Attack analysis device, attack analysis method, and attack analysis program

Abstract

A data acquisition unit (21) acquires operation data including an influence source target, which is a target that performs an operation that affects another target, an influence destination target, which is a target that is affected by the operation performed by the influence source target, and an attack certainty degree indicating a probability that the operation is an attack. When the attack certainty degree is equal to or greater than a threshold value A, a relationship construction unit (22) constructs relationship data by adding the relationship between the influence source target and the influence destination target to the relationship data. When an attack is detected, the specifying unit (23) specifies, on the basis of the relational data, at least one of a pollution range in which the influence of the attack is assumed to be present and an intrusion path of the attack.

Description

Technical Field

[0001] The present disclosure relates to techniques for determining the extent of contamination of an impact assuming the presence of a cyber attack. Background Art

[0002] Patent document 1 describes a technique for determining an intrusion path and contamination range based on an attack in a system that has been attacked by a network. In patent document 1, relationship data between targets is generated based on action data of multiple software. Furthermore, when a network attack is detected, the intrusion path and contamination range are determined based on the relationship data.

[0003] The relationship data is a directed graph. The directed graph has targets as nodes. The directed graph has directed edges from the impact source target to the impact destination target corresponding to the action data that affects the targets. When a network attack is detected, the relationship data is referred to. The range obtained by tracing back the directed edges from the target where the attack is detected is determined as the intrusion path. The range obtained by tracing forward the edges is determined as the contamination range.

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: Japanese Patent No. 6987332 Summary of the invention

[0007] Problems to be solved by the invention

[0008] In Patent Document 1, relational data between targets is generated based on the action data of multiple software. At this time, relational data about actions unrelated to the network attack is also generated. Therefore, when the relational data is traced back or forward when a network attack occurs, targets unrelated to the network attack may be reached. As a result, a portion that is not an intrusion path or contamination range may be determined as an intrusion path or contamination range.

[0009] An object of the present disclosure is to identify at least one of an intrusion path and a contamination range for a target that is highly likely to be involved in a network attack.

[0010] Means for solving problems

[0011] The attack analysis device disclosed in the present invention comprises: a data acquisition unit, which acquires action data, wherein the action data includes a target that performs an action that affects other targets, namely an impact source target, a target that is affected by the action performed by the impact source target, namely an impact destination target, and at least the impact destination target and the attack confidence that represents the probability that the action is an attack; a relationship construction unit, which adds the relationship between the impact source target and the impact destination target to the relationship data when the action data acquired by the data acquisition unit includes the impact source target and the attack confidence is greater than a threshold value A, thereby constructing the relationship data; and a determination unit, which, when an attack is detected, determines at least one of the contamination range of the impact of the detected attack and the intrusion path of the detected attack based on the relationship data constructed by the relationship construction unit.

[0012] Effects of the Invention

[0013] In the present disclosure, when the attack certainty is above the threshold A, the relationship between the impact source target and the impact destination target is added to the relationship data to construct the relationship data. In this way, only targets with a high probability of being related to the network attack can be determined as the intrusion path or contamination range. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a block diagram of the attack analysis device 10 according to the first embodiment.

[0015] Figure 2 This is an explanatory diagram of the action data 31 according to the first embodiment.

[0016] Figure 3 This is an explanatory diagram of the threshold value 41 in the first embodiment.

[0017] Figure 4 This is an explanatory diagram of the relationship data 51 according to the first embodiment.

[0018] Figure 5 This is a flowchart of the relationship building process in implementation mode 1.

[0019] Figure 6 This is a flowchart of the determination process in the first embodiment.

[0020] Figure 7 4 is a block diagram of an attack analysis device 10 according to Modification 1.

[0021] Figure 8 This is an explanatory diagram of the historical data 61 according to the second embodiment.

[0022] Fig. 9 This is a flowchart of the relationship building process in implementation mode 2.

[0023] Fig.10 It is a block diagram of the attack analysis device 10 according to the third embodiment.

[0024] Fig.11 This is an explanatory diagram of the action data 31 according to the third embodiment.

[0025] Fig.12 This is a flowchart of the attack certainty calculation process of implementation mode 3. DETAILED DESCRIPTION

[0026] Implementation Method 1

[0027] ***Description of the structure***

[0028] Reference Figure 1 The structure of the attack analysis device 10 according to the first embodiment will be described.

[0029] The attack analysis device 10 is a computer.

[0030] The attack analysis device 10 includes hardware such as a processor 11, a memory 12, and a storage 13. The processor 11 is connected to other hardware via a signal line and controls the other hardware.

[0031] The processor 11 is an IC that performs processing. IC is the abbreviation of Integrated Circuit. As a specific example, the processor 11 is a CPU, a DSP, or a GPU. CPU is the abbreviation of Central Processing Unit. DSP is the abbreviation of Digital Signal Processor. GPU is the abbreviation of Graphics Processing Unit.

[0032] The memory 12 is a volatile storage device that temporarily stores data. As a specific example, the memory 12 is SRAM or DRAM. SRAM is the abbreviation of Static Random Access Memory. DRAM is the abbreviation of Dynamic Random Access Memory.

[0033] The memory 13 is a non-volatile storage device for storing data. As a specific example, the memory 13 is an HDD. HDD is the abbreviation of Hard Disk Drive. In addition, the memory 13 can also be a mobile recording medium such as an SD (registered trademark) memory card, CompactFlash (registered trademark), NAND flash memory, floppy disk, optical disk, high-density disk, Blu-ray (registered trademark) disk, DVD. SD is the abbreviation of Secure Digital. DVD is the abbreviation of Digital Versatile Disk.

[0034] The attack analysis device 10 includes, as functional components, a data acquisition unit 21, a relationship construction unit 22, and a determination unit 23. The functions of the functional components of the attack analysis device 10 are realized by software.

[0035] The memory 13 stores a program for realizing the functions of each functional component of the attack analysis device 10. The program is read into the memory 12 by the processor 11 and executed by the processor 11. Thus, the functions of each functional component of the attack analysis device 10 are realized.

[0036] exist Figure 1 In FIG. 1 , only one processor 11 is shown. However, there may be multiple processors 11, and the multiple processors 11 may cooperate to execute programs that realize each function.

[0037] ***Description of the action***

[0038] Reference Figure 2 to Figure 6 The operation of the attack analysis device 10 according to the first embodiment will be described.

[0039] The operation procedure of the attack analysis device 10 of the first embodiment corresponds to the attack analysis method of the first embodiment. In addition, the program that realizes the operation of the attack analysis device 10 of the first embodiment corresponds to the attack analysis program of the first embodiment.

[0040] The operation of the attack analysis device 10 includes a relationship building process and a determination process. After describing data and the like used in the relationship building process and the determination process, the relationship building process and the determination process will be described.

[0041] Reference Figure 2 The motion data 31 according to the first embodiment will be described.

[0042] The action data 31 indicates an action in the target system when a target in the system performs an action that affects other targets. The target system is a system that becomes the target of at least one of the intrusion path and the contamination range. The target is an element used when executing software. For example, the target is an element such as a process, a file, and a shared storage area.

[0043] The action data 31 includes an impact source target 32 ​​, an impact destination target 33 , and an attack certainty 34 .

[0044] The impact source target 32 ​​is a target that performs an action that affects other targets. The impact destination target 33 is a target that is affected by the action performed by the impact source target 32. Assume that data is sent from process A to process B. In this case, the impact source target 32 ​​is process A. The impact destination target 33 is process B. Assume that data is written from process C to file D. In this case, the impact source target 32 ​​is process C. The impact destination target 33 is file D.

[0045] The attack certainty 34 indicates the probability that the action is a network attack against the target system.

[0046] The action data 31 is generated, for example, by an intrusion detection program or a security monitoring program introduced into the target system.

[0047] It is also acceptable that the action data 31 does not include the influence source target 32. When the intrusion detection program or the like that generates the action data 31 cannot identify the influence source, the action data 31 does not include the influence source target 32.

[0048] Reference Figure 3 The threshold value 41 in the first embodiment will be described.

[0049] The threshold 41 is information for classifying the action indicated in the action data 31 into three types: "not an attack", "suspected attack", and "yes attack" according to the attack certainty 34. Here, the threshold 41 indicates that the action is classified as "not an attack" when the attack certainty 34 is less than the threshold A. The threshold 41 indicates that the action is classified as "suspected attack" when the attack certainty 34 is greater than the threshold A and less than the threshold B. The threshold 41 indicates that the action is classified as "yes attack" when the attack certainty 34 is greater than the threshold B.

[0050] The threshold value 41 is set in the programs of the relationship construction unit 22 and the determination unit 23. Alternatively, the threshold value 41 may be set in the memory 13.

[0051] Reference Figure 4 The relationship data 51 according to the first embodiment will be described.

[0052] The relationship data 51 is a directed graph composed of nodes 52 representing targets and edges 53 having a direction from the impact source target to the impact destination target. Figure 4 In FIG. 5 , nodes 52 are represented by ovals. Edges 53 are represented by arrows. Relationship data 51 is stored in the memory 12 or the storage 13.

[0053] The relationship data 51 is generated based on the action data 31. Figure 4 , it can be seen that there is action data 31 whose source target 32 ​​is process A and whose destination target 33 is file A. It can be seen that there is action data 31 whose source target 32 ​​is file A and whose destination target 33 is process B. It can be seen that there is action data 31 whose source target 32 ​​is process B and whose destination target 33 is file B. It can be seen that there is action data 31 whose source target 32 ​​is process B and whose destination target 33 is process C. It can be seen that there is action data 31 whose source target 32 ​​is process D and whose destination target 33 is process C.

[0054] Reference Figure 5 The relationship building process in the first embodiment is described.

[0055] (Step S11: Relationship data initialization processing)

[0056] The relationship construction unit 22 initializes the relationship data 51 to be empty. That is, the relationship construction unit 22 sets the relationship data 51 to a state where the nodes 52 and the edges 53 do not exist.

[0057] (Step S12: Action data input processing)

[0058] The relationship building unit 22 receives new motion data 31 as input.

[0059] Specifically, the data acquisition unit 21 acquires the newly generated action data 31. The action data 31 acquired here includes at least the impact source target 32, the impact destination target 33, and the attack certainty 34. The data acquisition unit 21 inputs the acquired action data 31 to the relationship construction unit 22. The relationship construction unit 22 receives the input action data 31.

[0060] (Step S13: Data determination processing)

[0061] The relationship construction unit 22 determines whether the action data 31 received in step S12 includes the impact source target 32 ​​and whether the attack certainty 34 is equal to or greater than the threshold value A.

[0062] When the action data 31 includes the impact source target 32 ​​and the attack certainty 34 is greater than the threshold A, the relationship building unit 22 advances the process to step S14. The attack certainty 34 being greater than the threshold A means that the action is classified as "suspected attack" or "actual attack". On the other hand, in other cases, the relationship building unit 22 advances the process to step S15.

[0063] (Step S14: Data addition processing)

[0064] The relationship construction unit 22 adds the relationship between the influence source object 32 and the influence destination object 33 in the action data 31 received in step S12 to the relationship data 51. Thus, the relationship construction unit 22 constructs the relationship data 51.

[0065] Specifically, the relationship construction unit 22 adds direction information indicating the direction from the influence source target 32 ​​to the influence destination target 33 to the relationship data 51. Here, the relationship data 51 is a directed graph. Therefore, the relationship construction unit 22 adds the edge 53 from the node 52 corresponding to the influence source target 32 ​​to the node 52 corresponding to the influence destination target 33 to the relationship data 51 as direction information.

[0066] More specifically, the relationship construction unit 22 determines whether the influence source target 32 ​​exists in the relationship data 51. If the influence source target 32 ​​does not exist in the relationship data 51, the relationship construction unit 22 adds the node 52 corresponding to the influence source target 32 ​​to the relationship data 51. Similarly, the relationship construction unit 22 determines whether the influence destination target 33 exists in the relationship data 51. If the influence destination target 33 does not exist in the relationship data 51, the relationship construction unit 22 adds the node 52 corresponding to the influence destination target 33 to the relationship data 51. The relationship construction unit 22 adds an edge 53 from the node 52 corresponding to the influence source target 32 ​​to the node corresponding to the influence destination target 33.

[0067] (Step S15: Output processing)

[0068] The relationship building unit 22 outputs the motion data 31 received in step S12 to the specifying unit 23. Then, the relationship building unit 22 returns the process to step S12 and waits for the next motion data 31 to be input.

[0069] Reference Figure 6 The determination process of the first embodiment will be described.

[0070] (Step S21: Action Data Input Processing)

[0071] The specifying unit 23 receives as input new motion data 31. Specifically, the specifying unit 23 receives the motion data 31 output in step S15.

[0072] (Step S22: Data determination processing)

[0073] The identification unit 23 determines whether the attack certainty 34 in the action data 31 received in step S21 is equal to or greater than the threshold value B.

[0074] When the attack certainty 34 is greater than or equal to the threshold value B, the determination unit 23 causes the process to proceed to step S23. The attack certainty 34 being greater than or equal to the threshold value B means that the action is classified as "an attack". In other words, the attack certainty 34 being greater than or equal to the threshold value B means that an attack on the target system is detected. In other cases, the determination unit 23 causes the process to return to step S21 and waits for the input of the next action data 31.

[0075] (Step S23: Intrusion Path Determination Process)

[0076] The identification unit 23 refers to the relationship data 51 constructed by the relationship construction unit 22 to identify the intrusion path of the attack indicated by the action data 31 received in step S21 .

[0077] Specifically, the determination unit 23 determines the target that has detected the action indicating the attack indicated by the action data 31 received in step S21. Here, the determination unit 23 determines the impact destination target 33 in the action data 31 as the target that has detected the action indicating the attack. The determination unit 23 uses the determined target as the starting point and traces back in the direction indicated by the direction information included in the relationship data 51, thereby determining the intrusion path. The determination unit 23 determines the range reached by tracing back from the starting point as the intrusion path.

[0078] For example, suppose Figure 4 The process B in is the target where the action indicating the attack is detected. In this case, the edge 53 as the direction information is traced back to identify the process A, the file A and the process B as the intrusion path.

[0079] (Step S24: Contamination Range Determination Process)

[0080] The identification unit 23 refers to the relationship data 51 constructed by the relationship construction unit 22 and identifies the contamination range in which the influence of the attack indicated by the action data 31 received in step S21 is assumed to exist.

[0081] Specifically, the determination unit 23 determines the target that has detected the action indicating the attack indicated by the action data 31 received in step S21. Here, the determination unit 23 determines the impact destination target 33 in the action data 31 as the target that has detected the action indicating the attack. The determination unit 23 uses the determined target as the starting point and traces forward in the direction indicated by the direction information included in the relationship data 51, thereby determining the contamination range. The determination unit 23 determines the range reached by tracing forward from the starting point as the contamination range.

[0082] For example, suppose Figure 4 The process B in is the target where the action indicating the attack is detected. In this case, the edge 53 as the direction information is traced forward, and the process B, file B, process C, and process D are determined as the contamination range.

[0083] (Step S25: Data generation processing)

[0084] The specifying unit 23 generates output data indicating the intrusion path specified in step S23 and the contamination range specified in step S24 .

[0085] Specifically, the determination unit 23 generates data including a set of targets included in the intrusion path and a set of targets included in the contamination range as output data. Furthermore, the determination unit 23 may include the edge 53 traced in step S23 and the edge 53 traced in step S24 in the output data.

[0086] Then, the determination unit 23 returns the process to step S21 and waits for input of the next motion data 31 .

[0087] ***Effects of Implementation Method 1***

[0088] As described above, the attack analysis device 10 of the first embodiment adds the influence relationship between the targets caused by the action shown in the action data 31 to the relationship data 51 only when the action is classified as "suspected attack" or "is attack". That is, the attack analysis device 10 of the first embodiment adds the influence relationship between the targets caused by the action shown in the action data 31 to the relationship data 51 only when the probability of being a network attack is above a certain level.

[0089] Thus, only targets with a high probability of being related to a network attack can be determined as an intrusion path or a contamination range. In other words, targets with a low probability of being related to a network attack can be not determined as an intrusion path or a contamination range.

[0090] Furthermore, the attack analysis device 10 of the first embodiment constructs the relationship data 51 each time the action data 31 is input. Furthermore, when the action of the action data 31 is determined to be "an attack", the attack analysis device 10 of the first embodiment can immediately identify the intrusion path and the contamination range.

[0091] Therefore, it can be applied to control systems and the like that require real-time performance.

[0092] ***Other structures***

[0093] <Modification 1>

[0094] In the first embodiment, each functional component is implemented by software. However, as a modification example 1, each functional component may be implemented by hardware. Regarding this modification example 1, the differences from the first embodiment will be described.

[0095] Reference Figure 7 The structure of the attack analysis device 10 according to Modification 1 will be described.

[0096] When each functional component is realized by hardware, the attack analysis device 10 includes an electronic circuit 14 instead of the processor 11, the memory 12, and the storage 13. The electronic circuit 14 is a dedicated circuit that realizes the functions of each functional component and the memory 12 and the storage 13.

[0097] As the electronic circuit 14, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, and an FPGA can be envisioned. GA is the abbreviation of Gate Array. ASIC is the abbreviation of Application Specific Integrated Circuit. FPGA is the abbreviation of Field-Programmable Gate Array.

[0098] Each functional component may be realized by one electronic circuit 14 , or may be realized by distributing multiple electronic circuits 14 .

[0099] <Modification 2>

[0100] As a second modification, some of the functional components may be implemented by hardware, and the other functional components may be implemented by software.

[0101] The processor 11, the memory 12, the storage 13, and the electronic circuit 14 are referred to as a processing circuit. That is, the functions of each functional component are realized by the processing circuit.

[0102] Implementation Method 2

[0103] The difference between the second embodiment and the first embodiment is that, for the action data 31 whose attack certainty 34 is less than the threshold value A, when the attack certainty 34 is determined to be higher than the reference based on the relationship with other action data 31, the influence relationship between the targets is also added to the relationship data 51. In the second embodiment, the difference is explained, and the explanation of the same points is omitted.

[0104] ***Description of the action***

[0105] Reference Figure 8 and Fig. 9The operation of the attack analysis device 10 according to the second embodiment will be described.

[0106] The operation procedure of the attack analysis device 10 according to the second embodiment corresponds to the attack analysis method according to the second embodiment. In addition, the program for realizing the operation of the attack analysis device 10 according to the second embodiment corresponds to the attack analysis program according to the second embodiment.

[0107] After describing data used in the relationship building process, the relationship building process will be described. The determination process is the same as that of the first embodiment.

[0108] Reference Figure 8 The historical data 61 according to the second embodiment will be described.

[0109] The history data 61 is the action data 31 whose attack certainty 34 is less than the threshold value A and which includes the impact source target 32 ​​among the action data 31 input in the past.

[0110] The history data 61 includes an impact source target 62 , an impact destination target 63 , and time information 64 .

[0111] The influence source object 62 is the influence source object 32 in the action data 31 based on the history data 61. The influence destination object 63 is the influence destination object 33 in the action data 31 based on the history data 61. The time information 64 indicates the time when the action shown in the action data 31 based on the history data 61 was performed.

[0112] Reference Fig. 9 The relationship building process of implementation mode 2 is described.

[0113] The processing of step S31 is Figure 5 The processing of step S33 to step S35 is the same as that of step S11. Figure 5 The processing of step S12 to step S14 is the same as that of step S39. Figure 5 The processing of step S15 is the same as that of step S15.

[0114] However, in step S34, if the action data 31 includes the impact source target 32 ​​and the attack certainty 34 is equal to or greater than the threshold A, the relationship construction unit 22 advances the process to step S35. On the other hand, in other cases, the relationship construction unit 22 advances the process to step S36.

[0115] (Step S32: Historical data initialization processing)

[0116] The relationship building unit 22 initializes the history data 61 to be empty. In other words, the history data 61 is set to a state where no data exists.

[0117] (Step S36: Second Data Addition Process)

[0118] The relationship building unit 22 extracts the past data of the action data 31 included in the history data 61, which is the past data determined to have a higher attack certainty 34 than the reference based on the relationship with the action data 31 newly acquired in step S33. In the following cases (1) and (2), it can be considered that the relationship building unit 22 determines that the attack certainty 34 of the past data is higher than the reference.

[0119] (1) When both condition 1 and condition 2 are satisfied. Condition 1 is a condition that the attack certainty 34 in the newly acquired action data 31 is greater than or equal to the threshold value A. Condition 2 is a condition that the difference between the action time of the newly acquired action data 31 and the action time of the past data is within the reference time. The current time may be considered as the action time of the newly acquired action data 31. In addition, condition 1 may be excluded.

[0120] (2) The case where condition 1 and condition 3 are satisfied. Condition 1 is as described above. Condition 3 is a condition that at least one of the influence source target and the influence destination target is consistent between the newly acquired action data 31 and the past data. Condition 3 is satisfied in any of the following (a) and (b). (a) The influence source target 32 ​​in the newly acquired action data 31 is consistent with either the influence source target 62 or the influence destination target 63 in the past data. (b) The influence destination target 33 in the newly acquired action data 31 is consistent with either the influence source target 62 or the influence destination target 63 in the past data. In addition, condition 1 can also be excluded.

[0121] The relationship building unit 22 may use (1) and (2) together to determine that the attack certainty 34 of the past data is higher than the reference. That is, the relationship building unit 22 may determine that the attack certainty 34 of the past data is higher than the reference when condition 1, condition 2, and condition 3 are satisfied.

[0122] The relationship building unit 22 adds the relationship between the influence source target 62 and the influence destination target 63 in the extracted historical data 61 to the relationship data 51. Figure 5 Similarly to the process of step S14, the relationship construction unit 22 adds the edge 53 from the node 52 corresponding to the influence source target 62 to the node 52 corresponding to the influence destination target 63 to the relationship data 51 as direction information.

[0123] (Step S37: Influence source determination processing)

[0124] The relationship construction unit 22 determines whether the action data 31 newly acquired in step S33 includes the influence source target 62 .

[0125] When the influence source target 62 is included, the relationship construction unit 22 advances the process to step S38. In other cases, the relationship construction unit 22 advances the process to step S39.

[0126] (Step S38: History Addition Process)

[0127] The relationship construction unit 22 adds the action data 31 newly acquired in step S33 to the history data 61 .

[0128] Specifically, the relationship construction unit 22 creates a new record in the history data 61. Then, the relationship construction unit 22 writes the influence source target 32 ​​and the influence destination target 33 in the action data 31 in the influence source target 62 and the influence destination target 63 in the history data 61. The relationship construction unit 22 writes the action time of the action data 31 in the time information 64 in the history data 61.

[0129] ***Effects of Implementation Method 2***

[0130] As described above, when the attack analysis device 10 of the second embodiment determines that the attack certainty 34 is higher than the reference based on the relationship with other action data 31 , the attack analysis device 10 adds the influence relationship between targets to the relationship data 51 .

[0131] There are also actions that cannot be determined as "attack" or "suspected attack" by the action data 31 alone. Even such actions can be regarded as the same as the "suspected attack" action by using the association with the "suspected attack" action as a clue, and the relationship data 51 can be constructed.

[0132] Implementation 3

[0133] The third embodiment is different from the first and second embodiments in that the attack certainty 34 is calculated when the action data 31 does not include the attack certainty 34. In the third embodiment, this difference is described, and the description of the same points is omitted.

[0134] ***Description of the structure***

[0135] Reference Fig.10 The structure of the attack analysis device 10 according to the third embodiment will be described.

[0136] Attack analysis device 10 and Figure 1 The attack analysis device 10 shown is different in that it has an attack certainty calculation unit 24 as a functional component. Like other functional components, the function of the attack certainty calculation unit 24 is realized by software or hardware.

[0137] ***Description of the action***

[0138] Reference Fig.11 and Fig.12 The operation of the attack analysis device 10 according to the third embodiment will be described.

[0139] The operation procedure of the attack analysis device 10 according to the third embodiment corresponds to the attack analysis method according to the third embodiment. In addition, the program for realizing the operation of the attack analysis device 10 according to the third embodiment corresponds to the attack analysis program according to the third embodiment.

[0140] The operation of the attack analysis device 10 includes an attack certainty calculation process in addition to the relationship building process and the identification process. After describing data and the like used in the attack certainty calculation process, the attack certainty calculation process will be described.

[0141] Reference Fig.11 The action data 31 according to the third embodiment will be described.

[0142] The action data 31 includes action information 35 in addition to the impact source target 32 ​​, the impact destination target 33 , and the attack certainty 34 .

[0143] Action information 35 indicates the action type and action content. For example, the action type is data transmission based on socket communication. In this case, the action content includes port number, data size and transmission data. As another example, the action type is writing to a file. In this case, the action content includes file path, writing size, writing position and writing data.

[0144] Reference Fig.12 The attack certainty calculation process of implementation mode 3 is described.

[0145] (Step S41: Action Data Input Processing)

[0146] The attack certainty calculation unit 24 receives new action data 31 as input. Figure 5 The same as step S12.

[0147] (Step S42: Data determination processing)

[0148] The attack certainty calculation unit 24 determines whether the action data 31 received in step S41 includes the attack certainty 34 .

[0149] When the action data 31 does not include the attack certainty calculation unit 24, the attack certainty calculation unit 24 advances the process to step S43. On the other hand, in other cases, the attack certainty calculation unit 24 advances the process to step S44.

[0150] (Step S43: Confidence Calculation Process)

[0151] The attack certainty calculation unit 24 calculates the attack certainty 34 based on the action content indicated by the action information 35 in the action data 31 received in step S41. The attack certainty calculation unit 24 adds the calculated attack certainty 34 to the action data 31.

[0152] Specifically, the attack certainty calculation unit 24 pre-sets the value of the attack certainty 34 according to each judgment criterion. The judgment criterion is determined according to the action content. The attack certainty calculation unit 24 determines the judgment criterion that the action content in the action data 31 satisfies. The attack certainty calculation unit 24 determines the value of the attack certainty 34 corresponding to the determined judgment criterion.

[0153] A specific example of the determination criterion will be described.

[0154] Assume that the action type is data transmission based on socket communication. In this case, consider the following judgment criteria. Criteria 1: The port number may be used in the attack. Criteria 2: The data size is different from the data size used in normal communication. Criteria 3: The content of the transmitted data is consistent with or similar to known attack data.

[0155] Assume that the action type is file writing. In this case, the following judgment criteria are considered: Criterion 1: Writing is performed on a file that has not been written in normal action. Criterion 2: The writing size is different from the writing size in normal action.

[0156] (Step S44: Output processing)

[0157] The attack certainty calculation unit 24 outputs the action data 31 to the relationship construction unit 22. Then, the attack certainty calculation unit 24 returns the process to step S41, and waits for the next action data 31 to be input.

[0158] The relationship building process and the determination process are the same as those in Embodiments 1 and 2. However, in the action data input process ( Figure 5 Step S12 and Fig. 9 In step S33), the action data 31 output in step S44 is accepted.

[0159] ***Effects of Implementation 3***

[0160] As described above, when the action data 31 does not include the attack certainty 34 , the attack analysis device 10 according to the third embodiment calculates the attack certainty 34 .

[0161] Thus, even when the attack certainty 34 is not determined in advance, the same effects as those of the first and second embodiments can be obtained.

[0162] In addition, the word "unit" in the above description may be rewritten as "circuit", "process", "step", "processing" or "processing circuit".

[0163] The above describes the embodiments and variations of the present disclosure. It is also possible to implement several of these embodiments and variations in combination. In addition, it is also possible to partially implement any one or several of the embodiments and variations. In addition, the present disclosure is not limited to the above embodiments and variations, and various changes can be made as needed.

[0164] Description of symbols

[0165] 10: attack analysis device; 11: processor; 12: memory; 13: storage; 14: electronic circuit; 21: data acquisition unit; 22: relationship construction unit; 23: determination unit; 24: attack certainty calculation unit; 31: action data; 32: impact source target; 33: impact destination target; 34: attack certainty; 35: action information; 41: threshold; 51: relationship data; 52: node; 53: edge; 61: historical data; 62: impact source target; 63: impact destination target; 64: time information.

Claims

1. An attack analysis device, comprising: a data acquisition unit that acquires action data, the action data including at least the impact source target, which is a target that performs an action that affects other targets, the impact destination target, which is a target that is affected by the action performed by the impact source target, and the attack certainty indicating the probability that the action is an attack, of which at least the impact destination target and the attack certainty are included; a relationship construction unit that adds the relationship between the impact source target and the impact destination target to the relationship data, thereby constructing the relationship data, when the action data acquired by the data acquisition unit includes the impact source target and the attack certainty is greater than a threshold value A; as well as A determination unit determines, when an attack is detected, at least one of a contamination range where the influence of the detected attack is assumed to exist and an invasion path of the detected attack based on the relationship data constructed by the relationship construction unit.

2. The attack analysis device according to claim 1, wherein: The relationship building unit adds direction information indicating a direction from the influence source object to the influence destination object as a relationship between the influence source object and the influence destination object to the relationship data, The identification unit identifies the contamination range by tracing back in a forward direction indicated by the direction information included in the relationship data, using the target at which the action indicating the detected attack is detected as a starting point.

3. The attack analysis device according to claim 2, wherein: The specifying unit receives the motion data as input, and specifies the contamination range by taking the impact destination target as a target where the motion indicating the detected attack is detected, when the attack certainty is equal to or greater than a threshold value B which is higher than the threshold value A.

4. The attack analysis device according to claim 1, wherein: The relationship building unit adds direction information indicating a direction from the influence source object to the influence destination object as a relationship between the influence source object and the influence destination object to the relationship data, The identification unit identifies an intrusion path by tracing back the direction indicated by the direction information included in the relationship data, using the target at which the action indicating the detected attack is detected as a starting point.

5. The attack analysis device according to claim 4, wherein: The determination unit receives the action data as input, and when the attack certainty is equal to or greater than a threshold value B which is higher than the threshold value A, determines the intrusion path by taking the impact destination target as a target where an action indicating a detected attack is detected.

6. The attack analysis device according to any one of claims 1 to 5, wherein: The relationship building unit adds to the relationship data the relationship between the impact source target and the impact destination target in the past data of the action data whose attack certainty is less than the threshold A, and the past data which is judged to have the attack certainty higher than the benchmark based on the relationship with the newly acquired action data.

7. The attack analysis device according to claim 6, wherein: When the attack certainty in the newly acquired action data is above the threshold A and the difference between the action time of the newly acquired action data and the action time of the past data is within a reference time, the relationship building unit determines that the attack certainty of the past data is higher than the reference.

8. The attack analysis device according to claim 6 or 7, wherein: When the attack certainty in the newly acquired action data is above the threshold A and at least one of the impact source target and the impact destination target is consistent between the newly acquired action data and the past data, the relationship construction unit determines that the attack certainty of the past data is higher than the benchmark.

9. The attack analysis device according to any one of claims 1 to 8, wherein: The action data includes action information indicating the content of the action. The attack analysis device further includes an attack certainty calculation unit that calculates the attack certainty based on the action content indicated by the action information.

10. An attack analysis method, wherein: The computer obtains action data, the action data including at least the impact source target, which is a target that performs an action that affects other targets, the impact destination target, which is a target that is affected by the action performed by the impact source target, and the attack certainty indicating the probability that the action is an attack, among which at least the impact destination target and the attack certainty are included. When the action data includes the impact source target and the attack certainty is greater than a threshold value A, the computer adds the relationship between the impact source target and the impact destination target to the relationship data, thereby constructing the relationship data. When an attack is detected, the computer determines, based on the relationship data, at least one of a contamination range where the impact of the detected attack is assumed to exist and an invasion path of the detected attack.

11. An attack analysis program, the attack analysis program causing a computer to function as an attack analysis device, the attack analysis device performing the following processing: Data acquisition processing, acquiring action data, the action data including at least the impact destination target and the attack certainty of the target that performs an action that affects other targets, the target that is affected by the action performed by the impact source target, and the attack certainty indicating the probability that the action is an attack; a relationship building process, in which, when the action data acquired through the data acquisition process includes the impact source target and the attack certainty is greater than a threshold value A, the relationship between the impact source target and the impact destination target is added to the relationship data, thereby building the relationship data; as well as A determination process, when an attack is detected, determines at least one of a contamination range where the influence of the detected attack is assumed to exist and an intrusion path of the detected attack based on the relationship data constructed by the relationship construction process.

Images