Information processing device, information processing system, information processing method, and storage medium for intrusion detection by applying machine learning to dissimilarity calculations for intrusion alerts

An information processing method comprising:

• receiving an alert from a monitoring device;
• generating alert information including the alert and information relevant to the alert, the information relevant to the alert including a presentation flag and a classification result, the presentation flag being information representing whether the alert information is to be presented to an operator, and the classification result being information indicating whether the alert information is correctly detected;
• calculating a dissimilarity that is a distance between first alert information including a first alert and information relevant to the first alert, and second alert information including a second alert and information relevant to the second alert, the first alert being received prior to the second alert;
• generating a classifier that determines whether the alert information is a true detection or a false detection, as the classification result;
• determining a determination result of the second alert information by applying the classifier to the second alert information;
• setting the determination result to the classification result of the second alert information and setting information indicating that a presentation is unnecessary to the presentation flag of the second alert information, when the determination result is the false detection and the dissimilarity is less than a predetermined threshold value;
• setting information indicating that the presentation is necessary to the presentation flag of the second alert information, when the determination result is the true detection, or when the determination result is the false detection, and the dissimilarity is equal to or more than the predetermined threshold value;
• and
• outputting the second alert information to a presentation device.

A computer readable non-transitory storage medium storing a program, the program causing a computer to perform a method, the method comprising:

• receiving an alert from a monitoring device;
• generating alert information including the alert and information relevant to the alert, the information relevant to the alert including a presentation flag and a classification result, the presentation flag being information representing whether the alert information is to be presented to an operator, and the classification result being information indicating whether the alert information is correctly detected;
• calculating a dissimilarity that is a distance between first alert information including an a first alert and information relevant to the first alert, and second alert information including a second alert and information relevant to the second alert, the first alert being received prior to the second alert;
• generating a classifier that determines whether the alert information is a true detection or a false detection, as the classification result;
• determining a determination result of the second alert information by applying the classifier to the second alert information;
• setting the determination result to the classification result of the second alert information and setting information indicating that presentation is unnecessary to the presentation flag of the second alert information, when the determination result is the false detection and the dissimilarity is less than a predetermined threshold value;
• setting information indicating that presentation is necessary to the presentation flag of the second alert information, when the determination result is the true detection, or when the determination result is false detection indicating erroneous detection and the dissimilarity is equal to or more than the predetermined threshold value;
• and
• outputting the second alert information to a presentation device.