corresponds to a security incident. Note that the prompt includes "table 153a," "hypothesis information," and "past case information."

[0084] Similarly, the information processing unit 156 may estimate the impact of a message by sending a prompt requesting estimation of the impact of the message to the large-scale language model server 40. Note that the prompt includes "table 153a," "hypothesis information," and "past case information."

[0085] The information processing unit 156 makes three types of determinations based on the output result of the AI ​​and preset determination rules. For example, the three types of determinations include "1: No action required, terminate; 2: Action required, hand over to CSIRT; 3: AI action not possible, hand over to CSIRT."

[0086] 11 is a flowchart showing the processing procedure of the information processing unit 156. As shown in FIG. 11, if the message does not correspond to a security incident (step S50, No), the information processing unit 156 proceeds to step S56. On the other hand, if the message corresponds to a security incident (step S50, Yes), the information processing unit 156 proceeds to step S51.

[0087] If the impact level is medium or high (Yes at step S51), the information processing unit 156 determines that "response required, transfer to CSIRT" (step S52).

[0088] On the other hand, if the impact level is not medium or high (No at step S51), the information processing unit 156 proceeds to step S53. If the emotion is "unpleasant" (Yes at step S53), the information processing unit 156 determines that "AI cannot be handled, transfer to CSIRT" (step S55).

[0089] On the other hand, if the emotion set in the table is not "unpleasant" (No at Step S53), the information processing unit 156 proceeds to Step S54. If the number of interactions is equal to or greater than the predetermined number (Yes at Step S54), the information processing unit 156 proceeds to Step S55.

[0090] On the other hand, if the number of responses is less than the predetermined number (No at step S54), the information processing unit 156 determines that "response is no longer required" (step S56).

[0091] The information processing unit 156 makes three types of determinations by performing the processing shown in Fig. 11. If the information processing unit 156 determines that "response not required, terminated," it reports to the CSIRT terminal 22 that no response is required for the message. If the information processing unit 156 determines that "response required, hand over to CSIRT," it reports to the CSIRT terminal 22 that a response is required for the message and performs the handover. If the information processing unit 156 determines that "AI response not possible, hand over to CSIRT," it reports to the CSIRT terminal 22 that AI response to the message is not possible and performs the handover.

[0092] The information processing unit 156 registers the history of the determination result of whether to respond to the security incident, the estimated result of the impact, and the like in the response history DB 142 .

[0093] (Configuration example of information processing device) Next, a configuration example of the information processing device 100 shown in Fig. 1 will be described. Fig. 12 is a functional block diagram showing the configuration of the information processing device. As shown in Fig. 12, the information processing device 100 has a communication control unit 110, an input unit 120, a display unit 130, a storage unit 140, and a control unit 150.

[0094] The communication control unit 110 is realized using a NIC (Network Interface Card) or the like, and controls communication between the control unit 150 and the monitoring terminal 20, user terminal 21, large-scale language model server 40, and ticket system server 50 connected to the network 30.

[0095] The input unit 120 is realized using input devices such as a keyboard, a mouse, etc. A user operates the input unit 120 to input various pieces of information to the control unit 150.

[0096] The display unit 130 is an output device that outputs information acquired from the control unit 150, and is realized by a display device such as a liquid crystal display, a printing device such as a printer, or the like.

[0097] The storage unit 140 includes a question item DB 141, a response history DB 142, and a prompt DB 143. The storage unit 140 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk.

[0098] The question item DB 141 stores question items related to alerts. The rest of the description of the question item DB 141 is the same as that described above.

[0099] The response history DB 142 stores histories such as response messages sent by the information processing device 100 to the user terminal 21, information on response messages received from the user terminal 21, the results of determining whether to respond to a security incident, and the estimated results of the impact. The response history DB 142 also stores inference results of large-scale language models, table status, etc. Other details regarding the response history DB 142 are the same as those described above.

[0100] The prompt DB 143 stores various standard prompt phrases. The rest of the description of the prompt DB 143 is the same as that described above.

[0101] We will now move on to explaining the control unit 150. The control unit 150 has a receiving unit 151, a triage management unit 152, an extraction unit 153, a generation unit 154, an evaluation unit 155, an information processing unit 156, and a feedback unit 157. The control unit 150 is a processor such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit).

[0102] The receiving unit 151 receives a message from the monitoring terminal 20 or the user terminal 21. The receiving unit 151 outputs the received message to the triage management unit 152 and the extraction unit 153.

[0103] The triage management unit 152 communicates with the ticket system server 50 and manages tickets. For example, when the triage management unit 152 receives a message, it transmits information about the message to the ticket system server 50 and requests the issuance of a ticket. For example, when the ticket system server 50 receives a request to issue a ticket, it assigns an identification number or the like to the ticket, associates it with the ticket, and manages information about the message, an estimated result of the impact level related to the message, and the like.

[0104] When the extraction unit 153 acquires a message, it extracts question items related to the message (alert) from the question item DB 141 and sets the question items in the table 153 a. Other details regarding the extraction unit 153 are the same as those described with reference to FIG. 3.

[0105] The generation unit 154 acquires the table 153a, generates a response message by executing a hypothesis generation process and a response message generation process, and transmits the generated response message to the user terminal 21. The explanation of the hypothesis generation process and the response message generation process executed by the generation unit 154 is the same as the content explained using FIG.

[0106] The evaluation unit 155 receives a response message to the response message from the user terminal 21, evaluates the response message, and updates the table 153a based on the evaluation result. The evaluation unit 155 outputs the updated table 153a to the information processing unit 156. Other details regarding the evaluation unit 155 are the same as those described with reference to FIG. 3.

[0107] The information processing unit 156 determines whether the message corresponds to a security incident based on the updated table 153a, etc., and if it does correspond to a security incident, estimates the impact of the message. The information processing unit 156 executes the processing as described in Fig. 11 and reports the execution results to the user terminal 21 and the CSIRT terminal 22. Other processing related to the information processing unit 156 is the same as that described using Figs. 3 and 11.

[0108] The feedback unit 157 retrieves data registered in the response history DB 142 (such as response text, text logs of response text, inference results of large-scale language models, table status, and estimation results of discrimination and impact) and estimates the user's emotions, discomfort level, and situation. This makes it possible to determine whether the triage response flow was carried out smoothly and whether the user experience was good. The feedback unit 157 reports the estimation results to the CSIRT terminal 22 according to a pre-prepared evaluation rule base and accepts text feedback. Note that the feedback unit 157 may also report the estimation results to the CSIRT terminal 22 without using the evaluation rule base.

[0109] When the feedback unit 157 receives feedback in the form of text, it sends a prepared prompt with the text set therein (hereinafter referred to as a correction prompt) to the large-scale language model server 40, and corrects the process of the large-scale language model when estimating question items.

[0110] 13 is a diagram showing an example of a correction prompt. As shown in FIG. 13, the content of the text for which feedback has been received is set in an area 64-1 of the correction prompt 157a. The content of the question item generated by the large-scale language model that has received the input of the correction prompt 157a is improved.

[0111] (Processing Procedure of Information Processing Device) Next, an example of the processing procedure of the information processing device 100 will be described. Fig. 14 is a flowchart showing the processing procedure of the information processing device. As shown in Fig. 14, the receiving unit 151 of the information processing device 100 receives a message (step S101).

[0112] The triage management unit 152 of the information processing device 100 communicates with the ticket system server 50 and performs initialization settings for the ticket (step S102). The extraction unit 153 of the information processing device 100 extracts question items related to the message and sets them in a table (step S103).

[0113] The generation unit 154 of the information processing device 100 executes a hypothesis generation process (step S104). The generation unit 154 executes a response sentence generation process (step S105). The evaluation unit 155 of the information processing device 100 executes an evaluation process (step S106).

[0114] The information processing unit 156 of the information processing device 100 executes information processing (step S107), and the feedback unit 157 of the information processing device 100 executes feedback processing (step S108).

[0115] Here, the processes (hypothesis generation process, response sentence generation process, and evaluation process) executed by the generation unit 154 and the evaluation unit 155 shown in steps S104 to S106 in Fig. 14 will be described in more detail. Fig. 15 and Fig. 16 are flowcharts showing the processing procedures of the generation unit and the evaluation unit.

[0116] 15 will be described. As shown in Fig. 15, the generation unit 154 of the information processing device 100 receives a ticket from the ticket system server 50 (step S61). The generation unit 154 generates a hypothesis prompt and transmits the hypothesis prompt to the large-scale language model server 40 (step S62).

[0117] The generation unit 154 receives hypothesis information from the large-scale language model server 40 (step S63). The generation unit 154 generates a response sentence prompt and transmits the response sentence prompt to the large-scale language model server 40 (step S64).

[0118] The generation unit 154 receives the response message from the large-scale language model server 40 (step S65). The generation unit 154 transmits the response message to the user terminal 21 (step S66).

[0119] If the generation unit 154 has received a regeneration request (Yes at Step S67), the process proceeds to Step S64. On the other hand, if the generation unit 154 has not received a regeneration request (No at Step S67), the generation unit 154 receives a response sentence from the user terminal 21 (Step S68), and the process proceeds to Step S69 in FIG. 16 .

[0120] 16. If the confidentiality setting is not set (step S69, No), the evaluation unit 155 of the information processing device 100 proceeds to step S71. On the other hand, if the confidentiality setting is set (step S69, Yes), the evaluation unit 155 sets access control for the answer sentence (step S70).

[0121] The evaluation unit 155 generates a credibility prompt and sends the credibility prompt to the large-scale language model server 40 (step S71). The evaluation unit 155 receives credibility information from the large-scale language model server 40 (step S72).

[0122] If confirmation is not required (step S73, No), the evaluation unit 155 proceeds to step S75. On the other hand, if confirmation is required (step S73, Yes), the evaluation unit 155 transmits a response message for confirmation to the user terminal 21 and receives the response message (step S74).

[0123] If the termination condition is not satisfied (No at Step S75), the evaluation unit 155 proceeds to Step S62 in Fig. 15. On the other hand, if the termination condition is satisfied (Yes at Step S75), the evaluation unit 155 determines whether the security incident has occurred and estimates the impact (Step S76).

[0124] The evaluation unit 155 outputs the results of the security incident determination and impact estimation to the information processing unit 156 (step S77), and ends the process.

[0125] The specific processing procedure of the information processing shown in step S107 of FIG. 14 is the same as the processing procedure described with reference to FIG.

[0126] Next, an example of the processing procedure of the feedback processing shown in step S108 of FIG. 14 will be described.

[0127] 17 is a flowchart showing the processing steps of the feedback unit 157. As shown in FIG. 17, the feedback unit 157 acquires data from the response history DB 142 (step S81). The feedback unit 157 analyzes the data and estimates the user's emotions, discomfort level, and situation (step S82).

[0128] The feedback unit 157 transmits the estimation result to the CSIRT terminal 22 (step S83). The feedback unit 157 receives text feedback from the CSIRT terminal 22 (step S84).

[0129] The feedback unit 157 generates a correction prompt 157a (step S85), and transmits the correction prompt 157a to the large-scale language model server 40 (step S86).

[0130] The feedback unit 157 receives the correction result from the large-scale language model server 40 (step S87). The feedback unit 157 registers the correction history in the response history DB (step S88).

[0131] (Effects of Information Processing Device) The information processing device 100 according to this embodiment can improve security responses when an alert occurs. For example, the triage process that is currently performed manually by a CSIRT can be automated, allowing for faster triage compared to conventional manual work, and by establishing a division of labor in which low-impact issues are self-contained and high-impact issues are handed over to the CSIRT, allowing for efficient processing.

[0132] When the evaluation unit 155 of the information processing device 100 according to this embodiment receives a response message (information that serves as a response to the response message) from the user terminal 21, it registers the response message in the response history DB 142 in association with the response message. In this case, if a confidentiality request is set in the response message, the evaluation unit 155 imposes access control on the response message. This improves the protection of privacy and confidential information by restricting information disclosure to users other than those designated by the security officer. This is a new approach in the security field, and can also reduce the risk of confidential information leaks.

[0133] The evaluation unit 155 of the information processing device 100 according to this embodiment estimates the user's emotions based on reply sentences (for example, credible reply sentences) registered in the response history DB 142. For example, the function of the information processing device 100 to contact the CSIRT terminal 22 or the like when it estimates that the user will continue to feel uncomfortable with the automated response by the system can contribute to improving the user experience in order to speed up triage.

[0134] The feedback unit 157 of the information processing device 100 according to this embodiment retrieves data registered in the response history DB 142, estimates the user's emotions, discomfort level, and situation, and reports the estimation results to the CSIRT terminal 22. When the feedback unit 157 receives text feedback, it sends a correction prompt to the large-scale language model server 40 and corrects the process used by the large-scale language model to estimate question items. This enables the system to learn and evolve. Based on past response logs and estimation results, the system improves to make more appropriate decisions, reducing the burden of maintaining and managing quality.

[0135] (Other Configuration Examples) In the above-described embodiment, the information processing device 100, the large-scale language model server 40, and the ticket system server 50 are described as separate servers, but this is not limiting. For example, the information processing device 100, the large-scale language model server 40, and the ticket system server 50 may be configured as a single server.

[0136] (Information Processing Program) Next, an example of a computer that executes an information processing program will be described. Fig. 18 is a diagram showing an example of a computer that executes an information processing program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0137] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, for example. The video adapter 1060 is connected to a display 1061, for example.

[0138] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. The various pieces of information described in the above embodiments are stored in the hard disk drive 1031 or memory 1010, for example.

[0139] The information processing program is stored in the hard disk drive 1031 as a program module 1093 in which instructions to be executed by the computer 1000 are written. Specifically, the hard disk drive 1031 stores the program module 1093 in which the processes for executing the receiving unit 151, triage management unit 152, extraction unit 153, generation unit 154, evaluation unit 155, information processing unit 156, and feedback unit 157 described in the above embodiment are written.

[0140] Furthermore, data used for information processing by the information processing program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-described procedures.

[0141] Note that the program module 1093 and program data 1094 related to the information program are not limited to being stored in the hard disk drive 1031, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1041. Alternatively, the program module 1093 and program data 1094 related to the information processing program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0142] Although the present invention has been described above as an embodiment, the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0143] REFERENCE SIGNS LIST 100 Information processing device 110 Communication control unit 120 Input unit 130 Display unit 140 Storage unit 141 Question item DB 142 Response history DB 143 Prompt DB 150 Control unit 151 Receiving unit 152 Triage management unit 153 Extraction unit 154 Generation unit 155 Evaluation unit 156 Information processing unit 157 Feedback unit

Claims

1. An information processing device characterized by having: an extraction unit that, when receiving a message regarding an alert, extracts question items related to the message from a memory unit; a generation unit that generates a hypothesis regarding whether the cause of the message is a security incident based on the question items and generates a response message to collect information regarding the hypothesis from the user; an evaluation unit that receives a response message to the response message and evaluates the credibility of the response message; and a judgment unit that, if the response message is credible, determines whether to send the message to a specified terminal device based on the response message.

2. The information processing device described in claim 1, characterized in that the generation unit generates the hypothesis by inputting an instruction to formulate a hypothesis regarding whether the cause of the message is a security incident, and a hypothesis prompt that sets the question item and the message, into a large-scale language model.

3. The information processing device described in claim 2, characterized in that the generation unit generates the response sentence by inputting a response sentence prompt into the large-scale language model, the response sentence prompt including the hypothesis and an instruction to generate a response sentence for collecting information about the hypothesis from the user.

4. The information processing device described in claim 1, characterized in that the evaluation unit evaluates the credibility of the answer sentence by inputting the answer sentence and a credibility prompt that instructs the evaluation of the credibility of the answer sentence into a large-scale language model.

5. The information processing device described in claim 1, characterized in that the judgment unit determines whether the message corresponds to the security incident based on the credible response sentence and the hypothesis, and if it corresponds to the security incident, determines to send the message to a specified terminal device.

6. The information processing device described in claim 1, characterized in that the judgment unit judges the impact of the message based on the credible response sentence and the hypothesis, and if the impact is greater than or equal to a predetermined value, judges to send the message to a predetermined terminal device.

7. An information processing method comprising the steps of, when receiving a message regarding an alert, extracting questions related to the message from a memory unit; generating a hypothesis based on the questions as to whether the cause of the message is a security incident or not, and generating a response message for collecting information on the hypothesis from the user; receiving a response message to the response message and evaluating the credibility of the response message; and, if the response message is credible, determining based on the response message whether to send the message to a specified terminal device.

8. An information processing program that causes a computer to execute the following steps when a message regarding an alert is received: extracting questions related to the message from a memory unit; generating a hypothesis based on the questions as to whether the cause of the message is a security incident or not, and generating a response message to collect information about the hypothesis from the user; receiving a response message to the response message and evaluating the credibility of the response message; and, if the response message is credible, determining based on the response message whether to send the message to a specified terminal device.

Images