Cyber threat information processing apparatus, cyber threat information processing method, and storage medium storing cyber threat information processing program

An apparatus for providing cyber threat information (CTI), the apparatus comprising:

• a database configured to store data;
• and
• a processor,
• wherein the processor performs operations comprising:
• an operation of receiving a CTI analysis request for a document script from a client;
• an operation of analyzing the document script to obtain analysis information of the CTI for the document script;
• an operation of generating a CTI query related to the document script based on the analysis information of the CTI and delivering the CTI query to a natural language model;
• an operation of acquiring natural language description information describing a cyber threat mechanism related to the document script based on the natural language model;
• and
• an operation of providing the natural language description information to the client,
• wherein the cyber threat mechanism includes one or more functions being operated when the document script is executed,
• wherein the natural language description information describes an instruction, a variable, or a path that the one or more functions execute, and
• wherein the natural language description information further describes a code in the document script, a language in which the code is written, subroutines that exist in the code, and a function executed by the subroutines.

A non-transitory computer-readable storage medium for storing a program for providing cyber threat information (CTI) executable by a computer, the program operating instructions of:

• receiving a CTI analysis request for a document script from a client;
• analyzing the document script to obtain analysis information of the CTI for the document script;
• generating a CTI query related to the document script based on the analysis information of the CTI and delivering the CTI query to a natural language model;
• acquiring natural language description information describing a cyber threat mechanism related to the document script based on the natural language model;
• and
• providing a natural language description information to the client,
• wherein the cyber threat mechanism includes one or more functions being operated when the document script is executed,
• wherein the natural language description information describes an instruction, a variable, or a path that the one or more functions execute, and
• wherein the natural language description information further describes a code in the document script, a language in which the code is written, subroutines that exist in the code, and a function executed by the subroutines.