Communication interpretation method, communication interpretation device, and program

Abstract

A communication interpretation method according to the present invention is executed by a computer. In said communication interpretation method, a communication packet is acquired by means of communication (S11), characteristic information indicating the characteristics of the communication is determined on the basis of the communication packet (S12), one or more pieces of additional information related to the characteristic information are identified on the basis of information different from the characteristic information (S13, S14), and interpretation information, which is the result of interpreting the communication packet and is indicated by natural language, is generated on the basis of the characteristic information and the one or more pieces of additional information (S15, S16).

Description

Communication interpretation method, communication interpretation device, and program

[0001] The present disclosure relates to a communication interpretation method, a communication interpretation device, and a program.

[0002] Non-Patent Document 1 discloses a technology that uses descriptions of alerts about cyber attacks that have occurred to classify the attacks into MITRE ATT&CK (registered trademark) tactics using a large-scale language model (LLM).

[0003] Reza Fayyazi and Shanchieh Jay Yang, “On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptions,” arXiv preprint arXiv:2308.11420, August 22, 2023.

[0004] The present disclosure provides a communication interpretation method that can interpret the contents of a communication packet in a natural language that is easy for humans to understand and generate interpretation information that allows a user to accurately grasp the meaning and intent of the communication.

[0005] A communication interpretation method according to one aspect of the present disclosure is a communication interpretation method executed by a computer, which acquires a communication packet via communication, determines feature information indicating characteristics of the communication based on the communication packet, identifies one or more pieces of additional information related to the feature information from information different from the feature information, and generates interpretation information expressed in natural language as a result of interpreting the communication packet based on the feature information and the one or more pieces of additional information.

[0006] These general or specific aspects may be realized by a device, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or may be realized by any combination of a device, a method, a system, an integrated circuit, a computer program, and a non-transitory recording medium.

[0007] The communication interpretation method according to the present disclosure can interpret the contents of communication packets in a natural language that is easy for humans to understand, and generate interpretation information that allows a user to accurately grasp the meaning and intent of the communication.

[0008] FIG. 1 is a diagram illustrating an example of the configuration of an information processing system to which a communication interpreter according to an embodiment is applied. FIG. 2 is a hardware configuration diagram of the communication interpreter according to the embodiment. FIG. 3 is a configuration diagram illustrating functional blocks of the communication interpreter according to the embodiment. FIG. 4 is a flowchart illustrating an example of a communication interpretation process of the communication interpreter according to the embodiment. FIG. 5 is a diagram illustrating an example of a process for identifying feature information and first additional information from a communication packet. FIG. 6 is a diagram illustrating an example of a process for identifying first additional information and second additional information based on feature information. FIG. 7 is a diagram illustrating an overall flow of a process for generating interpretation information from a communication packet. FIG. 8 is a diagram illustrating example data of a communication packet. FIG. 9 is a diagram illustrating example interpretation information. FIG. 10 is a diagram illustrating functional blocks of a communication interpreter according to a first modification. FIG. 11 is a diagram illustrating functional blocks of a communication interpreter according to a second modification. FIG. 12 is a flowchart illustrating an example of a generation process according to the second modification. FIG. 13 is a diagram illustrating an example of generating a context from multiple information sources. FIG. 14 is a diagram illustrating an example of an information search process according to a third modification.

[0009] (Knowledge that forms the basis of this disclosure) In industrial control systems (ICS), a variety of vendor-dependent protocols coexist, and in order to understand the meaning and intent of each communication content, it is necessary to refer to a combination of individual specifications, configuration files, protocol specifications, terminal information, etc. However, even if a communication packet that is the source of an alert is received, it is difficult to understand the meaning of the communication from that packet alone, and there are many cases where analysts at the SOC (Security Operation Center) misunderstand or are unable to understand the content, resulting in delayed initial responses.

[0010] In recent years, attempts have been made to automate the "semantic assignment" and "summarization" of communication content using large-scale language models (LLMs). However, simply inputting communication packets into a large-scale language model makes it difficult to obtain natural language output that takes into account the purpose and context of the target communication and its relationship with the underlying settings and specifications. In particular, the target communication packets contain multiple information items, such as protocol identifiers, object names, and function codes. Unless external information appropriate for each item is appropriately enriched (reinforced), the accuracy of interpretation by the large-scale language model will be significantly reduced.

[0011] Taking these points into consideration, the present disclosure establishes a series of processes that appropriately combine and enrich feature information obtained from communication packets with related additional information (specifications, configuration, history, etc.), and generates output (interpretation information) that is interpreted in natural language using a large-scale language model, thereby enabling assistance in accurately understanding the content and intent of ICS communications without relying on the skills or knowledge of the analyst.

[0012] A communication interpretation method according to a first aspect of the present disclosure is a communication interpretation method executed by a computer, which acquires a communication packet via communication, determines feature information indicating features of the communication based on the communication packet, identifies one or more pieces of additional information related to the feature information from information different from the feature information, and generates interpretation information expressed in natural language as a result of interpreting the communication packet based on the feature information and the one or more pieces of additional information.

[0013] This makes it possible to interpret the contents of communication packets in a natural language that is easy for humans to understand, allowing the meaning and intent of the communication to be accurately grasped.

[0014] A communication interpretation method according to a second aspect of the present disclosure is a communication interpretation method according to the first aspect, wherein the communication characteristics include one or more types of information contained in the communication packet, and the identification involves identifying additional information corresponding to each of the one or more types.

[0015] Therefore, it is possible to refer to additional information appropriate for each of the multiple types of communication packets included in the communication packets, thereby improving the accuracy of interpretation.

[0016] A communication interpretation method according to a third aspect of the present disclosure is the communication interpretation method according to the second aspect, wherein the identification switches a method for identifying additional information corresponding to the type depending on the type.

[0017] This makes it possible to select the optimum method of identifying information according to the characteristics of each type, and to efficiently obtain additional information suitable for interpreting the meaning of characteristic information.

[0018] A communication interpretation method according to a fourth aspect of the present disclosure is a communication interpretation method according to the third aspect, wherein, in the identification, if the type is associated with first additional information by a predetermined correspondence relationship, the first additional information is identified as additional information corresponding to the type, and information different from the feature information includes the correspondence relationship.

[0019] Therefore, when there is a predetermined correspondence, highly reliable additional information can be acquired, and processing can be speeded up and stabilized.

[0020] A communication interpretation method according to a fifth aspect of the present disclosure is the communication interpretation method according to the fourth aspect, wherein, in the identification, if the type is not associated with the first additional information by a predetermined correspondence relationship, the second additional information is identified as the additional information corresponding to the type by searching multiple knowledge bases containing specification information regarding communication using RAG (Retrieval-Augmented Generation), and information different from the feature information is included in the multiple knowledge bases.

[0021] This allows necessary additional information to be dynamically acquired by performing a search using RAG even when the correspondence relationship has not been defined in advance.

[0022] A communication interpretation method according to a sixth aspect of the present disclosure is a communication interpretation method according to the fifth aspect, further comprising generating an additional correspondence relationship that associates the second additional information obtained by the search using the RAG with the type used in the search using the RAG, and adding the additional correspondence relationship to the correspondence relationship.

[0023] Therefore, the relationship between the newly acquired additional information and the type can be recorded, and future processing efficiency can be improved.

[0024] A communication interpretation method according to a seventh aspect of the present disclosure is a communication interpretation method according to any one of the first to sixth aspects, wherein the acquiring step further includes acquiring an alert issued when an abnormality is detected in the communication of the communication packet, and the determining step further includes determining the characteristic information based on the alert.

[0025] This allows alerts based on abnormality detection to be reflected in determining characteristic information, allowing more important communications to be interpreted with priority.

[0026] A communication interpretation method according to an eighth aspect of the present disclosure is a communication interpretation method according to any one of the first to seventh aspects, wherein the determination involves determining the feature information by inputting the communication packet into a learning model, and the learning model is a model obtained by machine learning based on past communication packets acquired in the past and features related to the anomaly identified based on past alerts issued when an anomaly was detected in the communication of the past communication packet.

[0027] This allows for the extraction of feature information that accurately indicates the meaning and intent of the current communication packet using a learning model that reflects past communication history and alerts, leading to a more appropriate understanding of the communication content in subsequent interpretation processing.

[0028] A communication interpretation method according to a ninth aspect of the present disclosure is a communication interpretation method according to any one of the first to eighth aspects, wherein the generation comprises summarizing the feature information and the one or more additional information, and inputting the summarized information obtained by summarizing into a large-scale language model, thereby generating the interpretation information.

[0029] This allows the key points of the feature information and one or more pieces of additional information to be appropriately extracted and summarized, and then input into a large-scale language model, thereby ensuring clarity and conciseness of the interpretation information.

[0030] A communication interpretation method according to a tenth aspect of the present disclosure is the communication interpretation method according to the ninth aspect, wherein the summary information includes information obtained by summarizing multiple pieces of information from among the feature information and the one or more pieces of additional information.

[0031] Therefore, by summarizing multiple pieces of information, it becomes easier for large-scale language models to properly grasp the context, and the consistency of the natural language interpretation information output can be improved.

[0032] A communication interpretation method according to an eleventh aspect of the present disclosure is a communication interpretation method according to the ninth or tenth aspect, wherein in the generation, the importance of information to be included in the summary information is set based on the feature information, and the summary information is generated so that the higher the importance, the more information is included.

[0033] This allows more important information based on the content of the communication packets to be reflected in the summary information, thereby improving the accuracy and expressiveness of the interpretation results obtained by the large-scale language model.

[0034] A communication interpretation method according to a twelfth aspect of the present disclosure is a communication interpretation method according to any one of the first to eleventh aspects, wherein the acquiring step further acquires additional communication packets; the determining step further determines additional feature information indicating features of the communication based on the additional communication packets, and identifies one or more additional pieces of information related to the additional feature information from information different from the additional feature information; and the generating step generates the interpretation information based on the feature information, the one or more pieces of additional information, the additional feature information, and the one or more pieces of additional additional information.

[0035] This makes it possible to generate consistent interpretation information that reflects the context based on comprehensive feature information and additional information covering a plurality of communication packets.

[0036] A communication interpretation method according to a thirteenth aspect of the present disclosure is a communication interpretation method according to any one of the first to twelfth aspects, wherein, in the identification, if the one or more additional pieces of information are insufficient, the user is requested to provide additional information necessary to identify the one or more pieces of additional information, and when the additional information is obtained from the user, the one or more pieces of additional information are identified by further identifying additional additional information based on the additional information.

[0037] This allows interpretation information to be generated after appropriate supplementation is made, reflecting additional information from the user, even if one or more pieces of additional information are insufficient, thereby enabling interpretation information to be generated with higher accuracy.

[0038] A communication interpretation method according to a fourteenth aspect of the present disclosure is a communication interpretation method according to any one of the first to thirteenth aspects, wherein the generation includes generating a prompt for generating the interpretation information based on the communication type of the communication packet and the one or more pieces of additional information, and inputting the generated prompt into a large-scale language model to generate the interpretation information.

[0039] This allows the large-scale language model to provide prompts optimized for the content and context of the communication, thereby enabling more accurate generation of natural language interpretation information that is in line with the meaning and intent of the communication.

[0040] A communication interpretation method according to a fifteenth aspect of the present disclosure is a communication interpretation method according to any one of the first to fourteenth aspects, further comprising receiving feedback from a user regarding the interpretation information, and updating a large-scale language model for generating the interpretation information based on the received feedback.

[0041] This allows the model to be continuously improved based on user feedback, thereby improving the quality of interpretation information throughout operation.

[0042] A communication interpretation device according to a sixteenth aspect of the present disclosure includes a processor and a memory, wherein the processor uses the memory to acquire a communication packet through communication, determine feature information indicating a feature of the communication based on the communication packet, identify one or more pieces of additional information related to the feature information from information different from the feature information, and generate interpretation information expressed in natural language as a result of interpreting the communication packet based on the feature information and the one or more pieces of additional information.

[0043] This makes it possible to interpret the contents of communication packets in a natural language that is easy for humans to understand, allowing the meaning and intent of the communication to be accurately grasped.

[0044] A program according to a seventeenth aspect of the present disclosure is a program for causing a computer to execute the communication interpretation method according to any one of the first to fifteenth aspects.

[0045] These general or specific aspects may be realized by a device, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or may be realized by any combination of a device, a method, a system, an integrated circuit, a computer program, and a non-transitory recording medium.

[0046] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, more detailed explanation than necessary may be omitted. For example, detailed explanation of well-known matters or redundant explanation of substantially the same configuration may be omitted. This is to avoid unnecessary redundancy in the following explanation and to facilitate understanding by those skilled in the art.

[0047] The inventors have provided the accompanying drawings and the following description to enable those skilled in the art to fully understand the present disclosure, and do not intend for them to limit the subject matter described in the claims.

[0048] (Embodiment) "Configuration" FIG. 1 is a diagram showing an example of the configuration of an information processing system to which a communication interpretation device according to an embodiment is applied.

[0049] 1 shows a configuration in which devices and equipment located in a factory a and devices and equipment located in a factory b are communicably connected to a communication interpretation device 30 via a network 10. Note that the devices and equipment appearing in FIG. 1 are not limited to those located in a factory, and may be located in various other facilities, such as buildings, logistics facilities, research facilities, stores, hospitals, etc.

[0050] In the factory a, a group of devices in a first group 11, a group of devices in a second group 12, and an abnormality detection device 20a are arranged.

[0051] The device group of the first group 11 includes at least a communication control device 11a, an IT device 11b, and an IT device 11c. In the first group 11, the communication control device 11a is connected to the IT device 11b and the IT device 11c so that they can communicate with each other. Note that the device group of the first group 11 includes multiple IT devices 11b and 11c, but is not limited to this, and may also include one IT device. The one IT device may be the IT device 11b or the IT device 11c.

[0052] The device group of the second group 12 includes at least a communication control device 12a, an OT device 12b, and an OT device 12c. In the second group 12, the communication control device 12a is communicatively connected to the OT device 12b and the OT device 12c. Note that the device group of the second group 12 includes multiple OT devices 12b and 12c, but is not limited to this, and may also include one OT device. The one OT device may be the OT device 12b or the OT device 12c.

[0053] Between the first group 11 and the second group 12, a communication control device 11a and a communication control device 12a are connected so as to be able to communicate with each other.

[0054] The communication control device 11 a of the first group 11 is connected to the network 10 .

[0055] Factory b is equipped with a group of devices in a third group 13 and an anomaly detection device 20b. The group of devices in the third group includes at least a communication control device 13a, an IT device 13b, and an IT device 13c. In the third group 13, the communication control device 13a is communicatively connected to the IT device 13b and the IT device 13c. Note that the group of devices in the third group 13 includes multiple IT devices 13b and 13c, but is not limited to this, and may include only one IT device. The single IT device may be either the IT device 13b or the IT device 13c.

[0056] The communication control device 13 a of the third group 13 is connected to the network 10 .

[0057] The configuration of the equipment may differ depending on whether it is factory a or factory b. The communication control device 12a and the anomaly detection device 20a may be an integrated device. Similarly, the communication control device 13a and the anomaly detection device 20b may be an integrated device. Furthermore, the anomaly detection devices 20a and 20b may be configured to be located outside factory a or factory b. The anomaly detection devices 20a and 20b may also be configured as an IDS (intrusion detection system) or an IPS (intrusion prevention system).

[0058] FIG. 2 is a hardware configuration diagram of the communication interpretation device according to the embodiment.

[0059] As shown in FIG. 2, the communication interpretation device 30 includes, as its hardware configuration, a processor 30a, a main memory 30b, a storage 30c, a communication IF (Interface) 30d, an input device 30e, and a display 30f.

[0060] The processor 30a is an arithmetic unit that executes programs stored in the storage 30c or the like.

[0061] The main memory 30b is a volatile storage area that is used to temporarily store data generated during processing by the processor 30a, to be used as a work area when the processor 30a executes a program, and to temporarily store data received by the communication IF 30d.

[0062] The storage 30c is a non-volatile storage area used to store programs and various data, such as various data generated as a result of processing by the processor 30a and various data received by the communication IF 30d.

[0063] The communication IF 30d is a communication interface for transmitting and receiving information to and from other devices via the network 10. The communication IF 30d may be a wireless communication interface such as a wireless LAN interface or a Bluetooth (registered trademark) interface, or a wired communication interface such as a USB (Universal Serial Bus) or a wired LAN interface.

[0064] The input device 30e is an interface for receiving input from a user, and may include a pointing device such as a mouse, a touchpad, a touch panel, or a trackball, or a keyboard.

[0065] The display 30f is a display device for visually outputting information, and may be a liquid crystal display or an organic EL display.

[0066] FIG. 3 is a configuration diagram showing functional blocks of the communication interpretation device according to the embodiment.

[0067] The communication interpretation device 30 includes a packet forming unit 31, a determining unit 32, a first identifying unit 33, a second identifying unit 34, and a generating unit 35. Communication packets 41 to be interpreted are automatically input to the communication interpretation device 30, and processing for interpreting the communication packets is sequentially performed on the input communication packets 41. Note that the communication packets 41 do not have to be automatically input to the communication interpretation device 30; communication packets 41 manually selected by a user may be input to the communication interpretation device 30.

[0068] The packet forming unit 31 acquires a communication packet 41 through communication, and parses and structures the acquired communication packet 41. By parsing the communication packet 41, the packet forming unit 31 organizes the data in the communication packet 41 into meaningful elements according to the protocol specifications and converts it into an analyzable format. Data for analysis is extracted based on the communication packet structured in this way.

[0069] Based on the structured communication packet 41, the determination unit 32 determines characteristic information indicating the characteristics of the communication of the communication packet 41. The determination unit 32 may determine the characteristic information indicating the characteristics of the communication of the communication packet 41 based on predetermined criteria. The criteria may be determined for each type of communication packet 41.

[0070] The determination unit 32 may perform a process of selecting the characteristics of the communication based on criteria such as whether the header configuration included in the structured communication packet deviates from the standard specifications, whether the destination of the communication is a port or IP address that poses a particular risk, and whether there are any abnormalities in the option values.

[0071] The determination unit 32 may also determine the feature information by inputting the communication packet into a learning model. Here, the learning model is a model obtained by machine learning based on past communication packets acquired in the past and features related to the anomaly identified based on past alerts issued when an anomaly was detected in communication of the past communication packets. The communication features include one or more types of information included in the communication packet 41.

[0072] The first identification unit 33 and the second identification unit 34 are examples of an identification unit that identifies one or more pieces of additional information related to feature information from information different from the feature information. The identification units (first identification unit 33 and second identification unit 34) identify additional information corresponding to each of one or more types. The identification units (first identification unit 33 and second identification unit 34) switch the identification method for the additional information corresponding to the type depending on the type. Specifically, the identification unit switches between processing by the first identification unit 33 and processing by the second identification unit 34.

[0073] When the type is associated with the first additional information in a predetermined correspondence relationship, the first identifying unit 33 identifies the first additional information as the additional information corresponding to the type from the important mapping information 42. The important mapping information 42 is an example of information different from feature information, and is an example of a correspondence relationship in which the type of information and the additional information are associated in advance.

[0074] Furthermore, the first identification unit 33 can identify additional information according to the correspondence relationship by performing a search process on a table structure storing corresponding additional information using the type of information as a key. Because this identification process based on the correspondence relationship is based on mapping information constructed in advance, additional information can be identified quickly and stably. The important mapping information 42 can be updated even while the system is running, and the identification accuracy of the first identification unit 33 can be improved by reflecting additional correspondence relationships generated by the second identification unit 34 (described below). For example, if the type of communication packet is an "HTTP request," the first identification unit 33 identifies standard additional information such as an "HTTP method description" and an "expected response code" based on the mapping information.

[0075] If the type is not associated with the first additional information in a predetermined correspondence relationship, the second identification unit 34 identifies the second additional information as additional information corresponding to the type by searching related search information 43 using Retrieval-Augmented Generation (RAG). The related search information 43 is an example of a plurality of knowledge bases including specification information related to communication, and is an example of information different from feature information.

[0076] For example, when the type of information is an "option field in a specific protocol," the second identification unit 34 may extract the meaning and usage of the field from the related search information 43 and identify the content as the second additional information. The RAG in the second identification unit 34 is configured, for example, by combining a search model based on semantic similarity with a generative language model, and is used by the second identification unit 34 to generate an explanatory text that matches the intention of the input type, rather than simply matching keywords. Note that the related search information 43 is a knowledge base composed of communication protocol specifications, past alert information, security guidelines, industry standard documents, etc., and the second identification unit 34 cross-sectionally searches for information from these knowledge bases to identify the additional information.

[0077] Furthermore, the second identification unit 34 may further generate an additional correspondence relationship that associates the second additional information obtained by the RAG search with the type used in the RAG search. Then, the second identification unit 34 may add the additional correspondence relationship to the important mapping information 42 (correspondence relationship). In this way, the additional correspondence relationship generated by the second identification unit 34 can be used in subsequent processing by the first identification unit 33 and can play a role in improving the accuracy of the subsequent matching processing.

[0078] The generation unit 35 generates interpretation information 44, which is expressed in natural language and is the result of interpreting the communication packet 41 based on the feature information and one or more pieces of additional information. The generation unit 35 is configured to generate a contextual explanation according to the content of the feature information and the additional information using a large-scale language model. This allows the interpretation result of the communication packet to be presented in a form that is easy for humans to understand. In other words, the interpretation information 44 may be presented to the user. The interpretation information 44 may be presented by the communication interpretation device 30, or may be transmitted to a terminal held by the user and presented by the terminal.

[0079] As the large-scale language model, a closed model service may be used, or an independently trained model may be used.

[0080] Each functional block of the communication interpretation device 30 shown in Fig. 3 is realized by a program executed on the hardware configuration shown in Fig. 2. Specifically, the packet shaping unit 31, the determination unit 32, the first identification unit 33, the second identification unit 34, and the generation unit 35 are functionally realized by various programs executed by the processor 30a. These programs are stored in the storage 30c and are deployed in the main memory 30b when executed. The communication IF 30d is used to receive the communication packet 41 acquired by the packet shaping unit 31 from the outside. Furthermore, the interpretation information 44 generated by the generation unit 35 is presented to the user via the display 30f, and user operations may be accepted via the input device 30e.

[0081] [Operation] FIG. 4 is a flowchart showing an example of a communication interpretation process of the communication interpretation device according to the embodiment.

[0082] The communication interpretation device 30 acquires a communication packet 41 (S11). This communication packet may be sent from anomaly detection devices 20a and 20b for detecting unauthorized intrusions or the like, or may be sent directly from a user via the network 10.

[0083] The communication interpretation device 30 analyzes and formats the contents of the communication packet 41, and then determines characteristic information that indicates the characteristics of the communication (S12).

[0084] When the type of characteristic information is based on a predetermined correspondence relationship, the communication interpretation device 30 identifies the first additional information from the important mapping information 42 or the like (S13).

[0085] If the type of characteristic information is not based on a correspondence relationship, the communication interpretation device 30 identifies the second additional information from the related search information 43 by searching using the RAG (S14).

[0086] The communication interpretation device 30 generates a prompt for generating interpretation information 44 based on the feature information, the first additional information, and the second additional information (S15).

[0087] The communication interpretation device 30 inputs the generated prompt into a large-scale language model (LLM) and generates interpretation information 44 as its output (S16).

[0088] The communication interpretation device 30 displays (presents) the generated interpretation information 44 to the user (S17).

[0089] FIG. 5 is a diagram illustrating an example of a process for identifying the characteristic information and the first additional information from a communication packet.

[0090] The communication interpretation device 30 extracts a plurality of frames from the communication packet 41. For each extracted frame, the packet forming unit 31 of the communication interpretation device 30 structures the data, and the determining unit 32 determines characteristic information.

[0091] As a result of the processing by the packet forming unit 31 and the determining unit 32, the IP address and MAC address from among information such as the IP address, MAC address, service type (Service), and protocol header (Header) are extracted from each frame as characteristic information. Next, the first identifying unit 33 of the communication interpretation device 30 identifies device information corresponding to each frame as first additional information by referring to the device information mapping DB 42a based on the extracted characteristic information. Note that the device information mapping DB 42a is one database included in the important mapping information 42.

[0092] As a result, an output including the feature information and the first additional information is generated for each frame.

[0093] FIG. 6 is a diagram illustrating an example of a process for identifying the first additional information and the second additional information based on feature information.

[0094] As a preprocessing step, the communication interpretation device 30 extracts a plurality of frames from the communication packet 41. These frames correspond to the information output in FIG.

[0095] The first identification unit 33 of the communication interpretation device 30 refers to the communication service information mapping DB 42b based on the characteristic information contained in each frame, particularly the service type (Service), and identifies the corresponding service context as the first additional information.

[0096] Meanwhile, the second identification unit 34 of the communication interpretation device 30 identifies second additional information based on the RAG method. The second identification unit 34 first generates a feature vector associated with each frame using the embedding model 43b. Using this vector, the second identification unit 34 performs a similarity search with documents in the RAG database 43a to obtain the top n chunks with the highest similarity. Then, for each chunk, it performs keyword matching using the payload data included in each frame, and finally identifies the RAG context for each frame as the second additional information.

[0097] This allows the communication interpretation device 30 to add additional information based on information about the communication service, specification documents, etc. to the communication packet, thereby improving the accuracy of the subsequent interpretation process.

[0098] FIG. 7 is a diagram for explaining the overall flow of processing for generating interpretation information from a communication packet.

[0099] As a preprocessing step, the communication interpretation device 30 extracts a plurality of frames from the communication packet 41 and structures and determines characteristic information for each frame. This preprocessing step corresponds to the processing shown in FIG.

[0100] Based on the feature information contained in each extracted frame, the communication interpretation device 30 identifies the first additional information (service context) using the first identification unit 33 and the second additional information (RAG context) using the second identification unit 34, as shown in Figure 6.

[0101] In addition to the feature information (packet information), the first additional information (service context), and the second additional information (RAG context), the communication interpretation device 30 uses these to generate a prompt for interpretation by the large-scale language model, and generates a query by combining these.

[0102] The generated query is input to a large-scale language model, and interpretation information 44 is generated as an output, which indicates the content and intent of the communication packet in natural language.

[0103] 8 is a diagram showing an example of data in a communication packet. The data shown in Fig. 8 is an example of information contained in one packet before structuring, and includes multiple information elements in a hierarchical structure.

[0104] In this case, the amount of information contained in a single packet is large, and it is difficult to directly enrich all of it with RAG. Therefore, based on the results of the building risk assessment, more detailed information is required, focusing on the details of the terminal and the communication content of the BACnet protocol.

[0105] As shown in a box 51, the communication packet includes an Ethernet II frame and IP address information, which are considered to be basic characteristic information related to terminal identification.

[0106] The portion shown in the box 52 includes UDP protocol information, sending port / receiving port, etc., and is information indicating the communication specifications of the transport layer.

[0107] Box 53 shows information about the BACnet Virtual Link Control (BVLC) and NPDU layers, including the communication type (e.g., Unicast), control flags, etc. While such information is useful for network configuration purposes, APDU layer information is more useful for general communication intent interpretation.

[0108] Box 54 shows information on the APDU layer of the Building Automation and Control Network (BACnet), including, for example, readPropertyMultiple as a Service Choice, the Object Identifier and Property Identifier of the target device, and reflects the actual control command and information acquisition content. The APDU information places more importance on object and property information that indicates what is being read or written, rather than just the call information for the protocol itself, such as write or read.

[0109] As such, the content of the communication packet shown in Figure 8 contains multiple layers of information, and which information in which layer is important as characteristic information needs to be appropriately extracted depending on the intention of the communication to be interpreted and the risk assessment.

[0110] FIG. 9 is a diagram illustrating an example of interpretation information.

[0111] 9 is an example of interpretation information 44 generated by the communication interpretation device 30 for the communication packet shown in FIG. 8, and shows the output results of the large-scale language model in a list format.

[0112] The interpretation information 44 mainly includes the following contents:

[0113] The first frame is a Confirmed-REQ message sent from IP address 192.168.1.xxx to 192.168.1.xxx, requesting to read multiple properties of an object with instance number ID device. The sender and receiver UDP port numbers are 47808. Also, in this frame, the listOfPropertyReferences field indicates that all properties of the device object ("Property Identifier: all") are requested.

[0114] In this way, the interpretation information 44 clarifies, based on the contents of communication packets, a typical scenario in which one device inquires about configuration information, status information, etc., as an example of basic communication in BACnet / IP. Therefore, such interpretation information 44 can be said to be useful information that can be used as a reference in the context of interpreting network protocols.

[0115] [Effects, etc.] The communication interpretation device 30 according to this embodiment executes a communication interpretation method. In the communication interpretation method, the communication interpretation device 30 acquires a communication packet 41 through communication (S11). The communication interpretation device 30 determines characteristic information indicating characteristics of the communication based on the communication packet 41 (S12). The communication interpretation device 30 identifies one or more pieces of additional information related to the characteristic information from information different from the characteristic information (S13, S14). The communication interpretation device 30 generates interpretation information 44 expressed in natural language as a result of interpreting the communication packet based on the characteristic information and the one or more pieces of additional information (S15, S16).

[0116] This makes it possible to interpret the contents of communication packets in a natural language that is easy for humans to understand, allowing the meaning and intent of the communication to be accurately grasped.

[0117] In the communication interpretation method according to the present embodiment, the communication characteristics include one or more types of information included in the communication packets. In the identification step (S13, S14), the communication interpretation device 30 identifies additional information corresponding to each of the one or more types.

[0118] Therefore, it is possible to refer to additional information appropriate for each of the multiple types of communication packets included in the communication packets, thereby improving the accuracy of interpretation.

[0119] In the communication interpretation method according to the present embodiment, in the identification (S13, S14), the communication interpretation device 30 switches the identification method of the additional information corresponding to the type depending on the type.

[0120] This makes it possible to select the optimum method of identifying information according to the characteristics of each type, and to efficiently obtain additional information suitable for interpreting the meaning of characteristic information.

[0121] In the communication interpretation method according to the present embodiment, in the identification step (S13, S14), if the type is associated with the first additional information through a predetermined correspondence relationship, the communication interpretation device 30 identifies the first additional information as additional information corresponding to the type (S13). The information different from the feature information includes the correspondence relationship.

[0122] Therefore, when there is a predetermined correspondence, highly reliable additional information can be acquired, and processing can be speeded up and stabilized.

[0123] In the communication interpretation method according to the present embodiment, in the identification (S13, S14), if the type is not associated with the first additional information in a predetermined correspondence relationship, the communication interpretation device 30 identifies the second additional information as the additional information corresponding to the type by searching multiple knowledge bases containing specification information related to communication using Retrieval-Augmented Generation (RAG) (S14). Information different from the feature information includes multiple knowledge bases.

[0124] This allows necessary additional information to be dynamically acquired by performing a search using RAG even when the correspondence relationship has not been defined in advance.

[0125] Furthermore, in the communication interpretation method according to the present embodiment, the communication interpretation device 30 further generates an additional correspondence relationship that associates the second additional information obtained by the RAG search with the type used in the RAG search. The communication interpretation device 30 adds the additional correspondence relationship to the correspondence relationships.

[0126] Therefore, the relationship between the newly acquired additional information and the type can be recorded, and future processing efficiency can be improved.

[0127] In the communication interpretation method according to the present embodiment, in the determination (S12), the feature information is determined by inputting the communication packets into a learning model. The learning model is a model obtained by machine learning based on past communication packets acquired in the past and features related to the anomaly identified based on past alerts issued when an anomaly was detected in the communication of the past communication packets.

[0128] This allows for the extraction of feature information that accurately indicates the meaning and intent of the current communication packet using a learning model that reflects past communication history and alerts, leading to a more appropriate understanding of the communication content in subsequent interpretation processing.

[0129] [Modifications] (Modification 1) FIG. 10 is a configuration diagram showing functional blocks of a communication interpretation device according to Modification 1. In FIG.

[0130] The communication interpretation device 30A shown in Figure 10 shares the same basic configuration as the communication interpretation device 30 in the embodiment, but has an expanded configuration in that it is now possible to input an occurring alert 45 and related risk information 46.

[0131] The connection configuration of the communication packet 41, important mapping information 42, related search information 43, and interpretation information 44 is the same as in the embodiment. In addition, Fig. 10 shows a configuration in which an occurring alert 45 and related risk information 46 are input to the communication interpretation device 30A.

[0132] The communication interpretation device 30A includes a packet forming unit 31, a determining unit 32A, a first identifying unit 33, a second identifying unit 34, and a generating unit 35. The determining unit 32A, like the determining unit 32 in the embodiment, includes a process of determining characteristic information based on a structured communication packet 41, as well as a process of determining characteristic information based on an occurred alert 45.

[0133] Specifically, alert information (occurrence alert 45) issued for communication in which an abnormality has been detected is used to identify signs of an abnormality and communication packets with high risk levels, and characteristic information is determined based on this. In addition, related risk information 46 is information regarding known threats and risk classifications behind the alert, and is used by the determination unit 32A to refer to and determine more appropriate characteristic information.

[0134] In this way, the determination unit 32A can determine characteristic information that more appropriately indicates the characteristics of the communication by taking into consideration the contents of the communication packet 41 as well as the contents of the occurring alert 45 and the related risk information 46.

[0135] This allows alerts based on abnormality detection to be reflected in determining characteristic information, allowing more important communications to be interpreted with priority.

[0136] (Modification 2) FIG. 11 is a configuration diagram showing functional blocks of a communication interpretation device according to Modification 2. In FIG.

[0137] The communication interpretation device 30B shown in FIG. 11 has the same basic configuration as the communication interpretation device 30 in the embodiment, but differs in configuration in that the functions of the generation unit are expanded.

[0138] The connection configuration between the communication packet 41, the occurring alert 45, the related risk information 46, the important mapping information 42, the related search information 43, and the interpretation information 44 is the same as in the first modification.

[0139] The communication interpretation device 30B includes a packet forming unit 31, a determining unit 32A, a first identifying unit 33, a second identifying unit 34, and a generating unit 35A. The determining unit 32A is capable of more advanced processing than the determining unit 32 of the embodiment in that it determines characteristic information that more appropriately indicates the characteristics of the communication by referring to the content of the communication packet 41 as well as the occurring alert 45 and related risk information 46.

[0140] The generation unit 35A first summarizes (compresses) the determined feature information and the one or more pieces of additional information identified by the first identification unit 33 and the second identification unit 34, rather than using the information as is. The summarization may be performed using a large-scale language model.

[0141] Specifically, the generation unit 35A generates the interpretation information 44 through the following steps.

[0142] (1) The feature information and one or more pieces of additional information are summarized to generate summary information, which allows the main points of the feature information and additional information to be appropriately extracted and stored in a concise format with a reduced amount of information.

[0143] (2) This summary information includes information obtained by summarizing multiple pieces of information from among the feature information and one or more pieces of additional information, making it possible to succinctly convey the overall picture of the information while maintaining the context.

[0144] (3) Furthermore, the generator 35A sets the importance of information to be included in the summary information based on the determined feature information. By leaving more content for information with high importance and strongly compressing information with low importance, information with high significance in interpretation is emphasized.

[0145] (4) A query including the generated summary information is input to a large-scale language model, and interpretation information 44 in natural language is obtained as the output.

[0146] In this way, the generation unit 35A can ensure clarity and conciseness of the interpretation information 44 by appropriately extracting and summarizing the key points of the feature information and one or more pieces of additional information and then inputting them into the large-scale language model.

[0147] Furthermore, by summarizing multiple pieces of information, it becomes easier for the large-scale language model to properly grasp the context, and the consistency of the natural language interpretation information 44 that is output can be improved.

[0148] Furthermore, since more important information based on the content of the communication packets is reflected in the summary information, the accuracy and expressiveness of the interpretation results obtained by the large-scale language model can be improved.

[0149] Fig. 12 is a flowchart showing an example of a generation process according to Modification 2. In Modification 2, the generation process shown in Fig. 12 is performed instead of the generation process in step S15 of Fig. 4 in the embodiment.

[0150] The communication interpretation device 30B first summarizes the first additional information and the second additional information (S21). In this summarization process, the importance of each additional information is determined based on the determined feature information, and the more important information is, the more details are retained. This makes it possible to reduce the amount of information while maintaining interpretation accuracy.

[0151] Next, the communication interpretation device 30B generates a prompt for generating interpretation information 44 based on the determined feature information and the summarized first and second additional information (S22).

[0152] This ensures that the prompts fed into the large-scale language model contain a condensed version of the contextually important elements, resulting in clear and precise natural language output.

[0153] FIG. 13 is a diagram showing an example of generating a context from a plurality of information sources.

[0154] In FIG. 13 , multiple databases (DBs) each serve as information sources for generating a context. For example, a first DB 61 corresponds to a "function DB," a second DB 62 corresponds to an "object DB," and a third DB 63 corresponds to a "property DB." Based on specific structured information set in advance, contexts 1 to 3 are sequentially generated by a generation unit 35A of a communication interpretation device 30B. The generation unit 35A may generate a context corresponding to each DB based on each of the DBs 61 to 63. The generation unit 35A may also generate context 2 by summarizing information based on context 1 and the information stored in the second DB 62.

[0155] In addition to these, the generation unit 35A may cause the communication interpretation device to generate context 4 and context 5 based on the first information 71 and the second information 72. The first information corresponds to “occurring alert information” and the second information corresponds to “terminal information,” and these also become sources of context.

[0156] These contexts (contexts 1 to 5) are generated by the communication interpretation device based on various information sources. If the amount of information becomes too large when adding these contexts, the generation unit 35A performs a process of summarizing the contexts using a large-scale language model (summarization process). In this summarization process, summary priorities are set according to the importance of each context, and redundant or noisy descriptions are deleted, leaving compact and useful information.

[0157] The summarized contexts are used in the prompt generation process for later query generation and are provided as input to a large-scale language model. Thus, Figure 13 shows a part of the utilization flow including the context information source and the generation and summarization process by the communication interpretation device.

[0158] In the communication interpretation method according to the second variant, the generation step involves summarizing the feature information and one or more pieces of additional information (S21), and inputting the resulting summary information into a large-scale language model to generate interpretation information 44 (S22).

[0159] This allows the key points of the feature information and one or more pieces of additional information to be appropriately extracted and summarized, and then input into a large-scale language model, thereby ensuring clarity and conciseness of the interpretation information 44.

[0160] In the communication interpretation method according to the second modification, the summary information includes information obtained by summarizing a plurality of pieces of information selected from the feature information and the one or more pieces of additional information.

[0161] Therefore, by summarizing multiple pieces of information together, it becomes easier for the large-scale language model to properly grasp the context, and the consistency of the natural language interpretation information 44 that is output can be improved.

[0162] In addition, in the communication interpretation method according to the second modification, the importance of information to be included in the summary information is set based on the feature information, and the summary information is generated so that the higher the importance, the more information is included.

[0163] This allows more important information based on the content of the communication packets to be reflected in the summary information, thereby improving the accuracy and expressiveness of the interpretation results obtained by the large-scale language model.

[0164] (Modification 3) FIG. 14 is a configuration diagram showing an example of information search processing according to Modification 3. In FIG.

[0165] In this modification, any one of the communication interpretation devices 30, 30A, and 30B may be the processing subject, but the following description will be given by taking the communication interpretation device 30 as a representative example.

[0166] 14, Modification 3 uses the BACnet communication protocol as an example, and multiple pieces of service information extracted from a communication packet 41 are referenced in a first DB 81, which stores explanatory information and other related information about the service information. The communication interpretation device 30 references this explanatory information and other information based on each piece of service information, and generates object information based on them.

[0167] Next, based on the obtained object information, the communication interpretation device 30 refers to the second DB 82 to obtain explanatory information and other information related to the object, and further generates property information based on this information.

[0168] In this way, the communication interpretation device 30 may generate information about lower-level elements (objects or properties) in stages based on explanations and related information about higher-level elements (services), thereby efficiently constructing additional information (context) that supplements the meaning and context of each element in a communication packet.

[0169] This configuration is useful for supporting precise interpretation of communication content, particularly in an environment with complex communication specifications and multi-layered protocol structures, and contributes to improving the accuracy of interpretation information 44.

[0170] (Variant 4) In variant 4, the communication interpretation device 30 has the same configuration as the embodiment, but performs processing similar to that of the embodiment, such as acquiring a series of multiple communication packets, determining feature information based on the series of multiple communication packets, and identifying one or more pieces of additional information, thereby generating interpretation information 44 for the series of multiple communication packets.

[0171] Although the fourth modification can be applied to any of the communication interpretation devices 30, 30A, and 30B, the following description will be given using the communication interpretation device 30 as a representative example.

[0172] In the fourth modification, the communication interpretation device 30 further acquires an additional communication packet and adds and identifies characteristic information based on the additional communication packet.

[0173] In this additional identification, one or more pieces of additional additional information are identified based on information different from the additional characteristic information identified from the additional communication packet. The processing of the first identification unit 33 or the second identification unit 34 described in the embodiment can be applied to the identification of the additional additional information.

[0174] The additional communication packets are communication packets related to the target communication packet and are used to combine and interpret a series of multiple communication packets in a concatenated manner. For example, the series of multiple communication packets is multiple communication packets exchanged between a communication packet indicating a request and a communication packet indicating a response to the request.

[0175] Then, the communication interpretation device 30 generates interpretation information 44 based on the previously identified characteristic information, one or more pieces of additional information, additional characteristic information, and additional additional information.

[0176] This configuration allows for the concatenation of feature information and additional information based on multiple communication packets, thereby enabling the generation of consistent interpretation information 44 that reflects the context. This makes it possible to generate more accurate and meaningful interpretation information 44 that reflects context information that cannot be obtained from individual communication packets.

[0177] In this way, the communication interpretation device 30 according to the fourth modification further acquires additional communication packets in the acquisition step (S11). The communication interpretation device 30 further determines additional feature information indicating the characteristics of the communication based on the additional communication packets in the determination step (S12). The communication interpretation device 30 identifies one or more pieces of additional information related to the additional feature information from information different from the additional feature information (S13, S14). The communication interpretation device 30 generates interpretation information 44 based on the feature information, one or more pieces of additional information, the additional feature information, and one or more pieces of additional additional information in the generation step (S15, S16).

[0178] This makes it possible to generate consistent interpretation information 44 that reflects the context based on comprehensive feature information and additional information covering a plurality of communication packets.

[0179] (Variation 5) In Variation 5, when the communication interpretation device 30 determines that one or more pieces of additional information to be identified are insufficient, the communication interpretation device 30 may request additional information necessary to identify the additional information from the user. Note that Variation 5 can be applied to any of the communication interpretation devices 30, 30A, and 30B, but the following description will be given using the communication interpretation device 30 as a representative example.

[0180] When additional information is received from the user, the communication interpretation device 30 additionally identifies other additional information based on the additional information, thereby supplementing the additional information that explains the meaning and background of the anomaly, thereby improving the validity of the interpretation information 44.

[0181] With this configuration, information that may be missing when automatically interpreting only the contents of the communication packet can be supplemented under the user's instructions and responsibility, thereby enabling the generation of more accurate interpretation information 44.

[0182] Such a request for additional information from the user is made when, for example, there is no reference to enrich important information due to differences in the communication specification versions. This is an example of a case where one or more pieces of additional information to identify are insufficient. In this case, by reflecting the supplemental information provided by the user, it becomes possible to clarify the interpretation and context taking into account the specification differences.

[0183] (Variation 6) In Variation 6, the communication interpretation device 30 generates a prompt to be used as input to the large-scale language model based on the communication type of the communication packet and one or more pieces of additional information. Variation 6 is applicable to any of the communication interpretation devices 30, 30A, and 30B, but the following description will be given using the communication interpretation device 30 as a representative example.

[0184] The communication interpretation device 30 inputs the generated prompt into a large-scale language model to generate interpretation information 44. With this configuration, a prompt optimized according to the content and context of the communication is provided to the large-scale language model, making it possible to generate more accurate interpretation information 44 in natural language that reflects the meaning and intent of the communication.

[0185] (Variation 7) In Variation 7, the communication interpretation device 30 has a function of receiving feedback from the user on the interpretation information 44. Variation 7 can be applied to any of the communication interpretation devices 30, 30A, and 30B, but the following description will be given using the communication interpretation device 30 as a representative example.

[0186] Based on the received feedback, the communication interpretation device 30 updates the large-scale language model for generating interpretation information 44. This allows the communication interpretation device 30 to continuously improve interpretation accuracy while reflecting content that is in line with the user's operations and business practices.

[0187] With this configuration, the communication interpretation device 30 can optimize the behavior of the large-scale language model through feedback that reflects the user's knowledge and judgment, thereby achieving improved reproducibility and reliability in future interpretation processes.

[0188] Furthermore, as a method of utilizing user feedback, a large-scale language model can be trained to determine what information is important depending on the type of communication packet by using techniques such as tuning based on user instructions. It is also possible to use a method in which rules are created in advance, such as those that state that certain information is necessary for certain packets, and the system is operated based on these rules.

[0189] (Variation 8) Another example of the data described in Fig. 8 of the above embodiment will be described. For example, data containing information about time synchronization in a communication packet. In this case, the detailed information of the service can be more important context information than the object information and property information that are emphasized in cases such as the write and read services of the BACnet protocol shown in Fig. 8 previously.

[0190] This indicates that the explanatory elements required differ depending on the content of the communication as a policy for generating context information, and serves as a reference for setting priorities when generating interpretation information.

[0191] [Others] In the above embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory. Here, the software that realizes the system, information terminal, server, camera device, etc. of the above embodiments is a program that causes a computer to execute each step included in the flowcharts shown in the figures.

[0192] The following cases are also included in this disclosure:

[0193] (1) Specifically, each of the above devices is a computer system consisting of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is stored in the RAM or hard disk unit. Each device achieves its function when the microprocessor operates in accordance with the computer program. Here, a computer program is composed of a combination of multiple instruction codes that indicate commands to a computer to achieve a specified function.

[0194] (2) Some or all of the components constituting each of the above devices may be configured as a single system LSI (Large Scale Integration). A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on a single chip, and specifically, is a computer system configured to include a microprocessor, ROM, RAM, etc. A computer program is stored in the RAM. The system LSI achieves its functions by the microprocessor operating in accordance with the computer program.

[0195] (3) Some or all of the components constituting each of the above devices may be configured as an IC card or a standalone module that can be attached to each device. The IC card or module may be a computer system configured with a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunctional LSI. The IC card or module achieves its functions when the microprocessor operates in accordance with a computer program. The IC card or module may be tamper-resistant.

[0196] (4) The present disclosure may be embodied as the methods described above, a computer program that implements these methods on a computer, or a digital signal that includes the computer program.

[0197] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Alternatively, the present disclosure may be a digital signal recorded on such a recording medium.

[0198] Furthermore, the present disclosure may also be applied to transmitting the computer program or the digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0199] The present disclosure may also be a computer system including a microprocessor and a memory, wherein the memory stores the computer program, and the microprocessor operates in accordance with the computer program.

[0200] The program or the digital signal may also be implemented by another independent computer system by recording it on the recording medium and transferring it, or by transferring it via the network or the like.

[0201] (5) The above-described embodiments and modifications may be combined with each other.

[0202] The present disclosure is useful as a communication interpretation method that can interpret the contents of communication packets in a natural language that is easy for humans to understand and generate interpretation information that allows a user to accurately grasp the meaning and intent of the communication.

[0203] 10 Network 11 First group 11a, 12a, 13a Communication control device 11b, 11c, 13b, 13c IT equipment 12 Second group 12b, 12c OT equipment 13 Third group 20a, 20b Anomaly detection device 30, 30A, 30B Communication interpretation device 30a Processor 30b Main memory 30c Storage 30d Communication IF 30e Input device 30f Display 31 Packet forming unit 32, 32A Determination unit 33 First identification unit 34 Second identification unit 35, 35A Generation unit 41 Communication packet 42 Important mapping information 42a Device information mapping DB 42b Communication service information mapping DB 43 Related search information 43a RAG DB 43b Embedding model 44 Interpretation information 45 Occurring alert 46 Related risk information 51-54 Boxes 61, 81 First DB 62, 82 Second DB 63 Third DB 71 First information 72 Second information

Claims

1. A communication interpretation method executed by a computer, comprising: acquiring a communication packet through communication; determining characteristic information indicating characteristics of the communication based on the communication packet; identifying one or more pieces of additional information related to the characteristic information from information different from the characteristic information; and generating interpretation information expressed in natural language as a result of interpreting the communication packet based on the characteristic information and the one or more pieces of additional information.

2. The communication interpretation method according to claim 1, wherein the communication characteristics include one or more types of information contained in the communication packet, and the identification step involves identifying additional information corresponding to each of the one or more types.

3. The communication interpretation method according to claim 2, wherein the method of identifying the additional information corresponding to the type is switched depending on the type.

4. The communication interpretation method according to claim 3, wherein, in the identification, if the type is associated with first additional information through a predetermined correspondence relationship, the first additional information is identified as additional information corresponding to the type, and information different from the characteristic information includes the correspondence relationship.

5. In the identification, if the type is not associated with the first additional information by a predetermined correspondence relationship, the second additional information is identified as the additional information corresponding to the type by searching multiple knowledge bases containing specification information related to communication using RAG (Retrieval-Augmented Generation), and information different from the feature information is included in the multiple knowledge bases. The communication interpretation method described in claim 4.

6. The communication interpretation method according to claim 5, further comprising: generating an additional correspondence relationship that associates the second additional information obtained by the search using the RAG with the type used in the search using the RAG; and adding the additional correspondence relationship to the correspondence relationship.

7. A communication interpretation method according to any one of claims 1 to 6, wherein the acquiring step further comprises acquiring an alert issued when an abnormality is detected in the communication of the communication packet, and the determining step further comprises determining the characteristic information based on the alert.

8. A communication interpretation method according to any one of claims 1 to 6, wherein the determination involves inputting the communication packet into a learning model to determine the feature information, and the learning model is a model obtained by machine learning based on past communication packets acquired in the past and features related to the anomaly identified based on past alerts issued when an anomaly was detected in the communication of the past communication packet.

9. A communication interpretation method according to any one of claims 1 to 6, wherein the generation comprises summarizing the feature information and the one or more pieces of additional information, and inputting the resulting summary information into a large-scale language model to generate the interpretation information.

10. The communication interpretation method according to claim 9, wherein the summary information includes information obtained by summarizing a plurality of pieces of information from among the characteristic information and the one or more pieces of additional information.

11. A communication interpretation method as described in claim 9, wherein the generation involves setting the importance of information to be included in the summary information based on the feature information, and generating the summary information so that the higher the importance, the more information is included.

12. A communication interpretation method according to any one of claims 1 to 6, wherein the acquiring step further acquires additional communication packets; the determining step further determines additional feature information indicating features of the communication based on the additional communication packets; the identifying step identifies one or more additional pieces of information related to the additional feature information from information different from the additional feature information; and the generating step generates the interpretation information based on the feature information, the one or more pieces of additional information, the additional feature information, and the one or more pieces of additional additional information.

13. A communication interpretation method according to any one of claims 1 to 6, wherein, in the identification, if the one or more pieces of additional information are insufficient, additional information necessary to identify the one or more pieces of additional information is requested from the user, and when the additional information is obtained from the user, the one or more pieces of additional information are further identified based on the additional information, thereby identifying the one or more pieces of additional information.

14. A communication interpretation method according to any one of claims 1 to 6, wherein the generation comprises generating a prompt for generating the interpretation information based on the communication type of the communication packet and the one or more pieces of additional information, and inputting the generated prompt into a large-scale language model to generate the interpretation information.

15. A communication interpretation method according to any one of claims 1 to 6, further comprising: receiving feedback from a user regarding the interpretation information; and updating a large-scale language model for generating the interpretation information based on the received feedback.

16. A communication interpretation device comprising: a processor; and a memory, wherein the processor uses the memory to: acquire a communication packet through communication; determine characteristic information indicating a characteristic of the communication based on the communication packet; identify one or more pieces of additional information related to the characteristic information from information different from the characteristic information; and generate interpretation information expressed in natural language as a result of interpreting the communication packet based on the characteristic information and the one or more pieces of additional information.

17. A program for causing a computer to execute the communication interpretation method according to any one of claims 1 to 6.

Images