Action generation method, action generation device, and program

Abstract

An action generation method according to the present invention acquires alert information including an alert detected at a target facility, acquires asset information and module information for the target facility, generates a query for acquiring an action for the alert on the basis of the acquired alert information, asset information, and module information, and generates an action for the alert on the basis of the query.

Description

Action generation method, action generation device, and program

[0001] The present disclosure relates to an action generation method, an action generation device, and a program.

[0002] In recent years, security orchestration automation and response (SOAR), a tool for automating responses to cyber attacks, has been attracting attention due to its ability to reduce human workloads. SOAR uses a playbook that predefines actions to be taken when an alert occurs, and the tool can automatically execute actions in accordance with the playbook. For example, Non-Patent Document 1 discloses a technology that "recommends" the next module to be used based on alert information generated by security information and event management (SIEM) and response sequence information in the playbook.

[0003] Ryuta Kremer, and 6 others, “IC-SECURE: Intelligent System for Assisting Security Experts in Generating Playbooks for Automated Incident Response”, [online], November 7, 2023, [Retrieved June 25, 2020], Internet <URL: https: / / arxiv.org / pdf / 2311.03825>

[0004] However, the technology in Non-Patent Document 1 only recommends the next module to be used in response to an alert, and is unable to specify the next action to be taken. From the perspective of further reducing the burden on humans, it is desirable to automatically generate the next action to be taken.

[0005] Therefore, the present disclosure provides an action generation method, an action generation device, and a program that are capable of automatically generating an action for an alert.

[0006] An action generation method according to one aspect of the present disclosure acquires alert information including an alert detected in a target facility, acquires asset information and module information for the target facility, generates a first query for acquiring a first action for the alert based on the acquired alert information, asset information, and module information, and generates the first action for the alert based on the first query.

[0007] An action generation device according to one aspect of the present disclosure includes a first acquisition unit that acquires alert information including an alert detected in a target facility; a second acquisition unit that acquires asset information and module information in the target facility; a query generation unit that generates a query for acquiring an action for the alert based on the acquired alert information, asset information, and module information; and an action generation unit that generates the action for the alert based on the query.

[0008] A program according to one aspect of the present disclosure is a program for causing a computer to execute the above-described action generation method.

[0009] According to one aspect of the present disclosure, it is possible to realize an action generation method or the like that can automatically generate an action for an alert.

[0010] FIG. 1 is a schematic diagram showing a configuration of an information processing system according to an embodiment. FIG. 2 is a block diagram showing a functional configuration of an automatic action generation device according to an embodiment. FIG. 3 is a diagram showing an example of response policy information according to an embodiment. FIG. 4 is a diagram showing a first example of asset information according to an embodiment. FIG. 5 is a diagram showing a second example of asset information according to an embodiment. FIG. 6A is a diagram showing a third example of asset information according to an embodiment. FIG. 6B is a diagram showing a fourth example of asset information according to an embodiment. FIG. 6C is a diagram showing a fifth example of asset information according to an embodiment. FIG. 7 is a diagram showing an example of module information according to an embodiment. FIG. 8 is a flowchart showing the operation of an information processing system according to an embodiment. FIG. 9 is a flowchart showing detailed operation of step S20 shown in FIG. 8. FIG. 10 is a diagram showing an example of a query for generating an action according to an embodiment. FIG. 11 is a diagram showing an example of a query for determining whether an action according to an embodiment can be executed.

[0011] (Background to the Invention of the Present Disclosure) Before describing the embodiments of the present disclosure, the background to the invention of the present disclosure will be described.

[0012] As described in the "Background Art" above, SOAR has attracted attention as a tool for reducing the human burden in responding to cyberattacks. However, SOAR uses playbooks to determine responses to cyberattacks, and creating playbooks places a heavy human burden on the system. Furthermore, while SOAR has technology to automatically select / recommend the next module to be used in response to a cyberattack, it does not specify the action. Furthermore, specifying the action in SOAR requires a significant human burden. Furthermore, there are cases where a playbook cannot be used, in which case manual response is required.

[0013] As such, there is room for improvement in SOAR in terms of reducing the human burden involved in responding to cyber attacks.

[0014] Therefore, the inventors of the present application have conducted extensive research into action generation methods etc. that can reduce the human burden in generating actions in response to alerts due to cyber-attacks etc., and have devised the following action generation method etc. Specifically, the inventors have devised an action generation method etc. that can automatically generate actions by utilizing asset information, modules etc., without using a playbook.

[0015] An action generation method according to a first aspect of the present disclosure acquires alert information including an alert detected in a target facility, acquires asset information and module information in the target facility, generates a first query for acquiring a first action for the alert based on the acquired alert information, asset information, and module information, and generates the first action for the alert based on the first query.

[0016] This allows the first query to be generated based on the asset information and the module information, so that the first action in response to the alert, which is based on the asset information and the module information, can be automatically generated.

[0017] An action generation method according to a second aspect of the present disclosure may be the action generation method according to the first aspect, further comprising generating a second query based on the first action to determine whether the first action can be executed, obtaining a determination result of whether the first action can be executed based on the second query, and executing processing according to the determination result.

[0018] This makes it possible to prevent the first action from being executed when it is desirable to execute the first action acquired based on the first query but it is desirable not to execute the first action due to other factors. For example, it is possible to prevent the execution of the first action from affecting the system of the target facility.

[0019] An action generation method according to a third aspect of the present disclosure is the action generation method according to the second aspect, and may include executing the first action when the determination result includes that the first action is executable.

[0020] As a result, the first action is executed, and a response to the alert can be taken.

[0021] An action generation method according to a fourth aspect of the present disclosure is the action generation method according to the second or third aspect, and may execute the first action after a predetermined time has elapsed if the determination result includes delaying execution.

[0022] This allows the first action to be executed while minimizing the impact on the system of the target facility that would occur if the first action were executed immediately.

[0023] An action generation method according to a fifth aspect of the present disclosure may be the action generation method according to the third or fourth aspect, which acquires historical log information to which a log of execution of the generated first action has been added, generates a third query for acquiring a second action to be executed next for the alert based on the acquired alert information, asset information, module information, and historical log information, and generates the second action for the alert based on the third query.

[0024] This allows the second action to be executed next to be acquired based on the execution of the first action, thereby automatically generating multiple actions to be executed consecutively.

[0025] An action generation method according to a sixth aspect of the present disclosure is an action generation method according to any of the second to fifth aspects, and when the determination result includes that the first action cannot be executed, may acquire historical log information to which a fact that the first action cannot be executed has been added, generate a fourth query for acquiring a third action to be executed for the alert based on the acquired alert information, asset information, module information, and historical log information, and generate the third action for the alert based on the fourth query.

[0026] This allows a third action different from the first action to be generated based on a third query when the first action obtained based on the first query is not executable, thereby enabling automatic generation of actions more reliably.

[0027] An action generation method according to a seventh aspect of the present disclosure may be the action generation method according to the first aspect, and may generate the first query for acquiring the first action in response to the alert and a determination result as to whether the first action can be executed based on the acquired alert information, the asset information, the module information, and specification information of equipment devices to be installed in the target facility, acquire the first action in response to the alert and the determination result as to whether the first action can be executed based on the first query, and execute processing according to the determination result.

[0028] This makes it possible to obtain the action content and the determination result of whether or not the action can be executed simply by generating one query, thereby reducing the amount of processing by the information processing device that executes the action generation method.

[0029] An action generation method according to an eighth aspect of the present disclosure is an action generation method according to any one of the first to seventh aspects, and may further generate the first query based on response policy information of the target facility.

[0030] This allows for more accurate action generation since the first query also includes the response policy information.

[0031] An action generation method according to a ninth aspect of the present disclosure is an action generation method according to any one of the second to eighth aspects, wherein the second query may include specification information of equipment to be installed in the target facility.

[0032] This allows a determination as to whether or not an action can be executed based on the specification information, and therefore an action that has a smaller impact on the system of the target facility can be generated.

[0033] An action generation method according to a tenth aspect of the present disclosure is an action generation method according to any one of the first to ninth aspects, wherein the asset information may include a device list of equipment devices installed in the target facility.

[0034] In this way, since the device list is used, actions can be automatically generated according to the devices installed in the target facility.

[0035] An action generation method according to an eleventh aspect of the present disclosure is an action generation method according to any one of the first to tenth aspects, wherein the asset information may include communication flow information between equipment devices installed in the target facility.

[0036] As a result, since communication flow information is used, actions can be automatically generated according to the communication history between the facility devices installed in the target facility.

[0037] An action generation method according to a twelfth aspect of the present disclosure is an action generation method according to any one of the first to eleventh aspects, wherein the asset information may include information indicating the network configuration of the target facility.

[0038] As a result, since information indicating the network configuration is used, it is possible to automatically generate an action according to the network configuration of the target facility.

[0039] An action generation method according to a thirteenth aspect of the present disclosure is an action generation method according to any one of the first to twelfth aspects, wherein the module information may include information about modules that can be used as actions in response to alerts in the target facility.

[0040] This allows the use of information about the module, making it possible to automatically generate actions according to the module's functions, performance, etc.

[0041] An action generation method according to a fourteenth aspect of the present disclosure is the action generation method according to any one of the first to thirteenth aspects, wherein the response policy information may include a response policy for alerts at the target facility.

[0042] This allows for automatic generation of actions according to the policy for dealing with alerts.

[0043] An action generation method according to a fifteenth aspect of the present disclosure is an action generation method according to any one of the first to fourteenth aspects, wherein the response policy information may include at least one of grace information for deferring execution of the action and a cancellation condition for canceling the action.

[0044] This allows automatic generation of actions according to at least one of the grace period information and the cancellation conditions. For example, immediate execution of an action can prevent the system of the target facility from being affected.

[0045] Moreover, an action generation device according to one aspect of the present disclosure includes a first acquisition unit that acquires alert information including an alert detected in a target facility, a second acquisition unit that acquires asset information and module information in the target facility, a query generation unit that generates a query for acquiring an action for the alert based on the acquired alert information, asset information, and module information, and an action generation unit that generates the action for the alert based on the query.

[0046] Furthermore, a program according to one aspect of the present disclosure is a program for causing a computer to execute the action generation method of any one of the first to fifteenth aspects.

[0047] This provides the same effect as the above-mentioned action generation method.

[0048] These general or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or as any combination of the system, method, integrated circuit, computer program, or recording medium. The program may be pre-stored in the recording medium, or may be supplied to the recording medium via a wide area communication network including the Internet.

[0049] Hereinafter, the embodiments will be specifically described with reference to the drawings.

[0050] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, components, component placement and connection configurations, steps, and step order shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components not described in independent claims are described as optional components.

[0051] Furthermore, each figure is a schematic diagram and is not necessarily an exact illustration. Therefore, for example, the scales of the figures do not necessarily match. Furthermore, in each figure, substantially the same components are given the same reference numerals, and redundant explanations are omitted or simplified.

[0052] Furthermore, in this specification, terms indicating relationships between elements such as "same," as well as numerical values ​​and numerical ranges, are not expressions that express only the strict meaning, but are expressions that also include a substantially equivalent range, for example, a difference of about several percent (or about 10%).

[0053] Furthermore, in this specification, ordinal numbers such as "first" and "second" do not refer to the number or order of components unless otherwise specified, but are used for the purpose of avoiding confusion and distinguishing between components of the same type.

[0054] (Embodiment) Hereinafter, an information processing system according to the present embodiment will be described with reference to FIGS.

[0055] [1. Configuration of Information Processing System] First, the configuration of an information processing system according to this embodiment will be described with reference to Figs. 1 to 7. Fig. 1 is a schematic diagram showing the configuration of an information processing system 1 according to this embodiment. Fig. 2 is a block diagram showing the functional configuration of an automatic action generation device 10 according to this embodiment. Note that Figs. 1 and 2 show exemplary functional configurations of the information processing system 1 and the automatic action generation device 10, and the functional configurations of the information processing system 1 and the automatic action generation device 10 are not limited to those shown in Figs. 1 and 2.

[0056] As shown in Figures 1 and 2, the information processing system 1 includes an automatic action generation device 10, a log generation source device 20A, an alert generation source device 20B, an action execution device 30, a first storage device 40, a second storage device 50, a third storage device 60, a fourth storage device 70, a fifth storage device 80, and a module group 90.

[0057] The automatic action generation device 10 is an example of an action generation device, and is an information processing device that, upon receiving an alert log L from the alert source device 20B, automatically generates an action to address the received alert log L. The action includes processing for causing a group of modules 90 installed in the target facility to execute the action in response to the alert. The automatic action generation device 10 does not use a playbook used in SOAR, but instead generates a query for generating an action to address the alert each time an alert is detected, and generates action content using the query. Such an automatic action generation device 10 can reduce the burden on a person creating a playbook. Furthermore, because the automatic action generation device 10 determines action content each time using a query, it is possible to automatically generate actions for alerts that cannot be addressed by SOAR, and actions to be executed after SOAR has addressed the alert. The action content includes information indicating which module should be operated with what input (e.g., control content) in response to the alert.

[0058] The automatic action generation device 10 is located remotely from the facility to be monitored. The facility may be, for example, a disaster prevention center or an office building, but may also be a non-residential facility such as a store, school, welfare facility, commercial complex, hospital, or factory. The facility may also be a residential facility such as a detached house or an apartment building. The automatic action generation device 10 is communicably connected to each of the alert source device 20B, the first storage device 40, the second storage device 50, the third storage device 60, the fourth storage device 70, the fifth storage device 80, and the module group 90. The communication method is not particularly limited, and may be wireless or wired communication.

[0059] As shown in FIG. 2 , the automatic action generation device 10 includes, as its functional configuration, a first acquisition unit 11, a second acquisition unit 12, an integrated query generation unit 13, an action generation unit 14, a determination unit 15, and an execution unit 16. The automatic action generation device 10 also includes, as its hardware configuration, a non-volatile memory in which a program is stored, a volatile memory that is a temporary storage area for executing the program, an input / output port, a communication interface, a processor that executes the program, and the like. The memory may be a read-only memory (ROM) or a random access memory (RAM), and can store a program to be executed by the processor. The first acquisition unit 11, the second acquisition unit 12, the integrated query generation unit 13, the action generation unit 14, the determination unit 15, and the execution unit 16 are realized by a processor that executes a program stored in the memory, and the like. The automatic action generation device 10 may be realized by a mobile terminal such as a stationary PC (Personal Computer), a smartphone, a tablet, etc., a dedicated computer, etc., or may be realized by a server (e.g., a cloud server), or may be realized by a combination of these.

[0060] The first acquisition unit 11 is a communication interface that enables the automatic action generation device 10 to communicate with the alert generation device 20B, and acquires an alert log L that indicates an alert detected in the target facility from the alert generation device 20B. The first acquisition unit 11 may acquire the alert log L directly from the alert generation device 20B, or may acquire the alert log L via another device. The first acquisition unit 11 is configured to include, for example, a communication circuit (or a communication module), but is not limited to this.

[0061] The second acquisition unit 12 is a communication interface for the automatic action generation device 10 to communicate with the first storage device 40, the second storage device 50, and the third storage device 60, and acquires response policy information 41 from the first storage device 40, asset information 51 from the second storage device 50, and module information 61 from the third storage device 60. The second acquisition unit 12 may acquire various pieces of information directly from the first storage device 40, the second storage device 50, and the third storage device 60, or may acquire various pieces of information via other devices. The second acquisition unit 12 is configured to include, for example, a communication circuit (or a communication module), but is not limited to this.

[0062] The second acquisition unit 12 is only required to acquire at least the asset information 51 and the module information 61. The handling policy information 41, the asset information 51, and the module information 61 will be described later.

[0063] The integrated query generator 13 is an example of a query generator, and generates a first query for acquiring an action for an alert based on at least the alert log L (alert information), asset information 51, and module information 61. In this embodiment, the integrated query generator 13 generates the first query further based on the response policy information 41 and history log information 71 of the target facility. The asset information 51 and module information 61 are information used to specify the action. The response policy information 41 is information used to improve the accuracy of the action.

[0064] Furthermore, the integrated query generation unit 13 further generates a second query for determining whether or not the action acquired using the first query can be executed, based on the action acquired using the first query. Note that it is sufficient for the integrated query generation unit 13 to generate at least the first query.

[0065] The response policy information 41, asset information 51, and module information 61 are different for each target facility (each system of the target facility). The system of the target facility is, for example, an IoT (Internet of Things) system.

[0066] The action generation unit 14 generates a first action for the alert based on the first query. The action generation unit 14 inputs the first query to the language model 81, and thereby obtains the first action as an output of the language model 81. Since the first query may include a constraint condition for the action, the action generated by the action generation unit 14 may be an action that satisfies the constraint condition.

[0067] The determination unit 15 is a processing unit that determines whether or not the action generated by the action generation unit 14 may be executed. The determination unit 15 determines whether or not the action generated using the first query may be executed based on, for example, whether or not the action violates the response policy of the target facility, whether or not the system of the target facility will be affected, and if so, the degree of such impact. The determination unit 15 determines whether or not the action generated by the action generation unit 14 may be executed based on the second query. The determination unit 15 inputs the second query to the language model 81, and acquires a determination result as an output of the language model 81. The determination result includes whether or not the action is executable (for example, whether or not it is executable immediately), whether or not the execution should be delayed (if delayed, by how long), whether or not the action is not executable, etc.

[0068] The execution unit 16 is a processing unit that executes processing according to the determination result of the determination unit 15. When the determination unit 15 determines that an action is executable, the execution unit 16 outputs a control signal for executing the action to the target module.

[0069] The administrator (user) of the information processing system 1 can register in advance what response policy will be used to respond to asset information and module information of the target facility, allowing the automatic action generation device 10 to generate actions based on the response policy.

[0070] The log source device 20A is a facility device installed in the target facility. Examples of the facility device include, but are not limited to, air conditioning devices, lighting devices, and access control devices. Control devices, server devices, and communication devices are examples of the facility device. The facility device outputs log information to the alert source device 20B.

[0071] The alert source device 20B monitors the network of the target facility based on log information from equipment devices installed in the target facility, and automatically detects and notifies of threats to the target facility. The alert source device 20B sends an alert log L including information about the detected threat to the automatic action generation device 10, but may also send it to the action execution device 30, for example. The alert log L is an example of alert information.

[0072] The threats include, for example, cybersecurity threats such as cyberattacks and malware infections. The alert generation source device 20B is configured to be able to detect incidents such as cyberattacks and malware infections. The alert generation source device 20B may be realized by a security information and event management (SIEM), an intrusion detection system (IDS), or the like.

[0073] The action execution device 30 generates an action for an alert using an automation tool such as SOAR (for example, using a playbook). The action generated by the action execution device 30 is stored in the fourth storage device 70 as history log information 71.

[0074] The first storage device 40 stores response policy information 41 including a response policy. The response policy information 41 is created, for example, for each target facility. The response policy is applied to the entire system (each facility device in the system) within the target facility. The response policy information 41 may be created, for example, by a user of the information processing system 1. Fig. 3 is a diagram showing an example of the response policy information 41 according to this embodiment.

[0075] As shown in FIG. 3, the response policy information 41 includes a response policy for an alert and a response postponement / cancellation condition.

[0076] The response policy includes a policy for the target facility regarding the execution of actions in response to alerts. In the example of Fig. 3, the response policy includes execution conditions for executing an action, such as requiring user confirmation when executing a specific category of action (e.g., a response action or an investigation action) on a specific facility device, and that the action must be immediately executable. The response policy may also include prohibitions, such as not performing a specific category of action on a specific facility device.

[0077] For example, if the response policy includes "1. Prompt the user for confirmation before taking direct action against ICONT," the action generation unit 14 can generate an action to confirm with the user before executing a specific action. In this way, when a specific action is to be executed, an action can be generated to inquire with the user in advance and obtain permission. For example, an action can be generated in which a text message is generated using a communication tool asking if there is a problem with the action being taken and sent to the user. Note that ICONT is a controller that controls the input and output of the BACnet system.

[0078] The response deferral / cancellation conditions include at least one of grace information for deferring the execution of an action in response to an alert and a cancellation condition for canceling the action. The grace information includes a grace period for deferring the execution of an action, such as refraining from taking a response action on an equipment device for a predetermined time (e.g., 10 seconds) after a packet from that equipment device is observed, and conditions for deferring the response. The conditions for deferring the response may be set, for example, based on prohibitions in the specifications of the equipment device. The cancellation conditions include conditions for canceling the execution of an action. The response deferral / cancellation conditions are set, for example, to prevent the execution of an action by one equipment device from affecting the functions of other equipment devices.

[0079] The response policy information 41 may include at least one of a response policy and a response postponement / cancellation condition. For example, the response policy information 41 may include at least a response policy.

[0080] Referring again to FIGS. 1 and 2, the second storage device 50 stores asset information 51. The asset information 51 includes information on each equipment device installed in the target facility. The asset information 51 includes, for example, at least one of a device list, communication flow information, and information indicating a network configuration. Specific examples of the asset information 51 will be described with reference to FIGS. 4 to 6C. FIGS. 4 to 6C are diagrams showing examples of the asset information 51 according to this embodiment. FIG. 4 shows an example of a device list 51a, which is an example of the asset information 51.

[0081] 4, the device list 51a includes the type (Device Name), IP address (IP addr), MAC address (MAC addr), device role (Role), and location (Location) of the facility equipment installed in the target facility. Note that hereinafter, the facility equipment will also be referred to as a device.

[0082] Since the device list 51a includes the device type and role, it is possible to estimate what impact the target facility will have if an action such as stopping the device is executed. Furthermore, since the device list 51a includes addresses such as IP addresses, it is possible to estimate what impact the target facility will have if communication is stopped. By estimating the impact, it is possible to generate, for example, an action that will have minimal impact on the target facility.

[0083] In the example of FIG. 4, the target facility (for example, the facility where the alert occurred) is a disaster prevention center (Building Safety Control Center).

[0084] 5 shows an example of communication flow information 51b, which is an example of asset information 51. The communication flow information 51b shows a log of communication between devices.

[0085] 5, the communication flow information 51b includes a source IP address (Src IP address), a destination IP address (Dst IP address), a communication protocol (Application Protocol), a port number and protocol (Port / Protocol), and a communication usage (Usage). The communication usage includes, for example, monitoring, control, etc.

[0086] The communication flow information 51b can be used to identify which device is communicating with which device and for what purpose. For example, if an action is taken to stop communication from the source address to the destination address shown in No. 1, it can be estimated that monitoring and control will be affected. For example, when the communication flow information 51b is included, the action generation unit 14 can generate an action that will have a smaller impact on the target facility.

[0087] 6A shows an example of routing information 51c in the information indicating the network configuration according to this embodiment. The routing information 51c is information indicating what kind of routing is required to enable communication between segments.

[0088] 6A, the routing information 51c includes a destination IP address (Destination), a mask value (Netmask) for extracting a network address from the IP address, a destination IP address to be forwarded next (Next hop Address), a port (Interface), a communication priority (Metric), and a route setting method (Method). In the route setting method, Connected means that a network connection is automatically established by specifying an IP address, route information, etc., and static means that the user manually sets the optimal route to the destination network.

[0089] FIG. 6A shows that a packet (packet from another segment) with a source IP address (192.168.1.0) and a mask value (255.255.255.0) is to be forwarded to the eth1 interface.

[0090] 6B is a diagram showing an example of firewall setting information 51d in the information indicating the network configuration according to the present embodiment. Firewall setting information 51d includes firewall settings for blocking specific packets in a communicable network, and specifically indicates what packets are to be filtered.

[0091] As shown in FIG. 6B , the firewall setting information 51d includes a source IP address (Src IP Address), a destination IP address (Dst IP Address), a protocol (Protocol), a source port (Src Port), a destination port (Dst Port), and whether communication is permitted (Action). In the example of FIG. 6B , communication from the source IP address "192.168.1.*" to the destination IP address "192.168.*" is denied. Also, in the example of FIG. 6B , communication from the source IP address "192.168.1.*" to the destination ports "53, 80, 8080" using the "TCP" protocol is permitted.

[0092] 6A and 6B, it is possible to know which packets can communicate and which packets cannot communicate in the target facility. By knowing which devices cannot communicate with each other, the action generation unit 14 can determine that no action is required for the devices that cannot communicate with each other.

[0093] For example, if suspicious communication using the HTTP protocol is detected, the action generation unit 14 may automatically generate an action that rewrites the firewall setting information 51d to block HTTP packets. This would result in blocking communication No. 1 shown in FIG. 5, which could potentially affect the operation of the facility. Since it is better not to block HTTP packets, for example, the action generation unit 14 may generate another action that does not block HTTP packets.

[0094] 6C is a diagram showing visualization information 51e that visualizes the network configuration in the information showing the network configuration according to this embodiment. In this way, the visualization information 51e showing the network configuration may be used as information showing the communication status between devices. This makes it possible to easily grasp, for example, whether communication between devices is possible, the connection relationship, etc.

[0095] In this way, by generating actions using asset information 51, actions can be generated that reflect what actions are actually effective when taking action, and what areas need to be taken with care.

[0096] 1 again, the third storage device 60 stores module information 61. Fig. 7 is a diagram showing an example of the module information 61 according to this embodiment.

[0097] 7, the module information 61 includes information about each module installed in the facility that can be used to handle alerts. Specifically, the module information 61 includes information indicating what actions each module can perform ("description": "This module can be used when...").

[0098] 7, id1 is information about a module "EDR_A" in which EDR (Endpoint Detection and Response) has been installed. Thus, the module information 61 includes information indicating which of the modules has EDR installed. Furthermore, EDR_A can execute commands such as those for extracting logs.

[0099] id2 is information relating to the module "IDS_A" that has the IDS function. In this way, the module information 61 includes information indicating which of the modules has the IDS function.

[0100] Id3 is information relating to the communication tool "team_communication_tool_A." The communication tool may be, for example, a chat tool.

[0101] In this way, the module information 61 includes information indicating which EDR products are installed in the target facility, which IDS is monitoring the network, which communication tools are available, etc. This information may differ for each target facility. Since different modules are available for each monitored system (e.g., disaster prevention system), module information 61 exists for each system (e.g., each target facility).

[0102] The alert information includes information indicating which system (for example, which target facility) the alert occurred in. This allows the automatic action generation device 10 to identify the module information 61 of the target facility where the alert was detected from the module information 61 of each of the multiple target facilities.

[0103] 1 , the fourth storage device 70 stores history log information 71. The history log information 71 includes a history of what actions were taken in response to past alerts and which modules were used. The history includes, for example, messages sent to users as actions, reply messages received from users in response to those actions, and, if firewall settings were changed, how they were changed.

[0104] The history log information 71 may include information indicating the history of actions taken in response to alerts that were previously executed by the action execution device 30. In other words, the history log information 71 may include information such as the content of past SOAR processing, the actions executed, and the execution results. The history log information 71 may include processing in a predetermined playbook and the results of the processing, and may include, for example, a past action sequence and execution log. The history log information 71 may be, for example, information in which alert information is associated with information indicating executed actions. The history log information 71 may also include information indicating the history of actions that were previously generated and executed by the automatic action generation device 10.

[0105] The fifth storage device 80 stores a language model 81. The language model 81 is, for example, a Large Language Model (LLM) that has been adjusted using a large amount of text data, such as a Generative Pre-trained Transformer (GPT). The LLM is a machine learning model that has the function of outputting sentences that are likely to follow an input sentence, and is capable of outputting very natural sentences by adjusting a large number of internal parameters using a huge amount of training data. In this embodiment, the LLM may be a machine learning model trained on a general dataset. In the present disclosure, at least asset information 51 and module information 61 are input to the machine learning model, so even an LLM trained on a general dataset can produce accurate output (action generation). Note that the language model 81 may be a machine learning model trained specifically for this purpose.

[0106] The language model 81 used by the action generation unit 14, i.e., the language model 81 into which the first query is input, and the language model 81 used by the determination unit 15, i.e., the language model 81 into which the second query is input, may be a common language model or may be different language models.

[0107] At least one of the action generation unit 14 and the determination unit 15 may use a technique (so-called RAG (Retrieval-Augmented Generation)) that improves answer accuracy by combining text generation using LLM with a search for external information.

[0108] The first storage device 40 to the fifth storage device 80 are realized by, but not limited to, semiconductor memories or HDDs (Hard Disk Drives).

[0109] The module group 90 is made up of modules that can be used to deal with alerts provided in the target facility. The module group 90 is configured to include a plurality of modules, including, for example, a first module 91 and a second module 92, but the number of modules included in the module group 90 is not particularly limited.

[0110] 2. Operation of Information Processing System Next, the operation of the information processing system 1 configured as described above will be described with reference to Figs. 8 to 11. Fig. 8 is a flowchart showing the operation (action generation method) of the information processing system 1 according to this embodiment. Figs. 8 and 9 explain the operation executed by the automatic action generation device 10.

[0111] 8, the first acquisition unit 11 of the automatic action generation device 10 receives a trigger event for generating an action (S10). The first acquisition unit 11 acquires, for example, alert information from the alert source device 20B as the trigger event. Note that the trigger event is not limited to the acquisition of alert information (i.e., the occurrence of an alert), and may be, for example, the arrival of a predetermined timing.

[0112] Next, the automatic action generation device 10 performs automatic action generation and execution processing (S20). When an alert occurs in, for example, SIEM, IDS, or the like, the automatic action generation device 10 executes step S20.

[0113] Fig. 9 is a flowchart showing detailed operations (action generation method) of step S20 shown in Fig. 8. The operations shown in Fig. 9 may be executed after an alert is detected by the alert source device 20B but before any operation is performed by the action execution device 30, or may be executed after an alert is detected by the alert source device 20B and an operation (action determined by a playbook) is performed by the action execution device 30.

[0114] 9 , the integrated query generation unit 13 collects log information of a trigger event (S21). For example, the integrated query generation unit 13 may read log information of the same trigger event as the trigger event acquired in step S10 from the fourth storage device 70. For example, if the trigger event is an abnormality in the air conditioning equipment, the integrated query generation unit 13 reads the abnormality in the air conditioning equipment from among the trigger events stored in the fourth storage device 70 as log information.

[0115] Next, the integrated query generation unit 13 collects past history log information 71 corresponding to the log information of the trigger event (S22). For example, if the trigger event is an abnormality in the air conditioning equipment, the integrated query generation unit 13 acquires history log information 71 including past actions corresponding to the abnormality in the air conditioning equipment from the fourth storage device 70. Note that steps S21 and S22 do not necessarily have to be executed.

[0116] Next, the second acquisition unit 12 acquires the handling policy information 41, the asset information 51, and the module information 61 (S23). The second acquisition unit 12 acquires the handling policy information 41 from the first storage device 40, the asset information 51 from the second storage device 50, and the module information 61 from the third storage device 60. Note that in step S23, it is sufficient if at least the asset information 51 and the module information 61 are acquired.

[0117] Next, the integrated query generation unit 13 generates a query (first query) using the acquired information in order to generate an action for the trigger event (S24). In this embodiment, the integrated query generation unit 13 generates a query for acquiring the next action to be executed using the response policy information 41, asset information 51, module information 61, and history log information 71.

[0118] 10 is a diagram showing an example of a query (first query) for generating an action according to this embodiment. The query shown in FIG. 10 is generated by the integrated query generation unit 13.

[0119] As shown in FIG. 10, the first query includes a command statement indicating that an action is to be generated and the output format of the action, as well as various information.

[0120] In FIG. 10, the command statement includes "Generate an action for the next alert based on the following conditions. However, the generated action should be output in the form of a module to be used and an input for the module to be used."

[0121] The first query also includes alert information text as alert information, and device information (device list 51a), communication flow information 51b, and network configuration information (routing information 51c, firewall setting information 51d, and visualization information 51e) as asset information 51. The first query also includes policy (handling policy information 41) as policy, past handling history (history log information 71) as past handling history, and module information 61 as module parameters.

[0122] In this way, the integrated query generator 13 generates a first query including the response policy information 41 , the asset information 51 , and the module information 61 .

[0123] 9 again, the action generation unit 14 then inputs the first query into the language model 81 to obtain output information corresponding to the alert information. The output information may include a next action to be executed, or may include information indicating that there is no next action to be executed if there is no next action to be executed. Therefore, upon obtaining the output information, the action generation unit 14 determines whether there is a next action to be executed (S25). If the action generation unit 14 determines that there is a next action to be executed (YES in S25), the process proceeds to step S26. If the action generation unit 14 determines that there is no next action to be executed (NO in S25), the process ends in step S20.

[0124] In the following example, an action is taken that involves executing module "XXX" with inputs (A, B, C).

[0125] Next, the integrated query generation unit 13 generates a query (second query) for determining whether the action acquired using the first query can be executed (S26). The executable status includes whether the action can be executed immediately, whether the action can be executed after a grace period has elapsed, whether the action cannot be executed, and the like. The integrated query generation unit 13 generates the second query using the specification information of the facility device in addition to the response policy information 41, asset information 51, and module information 61. The specification information is information created by the manufacturer of the facility device and includes information on the device's functions, performance, constraints, and the like. For example, the specification information includes prohibited actions for the facility device. Prohibited actions include, for example, actions that may cause a failure of the facility device (e.g., not canceling an action that is specified by the specifications and is currently being executed), actions that should not be executed at that timing (e.g., executing action B 10 seconds or more after executing action A), and the like. The specification information is publicly available information.

[0126] FIG. 11 is a diagram showing an example of a query (second query) for determining whether or not an action can be executed according to this embodiment.

[0127] As shown in FIG. 11, the second query includes a command statement indicating whether or not execution is to be determined, and various information.

[0128] In FIG. 11, the command statement includes "Please determine whether there is any violation of policy or whether there is a need for postponement of execution when executing module "XXX" with inputs (A, B, C)."

[0129] The second query also includes, as asset information 51, device information (device list 51a), communication flow information 51b, and network configuration information, as well as specification information for the module. The second query also includes, as policy, policy (action policy information 41), and as module information, module information 61. The device list 51a, communication flow information 51b, network configuration information, and module information 61 may be the same information as in the first query. Furthermore, since the second query is intended to confirm the impact on facility devices when an action is executed, alert information and past action history are not included in the second query.

[0130] In this way, the integrated query generator 13 generates a second query that includes the specification information of the module on which the action is to be executed, in addition to the response policy information 41, asset information 51, and module information 61. The second query is used to obtain a determination result as to whether the action should be executed immediately, whether to execute the action after waiting, or whether the action cannot be executed, taking into consideration whether the acquired action violates the response policy information 41, the extent of the impact on the system of the target facility, etc. Furthermore, whether to execute the action immediately also includes whether to execute the action even if it stops the normal operation of existing facility devices.

[0131] 9 again, next, the determination unit 15 determines whether or not the action can be executed using the second query (S27). The determination unit 15 inputs the second query into the language model 81, and thereby obtains output information corresponding to the obtained action. The output information includes a determination result as to whether the action should be executed immediately, executed after a delay, or not executed.

[0132] If the determination unit 15 determines that the task is not immediately executable (NO in S28), that is, if the output information does not indicate that the task is immediately executable, it further determines whether the execution should be delayed or whether the task is not executable (S29).

[0133] Next, if the determination unit 15 determines to delay (delay in S29), that is, if the output information includes a delay in execution, the execution unit 16 waits according to the condition (S30) and executes the action after waiting (S32). The execution unit 16 executes the action after a predetermined time (grace time) included in the output information has elapsed. In step S29, it is determined that the action should be delayed if it is better to execute the acquired action in the first query, but if the action is executed immediately due to constraints such as a response policy, there is a possibility that the system of the target facility will malfunction.

[0134] Furthermore, if the determination unit 15 determines that the action can be immediately executed (YES in S28), that is, if the output information indicates that the action can be immediately executed, the execution unit 16 executes the action (S32). A log of the action executed in step S32 is added to the history log information 71.

[0135] Next, the integrated query generation unit 13 generates a query (third query) using the information to which the log of the action executed in step S32 has been added (S33), and proceeds to step S25. This allows the action generation unit 14 to obtain whether there is an action to be executed next to the executed action, and if so, what kind of action it is.

[0136] Furthermore, if the determination unit 15 determines that the action is not executable (not executable in S29), that is, if the output information includes that the action is not executable, the determination unit 15 adds a log including the determination that the action is not executable to the history log information 71. If the action is not executable, information on the reason why the action cannot be executed is also included in the output information of the language model 81, and therefore the reason is also added to the history log information 71. Although it would be better to execute the acquired action in the first query, if there is a possibility that the system of the target facility will malfunction if the action is executed (for example, suddenly stopping the target equipment for which an alert has been detected) due to prohibitions in the response policy information 41, specification information, etc., the determination unit 15 determines that the action is not executable in step S29.

[0137] Next, the integrated query generation unit 13 generates a query (fourth query) using information to which a log including information indicating that the action was determined to be unexecutable has been added (S31), and proceeds to step S25. This allows the action generation unit 14 to determine whether there are any actions other than the action determined to be unexecutable, and if so, what kind of actions they are.

[0138] Note that an action inquiring about the current asset status may be generated as output information obtained by inputting the first query into the language model 81. For example, the asset status is used to determine whether an action should be prioritized even if it means stopping the normal operation of existing facility devices, or whether the action should be executed with a delay. Then, the integrated query generation unit 13 may generate a first query including, as a command statement, "Please generate an action according to the current asset status."

[0139] (Other Embodiments) While the action generation method according to one or more aspects has been described above based on the embodiments, the present disclosure is not limited to these embodiments. As long as it does not deviate from the spirit of the present disclosure, various modifications conceivable by a person skilled in the art to the present embodiments and embodiments constructed by combining components of different embodiments may also be included in the present disclosure.

[0140] For example, in the above embodiment, an example has been described in which separate queries are generated for action generation and execution feasibility, but a single query may be generated for acquiring the action and execution feasibility. The single query may be, for example, a query in which the specification information shown in FIG. 11 is added to the query shown in FIG. 10.

[0141] Furthermore, in the above embodiment, an example has been described in which language model 81 is used to generate an action and determine whether it is executable. However, for example, a table may be used to acquire the action and the determination result of whether it is executable. Even in this case, the action can be generated automatically because asset information 51 and module information 61 are used. The table includes a table in which first queries are associated with the content of the action, and a table in which second queries are associated with the determination result of whether it is executable.

[0142] Furthermore, in the above embodiment, an example was described in which the automatic action generation device 10 and the first storage device 40 to the fifth storage device 80 are separate devices, but this is not limited to this, and at least one of the first storage device 40 to the fifth storage device 80 may be configured integrally with the automatic action generation device 10.

[0143] In the above embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0144] The order in which the steps in the flowchart are executed is merely an example for specifically explaining the present disclosure, and other orders may be used. Some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0145] The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or time-shared by a single piece of hardware or software.

[0146] Furthermore, the automatic action generation device 10 according to the above embodiment may be realized as a single device, or may be realized by multiple devices. When the automatic action generation device 10 is realized by multiple devices, the components of the automatic action generation device 10 may be distributed in any manner among the multiple devices. When the automatic action generation device 10 is realized by multiple devices, the communication method between the multiple devices is not particularly limited, and may be wireless communication or wired communication. Furthermore, wireless communication and wired communication may be combined between the devices.

[0147] Furthermore, each component described in the above embodiments may be implemented as software or, typically, as an LSI, which is an integrated circuit. These components may be individually integrated into a single chip, or some or all of them may be integrated into a single chip. While the term "LSI" is used here, it may also be referred to as an IC, system LSI, super LSI, or ultra LSI depending on the level of integration. Furthermore, the integrated circuit implementation is not limited to LSIs; it may also be implemented using dedicated circuits (general-purpose circuits that execute dedicated programs) or general-purpose processors. It is also possible to use FPGAs (Field Programmable Gate Arrays), which can be programmed after LSI fabrication, or reconfigurable processors, which allow the connection or settings of circuit cells within an LSI to be reconfigured. Furthermore, if an integrated circuit technology that replaces LSIs emerges due to advances in semiconductor technology or other derivative technologies, it is natural that such technology may be used to integrate the components.

[0148] A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple processing units on a single chip, and is specifically a computer system comprising a microprocessor, ROM, RAM, etc. The ROM stores computer programs. The system LSI achieves its functions when the microprocessor operates in accordance with the computer programs.

[0149] Furthermore, one aspect of the present disclosure may be a computer program that causes a computer to execute each of the characteristic steps included in the action generation method shown in FIG. 8 or FIG.

[0150] Furthermore, for example, the program may be a program to be executed by a computer. Another aspect of the present disclosure may be a computer-readable non-transitory recording medium on which such a program is recorded. For example, such a program may be recorded on a recording medium and distributed or circulated. For example, the distributed program may be installed in a device having another processor, and the program may be executed by the processor, thereby causing the device to perform each of the above processes.

[0151] The present disclosure is useful for an information processing device or the like that deals with a detected security alert.

[0152] 1 Information processing system 10 Automatic action generation device (action generation device) 11 First acquisition unit 12 Second acquisition unit 13 Integrated query generation unit (query generation unit) 14 Action generation unit 15 Determination unit 16 Execution unit 20A Log generation source device 20B Alert generation source device 30 Action execution device 40 First storage device 41 Response policy information 50 Second storage device 51 Asset information 51a Device list 51b Communication flow information 51c Routing information 51d Firewall setting information 51e Visualization information 60 Third storage device 61 Module information 70 Fourth storage device 71 History log information 80 Fifth storage device 81 Language model 90 Module group 91 First module 92 Second module L Alert log (alert information)

Claims

1. An action generation method comprising: acquiring alert information including an alert detected in a target facility; acquiring asset information and module information for the target facility; generating a first query for acquiring a first action for the alert based on the acquired alert information, asset information, and module information; and generating the first action for the alert based on the first query.

2. The action generation method according to claim 1, further comprising: generating a second query based on the first action to determine whether the first action can be executed; obtaining a determination result of whether the first action can be executed based on the second query; and executing processing according to the determination result.

3. The action generation method according to claim 2, wherein the first action is executed if the determination result includes that the first action is executable.

4. The generation method according to claim 2 or 3, wherein if the determination result includes delaying execution, the first action is executed after a predetermined time has elapsed.

5. An action generation method as described in claim 3 or 4, which includes acquiring historical log information to which a log of the generated first action has been added, generating a third query for acquiring a second action to be executed next for the alert based on the acquired alert information, asset information, module information and historical log information, and generating the second action for the alert based on the third query.

6. An action generation method according to any one of claims 2 to 5, wherein, if the determination result includes that the first action cannot be executed, historical log information is acquired to which a notice that the first action cannot be executed is added, a fourth query is generated based on the acquired alert information, asset information, module information and historical log information to acquire a third action to be executed for the alert, and the third action for the alert is generated based on the fourth query.

7. The action generation method according to claim 1, further comprising: generating the first query for acquiring the first action for the alert and a determination result as to whether the first action can be executed based on the acquired alert information, asset information, module information, and specification information for the equipment device to be installed in the target facility; acquiring the first action for the alert and a determination result as to whether the first action can be executed based on the first query; and executing processing according to the determination result.

8. The action generation method according to any one of claims 1 to 7, further comprising generating the first query based on response policy information of the target facility.

9. The action generation method according to any one of claims 2 to 8, wherein the second query includes specification information of equipment to be installed in the target facility.

10. An action generation method according to any one of claims 1 to 9, wherein the asset information includes a device list of equipment installed in the target facility.

11. An action generation method according to any one of claims 1 to 10, wherein the asset information includes communication flow information between equipment devices installed in the target facility.

12. An action generation method according to any one of claims 1 to 11, wherein the asset information includes information indicating the network configuration of the target facility.

13. The action generation method according to any one of claims 1 to 12, wherein the module information includes information about modules that can be used as actions in response to alerts in the target facility.

14. An action generation method according to any one of claims 1 to 13, wherein the response policy information includes a response policy for an alert at the target facility.

15. An action generation method according to any one of claims 1 to 14, wherein the response policy information includes at least one of postponement information for postponing the execution of an action and a cancellation condition for canceling the action.

16. An action generation device comprising: a first acquisition unit that acquires alert information including an alert detected in a target facility; a second acquisition unit that acquires asset information and module information in the target facility; a query generation unit that generates a query to acquire an action for the alert based on the acquired alert information, asset information, and module information; and an action generation unit that generates the action for the alert based on the query.

17. A program for causing a computer to execute the action generation method according to any one of claims 1 to 15.

Images