DETERMINATION METHOD, DETERMINATION DEVICE, AND DETERMINATION PROGRAM
A determination method executed by a determination apparatus includes extracting feature information from an indicator of compromise (IOC) included in information related to cyber security, imparting a label to each of IOCs according to an actual result of a workload required for dealing with a relevant alert, and learning a model for outputting a label from feature information of an IOC by using learning data obtained by combining the feature information extracted with the label imparted.
1 . A determination method executed by a determination apparatus, the determination method comprising:
extracting feature information from an indicator of compromise (IOC) included in information related to cyber security;
imparting a label to each of IOCs according to an actual result of a workload required for dealing with a relevant alert; and
learning a model for outputting a label from feature information of an IOC by using learning data obtained by combining the feature information extracted with the label imparted.
2 . The determination method according to claim 1 , wherein a label indicating a high priority is imparted to an IOC for which a number of manual investigations performed for a relevant alert within a certain period is equal to or more than a predetermined value among IOCs, and a label indicating a non-high priority is imparted to an IOC for which the number of manual investigations is less than the predetermined value.
3 . The determination method according to claim 1 , wherein a label indicating a high priority is imparted to an IOC for which a time required for a manual investigation performed for a relevant alert within a certain period has a value equal to or greater than a predetermined value among IOCs, and a label indicating a non-high priority is imparted to an IOC for which the time has a value less than the predetermined value.
4 . The determination method according to claim 1 , further including: predicting a label from the feature information of the IOC using the model that is learned.
5 . The determination method according to claim 4 , further including: notifying of information about the IOC for which a label indicating a high priority is predicted.
6 . A determination apparatus comprising:
processing circuitry configured to:
extract feature information from an indicator of compromise (IOC) included in information related to cyber security;
impart a label to each of IOCs according to an actual result of a workload required for dealing with a relevant alert; and
learn a model for outputting a label from feature information of an IOC by using learning data obtained by combining the feature information extracted with the label imparted.
7 . A non-transitory computer-readable recording medium storing therein a determination program that causes a computer to execute a process comprising:
extracting feature information from an indicator of compromise (IOC) included in information related to cyber security;
imparting a label to each of IOCs according to an actual result of a workload required for dealing with a relevant alert; and
learning a model for outputting a label from feature information of an IOC by using learning data obtained by combining the feature information extracted with the label imparted.