Information processing method, information processing device, and program

Abstract

An information processing method according to one aspect of the present disclosure acquires a plurality of pieces of analysis report information related to an analysis result of an analysis target, and outputs the plurality of pieces of analysis report information stepwise on the basis of a management level determined for each of the plurality of pieces of analysis report information. In the stepwise output of the plurality of pieces of analysis report information, when request information indicating an instruction to request information related to the analysis result is acquired from a predetermined user, one or more pieces of analysis report information among the plurality of pieces of analysis report information are output in the order of management levels determined for each of the plurality of pieces of analysis report information, thereby outputting the plurality of pieces of analysis report information stepwise.

Description

Information Processing Method, Information Processing Apparatus, and Program

[0001] The present disclosure relates to an information processing method, an information processing apparatus, and a program.

[0002] Recently, in the technical field of incident response for information security, organizations and individuals are required to respond to incidents quickly and effectively. Information handled in the technical field of incident response for information security is often treated as confidential for an organization or an individual, such as, for example, threat information (Indicator of Compromise, hereinafter also referred to as IoC). Therefore, there is a risk of unintended disclosure such as information leakage of IoC, or human error such as concealment of information to be shared. Conventionally, in order to suppress such human error, there is a technique for sharing and distributing IoC (see, for example, Patent Document 1 and Non-Patent Document 1).

[0003] Patent Document 1 discloses a method of safely exchanging information between organizations or individuals by adding metadata to IoC. Non-Patent Document 1 also discloses an example of applying an access management group interactively by a large language model (hereinafter also referred to as LLM).

[0004] Japanese Patent No. 6736657

[0005] SCREEN ADVANCE SYSTEM SOLUTIONS CO., LTD., "Riaru Mamori Tokku", [online] Reiwa 3, [searched on October 15, 2024], Internet <URL: https: / / www.screen.co.jp / as / solution / real>

[0006] The present disclosure provides an information processing method and the like that can reduce the risk of information leakage.

[0007] An information processing method according to one aspect of this disclosure acquires multiple analysis report information relating to the analysis results of an analysis target, outputs the multiple analysis report information in stages based on the management level defined for each of the multiple analysis report information, and in the staged output of the multiple analysis report information, when request information indicating an instruction to request information regarding the analysis results is obtained from a predetermined user, the method outputs one or more of the multiple analysis report information in order of the management levels defined for each of the multiple analysis report information, thereby outputting the multiple analysis report information in stages.

[0008] An information processing device according to one aspect of the present disclosure comprises a processor and a memory, wherein the processor uses the memory to acquire a plurality of analysis report information relating to the analysis results of a target for analysis, outputs the plurality of analysis report information in stages based on the management level defined for each of the plurality of analysis report information, and in the staged output of the plurality of analysis report information, when request information indicating an instruction to request information relating to the analysis results is obtained from a predetermined user, the processor outputs one or more of the plurality of analysis report information in order of the management levels defined for each of the plurality of analysis report information, thereby outputting the plurality of analysis report information in stages.

[0009] A program relating to one aspect of this disclosure is a program for causing a computer to execute the information processing method described above.

[0010] This disclosure provides information processing methods and other solutions that can reduce the risk of information leakage.

[0011] Figure 1 is a block diagram showing an analysis system according to an embodiment. Figure 2 is a block diagram showing an input device according to an embodiment. Figure 3 is a block diagram showing an analysis device according to an embodiment. Figure 4 is a block diagram showing an output device according to an embodiment. Figure 5 is a block diagram showing an LLM according to an embodiment. Figure 6 is a flowchart showing the processing procedure of the analysis system according to an embodiment. Figure 7 is a flowchart showing the input processing of the input device according to an embodiment. Figure 8 is a flowchart showing the analysis processing of the analysis device according to an embodiment. Figure 9 is a flowchart showing the output processing of the output device according to an embodiment. Figure 10 is a flowchart showing the detailed analysis processing of the analysis device according to an embodiment. Figure 11 is a schematic diagram showing the information stored in the memory unit of the input device according to an embodiment. Figure 12 is a schematic diagram showing the information stored in the memory unit of the analysis device according to an embodiment. Figure 13 is a schematic diagram showing the information stored in the memory unit of the output device according to an embodiment. Figure 14 is a diagram showing a first example of an image based on the information output by the output device according to an embodiment. Figure 15 is a diagram showing a second example of an image based on the information output by the output device according to an embodiment. Figure 16 is a diagram showing a third example of an image based on information output by the output device according to the embodiment. Figure 17 is a diagram showing a fourth example of an image based on information output by the output device according to the embodiment. Figure 18 is a block diagram of an information processing device according to the embodiment. Figure 19 is a flowchart showing an information processing method according to the embodiment.

[0012] (Summary of the Invention) In recent years, in the field of information security incident response technology, organizations and individuals are required to respond to incidents quickly and effectively. Traditional manual incident response is time-consuming and labor-intensive, and also carries the risk of human error. Therefore, in recent years, the automation of incident response has progressed, and systems that enable real-time threat detection and response are being introduced.

[0013] Recently, in the field of incident response technology, the use and application of LLM (Language-Language-Based Learning) for purposes such as question-and-answer sessions has been progressing. By using LLM, it becomes possible to analyze large amounts of data at high speed, automate the creation of detailed incident reports, and propose appropriate countermeasures for incidents, thereby further improving the efficiency of incident response.

[0014] However, in reality, human judgment is sometimes required when making decisions. In such cases, the risk of human error mentioned above still remains. This is also true in systems where LLM is used. In particular, much of the information handled in the field of information security incident response is confidential to the organization or individual, such as IoCs. Therefore, there is a risk of human error such as the unintentional disclosure of IoCs or the concealment of information that should be shared. To mitigate this risk, the thorough application of the so-called Need To Know principle is required of organizations and individuals in the field of information security incident response.

[0015] Conventionally, to deter such human errors, there are technologies for sharing and distributing IoCs, as disclosed in Patent Document 1 and Non-Patent Document 1. In all of the technologies dealt with in these documents, the system controls the scope of confidential information that can be disclosed, for example, as used in non-disclosure agreements.

[0016] However, the access management group defined in Patent Document 1 requires manual updating of information within an organization to keep up with organizational restructuring. Similarly, the access management group defined in Patent Document 1 requires manual updating of information within an individual to keep up with changes in that individual's job responsibilities. Furthermore, in Non-Patent Document 1, the highest-ranking authority holder has access to sensitive information from the outset. Therefore, the highest-ranking authority holder faces a high risk of information leakage, for example, through kidnapping or coercion. In light of these issues, the inventors of the present invention have arrived at this disclosure. Specifically, in this disclosure, in any information security incident response, the information presented is dynamically adjusted so that the user is presented with information tailored to the user by interacting with the access management group using LLM in natural language, and information indicating the extent to which confidential information can be disclosed to the user is output.

[0017] The following describes examples of inventions that can be obtained from the disclosures in this specification, and explains the effects and other benefits that can be obtained from such inventions.

[0018] Example 1 is an information processing method that acquires multiple analysis report information relating to the analysis results of the subject to analysis, outputs the multiple analysis report information in stages based on the management level defined for each of the multiple analysis report information, and in the staged output of the multiple analysis report information, when request information indicating an instruction to request information regarding the analysis results is acquired from a predetermined user, one or more of the multiple analysis report information are output in order of the management levels defined for each of the multiple analysis report information, thereby outputting the multiple analysis report information in stages.

[0019] The amount of information necessary to accurately understand the analysis results varies depending on the user's capabilities. Furthermore, the less information presented to the user, the lower the risk of information leakage. Therefore, in one aspect of this disclosure, instead of presenting a large amount of analysis report information to the user at once, the analysis report information is output in stages each time it is requested by the user, thus presenting the user with analysis report information in stages. This eliminates the need to output unnecessary analysis report information depending on the user's capabilities. Consequently, the amount of analysis report information presented to the user can be reduced. Therefore, the risk of information leakage can be reduced.

[0020] Example 2 is the information processing method described in Example 1, wherein the management level set for each of the multiple analysis report information is set lower the wider the range of people permitted to access the analysis report information, and in the stepwise output of the multiple analysis report information, when the requested information is obtained, one or more analysis report information may be output in order from the analysis report information with the lowest management level among the multiple analysis report information.

[0021] The wider the range of people permitted to access the analysis report information—that is, the more people who can access the analysis report information without problems—the lower the risk of information leakage is considered to be. Therefore, among multiple analysis reports, those with the widest range of people permitted to access them are output in stages. This can further reduce the risk of information leakage.

[0022] Example 3 is an information processing method described in Example 1 or Example 2, wherein in the stepwise output of the multiple analysis report information, when the request information is obtained, one or more analysis report information may be output in order from the analysis report information with the lowest management level among the multiple analysis report information, up to the analysis report information corresponding to the management level defined for the predetermined user.

[0023] Depending on a user's job title and organizational affiliation, the information they are permitted to access may vary. Therefore, analytical reports are output in stages, starting with the lowest level of management and progressing to the level corresponding to the user's assigned management level. This ensures that only user-specific analytical reports are presented, further reducing the risk of information leakage.

[0024] Example 4 is an information processing method described in any of Examples 1 to 3, wherein the object to be analyzed is acquired, and in acquiring the multiple analysis report information, the multiple analysis report information generated by inputting at least one different piece of confidential information from the multiple pieces of confidential information included in the object to be analyzed into each of the multiple large-scale language models is acquired.

[0025] According to this, by using multiple large-scale language models, it is possible to obtain multiple analytical report information tailored to confidential information.

[0026] Example 5 is an information processing method described in Example 4, wherein management information indicating the management level corresponding to the scope of persons permitted to access each of the multiple confidential pieces of information is obtained, and in obtaining the multiple analysis report information, the multiple analysis report information generated by inputting one or more of the confidential pieces of information into each of the multiple large-scale language models based on the management information is obtained.

[0027] According to this, multiple analytical report pieces of information may be obtained depending on the scope of individuals who have been granted access to confidential information.

[0028] Example 6 is an information processing method described in Example 4 or Example 5, wherein in acquiring the plurality of analysis report information, the plurality of large-scale language models are made to generate a plurality of first analysis report information relating to the one or more confidential pieces of information by inputting the one or more confidential pieces of information into each of the plurality of large-scale language models, and the plurality of second analysis report information generated by inputting information from the plurality of first analysis report information according to the management level defined for each of the plurality of large-scale language models into each of the plurality of large-scale language models is acquired as the plurality of analysis report information.

[0029] According to this, the accuracy of analysis on the target of analysis by large-scale language models can be improved.

[0030] Example 7 is an information processing method described in any of Examples 1 to 6, which may output level information indicating the management level defined for the predetermined user.

[0031] According to this, users can recognize their own level of control.

[0032] Example 8 is an information processing device comprising a processor and memory, wherein the processor uses the memory to acquire multiple analysis report information relating to the analysis results of the object to be analyzed, outputs the multiple analysis report information in stages based on the management level defined for each of the multiple analysis report information, and in the staged output of the multiple analysis report information, when request information indicating an instruction to request information relating to the analysis results is obtained from a predetermined user, one or more of the multiple analysis report information are output in order of the management levels defined for each of the multiple analysis report information, thereby outputting the multiple analysis report information in stages.

[0033] According to this, it will have the same effect as the information processing method relating to one aspect of this disclosure.

[0034] Example 9 is a program for causing a computer to execute one of the information processing methods described in Examples 1 to 7.

[0035] According to this, it will have the same effect as the information processing method relating to one aspect of this disclosure.

[0036] These comprehensive or specific embodiments may be implemented as a system, device, integrated circuit, computer program, or recording medium such as a computer-readable CD-ROM, or as any combination of a system, device, integrated circuit, computer program, and recording medium.

[0037] The embodiments will be described in detail below with reference to the drawings.

[0038] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, arrangement and connection configurations of components, steps, and the order of steps shown in the following embodiments are examples only and are not intended to limit this disclosure. Furthermore, any components in the following embodiments that are not described in the independent claims of this disclosure will be described as optional components.

[0039] Furthermore, the figures are not necessarily strictly accurate. In each figure, substantially identical components are denoted by the same reference numerals, and redundant explanations may be omitted or simplified.

[0040] Furthermore, in this specification, ordinal numbers such as "first," "second," etc., do not indicate the number or order of components unless otherwise specified, but are used to avoid confusion and to distinguish similar components.

[0041] Furthermore, in this specification, when we describe, for example, a value greater than or equal to a threshold and a value less than a threshold in comparison, it means that the value is distinguished by that threshold, and may mean that the value is greater than the threshold and less than or equal to the threshold, respectively.

[0042] In addition, in this specification, an access management group means a symbol that makes the range in which confidential information can be disclosed quantitatively comparable, and is not limited to TLP (Traffic Light Protocol) and / or PAP (Permissible Actions Protocol), and may be different symbols such as external company secrets and internal secrets among related parties as long as it has the function.

[0043] In addition, in this specification, LLM means a language model that performs natural language processing and is trained using a large amount of text data. For example, each LLM may have a function of learning by having LLMs interact with each other (that is, exchanging information).

[0044] (Embodiment) <Block Diagram> FIG. 1 is a block diagram showing an analysis system 1 according to an embodiment.

[0045] The analysis system 1 is a system that analyzes analysis targets such as logs (log information) showing the processes executed by devices or communication logs such as data flowing on a communication network such as the Internet. The analysis system 1 analyzes information such as the input logs using the LLM 13.

[0046] The analysis system 1 includes an input device 10, an analysis device 11, an output device 12, and an LLM 13.

[0047] The input device 10 and the analysis device 11 are connected by a signal line 14, and the analysis device 11 and the output device 12 are connected by a signal line 15. In addition, the input device 10, the analysis device 11, and the output device 12 are connected to the LLM 13 via a network 16.

[0048] In addition, in the present embodiment, the input device 10, the analysis device 11, and the output device 12 do not communicate with devices other than the LLM 13 via the network 16. That is, in the present embodiment, the input device 10, the analysis device 11, and the output device 12 do not communicate with each other via the network 16. Of course, the input device 10, the analysis device 11, and the output device 12 may communicate with devices other than the LLM 13 via the network 16. The network 16 is, for example, a LAN (Local Area Network), but any network such as a WAN (Wide Area Network) or the Internet may be adopted.

[0049] The input device 10 is a computer to which an analysis target is input. In other words, the input device 10 acquires the analysis target. The input device 10 outputs, for example, the acquired analysis target to the analysis device 11 via the signal line 14.

[0050] The analysis device 11 is a computer that analyzes the input (acquired) analysis target. The analysis device 11 outputs, for example, the analysis target or information (specifically, IoC) included in the analysis target to the LLM 13 via the network 16, and acquires from the LLM 13 the analysis result of the analysis target or information included in the analysis target (specifically, information indicating the analysis result). The analysis device 11 extracts, for example, IoCs for each predetermined IoC type from the analysis target, and outputs information indicating the extracted result (primary analysis result), that is, the extracted IoCs to the LLM 13. Thereby, the analysis device 11 acquires from the LLM 13 an analysis report (analysis report information) indicating the analysis result (secondary analysis result) of the IoCs output to the LLM 13. The analysis device 11 outputs, for example, the acquired analysis result (analysis report) to the output device 12 via the signal line 15.

[0051] The output device 12 is a computer that outputs the input (acquired) analysis result (analysis report). The output device 12 presents the analysis result to the user, for example, by outputting the analysis result to a presentation device to cause the presentation device to present the analysis result.

[0052] The presentation device is, for example, a display device such as a screen. The presentation device only needs to be capable of presenting the analysis results to the user. For example, the presentation device may be an audio device with a speaker that presents the analysis results to the user verbally.

[0053] LLM13 is a computer having a large-scale language model (LLM) that analyzes the input (acquired) analysis target or the information contained in the analysis target (specifically, IoC). LLM13 outputs the analysis results (specifically, an analysis report) of the acquired analysis target or the information contained in the analysis target to the analysis device 11 via the network 16.

[0054] Furthermore, the large-scale language model used by LLM13 may be trained using any method.

[0055] The output device 12 acquires, for example, multiple analysis reports concerning the analysis results of the target of analysis (specifically, secondary analysis results by LLM 13), and outputs the acquired multiple analysis report information in stages based on the management level defined for each of the acquired multiple analysis report information. In the staged output of multiple analysis report information, when the output device 12 acquires request information from a predetermined user indicating an instruction to request information on the analysis results, it outputs one or more of the multiple analysis report information in order of the access management group including the TLP defined for each of the multiple analysis report information, thereby outputting the multiple analysis report information in stages. In other words, when the output device 12 acquires request information from a user, it outputs one or more of the multiple analysis report information, and when it acquires further request information from the same user, it further outputs one or more analysis report information from the multiple analysis report information that is different from the one or more analysis reports output previously. For example, when the output device 12 obtains request information from a user, it outputs one or more analysis report information with a first TLP defined, and when it obtains further request information from the same user, it outputs one or more further analysis report information with a second TLP different from the first TLP defined. Specifically, each time the output device 12 obtains request information from a predetermined user, it outputs multiple analysis reports in stages according to the access management group that includes the TLP defined for each of the multiple analysis reports, and the TLP indicated in the maximum allowed authority defined for the predetermined user. In this embodiment, the analysis device 11 obtains multiple analysis reports (secondary analysis reports) from multiple LLMs 13. The output device 12 obtains multiple analysis reports from the analysis device 11.

[0056] An access control group (more specifically, a TLP) indicates the scope of individuals permitted to access the IoC (i.e., data) included in the analysis, or the analysis reports created by LLM13 using that IoC (e.g., secondary analysis reports presented to users). In other words, a TLP indicates the scope of sharing of the IoC or analysis report. That is, a TLP indicates who may view the IoC or analysis report. A TLP is an example of an access control level.

[0057] In this embodiment, an access control group (more specifically, a TLP and PAP) is defined for the IoC, for example, by an administrator. Furthermore, a TLP is defined for the analysis report, for example, based on the access control group defined for the IoC used to create (generate) the analysis report. The TLP defined for the analysis report may be automatically determined by, for example, the analysis device 11 or LLM 13, or it may be manually determined by an administrator. Similarly, a TLP is defined for the LLM 13, for example, based on the access control group defined for the IoC used to create the analysis report. The TLP defined for the LLM 13 may be automatically determined by, for example, the analysis device 11 or LLM 13, or it may be manually determined by an administrator. In this embodiment, a maximum permissible authority (specifically, a TLP) is defined for the user, for example, by an administrator. The maximum permissible authority (TLP) defined for a user indicates the TLP level of the IoC or analysis report to which the user is permitted access. Information indicating the access management group and TLP is pre-stored in, for example, storage units 102, 112, 122 and / or 132.

[0058] For example, the TLP (Top Level) set for each of the multiple analysis reports will be set lower the wider the range of people who are permitted to access that analysis report.

[0059] In this embodiment, TLP has four stages, for example, "WHITE", "AMBER", "AMBER+STRICT", and "RED".

[0060] "WHITE" indicates, for example, that the IoC (Indicator of Control) can be made public to anyone. In other words, an IoC designated as "WHITE" is information that anyone can view (access).

[0061] "AMBER" indicates, for example, that IoCs may only be shared among a specified organization and its business partners.

[0062] "AMBER+STRICT" indicates, for example, that IoCs may only be shared within a designated organization.

[0063] "RED" indicates information that is, for example, kept confidential in principle and accessible only to specific individuals.

[0064] In this embodiment, the scope of individuals permitted to access the analysis report is broadest in the order of "WHITE," "AMBER," "AMBER+STRICT," and "RED." In other words, when the scope of individuals permitted to access the analysis report is the broadest, the analysis report is designated as "WHITE." When the scope is the next broadest, the analysis report is designated as "AMBER." When the scope is the next broadest, the analysis report is designated as "AMBER+STRICT." When the scope is the next broadest, the analysis report is designated as "RED."

[0065] In this embodiment, TLP may be described as high or low, such as "WHITE" having a lower TLP than "AMBER," or "AMBER" having a higher TLP than "WHITE." For example, a user designated as "AMBER" is permitted to access analysis reports designated as "WHITE" or "AMBER," but not as "AMBER+STRICT" or "RED." In other words, such a user will be presented with analysis reports designated as "WHITE" or "AMBER," but will not be permitted to access analysis reports designated as "AMBER+STRICT" or "RED." The scope of those permitted access is, for example, broadest for "WHITE," followed by "WHITE" > "AMBER" > "AMBER+STRICT" > "RED."

[0066] PAP includes information indicating actions that individuals who view an IoC or analysis report may take. In this embodiment, PAP consists of four levels, for example, "WHITE," "GREEN," "AMBER," and "RED."

[0067] "WHITE" indicates, for example, that the IoC can be handled in any way.

[0068] "GREEN" indicates that certain proactive actions are permitted, such as using the internet to research IoCs.

[0069] "AMBER" indicates, for example, that active actions are not permitted, and only passive actions are allowed.

[0070] "RED" indicates, for example, that IoC information should not be disclosed to anyone.

[0071] Request information is information obtained from the user via an operating device or the like. Examples of request information include the dialogue entered by the user into the output device 12, such as "Please submit the analysis report for honeypot access log 01," and "I don't understand that," (see, for example, Figure 15).

[0072] The operating device can be any device that accepts input (operation) from the user. For example, the operating device can be a mouse, keyboard, microphone, and / or touch panel.

[0073] For example, in the stepwise output of multiple analysis report information, when the output device 12 receives the requested information, it outputs one or more analysis reports in order from the analysis report with the lowest TLP among the multiple analysis reports.

[0074] Furthermore, when the output device 12 acquires the requested information, it only needs to output one or more analysis report information from among multiple analysis report information for which the same TLP is defined. For example, if there are multiple analysis report information for which the same TLP is defined, when the output device 12 acquires the requested information, it may output all of the multiple analysis report information for which the same TLP is defined, or it may output some of the analysis report information for which the same TLP is defined. In other words, each time the output device 12 acquires the requested information, it may output some of the multiple analysis report information for which the same TLP is defined. Alternatively, each time the output device 12 acquires the requested information, it may output one or more analysis report information for each TLP from among the multiple analysis report information.

[0075] For example, when the output device 12 receives a request for a secondary analysis report from a user designated as "AMBER" (i.e., acquires the request information), it first outputs a secondary analysis report designated as "WHITE". If the user further requests the secondary analysis report, the output device 12 then outputs a secondary analysis report designated as "AMBER". Even if the user further requests the secondary analysis report, the output device 12 does not output a secondary analysis report designated as "AMBER + STRICT". In this way, the output device 12 outputs analysis reports in stages (interactively) based on the TLP designated by the user.

[0076] Furthermore, for example, the output device 12 outputs information indicating the user's designated access management group (specifically, TLP) (information indicating the maximum permitted authority) to the presentation device, thereby presenting the user with information indicating the user's designated access management group.

[0077] Information indicating the user's assigned access control group (specifically, TLP) (information indicating the maximum permitted privileges) is an example of level information. Output device 12 causes the presentation device to display information that directly indicates the user's assigned TLP, such as, "Your management level is TLP:AMBER," "You can act on this matter with TLP:AMBER," or "You can only act on this matter with TLP:RED." Alternatively, output device 12 may cause the presentation device to display information that indirectly indicates the user's assigned access control group, such as, "There are no more reports that can be shared."

[0078] The input device 10, the analysis device 11, the output device 12, and the LLM 13 are each implemented by a computer that includes, for example, a communication interface, a storage device for storing various information, a non-volatile memory for storing a program, a volatile memory which is a temporary storage area for executing a program, input / output ports for sending and receiving signals, and a processor such as a CPU for executing a program. The communication interface may be implemented by a connector to which a communication line is connected for wired communication, or by an antenna and a wireless communication circuit for wireless communication. The storage device may be implemented by, for example, an HDD (Hard Disk Drive) or semiconductor memory.

[0079] The input device 10, the analysis device 11, the output device 12, and the LLM 13 may be implemented as a single mechanical device, or as multiple mechanical devices located in different locations. In other words, the analysis system 1 may be implemented as a single computer, or as multiple computers that can communicate with each other. The large-scale language model used by the LLM 13 may be stored, for example, in the memory unit 102 of the input device 10 (see Figure 2), the memory unit 112 of the analysis device 11 (see Figure 3), or the memory unit 122 of the output device 12 (see Figure 4).

[0080] Figure 2 is a block diagram showing the input device 10 according to the embodiment. Figure 3 is a block diagram showing the analysis device 11 according to the embodiment. Figure 4 is a block diagram showing the output device 12 according to the embodiment. Figure 5 is a block diagram showing the LLM 13 according to the embodiment.

[0081] The input device 10, the analysis device 11, the output device 12, and the LLM 13 each comprise a processing unit, a storage unit, and a communication unit. Specifically, the input device 10 comprises a processing unit 101, a storage unit 102, and a communication unit 103. The analysis device 11 comprises a processing unit 111, a storage unit 112, and a communication unit 113. The output device 12 comprises a processing unit 121, a storage unit 122, and a communication unit 123. The LLM 13 comprises a processing unit 131, a storage unit 132, and a communication unit 133.

[0082] The processing units 101, 111, 121, and 131 perform various information processing. The processing units 101, 111, 121, and 131 are implemented, for example, by a memory that stores a control program and a processor such as a CPU (Central Processing Unit) that executes the control program stored in the memory.

[0083] The memory units 102, 112, 122, and 132 store various types of information. The memory units 102, 112, 122, and 132 are implemented, for example, by HDDs or semiconductor memory.

[0084] Communication units 103, 113, 123, and 133 communicate various types of information. Communication units 103, 113, 123, and 133 are implemented by a communication interface. The communication interface may be implemented by a connector to which a communication line is connected for wired communication, or by an antenna and wireless communication circuit for wireless communication.

[0085] In the example shown in Figure 1, the analysis system 1 comprises one LLM 13. The analysis system 1 may comprise multiple LLM 13s. When the analysis system 1 comprises multiple LLM 13s, the multiple LLM 13s may, for example, each have different large-scale language models. Different large-scale language models are, for example, large-scale language models trained using different information. Each large-scale language model has different IoCs (Inputs of Computation) input when analyzing the target of analysis. Each large-scale language model is, for example, a trained model that has undergone machine learning in response to the IoCs input when analyzing the target of analysis.

[0086] In the following explanation, the analysis system 1 is described as comprising multiple LLMs 13, each storing a different large-scale language model.

[0087] The analysis device 11 acquires, for example, an object to be analyzed, and then acquires multiple analysis reports from the multiple LLMs 13 by inputting at least one different IoC (for example, different IoC types) from among the multiple IoCs included in the object to each of the multiple LLMs 13. An IoC is an example of confidential information. In this embodiment, the input device 10 acquires the object to be analyzed from an external server device or the like. The analysis device 11 acquires the object to be analyzed from the input device 10.

[0088] Furthermore, for example, the analysis device 11 acquires information indicating the TLP (Time Level Program) for each of the multiple IoCs, corresponding to the scope of persons authorized to access that IoC (in this embodiment, access management group information indicating an access management group). Also, for example, the analysis device 11 acquires multiple analysis reports created by inputting one or more IoCs into each of the multiple LLMs 13 based on the access management group information. Access management group information is an example of management information. In this embodiment, the input device 10 acquires access management group information from the administrator via the operating device. The analysis device 11 acquires access management group information from the input device 10.

[0089] Furthermore, for example, the analysis device 11 inputs one or more IoCs into each of the multiple LLMs 13, causing the multiple LLMs 13 to create multiple primary analysis reports related to one or more IoCs, and then obtains multiple secondary analysis reports created by inputting information from the multiple primary analysis reports into each of the multiple LLMs 13 according to the TLP specified for each of the multiple LLMs 13. The analysis device 11 outputs the multiple secondary analysis reports to the output device 12. The output device 12 outputs the secondary analysis reports to the presentation device, thereby presenting the secondary analysis reports to the user. The primary analysis report is an example of first analysis report information. The secondary analysis report is an example of second analysis report information.

[0090] <Flowchart> Figure 6 is a flowchart showing the processing procedure of the analysis system 1 according to the embodiment.

[0091] First, the analysis system 1 performs input processing in the processing unit 101 of the input device 10 (S100).

[0092] Next, the analysis system 1 performs analysis processing in the processing unit 111 of the analysis device 11 (S110).

[0093] Next, the analysis system 1 performs output processing in the processing unit 121 of the output device 12 (S120).

[0094] At least some of the multiple LLM13s are activated by the processing in step S100 (specifically, step S1002 described later) (S130). At least one of the activated LLM13s is terminated (stopped) by the processing in step S120 (specifically, step S1206 described later) (S131).

[0095] Figure 7 is a flowchart showing the input processing of the input device 10 according to the embodiment. Specifically, Figure 7 shows the details of the processing procedure in step S100.

[0096] First, the input device 10 sets the types of IoCs that can be obtained from the analysis target (S1000). In other words, the input device 10 obtains IoC type information indicating the type of IoC. Specifically, the input device 10 obtains IoC type information indicating the types of IoCs that may be included in the analysis target. For example, an administrator such as an analyst inputs IoC type information using the operating device. The input device 10 obtains IoC type information from the administrator via the operating device.

[0097] The IoC type information indicates that the IoC type may be all of the multiple IoC types described in any information security incident response manual, or it may be a part of those multiple IoC types. For example, the IoC type information indicates that the IoC type may be all of the multiple IoC types obtained as a result of the analysis of the subject of analysis, as described in the incident response manual, or it may be a part of those multiple IoC types.

[0098] Next, the input device 10 sets an access management group for each IoC type (S1001). The input device 10 stores this setting in the storage unit 102. Specifically, the input device 10 acquires access management group information indicating the access management group for each IoC type. For example, an administrator inputs access management group information using an operating device. The input device 10 acquires access management group information from the administrator via the operating device. The input device 10 stores the IoC type and access management group in the storage unit 102, linking them together.

[0099] Access management group information indicates the scope of individuals who are permitted to access the IoC. In other words, access management group information indicates individuals who are allowed to refer to (verify) the IoC. In this embodiment, access management group information includes information indicating the TLP and information indicating the PAP.

[0100] Information indicating a TLP (Through the Link Level) indicates the scope of IoC (Indicator of Control) sharing. Specifically, it indicates the scope of individuals who are permitted to access the IoC. In other words, it indicates the individuals who are allowed to refer to the IoC.

[0101] Information indicating PAP (Permitted Actions) is information that indicates permitted actions when using IoC (Indicators of Control). Specifically, information indicating PAP is information that indicates actions that a person who has referenced IoC may perform using IoC.

[0102] Furthermore, the input device 10 calculates the total number of access management groups required for the analysis of the target based on the types of IoCs included in the target of analysis. For example, the input device 10 determines one or more LLMs 13 from among a plurality of LLMs 13 that are linked to the access management groups required for the analysis of the target. Information showing the correspondence between LLMs 13 and access management groups is stored in advance, for example, in the storage unit 102.

[0103] Next, the input device 10 activates one or more LLMs 13 from among the multiple LLMs 13 that belong to the access management group corresponding to one or more IoCs included in the analysis target (S1002). In other words, the input device 10 activates one of the multiple LLMs 13 that has a TLP defined that corresponds to the access management group defined for one or more IoCs included in the analysis target. The analysis target may be input to the input device 10 from an external device via the communication unit 103, for example.

[0104] Figure 8 is a flowchart showing the analysis process of the analysis apparatus 11 according to the embodiment. Specifically, Figure 8 shows the details of the processing procedure in step S110.

[0105] First, the analyzer 11 extracts IoCs for each IoC type from the arbitrary analysis results (primary analysis results) of the object to be analyzed (S1100).

[0106] The information showing the analysis results may, for example, be information showing the results of an analysis conducted by an analyst in accordance with an incident response manual, or it may be information showing the results of an automated device such as Security Information and Event Management (hereinafter also referred to as SIEM) performing an analysis of the target according to analysis rules. The information showing the analysis results may, for example, be input from an external device to the input device 10 via the communication unit 103 and output from the input device 10 to the analysis device 11. Alternatively, the information showing the analysis results may be input from an external device to the analysis device 11 via the communication unit 113.

[0107] Furthermore, the extracted IoCs may be all of the IoC types indicated by the IoC type information stored in the storage unit 102 in step S1001, or they may be a part of the multiple IoC types indicated by the IoC type information.

[0108] Here, information is transmitted between the input device 10 and the analysis device 11 only via, for example, the signal line 14 connecting the communication unit 103 and the communication unit 113. In this way, communication between the input device 10 and the analysis device 11 is performed without the need for other devices in the analysis system 1, thereby suppressing unintended information leakage in the communication path.

[0109] Next, the analysis device 11 inputs the IoC to the LLM 13 belonging to the access management group corresponding to the type of IoC extracted (S1101). In other words, the analysis device 11 outputs the IoC to the LLM 13 among the multiple LLM 13s that has a TLP defined that corresponds to the access management group corresponding to the type of IoC extracted.

[0110] Next, the analysis device 11 performs a detailed analysis process (S1102). By performing the detailed analysis process, the analysis device 11 outputs a secondary analysis report (secondary analysis report information) to the output device 12. The detailed analysis process will be described later.

[0111] Figure 9 is a flowchart showing the output processing of the output device 12 according to the embodiment. Specifically, Figure 9 shows the details of the processing procedure in step S120.

[0112] First, the output device 12 obtains a secondary analysis report from the LLM 13 belonging to the access management group with the widest scope of sharing among the one or more LLMs 13 to which the IoC has been input, and presents the obtained secondary analysis report to the user (S1200). Specifically, the output device 12 presents the secondary analysis report to the user by outputting the secondary analysis report created by the LLM 13 to which the lowest level TLP has been defined to the presentation device.

[0113] Next, the output device 12 determines whether the user has accepted the presented secondary analysis report (S1201). The user inputs information indicating whether they have accepted the presented secondary analysis report to the output device 12, for example, by operating the control device. Based on the information thus input, the output device 12 determines whether the user has accepted the presented secondary analysis report.

[0114] If the output device 12 determines that the user has not accepted the presented secondary analysis report (No in S1201), it determines whether there is an LLM 13 belonging to the next widest access management group (S1202). For example, the output device 12 determines whether there is an LLM 13 belonging to the next widest access management group after the LLM 13 belonging to the widest access management group among the one or more LLM 13s. Thus, in step S1202, the output device 12 determines whether there is an LLM 13 belonging to the next widest access management group after the LLM 13 that created the last secondary analysis report presented to the user among the one or more LLM 13s.

[0115] If the output device 12 determines that there is an LLM 13 belonging to the next widest access management group (Yes in S1202), it determines whether the next widest access management group is accessible with the user's maximum permitted privileges (S1203). Specifically, the output device 12 determines whether the maximum permitted privileges set for the user are the privileges that allow them to refer to the secondary analysis report created by the LLM 13 belonging to the next widest access management group.

[0116] If the output device 12 determines that the next widest access management group is accessible with the user's maximum permitted privileges (Yes in S1203), it obtains a secondary analysis report from the LLM 13 belonging to the next widest access management group, presents the obtained secondary analysis report to the user, and returns to step S1201.

[0117] Steps S1201, S1202, and S1203 are repeated until the user does not accept the secondary analysis report, that is, each time the user requests a secondary analysis report, the user is presented with secondary analysis reports in a stepwise manner, starting with the report with the lowest TLP and progressing up to the report with a TLP corresponding to the maximum allowable authority (TLP) set for the user. Each time a secondary analysis report is presented to the user, the TLP set for that report increases.

[0118] If the output device 12 determines that the user has accepted the presented secondary analysis report (Yes in S1201), if it determines that there is no LLM 13 belonging to the next broadest access management group (No in S1202), or if it determines that the next broadest access management group is not accessible with the user's maximum permitted privileges (No in S1203), it stores information indicating the access management group of the LLM 13 that created the last presented secondary analysis report in the storage unit 122 (S1204).

[0119] Next, the output device 12 presents the user with information indicating the access management group applicable to the user (S1205). Specifically, the output device 12 presents the user with information indicating the access management group applicable to the user by outputting information indicating the maximum permissible authority (more specifically, TLP) set for the user to the presentation device.

[0120] Next, the output device 12 terminates all LLM 13s belonging to the access management group (S1206). In other words, the output device 12 stops all running LLM 13s.

[0121] Figure 10 is a flowchart showing the detailed analysis process of the analysis apparatus 11 according to the embodiment. Specifically, Figure 10 shows the details of the processing procedure in step S1102.

[0122] First, the analysis device 11 instructs one or more LLMs 13 to execute external linkage processing in a manner compliant with the access management group to which the LLM 13 belongs (S11020).

[0123] External integration processing is the process by which LLM13 communicates with devices other than those provided by the analysis system 1. Depending on the TLP (Access Control Group) defined for LLM13, it may be permitted to obtain information from external servers, etc.

[0124] For example, an IoC designated as "PAP: GREEN" allows RAG (Retrievable Augmented Generation) analysis. On the other hand, an IoC designated as "PAP: RED" allows analysis based only on information generated within a specified organization. For example, the analysis device 11 outputs information instructing external collaboration processing to each of the one or more LLMs 13, thereby causing each of the one or more LLMs 13 to perform external collaboration processing to acquire information from an external server by communicating with the external server according to the access management group to which the LLM 13 belongs. In other words, external collaboration processing in a manner compliant with the access management group to which the LLM 13 belongs is, for example, a process that causes the LLM 13 to acquire information from an external server by communicating with the external server according to the access management group to which the LLM 13 belongs.

[0125] Next, the analyzer 11 determines whether or not a primary analysis report has been generated by the LLM 13 (S11021). For example, the analyzer 11 determines whether or not a primary analysis report has been obtained from the LLM 13 within a predetermined first hour after executing step S11020.

[0126] If the analyzer 11 determines that a primary analysis report has not been generated by the LLM 13 (No in S11021), it returns to step S11020.

[0127] If the analyzer 11 determines that a primary analysis report has been generated by the LLM 13 (Yes in S11021), it stores the primary analysis report from the LLM 13 in the storage unit 112 (S11022).

[0128] Next, the analysis device 11 instructs each of the one or more LLMs 13 to perform the primary analysis report sharing process in a manner compliant with the access management group to which the LLM 13 belongs (S11023).

[0129] The sharing process is a process that allows one or more LLMs 13 to share the information contained in the primary analysis report they have created. Each of the one or more LLMs 13 creates a primary analysis report using one or more IoCs that are different from each other. The narrower the scope of sharing set for the access management group to which the LLMs 13 belong, the more IoCs the LLMs 13 use to create their primary analysis reports. Therefore, a primary analysis report created by an LLM 13 belonging to an access management group with a narrower scope of sharing may contain information that can be used by an LLM 13 belonging to an access management group with a wider scope of sharing than that LLM 13. Therefore, the analysis device 11 allows each of the one or more LLMs 13 to share at least a portion of the content (information) contained in the primary analysis report created by each of the one or more LLMs 13, based on the access management group to which each of the one or more LLMs 13 belongs, by having the LLMs 13 output to each other. In other words, the process of sharing primary analysis reports in a manner compliant with the access management group to which LLM13 belongs is, for example, a process of sharing at least a portion of the content (information) contained in the primary analysis report created by one or more LLM13s with one or more LLM13s by having them output to each other.

[0130] Next, the analyzer 11 instructs the creation of a secondary analysis report based on the contents of the primary analysis report from another LLM 13 (S11024). In other words, the LLM 13 creates a secondary analysis report based on the primary analysis report it created and the primary analysis report created by the other LLM 13.

[0131] The analysis device 11 may also instruct each of the one or more LLMs 13 to perform the secondary analysis report sharing process in a manner compliant with the access management group to which the LLM 13 belongs. The secondary analysis report sharing process in a manner compliant with the access management group to which the LLM 13 belongs is the same as the primary analysis report sharing process in a manner compliant with the access management group to which the LLM 13 belongs. In other words, the secondary analysis report sharing process in a manner compliant with the access management group to which the LLMs 13 belong is a process in which, for example, at least a portion of the content (information) contained in the secondary analysis report created by each of the one or more LLMs 13 is output to each other, thereby sharing at least that portion among the one or more LLMs 13.

[0132] Next, the analyzer 11 determines whether a secondary analysis report has been generated by the LLM 13 (S11025). For example, the analyzer 11 determines whether a secondary analysis report has been obtained from the LLM 13 within a predetermined second time after executing step S11024.

[0133] If the analyzer 11 determines that a secondary analysis report has not been generated by the LLM 13 (No in S11025), it returns to step S11023.

[0134] If the analyzer 11 determines that a secondary analysis report has been generated by the LLM 13 (Yes in S11025), it stores the secondary analysis report from the LLM 13 in the storage unit 112 (S11026).

[0135] Furthermore, the analysis device 11 outputs, for example, a secondary analysis report from the LLM 13 to the output device 12. The LLM 13 may also output a secondary analysis report to the output device 12.

[0136] If the result is No in step S11021, or No in step S11025, the analyzer 11 may stop processing by having the display device display information indicating an error.

[0137] Furthermore, the predetermined first time and predetermined second time may be arbitrarily determined in advance and are not particularly limited. The predetermined first time and predetermined second time may be stored in advance in the storage unit 112.

[0138] Furthermore, for example, if the primary analysis report created by LLM13 does not contain information that can be shared with other LLM13s, LLM13 does not need to perform the sharing process even if step S11023 is executed. Also in this case, LLM13 does not need to create a secondary analysis report. Also in this case, LLM13 may send the created primary analysis report to the analysis device 11 as a secondary analysis report. Also, the output device 12 may present the primary analysis report to the user.

[0139] <Various Information> Figure 11 is a schematic diagram showing the information stored in the storage unit 102 of the input device 10 according to the embodiment.

[0140] The memory unit 102 includes, for example, information indicating the object to be analyzed ("Object to be analyzed" as shown in Figure 11), information indicating the type of IoC included in the object to be analyzed ("IoC type" as shown in Figure 11), and information indicating the access management group defined for the type of IoC ("IoC access management group" as shown in Figure 11). The information indicating the access management group includes information indicating the TLP and information indicating the PAP.

[0141] Information indicating the target of analysis may include, for example, information indicating the name of the cyberattack, such as "honeypot access," "DDoS attack," or "RFI attack."

[0142] Information indicating the type of IoC includes information indicating the type of data that may be included in the analysis, such as "source IP," "URL," "file hash," "HTTP header," or "HTTP body."

[0143] Information indicating the TLP includes information indicating who may be allowed to disclose the IoC. In this embodiment, information indicating the TLP (specifically, the TLP level) may include information indicating the TLP such as "WHITE", "AMBER", "AMBER+STRICT", or "RED".

[0144] The information indicating PAP includes information indicating actions that the person viewing the IoC may take. In this embodiment, the information indicating PAP may include information indicating PAP (specifically, the PAP level) such as "WHITE," "GREEN," "AMBER," or "RED."

[0145] Figure 12 is a schematic diagram showing the information stored in the storage unit 112 of the analysis device 11 according to the embodiment.

[0146] The memory unit 112 includes, for example, information indicating the object to be analyzed ("object to be analyzed" shown in Figure 12), information indicating the TLP defined in the IoC included in the object to be analyzed ("TLP" shown in Figure 12), and information indicating the natural language created by the LLM 13 using the IoC in which the TLP is defined ("natural language created by LLM" shown in Figure 12). The information indicating the natural language created by the LLM 13 includes a primary analysis report and a secondary analysis report.

[0147] Note that in Figure 12, for example, the primary analysis report is shown as "Natural Language Text 1," etc., and "Natural Language Text 1," etc., contains information in natural language such as "The analysis results for the subject of analysis show no particular abnormalities." The same applies to "Natural Language Text A," etc., in the secondary analysis report.

[0148] Furthermore, for example, a primary analysis report designated (linked) as "TLP: WHITE" is created using only IoCs where TLP is designated as WHITE. Similarly, a primary analysis report designated as "TLP: AMBER" is created using IoCs where TLP is designated as WHITE and IoCs where TLP is designated as AMBER. Thus, for example, the TLP shown in Figure 12 indicates that a primary analysis report may be created using IoCs with a lower TLP than the designated TLP. For example, a primary analysis report designated as "TLP: RED" is created using all IoCs extracted from the analysis target.

[0149] In the example shown in Figure 12, if the user requests secondary analysis report information for "honeypot access log 01" as the analysis target, the output device 12 first outputs secondary analysis report information for "natural language text A". Furthermore, if the user requests secondary analysis report information for "honeypot access log 01" as the analysis target, the output device 12 outputs secondary analysis report information for "natural language text B" if the TLP set for that user is "AMBER" or higher. On the other hand, if the user requests secondary analysis report information for "honeypot access log 01" as the analysis target, the output device 12 does not output secondary analysis report information if the TLP set for that user is less than "AMBER".

[0150] Figure 13 is a schematic diagram showing the information stored in the storage unit 122 of the output device 12 according to the embodiment.

[0151] The memory unit 122 includes, for example, information indicating a user ("User" as shown in Figure 13), information indicating secondary analysis reports presented to that user ("Honeypot Access Log 01", "DDoS Attack Log 01", and "RFI Attack 01" as shown in Figure 13), and information indicating the access management group (TLP in this embodiment) assigned to that user ("Maximum Allowed Authority" as shown in Figure 13).

[0152] The information regarding "honeypot access log 01," "DDoS attack log 01," and "RFI attack 01" is, for example, information indicating the TLP corresponding to the secondary analysis report presented to the user through interaction between the user and the output device 12.

[0153] In the example shown in Figure 13, the output device 12 indicates that it has presented the user "User 1" with a secondary analysis report showing the analysis results (secondary analysis results) of the "honeypot access log 01," and that the secondary analysis report has "TLP: WHITE" specified.

[0154] Furthermore, in the example shown in Figure 13, the output device 12 indicates that, after presenting the secondary analysis report showing the analysis results (secondary analysis results) of the "DDoS attack log 01" to the user "User 1," and that a secondary analysis report with "TLP: WHITE" specified was presented, it also indicates that, in response to a request from the user, a secondary analysis report with "TLP: AMBER" specified was presented.

[0155] Information indicating the access control group assigned to a user (specifically, the maximum permitted privilege, more specifically, the TLP) indicates that the user may only view secondary analysis reports for which access control groups below that group are assigned. For example, a user whose "maximum permitted privilege" is "TLP:AMBER" is permitted to view secondary analysis reports that are designated as "WHITE" and "AMBER". On the other hand, a user whose "maximum permitted privilege" is "TLP:AMBER" is not permitted to view secondary analysis reports that are designated as "RED". In other words, even if the output device 12 receives a request for a secondary analysis report from a user whose "maximum permitted privilege" is "TLP:AMBER", it will display secondary analysis reports designated as "WHITE" and "AMBER", but will not display secondary analysis reports designated as "AMBER+STRICT" and "RED".

[0156] <UI (User Interface)> Figures 14 to 17 show specific examples of images (UI) based on information output by the output device 12 according to the embodiment. In the examples shown in Figures 14 to 17, the output device 12 processes information based on the information shown in Figure 13. In the following examples, the presentation device used to present the secondary analysis report to the user is a display device.

[0157] The first example shown in Figure 14 illustrates a case where user 1 can use information below the access management group defined for themselves to make judgments about the analysis results of the analysis target (for example, to determine what kind of abnormalities are occurring in the analysis target).

[0158] First, let's assume that user 1 makes a request saying, "Please submit an analysis report for honeypot access log 01." Information indicating this statement and information that uniquely identifies the user (for example, information indicating "user 1") are input to output device 12, for example, via an operating device.

[0159] The output device 12 determines which secondary analysis reports may be presented to user 1 based on user 1's "maximum permitted authority". Based on the determination result, the output device 12 displays the contents of the secondary analysis report for TLP that is "WHITE" on the display device.

[0160] Next, let's assume that User 1 does not request any further secondary analysis reports, for example, by saying, "I understand." In this case, the output device 12 terminates processing without displaying any further secondary analysis reports on the display device, such as "Please use the information within the scope of the TLP-WHITE access management group."

[0161] The second example shown in Figure 15 illustrates a case where user 2 can make decisions based on the information below the access management group defined for themselves.

[0162] First, let's assume that user 2 makes a request saying, "Please submit an analysis report for honeypot access log 01." Information indicating this statement and information that uniquely identifies the user (for example, information indicating "user 2") are input to output device 12, for example, via an operating device.

[0163] The output device 12 determines which secondary analysis reports may be presented to user 2 based on user 2's "maximum permitted authority". Based on the determination result, the output device 12 displays the contents of the secondary analysis report for TLP that is "WHITE" on the display device.

[0164] Next, suppose user 2 requests a further secondary analysis report, saying something like, "I still don't understand." In this case, the output device 12 displays the contents of the secondary analysis report for "AMBER" from the TLP on the display device, based on the judgment result.

[0165] Next, let's assume that User 2 does not request any further secondary analysis reports, such as saying, "I understand." In this case, the output device 12 terminates processing without displaying any further secondary analysis reports on the display device, such as "Please use the information within the scope of the TLP-AMBER access management group."

[0166] The third example shown in Figure 16 illustrates a situation where user 3 needs information corresponding to their assigned access management group to make a decision, and where a secondary analysis report containing such information does not exist.

[0167] First, let's assume that user 3 makes a request saying, "Please submit an analysis report for honeypot access log 01." Information indicating this statement and information that uniquely identifies the user (for example, information indicating "user 3") are input to output device 12, for example, via an operating device.

[0168] The output device 12 determines which secondary analysis reports may be presented to user 3 based on user 3's "maximum permitted authority". Based on the determination result, the output device 12 displays the contents of the secondary analysis report for "WHITE" from TLP on the display device.

[0169] Next, suppose user 3 requests a further secondary analysis report, saying something like, "I still don't understand." In this case, the output device 12 displays the contents of the secondary analysis report for "AMBER" from the TLP on the display device, based on the judgment result.

[0170] Next, let's assume that User 3 requests a further secondary analysis report, saying something like, "I still don't understand." At this point, let's assume that there is no secondary analysis report for TLP that is "RED".

[0171] In this way, for example, when there are no secondary analysis reports that can be presented to user 3, the output device 12 further displays information on the display device indicating that there are no secondary analysis reports that can be presented to user 3, such as "There are no further reports that can be shared."

[0172] Furthermore, the output device 12 terminates the process without displaying a secondary analysis report on the display device, such as "Please use the information within the scope of the TLP-AMBER access management group."

[0173] The fourth example shown in Figure 17 illustrates a situation where user 4 cannot make a decision based on the information below the access management group defined for themselves.

[0174] First, let's assume that user 4 makes a request: "Please submit an analysis report of the honeypot access log 01." Information indicating this request and information that uniquely identifies the user (for example, information indicating "user 4") are input to the output device 12, for example, via an operating device.

[0175] The output device 12 determines which secondary analysis reports may be presented to user 4 based on user 4's "maximum permitted authority". Based on the determination result, the output device 12 displays the contents of the secondary analysis report for TLP that is "WHITE" on the display device.

[0176] Next, suppose user 4 requests a further secondary analysis report, such as saying, "I still don't understand." In this case, based on the judgment result, output device 12 displays further information on the display device indicating that there are no secondary analysis reports available to present to user 4, such as "There are no further reports that can be shared."

[0177] Furthermore, the output device 12 terminates the process without displaying a secondary analysis report on the display device, such as "Please use the information within the scope of the TLP-WHITE access management group."

[0178] As shown in the examples above, the output device 12 presents the secondary analysis report to the user interactively. Specifically, the output device 12 presents the secondary analysis report to the user step by step while interacting with the user interactively.

[0179] <Effects, etc.> As described above, the analysis system 1 comprises an input device 10, an analysis device 11, and an output device 12. The input device 10, for example, assigns at least one access control group to the confidential information (e.g., IoC) included in the analysis target. The analysis device 11, for example, analyzes the confidential information considering the scope of persons to whom it can be disclosed by a plurality of different LLMs 13. The output device 12 interactively outputs the analysis report created by the LLMs 13.

[0180] In this way, the analysis system 1 outputs multiple analysis report information for a single analysis target by adding a scope to which the IoC can be disclosed to the analysis target. Furthermore, the analysis system 1 interactively outputs multiple analysis report information to an output destination (for example, a display device) by using at least two LLM 13s.

[0181] Traditionally, SOC (Security Operation Center) analysts face the risk of unintentional information disclosure and unintentional confidentiality errors during the process of translating SIEM (Security Information and Event Management) analysis results into natural language, or during the process of sharing information on analysis results using SOAR (Security Orchestration, Automation and Response). Such communication errors can occur when collaborating with different organizations, such as SIRT (Security Incident Response Team). Furthermore, such communication errors can occur even within the same organization, even between SOC analysts with differing confidentiality agreements.

[0182] Therefore, the analysis system 1 employs information sharing protocols such as TLP and PAP, assigns a sharing scope (TLP and / or PAP) to the IoCs extracted according to the analysis rules described in the incident response manual, and inputs them into an AI (Artificial Intelligence) such as LLM13. The AI ​​then interactively outputs information in natural language on behalf of the SOC analyst.

[0183] This allows users to share the necessary and sufficient IoCs (Indicators of Computation). Therefore, it enables proactive information sharing backed by information control by the generating AI agent, while suppressing information leaks. Furthermore, analysis system 1 allows for the secure analysis of confidential information by setting the scope of information that can be disclosed for each organization or individual.

[0184] Furthermore, multiple LLM13s may share the analysis reports they each create.

[0185] Furthermore, the output device 12 may interactively output analysis reports in order from among multiple analysis reports, starting with those for which an access management group with a wide range of accessible users has been defined.

[0186] Furthermore, the analysis system 1 may also output information indicating the extent to which IoCs can be disclosed to the user (for example, information indicating the TLP defined by the user) along with the analysis report.

[0187] According to analysis system 1, this facilitates appropriate information sharing. Therefore, analysis system 1 enables secure information exchange of IoCs by pre-linking IoCs with access management groups and pre-defining the scope of IoC disclosure for each organization or individual.

[0188] Therefore, according to analysis system 1, the effort required to manage access control groups can be reduced. Furthermore, according to analysis system 1, excessive information sharing can be suppressed. Furthermore, according to analysis system 1, unintended concealment of information can be suppressed.

[0189] <Representative Example> Figure 18 is a block diagram showing an information processing device 200 according to an embodiment. Figure 19 is a flowchart showing an information processing method according to an embodiment.

[0190] The analysis system 1 described above is a specific example of the information processing device 200. The information processing device 200 comprises a processor 210 and a memory 220, and the processor 210 uses the memory 220 to execute the information processing method shown in Figure 19. For example, the memory 220 stores a control program to be executed by the processor 210. The processor 210 executes the control program stored in the memory 220, for example.

[0191] First, the information processing device 200 acquires multiple analysis report information regarding the analysis results of the object to be analyzed (S10).

[0192] The analysis report information is, for example, the secondary analysis report (secondary analysis report information) mentioned above.

[0193] Next, the information processing device 200 outputs the multiple analysis report information in stages based on the management level defined for each of the multiple analysis report information (S20). Here, in the staged output of the multiple analysis report information (S20), when the information processing device 200 obtains request information from a predetermined user indicating an instruction to request information regarding the analysis results, it outputs one or more of the multiple analysis report information in order of the management level defined for each of the multiple analysis report information, thereby outputting the multiple analysis report information in stages.

[0194] Specifically, when the information processing device 200 receives request information from the user via a terminal such as a computer used by the user, or an operating terminal operated by the user, indicating an instruction to request information regarding analysis results (i.e., analysis report information), it displays one or more analysis report information on the display device. When the information processing device 200 receives further request information from the user via the operating terminal indicating an instruction to request more information regarding analysis results (i.e., analysis report information), it displays one or more analysis report information different from the one or more analysis report information that has been displayed on the display device. In other words, even if there is a large amount of analysis report information that the user is permitted to access, the information processing device 200 does not present all the analysis report information that the user is permitted to access to the user all at once, but rather presents the analysis report information in stages.

[0195] Request information is information that indicates dialogue entered by the user, such as "Please submit the analysis report for honeypot access log 01," or "I don't understand." The management level is, for example, the TLP mentioned above. For example, the management level defined for each of the multiple analysis report pieces of information is determined according to the TLP and PAP defined in the IoC entered into LLM13 above. Also, for example, the management level defined for a given user is the TLP defined as the maximum permissible authority mentioned above.

[0196] The amount of information necessary to accurately understand the analysis results varies depending on the user's capabilities. Furthermore, the less information presented to the user, the lower the risk of information leakage. Also, even a user with significant administrative privileges may be unable to share information with others if they have access to all the information. Therefore, in one aspect of this disclosure, the information processing method does not present a large amount of analysis report information to the user at once, but rather outputs the analysis report information in stages as requested by the user, presenting it to the user gradually. This eliminates the need to output unnecessary analysis report information depending on the user's capabilities. Consequently, the amount of information presented to the user can be reduced, and therefore, the risk of information leakage can be reduced.

[0197] Furthermore, for example, the management level defined for each of the multiple analysis report pieces is set lower the wider the range of people permitted to access the analysis report piece, and in the stepwise output of multiple analysis report pieces, when the information processing device 200 obtains the requested information, it outputs one or more analysis report pieces in order from the analysis report piece with the lowest management level among the multiple analysis report pieces.

[0198] The wider the range of people permitted to access the analysis report information—that is, the more people who can access the analysis report information without problems—the lower the risk of information leakage is considered to be. Therefore, among multiple analysis reports, those with the widest range of people permitted to access them are output in stages. This can further reduce the risk of information leakage.

[0199] Furthermore, for example, in the stepwise output of multiple analysis report information, when the information processing device 200 obtains the requested information, it outputs one or more analysis report information in order from the analysis report information with the lowest management level among the multiple analysis report information, up to the analysis report information corresponding to the management level defined for a given user.

[0200] Thus, for example, if there is no analysis report information that can be presented to a user that corresponds to the management level set for a given user, the information processing device 200 will not have the presentation device present the analysis report information. Depending on the user's attributes, such as the user's job title and the organization to which the user belongs, the information that the user is permitted to access may differ. Therefore, the analysis report information is output in stages, starting from the analysis report information with the lowest management level up to the analysis report information corresponding to the management level set for the user. As a result, only analysis report information appropriate to the user can be presented to the user. Therefore, the risk of information leakage can be further reduced.

[0201] Furthermore, for example, the information processing device 200 acquires an analysis target, and in acquiring multiple analysis report information, it acquires multiple analysis report information generated by inputting at least one different piece of confidential information from among the multiple pieces of confidential information included in the analysis target into each of the multiple large-scale language models.

[0202] An example of a large-scale language model is LLM13 mentioned above.

[0203] According to this, by using multiple large-scale language models, it is possible to obtain multiple analytical report information tailored to confidential information.

[0204] Furthermore, for example, the information processing device 200 acquires management information indicating the management level for each of the multiple confidential pieces of information, corresponding to the scope of persons authorized to access that confidential piece of information. In acquiring multiple analysis report information, the device acquires multiple analysis report information generated by inputting one or more pieces of confidential information into each of the multiple large-scale language models based on the management information.

[0205] Confidential information is, for example, the IoC mentioned above. Management information is, for example, the access control group information mentioned above (more specifically, information indicating TLP and PAP).

[0206] According to this, multiple analytical report pieces of information may be obtained depending on the scope of individuals who have been granted access to confidential information.

[0207] Furthermore, for example, when acquiring multiple analysis report information, the information processing device 200 inputs one or more pieces of confidential information into each of the multiple large-scale language models, causing the multiple large-scale language models to generate multiple first analysis report information relating to one or more pieces of confidential information. The device then acquires multiple second analysis report information, which is generated by inputting information from the multiple first analysis report information according to the management level defined for each of the multiple large-scale language models, as multiple analysis report information.

[0208] The first analysis report information is, for example, the primary analysis report (primary analysis report information) described above. The second analysis report information is, for example, the secondary analysis report (secondary analysis report information) described above.

[0209] According to this, the accuracy of analysis on the target of analysis by large-scale language models can be improved.

[0210] Furthermore, for example, the information processing device 200 outputs level information indicating a management level defined for a given user.

[0211] Level information, for example, is information indicating the maximum permitted authority as described above.

[0212] According to this, users can recognize their own level of control.

[0213] These comprehensive or specific embodiments may be implemented in a system, device, integrated circuit, computer program, or recording medium such as a computer-readable CD-ROM, or in any combination of a system, device, integrated circuit, computer program, and recording medium. Furthermore, this disclosure goes beyond mere classification and presentation of information. By having the input device 10, analysis device 11, output device 12, and LLM 13 of the analysis system 1 cooperate to add metadata based on TLP / PAP to the primary analysis report / secondary analysis report held in the storage unit 112, and by incorporating management level-based queuing and chunking, rate control, buffer management, and audit log appending using hash chains into the input / output path, it is possible to technically improve the input / output and memory management functions of a computer by achieving things that were inefficient or difficult to achieve with conventional implementations that relied on simple conditional branching or batch transmission at the application layer, such as preventing the mixing of unauthorized information, suppressing leakage during retransmission, avoiding queue overflow, and reducing average latency. Furthermore, these processing results directly lead to specific physical operations such as control of display / hide and order on the presentation device, adjustment of timing and amount of transmission signals in the communication unit 123 / network 16 (rate control) and control of whether or not chunks can be sent, non-temporary writing and zeroing to the storage units 112 / 122, and process control such as stopping the LLM 13 in step S1206. In addition, based on external cooperation processing, acquisition requests and control signals may be sent to external devices such as servers to operate those devices. Therefore, this disclosure is not merely an application of abstract rules, but an invention that specifically controls and improves the operation of the processor 210 / memory 220 and input / output devices of the information processing device 200.

[0214] (Other Embodiments) Although embodiments of the present disclosure have been described above, the present disclosure is not limited to the embodiments described above.

[0215] For example, each processing unit included in the analysis system 1 according to the above embodiment is typically implemented as an LSI, which is an integrated circuit. These may be individually integrated into a single chip, or some or all of them may be integrated into a single chip.

[0216] Furthermore, the information processing device 200 may be implemented by all of the devices provided in the analysis system 1, or by some of the devices provided in the analysis system 1. For example, the information processing device 200 may be implemented by the output device 12 alone, or by any combination of the input device 10, the analysis device 11, the output device 12, and the LLM 13.

[0217] Furthermore, integrated circuit implementation is not limited to LSIs; it may also be achieved using dedicated circuits or general-purpose processors. Alternatively, an FPGA (Field Programmable Gate Array), which can be programmed after LSI manufacturing, or a reconfigurable processor that allows for the reconfiguration of the connections and settings of circuit cells within the LSI, may be used.

[0218] Furthermore, the division of functional blocks in a block diagram is just one example; multiple functional blocks can be implemented as a single functional block, a single functional block can be divided into multiple parts, or some functions can be moved to other functional blocks. Additionally, the functions of multiple functional blocks with similar functions can be processed in parallel or time-sharing by a single piece of hardware or software.

[0219] Furthermore, for example, the order in which each step in the flowchart is performed is illustrative for the purpose of specifically illustrating this disclosure, and may be in a different order. Also, some of the above steps may be performed simultaneously (in parallel) with other steps.

[0220] Furthermore, in each of the above embodiments, for example, each component may be implemented by dedicated hardware or by executing a software program suitable for each component. Each component may also be implemented by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0221] Although the analysis system and the like according to one or more embodiments have been described above based on each embodiment, this disclosure is not limited to these embodiments. Without departing from the spirit of this disclosure, various modifications that a person skilled in the art could conceive of may be applied to each embodiment, and forms constructed by combining components from different embodiments may also be included within the scope of one or more embodiments.

[0222] This disclosure is applicable to devices that present information. For example, this disclosure allows for the secure exchange of confidential information by setting the scope of disclosure for each organization or individual, provided that access control groups can be assigned to the confidential information in advance. Furthermore, this disclosure can be used not only in the field of information security, but also by organizations or individuals that handle information based on the Need To Know principle.

[0223] 1 Analysis system 10 Input device 11 Analysis device 12 Output device 13 LLM 14, 15 Signal lines 16 Network 101, 111, 121, 131 Processing unit 102, 112, 122, 132 Storage unit 103, 113, 123, 133 Communication unit 200 Information processing unit 210 Processor 220 Memory

Claims

1. An information processing method that acquires multiple analysis report information relating to the analysis results of a target for analysis, outputs the multiple analysis report information in stages based on the management level defined for each of the multiple analysis report information, and in the staged output of the multiple analysis report information, each time a request information indicating an instruction to request information relating to the analysis results is acquired from a predetermined user, outputs one or more of the multiple analysis report information in order of the management level defined for each of the multiple analysis report information.

2. The information processing method according to claim 1, wherein the management level set for each of the multiple analysis report information is set lower the wider the range of persons permitted to access the analysis report information, and in the stepwise output of the multiple analysis report information, when the requested information is obtained, the one or more analysis report information is output in order from the analysis report information with the lowest management level among the multiple analysis report information.

3. In the stepwise output of the multiple analysis report information, when the request information is obtained, the information processing method according to claim 1, wherein the one or more analysis report information is output in order from the analysis report information with the lowest management level among the multiple analysis report information, up to the analysis report information corresponding to the management level defined for the predetermined user.

4. The information processing method according to claim 1, wherein the object to be analyzed is acquired, and in acquiring the plurality of analysis report information, the plurality of analysis report information is acquired by inputting at least one different piece of confidential information from the plurality of confidential information included in the object to be analyzed into each of the plurality of large-scale language models.

5. The information processing method according to claim 4, wherein management information is obtained for each of the multiple confidential pieces of information, indicating a management level corresponding to the scope of persons authorized to access the confidential piece of information, and in obtaining the multiple analysis report information, the multiple analysis report information is obtained by inputting one or more confidential pieces of information into each of the multiple large-scale language models based on the management information.

6. The information processing method according to claim 4, wherein, in obtaining the plurality of analysis report information, the plurality of large-scale language models are made to generate a plurality of first analysis report information relating to the one or more confidential pieces of information by inputting the one or more confidential pieces of information into each of the plurality of large-scale language models, and the plurality of second analysis report information generated by inputting information from the plurality of first analysis report information according to the management level defined for each of the plurality of large-scale language models into each of the plurality of large-scale language models is obtained as the plurality of analysis report information.

7. The information processing method according to claim 1, which outputs level information indicating a management level defined for the predetermined user.

8. An information processing device comprising a processor and memory, wherein the processor uses the memory to acquire multiple analysis report information relating to the analysis results of a target for analysis, outputs the multiple analysis report information in stages based on the management level defined for each of the multiple analysis report information, and in the staged output of the multiple analysis report information, each time request information indicating an instruction to request information relating to the analysis results is obtained from a predetermined user, the device outputs one or more of the multiple analysis report information in order of the management levels defined for each of the multiple analysis report information.

9. A program for causing a computer to execute the information processing method described in any one of claims 1 to 7.

Images