Security report creation assistance system and security report creation assistance method

Abstract

The present invention provides technology with which it is possible to assist creation of a security report that suits a reporting partner and a purpose. A security report creation assistance system according to the present invention includes a processor 103 and a storage device 105. The storage device 105 stores a rule table 113 that retains rules corresponding to a report object and a report type. The processor 103 acquires the report content, report object, and report type inputted by a user, reads a rule corresponding to the report object and report type inputted by the user from the rule table 113, and generates a report on the basis of the rule read from the rule table 113 and the report content inputted by the user.

Description

Security report creation support system and security report creation support method

[0001] The present invention relates to a security report creation support device and a security report creation support method.

[0002] In cybersecurity operations, it is important to create security reports on the threats and situations that have been discovered and dealt with, and to share information and request responses from management, employees, security engineers, etc. Currently, creating security reports is often done manually.

[0003] Patent Literature 1 discloses a technology that enables a reduction in the workload required to create a service report for incident management. Patent Literature 1 describes a technology that selects incident statistical information that corresponds to predetermined conditions from statistical information on each incident included in management reports that have been generated in the past, generates template information consisting of each selected item, assigns identification information to the template, performs statistical processing on each piece of incident information recorded in a storage device, and generates a management report.

[0004] JP 2011-203909 A

[0005] Security reports are created for various audiences, such as management, employees, security engineers, etc. Security reports are also created for various purposes, such as incident reporting and information sharing.

[0006] Depending on the audience and purpose, the expressions used in the report may differ, and graphical illustrations may be required. Therefore, it is necessary to create a report that is appropriate for the audience and purpose.

[0007] However, Patent Document 1 does not describe support for creating security reports according to the reporting recipient or purpose.

[0008] Therefore, an object of the present invention is to provide a technique that can support the creation of a security report according to the reporting party and purpose.

[0009] In order to solve the above problems, one representative security report creation support system of the present invention is a security report creation support system having a processor and a storage device, in which the storage device stores a rule table that holds rules corresponding to the report subject and report type, and the processor acquires the report content, report subject, and report type input by the user, reads rules from the rule table that correspond to the report subject and report type input by the user, and generates a report based on the rules read from the rule table and the report content input by the user.

[0010] According to the present invention, it is possible to support the creation of a security report according to the reporting party and purpose.

[0011] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments.

[0012] 1 is a block diagram showing an example of the configuration of a security report creation support system according to a first embodiment; FIG. 2 is a diagram showing an example of a report creation support screen displayed on a user terminal according to the first embodiment; FIG. 3 is a diagram showing an example of the data configuration of a creation report table; FIG. 4 is a diagram showing an example of the data configuration of a rule table; FIG. 5 is a diagram showing an example of the data configuration of a template table; FIG. 6 is a flowchart showing an example of a rule analysis process by report according to the first embodiment; FIG. 7 is a flowchart showing an example of a report generation process according to the first embodiment; FIG. 8 is a flowchart showing an example of a screen drawing process according to the first embodiment; FIG. 9 is a diagram showing an example of the configuration of a security report creation support system according to a second embodiment; FIG. 10 is a flowchart showing an example of a data output process according to the second embodiment; FIG. 11 is a diagram showing an example of the configuration of a security report creation support system according to a third embodiment; FIG. 12 is a diagram showing an example of a report creation support screen displayed on a user terminal according to the third embodiment; FIG. 13 is a diagram showing an example of the data configuration of an input recommendation table; FIG. 14 is a flowchart showing an example of report creation support process according to the third embodiment;

[0013] Hereinafter, embodiments of the present invention will be described with reference to the drawings. The examples are merely examples for explaining the present invention and are simplified. The present invention can also be implemented in various other forms. While various types of information will be described using expressions such as "tables" as examples, the various types of information may also be expressed using data structures other than these.

[0014] The security report creation support system of the first embodiment is a system that supports the creation of a security report according to the report recipient (report target) and purpose (report type).

[0015] FIG. 1 is a block diagram illustrating an example of the configuration of a security report creation support system according to a first embodiment.

[0016] The security report creation support system includes one or more user terminals 101 and a report creation support computer 102. The user terminals 101 and the report creation support computer 102 are connected to each other via a network.

[0017] The user terminal 101 is a terminal operated by a user such as an analyst.

[0018] The user terminal 101 has a function for inputting information necessary for report creation, such as the report subject, report purpose, and report content, through user operation, and a function for presenting a report created by the report creation support computer 102. The user terminal 101 realizes these functions, for example, by displaying on the display screen a report creation support screen 200, which will be described later with reference to FIG.

[0019] The user terminal 101 can be realized by an information processing device such as a general server device, a personal computer, or a mobile terminal.

[0020] The report creation support computer 102 has a function of creating a security report according to the report subject and report type. The report creation support computer 102 can be realized by an information processing device such as a general server device, a personal computer, or a mobile terminal.

[0021] The report creation support computer 102 has, as its hardware configuration, a processor 103, a main memory 104, a storage device 105, an input / output device 106, a network interface 107, a bus 108 connecting these, and the like.

[0022] The processor 103 controls each unit of the report creation support computer 102. The processor 103 also reads data and programs stored in the storage device 105 into the main memory 104 and executes processing determined by the programs.

[0023] The main memory 104 is configured with a volatile memory element such as a RAM (Random Access Memory), and stores programs executed by the processor 103 and data.

[0024] The main memory 104 also has a report-specific rule analysis unit 109, a report generation unit 110, and a screen drawing unit 111. These functions are realized by the processor 103 reading out a program stored in the storage device 105 into the main memory 104 and executing the processing.

[0025] The storage device 105 is configured with a nonvolatile storage element such as a hard disk drive (HDD) or a solid state drive (SSD), and stores a production report table 112, a rule table 113, and a template table 114.

[0026] The input / output device 106 includes input devices such as a keyboard and a mouse that accept user operations, and output devices such as a touch panel, a display, and a speaker that output information.

[0027] The report creation support computer 102 acquires information input by a user through an input device, and presents the information to the user through, for example, a screen display using an output device.

[0028] The NWIF 107 is an interface used by the report creation support computer 102 to communicate with the user terminal 101. The NWIF 107 is connected to a network and transmits and receives data to and from the user terminal 101 via the network.

[0029] The bus 108 connects the main memory 104, the storage device 105, the processor 103, and the NWIF 107. The bus 108 is an information transmission medium such as a bus or a cable.

[0030] The report-specific rule analysis unit 109 executes the report-specific rule analysis process described later in FIG. 6, derives rules according to the report subject and report type from previously created reports stored in the created report table 112, and records the rules in the rule table 113.

[0031] The report generation unit 110 executes the report generation process described later in FIG. 8, and generates a report based on the report content input by the user via the user terminal 101, the rules stored in the rule table 113, and the templates stored in the template table 114.

[0032] The screen drawing unit 111 executes a screen drawing process, which will be described later with reference to FIG. 9, and displays the report generated by the report generation unit 110 on the user terminal 101 .

[0033] The created report table 112 stores information about created reports. The data structure of the created report table 112 will be described with reference to FIG.

[0034] The rule table 113 stores information on rules for writing reports according to the report subject and report type. The data structure of the rule table 113 will be described with reference to FIG.

[0035] The template table 114 stores information on templates according to the purpose of the report. The data structure of the template table 114 will be explained with reference to FIG.

[0036] FIG. 2 is a diagram showing an example of a report creation support screen 200 displayed on the user terminal 101 according to the first embodiment.

[0037] The report creation support screen 200 has an input section 201, an output section 202, and a template presentation section 203. The report creation support screen 200 is implemented, for example, as an executable application, a web page, or a browser extension function.

[0038] The input unit 201 has various input fields and buttons for the user to input information necessary for creating a report, such as the report subject, the report purpose, and the report content.

[0039] The input section 201 has a report target input field 204 , a report type input field 205 , a tag input field 206 , a report content input field 207 , a report generation button 208 , and an end button 209 .

[0040] The report target input field 204 is used to input information about the report target, such as management, security engineers, employees, etc., to whom the report is to be submitted.

[0041] The report type input field 205 is used to input information about the report type, which indicates the purpose of the report, such as an incident handling report or information sharing.

[0042] The tag input field 206 is used to input tag information indicating the attributes of the report.

[0043] Information about the report content, which is the content to be written in the report, is input into the report content input field 207. The report content may be input in a descriptive format using technical terms, etc., taking into consideration the subject of the report, or may be input using simple language that anyone can understand.

[0044] The report generation button 208 is a button that is input by the user after inputting information in each input field to cause the report creation support computer 102 to start creating a report. When the user inputs the report generation button 208, the report creation support computer 102 accepts the information input in each input field from the user terminal 101 and starts creating a report.

[0045] The report generation button 208 is not required, and when a predetermined time has passed since information was entered into each input field of the input section 201, or when text is entered into the report content input field 207, the information entered into each input field may be accepted from the user terminal 101 and report creation may begin.

[0046] The end button 209 is a button that the user presses when he or she has completed inputting information into each input field and wants to save the created report.

[0047] When the end button 209 is pressed, the report creation support computer 102 determines that input into each input field of the input section 201 is complete, and stores the generated report in the created report table 112 .

[0048] The end button 209 is not essential, and the method of determining whether input to the input unit 201 has been completed is not limited to this.

[0049] The report generated by the report generating unit 110 is displayed on the output unit 202 by the screen drawing unit 111 .

[0050] The template presentation section 203 displays the template used to generate the report for reference.

[0051] The report creation support screen 200 in FIG. 2 is an example, and the contents can be changed as appropriate.

[0052] 3 to 5, various data tables used in the security report creation support system will be described.

[0053] FIG. 3 is a diagram showing an example of the data configuration of the created report table 112. As shown in FIG.

[0054] The created report table 112 stores information about created reports.

[0055] The created report table 112 stores records having the following fields: created report ID 301 , case ID 302 , date and time 303 , report target 304 , report type 305 , tag 306 , and report content 307 .

[0056] The information stored in the created report table 112 may be information on reports created by the organization in the past or publicly available security reports, and the source of the information is not limited.

[0057] The created report ID 301 is a field that stores an identifier assigned to uniquely identify one report. The created report ID 301 is assigned a number as an example, but is not limited to this format as long as it can uniquely identify one report.

[0058] The case ID 302 is a field that stores an identifier assigned to uniquely identify one incident that is the source of the report. Although a number is assigned to the case ID 302 as an example, the case ID is not limited to this format as long as it can uniquely identify one incident.

[0059] 3, the reports with created report IDs 301 of "1" and "2" both have a case ID 302 of "1." This indicates that an incident has occurred, and reports on this incident have been created for management and security engineers, respectively.

[0060] The date and time 303 stores the date and time when the report was created.

[0061] The report target 304 stores information about the report target of the report. Information stored in the report target 304 includes, for example, management, security engineers, employees, and the like.

[0062] The report type 305 stores information about the report type of the report. For example, the information stored in the report type 305 is an incident handling report, information sharing, and the like.

[0063] The tag 306 stores attribute information of the report that is freely added and input by the user. The information stored in the tag 306 includes information that represents report attributes that are not included in the report target 304 or the report type 305.

[0064] The report content 307 stores the created report. The information stored in the report content 307 is not limited to text format, and may be in the form of a table, a diagram, or the like.

[0065] FIG. 4 is a diagram showing an example of the data structure of the rule table 113. As shown in FIG.

[0066] The rule table 113 stores information on rules for creating reports according to report targets and report types.

[0067] The rule table 113 stores records having the following fields: rule ID 401 , report target 402 , report type 403 , other attributes 404 , and rule 405 .

[0068] The information stored in the rule table 113 may be created by a report-specific rule analysis process, which will be described later with reference to FIG. 6, or may be created and edited manually by the user.

[0069] The rule ID 401 is a field that stores an identifier assigned to uniquely identify one rule. Although a number is assigned to the rule ID 401 as an example, the rule ID is not limited to this format as long as it can uniquely identify one rule.

[0070] The report target 402 stores information about the report target of the report. Information stored in the report target 402 includes, for example, management, security engineers, employees, and the like.

[0071] This report target 402 corresponds to the field of the report target 304 in the created report table 112. When a rule is created in the report-specific rule analysis process of Fig. 6, the value of the report target 304 in the created report table 112 that had the greatest influence when creating the rule is stored in the report target 402.

[0072] The report type 403 stores information about the report type of the report. Information stored in the report type 403 is, for example, an incident handling report, information sharing, and the like.

[0073] The report type 403 corresponds to the report type 305 field of the created report table 112 .

[0074] When a rule is created in the report-specific rule analysis process of FIG. 6, the value of the report type 305 in the created report table 112 that had the greatest influence when creating the rule is stored in the report type 403 .

[0075] The other attribute 404 is a field that can store attributes to which the rule applies. The other attribute 404 corresponds to the tag 306 field of the created report table 112. When a rule is created in the report-specific rule analysis process (see FIG. 6), the other attribute 404 is the value of the tag 306 of the created report table 112 that had the greatest influence on the creation of the rule.

[0076] The rule 405 stores rules describing how to convert a report from the information of the report content entered by the user when generating the report. The rule 405 may be, for example, a one-to-one conversion rule such as "the word "malware" should be written as the word "suspicious file," or a rule related to the creation policy such as "information about files should be illustrated using a file diagram to show the relationship." The rule 405 may be written in a format that expresses substitutions such as regular expressions, or in a format that is written in natural language.

[0077] FIG. 5 is a diagram showing an example of the data configuration of the template table 114. As shown in FIG.

[0078] The template table 114 stores information about templates related to report creation.

[0079] The template table 114 stores records having the following fields: template ID 501, report type 502, and template content 503.

[0080] The information stored in the template table 114 may be manually created and edited by the user, and the method for creating the template is not limited.

[0081] The template ID 501 is a field that stores an identifier assigned to uniquely identify one template. Although a number is assigned to the template ID 501 as an example, the format is not limited to this as long as it can uniquely identify one template.

[0082] The report type 502 stores information about the report type of the report. Information stored in the report type 502 is, for example, an incident handling report, information sharing, and the like.

[0083] The report type 502 corresponds to the report type 305 field of the created report table 112 .

[0084] The template used for creating a report is stored in the template content 503. The information stored in the template content 503 is not limited to text format, and may be in the format of a table, a diagram, or the like.

[0085] The field configurations of the report table 112, the rule table 113, and the template table 114 shown in FIGS. 3 to 5 are merely examples, and the contents can be changed as appropriate.

[0086] The processing executed in the security report creation support system will be described with reference to Figures 6 to 9. The following processing is realized by the processor 103 of the report creation support computer 102 reading data and programs stored in the storage device 105 into the main memory 104 and executing the processing defined by the programs.

[0087] FIG. 6 is a flowchart illustrating an example of a report-specific rule analysis process according to the first embodiment.

[0088] The report-specific rule analysis process, an example of which is shown in FIG. 6, is executed by the report-specific rule analysis unit 109 of the report creation support computer 102.

[0089] The report-specific rule analysis process is a process for updating the rule table 113 used in the report creation support process, which will be described later with reference to Fig. 7. Therefore, the report-specific rule analysis process is independent of the report creation support process, which is executed in response to a user input as a trigger, and the timing of execution does not matter.

[0090] In FIG. 6, the report creation support computer 102 calls up a report stored in the created report table 112 (step S601).

[0091] Next, the report creation support computer 102 classifies the reports by attribute, using the report target 304, report type 305, and tag 306 in the created report table 112 as attributes of the report, and creates clusters (step S602). Note that the classification method may be to classify into clusters with the same combination of report target 304, report type 305, and tag 306, or a clustering method may be used.

[0092] Next, the report creation support computer 102 compares the characteristics of the reports belonging to one cluster with the characteristics of the reports in other clusters and extracts the differences between the characteristics of the reports and the characteristics of other clusters (step S603), thereby clarifying the characteristic report creation rules for each cluster created in step S602.

[0093] The feature difference extraction in step S603 is performed using machine learning, such as Bidirectional Encoder Representations from Transformers (BERT) or Large Language Models (LLM).

[0094] Here, the characteristics of the report include, for example, the use of different terms for the same subject depending on the cluster.

[0095] Next, the report creation support computer 102 records the difference in features extracted in step S603 in the rule 406 of the rule table 113, and records the report object 304, report type 305, and tag 306 of the report belonging to the cluster in the report object 402, report type 403, and other attributes 404, respectively (step S604).

[0096] Next, it is determined whether or not the processes of steps S603 and S604 have been completed for all the clusters created in step S602 (step S605).

[0097] In step S605, if the processes in steps S603 and S604 have not been completed for all the clusters created in step S602, the process returns to step S603, and the difference in features between the next cluster and other clusters is extracted.

[0098] In step S605, when the processes in steps S603 and S604 have been completed for all the clusters created in step S602, this process ends.

[0099] FIG. 7 is a flowchart illustrating an example of a report creation support process according to the first embodiment.

[0100] 7, the report creation support computer 102 determines whether or not the report creation button 208 on the report creation support screen 200 in Fig. 2 has been pressed as a trigger to start report creation (step S701). Note that the trigger is not limited to the press of the report creation button 208, and report creation may be started when a predetermined time has elapsed since information was entered into the input unit 201, or when text is entered into the report content input field 207.

[0101] If the report generation button 208 is pressed in step S701, the report generation support computer 102 receives information input to the input section 201 of the report generation support screen 200 from the user terminal 101 (step S702).

[0102] The report creation support computer 102 executes a report generation process (step S703) which will be described later in Fig. 8. In the report generation process, a report is generated based on the report content entered by the user in the report content input field 207 of the input unit 201 of the report creation support screen 200, according to the report target entered in the report target input field 204.

[0103] Next, the report creation support computer 102 executes a screen drawing process (step S704) which will be described later with reference to Fig. 9. In the screen drawing process, the report generated in step S703 is presented on the output unit 202 of the report creation support screen 200.

[0104] Next, the report creation support computer 102 determines whether the user has completed input to the input unit 201 (step S705). Here, it determines that the input to the input unit 201 has been completed by pressing the end button 209 on the report creation support screen 200 in Fig. 2. Note that the method for determining whether the input to the input unit 201 has been completed is not limited to this.

[0105] If it is determined in step S705 that input to the input unit 201 is complete, the process proceeds to step S706.

[0106] On the other hand, if it is determined in step S705 that input to the input unit 201 is not complete, the process proceeds to step S702, where the report creation support computer 102 accepts the content input to the input unit and repeats the process.

[0107] In step S706, the report creation support computer 102 stores the report created in step S703 in the created report table 112, and ends this process.

[0108] FIG. 8 is a flowchart illustrating an example of a report generation process according to the first embodiment.

[0109] The report generation process, an example of which is shown in FIG. 8, is executed by the report generation unit 110 of the report generation support computer 102.

[0110] 8, the report creation support computer 102 acquires the report target, report type, and report content input in the input section 201 of the report creation support screen 200 (step S801). At the same time, the computer 102 may also acquire tags input in the tag input field 206.

[0111] Next, the report creation support computer 102 calls the rule 405 from the rule table 113, whose field values ​​of the report target 402 and report type 403 match the report target and report type acquired in step S801 (step S802).

[0112] Next, the report creation support computer 102 calls up from the template table 114 the template content 503 whose field value of the report type 502 matches the report type acquired in step S801 (step S803).

[0113] Next, the report creation support computer 102 generates a report from the report content acquired in step S801, the rule called in step S802, and the template called in step S803 (step S804), and ends this processing.

[0114] The report generation method in step S804 can be, for example, generation by LLM or generation by substitution using heuristic rules. In generation by LLM, the report content, clearly stated rules as conditions, and a template are input as prompts, and the completed report is output.

[0115] FIG. 9 is a flowchart illustrating an example of a screen drawing process according to the first embodiment.

[0116] The screen drawing process, an example of which is shown in FIG. 9, is executed by the screen drawing unit 111 of the report creation support computer 102.

[0117] 9, the report creation support computer 102 renders the report generated in step S804 in the output section 202 of the report creation support screen 200 (step S901), thereby allowing the user to check the generated report.

[0118] In this case, any drawing method can be used.

[0119] Next, the report creation support computer 102 calls up the template content 503 from the template table 114, the template content 503 having a field value of the report type 502 that matches the value of the report in question (step S902).

[0120] Next, the template content 503 called up in step S902 is rendered on the template presentation unit 203 (step S903), and this processing ends. This allows the user to check the template used to create the report.

[0121] According to the first embodiment, rules for creating a report are extracted according to the report target and report type, and a report is generated based on the report content entered by the user, the rules according to the report target and report type, and a template according to the report type. This makes it possible to support the creation of a security report according to the report recipient and purpose.

[0122] The security report creation support system of the second embodiment differs from the first embodiment in that, in addition to the functions of the first embodiment, the report creation support computer 102 converts the created report into a specified output format and outputs it. As a result, in the second embodiment, the report created by the report creation support computer 102 can be used on other media.

[0123] The second embodiment will be described below with reference to FIGS. 10 and 11, focusing on the differences from the first embodiment.

[0124] FIG. 10 is a diagram illustrating an example of the configuration of a security report creation support system according to the second embodiment.

[0125] In FIG. 10, the report creation support computer 102 has a data output unit 1001 in addition to the functions of the first embodiment.

[0126] The data output unit 1001 converts the report created by the report generation unit 110 into a specified output format and outputs it.

[0127] FIG. 11 is a flowchart illustrating an example of a data output process according to the second embodiment.

[0128] The data output process, an example of which is shown in FIG. 11, is executed by the data output unit 1001 of the report creation support computer 102.

[0129] 11, the report creation support computer 102 determines whether or not a data output format has been specified in the user terminal 101 for the report created in the report creation support process of FIG. 7 (step S1101).

[0130] The data output format is, for example, PDF, PowerPoint, etc. The data output format can be specified, for example, by presenting a select box in the report creation support screen 200 in FIG. 2 that allows the user to select the output format and prompting the user to specify the format.

[0131] If the data output format is not specified in step S1101, this process ends.

[0132] On the other hand, if the data output format is specified in step S1101, the report creation support computer 102 converts the report created in the report creation support process of FIG. 7 into the specified output format (step S1102).

[0133] Next, the report creation support computer 102 outputs the converted report to the user terminal 101 (step S1103), and this process ends.

[0134] According to the second embodiment, the security report creation support system converts the created report into a specified output format and outputs it. This allows the created report to be used in other media, making it easier to provide the security report to the person to whom the report is to be sent.

[0135] The security report creation support system of the third embodiment differs from the first embodiment in that, in addition to the functions of the first embodiment, the report creation support computer 102 can accept an input of an instruction to create a report using diagrams from a user and create a report using diagrams. As a result, in the third embodiment, it is possible to create a more effective report using diagrams.

[0136] Hereinafter, the third embodiment will be described with reference to FIGS. 12 to 15, focusing on the differences from the first embodiment.

[0137] FIG. 12 is a diagram illustrating an example of the configuration of a security report creation support system according to the third embodiment.

[0138] 12, the report creation support computer 102 has an input support unit 1002 in addition to the functions of the first embodiment. The storage device 105 stores an input recommendation table 1004 in addition to the configuration of the first embodiment.

[0139] The input support unit 1002 extracts input recommendations that are recommended for report creation from the input recommendation table 1004 based on the input status of the user's report content, and presents them to the user.

[0140] The input recommendation table 1004 is a table for managing input recommendations extracted by the input support unit 1002. The data structure of the input recommendation table 1004 will be described with reference to FIG.

[0141] FIG. 13 is a diagram showing an example of a report creation support screen 200 displayed on the user terminal 101 according to the third embodiment.

[0142] The report creation support screen 200 of the third embodiment has an input support indicator 1202 in addition to the configuration of the report creation support screen 200 of the first embodiment shown in Fig. 2. Furthermore, the report creation support screen 200 of the third embodiment has a report content input field 1201 instead of the report content input field 207 of the first embodiment.

[0143] The report creation support screen 200 is implemented, for example, as an executable application, a web page, or a browser extension.

[0144] 2 in that the report content input field 1201 allows the user to input a report creation instruction using diagrams in a predetermined input format. This allows the user to instruct the creation of a report using diagrams as exemplified in the output unit 202. The input format for the report creation instruction is an intermediate language in which the report creation instruction can be input, such as a unique input format such as Markdown.

[0145] The input support indicator 1202 displays input recommendations extracted in the report creation support process described later in Fig. 15. By checking the input support indicator 1202, the user can learn about missing information and more desirable input formats. This enables the creation of accurate and useful reports.

[0146] In FIG. 13, the input assistance indicator 1202 is displayed in a balloon as an example, but the format of the input assistance indicator 1202 is not limited to this.

[0147] Note that a method for creating a report from data in a predetermined input format can be realized by describing rules 405 that take the input format into consideration, so a description thereof will be omitted.

[0148] Furthermore, the report creation support screen 200 in FIG. 13 is an example, and the contents can be changed as appropriate.

[0149] FIG. 14 is a diagram showing an example of the data configuration of the input recommendation table 1004. As shown in FIG.

[0150] The input recommendation table 1004 stores information on input recommendations that are recommended for report creation.

[0151] The input recommendation table 1004 stores records having the following fields: input format ID 1301 , report target 1302 , report type 1303 , target 1304 , attribute 1305 , condition 1306 , and input recommendation 1307 .

[0152] The information stored in the input recommendation table 1004 may be created and edited manually by the user as rules.

[0153] The input format ID 1301 is a field for storing an identifier assigned to uniquely identify one input recommendation. Although a number is assigned to the input format ID 1301 as an example, the input format ID is not limited to this format as long as it can uniquely identify one input recommendation.

[0154] The report target 1302 stores information about the report target of the report. Information stored in the report target 1302 includes, for example, management, security engineers, employees, and the like.

[0155] The report type 1303 stores information about the report type of the report. Information stored in the report type 1303 is, for example, an incident handling report, information sharing, and the like.

[0156] The target 1304 stores information about the target of the condition for displaying input recommendations in the input assistance indicator 1202. The target is, for example, the subject of the condition, such as an attacker, an attacking group, a victim, a terminal, a file, a process, a registry, an IP address, or a domain name.

[0157] The attribute 1305 stores information about the attributes of the target 1304. The attributes are, for example, the properties or operations of the target 1304, such as an executable format, a hash value, or a file drop.

[0158] The condition 1306 stores information on the condition for displaying input recommendations in the input assistance indicator 1202. The condition indicates the state of the attribute 1305 of the target 1304, such as small, large, included, or not included.

[0159] The input recommendation 1307 stores information about the input recommendation displayed on the input assistance indicator 1202. The input recommendation is, for example, information that the user is advised to input into the report content input field 1201, such as "The report will be more useful if you include file format information for [file name]."

[0160] In the example of FIG. 14 , if “file” is stored in the target 1304, “executable format” is stored in the attribute 1305, and “not included” is stored in the condition 1306, and if the file does not include an executable format, the message “The report will be more useful if there is file format information for [file name]” stored in the input recommendation 1307 is displayed in the input assistance indicator 1202.

[0161] The field configuration of the input recommendation table 1004 is an example, and the contents can be changed as appropriate.

[0162] FIG. 15 is a flowchart illustrating an example of a report creation support process according to the third embodiment.

[0163] The report creation support process in Fig. 15 is a modified example of the report creation support process in Fig. 7. In Fig. 15, the input support process of steps S1401 to S1403 is executed by the input support unit 1002 of the report creation support computer 102. In Fig. 15, the same processes as those in Fig. 7 are denoted by the same reference numerals, and their explanations will be omitted.

[0164] In FIG. 15, when the report creation support computer 102 receives information entered into the report creation support screen 200 of the user terminal 101 in step S702, it reads from the input recommendation table 1004 input recommendations whose report target 1302 and report type 1303 match the report action and report type included in the information received in step S702 (step S1401).

[0165] Next, the report creation support computer 102 determines whether or not there is an input recommendation 1307 among the input recommendations read in step S402, in which the information entered in the report content input field 1201 matches the target 1304, attribute 1305, and condition 1306 (step S1402).

[0166] In step S1402, if there is no input recommendation 1307 among the input recommendations read in step S402 that matches the information entered in the report content input field 1201 with the target 1304, attribute 1305, and condition 1306, the processing from step S703 onwards is executed.

[0167] On the other hand, if there is an input recommendation 1307 among the input recommendations read in step S1402, in which the information entered in the report content input field 1201 matches the target 1304, attribute 1305, and condition 1306, that input recommendation 1307 is extracted (step S1403).

[0168] Next, the report creation support computer 102 displays the input support indicator 1202 on the report creation support screen 200, displays the input recommendation 1307 extracted in step S1403 on the input support indicator 1202 (step S1404), and executes the processing from step S703 onwards.

[0169] According to Example 3, the user inputs instructions for creating a report using diagrams in a specified input format, and a report is generated based on the input information, so that precise reports using diagrams can be created.

[0170] Furthermore, input recommendations are displayed in the input assistance indicator 1202 based on the information entered by the user, so that the user can be prompted to enter information necessary to generate a more useful report.

[0171] The security report creation support system of Example 4 differs from Example 3 in that, in addition to the functions of Example 3, the report creation support computer 102 creates data in a predetermined input format for inputting instructions for creating a report using diagrams from security-related data such as logs and tickets. As a result, Example 4 makes it possible to easily create data in a predetermined input format.

[0172] Hereinafter, the fourth embodiment will be described with reference to FIGS. 16 to 18, focusing on the differences from the third embodiment.

[0173] FIG. 16 is a diagram illustrating an example of the configuration of a security report creation support system according to the fourth embodiment.

[0174] The report creation support computer 102 has an input format conversion unit 1003 in addition to the functions of the third embodiment. The storage device 105 stores a conversion data table 1005 in addition to the configuration of the first embodiment.

[0175] The input format conversion unit 1003 creates data in a predetermined input format for inputting instructions to create a report using diagrams from security-related data such as logs and tickets.

[0176] The conversion data table 1005 is a table for managing information on input format conversions that have been performed in the past. The data structure of the conversion data table 1005 will be described with reference to FIG.

[0177] FIG. 17 is a diagram showing an example of the data structure of the conversion data table 1005. As shown in FIG.

[0178] The conversion data table 1005 stores data before and after input format conversion when the input format was converted in the past. The conversion data table 1005 is stored in advance in the storage device 105 and is used in the input format conversion process described with reference to FIG.

[0179] The conversion data table 1005 stores records having conversion data ID 1501, raw data 1502, and converted data 1503 as fields.

[0180] The information stored in the conversion data table 1005 may be created and edited manually by the user as rules.

[0181] The converted data ID 1501 is a field for storing an identifier assigned to uniquely identify a set of data before and after input format conversion. Although a number is assigned to the converted data ID 1501 as an example, the format is not limited to this as long as it can uniquely identify a set of data before and after input format conversion.

[0182] The raw data 1502 stores data before conversion when the input format was converted in the past. The raw data 1502 is, for example, a log or a ticket.

[0183] The post-conversion data 1503 stores the converted data when the input format was converted in the past.

[0184] The field configuration of the conversion data table 1005 is an example, and the contents can be changed as appropriate.

[0185] FIG. 18 is a flowchart illustrating an example of an input format conversion process according to the fourth embodiment.

[0186] The input format conversion process, an example of which is shown in FIG. 18, is executed by the input format conversion unit 1003 of the report creation support computer 102.

[0187] 18, the report creation support computer 102 determines whether input of data to be converted into an input format such as a log or an incident ticket has been received from the user terminal 101 (step S1601). The data received at this time is data related to security reports, such as logs, malware analysis data, and incident tickets.

[0188] When input of data to be converted is accepted in step S1601, the report creation support computer 102 reads out the raw data 1502 and the converted data 1503 from the conversion data table 1005 (step S1602).

[0189] Next, the report creation support computer 102 converts the data received in step S1601 into a predetermined input format for inputting a report creation instruction based on the read raw data 1502 and converted data 1503 (step S1603).

[0190] In step S1603, the received data is converted into a predetermined input format using the LLM with the received data, raw data 1502, and converted data 1503 as prompts. Note that the method of converting the input format is not limited to this.

[0191] Next, the report creation support computer 102 stores the data before and after conversion in the conversion data table 1005 as raw data 1502 and converted data 1503 (step S1604).

[0192] Next, the report creation support computer 102 outputs the converted data 1503 to the user terminal 101 (step S1605), and ends this process. The user inputs a report creation instruction to the report creation support computer 102 by inputting the data in a predetermined input format output from the report creation support computer 102 into the report content input field 1201 in Figure 3.

[0193] According to the fourth embodiment, data related to security reports, such as logs and incident tickets, is converted into a predetermined input format for inputting instructions for creating a report using diagrams, thereby reducing the workload of creating data in the predetermined input format.

[0194] The present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0195] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The above-described configurations, functions, etc. may also be implemented in software, with a processor interpreting and executing a program that implements each function. Information such as the programs, tables, and files that implement each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0196] 101: User terminal 102: Report creation support computer 103: Processor 104: Main memory 105: Storage device 106: Input / output device 107: Network interface 108: Bus 109: Report-specific rule analysis unit 110: Report generation unit 111: Screen drawing unit 112: Created report table 113: Rule table 114: Template table

Claims

1. A security report creation support system having a processor and a storage device, wherein the storage device stores a rule table that holds rules corresponding to report targets and report types, and the processor acquires report content, report targets, and report types input by a user, reads out rules from the rule table that correspond to the report target and report type input by the user, and generates a report based on the rules read out from the rule table and the report content input by the user.

2. A security report creation support system as described in claim 1, wherein the storage device stores a template table that stores templates corresponding to the report type of the report, and the processor reads out a template corresponding to the report type input by the user from the template table, and creates a report based on the read template.

3. A security report creation support system as described in claim 1, wherein the storage device stores a created report table that stores created reports, and the processor creates the rules corresponding to the report subject and the report type based on the reports stored in the created report table.

4. A security report creation support system according to claim 3, wherein the processor creates the rules through machine learning.

5. A security report creation support system according to claim 1, wherein said processor presents said generated report to said user.

6. A security report creation support system according to claim 3, wherein said processor stores said generated report in said created report table.

7. A security report creation support system as described in claim 1, wherein the processor acquires an output format input by the user and converts the generated report into the output format input by the user.

8. A security report creation support system as described in claim 1, wherein the processor acquires a report creation instruction input by a user in a predetermined input format, and generates a report based on the report creation instruction.

9. A security report creation support system as described in claim 8, wherein the storage device stores an input recommendation table that stores input recommendations and conditions for presenting the input recommendations, and the processor extracts from the input recommendation table input recommendations that match the conditions of the report creation instructions entered by the user, and presents the extracted input recommendations to the user.

10. A security report creation support system as described in claim 8, wherein the storage device stores a conversion data table that stores data before and after input format conversion, and the processor acquires data entered by the user, reads the data before and after input format conversion from the conversion data table, and converts the data entered by the user into the specified input format based on the data before and after input format conversion.

11. A security report creation support method for a security report creation support system having a processor and a storage device, the method comprising: storing a rule table in which rules corresponding to report targets and report types are stored in the storage device; acquiring report content, report targets, and report types input by a user using the processor; reading rules corresponding to the report targets and report types input by the user from the rule table; and generating a report based on the rules read from the rule table and the report content input by the user.

Images