Cyber threat information processing apparatus, cyber threat information processing method, and storage medium storing cyber threat information processing program

Abstract

A cyber threat information processing apparatus, a cyber threat information processing method, and a storage medium storing software that processes cyber threat information. A cyber threat information processing method including converting an executable file in an input file into a code block of a certain format, determining similarity between the converted code block and previously classified malware and classifying malware in the executable file, extracting natural language included in an electronic document associated with the classified malware, and registering the extracted natural language in association with the classified malware, and providing information about malware related to requested search for the malware and natural language related to the malware as search result information when a user requests the search for the malware.