ATTACK ANALYSIS DEVICE, ATTACK ANALYSIS METHOD AND ATTACK ANALYSIS PROGRAM

Abstract

A data acquisition unit (21) captures operation data, which includes an influence source object, which is an object that has performed an operation to influence another object; an influence target object, which is an object that is affected by the operation performed by the influence source object; and an attack probability, which represents the likelihood that the operation is an attack. A relationship construction unit (22) creates relationship data when the attack probability is equal to or greater than a threshold A by adding a relationship between the influence source object and the influence target object to the relationship data. When an attack is captured, a specification unit (23) specifies, based on the relationship data, at least either an infected area that is said to be affected by the attack or an intrusion route of the attack.

Description

Technical area

[0001] The present disclosure relates to a technique for determining an infected area to be affected by a cyberattack. State of the art

[0002] Patent Literature 1 discloses a technique for specifying an intrusion route and an infected area due to an attack in a system that has suffered a cyberattack. In Patent Literature 1, relationship data between objects is generated from the operation data of a plurality of software components. Then, when a cyberattack is detected, the intrusion route and the infected area are determined based on the relationship data.

[0003] The relationship data is a directed graph. The directed graph contains objects as nodes. The directed graph contains directed edges from influence source objects to influence target objects, corresponding to process data that affect the relationships between the objects. When a cyberattack is detected, the relationship data is referenced. The area obtained by tracing the directed edges from an object where the attack is detected in the reverse direction is designated as the intrusion route. The area obtained by tracing edges in the forward direction is designated as the infected area. Reference listPatent literature

[0004] Patent literature 1: JP 6987332 B1 Summary of the inventionTechnical problem

[0005] In Patent Literature 1, relationship data between objects is generated from the operation data of a plurality of software parts. In this case, relationship data related to operations irrelevant to cyberattacks is also generated. Therefore, when a cyberattack occurs, if the relationship data is traced backward or forward, an object unrelated to the cyberattack may be reached. Consequently, a part that is not an intrusion route or an infected area can be specified as an intrusion route or an infected area.

[0006] This disclosure is intended to make it possible to specify an object that is highly likely to be related to a cyberattack, at least as either the intrusion route or the infected area. Solution to the problem

[0007] An attack analysis device according to the present disclosure comprises: a data acquisition unit for acquiring operation data including at least one influence target object and an attack probability among an influence source object that is an object that has performed an operation to influence another object, the influence target object that is an object influenced by the operation performed by the influence source object, and the attack probability that represents a probability that the operation is an attack; a relationship construction unit for creating relationship data when the operation data acquired by the data acquisition unit includes the influence source object and the attack probability is equal to or higher than a threshold A by adding a relationship between the influence source object and the influence target object to the relationship data; and a specification unit for specifying at least one of an infected area to be affected by a detected attack and an intrusion route of the detected attack based on the relationship data constructed by the relationship construction unit when the attack is detected. Advantageous effects of the invention

[0008] In the present disclosure, when the probability of an attack is equal to or greater than a threshold A, a relationship between an influence source object and an influence target object is added to the relationship data, and the relationship data is created. In this way, it is possible to specify only an object with a high probability of being related to a cyberattack as an intrusion route or infected area. Short description of the drawings Fig. 1 is a configuration diagram of an attack analysis apparatus 10 according to a first embodiment; Fig. 2 is an explanatory drawing of the operation data 31 according to the first embodiment; Fig. 3 is an explanatory drawing of a threshold value 41 according to the first embodiment; Fig. 4 is an explanatory drawing of the relationship data 51 according to the first embodiment; Fig. 5 is a flowchart of a relationship creation process according to the first embodiment; Fig. 6 is a flowchart of a specification process according to the first embodiment; Fig. 7 is a configuration diagram of an attack analysis device 10 according to a first variant; Fig. 8 is an explanatory drawing of the history data 61 according to a second embodiment; Fig. 9 is a flowchart of a relationship creation process according to the second embodiment; Fig. 10 is a configuration diagram of an attack analysis apparatus 10 according to a third embodiment; Fig. 11 is an explanatory drawing of the operation data 31 according to a third embodiment; and Fig. 12 is a flowchart of a method for calculating the attack probability according to the third embodiment. Description of embodimentsFirst embodiment***Description of the configuration***

[0009] A configuration of an attack analysis apparatus 10 according to a first embodiment will be described with reference to Fig. 1 described.

[0010] The attack analysis device 10 is a computer.

[0011] The attack analysis device 10 comprises hardware components such as a processor 11, a memory unit 12, and a data storage unit 13. The processor 11 is connected to the other hardware components via a signal line and controls these other hardware components.

[0012] The processor 11 is an integrated circuit (IC) for performing the processing. IC is an abbreviation for integrated circuit. The processor 11 is, for example, a CPU, a DSP, or a GPU. CPU is an abbreviation for central processing unit. DSP is an abbreviation for digital signal processor. GPU is an abbreviation for graphics processing unit.

[0013] The memory unit 12 is a volatile memory for temporarily storing data. The memory unit 12 is, for example, an SRAM or a DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory.

[0014] The data storage unit 13 is a non-volatile memory for storing data. The data storage unit 13 is, for example, an HDD. HDD is an abbreviation for Hard Disk Drive. Furthermore, the data storage unit 13 may be a portable recording medium, such as an SD memory card (registered trademark), a CompactFlash card (registered trademark), a NAND flash memory, a flexible disk, an optical disk, a compact disk, a Blu-ray disk (registered trademark), a DVD, or the like. SD is an abbreviation for Secure Digital. DVD is an abbreviation for Digital Versatile Disk.

[0015] The attack analysis device 10 is equipped with a data acquisition unit 21, a relationship construction unit 22, and a specification unit 23 as functional components. The functions of the individual functional components of the attack analysis device 10 are implemented by software.

[0016] Programs for implementing the functions of the individual functional components of the attack analysis device 10 are stored in the data storage unit 13. These programs are read into the storage unit 12 by the processor 11 and executed by the processor 11. In this way, the functions of the individual functional components of the attack analysis device 10 are implemented.

[0017] In Fig. 1, only a single processor 11 is shown. However, there may also be a plurality of processors 11 that can cooperate with each other and execute the programs to realize each function. ***Description of how it works***

[0018] The operation of the attack analysis device 10 according to the first embodiment will be explained with reference to the Fig. 2 to Fig. 6 described.

[0019] The workflow of the attack analysis device 10 according to the first embodiment corresponds to an attack analysis method according to the first embodiment. Furthermore, the programs for implementing the operation of the attack analysis device 10 according to the first embodiment correspond to an attack analysis program according to the first embodiment.

[0020] The operation of the attack analysis device 10 includes a relationship construction process and a specification process. After describing the data and the like used in the relationship construction process and the specification process, the relationship construction process and the specification process will be described.

[0021] The operation data 31 according to the first embodiment will be described with reference to Fig. 2 described.

[0022] The operation data 31 represents an operation in a case where a specific object in a system performs the operation that affects another object in the system that is a target. The target system is a system that specifies at least one of an intrusion route and an infected area as a target. Objects are elements used in software execution. The objects are, for example, elements such as a process, a file, and a shared memory area.

[0023] The process data 31 includes an influence source object 32, an influence target object 33 and an attack probability 34.

[0024] The influence source object 32 is an object that has performed an operation to influence another object. The influence target object 33 is an object that is influenced by the operation performed by the influence source object 32. Suppose that data is transferred from a process A to a process B. In this case, the influence source object 32 is process A. The influence target object 33 is process B. Suppose that data is written from a process C to a file D. In this case, the influence source object 32 is process C. The influence target object 33 is file D.

[0025] The attack probability 34 indicates the probability that the process is a cyber attack on the target system.

[0026] The process data 31 is generated, for example, by an intrusion detection program or a security monitoring program that has been introduced into the target system.

[0027] It is also acceptable that the influence source object 32 is not included in the operation data 31. In a case where the intrusion detection program and the like that generate the operation data 31 is unable to specify the influence source, etc., the influence source object 32 is not included in the operation data 31.

[0028] A threshold value 41 according to the first embodiment is described with reference to Fig. 3 described.

[0029] The threshold value 41 is information for classifying the operations represented by the operation data 31 into the three types "no attack", "likely an attack", and "an attack" according to the attack probability 34. The threshold value 41 means that the operation is classified as "no attack" if the attack probability 34 is less than the threshold value A. The threshold value 41 means that the operation is classified as "likely an attack" if the attack probability 34 is equal to or greater than the threshold value A but less than the threshold value B. The threshold value 41 means that the operation is classified as "an attack" if the attack probability 34 is equal to or greater than the threshold value B.

[0030] The threshold value 41 is set in programs of the relationship construction unit 22 and the specification unit 23. Otherwise, the threshold value 41 can be set in the data storage unit 13.

[0031] The relationship data 51 according to the first embodiment will be described with reference to Fig. 4 described.

[0032] The relationship data 51 is formed as a directed graph consisting of a node 52 representing an object and an edge 53 having a direction from an influence source object to an influence target object. Fig. In Figure 4, node 52 is represented by an elliptical shape. Edge 53 is represented by an arrow. Relationship data 51 is stored in storage unit 12 or data storage unit 13.

[0033] The relationship data 51 is generated from the transaction data 31. Fig. 4 shows process data 31 in which the influence source object 32 is process A and the influence target object 33 is file A. Process data 31 is shown in which the influence source object 32 is file A and the influence target object 33 is process B. Process data 31 is shown in which the influence source object 32 is process B and the influence target object 33 is file B. Process data 31 is shown in which the influence source object 32 is process B and the influence target object 33 is process C. Process data 31 is shown in which the influence source object 32 is process D and the influence target object 33 is process C.

[0034] A method for establishing relationships according to the first embodiment will be described with reference to Fig. 5 described. (Step S11: Relationship data initialization process)

[0035] The relationship construction unit 22 initializes the relationship data 51 as empty. That is, the relationship construction unit 22 brings the relationship data 51 into a state that contains neither a node 52 nor an edge 53. (Step S12: Operation data entry process)

[0036] The relationship construction unit 22 accepts new transaction data 31 as input.

[0037] Specifically, the data acquisition unit 21 acquires the newly generated process data 31. The process data 31 acquired here includes at least one influence target object 33 and one attack probability 34 among an influence source object 32, the influence target object 33, and the attack probability 34. The data acquisition unit 21 inputs the acquired process data 31 to the relationship construction unit 22. The relationship construction unit 22 receives the input process data 31. (Step S13: Data decision process)

[0038] The relationship construction unit 22 decides whether the process data 31 assumed in step S12 contains the influence source object 32 and whether the attack probability 34 is equal to or greater than the threshold value A.

[0039] If the event data 31 includes the influence source object 32 and the attack probability 34 is equal to or greater than the threshold A, the relationship construction unit 22 proceeds to step S14. If the attack probability 34 is equal to or greater than the threshold A, this means that the event is classified as "likely an attack" or "an attack." Otherwise, the relationship construction unit 22 proceeds to step S15. (Step S14: Data addition process)

[0040] The relationship construction unit 22 adds a relationship between the influence source object 32 and the influence target object 33 in the operation data 31 accepted in step S12 to the relationship data 51. In this way, the relationship construction unit 22 creates the relationship data 51. Specifically, the relationship construction unit 22 adds direction information indicating a direction from the influence source object 32 to the influence target object 33 to the relationship data 51. Here, the relationship data 51 is formed as a directed graph. Therefore, the relationship construction unit 22 adds an edge 53 leading from a node 52 corresponding to the influence source object 32 to a node 52 corresponding to the influence target object 33 to the relationship data 51 as direction information.

[0041] More specifically, the relationship construction unit 22 determines whether the influence source object 32 exists in the relationship data 51. If the influence source object 32 does not exist in the relationship data 51, the relationship construction unit 22 adds the node 52 corresponding to the influence source object 32 to the relationship data 51. Similarly, the relationship construction unit 22 determines whether the influence target object 33 exists in the relationship data 51. If the influence target object 33 does not exist in the relationship data 51, the relationship construction unit 22 adds the node 52 corresponding to the influence target object 33 to the relationship data 51. The relationship construction unit 22 adds an edge 53 leading from the node 52 corresponding to the influence source object 32 to a node corresponding to the influence target object 33. (Step S15: Output process)

[0042] The relationship construction unit 22 outputs the operation data 31 accepted in step S12 to the specification unit 23. Then, the relationship construction unit 22 returns to step S12 and waits for the input of the next operation data 31.

[0043] A specification method according to the first embodiment will be described with reference to Fig. 6 described. (Step S21: Operation data entry process)

[0044] The specification unit 23 receives new operation data 31 as input. Specifically, the specification unit 23 accepts the operation data 31 output in step S15. (Step S22: Data decision process)

[0045] The specification unit 23 decides whether an attack probability 34 in the process data 31 assumed in step S21 is equal to or greater than a threshold value B or not.

[0046] If the attack probability 34 is equal to or greater than the threshold B, the specification unit 23 proceeds to step S23. If the attack probability 34 is equal to or greater than the threshold B, this means that the operation is classified as an "attack." In other words, if the attack probability 34 is equal to or greater than the threshold B, this means that an attack on the target system has been detected. In other cases, the specification unit 23 returns to step S21 and waits for the next operation data 31 to be input. (Step S23: Process of specifying penetration routes)

[0047] The specification unit 23 refers to the relationship data 51 created by the relationship construction unit 22 and specifies an intrusion route of the attack indicated by the operation data 31 assumed in step S21.

[0048] Specifically, the specification unit 23 specifies an object in which an event constituting an attack indicated in the event data 31 acquired in step S21 is detected. At this time, the specification unit 23 sets the influence target object 33 in the event data 31 as the object in which the event constituting the attack is detected. The specification unit 23 specifies the intrusion route by using the specified object as the origin and tracing the direction indicated by the direction information included in the relationship data 51 in a reverse direction. The specification unit 23 specifies an area reached by tracing the direction in a reverse direction from the origin as the intrusion route.

[0049] For example, it is assumed that process B in Fig. 4 is an object in which an operation constituting an attack is detected. In this case, edge 53, which is directional information, is traced backward, and process A, file A, and process B are specified as the intrusion route. (Step S24: Infected area specification process)

[0050] The specification unit 23 refers to the relationship data 51 created by the relationship construction unit 22 and specifies an infected area to be affected by the attack indicated in the operation data 31 assumed in step S21.

[0051] Specifically, the specification unit 23 specifies an object in which an event constituting an attack indicated in the event data 31 acquired in step S21 is detected. At this time, the specification unit 23 sets the influence target object 33 in the event data 31 as the object in which the event constituting the attack is detected. The specification unit 23 specifies the infected area by using the specified object as the origin and forward tracing the direction indicated in the direction information included in the relationship data 51. The specification unit 23 specifies an area reached by forward tracing the direction from the origin as the infected area.

[0052] For example, it is assumed that process B in Fig. 4 is an object in which a process representing an attack is detected. In this case, edge 53, which represents the direction information, is traced in the forward direction, and process B, file B, process C, and process D are specified as the infected area. (Step S25: Data generation process)

[0053] The specification unit 23 generates the intrusion route specified in step S23 and the output data representing the infected area specified in step S24.

[0054] Specifically, the specification unit 23 generates, as output data, a set of objects included in the intrusion route and a set of objects included in the infected area. The specification unit 23 may further include the edge 53 traced in step S23 and the edge 53 traced in step S24 in the output data.

[0055] Then, the specification unit 23 returns to step S21 and waits for the input of the next operation data 31. ***Effect of the first embodiment***

[0056] As described above, the attack analysis device 10 according to the first embodiment adds the influence relationship between objects based on the event indicated in the event data 31 to the relationship data 51 only when the event is determined to be "likely an attack" or "an attack." That is, the attack analysis device 10 according to the first embodiment adds the influence relationship between objects based on the event indicated in the event data 31 to the relationship data 51 only when the probability of a cyberattack exceeds a certain value.

[0057] This makes it possible to specify only those objects that are highly likely to be related to a cyberattack, such as an intrusion route or an infected area. In other words, it is possible to exclude an object that is unlikely to be related to a cyberattack as an intrusion route or infected area.

[0058] Furthermore, the attack analysis device 10 according to the first embodiment performs creation of the relationship data 51 each time the event data 31 is input. Then, the attack analysis device 10 according to the first embodiment is able to immediately determine the intrusion route and the infected area when the event in the event data 31 is classified as an "attack."

[0059] In this way, it is possible to apply the attack analysis device 10 to a control system and the like that requires a real-time property. ***Other configurations***<Erste Variante>

[0060] In the first embodiment, each functional component is implemented by software. However, in the first variant, each functional component can be implemented by a hardware component. In this first variant, the part that differs from the first embodiment will be described.

[0061] A configuration of the attack analysis device 10 according to the first variant will be described with reference to Fig. 7 described.

[0062] When each functional component is implemented by the hardware component, the attack analysis device 10 is equipped with an electronic circuit 14 instead of the processor 11, the memory unit 12, and the data storage unit 13. The electronic circuit 14 is a dedicated circuit for implementing the individual functional components as well as the functions of the memory unit 12 and the data storage unit 13.

[0063] The electronic circuit 14 can be a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA stands for gate array. ASIC stands for application-specific integrated circuit. FPGA stands for field-programmable gate array.

[0064] Each functional component can be realized by a single electronic circuit 14 or by a plurality of distributed electronic circuits 14. <Zweite Variante>

[0065] In the second variant, one part of each functional component can be realized by a hardware component and the other part of each functional component can be realized by software.

[0066] The processor 11, the memory unit 12, the data storage unit 13, and the electronic circuit 14 are referred to as processing circuits. This means that the functions of the individual functional components are realized by the processing circuits. Second embodiment

[0067] The second embodiment differs from the first embodiment in that, even for operation data 31 for which the attack probability 34 is lower than the threshold A, the influence relationship between objects is added to the relationship data 51 when it is decided that the attack probability 34 is higher than a criterion based on the relationship with other operation data 31. In the second embodiment, this other part is described, and the description for the same parts is omitted. ***Description of how it works***

[0068] The operation of the attack analysis device 10 according to the second embodiment will be explained with reference to Fig. 8 and Fig. 9 described.

[0069] The operation flow of the attack analysis device 10 according to the second embodiment corresponds to an attack analysis method according to the second embodiment. Furthermore, a program for implementing the operation of the attack analysis device 10 according to the second embodiment corresponds to an attack analysis program according to the second embodiment.

[0070] A description will be given of a relationship construction process after describing data and the like used in the relationship construction process. The specification process is the same as in the first embodiment.

[0071] The history data 61 according to the second embodiment will be described with reference to Fig. 8 described.

[0072] The history data 61 is operation data 31 for which the attack probability 34 is smaller than the threshold A and which includes the influence source object 32 among the operation data 31 entered in the past.

[0073] The historical data 61 includes an influence source object 62, an influence target object 63 and time information 64.

[0074] The influence source object 62 is an influence source object 32 in the operation data 31 on which the history data 61 is based. The influence target object 63 is an influence target object 33 in the operation data 31 on which the history data 61 is based. The time information 64 indicates a time at which an operation represented by the operation data 31, on which the history data 61 is based, is performed.

[0075] The relationship construction process according to the second embodiment will be explained with reference to Fig. 9 described.

[0076] The process of step S31 is the same as that of step S11 in Fig. 5. The process from step S33 to step S35 is the same as that from step S12 to step S14 in Fig. 5. The process of step S39 is the same as that of step S15 in Fig. 5.

[0077] However, in step S34, if the operation data 31 includes the influence source object 32 and the attack probability 34 is equal to or higher than the threshold A, the relationship construction unit 22 proceeds to step S35. In other cases, the relationship construction unit 22 proceeds to step S36. (Step S32: Initialization process of the history data)

[0078] The relationship construction unit 22 initializes the history data 61 as empty. That is, the relationship construction unit 22 establishes the history data 61 in a state that contains no data. (Step S36: Second data addition process)

[0079] The relationship construction unit 22 extracts past data that has been judged to have an attack probability 34 higher than the criterion based on the relationship with the newly acquired operation data 31 in step S33, among the past data that is the operation data 31 included in the history data 61. It is assumed that the relationship construction unit 22 judges that the attack probability 34 of past data is higher than the criterion in cases (1) and (2) as follows.

[0080] 1) A case where a first condition is met and a second condition is met. The first condition is a condition that the attack probability 34 in the newly acquired operation data 31 is equal to or higher than the threshold A. The second condition is a condition that a difference between an operation tact time of the newly acquired operation data 31 and an operation tact time of the past data is within a reference time. The current time can be regarded as the operation time of the newly acquired operation data 31. The first condition can be omitted.

[0081] 2) A case where the first condition is satisfied and a third condition is satisfied. The first condition is as described above. The third condition is a condition that at least one of the influence source object and the influence target object is identical between the newly acquired operation data 31 and the past data. The third condition is satisfied in either of cases (a) and (b) as follows. (a) The influence source object 32 in the newly acquired operation data 31 coincides with either the influence source object 62 or the influence target object 63 in the past data. (b) The influence target object 33 in the newly acquired operation data 31 coincides with either the influence source object 62 or the influence target object 63 in the past data. The first condition can be omitted.

[0082] The relationship construction unit 22 can decide that the attack probability 34 of the past data is higher than the criterion by using (1) and (2) together. That is, the relationship construction unit 22 can decide that the attack probability 34 of the past data is higher than the criterion in a case where the first condition is satisfied, the second condition is satisfied, and the third condition is satisfied.

[0083] The relationship construction unit 22 adds a relationship between the influence source object 62 and the influence target object 63 in the extracted history data 61 to the relationship data 51. Specifically, the relationship construction unit 22 adds an edge 53 directed from a node 52 corresponding to the influence source object 62 to a node 52 corresponding to the influence target object 63 to the relationship data 51 as direction information, as in the process of step S14 in Fig. 5. (Step S37: Influence source decision process)

[0084] The relationship construction unit 22 decides whether the process data 31 newly acquired in step S33 contains the influence source object 62.

[0085] The relationship construction unit 22 proceeds to step S38 if the influence source object 62 is included. In other cases, the relationship construction unit 22 proceeds to step S39. (Step S38: Gradient addition process)

[0086] The relationship construction unit 22 adds the operation data 31 newly acquired in step S33 to the history data 61.

[0087] Specifically, the relationship construction unit 22 creates a new record in the history data 61. Then, the relationship construction unit 22 writes the influence source object 32 and the influence target object 33 in the process data 31 to the influence source object 62 and the influence target object 63 in the history data 61. The linking unit 22 writes the history takt time of the process data 31 to the takt time information 64 in the history data 61. ***Effect of the second embodiment***

[0088] As described above, the attack analysis apparatus 10 according to the second embodiment adds the influence relationship between objects to the relationship data 51 when it is decided that the attack probability 34 is higher than the criterion based on the relationship with other operation data 31.

[0089] There is also a process where it cannot be determined whether it is an "attack" or "likely an attack" based solely on process data 31. This process can also be considered similar to the "likely an attack" process, and the relationship data 51 can be created based on the presence or absence of relevance to the "attack" or "likely an attack" processes. Third embodiment

[0090] The third embodiment differs from the first embodiment and the second embodiment in that an attack probability 34 is calculated when the operation data 31 does not include an attack probability 34. In the third embodiment, this other part is described, and the description for the same parts is omitted. ***Description of the configuration***

[0091] A configuration of the attack analysis apparatus 10 according to the third embodiment will be described with reference to Fig. 10 described.

[0092] The attack analysis device 10 differs from that in Fig. 1 in that it contains a calculation unit for the probability of attack 24 as a functional component. The function of the calculation unit for the probability of attack 24 is implemented, as with other functional components, by software or a hardware component. ***Description of how it works***

[0093] The operation of the attack analysis device 10 according to the third embodiment will be explained with reference to Fig. 11 and Fig. 12 described.

[0094] The operation flow of the attack analysis device 10 according to the third embodiment corresponds to an attack analysis method according to the third embodiment. Furthermore, a program for implementing the operation of the attack analysis device 10 according to the third embodiment corresponds to an attack analysis program according to the third embodiment.

[0095] The operation of the attack analysis device 10 includes, in addition to the relationship construction process and the specification process, a process for calculating the attack probability. The method for calculating the attack probability will be described after the description of the data and the like used in the method for calculating the attack probability.

[0096] The operation data 31 according to the third embodiment will be described with reference to Fig. 11 described.

[0097] The process data 31 contains the influence source object 32, the influence target object 33 and the attack probability 34 as well as process information 35.

[0098] The operation information 35 represents an operation type and operation content. For example, the operation type is data transfer via socket communication. In this case, a port number, data size, and transfer data are specified as the operation content. Another example is the operation type of writing to a file. In this case, the file path, write size, write position, and write data are included as the operation content.

[0099] The method for calculating the attack probability according to the third embodiment will be explained with reference to Fig. 12 described. (Step S41: Operation data entry process)

[0100] The attack probability calculation unit 24 receives new process data 31 as input. The concrete process is the same as in step S12 of Fig. 5. (Step S42: Data decision process)

[0101] The attack probability calculation unit 24 decides whether the process data 31 accepted in step S41 contains an attack probability 34.

[0102] The attack probability calculation unit 24 proceeds to step S43 if the operation data 31 does not include the attack probability calculation unit 24. In other cases, the attack probability calculation unit 24 proceeds to step S44. (Step S43: Probability calculation process)

[0103] The attack probability calculation unit 24 calculates an attack probability 34 from the operation content specified in the operation information 35 in the operation data 31 acquired in step S41. The attack probability calculation unit 24 adds the calculated attack probability 34 to the operation data 31.

[0104] Specifically, the attack probability calculation unit 24 predetermines an attack probability value 34 for each decision criterion. The decision criterion is determined based on the operation content. The attack probability calculation unit 24 specifies a decision criterion that the operation content in the operation data 31 satisfies. The attack probability calculation unit 24 specifies an attack probability value 34 that corresponds to the specified decision criterion.

[0105] A concrete example of the decision criterion is described.

[0106] The process type is assumed to be data transmission via socket communication. In this case, the following decision criteria are considered. First criterion: There is a possibility that the port number is being used for an attack. Second criterion: The data size differs from that used in normal communication. Third criterion: The content of the transmitted data matches or is similar to the content of known attack data.

[0107] The operation type is assumed to be writing files. In this case, a decision criterion is considered as follows. First criterion: Writing is being done to a file that would not be written to in a normal operation. Second criterion: The write size differs from the write size in a normal operation. (Step S44: Output process)

[0108] The attack probability calculation unit 24 outputs the operation data 31 to the relationship construction unit 22. Then, the attack probability calculation unit 24 returns to step S41 and waits for the input of the next operation data 31.

[0109] The relationship construction process and the specification process are the same as in the first and second embodiments. In the process of operation data input (step S12 in Fig. 5 and step S33 in Fig. 9) However, in the relationship construction process, the transaction data 31 output in step S44 is accepted. Effect of the third embodiment

[0110] As described above, the attack analysis device 10 according to the third embodiment calculates the attack probability 34 when the operation data 31 does not include the attack probability 34.

[0111] In this way, it is possible to achieve a similar effect to that in the first and second embodiments even in the case where the attack probability 34 is not set in advance.

[0112] Furthermore, “unit” in the above description may be replaced by “circuit”, “step”, “method”, “process” or “processing circuit”.

[0113] In the above, the embodiments and variants of the present disclosure have been described. Some of these embodiments and variants may be combined and implemented. Otherwise, one or more of these measures may be partially implemented. The present disclosure is not limited to the embodiments and variants described above, and various modifications may be added as needed. List of reference symbols

[0114] 10: Attack analysis device; 11: Processor; 12: Storage unit; 13: Memory unit; 14: Electronic circuit; 21: Data acquisition unit; 22: Relationship construction unit; 23: Specification unit; 24: Attack probability calculation unit; 31: Operation data; 32: Influence source object; 33: Influence target object; 34: Attack probability; 35: Operation information; 41: Threshold; 51: Relationship data; 52: Node; 53: Edge; 61: History data; 62: Influence source object; 63: Influence target object; 64: Cycle time information QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] JP 6987332 B1

[0004]

Claims

[1] Attack analysis device comprising: a data acquisition unit for acquiring operation data including at least one influence target object and an attack probability among an influence source object that is an object that has performed an operation to influence another object, the influence target object that is an object influenced by the operation performed by the influence source object, and the attack probability that represents a probability that the operation is an attack; a relationship construction unit for creating relationship data when the operation data acquired by the data acquisition unit includes the influence source object and the attack probability is equal to or greater than a threshold A by adding a relationship between the influence source object and the influence target object to the relationship data; and a specification unit for specifying at least one of an infected area to be affected by a detected attack and an intrusion route of the detected attack based on the relationship data constructed by the relationship construction unit when the attack is detected. [2] The attack analysis device according to claim 1, wherein the relationship construction unit adds to the relationship data direction information indicating a direction from the influence source object to the influence target object as the relationship between the influence source object and the influence target object, and the specification unit specifies the infected area by using an object in which an event indicating the detected attack is detected as an origin and by tracing a direction indicated by the direction information included in the relationship data in a forward direction. [3] The attack analysis apparatus according to claim 2, wherein the specifying unit specifies the infected area when the operation data is taken as input and the attack probability is equal to or higher than a threshold B which is higher than the threshold A by using the influence target object as the object in which the operation indicating the detected attack is detected. [4] The attack analysis device according to claim 1, wherein the relationship construction unit adds direction information indicating a direction from the influence source object to the influence target object to the relationship data as the relationship between the influence source object and the influence target object, and the specifying unit specifies the intrusion route by using the object in which an operation indicating the detected attack is detected as the origin and by tracing a direction indicated by the direction information included in the relationship data in a backward direction. [5] The attack analysis apparatus according to claim 4, wherein the specifying unit specifies the intrusion route when the operation data is taken as input and the attack probability is equal to or higher than a threshold B which is higher than the threshold A by using the influence target object as the object in which the operation indicating the detected attack is detected. [6] The attack analysis device according to any one of claims 1 to 5, wherein the relationship construction unit adds to the relationship data a relationship between the influence source object and the influence target object in past data in which the attack probability is decided to be higher than a criterion based on a relationship with the newly acquired operation data, among the past data which is the operation data in which the attack probability is lower than the threshold A. [7] The attack analysis device according to claim 6, wherein the relationship construction unit decides that the attack probability of the past data is higher than the criterion when the attack probability in the newly acquired operation data is equal to or higher than the threshold A and a difference between an operation tact time of the newly acquired operation data and an operation tact time of the past data is within a reference time. [8] The attack analysis device according to claim 6 or claim 7, wherein the relationship construction unit decides that the attack probability of the past data is higher than the criterion when the attack probability in the newly acquired operation data is equal to or higher than the threshold A and at least one of the influence source object and the influence target object is identical between the newly acquired operation data and the past data. [9] Attack analysis device according to one of claims 1 to 8, wherein the process data includes process information that specifies a process content, the attack analysis device further comprises an attack probability calculation unit for calculating the attack probability from the operation content specified in the operation information. [10] Attack analysis procedure that includes: by a computer, acquiring operation data including at least one influence target object and an attack probability among an influence source object, which is an object that has performed an operation to influence another object, the influence target object, which is an object influenced by the operation performed by the influence source object, and the attack probability, which is a probability that the operation is an attack; by the computer, creating relationship data when the operation data contains the influence source object and the attack probability is equal to or higher than a threshold A, by adding a relationship between the influence source object and the influence target object to the relationship data; and by the computer, specifying at least one of an infected area to be affected by a detected attack and an intrusion route of the detected attack based on the relationship data when the attack is detected. [11] Attack analysis program that causes a computer to act as an attack analysis device that performs: a data acquisition process for acquiring operation data including at least one influence target object and an attack probability among an influence source object, which is an object that has performed an operation to influence another object, the influence target object, which is an object influenced by the operation performed by the influence source object, and the attack probability, which is a probability that the operation is an attack; a relationship construction process to create relationship data when the operation data acquired by the data acquisition process contains the influence source object and the attack probability is equal to or higher than a threshold A by adding a relationship between the influence source object and the influence target object to the relationship data; and a specification process to specify at least one of an infected area to be affected by a detected attack and an intrusion route of the detected attack based on the relationship data created by the relationship construction process when the attack is detected.

Images