INFORMATION PROCESSING DEVICE, INFORMATION PROCESSING METHOD, AND INFORMATION PROCESSING PROGRAM

摘要

An information processing device (120) is connected to a past incident information storage device (T3) which stores past incident information in which is described a plurality of attribute values of previously detected security incidents. An information acquisition unit (130) acquires new incident information in which a plurality of attribute values of newly detected security incidents is described. An incident information evaluation unit (160): reads out the past incident information from the past incident information storage device (T3); evaluates matches, including partial matches, in the attribute values between the past incident information and the new incident information; and, on the basis of the result of the evaluation of the matches in the attribute values, computes a degree of association between the past incident information and the new incident information.