Attack means evaluation device, attack means evaluation method, and computer-readable storage medium

Abstract

An attack method evaluation device (100) evaluates attack methods used for network attacks. A score calculation unit (110) acquires multiple attack methods and calculates a score representing the effectiveness of the attack against the target system for each of the multiple attack methods. A method selection unit (120) uses the score of each of the multiple attack methods and a threshold (173) to select an attack method that is effective against the target system from the multiple attack methods. A method execution unit (130) executes the selected attack method on the target system and determines whether the attack can achieve the ultimate goal of the network attack based on the execution result of the selected attack method.

Description

Technical Field

[0001] This invention relates to an attack method evaluation device, an attack method evaluation method, and a computer-readable storage medium. Background Technology

[0002] Vulnerabilities, as weaknesses in security, have become a societal problem. In recent years, there has been a demand for vulnerability checks before system release or product shipment. One method of vulnerability checking is penetration testing. Penetration testing simulates a cyberattack on the target system, thereby confirming the existence of vulnerabilities, the impact of vulnerability misuse, and the accuracy of cyberattack detection. Penetration testing is conducted by professional technicians familiar with security technologies, known as penetration testers. Penetration testing is generally a black-box test. Based on the system's response and behavior when given inputs that induce vulnerabilities, penetration testers estimate the internal structure and select the next simulated attack method to be implemented.

[0003] Non-Patent Document 1 discloses CALDERA, a tool that supplements insufficient attack methods in a generated attack script based on pre-defined attack method dependencies. CALDERA utilizes knowledge gained from systematically organizing tactics employed by network attackers known as ATT&CK (registered trademark). Furthermore, Non-Patent Document 1 also discloses a technique that analyzes past attack examples to identify attack methods used after a particular attack method and selects attack methods that co-occur with each other.

[0004] Patent Document 1 illustrates a method for diagnosing security vulnerabilities by performing simulated attacks. Patent Document 1 also describes a method for automatically performing network attacks by inferring the dependencies required to execute an attack based on those dependencies. For example, in Patent Document 1, attack methods are pre-stored in a database, and based on an attack script, other attack methods are executed when conditions for executing a particular attack method exist, thus satisfying those necessary conditions.

[0005] Existing technical documents

[0006] Patent documents

[0007] Patent Document 1: Japanese Patent Application Publication No. 2004-145413

[0008] Non-patent literature

[0009] Non-patent document 1: Andy Applebaum, Finding Dependencies Between AdversaryTechniques, FIRST Annual Conference 2019, 2019-06-19, https: / / www.first.org / resources / papers / conf2019 / 1100-Applebaum.pdf Summary of the Invention

[0010] The problem that the invention aims to solve

[0011] The techniques described in the prior art cannot execute network attacks performed by a skilled penetration tester. For example, in the technology described in Non-Patent Document 1, it merely generates a list of attack methods based on reported network attack cases, i.e., a network attack script. To actually execute the attack, the user needs to set the parameters or options of the attack tool. In Patent Document 1, other necessary attack methods are inferred and executed to meet the dependencies required for executing the attack methods. Therefore, the undetectability of the attack methods or the parameters of the attack tools need to be defined by the user. It cannot be guaranteed that an attack method capable of penetrating a network attack detection system can be selected in the same way as an attack method selected by a professional penetration tester.

[0012] The purpose of this invention is to score the attack methods that should be executed, thereby enabling sophisticated cyberattacks to be reproduced even without skilled penetration testers.

[0013] Methods for solving problems

[0014] The attack method evaluation apparatus of the present invention evaluates attack methods used for network attacks, wherein the attack method evaluation apparatus comprises:

[0015] The scoring unit acquires multiple attack methods and, for each of the multiple attack methods, calculates a score representing the effectiveness of the attack against the system targeted by the attack.

[0016] The method selection unit selects an attack method from the plurality of attack methods to execute an attack against the target system based on the score value; and

[0017] The means execution unit executes selected attack methods on the target system and determines whether the attack can achieve its ultimate goal of the network attack based on the execution result of the selected attack methods.

[0018] Invention Effects

[0019] According to the attack method evaluation device of the present invention, attack methods are scored, attack methods are selected based on the scores, and for the selected attack methods, it is determined whether they can achieve the ultimate goal of the network attack. Thus, the reproduction of clever network attacks can be automated. Attached Figure Description

[0020] Figure 1 This is a structural example of the attack method evaluation device in Implementation Method 1.

[0021] Figure 2 This is a flowchart illustrating the operation of the attack method evaluation device according to Embodiment 1.

[0022] Figure 3 This is a schematic diagram illustrating the setting process of the score database in Implementation 1.

[0023] Figure 4 This is a flowchart illustrating a detailed example of the operation of the attack method evaluation device according to Embodiment 1.

[0024] Figure 5 This is a structural example of the score database in Implementation Method 1.

[0025] Figure 6 This is a structural example of an attack means evaluation device that is a variation of Implementation 1. Detailed Implementation

[0026] The following description uses the accompanying drawings. In each drawing, the same or corresponding parts are labeled with the same reference numerals. In the description of the embodiment, the same or corresponding parts are appropriately omitted or simplified.

[0027] Implementation Method 1

[0028] ***Structure Description***

[0029] use Figure 1 An example of the structure of the attack method evaluation device 100 of this embodiment will be described.

[0030] The attack method evaluation device 100 is a computer. The attack method evaluation device 100 has a processor 910, and other hardware such as a memory 921, an auxiliary storage device 922, an input interface 930, an output interface 940, and a communication device 950. The processor 910 is connected to and controls the other hardware via signal lines.

[0031] The attack method evaluation device 100 of this embodiment evaluates attack methods that constitute a network attack against a target system. There can be one or more attack methods constituting a network attack. Specifically, the attack method evaluation device 100 evaluates the quality of an attack method under a certain condition as a score. The quality of an attack method can also be referred to as the effectiveness of the attack. For example, the quality of an attack method refers to indicators such as the difficulty in detecting the attack method or the reliability of the attack, which are independent of the evaluation axis.

[0032] In this embodiment, the attack means constitute a network attack. A list of at least one attack means constituting a network attack is also referred to as an attack script. Furthermore, attack means are also called attack methods, attack tools, attack code, or attack instructions.

[0033] In the attack method evaluation device 100, as information related to the system structure of the target system is determined, the score of the attack method is refined. Moreover, by refining the score, the attack method evaluation device 100 can select attack methods that closely resemble those of a real attacker.

[0034] As structural elements, the attack method evaluation device 100 includes a score calculation unit 110, a method selection unit 120, a method execution unit 130, a result collection unit 140, a result analysis unit 150, a condition acquisition unit 160, and a storage unit 170. The storage unit 170 stores a score database 107, a system structure database 108, and a threshold 173.

[0035] The functions of the score calculation unit 110, the means selection unit 120, the means execution unit 130, the result collection unit 140, the result analysis unit 150, and the condition acquisition unit 160 are implemented by software. The storage unit 170 is provided in the memory 921. Alternatively, the storage unit 170 may be provided in the auxiliary storage device 922, or it may be distributed between the memory 921 and the auxiliary storage device 922.

[0036] The processor 910 is a device that executes an attack method evaluation program. The attack method evaluation program is a program that implements the functions of a score calculation unit 110, a method selection unit 120, a method execution unit 130, a result collection unit 140, a result analysis unit 150, and a condition acquisition unit 160.

[0037] Processor 910 is an IC (Integrated Circuit) that performs computational processing. Specific examples of processor 910 are CPU (Central Processing Unit), DSP (Digital Signal Processor), and GPU (Graphics Processing Unit).

[0038] Memory 921 is a storage device for temporary data storage. Specific examples of memory 921 are SRAM (Static Random Access Memory) or DRAM (Dynamic Random Access Memory).

[0039] Auxiliary storage device 922 is a storage device for storing data. A specific example of auxiliary storage device 922 is an HDD. However, auxiliary storage device 922 can also be a removable storage medium such as an SD (trademarked) memory card, CF card, NAND flash memory, floppy disk, optical disk, high-density disk, floppy disk, or DVD. Additionally, HDD is an abbreviation for Hard Disk Drive; SD (trademarked) is an abbreviation for Secure Digital; CF is an abbreviation for Compact Flash; and DVD is an abbreviation for Digital Versatile Disk.

[0040] Input interface 930 is a port for connecting to input devices such as a mouse, keyboard, or touch panel. Specifically, input interface 930 is a USB (Universal Serial Bus) terminal. Alternatively, input interface 930 can also be a port for connecting to a LAN (Local Area Network).

[0041] Output interface 940 is a port for cable connection to output devices such as monitors. Specifically, output interface 940 is a USB terminal or an HDMI (High Definition Multimedia Interface) terminal. Specifically, the monitor is an LCD (Liquid Crystal Display). Output interface 940 is also called a monitor interface.

[0042] The communication device 950 has a receiver and a transmitter. The communication device 950 connects to a communication network such as a LAN, the Internet, or a telephone line. Specifically, the communication device 950 is a communication chip or a NIC (Network Interface Card).

[0043] The attack method evaluation program is executed in the attack method evaluation device 100. The attack method evaluation program is read into the processor 910 and executed by the processor 910. The memory 921 stores not only the attack method evaluation program but also the operating system (OS). The processor 910 executes the OS while simultaneously executing the attack method evaluation program. The attack method evaluation program and the OS can also be stored in the auxiliary storage device 922. The attack method evaluation program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. Alternatively, part or all of the attack method evaluation program can be incorporated into the OS.

[0044] The attack method evaluation device 100 may also have multiple processors instead of processor 910. These multiple processors share the responsibility of executing the attack method evaluation program. Similar to processor 910, each processor is a device for executing the attack method evaluation program.

[0045] Data, information, signal values, and variable values ​​used, processed, or output by the attack evaluation program are stored in registers or flash memory within memory 921, auxiliary storage device 922, or processor 910.

[0046] The word "section" in each of the score calculation section 110, means selection section 120, means execution section 130, result collection section 140, result analysis section 150, and condition acquisition section 160 can be rewritten as "process," "procedure," or "step." The attack means evaluation program causes the computer to perform score calculation processing, means selection processing, means execution processing, result collection processing, result analysis processing, and condition acquisition processing. The word "process" in score calculation processing, means selection processing, means execution processing, result collection processing, result analysis processing, and condition acquisition processing can also be rewritten as "program," "program product," "computer-readable storage medium storing a program," or "computer-readable recording medium recording a program." Furthermore, the attack means evaluation method is a method performed by executing the attack means evaluation program through the attack means evaluation device 100.

[0047] Attack method evaluation programs can also be provided by storing them on computer-readable recording media. Furthermore, attack method evaluation programs can also be provided as a program product.

[0048] ***Instructions for Action***

[0049] Next, use Figure 2 The operation of the attack method evaluation device 100 according to this embodiment will be described in general. The operation process of the attack method evaluation device 100 is equivalent to the attack method evaluation method. Furthermore, the program that implements the operation of the attack method evaluation device 100 is equivalent to the attack method evaluation program.

[0050] Attack method evaluation device 100 evaluates attack methods used for network attacks.

[0051] In step S11, the condition acquisition unit 160 acquires a threshold 173 as a basis for selecting an attack method. Specifically, the condition acquisition unit 160 acquires the threshold 173 from the user via the input interface 930. Specifically, the threshold 173 is a value representing the probability of being detected by an attack detection tool such as a security detection device when an attack method is executed.

[0052] For example, when users want to prioritize stealth and avoid detection by security detection devices, the score is used to calculate the attack detection probability. Furthermore, the attack method with the lowest calculated attack detection probability is selected as the most effective attack method against the target system.

[0053] The condition acquisition unit 160 obtains the threshold pth of the attack detection probability from the user via the input interface 930.

[0054] In step S12, the score calculation unit 110 acquires multiple attack methods and calculates a score representing the effectiveness of the attack against the target system for each of the multiple attack methods. The calculated score is also called the evaluation score.

[0055] The system structure database 108 contains the system structure of the target system, which is the target of the attack. Furthermore, the system structure database 108 contains information such as the attack conditions that constitute an attack on the target system.

[0056] The score calculation unit 110 calculates the score of each attack method among multiple attack methods based on the system structure database 108. The score calculation unit 110 calculates the score based on the system structure of the target system contained in the system structure database 108.

[0057] For example, the score calculation unit 110 calculates the attack detection probability, which represents the difficulty of detection in the system targeted by the attack, as a score.

[0058] Figure 3 This is a schematic diagram illustrating the setting process of the score database 107 in this embodiment.

[0059] In step S21, the score calculation unit 110 lists attack methods, for example, from a list of instructions for ATT&CK (registered trademark) or attack tools. A final objective is set in a cyberattack. In a cyberattack, multiple attack methods are implemented to achieve that final objective, and finally, an attack is executed to achieve that final objective. The attack methods listed from the list of instructions for ATT&CK (registered trademark) or attack tools correspond to the attack methods constituting one cyberattack.

[0060] In step S22, the score calculation unit 110 calculates the score for each attack method based on the attack establishment conditions and sets it in the score database 107. Specifically, the score calculation unit 110 calculates the score based on attack establishment conditions such as ATT&CK (registered trademark) or the CVSS (Common Vulnerability Scoring System) value of the vulnerability used. The score is a function value rather than a fixed value. For example, the score for an attack method targeting Windows (registered trademark) would be completely meaningless if the target is Linux (registered trademark), therefore, the score would be 0. Alternatively, the stealth or reliability of the attack can also be expressed as a score.

[0061] In step S13, the means selection unit 120 uses the score values ​​of each of the multiple attack means and a threshold 173 to select an attack means that is effective against the target system from the multiple attack means. The means selection unit 120 uses the threshold 173 to select the attack means to be executed from the attack means set in the score value database 107. Specifically, the means selection unit 120 lists attack means with a score value below the attack detection probability threshold pth from the attack means set in the score value database 107. Then, the means selection unit 120 selects the attack means with the lowest attack detection probability from the listed attack means as the attack means to be executed.

[0062] Alternatively, the method selection unit 120 can list multiple attack methods based on the threshold 173 and prompt the user through the output interface 940, allowing the user to select the attack method to be executed.

[0063] Next, in steps S14 to S15, the means execution unit 130 performs a network attack on the target system by executing the selected attack means on the target system.

[0064] First, in step S14, the means execution unit 130 executes the selected attack means on the target system. The means execution unit 130 retrieves the necessary parameters from the system structure database 108 and executes the selected attack means. The necessary parameters are, for example, information such as the IP (Internet Protocol) address of the attack destination.

[0065] The means execution unit 130 executes the selected attack means on the target system, and determines whether the attack can achieve the ultimate goal of the network attack based on the execution result of the selected attack means. Then, if the means execution unit 130 determines that the attack can achieve the ultimate goal, it executes the attack. If the means execution unit 130 determines that the attack cannot achieve the ultimate goal, it delivers the execution result to the result collection unit 140.

[0066] The results collection unit 140 collects the execution results of the attack methods.

[0067] When an attack is determined to be unsuccessful in achieving its ultimate objective, the result analysis unit 150 analyzes the system architecture of the target system based on the execution result of the selected attack method and feeds the analysis result back to the system architecture database 108. Specifically, the result analysis unit 150 obtains the execution result and determines whether the attack was successful. If the executed method is a reconnaissance activity such as network scanning rather than an attack, the result analysis unit 150 obtains the scanning result as the execution result. The result analysis unit 150 analyzes the execution result. The result analysis unit 150 feeds the analysis result back to the system architecture database 108. Thus, the system architecture database 108 is updated each time an attack method targeting the target system is executed, until an attack that achieves the ultimate objective is successfully executed.

[0068] The means execution unit 130 repeats the above actions until the execution of all attack methods constituting the network attack is completed. When the conditions for executing the final objective of the network attack input by the user are met, the means execution unit 130 executes the final objective of the network attack as the target (step S15). If the execution conditions are not met, the process is repeated until the execution conditions are met. The situation where the execution conditions for the final objective are not met refers to situations such as incomplete information required for execution or failure to ensure the network reachability required for execution.

[0069] Figure 4 This is a flowchart illustrating a detailed example of the operation of the attack method evaluation device 100 according to this embodiment. Figure 4 In this context, the score is assumed to be the probability of attack detection.

[0070] In addition, Figure 4This section explains attack methods used to target a sub-target that serves as the ultimate goal of a cyberattack. Furthermore, the same approach can be applied even when the sub-target is the ultimate goal of the cyberattack.

[0071] In step S101, the condition acquisition unit 160 obtains the threshold pth of the attack detection probability from the user via the input interface 930.

[0072] In step S102, the score calculation unit 110 acquires multiple attack methods and calculates the attack detection probability of each attack method as a score based on the system structure database 108. Then, the method selection unit 120 lists attack methods whose score value is below the attack detection probability threshold pth from the attack methods set in the score database 107.

[0073] In step S103, the means selection unit 120 selects an attack means that complies with restrictions from the listed attack means as the attack means to be executed. Specifically, the means selection unit 120 selects the attack means with the lowest attack detection probability from the listed attack means as the attack means to be executed. The attack means with the lowest attack detection probability means the attack means that is the most difficult to detect. That is, as an attack against the target system, it is the most effective attack means. The selected attack means is sometimes also a reconnaissance means.

[0074] In step S104, the means execution unit 130 executes the selected attack means on the target system.

[0075] In step S105, the result collection unit 140 collects the execution result of the attack method. The result collection unit 140 determines whether the information required for the attack method on the sub-target is complete. If the information required for the attack method on the sub-target is complete, the process proceeds to step S108. If the information required for the attack method on the sub-target is incomplete, the process proceeds to step S106.

[0076] In step S106, the result analysis unit 150 analyzes the execution result of the selected attack method and feeds the analysis result back to the system structure database 108.

[0077] In step S107, the score calculation unit 110 recalculates the score of each attack method based on the system structure of the target system contained in the system structure database 108, which has received feedback analysis results. Then, the process is repeated starting from the enumeration of attack methods in step S102.

[0078] The system architecture database 108 contains information about the target system, such as its IP address and operating system, the version information of the software it is using, and firewall rules. This information is unknown immediately after intrusion into the target system. Therefore, in network attacks, network scanning or probing is performed to collect information about the target system. Storing the collected results in the system architecture database 108 improves the accuracy of score calculations using these collected results.

[0079] In step S108, the means execution unit 130 executes the attack means of the sub-target.

[0080] Figure 3 The ultimate goal of a cyberattack, as described above, is the theft of information or the destruction of information systems—the objectives that attackers should achieve. However, immediately after infiltrating a system, it's not necessarily the terminal capable of achieving this ultimate goal that has been compromised. Therefore, it's necessary to attack other terminals or servers. Such attacks on other terminals or servers are examples of attack methods targeting the aforementioned sub-goals.

[0081] On the other hand, as mentioned above, the "target of the network attack input by the user" is the ultimate goal of the attack. When the target of a network attack is set as "to damage the data of system XX," then a target such as "intruding into system XX" is a sub-target of the preceding target. Within this sub-target, there are sometimes further sub-sub-targets. Thus, it can be assumed that the network attack operates in a manner known as an attack tree.

[0082] about Figure 4 The state in step S105, "The information required for the attack method of the sub-target is complete," specifically assumes that the version of the vulnerable OS has been identified as information for intruding into other terminals. Alternatively, it assumes that information such as the ability to perform a brute-force attack due to the open telnet port is obtained as information for intruding into other terminals.

[0083] Furthermore, in step S103, the means selection unit 120 selects the attack means with the lowest attack detection probability from the listed attack means as the attack means to be executed. However, even if the attack means with the lowest attack detection probability is executed, sometimes the required information cannot be obtained. In this case, the means with the second lowest attack detection probability is selected and executed. In this way, the attacks are executed sequentially starting from the attack means with the lowest attack detection probability until all the information required for the attack means of the subtarget is obtained.

[0084] Figure 5 This is a diagram illustrating an example of the structure of the score database 107 in this embodiment.

[0085] like Figure 5As shown, the score database 107 includes attack methods 61, attack detection probability pi (as the score value 62 for each attack method), and attack success probability 63.

[0086] Based on the execution result of attack method 61, the result analysis unit 150 sets the attack success probability 63 of attack method 61 in the score value database 107. For example, the result analysis unit 150 recalculates the attack success probability by using information such as the response from the target system and reflects it in the score value database 107, thereby refining the attack success probability 63.

[0087] ***Other Structures***

[0088] In this embodiment, the functions of the score calculation unit 110, the means selection unit 120, the means execution unit 130, the result collection unit 140, the result analysis unit 150, and the condition acquisition unit 160 are implemented by software. As a variation, the functions of the score calculation unit 110, the means selection unit 120, the means execution unit 130, the result collection unit 140, the result analysis unit 150, and the condition acquisition unit 160 can also be implemented by hardware.

[0089] Specifically, the attack method evaluation device 100 has electronic circuitry 909 instead of processor 910.

[0090] Figure 6 This is a diagram showing the structure of the attack means evaluation device 100 of a modified example of this embodiment.

[0091] Electronic circuit 909 is a dedicated electronic circuit that implements the functions of score calculation unit 110, means selection unit 120, means execution unit 130, result collection unit 140, result analysis unit 150, and condition acquisition unit 160. Specifically, electronic circuit 909 can be a single circuit, a composite circuit, a programmable processor, a parallel programmable processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

[0092] The functions of the score calculation unit 110, the means selection unit 120, the means execution unit 130, the result collection unit 140, the result analysis unit 150, and the condition acquisition unit 160 can be implemented by one electronic circuit or distributed among multiple electronic circuits.

[0093] As another variation, some of the functions of the score calculation unit 110, means selection unit 120, means execution unit 130, result collection unit 140, result analysis unit 150, and condition acquisition unit 160 can be implemented by electronic circuits, while the remaining functions can be implemented by software. Furthermore, some and all of the functions of the score calculation unit 110, means selection unit 120, means execution unit 130, result collection unit 140, result analysis unit 150, and condition acquisition unit 160 can be implemented by firmware.

[0094] The processor and electronic circuit are also referred to as processing circuits. That is, the functions of the score calculation unit 110, the means selection unit 120, the means execution unit 130, the result collection unit 140, the result analysis unit 150, and the condition acquisition unit 160 are realized through the processing circuits.

[0095] ***Explanation of the effects of this implementation method***

[0096] As described above, in this embodiment, an attack method evaluation device 100 having the following functions is described.

[0097] (a) The attack method evaluation device 100 has the function of scoring attack methods according to a pre-set evaluation axis. Scoring refers to numericalization, such as calculating the attack detection probability.

[0098] (b) The score of an attack method varies depending on the conditions of the system being attacked.

[0099] (c) The attack method evaluation device 100 selects the attack target system with the best score and executes a network attack.

[0100] (d) The attack method evaluation device 100 feeds back the information of the target system obtained when executing the attack method to the system structure database. As a result, the score values ​​shown in (a) and (b) change, and the score value of the attack method is refined each time an attack is executed.

[0101] According to the attack method evaluation device 100 of this embodiment, the attack methods that should be executed are scored, thereby enabling sophisticated network attacks to be reproduced even without a skilled penetration tester.

[0102] Implementation Method 2

[0103] In this embodiment, we will mainly describe aspects that differ from Embodiment 1 and aspects that are added to Embodiment 1.

[0104] In this embodiment, structures having the same functions as in Embodiment 1 are labeled with the same markings, and their descriptions are omitted.

[0105] In Implementation Method 1, it is assumed that the attack method with the highest score is executed first. In this implementation method, the following situation will be explained: the overall score is calculated as the column of the attack method, i.e., the attack script, thereby enabling the overall scoring of the attack script.

[0106] The score calculation unit 110 calculates a script score ps, which represents the effectiveness of the attack against the target system, for an attack script consisting of attack methods that constitute a network attack.

[0107] The method selection unit 120 uses the script score value ps and the threshold pth to select an attack script that is effective against the system being attacked.

[0108] The means execution unit 130 performs a network attack on the target system by executing a selected attack script on the target system.

[0109] For example, when the score of each attack method is set as the attack detection probability pi, the attack detection probability ps of the network attack to be executed as a whole can be represented by ps = 1 - Π(1 - pi).

[0110] For example, by having the user input a threshold pth for the probability of attack detection, it is possible to mechanically generate a series of attack methods, i.e., attack scripts, that do not exceed the threshold pth for the overall attack detection probability of the attack script.

[0111] Implementation Method 3

[0112] In this embodiment, the differences from embodiments 1 and 2 and the aspects added to embodiments 1 and 2 will be mainly described.

[0113] In this embodiment, structures that have the same functions as those in embodiments 1 and 2 are marked with the same labels, and their descriptions are omitted.

[0114] In implementation methods 1 and 2, the score for each attack method is a single value. However, without knowing the structural information of the target system, it is difficult to accurately calculate scores such as attack detection probabilities. For example, even if a certain attack code has an attack detection probability of 0.5 and an attack success probability of 0.7, if the target system using the attack code is not vulnerable, the attack success probability is 0, and choosing to use that attack method would be wasteful.

[0115] To address this issue, the score values ​​of each attack method are made to vary like a function value. For example, if the target system's OS is Windows (registered trademark), the probability of success is 0.5; if a vulnerability is identified, the probability of success is 1.0; and if the OS is not the target of the attack code or the vulnerability has been modified, the probability of success is set to 0. This prevents the selection of invalid attack methods and allows for closer access to more sophisticated network attacks. Furthermore, in the initial stage of an attack, many aspects of the target system's structure are unclear; therefore, the attack detection probability can also range from 0.3 to 0.5, allowing the score value to fluctuate. This allows for the identification of the target system's structure each time the attack is advanced, thus narrowing the range of the score value.

[0116] According to the attack method evaluation device of this embodiment, attack methods can be executed sequentially in such a way that the attack detection probability obtained by comprehensively considering all the attack methods that have been executed does not exceed the threshold set by the user, thereby automatically executing network attacks.

[0117] In the above embodiments 1 to 3, each part of the attack method evaluation device was described as an independent functional block. However, the structure of the attack method evaluation device may not be as described in the above embodiments. The functional blocks of the attack method evaluation device can be of any structure as long as they can perform the functions described in the above embodiments. Furthermore, the attack method evaluation device may be a system composed of multiple devices instead of a single device.

[0118] Furthermore, multiple parts of embodiments 1 to 3 can be combined. Alternatively, one part of these embodiments can be implemented. Furthermore, these embodiments can be implemented in any combination, either as a whole or in part.

[0119] That is, in embodiments 1 to 3, it is possible to freely combine the embodiments, modify any structural elements of the embodiments, or omit any structural elements in the embodiments.

[0120] Furthermore, the above embodiments are merely preferred examples and are not intended to limit the scope of the invention, its applications, or its uses. Various modifications can be made to the above embodiments as needed.

[0121] Label Explanation

[0122] 61: Attack method; 62: Score value; 63: Attack success probability; 100: Attack method evaluation device; 110: Score value calculation unit; 120: Method selection unit; 130: Method execution unit; 140: Result collection unit; 150: Result analysis unit; 160: Condition acquisition unit; 170: Storage unit; 107: Score value database; 108: System structure database; 173: Threshold; 909: Electronic circuit; 910: Processor; 921: Memory; 922: Auxiliary storage device; 930: Input interface; 940: Output interface; 950: Communication device.

Claims

1. An attack means evaluation device that evaluates an attack means used for a cyber attack, wherein, The attack means evaluation device has: an input interface that acquires a threshold value of an attack detection probability, the threshold value indicating a probability of being detected by an attack detection tool when an attack means is executed; a score value calculation section that acquires a plurality of attack means, calculates, for each attack means of the plurality of attack means, a score value indicating attack effectiveness against an attack target system that is an attack target, the score value calculation section calculating, as the score value, an attack detection probability indicating a degree of difficulty of detection in the attack target system; a means selection section that selects, from the plurality of attack means, an attack means that executes an attack against the attack target system according to the score value, the means selection section listing attack means whose score value is below the threshold value and selecting, from the listed attack means, an attack means having the lowest attack detection probability as a score value, or the means selection section prompting the user through an output interface to present the listed attack means and to select an attack means to be executed; and a means execution section that executes the selected attack means against the attack target system, and determines whether or not an attack for achieving a final purpose of the cyber attack can be achieved based on an execution result of the selected attack means.

2. The attack means evaluation device according to claim 1, wherein the means execution section executes an attack for achieving the final purpose when it is determined that the attack for achieving the final purpose can be achieved.

3. The attack means evaluation device according to claim 1 or 2, wherein the attack means evaluation device has a system structure database in which a system structure of the attack target system is set, the score value calculation section calculates the score value based on the system structure of the attack target system included in the system structure database.

4. The attack means evaluation device according to claim 3, wherein the attack means evaluation device has a result analysis section that, when it is determined that the attack for achieving the final purpose cannot be achieved, analyzes the system structure of the attack target system based on the execution result of the selected attack means, feeds back an analysis result to the system structure database, the score value calculation section recalculates the score value based on the system structure of the attack target system included in the system structure database to which the analysis result is fed back.

5. The attack means evaluation device according to claim 1 or 2, wherein the score value calculation section calculates, for an attack script constituted by attack means constituting the cyber attack, a script score value indicating attack effectiveness against the attack target system, the means selection section selects, using the script score value, an attack script that is effective for an attack against the attack target system, the means execution section executes the cyber attack against the attack target system by executing the selected attack script against the attack target system.

6. The attack means evaluation device according to claim 3, wherein The score value calculation section calculates a script score value indicating attack effectiveness against the attack target system for an attack script composed of attack means constituting the network attack, The means selection section selects an attack script that is effective for the attack against the attack target system using the script score value, The means execution section executes the network attack against the attack target system by executing the selected attack script against the attack target system.

7. The attack means evaluation device according to claim 4, wherein The score value calculation section calculates a script score value indicating attack effectiveness against the attack target system for an attack script composed of attack means constituting the network attack, The means selection section selects an attack script that is effective for the attack against the attack target system using the script score value, The means execution section executes the network attack against the attack target system by executing the selected attack script against the attack target system.

8. An attack means evaluation method of an attack means evaluation device that evaluates attack means for a network attack, wherein An input interface acquires a threshold value of an attack detection probability, the threshold value indicating a probability of being detected by an attack detection tool when the attack means is executed; A score value calculation section acquires a plurality of attack means, calculates a score value indicating attack effectiveness against an attack target system that is an attack target for each attack means of the plurality of attack means, the score value calculation section calculating an attack detection probability indicating a degree of difficulty of detection in the attack target system as the score value, A means selection section selects an attack means that executes an attack against the attack target system from the plurality of attack means according to the score value, the means selection section listing attack means whose score value is below the threshold value and selecting an attack means whose attack detection probability is the lowest from the listed attack means, or the means selection section prompting the listed attack means to a user and causing the user to select an attack means to be executed through an output interface, A means execution section executes the selected attack means against the attack target system, and determines whether or not an attack for achieving a final purpose of the network attack can be achieved based on an execution result of the selected attack means.

9. A computer-readable storage medium storing an attack means evaluation program of an attack means evaluation apparatus that evaluates an attack means used for a cyber attack, wherein The attack means evaluation program causes a computer to execute the following processes: A threshold value input process acquires a threshold value of an attack detection probability, the threshold value indicating a probability of being detected by an attack detection tool when the attack means is executed A score value calculation process acquires a plurality of attack means, calculates a score value indicating attack effectiveness against an attack target system that is an attack target for each attack means of the plurality of attack means, the score value calculation process calculating an attack detection probability indicating a degree of difficulty of detection in the attack target system as the score value; The means selection process selects an attack means for performing an attack on the attack target system from among the plurality of attack means according to the score value, the means selection process listing attack means having a score value that is lower than the threshold value and selecting, from among the listed attack means, an attack means having the lowest attack detection probability as a score value, or the means selection process prompts a user through an output interface to present the listed attack means and have the user select an attack means to be performed; and The means execution process performs the selected attack means on the attack target system, and determines whether or not the attack for achieving the final purpose of the cyber attack can be achieved according to the execution result of the selected attack means.

Images