Back to results
US 11,689,547 B2Granted
Information analysis system, information analysis method, and recording medium
AssigneeNEC Corporation
InventorMasaru Kawakita
Life of this patent
Estimating the term…
Abstract
To detect information relating to the threat appropriately, based on an appearance tendency of information related to a threat in security. Information analysis system includes: an information storing unit that stores reference information acquired from an information source; and an information analysis unit that analyzes an appearance tendency of first phrase information that is included in the reference information acquired at chronologically different timings and that represents a phrase related to security and extracts reference information including the first phrase information the appearance tendency of which has changed from the information storing unit.
Claims15
A cyber threat analysis system comprising:
- a database configured to store reference information acquired from an information source;
- a memory configured to store instructions;
- and
- a processor configured to execute the instructions to:
- analyze an appearance tendency of first phrase information that is included in the reference information acquired at chronologically different timings and the appearance tendency of the first phrase information represents a phrase related to a malicious program that provides malicious instructions to an information processing device;
- extract the reference information including the first phrase information, the appearance tendency of the first phrase information has changed, from the database;
- extract one or more information representing another phrase that is included in the reference information including the first phrase information and has a relationship with the first phrase information;
- count a number of appearances of the one or more information representing the another phrase;
- based on the number of appearances of the information representing the another phrase, select at least some of the information representing the another phrase as second phrase information;
- analyze an appearance tendency of the second phrase information;
- generate a user interface screen including the reference information, the first phase information, and the second phase information, the appearance tendency of the second phrase information has changed,
- when the analysis of the appearance tendency of the second phrase information resulted in a switch in the appearance tendency of the second phrase information;
- generate threat description data relating to the first phrase information;
- and
- provide the information processing device with the generated threat description data.
12 more elements
A cyber threat analysis method comprising:
- analyzing an appearance tendency of first phrase information that is included in reference information acquired at chronologically different timings from an information source and the appearance tendency of the first phrase information represents a phrase related to a malicious program that provides malicious instructions to an information processing device;
- extracting reference information including the first phrase information the appearance tendency of the first phrase information has changed;
- extracting one or more information representing another phrase that is included in the reference information including the first phrase information and has a relationship with the first phrase information;
- counting a number of appearances of the one or more information representing the another phrase;
- based on the number of appearances of the information representing the another phrase, selecting at least some of the information representing the another phrase as second phrase information;
- analyzing an appearance tendency of the second phrase information;
- generating a user interface screen including the reference information, the first phase information and the second phase information, the appearance tendency of the second phrase information has changed,
- when the analysis of the appearance tendency of the second phrase information resulted in a switch in the appearance tendency of the second phrase information;
- generating threat description data relating to the first phrase information;
- and
- providing the information processing device with the generated threat description data.
8 more elements
A non-transitory computer-readable medium storing a cyber threat analysis program that, when executed by a processor, causes the processor to:
- store reference information acquired from an information source;
- analyze an appearance tendency of first phrase information that is included in the reference information acquired at chronologically different timings and the appearance tendency of the first phrase information represents a phrase related to a malicious program that provides malicious instructions to an information processing device;
- extract reference information including the first phrase information, the appearance tendency of the first phrase information has changed;
- extracting one or more information representing another phrase that is included in the reference information including the first phrase information and has a relationship with the first phrase information;
- counting a number of appearances of the one or more information representing the another phrase;
- based on the number of appearances of the information representing the another phrase, selecting at least some of the information representing the another phrase as second phrase information;
- analyzing an appearance tendency of the second phrase information;
- generating a user interface screen including the reference information, the first phase information and the second phase information, the appearance tendency of the second phrase information has changed,
- when the analysis of the appearance tendency of the second phrase information resulted in a switch in the appearance tendency of the second phrase information;
- generate threat description data relating to the first phrase information;
- and
- provide the information processing device with the generated threat description data.
9 more elements
The non-transitory computer-readable medium 17, wherein a criterion data is a predetermined criterion value.
Dependencies are inferred from the claim text.