Information processing device, information processing method, and information processing program

Abstract

In this invention, an information acquisition destination derivation unit derives an acquisition destination for acquiring information about visualization data in which a configuration, a state, and an evaluation related to a device, system, service, or the like are visualized. An information acquisition unit acquires the information about the visualization data from the acquisition destination derived by the information acquisition destination derivation unit. An information estimation unit uses the information about the visualization data acquired by the information acquisition unit to estimate information included in the visualization data.

Description

Information processing device, information processing method, and information processing program

[0001] The present invention relates to an information processing device, an information processing method, and an information processing program.

[0002] For security measures in the supply chain, there are technologies that perform security inspections such as configuration inspections and vulnerability inspections using visualized data (hereinafter referred to as visualized data) of the configuration, status, and evaluation of devices, systems, services, etc. For example, as an example of a technology for sharing configuration information, SBOM (Software Bill of Materials) has been proposed as a data format and process for listing and documenting the components and dependencies of software products (see Non-Patent Document 1).

[0003] More specifically, an SBOM is a software "bill of materials," a data format and process for listing and documenting a software product's components and dependencies. SBOM provides transparency into software products and is used for purposes such as traceability, security, legal compliance, license management, or vulnerability management.

[0004] Here, the visualization data of devices provided by providers to users often contains confidential information about the provider, such as proprietary innovations. Therefore, it is difficult for providers to provide all of the visualization data due to concerns about leaks of confidential information. It is also possible that the information provided by providers may contain unintentional errors. Thus, even if an SBOM or similar document is provided, the information necessary for security testing may be insufficient or may contain errors, making it difficult to conduct a highly accurate test.

[0005] Therefore, a method has been proposed to improve the accuracy of security inspections by estimating information that is missing from visualization data and using it in security inspections (see Non-Patent Document 2).

[0006] “The Minimum Elements For a Software Bill Of Materials [SBOM]”, [online], July 12, 2021, The United States Department of Commerce, [Retrieved October 24, 2023], Internet <URL: https: / / www.ntia.doc.gov / files / ntia / publications / sbom_minimum_elements_report.pdf> Masaki Shinohara, “Inference Method for Visualized Data Using Large-Scale Language Models”, 86th National Convention of Information Processing Society of Japan, 2024

[0007] However, there is room for improvement in the conventional techniques. The above conventional techniques pre-train visualization data descriptions and OSINT (Open Source Intelligence) information using a large-scale language model (LLM), and estimate information required for testing based on the pre-training results. With this method, it is difficult to create a pre-training model for the LLM on your own or to obtain a large amount of effective data for fine-tuning the LLM. Furthermore, if there are errors or biases in the training data, they may be reflected in the results, reducing the accuracy of the estimation results.

[0008] The present invention has been made in view of the above, and has an object to improve the accuracy of the estimation results of visualization data.

[0009] In order to solve the above-mentioned problems and achieve the objectives, the information processing device of the present invention is characterized by having an information acquisition destination derivation unit that derives an acquisition destination of information related to visualization data, an information acquisition unit that acquires information related to the visualization data from the acquisition destination derived by the information acquisition destination derivation unit, and an information estimation unit that estimates information contained in the visualization data using the information related to the visualization data acquired by the information acquisition unit.

[0010] According to the present invention, it is possible to improve the accuracy of the estimation results of visualization data.

[0011] FIG. 1 is a diagram illustrating an example of a configuration and a processing overview of an information processing system. FIG. 2 is a flowchart illustrating an example of a processing procedure executed by the information processing system. FIG. 3 is a diagram illustrating an example of a configuration of an information processing device according to an embodiment. FIG. 4 is a diagram for explaining an overview of information processing. FIG. 5 is a flowchart illustrating an example of a first estimation processing procedure. FIG. 6 is a diagram illustrating an overview of the first estimation processing. FIG. 7 is a diagram illustrating an overview of the first estimation processing. FIG. 8 is a flowchart illustrating an example of a second estimation processing procedure. FIG. 9 is a diagram illustrating an overview of the second estimation processing. FIG. 10 is a flowchart illustrating an example of a knowledge base processing procedure. FIG. 11 is a diagram illustrating an overview of knowledge base processing. FIG. 12 is a diagram illustrating an example of experimental results. FIG. 13 is a diagram illustrating an example of a computer that executes an information processing program.

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0013] [Embodiment] [Overview] An example of an overview of information processing executed by an information processing system 1 having an information processing device 100 (see FIG. 3) according to an embodiment will be described with reference to Figures 1 and 2. First, an overview of the processing will be described using Figure 1. Figure 1 is a diagram showing an example of the configuration of an information processing system and an overview of the processing.

[0014] The information processing system 1 estimates information contained in visualization data through information processing by the information processing device 100. The visualization data is data that visualizes information related to a device, system, service, etc. (also referred to as a "processing target"). For example, the visualization data is data for visualizing the configuration of software. In FIG. 1 , the information processing system 1 generates visualization data VD2 based on the information in visualization data VD1.

[0015] The information processing system 1 can have any device configuration as long as it includes the information processing device 100. For example, the information processing system 1 may include an information providing device (computer) that serves as the external information source INF1, such as OSINT, or may not include an information providing device that serves as the external information source INF1. The information processing system 1 may also include multiple information processing devices 100. Hereinafter, processes that are described as being performed by the information processing system 1 may be performed by any device capable of executing the process, such as the information processing device 100, depending on the device configuration of the information processing system 1.

[0016] For example, the information processing system 1 derives a source (hereinafter simply referred to as an "acquisition source") for software configuration information having information missing from the visualization data VD1, estimates the information missing from the visualization data VD1 using the software configuration information acquired from the derived source, updates the visualization data VD1, and outputs the visualization data VD2. When the visualization data VD1 and the visualization data VD2 are not distinguished from each other, they may be referred to as visualization data VD. In FIG. 1 , the visualization data VD1 represents the visualization data VD before it has been updated with information acquired through information processing by the information processing device 100, and the visualization data VD2 represents the visualization data VD after it has been updated with information acquired through information processing by the information processing device 100. The information updated in the visualization data VD1 is not limited to software configuration information, but may also be configuration information related to a device, a system, a service, or the like. Furthermore, the information to be updated in the visualization data VD1 is not limited to missing information, but may be estimated for existing information, and by comparing the original information with the estimated result, errors contained in the visualization data VD1 may be detected, and the visualization data VD1 may be updated with the estimated information and output as visualization data VD2.

[0017] 1 a derives information about the configuration of software (also referred to as “software configuration information”). For example, the information acquisition destination derivation unit 131 derives an acquisition destination for software configuration information that includes information that is missing from visualization data.

[0018] The information acquisition destination derivation unit 131 derives an information acquisition destination using information included in the visualization data VD1. For example, the visualization data VD1 is pre-acquired information used for estimation. The visualization data VD1 includes information such as the package name and version of the software to be visualized. For example, the visualization data VD1 includes data that has already been acquired about the software group to be processed.

[0019] In FIG. 1 , the information acquisition destination derivation unit 131 derives the acquisition destination of software configuration information using a model M1, which is a large-scale language model denoted as LLM in FIG. 1 . For example, the model M1 is a GPT (Generative Pretrained Transformer) language model such as GPT4. Note that GPT is merely an example, and the model M1 is not limited to GPT, and any model format can be adopted as long as it can output information indicating a desired acquisition destination. For example, the information acquisition destination derivation unit 131 requests the model M1 to output a URL (Uniform Resource Locator) that will be the information acquisition destination, and generates the URL that will be the information acquisition destination by having the model M1 output the URL.

[0020] The information acquisition destination derivation unit 131 inputs input information requesting information indicating an acquisition destination to the model M1 and causes the model M1 to output information indicating the acquisition destination (such as a URL), thereby deriving the acquisition destination. For example, the information acquisition destination derivation unit 131 derives a URL related to an API (Application Programming Interface) of OSI (Open Source Insights), a URL related to an API of Github, or the like as the acquisition destination. Note that URLs are merely an example, and the derived information indicating the acquisition destination is not limited to a URL, and any information indicating the acquisition destination of desired software configuration information can be used.

[0021] For example, the information acquisition destination derivation unit 131 derives the acquisition destination of software configuration information having the missing information by requesting the model M1 to acquire the acquisition destination of information that is missing in the visualization data VD at the time of processing, such as the visualization data VD1. In this way, the information acquisition destination derivation unit 131 acquires the acquisition destination of information related to the target data item.

[0022] The information acquisition unit 132 shown in b in FIG. 1 acquires software configuration information from an acquisition destination derived by the information acquisition destination derivation unit 131. For example, the information acquisition unit 132 acquires software configuration information containing information that is missing from the visualization data VD from the acquisition destination. The information acquisition unit 132 acquires information from an external information source INF1. For example, the external information source INF1 may be Open Source Insights, Github, or the like.

[0023] 1 , the information acquisition unit 132 acquires software configuration information using information indicating the acquisition destination, such as a URL, acquired from the model M1 by the information acquisition destination derivation unit 131. For example, the information acquisition unit 132 accesses the external information source INF1 indicated by the URL and acquires software configuration information containing information missing from the visualization data VD from the accessed external information source INF1. In this way, the information acquisition unit 132 acquires the latest information. The information acquired from the external information source INF1 may be information that can be acquired on demand via an API or the like.

[0024] 1 c estimates the visualization data VD using the software configuration information acquired by the information acquisition unit 132. The information estimation unit 133 updates the visualization data VD using the software configuration information acquired by the information acquisition unit 132, and outputs updated visualization data VD to which information missing in the visualization data VD before the update at the time of processing has been added.

[0025] 1 , the information estimation unit 133 extracts items from the information acquired by the information acquisition unit 132, compares the information with information in a knowledge base DB, determines whether to acquire further external information, and performs item estimation using LLM. For example, the information estimation unit 133 uses a knowledge base DB to compare the information with information acquired in advance. The knowledge base DB is information distributed as data, etc. For example, the knowledge base DB is MavenDB, purl2cpe, NVD CPE (Common Platform Enumeration) Directory, NVD CPEMatch, etc.

[0026] 1 , the information estimation unit 133 extracts items from the information acquired by the information acquisition unit 132. For example, the information estimation unit 133 extracts items corresponding to information missing from the visualization data VD from the software configuration information acquired by the information acquisition unit 132. The information estimation unit 133 extracts information or intermediate information on items included in the visualization data VD from the software configuration information, and updates the visualization data VD using the information extracted from the software configuration information.

[0027] The information processing system 1 may repeat the process using the information included in the visualization data VD updated by the information estimation unit 133. For example, if the visualization data VD at that time does not satisfy the termination condition, the information processing system 1 may repeat the processes a to c in FIG. 1. In this way, the information processing system 1 may use the updated information to obtain more detailed information. For example, the information processing system 1 may use information such as the package name, version, owner, and repository name to obtain more detailed information.

[0028] 1, the information processing system 1 outputs visualization data VD2 through the above-described processing. The visualization data VD2 is visualization data VD obtained by updating the visualization data VD1 at the start of processing through the processing in steps a to c in FIG. 1. For example, the visualization data VD2 is visualization data VD to which estimation results in the information processing system 1 have been added. For example, the visualization data VD2 is visualization data VD that includes estimated items such as author, supplier, copyright, licenses, type, cpes, and purl.

[0029] In this way, the information processing system 1 derives the source of software configuration information, acquires the software configuration information from the derived source, and uses the acquired software configuration information to estimate information contained in the visualization data. This allows the information processing system 1 to improve the accuracy of the estimation results of the visualization data even when it is difficult to create a pre-learning model for the LLM or obtain a large amount of data for fine-tuning the LLM, or when errors or bias exist in the learning data for the LLM.

[0030] Note that the information processing system 1 can improve the accuracy of the estimation results of the visualized data even when it is difficult to create a pre-training model of the LLM or obtain a large amount of data for fine-tuning the LLM, or when errors or bias exist in the LLM training data. However, this does not restrict the creation of a pre-training model of the LLM or fine-tuning the LLM. When it is possible to create a pre-training model of the LLM or fine-tune the LLM, the accuracy of the estimation results may be further improved by using both the creation of a pre-training model of the LLM and fine-tuning the LLM.

[0031] The information estimation unit 133 may input information that is difficult to define based on rules and estimate items. In this case, the information estimation unit 133 may estimate items using the model M1. For example, the information estimation unit 133 may input a list of related files and estimate an ecosystem or the like.

[0032] An example of a flowchart of the processing by the above-described information processing system 1 will now be described with reference to Fig. 2. Fig. 2 is a flowchart showing an example of a processing procedure executed by the information processing system. Note that explanations of points similar to those described above will be omitted as appropriate.

[0033] First, the information processing system 1 acquires an input (step S1). For example, the information processing system 1 acquires visualization data at that time of a system or the like that is a processing target of a package (package software or the like) as input.

[0034] The information processing system 1 executes processing by the information acquisition destination derivation unit 131 (step S2). The information processing system 1 derives the acquisition destination of the software configuration information by the information acquisition destination derivation unit 131 shown as "a" in Fig. 2. "a" in Fig. 2 corresponds to "a" in Fig. 1. For example, the information processing system 1 generates a URL of the information acquisition destination.

[0035] The information processing system 1 executes processing by the information acquisition unit 132 (step S3). The information processing system 1 acquires software configuration information from an acquisition source by the information acquisition unit 132 shown as b in Fig. 2. b in Fig. 2 corresponds to b in Fig. 1. For example, the information processing system 1 accesses the information source generated by the information acquisition destination derivation unit 131 to acquire information.

[0036] The information processing system 1 executes processing by the information estimation unit 133 (step S4). The information processing system 1 estimates information included in the visualization data using software configuration information using the information estimation unit 133 shown in c in FIG. 2. c in FIG. 2 corresponds to c in FIG. 1. For example, the information processing system 1 extracts items of the visualization data or intermediate information from the acquired information, and acquires corresponding information from a knowledge base using the extracted information as a key. Furthermore, for example, the information processing system 1 may perform item estimation using LLM.

[0037] When the termination condition is satisfied, the information processing system 1 performs processing to output updated visualization data, etc. (step S5), and terminates the processing to estimate the processing target of, for example, a package (package software, etc.). On the other hand, when the termination condition is not satisfied, the information processing system 1 returns to step S2 and attempts to acquire further information.

[0038] The termination condition can be separately determined and can be set arbitrarily. Several examples are provided below. For example, the most basic termination condition may be a termination condition that includes determining whether the information to be output to the visualization data VD2 is filled in. Furthermore, the termination condition may not only be whether the information is filled in, but also whether an index value based on a predetermined policy, such as the degree of match with a specific format or the similarity with a specific character string, exceeds a certain level. Furthermore, the termination condition may include terminating the process because estimation is impossible for items that cannot be filled in even after accessing all of the information sources to be acquired. Furthermore, for each software package or software series, the number of times each information source was used until the termination condition was reached and the index value at that time may be accumulated.

[0039] For example, when selecting an information source in step S2, the information processing system 1 can improve processing efficiency by prioritizing information sources that have a low number of information acquisitions before reaching the termination condition, information sources that are used frequently, and information sources that have a high index value when the termination condition is met.

[0040] [Configuration of Information Processing Apparatus] Next, a configuration of the information processing apparatus 100, which is an example of an information processing apparatus that executes information processing according to the embodiment, will be described. Fig. 3 is a diagram showing an example of the configuration of the information processing apparatus 100 according to the embodiment.

[0041] 3, the information processing device 100 of this embodiment is realized by a general-purpose computer such as a personal computer, and includes a communication unit 110, a storage unit 120, and a control unit 130. The information processing device 100 may also include an input unit (e.g., a keyboard, a mouse, etc.) that accepts various operations from an administrator of the information processing device 100, a display unit (e.g., a liquid crystal display, etc.) that displays information, and an output unit such as an audio output unit (e.g., a speaker, etc.) that outputs information aloud.

[0042] The communication unit 110 is realized by, for example, a network interface card (NIC), etc. The communication unit 110 is connected to a predetermined network such as the Internet via a wired or wireless connection, and transmits and receives information to and from other information processing devices such as terminal devices used by users who receive the estimation service provided by the information processing device 100.

[0043] The storage unit 120 is realized by, for example, a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. As shown in FIG. 3 , the storage unit 120 according to the embodiment includes a collected data storage unit 121, a model information storage unit 122, and a processing information storage unit 123.

[0044] The collected data storage unit 121 according to the embodiment stores various types of information collected by the information processing device 100. For example, the collected data storage unit 121 stores various types of information received by the information processing device 100 from an external information processing device. For example, the collected data storage unit 121 stores information indicating an information acquisition destination derived by an information acquisition destination derivation process. For example, the collected data storage unit 121 stores information acquired by an information acquisition process.

[0045] The collected data storage unit 121 stores information estimated by the information estimation process, for example, visualization data generated by the information estimation process.

[0046] The collected data storage unit 121 may store various types of information according to the purpose, without being limited to the above. For example, when the information processing device 100 learns a model such as model M1, the collected data storage unit 121 may store learning data that is data used by the information processing device 100 for learning.

[0047] When the information processing device 100 learns a model such as model M1, the information processing device 100 may have a learning unit that executes a learning process to learn the model (machine learning model). In this case, the learning unit of the information processing device 100 executes the learning process based on information from an external information processing device or information stored in the storage unit 120. The learning unit of the information processing device 100 executes the learning process based on learning data stored in the collected data storage unit 121. The learning unit of the information processing device 100 stores the model generated by the learning process in the model information storage unit 122.

[0048] Note that a machine learning model (model) such as model M1 may be learned (generated) by a device (machine learning device) other than the information processing device 100. For example, when a machine learning device learns a model such as model M1, the information processing device 100 acquires (receives) the model such as model M1 from the machine learning device and executes processing such as information processing using the model such as model M1.

[0049] The model information storage unit 122 according to the embodiment stores information related to a model. For example, the model information storage unit 122 stores information (model data) indicating the structure of a model (network). The model information storage unit 122 includes items such as "model ID," "type," and "model data."

[0050] "Model ID" indicates identification information for identifying a model. "Type" indicates the type of the corresponding model. "Model data" indicates the data of the model. "Model data" includes various information that constitutes the model, such as information about the network included in the model, functions, and parameter information of the model learned by the learning process. For example, the model ID "M1" that identifies model M1 is stored in association with the type "large-scale language model (LLM)," model data MDT1, etc.

[0051] The model information storage unit 122 may store various types of information according to the purpose, without being limited to the above. For example, the model information storage unit 122 may store information indicating the use of each model. In this case, the model information storage unit 122 may store the use "information acquisition destination derivation", which indicates that the model is used for information acquisition destination derivation, in association with the model ID "M1" that identifies the model M1.

[0052] The processing information storage unit 123 according to the embodiment stores various types of information used in processing. The processing information storage unit 123 stores information used in processing to estimate (generate) information such as visualization data. For example, the processing information storage unit 123 stores information related to processing termination conditions. The processing information storage unit 123 stores a history of estimation processing of visualization data.

[0053] For example, the processing information storage unit 123 stores information indicating the trustworthiness of each acquisition source. For example, the processing information storage unit 123 stores the number of times that information from each acquisition source has been used as information for visualization data, as information indicating the trustworthiness. For example, the processing information storage unit 123 stores information indicating the trustworthiness of each type of information for each acquisition source. For example, the processing information storage unit 123 stores the number of times that information from each acquisition source has been used as information for visualization data, for each type of information, as information indicating the trustworthiness of each type of information.

[0054] The processing information storage unit 123 is not limited to the above, and may store various types of information depending on the purpose.

[0055] Returning to Fig. 3, the explanation will be continued. The control unit 130 is realized, for example, by a processor such as a CPU (Central Processing Unit) executing a program (e.g., an information processing program) stored inside the information processing device 100 using a RAM or the like as a work area. The control unit 130 is also realized, for example, by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). As shown in Fig. 3, the control unit 130 has an information acquisition destination derivation unit 131, an information acquisition unit 132, an information estimation unit 133, and a provision unit 134.

[0056] The information acquisition destination derivation unit 131 executes an information acquisition destination derivation process, which is a process of deriving an information acquisition destination. The information acquisition destination derivation unit 131 executes a process of deriving information indicating an information acquisition destination. The information acquisition destination derivation unit 131 derives information indicating an information acquisition destination using information stored in the storage unit 120. For example, the information acquisition destination derivation unit 131 acquires information indicating an information acquisition destination from an external information processing device.

[0057] The information acquisition destination derivation unit 131 derives an acquisition destination for software configuration information, which is information relating to the configuration of software. The information acquisition destination derivation unit 131 inputs input information requesting information indicating an acquisition destination to a large-scale language model and causes the large-scale language model to output the information indicating the acquisition destination, thereby deriving the acquisition destination. The information acquisition destination derivation unit 131 derives an acquisition destination for software configuration information that has information that is missing in visualization data. The information acquisition destination derivation unit 131 derives multiple acquisition destinations for the software configuration information.

[0058] The information acquisition destination derivation unit 131 executes information acquisition destination derivation processing based on information stored in the collected data storage unit 121, the model information storage unit 122, and the processing information storage unit 123. The information acquisition destination derivation unit 131 executes information acquisition destination derivation processing using a model such as model M1. The information acquisition destination derivation unit 131 uses model M1 to derive a URL indicating the acquisition destination of software configuration information.

[0059] For example, the information acquisition destination derivation unit 131 inputs a prompt to the model M1 requesting that a URL indicating the acquisition destination of the software configuration information be output, thereby causing the model M1 to output a URL indicating the acquisition destination of the software configuration information, thereby deriving a URL indicating the acquisition destination of the software configuration information.

[0060] If the information estimation unit 133 determines that the termination condition is not satisfied, the information acquisition destination derivation unit 131 executes the information acquisition destination derivation process again. For example, if the information estimation unit 133 determines that the termination condition is not satisfied, the information acquisition destination derivation unit 131 executes the information acquisition destination derivation process using information included in the visualization data updated by the information estimation unit 133.

[0061] The information acquisition unit 132 executes information acquisition processing, which is processing for acquiring information. The information acquisition unit 132 acquires information from an external information processing device. The information acquisition unit 132 receives information from the external information processing device via the communication unit 110. The information acquisition unit 132 acquires information from the storage unit 120. The information acquisition unit 132 acquires information from the collected data storage unit 121, the model information storage unit 122, and the processing information storage unit 123.

[0062] The information acquisition unit 132 acquires software configuration information from the acquisition destination derived by the information acquisition destination derivation unit 131. For example, the information acquisition unit 132 requests information from the acquisition destination derived by the information acquisition destination derivation unit 131 and acquires the software configuration information from the requested acquisition destination. The information acquisition unit 132 acquires multiple pieces of software configuration information from the multiple acquisition destinations derived by the information acquisition destination derivation unit 131.

[0063] When the information destination derivation unit 131 derives multiple destinations (also referred to as "candidate destinations"), the information acquisition unit 132 may select a destination from among the multiple candidate destinations based on the trustworthiness of each of the multiple candidate destinations. In this case, the information acquisition unit 132 acquires information from a destination selected from the multiple candidate destinations. For example, the information acquisition unit 132 may select a predetermined number of destinations (e.g., any number such as three) with higher trustworthiness from among the multiple candidate destinations as the destinations from which to acquire information. For example, the information acquisition unit 132 may select the destination with the highest trustworthiness from among the multiple candidate destinations as the destination from which to acquire information.

[0064] For example, the information acquisition unit 132 acquires software configuration information from a URL indicating the acquisition destination of the software configuration information derived by the information acquisition destination derivation unit 131. The information acquisition unit 132 collects and registers the software configuration information acquired from the acquisition destination in the data storage unit 121. Furthermore, when the information acquisition unit 132 acquires a model such as model M1 from an external information processing device, the information acquisition unit 132 registers the acquired model in the model information storage unit 122.

[0065] The information estimation unit 133 executes information estimation processing. The information estimation unit 133 executes the information estimation processing, which is processing for estimating various types of information such as visualization data. The information estimation unit 133 executes the information estimation processing by generating various types of information such as visualization data using information acquired from an external information processing device or information stored in the storage unit 120. The information estimation unit 133 executes the information estimation processing based on the information stored in the collected data storage unit 121, the model information storage unit 122, and the processing information storage unit 123.

[0066] The information estimation unit 133 estimates information included in the visualization data using the software configuration information acquired by the information acquisition unit 132. The information estimation unit 133 updates the visualization data using the software configuration information acquired by the information acquisition unit 132. For example, the information estimation unit 133 extracts information that is missing from the visualization data from the software configuration information and adds the extracted information to the visualization data, thereby updating the visualization data.

[0067] The information estimation unit 133 extracts information or intermediate information on items included in the visualization data from the software configuration information, and estimates information included in the visualization data using the information extracted from the software configuration information. The information estimation unit 133 estimates information included in the visualization data using multiple pieces of software configuration information acquired by the information acquisition unit 132. The information estimation unit 133 estimates information included in the visualization data using software configuration information selected from the multiple pieces of software configuration information based on the credibility of each of the multiple acquisition sources.

[0068] When the information acquisition unit 132 acquires information from multiple acquisition sources, the information estimation unit 133 may select information to be used as information for visualization data based on the trustworthiness of each of the multiple acquisition sources. For example, the information estimation unit 133 may use, as information for visualization data, information acquired from a source with a high trustworthiness among the information acquired from the multiple acquisition sources. For example, when the information estimation unit 133 acquires information of the same type from multiple acquisition sources, it may use information acquired from a source with the highest trustworthiness for that type as information for that type of visualization data.

[0069] The information estimation unit 133 performs a determination process. The information estimation unit 133 determines whether a termination condition is satisfied. For example, the information estimation unit 133 determines whether a termination condition stored in the processing information storage unit 123 is satisfied. For example, if the information estimation unit 133 determines that the termination condition is not satisfied, it provides the updated visualization data to the information acquisition destination derivation unit 131 and causes the information acquisition destination derivation unit 131 to repeat the processing. For example, if the information estimation unit 133 determines that the termination condition is satisfied, it determines that estimation of information included in the visualization data is complete, and ends the estimation process of information included in the visualization data.

[0070] The providing unit 134 provides information. The providing unit 134 provides information to an external information processing device. The providing unit 134 transmits information to an external information processing device. For example, the providing unit 134 transmits information to another information processing device such as a user's terminal device. The providing unit 134 transmits information stored in the storage unit 120. The providing unit 134 transmits information such as visualization data estimated by the information estimation unit 133. For example, the providing unit 134 transmits visualization data to a user's terminal device that requests the provision of visualization data.

[0071] [Processing Example] Based on the above-described contents, a processing example will now be described. For example, the implementation conditions in the processing example shown below are as follows: GPT4 is used as the LLM. OSI and Github are used as the external information source INF1. Knowledge base configuration information is purl2cpe / NVD CPE Directory / NVD CPEMatch / Maven. Input information (e.g., corresponding to visualization data VD1 in FIG. 1) is {package name, version} of each package. Output information (e.g., corresponding to visualization data VD2 in FIG. 1) is author / supplier / copyright / licenses / type / cpes / purl of each software package.

[0072] 4 corresponds to the information processing system 1 shown in FIG. 1, and is a diagram showing a correspondence relationship PH1 between processes and system configurations, in which numbers corresponding to the processes shown below are assigned to each component. FIG. 4 is a diagram for explaining an overview of information processing.

[0073] For example, the numbers (function numbers) shown in the circles in Figure 4 correspond to the estimation processes using OSI. Note that when there are multiple circles with the same number, the processes other than the main process are indicated with hatching. The numbers shown in the squares in Figure 4 correspond to the estimation processes using Github. Note that when there are multiple circles with the same number, the processes other than the main process are indicated with hatching. P1 to P6 in Figure 4 correspond to the CPE derivation processes using a knowledge base.

[0074] [Inference Processing Using OSI] First, the estimation processing using OSI will be described with reference to Figs. 5 to 7. Fig. 5 is a flowchart showing an example of a first estimation processing procedure. Figs. 6 and 7 are diagrams showing an overview of the first estimation processing. The numbers shown in the circles in Figs. 5 to 7 correspond to the numbers shown in the circles in Fig. 4. The lists shown in Figs. 6 and 7 show, from the right side of the columns, function number (No.), step, function overview, processing conditions, input, obtained information, and an example processing engine.

[0075] An example of a flowchart of estimation processing using OSI shown in Figure 5 will now be described with reference to the details of each process (function) shown in Figures 6 and 7. Note that the type of each element in Figure 5 is distinguishable by the type of hatching. The type of hatching distinguishes between subroutines, execution in LLM, processing in Python, expected (obtained) output, etc. Furthermore, among the processes in Figure 5, processes shown in bold (e.g., step S112, etc.) correspond to processes using an API.

[0076] The information processing system 1 starts processing using the OSI (step S101). For example, the information processing system 1 acquires visualization data (e.g., visualization data VD1 in FIG. 1 ) as input and starts estimation processing using the OSI.

[0077] The estimation process (step S102 and subsequent steps) using the visualization data as input is performed for each software package included in the visualization data.

[0078] The information processing system 1 performs an OSI determination (step S102). For example, the information processing system 1 checks whether the information is subject to OSI management as shown in Fig. 6. For example, the information processing system 1 checks whether the missing information in the visualization data is subject to OSI management using an LLM (e.g., model M1).

[0079] If the OSI determination is No (step S102: No), the information processing system 1 proceeds to a Github search process (step S103). For example, the information processing system 1 searches for information other than OSI in Github as shown in Fig. 7. For example, if the information missing in the visualization data is not subject to OSI management, the information processing system 1 proceeds to a Github-related process as shown in Figs. 8 and 9.

[0080] If the OSI determination is Yes (step S102: Yes), the information processing system 1 infers the URL of the OSI using the LLM (step S104). For example, the information processing system 1 generates the URL of the OSI using the LLM as shown in Fig. 6. For example, if information missing in the visualization data is subject to OSI management, the information processing system 1 derives the URL of the OSI from which the information is to be obtained using the LLM.

[0081] The information processing system 1 branches the process depending on whether the URL reading is successful or not (step S105). The information processing system 1 opens the generated URL as shown in Fig. 6 and executes the URL reading. If the URL reading is successful (step S105: Yes), the information processing system 1 outputs the package manager based on the URL reading result and executes the processes from step S112 onwards.

[0082] If the URL reading is not successful (step S105: No), the information processing system 1 estimates a package manager (step S106). For example, the information processing system 1 estimates a package manager under OSI management as shown in FIG. 6. For example, the information processing system 1 estimates a package manager using LLM. There may be multiple package managers estimated here.

[0083] The information processing system 1 executes the loop process as many times as the number of package managers output by the LLM (step S107). For example, the information processing system 1 repeats the processes of steps S108 to S110 below until the number of times the loop process has been executed reaches the number of package managers output by the LLM. Furthermore, when the number of times the loop process has been executed reaches the number of package managers output by the LLM, the information processing system 1 executes the processes from step S111 onwards.

[0084] The information processing system 1 branches the process depending on whether the package manager is Maven or not until the number of times the loop process reaches the number of package managers output by the LLM (step S108). If the package manager is Maven (step S108: Yes), the information processing system 1 executes a query process to the MavenDB (step S109) and returns to step S107 to repeat the process. For example, in the case of a Maven software package, as shown in FIG. 6, if the search in the MavenDB is successful, the information processing system 1 collects information from the POM file. Furthermore, if the search does not result in a hit, the information processing system 1 deletes the package manager from the candidate list.

[0085] Here, as the MavenDB, for example, package-related information may be acquired in advance from a Maven repository on the Internet, and locally stored data may be used.

[0086] For example, when the package manager is Maven, the information processing system 1 executes a query process on the MavenDB and acquires information from the MavenDB. For example, the information processing system 1 acquires information such as Supplier / Author / Description / Licenses / Owner / Repository.

[0087] If the information processing system 1 is not Maven (step S108: No), it acquires a version list from OSI, selects an appropriate version notation (step S110), and returns to step S107 to repeat the process. For example, the information processing system 1 reads out the relevant version as shown in FIG. 6 , compares it with the version notation of the package being estimated, and selects an appropriate version notation from the version list.

[0088] When the number of times the loop process has been performed reaches the number of package managers output by the LLM, the information processing system 1 executes a package manager determination process (step S111). For example, the information processing system 1 determines a package manager based on the suitability of each package manager candidate, as shown in Fig. 6. For example, the information processing system 1 may select a package manager that manages a package whose package name and version match the package being estimated.

[0089] The information processing system 1 acquires detailed information through the OSI (step S112). For example, the information processing system 1 generates an OSI URL from the collected information as shown in Fig. 6, and extracts information to be reflected in visualization data such as an SBOM and other information from the collected information. For example, the information processing system 1 acquires information such as Licenses, Vulnerabilities, Links, Owner, and Repository.

[0090] The information processing system 1 executes an npm search (step S113). As shown in Fig. 6, the information processing system 1 searches the npm registry for detailed product information, and if found, extracts information to be reflected in visualization data such as SBOM and other information.

[0091] The information processing system 1 executes a PyPI search (step S114). For example, the information processing system 1 searches for detailed product information from the PyPI API as shown in Fig. 6, and if found, extracts information to be reflected in visualization data such as an SBOM and other information.

[0092] The information processing system 1 branches the process depending on whether the repository is Github or not (step S115). If the repository is not Github (step S115: No), the information processing system 1 ends the process as NG (step S116). For example, the information processing system 1 ends the process if it has not been able to acquire owner / repository name information as shown in FIG. 7.

[0093] If the repository is Github (step S115: Yes), the information processing system 1 acquires detailed information from Github (step S117). For example, the information processing system 1 acquires detailed information from the owner / repository name / version using the Github API as shown in FIG. 7, and extracts information to be reflected in visualization data such as an SBOM. For example, the information processing system 1 acquires information such as the author and description.

[0094] The information processing system 1 acquires owner information from Github (step S118). For example, the information processing system 1 acquires owner information from the owner / repository name using the Github API as shown in FIG. 7, and extracts information to be reflected in visualization data such as SBOM. For example, the information processing system 1 acquires information such as supplier / author.

[0095] The information processing system 1 acquires license information from Github (step S119). For example, as shown in FIG. 7, the information processing system 1 acquires license information from the owner / repository name using the Github API and extracts information to be reflected in visualization data such as SBOM. For example, the information processing system 1 acquires information such as Licenses / Content.

[0096] The information processing system 1 generates a Copyright statement from the content information (step S120). For example, the information processing system 1 causes the LLM to generate a Copyright statement based on the content information as shown in Fig. 7. For example, the information processing system 1 acquires information such as Copyright.

[0097] The information processing system 1 executes the CPE estimation process (step S121) and ends the process. For example, the information processing system 1 searches the DB using the package name and version as shown in FIG. 7. For example, the information processing system 1 acquires information such as the CPE.

[0098] When the information processing system 1 has transitioned from the Github search process (step S122), it may execute the processes from step S117 onward. For example, the information processing system 1 searches for anything other than OSI on Github as shown in Fig. 7. For example, the information processing system 1 acquires information such as PURL, Owner, Repository, and Tag through the Github-related processes shown in Figs. 8 and 9.

[0099] [Estimation Processing Using Github] Next, the estimation processing using Github will be described with reference to Figs. 8 and 9. Fig. 8 is a flowchart showing an example of the second estimation processing procedure. Fig. 9 is a diagram showing an overview of the second estimation processing. The numbers shown in the squares in Figs. 8 and 9 correspond to the numbers shown in the squares in Fig. 4. The list shown in Fig. 9 shows, from the right side of the column, an example of a function number, a step, an overview of the processing, an input, and an output.

[0100] An example of a flowchart of estimation processing using Github shown in FIG. 8 will now be described with reference to the details of each process (function) shown in FIG. 9. Note that the type of each element in FIG. 8 is distinguishable by the type of hatching. The type of hatching distinguishes between subroutines, execution in LLM, processing in Python, and obtained (expected) output. Furthermore, among the processes in FIG. 8, processes shown in bold (e.g., step S202) correspond to processes using an API.

[0101] The information processing system 1 starts processing using Github (step S201). For example, when the information processing system 1 moves from step S103 in FIG. 5, it starts estimation processing using Github.

[0102] The information processing system 1 collects a repository list whose package name matches the package_name of Github (step S202). For example, the information processing system 1 acquires the repository list using the API of Github as shown in FIG.

[0103] The information processing system 1 executes a loop process for each repository until a repository whose version matches the GitHub tag is found (step S203). The information processing system 1 branches the process depending on whether the repository comparison results in a match (step S204). For example, the information processing system 1 branches the process depending on the comparison result of the repository names as shown in FIG. 9.

[0104] If the repository comparison does not result in a match (step S204: No), the information processing system 1 executes the process of step S209. If the repository comparison results in a match (step S204: Yes), the information processing system 1 collects tag lists in which the owner / repository name pair matches the full_name of Github (step S205). For example, the information processing system 1 acquires the tag list of the full_name from Github using the Github API as shown in FIG. 9.

[0105] The information processing system 1 executes a loop process until a matching version is found for each tag list (step S206). The information processing system 1 branches the process depending on whether the versions match for each tag list (step S207). For example, the information processing system branches the process depending on the comparison result of the version and tag as shown in Fig. 9. For example, if the version and tag match, the information processing system determines the full_name and obtains the owner / repository name from {owner} / {repo_name} represented by the full_name.

[0106] If the comparison of the version and the tag does not result in a match (step S207: No), the information processing system 1 branches the process depending on whether the tag list is complete (step S208). For example, the information processing system 1 branches the process depending on whether there are any remaining tags (e.g., unprocessed tags) in the tag list.

[0107] If the tag list is not complete (step S208: remaining), the information processing system 1 returns to step S206 and repeats the process. If the tag list is complete (step S208: not remaining), the information processing system 1 branches the process depending on whether there are remaining repositories in the repository list (step S209). For example, the information processing system 1 branches the process depending on whether there are remaining repositories (e.g., unprocessed repositories) in the repository list. If there are remaining repositories in the repository list (step S209: yes), the information processing system 1 returns to step S203 and repeats the process. On the other hand, if there are no remaining repositories in the repository list (step S209: no), the information processing system 1 estimates the package manager and ecosystem from the package name and version information using the LLM (step S210) and executes the process of step S213.

[0108] For example, the information processing system 1 performs step S207 for all tags in the tag list as shown in Fig. 9, and if there is no match, returns to the process from step S204. Furthermore, the information processing system 1 performs step S210 when processing is complete for all repositories acquired in step S202 as shown in Fig. 9. For example, the information processing system 1 infers a package manager and ecosystem from package name and version information as shown in Fig. 9. For example, the information processing system 1 infers a GitHub details page.

[0109] If the comparison of the version and tag results in a match (step S207: Yes), the information processing system 1 acquires the file list (step S211). For example, the information processing system 1 acquires the file list using the API of Github as shown in FIG.

[0110] The information processing system 1 provides the owner, repository name, version, and file list to the LLM and executes processing (step S212). For example, the information processing system 1 estimates an ecosystem. For example, the information processing system 1 provides the owner, repository name, version, and file list to the LLM and generates information indicating the package manager and ecosystem.

[0111] The information processing system 1 generates a PURL from the above results (step S213). For example, the information processing system 1 generates a PURL based on the package manager, package name, and version as shown in FIG. 9. For example, the information processing system 1 generates and acquires a PURL from the processing results of step S212 or S210. Then, the information processing system 1 completes the Github process (step S214) and ends the Github process.

[0112] [CPE derivation process using knowledge base] Next, the CPE derivation process using the knowledge base will be described with reference to Figs. 10 and 11. Fig. 10 is a flowchart showing an example of a knowledge base processing procedure. Fig. 11 is a diagram showing an overview of knowledge base processing. The numbers shown in the squares in Figs. 10 and 11 correspond to the numbers shown in the squares in Fig. 4. The list shown in Fig. 11 shows, from the right side of the column, a function number, a step, an overview of processing, and an example of input and output.

[0113] An example of a flowchart of a CPE derivation process using the knowledge base shown in Fig. 10 will now be described with reference to the details of each process (function) shown in Fig. 11. The types of elements in Fig. 10 are distinguishable by the type of hatching. The types of hatching distinguish between subroutines, execution in LLM, processing in Python, obtained (expected), etc.

[0114] The information processing system 1 starts a process of identifying a CPE from a PURL (step S301). For example, the information processing system 1 starts a process of deriving a CPE using a knowledge base after the process of step S121 in FIG.

[0115] The information processing system 1 performs a comparison using purl2cpe (step S302). For example, the information processing system 1 issues a query to the purl2cpe DB as shown in FIG.

[0116] The information processing system 1 branches the process depending on whether or not there is a match in the PURL (step S303). If there is a match in the PURL (step S303: Yes), the information processing system 1 executes the process of step S312. If there is no match in the PURL (step S303: No), the information processing system 1 deletes the version portion of the PURL and searches the purl2cpe DB for the package name (step S304). For example, the information processing system 1 issues a query to the purl2cpe DB and performs a search, as shown in FIG. 11 .

[0117] The information processing system 1 branches the process depending on whether the package names match (step S305). If the package names do not match (step S305: No), the information processing system 1 searches the NVD CPE Directory / NVD CPEMatch DB by package name / version (step S306). For example, the information processing system 1 issues a query to the NVD CPE Directory / NVD CPEMatch DB to perform a search, as shown in FIG. 11 .

[0118] The information processing system 1 branches the process depending on whether the versions match (step S307). If the versions match (step S307: Yes), the information processing system 1 confirms the vendor name and executes the process from step S310 onwards. If the versions do not match (step S307: No), the information processing system 1 branches the process depending on whether only the package names match (step S308). For example, the information processing system 1 issues a query to the NVD CPE Directory / NVD CPEMatch DB and performs a search, as shown in FIG. 11 .

[0119] If only the package names match (step S308: Yes), the information processing system 1 executes the processes from step S311 onward. If the package names do not match (step S308: No), the information processing system 1 sets the vendor name to [*] (step S309) and executes the process of step S312. For example, the information processing system 1 combines a CPE from the package name / version with the vendor name set to [*] as shown in FIG. 11 .

[0120] If the package names match (step S305: Yes), the information processing system 1 determines the vendor name (step S310). Then, the information processing system 1 combines the CPE using the vendor name (step S311) and executes the process of step S312. The information processing system 1 determines the CPE (step S312) and ends the process using the knowledge base.

[0121] As described above, the information processing system 1 may directly extract a CPE by comparing with purl2cpe / NVD CPE Directory / NVD CPEMatch. Alternatively, the information processing system 1 may extract a vendor name and configure a CPE. Alternatively, if the information processing system 1 cannot find (extract) the vendor name, it may configure a CPE with the vendor name set to [*].

[0122] [Experimental Results] Here, the experimental results will be described using FIG. 12 . FIG. 12 is a diagram showing an example of the experimental results. FIG. 12 shows a comparison between experimental results when using the processing method (also referred to as "this method"), configuration, etc. of the information processing system 1 described above and experimental results using a conventional method. The "Item" column in FIG. 12 indicates items included in the visualization data generated (estimated) by the present method and the conventional method. FIG. 12 shows the experimental results for seven items: author / licenses / copyright / type / supplier / cpes / purl.

[0123] The "conventional method" column in Fig. 12 shows the execution results when using, for example, the method in Non-Patent Document 1. The "current" column in Fig. 12 shows the execution results when using the present method. The values ​​(percentages) of each item shown in "conventional method" and "current" in Fig. 12 indicate the correct answer completion rate (correct answer rate) for each item for the "conventional method" and "current"

[0124] In the experiment shown in Figure 12, correct answer data was generated by merging the same package data with SBOM data (visualization data) collected from the SBOM benchmark. For the conventional method, an externally acquired learning model was fine-tuned using the correct answer data, and items were inferred using data not used in the learning as inference input, and the accuracy rate was calculated. Furthermore, items were inferred using the present method for the same inference input, and the accuracy rate was calculated.

[0125] As shown in Figure 12, the present method was able to achieve improved accuracy for almost all items compared to the conventional method. For example, the present method was able to significantly improve the accuracy of items related to proper nouns compared to the conventional method.

[0126] [Effect] As described above, in the information processing device 100 of this embodiment, the information acquisition destination derivation unit 131 derives an acquisition destination for software configuration information, which is information about the configuration of software. Furthermore, the information acquisition unit 132 acquires the software configuration information from the acquisition destination derived by the information acquisition destination derivation unit 131. The information estimation unit 133 uses the software configuration information acquired by the information acquisition unit 132 to estimate information included in the visualization data.

[0127] Specifically, the information acquisition destination derivation unit 131 inputs input information requesting information indicating the acquisition destination to the large-scale language model, and derives the acquisition destination by having the large-scale language model output information indicating the acquisition destination.

[0128] In this way, the information processing device 100 derives a source for acquiring software configuration information that has information missing from the visualization data, and uses the software configuration information acquired from the derived source to estimate information included in the visualization data. This makes it possible to estimate information included in the visualization data using the information acquired from the derived source, without having to create an LLM pre-learning model in-house or fine-tune the LLM. Furthermore, errors and biases present in the LLM training data are less likely to be reflected. Therefore, the information processing device 100 can improve the accuracy of the estimation results of the visualization data.

[0129] Generally, because the visualization data described above contains information about many software packages, it is often difficult to generate it automatically and accurately. For example, there are multiple standard SBOM formats, each suitable for different use cases, making it difficult to standardize the format. As a result, visualization data created by third parties using tools such as SCA (Software Composition Analysis) is sometimes distributed, rather than visualization data (such as SBOM) created by the software author. Such visualization data created by third parties may contain incomplete information, which may reduce the accuracy of the results of intended use cases (such as vulnerability testing and license testing).

[0130] Therefore, conventional methods have been proposed to appropriately estimate the information from the visualization data. These conventional methods involve rule-based derivation limited to specific items (PURL or CPE), or learning the description of the visualization data and OSINT information using LLM, and then estimating the information required for inspection based on the results of this pre-learning.

[0131] These conventional methods have several problems. For example, when deriving data using a rule base, conventional methods require a rule for each target item, which limits the use cases for the visualized data. This results in a lack of comprehensiveness. Furthermore, when deriving data using LLM, conventional methods have problems with training data, as it is difficult to create a pre-training model for LLM in-house or obtain a large amount of effective data for fine-tuning.

[0132] Furthermore, conventional methods have the problem of accuracy in that the results derived by LLM are merely estimates, making it difficult to guarantee accuracy, and errors or biases in the training data may be reflected in the results (particularly vulnerable to proper nouns). Furthermore, conventional methods have the problem of cost due to the amount of computation required, as creating an LLM training model in-house and fine-tuning it requires a large amount of computational resources, which makes it costly and time-consuming.

[0133] Therefore, as described above, the information processing device 100 has the LLM respond with the reference destination (source of acquisition) of the information source, acquires the latest data from outside, and based on the acquired information, acquires additional information from a new reference destination, repeating the acquisition of information multiple times to improve the accuracy of the information.

[0134] As a result, the information processing device 100 can solve the problems associated with the conventional methods described above. For example, by applying the mechanism described above, the information processing device 100 can easily accommodate new formats and items. In this way, the information processing device 100 can address the comprehensiveness problem.

[0135] For example, the information processing device 100 can always use new data without having to update the learning model itself. In this way, the information processing device 100 can address issues with learning data. For example, the information processing device 100 can improve the accuracy of the derived SBOM items by acquiring and using data from multiple highly reliable reference sources. In this way, the information processing device 100 can address issues with accuracy. For example, the information processing device 100 can reduce the computational costs associated with learning by minimizing the creation and fine-tuning of learning models on its own. In this way, the information processing device 100 can address issues with costs due to the amount of computation.

[0136] Note that the information processing device 100 can improve the accuracy of the estimation results of the visualized data even when it is difficult to create a pre-training model of the LLM or obtain a large amount of data for fine-tuning the LLM, or when errors or bias exist in the LLM training data. However, this does not restrict the creation of a pre-training model of the LLM or fine-tuning the LLM. When it is possible to create a pre-training model of the LLM or fine-tune the LLM, the accuracy of the estimation results can be further improved by using the creation of a pre-training model of the LLM and fine-tuning the LLM in combination.

[0137] The above-mentioned issues and benefits can be summarized as follows: Conventionally, the information in visualization data was incomplete, which could make it impossible to implement the intended use cases (vulnerability testing, license testing, etc.). However, simply using LLM to estimate the information in the visualization data itself, as in conventional methods, would result in problems such as a lack of training data, inaccuracy, and computational costs.

[0138] Therefore, the information processing device 100 uses the LLM to acquire references to information sources, and uses data acquired from more reliable information sources to estimate information contained in the visualization data. This eliminates the need for the information processing device 100 to collect large amounts of training data on its own, making it easy to accommodate new formats and items, and eliminating the computational costs of training. Furthermore, by selecting the information sources used to acquire information, the information processing device 100 can ensure the accuracy of the information, and even if the information is inaccurate, it can present the information on which it was derived. This allows the information processing device 100 to improve the accuracy and comprehensiveness of the estimated visualization data.

[0139] [Program] A program written in a computer-executable language may be created to execute the processes performed by the information processing device 100 according to the above embodiment. In one embodiment, the information processing device 100 can be implemented by installing an information processing program that executes the above information processing as package software or online software on a desired computer. For example, by executing the information processing program on an information processing device, the information processing device can function as the information processing device 100. Other examples of information processing devices include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants). The functions of the information processing device 100 may also be implemented on a cloud server.

[0140] 13 is a diagram showing an example of a computer that executes an information processing program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0141] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, for example. The video adapter 1060 is connected to a display 1061, for example.

[0142] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. The various pieces of information described in the above embodiments are stored in the hard disk drive 1031 or memory 1010, for example.

[0143] The information processing program is stored in the hard disk drive 1031 as, for example, a program module 1093 in which instructions to be executed by the computer 1000 are written. Specifically, the program module 1093 in which each process executed by the information processing device 100 described in the above embodiment is written is stored in the hard disk drive 1031.

[0144] Furthermore, data used for information processing by the information processing program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-described procedures.

[0145] The program module 1093 and program data 1094 related to the information processing program are not limited to being stored in the hard disk drive 1031, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1041. Alternatively, the program module 1093 and program data 1094 related to the information processing program may be stored in another computer connected via a network such as a LAN (Local Area Network) or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0146] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0147] REFERENCE SIGNS LIST 1 Information processing system 100 Information processing device 110 Communication unit 120 Storage unit 121 Collected data storage unit 122 Model information storage unit 123 Processing information storage unit 130 Control unit 131 Information acquisition destination derivation unit 132 Information acquisition unit 133 Information estimation unit 134 Provision unit

Claims

1. An information processing device comprising: an information acquisition destination derivation unit that derives an acquisition destination for information relating to visualization data, which is data that visualizes the configuration, status, and evaluation of a device, system, service, etc.; an information acquisition unit that acquires information relating to the visualization data from the acquisition destination derived by the information acquisition destination derivation unit; and an information estimation unit that estimates information included in the visualization data using the information relating to the visualization data acquired by the information acquisition unit.

2. The information processing device described in claim 1, characterized in that the information acquisition destination derivation unit derives the acquisition destination by inputting input information requesting information indicating the acquisition destination to a large-scale language model and causing the large-scale language model to output information indicating the acquisition destination.

3. The information processing device described in claim 1, characterized in that the information acquisition destination derivation unit derives an acquisition destination of information related to the visualization data that has information contained in the visualization data, and the information estimation unit updates the visualization data using information related to the visualization data acquired by the information acquisition unit.

4. The information processing device described in claim 1, characterized in that the information estimation unit extracts information or intermediate information of items included in the visualization data from information about the visualization data, and estimates the information included in the visualization data using the information extracted from the information about the visualization data.

5. The information processing device according to claim 1, characterized in that the information acquisition destination derivation unit derives multiple acquisition destinations for information related to the visualization data, the information acquisition unit acquires information related to the multiple visualization data from the multiple acquisition destinations derived by the information acquisition destination derivation unit, and the information estimation unit estimates information included in the visualization data using the information related to the multiple visualization data acquired by the information acquisition unit.

6. The information processing device described in claim 5, characterized in that the information estimation unit estimates information contained in the visualization data using information about visualization data selected from information about the plurality of visualization data based on the credibility of each of the plurality of sources.

7. An information processing method comprising: an information acquisition destination derivation step of deriving an acquisition destination of information relating to visualization data, which is data that visualizes the configuration, status, and evaluation of a device, system, service, etc.; an information acquisition step of acquiring information relating to the visualization data from the acquisition destination derived by the information acquisition destination derivation step; and an information estimation step of estimating information contained in the visualization data using the information relating to the visualization data acquired by the information acquisition step.

8. An information processing program that causes a computer to execute the following steps: an information acquisition destination derivation procedure that derives an acquisition destination for information related to visualization data, which is data that visualizes the configuration, status, and evaluation of a device, system, service, etc.; an information acquisition procedure that acquires information related to the visualization data from the acquisition destination derived by the information acquisition destination derivation procedure; and an information estimation procedure that estimates information included in the visualization data using the information related to the visualization data acquired by the information acquisition procedure.

Images