Information processing apparatus and information processing method

Abstract

To evaluate whether a device to be evaluated can detect an attack to equipment without actually attacking the equipment.SOLUTION: An information processing apparatus comprises: a pseudo-trace generation part which generates pseudo-trace information on a second attack based upon trace information on a first attack acquired during the first attack to first equipment on a communication network and information associated with an attacking method of the second attack to second equipment; and a pseudo-trace transmission part which transmits the pseudo-trace information on the second attack to the device to be evaluated which detects the attack based upon the trace information on the attack.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an information processing device and an information processing method. [Background technology]

[0002] There are security devices that detect or block cyber attacks against a system. In order to evaluate the performance of the security devices and the settings at the time of system installation, there is a method of actually attacking the system and having the security devices read the communication data flowing on the network during the attack, or the logs acquired from the host that was the target of the attack. However, actually executing an attack on a system may have a negative effect on the system. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6101525 Summary of the Invention [Problem to be solved by the invention]

[0004] The present embodiment provides an information processing device and an information processing method that enable evaluation of whether an evaluation target device is capable of detecting an attack on a device without actually attacking the device. [Means for solving the problem]

[0005] The information processing device of this embodiment includes a pseudo-trace generation unit that generates pseudo-trace information of a second attack based on trace information of a first attack acquired at the time of a first attack on a first device in a communication network and information regarding the attack method of a second attack on a second device, and a pseudo-trace transmission unit that transmits the pseudo-trace information of the second attack to an evaluation target device that detects the attack based on the trace information of the attack. [Brief description of the drawings]

[0006] [Figure 1] FIG. 1 is a diagram showing an example of a security countermeasure system according to a first embodiment. [Diagram 2] FIG. 1 is a diagram showing an example of the configuration of a monitored system in which an evaluation target device and a security measure evaluation device are incorporated. [Diagram 3] FIG. 2 is a functional block diagram showing a configuration example of a security countermeasure evaluation device. [Figure 4] A diagram showing an example of an attack scenario. [Diagram 5] FIG. 4 is a diagram showing an example of network configuration information. [Figure 6] A figure showing an example of attack trace data stored in an attack trace memory unit. [Figure 7] 7 is a diagram showing an example of trace information in the attack trace data of FIG. 6. [Figure 8] FIG. 13 is a diagram showing an example of pseudo trace information generated from trace information based on parameters. [Figure 9] 11A and 11B are diagrams showing specific examples of trace information and pseudo trace information. [Figure 10] 4 is a flowchart showing an example of a processing procedure of the security countermeasure evaluation device according to the present embodiment. [Figure 11] 11 is a flowchart showing an example of a processing procedure for generating pseudo trace information when the trace information is communication data. [Figure 12] 11 is a flowchart showing an example of a processing procedure for generating pseudo trace information when the trace information is a log. [Figure 13] FIG. 11 is a functional block diagram showing an example of the configuration of a security countermeasure evaluation device according to a second embodiment. [Figure 14] FIG. 11 is a diagram showing an example of evaluation result data. [Figure 15] 10 is a flowchart showing an example of a processing procedure of the security countermeasure evaluation device according to the second embodiment. [Figure 16] 13 is a flowchart showing an example of a processing procedure for generating an evaluation result in Example 1 of the second embodiment. [Figure 17]13 is a flowchart showing an example of a processing procedure for generating an evaluation result in Example 2 of the second embodiment. [Figure 18] 13 is a flowchart illustrating an example of a processing procedure for generating an evaluation result in Example 3 of the second embodiment. [Figure 19] 2 illustrates a hardware configuration of an information processing device according to each embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] Hereinafter, the present embodiment will be described with reference to the drawings.

[0008] (First embodiment) FIG. 1 shows an example of a security countermeasure system according to the first embodiment. The security countermeasure system in FIG. 1 includes a security countermeasure evaluation device 100 and an evaluation target device 200. The security countermeasure evaluation device 100 corresponds to the information processing device according to the present embodiment. The security countermeasure evaluation device 100 evaluates security countermeasures in the monitored system, such as whether the evaluation target device 200, which is responsible for security functions in the monitored system, can detect or block attacks. The monitored system is a communication network including one or more devices. The communication network is, for example, a local area network such as a wireless LAN or Ethernet.

[0009] The evaluation target device 200 may be incorporated as a part of the monitored system, or may be incorporated as software in a device (host) in the monitored system. Alternatively, the evaluation target device 200 may exist separately from the monitored system, in which case the evaluation target device 200 may be directly connected to the security measure evaluation device 100 via a communication cable or the like.

[0010] The evaluation target device 200 is a device that plays a role in executing security functions such as detecting or blocking attacks based on communication data acquired from a communication network or on host logs. The function of detecting or blocking attacks is, for example, a function of detecting abnormal traffic or a function of blocking abnormal traffic. Specific examples of the evaluation target device 200 include a network-based intrusion detection system (IDS: Intrusion Detection System) capable of detecting attacks, a network-based intrusion prevention system (IPS: Intrusion Prevention System) capable of detecting and blocking attacks, and an attack detection tool (log detection tool) as software capable of detecting and blocking attacks.

[0011] FIG. 2 shows an example of the configuration of a monitored system incorporating an evaluation target device 200 and a security countermeasure evaluation device 100. The monitored system is configured as a communication network. In this example, the evaluation target device 200 is a network-type IDS. The system in FIG. 2 is configured as a local area network. In addition to the evaluation target device 200 and the security countermeasure evaluation device 100, two devices (hosts) are placed in the communication network, one of which is a gateway (GW) 11 and the other is an arbitrary device 12. The device 12 may be a PC (Personal Computer), an industrial device, or any other device. For reference, the figure shows a device (attacker device) 31 outside the network that is operated by a malicious person and attacks the communication network in FIG. 2. Consider a case in which the attacker device 31 sends communication data to the communication network for an attack (attack A1), takes over the gateway 11, and uses the gateway 11 as a springboard to attack the device 12 (attack A2). If the evaluation target device 200 has a correct security setting (security countermeasure), the evaluation target device 200 can acquire communication data flowing through the communication network at the time of an attack, and detect an attack from the attacker device 31 from the acquired communication data. The communication data may be acquired using packet capture software or the like. In this embodiment, assuming that such an attack has occurred, the security countermeasure evaluation device 100 realizes a prior evaluation of whether or not the attack can be detected or blocked without actually attacking the communication network (attacking the GW 11 and the device 12). When performing the evaluation, the devices to be monitored (the GW 11 and the device 12 in the example of FIG. 2) may or may not actually be placed in the communication network.

[0012] Specifically, the security countermeasure evaluation device 100 generates pseudo communication data or pseudo log (pseudo trace information, described later) assuming that an attack has occurred based on one or more attack scenarios, transmits it to the evaluation target device 200, and causes the evaluation target device 200 to perform an attack detection operation using the pseudo communication data or the pseudo log. One of the major features of this embodiment lies in the method of generating such pseudo communication data or pseudo log (pseudo trace information).

[0013] FIG. 3 is a functional block diagram showing an example of the configuration of the security countermeasure evaluation device 100. As shown in FIG. The security countermeasure evaluation device 100 includes an analysis unit 110 , an attack scenario storage unit 120 , an attack trace storage unit 130 , a pseudo trace generation unit 140 , and a pseudo trace transmission unit 150 .

[0014] The analysis unit 110 acquires an attack scenario 300 (see FIG. 4 described later) and network configuration information 500 (see FIG. 5 described later). The attack scenario 300 may be acquired by the analysis unit 110, for example, generated by another device based on system configuration information or vulnerability information of the monitored system. Alternatively, the analysis unit 110 may acquire an attack scenario 300 input by a user from an operation device. The attack scenario 300 may be single or multiple. The analysis unit 110 may acquire the network configuration information 500 from the user via the operation device, or may acquire it from a device that manages network configuration information.

[0015] 4 shows an example of an attack scenario 300. The attack scenario 300 includes a plurality of attack data 310 to 330. The attack data 310 includes an attack order 311 and an attack method 410. The attack method 410 includes information related to the attack method, and more specifically, includes attack identification information 312 and one or more parameters 313a, 313b, etc. When the parameters 313a, 313b, etc. are described without any particular distinction, they are collectively referred to as parameters 313.

[0016] Other attack data 320, 330, etc. have the same configuration as the attack data 310. That is, the attack data 320 includes an attack order 321 and an attack method 420. The attack method 420 includes an attack identification information 322 and one or more parameters 323a, 323b, etc. When the parameters 323a, 323b, etc. are described without any particular distinction, they are collectively referred to as parameters 323. The attack data 330 includes an attack order 331 and an attack method 430. The attack method 430 includes an attack identification information 332 and one or more parameters 333a, 333b, etc. When the parameters 333a, 333b, etc. are described without any particular distinction, they are collectively referred to as parameters 333.

[0017] The attack orders 311 to 331 are information for determining the procedure of attacks according to the attack scenario 300. For example, when the attack A1 in Fig. 2 is simulated using the attack data 310 and the attack A2 is simulated using the attack data 320, the attack order 311 indicates "1" and the attack order 321 indicates "2".

[0018] The attack identification information 312 to 332 is information capable of identifying the contents of an attack. It may be identification information for identifying an attack module implemented in a penetration test tool, or identification information for identifying a penetration test script. Or it may simply be an ID for identifying multiple pieces of attack data from each other.

[0019] The parameters 313 to 333 are information that needs to be specified to execute an attack, and are parameters that are specified when an attack is made. The parameters may include, for example, all or at least one of an IP address, a port number, a user name, a password, and a type of an attack target. For example, when generating one or more packets used when attacking the GW11 from the attacker device 31 in FIG. 2 based on the attack data 310 as pseudo communication data (pseudo trace information to be described later), the parameters 313 to 333 that specify the source IP address of the device 31 and the destination address of the GW11, etc., are used. When an attack is performed in multiple phases (for example, attacking the GW11 in the first phase and attacking the device 12 in the next phase), the attack data 310 to 330 may correspond to each of the multiple phases. In this case, the parameters 313 to 333 are used corresponding to each of the multiple phases. In the example of FIG. 4, the attack data includes multiple parameters, but the number of parameters may be one. There may also be a configuration in which the attack data does not include parameters. For example, instead of parameters, a function (program) that rewrites trace information, described later, to generate pseudo trace information may be stored.

[0020] Fig. 5 shows an example of network configuration information 500. As shown in Fig. 5, the network configuration information 500 includes one or more pieces of host information 510-530. The host information 510-530 is information relating to one or more devices or apparatuses present in the communication network. For example, in the case of the network in Fig. 2, the GW 11, the device 12, the IDS 200, and the security measure evaluation device 100 may each be included as host information. The configuration of the communication network can be specified by a collection of these pieces of host information.

[0021] More specifically, the host information 510 includes a host name 511 and one or more network parameters 512. The network parameters 512 are information about a network to which the host of the host information 510 is connected. The network parameters 512 include one or more pieces of information, such as an IP address 512a of the host. An example of information other than an IP address is a MAC address.

[0022] Other host information 520, 530, etc. have the same configuration as host information 510. That is, host information 520 includes a host name 521 and one or more network parameters 522. Network parameters 522 include one or more pieces of information such as a host's IP address 522a. Host information 530 includes a host name 531 and one or more network parameters 532. Network parameters 532 include one or more pieces of information such as a host's IP address 532a.

[0023] The attack scenario storage unit 120 stores the attack scenario 300 and the network configuration information 500 acquired by the analysis unit 110.

[0024] The attack scenario storage unit 120 may also use the network configuration information 500 to determine whether the evaluation target device 200 is capable of monitoring an attack indicated in the attack data 310 or the like, and store information on the result of the determination. Being capable of monitoring an attack means that the evaluation target device 200 is capable of acquiring communication data flowing through the communication network at the time of the attack, or is capable of acquiring a log on its own device. For example, if the evaluation target device 200 is a network-type IDS and is capable of acquiring communication data of the device to be monitored flowing through the communication network at the time of the attack, the evaluation target device 200 is capable of monitoring an attack.

[0025] The attack trace storage unit 130 stores trace data of a plurality of attacks (attack trace data) corresponding to the attack identification information 312 to 332. The attack trace data is, for example, data of attacks that have actually been carried out against a communication network in the past. The former attacks may be experimental attacks. It may also be data of virtual attacks created assuming actual attacks. The attacks against the communication network may be either successful or unsuccessful, or may be both. The devices that have been targeted by the attack according to the attack trace data may or may not be currently present in the communication network.

[0026] FIG. 6 shows an example of attack trace data stored in the attack trace storage unit 130. The attack trace storage unit 130 includes a plurality of attack trace data 610-630.

[0027] The attack trace data 610 includes attack identification information 611 and one or more trace information 612 (612a, 612b, ...). The attack trace data 610 corresponds to the attack data 310 in FIG. 4, and the attack identification information 611 includes the same value as the attack identification information 312 of the attack data in FIG. 4. The attack scenario 300 may be created by referring to the attack trace data 610 after the attack trace data 610 in FIG. 6 is acquired. The trace information 612 is information generated during an attack, and is, for example, communication data flowing through a communication network (communication data when the attack is successful or communication data when the attack fails), or a log remaining on a host. The communication data is acquired by a capture device or capture software installed in the communication network. The data format of the trace information 612 may be any format, for example, PCAP format or TXT format. The trace information 612 (612a, 612b, . . . ) corresponds to the parameters 313 (313a, 313b, . . . ) in FIG. 4, and pseudo trace information is generated by rewriting the trace information 612a, 612b with the parameters 313a, 313b, as described below.

[0028] Other attack trace data 620, 630, etc. have the same configuration as the attack trace data 610. That is, the attack trace data 620 includes attack identification information 621 and one or more pieces of trace information 622 (622a, 622b,...). The attack trace data 630 includes attack identification information 631 and one or more pieces of trace information 632 (632a, 632b,...).

[0029] Fig. 7 shows an example of trace information 612a from among the multiple pieces of trace information 612 (612a, 612b, ...) in the attack trace data 610 of Fig. 6. In this example, the trace information 612a is communication data that flowed in the communication network at the time of the attack. More specifically, the trace information 612a includes multiple packets 710-730.

[0030] The packet 710 includes time information 711, a header 712, and data 713. The header 712 includes a plurality of pieces of information such as a source IP address 712a and a destination IP address 712b. The data 713 is the main body of the communication data. The other packets 720 and 730 have the same configuration as the packet 710. That is, the packet 720 includes time information 721, a header 722, and data 723. The header 722 includes a plurality of pieces of information such as a source IP address 722a and a destination IP address 722b. The packet 730 includes time information 731, a header 732, and data 733. The header 732 includes a plurality of pieces of information such as a source IP address 732a and a destination IP address 732b.

[0031] The pseudo trace generation unit 140 sequentially selects attack data from the attack scenario storage unit 120, selects attack trace data corresponding to the selected attack data (attack trace data with matching attack identification information) from the attack trace storage unit 130, and generates pseudo trace data. More specifically, for example, if the attack data 310 and the attack trace data 610 are selected, the trace information 612a in the attack trace data 610 is rewritten based on the parameter 313a of the corresponding attack data 310 to generate pseudo trace information. The pseudo trace information is the trace information 612a rewritten to simulate an actual attack. For example, assuming that an attack according to the parameter 313a is performed, the source IP address and destination IP address in the trace information 612a are changed to simulate communication data flowing in an actual attack, thereby generating pseudo trace information. However, if the attack trace data 610 is a trace obtained by an attack on the same device as the attack data 310, the source IP address and source IP address in the trace information 612a will match the parameters 313a.

[0032] FIG. 8 shows an example of pseudo trace information 612a" generated from trace information 612a based on parameters 313a. Time information 711-731 in FIG. 7 are changed to the current time and become 711"-731", respectively. Furthermore, headers 712-732 in FIG. 7 are changed based on parameters 313a and become headers 712"-732". Note that headers 712"-732" respectively include source IP addresses 712a"-732a", destination IP addresses 712b"-732b", port numbers, etc. In this example, it is assumed that data 713-733 have the same values ​​as the data in FIG. 7 (data is not rewritten), but data 713-733 may also be rewritten from the data in FIG. 7.

[0033] FIG. 9 shows a specific example of trace information 612a and pseudo trace information 612a". The upper diagram in FIG. 9 shows a specific example of trace information 612a, and the lower diagram shows a specific example of pseudo trace information 612a". The time information, source IP address, and destination IP address have been rewritten. The payload (data) has not been rewritten. Note that in the example shown, packets are sent and received between two devices (for example, an attacking device and an attacked device), so the source IP address and destination IP address are swapped between the packet in the first row and the packet in the second row.

[0034] Similarly, the trace information 612b... in the attack trace data 610 is also modified based on the parameters 313b... of the corresponding attack data to generate pseudo trace information. In this way, the pseudo trace generation unit 140 generates a group of pseudo trace information corresponding to the trace information 612a, 612b...

[0035] In this manner, the pseudo-trace generation unit 140 generates a group of pseudo-trace information for each piece of attack data in an attack scenario by using the corresponding attack trace data.

[0036] The pseudo trace sending unit 150 sends the corresponding pseudo trace information groups to the evaluation target device 200 in order according to the attack orders 311 to 331. When sending the pseudo trace information, one piece of trace information may be sent at a time, or multiple pieces of trace information may be sent at a time. When sending one piece of trace information at a time, the detection result of the evaluation target device 200 can be grasped each time, making evaluation easier. On the other hand, when sending all the trace information groups for each attack data at once, no waiting time is required because the processing of the device 100 can be completed at the time of sending.

[0037] When the simulated trace information is transmitted (read) to the evaluation target device 200, the evaluation target device 200 may be incorporated in a communication network (actual device environment) or may be separated from the communication network. Even when the evaluation target device 200 is incorporated in a communication network, only normal communication data flows in the communication network, and the simulated trace information is transmitted only to the evaluation target device 200, so that other devices in the communication network are not affected. Therefore, it is possible to transmit simulated trace information simulating an attack on the target device to the evaluation target device 200 without actually attacking the target device, and to evaluate whether the attack can be detected. When the evaluation target device 200 is separated from the communication network, evaluation is possible without the effort of actually constructing a simulated environment. In this case, it is of course possible to evaluate whether the evaluation target device 200 can detect an attack without actually attacking the target device.

[0038] [Processing Procedure] FIG. 10 is a flowchart showing an example of a processing procedure of the security countermeasure evaluation device 100 according to this embodiment.

[0039] The analysis unit 110 acquires the attack scenario 300 and the network configuration information 500 (step S11 in FIG. 10). The attack scenario 300 may be in a JSON format or an XML format, for example. The attack scenario 300 may not include the attack order, but may include the attack method for each attack order. The network configuration information 500 may be in a JSON format or an XML format, for example. The network configuration information 500 may be input by a user via an operation device.

[0040] The attack scenario storage unit 120 stores the attack scenario 300 acquired by the analysis unit 110 (step S12 in FIG. 10). At this time, it may store whether or not the attack indicated by each attack data of the attack scenario is an attack that can be monitored by the evaluation target device 200. An example of determining whether or not it can be monitored is as described above.

[0041] The pseudo trace generation unit 140 uses each attack trace data in the attack trace storage unit 130 to generate pseudo trace information corresponding to the corresponding attack data in the attack scenario 300 (step S13 in FIG. 10). The pseudo trace information corresponds to communication data flowing through a communication network or a log generated in a host when an attack is assumed to have been carried out according to the parameters of the attack data.

[0042] The pseudo trace sending unit 150 sends the pseudo trace information generated in step S13 to the evaluation target device 200 in accordance with the attack order of the attack data, and causes the evaluation target device 200 to perform a detection operation (step S14 in FIG. 10). The evaluation target device 200 obtains a detection result indicating that an attack is detected or that an attack is not detected. The detection result may take various forms, such as being stored as a log in the evaluation target device 200 or being output as an alert. The user may read out the log of the detection result of the evaluation target device 200 on the operation device and display it on the screen.

[0043] [Method of generating pseudo trace information when the trace information is communication data] Fig. 11 is a flowchart showing an example of a processing procedure for generating pseudo trace information in the pseudo trace generating unit 140 based on the attack data 310 included in the attack scenario 300 when the trace information is communication data. The processing in Fig. 11 may be performed when the attack indicated by each attack data of the attack scenario is an attack that can be monitored by the evaluation target device 200, and the trace information is communication data. Here, an example of a processing procedure for the attack data 310 included in the attack scenario 300 is shown, but the same applies to the attack data 320 and the attack data 330.

[0044] First, the pseudo-trace generator 140 acquires the attack technique 410 included in the attack data 310 (step S21 in FIG. 11).

[0045] Next, the pseudo trace generation unit 140 acquires communication data that is trace information corresponding to the attack identification information 312 included in the attack method 410 from the attack trace storage unit 130 (step S22 in FIG. 11).

[0046] Next, the pseudo trace generation unit 140 converts parameters such as the source IP address and destination IP address of packets included in the communication data (trace information) based on the parameters 313 included in the attack method 410 (step S23 in FIG. 11). If the communication data (trace information) includes multiple packets, the parameters such as the source IP address and destination IP address of all packets are converted based on the parameters 313. The conversion may be performed, for example, by creating an IP address correspondence table based on the parameters 313 and packets included in the communication data, and according to the correspondence table.

[0047] Next, the pseudo trace generation unit 140 shifts the time information of the packets included in the communication data (trace information) to the current time (step S24 in FIG. 11). If the communication data (trace information) includes multiple packets, the time information of all the packets is shifted to the current time.

[0048] Through the above process, communication data simulating communication data generated during an attack can be generated as pseudo trace information.

[0049] [How to generate pseudo trace information when the trace information is a log] Fig. 12 is a flowchart showing an example of a processing procedure for the pseudo-trace generating unit 140 to generate pseudo-trace information based on the attack data 310 included in the attack scenario 300 when the trace information is a log. The processing in Fig. 12 may be performed when the attack of each attack data of the attack scenario is not an attack that can be network-monitored by the evaluation target device 200, and the trace information is a log. Here, an example of a processing procedure for the attack data 310 included in the attack scenario 300 is shown, but the same applies to the attack data 320 and the attack data 330.

[0050] First, the pseudo-trace generator 140 acquires the attack technique 410 included in the attack data 310 (step S51 in FIG. 12). Next, the pseudo trace generation unit 140 acquires a log (host log) which is trace information corresponding to the attack identification information 312 included in the attack method 410 from the attack trace storage unit 130 (step S52 in FIG. 12). There may be one log or multiple logs. In addition, the log may be a log when an attack attempt is successful, or may be a log when an attack attempt is unsuccessful.

[0051] Next, the pseudo-trace generation unit 140 converts the parameters included in the host log based on the parameters 313 included in the attack method 410 (step S53 in FIG. 10). The parameters to be converted may be information for identifying the host, such as at least one of an IP address and a MAC address.

[0052] Next, the pseudo-trace generation unit 140 shifts the time information included in the log to the current time (step S54 in FIG. 10). If there are multiple logs, the time information of all the logs is shifted to the current time.

[0053] By the above process, a host log that simulates a host log generated during an attack can be generated as pseudo trace information.

[0054] [Example of the first embodiment] The evaluation target device 200 is a network-based IDS (hereinafter NIDS) or a network-based IPS (hereinafter NIPS). Based on the communication data when the attack is successful or when the attack is unsuccessful and the attack scenario, communication data is generated as pseudo trace information and transmitted to the NIDS or NIPS. That is, the pseudo trace generation unit 140 generates pseudo communication data (pseudo trace information) based on the attack data included in the attack scenario 300. Then, the pseudo trace transmission unit 150 reads the pseudo communication data (pseudo trace information) into the evaluation target device 200 (NIDS or NIPS). By manually analyzing the log or alert generated by the NIDS or NIPS when the pseudo communication data is read, it is evaluated whether the NIDS detects the attack or whether the NIPS detects and blocks the attack. This makes it possible to evaluate whether the installation location and settings of the NIDS or NIPS, or the attack detection method, are appropriate.

[0055] As described above, according to this embodiment, by generating pseudo trace information that simulates communication data in a hypothetical case where an attack has occurred, it is possible to evaluate whether the settings of the evaluation target device are appropriate without actually attacking the monitored system (communication network). That is, pseudo trace information that occurs when an attack is made according to an attack scenario based on attack trace data acquired in advance is generated, and the pseudo trace information is read into the evaluation target device. This makes it possible to evaluate whether the security measures of the monitored system are functioning properly without actually attacking the monitored system.

[0056] Second embodiment Fig. 13 is a block diagram showing the functional configuration of a security countermeasure evaluation device 100A according to the second embodiment. Blocks that are the same as those in the functional block diagram of Fig. 1 showing the configuration of the security countermeasure evaluation device 100 according to the first embodiment are given the same reference numerals, and detailed explanations will be omitted.

[0057] The security countermeasure evaluation device 100A includes an analysis unit 110, an attack scenario storage unit 120, an attack trace storage unit 130, a pseudo trace generation unit 140, a pseudo trace transmission unit 150, a function evaluation unit (evaluation unit) 160, an evaluation result storage unit 170, and an evaluation result output unit 180. The function evaluation unit 160, the evaluation result storage unit 170, and the evaluation result output unit 180 are added to the security countermeasure evaluation device of the first embodiment.

[0058] The function evaluation unit 160 receives output information based on the result of the detection operation of the evaluation target device 200, evaluates whether an attack has been detected or blocked based on the output information, and creates evaluation result data 800. The output information may be a log of an application for intrusion detection (attack detection) running on an IDS, or a log of an application for intrusion blocking (attack blocking) running on an IPS. Alternatively, when the evaluation target device 200 is configured as attack detection tool software installed on a host, the output information may be a log of the operation of the attack detection tool remaining on the host.

[0059] 14 shows an example of evaluation result data 800. The evaluation result data 800 includes a plurality of evaluation results 810 to 830. The evaluation results 810 to 830 correspond to the attack data 310 to 330 of the attack scenario 300 in FIG.

[0060] The evaluation result 810 includes the attack identification information 312 (see FIG. 4), output information 811, and an analysis result 812.

[0061] The output information 811 is information output from the evaluation target device 200 that has read a group of pseudo trace information (for example, pseudo trace information 612a”, 612b”,...) transmitted in response to the attack data 310. If the evaluation target device 200 is an IDS or IPS, the output information 811 may be a log of an intrusion detection or intrusion blocking application running in the IDS or IPS. If the evaluation target device 200 is an attack detection tool mounted on a host, the output information 811 may be a log of the operation of the attack detection tool in the host. If the output information 811 is not obtained from the evaluation target device 200, it is not necessary to store the output information 811 in the evaluation result 810.

[0062] The analysis result 812 is a result of evaluation based on the output information 811 as to whether the evaluation target device 200 was able to detect or block an attack, and is generated by the function evaluation unit 160. The analysis result 812 may be data such as a character string indicating that an attack was detected or blocked, or that an attack was not detected or blocked. The function evaluation unit 160 analyzes the output information 811 and includes the analysis result in the evaluation result 810, so that the user can easily understand whether an attack was detected or blocked. If the output information 811 is not acquired from the evaluation target device 200, the function evaluation unit 160 may determine that it is impossible to evaluate the corresponding attack data in the attack scenario.

[0063] The evaluation result storage unit 170 stores the evaluation result data 800 created by the function evaluation unit 160 .

[0064] The evaluation result output unit 180 outputs the evaluation result data 800 stored in the evaluation result storage unit 170. The evaluation result output unit 180 may output a part of the evaluation result data 800. For example, of the multiple evaluation results included in the evaluation result data 800, only the evaluation result indicating that the analysis result 812 could not be detected or blocked may be output. The evaluation result data 800 may be output to a display device (e.g., a console) or may be output (written) to a file. The user can check the contents of the evaluation result data 800 by checking the evaluation result data 800 on the console screen or opening the file on a PC (personal computer) or the like.

[0065] [Processing Procedure] 15 is a flowchart showing an example of the processing procedure of the security countermeasure evaluation device 100A according to the second embodiment. Steps S11 to S14 are the same as the processing procedure of the security countermeasure evaluation device 100 according to the first embodiment, and therefore detailed description thereof will be omitted.

[0066] The function evaluation unit 160 receives and analyzes the output information from the evaluation target device 200 to generate evaluation result data 800 including the evaluation result regarding the attack data of the attack scenario 300 (step S15 in FIG. 15).

[0067] The evaluation result storage unit 170 stores the evaluation result data 800 generated by the function evaluation unit 160 (step S16 in FIG. 15).

[0068] The evaluation result output unit 180 reads out the evaluation result data 800 from the evaluation result storage unit 170 and outputs it (step S17 in FIG. 15).

[0069] [Example 1 of the second embodiment] If the evaluation target device 200 is a network-based IDS (hereinafter referred to as NIDS), pseudo trace information is generated based on communication data when an attack is successful or when an attack fails, and it is evaluated whether the NIDS detects an attack corresponding to the attack data.

[0070] In this embodiment, the pseudo-trace generation unit 140 generates pseudo communication data (pseudo-trace information) based on the attack data and the attack trace data of the attack scenario 300, and the pseudo-trace transmission unit 150 reads the pseudo-trace information into the NIDS according to the attack order. The function evaluation unit 160 acquires a log (output information) of the detection operation results from the NIDS.

[0071] 16 is a flowchart showing an example of a processing procedure for generating an evaluation result 810 in the function evaluation unit 160 according to Example 1 of the second embodiment. Here, an example of a processing procedure for generating the evaluation result 810 is shown, but the same applies to the evaluation result 820 and the evaluation result 830.

[0072] First, the function evaluation unit 160 judges whether an attack based on the attack data 310 can be monitored by the NIDS (step S31 in FIG. 16). More specifically, it judges whether an attack identified by the attack identification information 312 can be monitored by the NIDS. For example, it judges whether the subnet in which the NIDS is located is the same as the subnet of the device (monitored device) specified from the parameters of the attack data, based on the parameters of the attack data. If they are different, the NIDS may judge that monitoring is impossible because it cannot receive packets flowing through the subnetwork to be monitored. If monitoring is impossible, the analysis result 812 is set to information indicating that monitoring is impossible (for example, "monitoring impossible") (step S33 in FIG. 16). Here, the function evaluation unit 160 judges that monitoring is impossible and generates the analysis result 812, but it may also generate the analysis result 812 by grasping that the evaluation target device 200 could not be monitored from the output information received from the evaluation target device 200.

[0073] If monitoring is possible, the function evaluation unit 160 judges whether the attack has been detected by the NIDS based on the acquired NIDS log or alert (step S32 in FIG. 16). If it is judged that the attack has been detected, the function evaluation unit 160 sets the analysis result 812 to information indicating that it has been detected (e.g., "detected") (step S34 in FIG. 16). For example, the function evaluation unit 160 may judge that the attack has been detected if a specific character string is included in the log or alert. The function evaluation unit 160 generates an evaluation result 810 including the analysis result 812, the attack identification information 312, and the output information 811.

[0074] If it is determined that the attack has not been detected, the function evaluation unit 160 sets the analysis result 812 to information indicating that the attack has not been detected (e.g., "not detected") (step S35 in FIG. 16). For example, the function evaluation unit 160 may determine that the attack has not been detected if a specific character string is included in a log or an alert. Alternatively, the function evaluation unit 160 may determine that the attack has not been detected if no log or alert is obtained. The function evaluation unit 160 generates an evaluation result 810 including the analysis result 812, the attack identification information 312, and the output information 811.

[0075] [Example 2 of the second embodiment] In Example 1 of the second embodiment, it is assumed that the evaluation target device 200 is a network-type IDS, but a network-type IDS can only detect attacks and cannot block them. In this example, a case will be described in which the evaluation target device 200 is a network-type IPS (hereinafter referred to as NIPS) that can detect and block attacks.

[0076] 17 is a flowchart showing an example of a processing procedure for acquiring an analysis result 812 from output information 811 and generating an evaluation result 810 in the function evaluation unit 160 according to the second embodiment. Here, an example of a processing procedure for generating the evaluation result 810 is shown, but the same applies to the evaluation result 820 and the evaluation result 830.

[0077] First, the function evaluation unit 160 judges whether an attack based on the attack data 310 can be monitored by NIPS (step S41 in FIG. 17). More specifically, it judges whether an attack identified by the attack identification information 312 can be monitored by NIPS. Whether or not monitoring is possible may be the same as in the above-mentioned embodiment 1. If monitoring is not possible, the analysis result 812 is set to information indicating that monitoring is not possible (for example, "monitoring not possible") (step S43 in FIG. 17).

[0078] If the attack can be monitored, the function evaluation unit 160 determines whether the attack has been detected based on the acquired NIPS log or alert (step S42 in FIG. 17). If it is determined that the attack has not been detected, the function evaluation unit 160 sets the analysis result 812 to information indicating that the attack has not been detected (e.g., "not detected") (step S45 in FIG. 17). The function evaluation unit 160 generates an evaluation result 810 including the analysis result 812, the attack identification information 312, and the output information 811.

[0079] If it is determined that the attack has been detected, the function evaluation unit 160 determines whether the attack has been blocked based on the log or alert of NIPS (step S44 in FIG. 17). If it is determined that the attack has been blocked, the function evaluation unit 160 sets the analysis result 812 to information indicating that the attack has been blocked (e.g., "blocked") (step S46 in FIG. 17). If it is determined that the attack has not been blocked, the function evaluation unit 160 sets the analysis result 812 to information indicating that the attack has not been blocked (e.g., "not blocked") (step S47 in FIG. 17). For example, the function evaluation unit 160 may determine that the attack has been blocked or not blocked when a specific character string is included in the log or alert. The function evaluation unit 160 generates an evaluation result 810 including the analysis result 812, the attack identification information 312, and the output information 811.

[0080] [Example 3 of the second embodiment] In Example 1 of the second embodiment and Example 2 of the second embodiment, the evaluation target device 200 is a network-type IDS or a network-type IPS, and communication data is used as the pseudo trace information. In this example, the evaluation target device 200 is an attack detection tool (log detection tool) that uses logs, and a case will be described in which logs are used as the pseudo trace information. In the case of a network configuration such as that shown in FIG. 2, for example, the attack detection tool can be mounted on the GW 11 or the device 12.

[0081] In this embodiment, the pseudo-trace generation unit 140 generates a pseudo host log based on the attack data of the attack scenario 300 and the attack trace data. The pseudo-trace transmission unit 150 transmits the host log to the evaluation target device 200 in the attack order, and causes the evaluation target device 200 (attack detection tool) to read the host log. The function evaluation unit 160 acquires output information of the attack detection tool from the evaluation target device 200.

[0082] 18 is a flowchart showing an example of a processing procedure for acquiring an analysis result 812 from output information 811 and generating an evaluation result 810 in the function evaluation unit 160 according to Example 3 of the second embodiment. Although an example of a processing procedure for the evaluation result 810 is shown here, the same applies to the evaluation result 820 and the evaluation result 830.

[0083] First, the function evaluation unit 160 judges whether the attack data 310 can be monitored by an attack detection tool (step S61 in FIG. 18). For example, if the monitoring target identified by the parameters is a host in which an attack detection tool is installed (if it is an offline attack detection tool), it is judged that the attack against the host can be monitored. If the monitoring target identified by the attack identification information or the parameters is a host in which an attack detection tool is not installed, it may be judged that monitoring is impossible. If monitoring is impossible, the analysis result 812 is set to information indicating that the attack cannot be monitored (for example, "unmonitored") (step S63 in FIG. 18).

[0084] If the attack can be monitored, the function evaluation unit 160 determines whether or not an attack has been detected based on the acquired output information of the attack detection tool (step S62 in FIG. 18). If it is determined that an attack has been detected, the function evaluation unit 160 sets the analysis result 812 to information indicating that the attack has been detected (e.g., "detected") (step S64 in FIG. 18). The function evaluation unit 160 generates an evaluation result 810 including the analysis result 812, the attack identification information 312, and the output information 811.

[0085] When it is determined that the attack has not been detected, the function evaluation unit 160 sets the analysis result 812 to information indicating that the attack has not been detected (e.g., "not detected") (step S65 in FIG. 18). For example, the function evaluation unit 160 may determine that the attack has been detected or not detected when a specific character string is included in the output information of the attack detection tool. Whether or not an attack has been detected may be determined manually or according to an arbitrary algorithm. The function evaluation unit 160 generates an evaluation result 810 including the analysis result 812, the attack identification information 312, and the output information 811.

[0086] In the examples 1 to 3 of the second embodiment, the operation examples in which the evaluation target device 200 is a network-based IDS, a network-based IPS, and an attack detection tool have been described, but other examples are also possible. For example, the evaluation target device 200 may be a host-based IDS, a host-based IPS, a firewall, a WAF (Web Application Firewall), or a personal firewall.

[0087] (Hardware configuration) 19 shows a hardware configuration of an information processing device according to each embodiment. The information processing device is configured by a computer device 900. The computer device 900 includes a CPU 901, an input interface 902, a display device 903, a communication device 904, a main storage device 905, and an external storage device 906, which are interconnected by a bus 907.

[0088] A CPU (Central Processing Unit) 901 executes an information processing program, which is a computer program, on a main memory device 905. The information processing program is a program that realizes each of the above-mentioned functional configurations of the information processing device. The information processing program may be realized not as a single program, but as a combination of multiple programs and scripts. Each functional configuration is realized by the CPU 901 executing the information processing program.

[0089] The input interface 902 is a circuit for inputting operation signals from input devices such as a keyboard, a mouse, a touch panel, etc., to the information processing device. The input interface 902 corresponds to the input unit of the information processing device according to each embodiment.

[0090] The display device 903 displays data output from the information processing device. The display device 903 is, for example, but not limited to, an LCD (liquid crystal display), an organic electroluminescence display, a CRT (cathode ray tube), or a PDP (plasma display). Data output from the computer device 900 can be displayed on this display device 903. The display device 903 corresponds to the output unit of the information processing device according to each embodiment.

[0091] The communication device 904 is a circuit for the information processing device to communicate with an external device wirelessly or via wire. Data can be input from the external device via the communication device 904. The data input from the external device can be stored in the main memory device 905 or the external memory device 906.

[0092] The main memory device 905 stores an information processing program, data required for executing the information processing program, data generated by executing the information processing program, etc. The information processing program is expanded and executed on the main memory device 905. The main memory device 905 is, for example, a RAM, a DRAM, or an SRAM, but is not limited to these. Each storage unit or database of the information processing device according to each embodiment may be constructed on the main memory device 905.

[0093] The external storage device 906 stores an information processing program, data required for executing the information processing program, data generated by executing the information processing program, etc. These information processing programs and data are read into the main storage device 905 when the information processing program is executed. The external storage device 906 is, for example, a hard disk, an optical disk, a flash memory, or a magnetic tape, but is not limited to these. Each storage unit or database of the information processing device may be constructed on the external storage device 906.

[0094] The information processing program may be pre-installed in the computer device 900, or may be stored in a storage medium such as a CD-ROM. The information processing program may also be uploaded onto the Internet.

[0095] Furthermore, the information processing device may be configured as a single computer device 900, or may be configured as a system made up of a plurality of computer devices 900 connected to each other.

[0096] The present invention is not limited to the above-described embodiments as they are, and the components can be modified and embodied in the implementation stage without departing from the gist of the invention. Various inventions can be formed by appropriately combining multiple components disclosed in the above-described embodiments. For example, a configuration in which some components are deleted from all the components shown in each embodiment can also be considered. Furthermore, the components described in different embodiments can be appropriately combined.

[0097] This embodiment can also be configured as follows. [Item 1] a pseudo trace generation unit that generates pseudo trace information of a second attack based on trace information of a first attack acquired at the time of a first attack on a first device in a communication network and information on an attack method of a second attack on a second device; a pseudo-trace sending unit that sends pseudo-trace information of the second attack to an evaluation target device that detects the attack based on the attack trace information; An information processing device comprising: [Item 2] the information on the attack technique of the second attack includes parameters on the second attack; The pseudo-trace generation unit rewrites trace information of the first attack based on the parameter to generate pseudo-trace information of the second attack. Item 1. An information processing device according to item 1. [Item 3] The second device is a device different from or the same as the first device, the trace information of the first attack includes information about the first device; The parameters include information about the second device; the pseudo trace generation unit generates pseudo trace information of the second attack by rewriting information about the first device included in the trace information of the first attack with information about the second device based on the parameter. Item 3. An information processing device according to item 2. [Item 4] The trace information of the first attack further includes time information of the first attack, The pseudo-trace generating unit further generates pseudo-trace information of the second attack by rewriting time information of the first attack included in the trace information of the first attack with time information of the current time. The information processing device according to claim 3. [Item 5] The information about the first device includes address information of the first device, The parameter includes address information of the second device as information about the second device, The pseudo-trace generation unit rewrites address information of the first device to address information of the second device. 5. The information processing device according to item 3 or 4. [Item 6] the pseudo-indication generation unit selects an attack scenario from a plurality of attack scenarios including information on the attack method and attack identification information identifying the second attack method, and selects attack indication data including attack identification information matching the attack identification information included in the selected attack scenario from a plurality of attack indication data including information on the first attack and attack identification information identifying the first attack method, the pseudo-trace generation unit generates pseudo-trace information of the second attack based on trace information of the first attack included in the selected attack trace data and information on the attack method included in the selected attack scenario. 6. The information processing device according to any one of items 1 to 5. [Item 7] the evaluation target device is a device that acquires communication data flowing through the communication network during an attack, and detects or blocks the attack based on the acquired communication data; The trace information of the first attack is communication data that flows through the communication network and is acquired from the communication network at the time of the first attack. 7. The information processing device according to any one of items 1 to 6. [Item 8] the trace information of the first attack is a log of an operation acquired by the first device at the time of the first attack; the evaluation target device is a device that detects the attack based on an operation log acquired in the device that is the target of the attack at the time of the attack as the trace information of the attack; 8. The information processing device according to any one of items 1 to 7. [Item 9] an evaluation unit that receives output information indicating a result of the detection of the second attack based on the pseudo trace information of the second attack from the evaluation target device, and generates an analysis result indicating whether or not the second attack has been detected in the evaluation target device based on the output information; 9. The information processing device according to any one of items 1 to 8, comprising: [Item 10] the pseudo-indication generation unit selects an attack scenario from a plurality of attack scenarios including parameters related to the second attack and attack identification information identifying a method of the second attack, and selects attack indication data including attack identification information matching the attack identification information included in the selected attack scenario from a plurality of attack indication data including the indicator information of the first attack and attack identification information identifying the method of the first attack, the pseudo-indication generation unit generates pseudo-indication information of the second attack based on the indication information of the first attack included in the selected attack indication data and the parameters included in the attack scenario; The evaluation unit identifies the attack identification information included in the attack scenario that was the source of generating the pseudo trace information of the second attack, the evaluation unit generates an evaluation result including the analysis result, the output information, and the identified attack identification information, and outputs the evaluation result. Item 10. The information processing device according to item 9. [Item 11] The trace information of the first attack is trace information acquired when the first attack is successful. 11. The information processing device according to any one of items 1 to 10. [Item 12] The trace information of the first attack is trace information obtained when the first attack fails. 12. The information processing device according to any one of items 1 to 11. [Item 13] generating pseudo trace information of the second attack based on trace information of the first attack acquired at the time of the first attack on the first device in the communication network and information on an attack method of the second attack on the second device; The pseudo trace information of the second attack is transmitted to an evaluation target device that detects the attack based on the trace information of the attack. A computer implemented information processing method. [Explanation of symbols]

[0098] 11: Gateway (GW) 12:Equipment 31: Attacker's device 100: Security measures evaluation device (information processing device) 100A: Security measures evaluation device (information processing device) 110: Analysis Department 120: Attack scenario memory section 130: Attack trace memory unit 140: Pseudo-trace generation unit 150: Pseudo-trace transmission unit 160: Functional evaluation section (evaluation section) 170: Evaluation result storage unit 180: Evaluation result output unit 200: Evaluation target device 300: Attack Scenario 310: Attack Data 311: Attack Order 312: Attack Identification Information 313: Parameter 313a:Parameters 313b:Parameter 320: Attack Data 321: Attack Order 322: Attack Identification Information 323: Parameter 323a:Parameters 330: Attack Data 331: Attack Order 332: Attack Identification Information 333: Parameter 333a:Parameters 410: Attack Method 420: Attack Method 430: Attack Method 500: Network configuration information 510: Host information 511: Host name 512: Network parameters 512a:IP address 520: Host information 521: Host name 522: Network parameters 522a IP address 530: Host information 531: Host name 532: Network parameters 532a:IP address 610: Attack trace data 611: Attack Identification Information 612:Trace information 612a: Trace information 612a”: Pseudo-trace information 612b:Trace information 620: Attack trace data 621: Attack Identification Information 630: Attack trace data 631: Attack Identification Information 710, 710”: Packet 711, 711”: Time information 712, 712”: Header 712a, 712a”: Source IP address 712b, 712b”: Destination IP address 713: Data 720, 720”: Packet 721, 721”: Time information 722, 722”: Header 722a, 722a”: Source IP address 722b, 722b”: Destination IP address 723: Data 730, 730”: Packet 731, 731”: Time information 732”: Header 732a, 732a”: Source IP address 732b, 732b”: Destination IP address 733: Data 800: Evaluation result data 810: Evaluation results 811: Output information 812:Analysis results 820: Evaluation results 830: Evaluation results 900: Computer equipment 902: Input interface 903:Display device 904: Communication equipment 905: Main memory 906: External storage device 907: Bus A1: Attack A2: Attack

Claims

1. a pseudo trace generation unit that generates pseudo trace information of a second attack based on trace information of a first attack acquired at the time of a first attack on a first device in a communication network and information on an attack method of a second attack on a second device; a pseudo-trace sending unit that sends pseudo-trace information of the second attack to an evaluation target device that detects the attack based on the attack trace information; An information processing device comprising:

2. the information on the attack method of the second attack includes parameters on the second attack; The pseudo-trace generation unit rewrites trace information of the first attack based on the parameter to generate pseudo-trace information of the second attack. The information processing device according to claim 1 .

3. The second device is a device different from or the same as the first device, the trace information of the first attack includes information about the first device; The parameters include information about the second device, the pseudo-trace generation unit rewrites information about the first device included in the trace information about the first attack with information about the second device based on the parameter, thereby generating pseudo-trace information about the second attack. The information processing device according to claim 2 .

4. The trace information of the first attack further includes time information of the first attack, The pseudo-trace generating unit further generates pseudo-trace information of the second attack by rewriting time information of the first attack included in the trace information of the first attack to time information of the current time. The information processing device according to claim 3 .

5. The information about the first device includes address information of the first device, The parameter includes address information of the second device as information about the second device, The pseudo-trace generation unit rewrites address information of the first device to address information of the second device. The information processing device according to claim 3 .

6. the pseudo-indication generation unit selects the attack scenario from a plurality of attack scenarios including information on the attack method and attack identification information identifying the second attack method, and selects attack indication data including attack identification information matching the attack identification information included in the selected attack scenario from a plurality of attack indication data including the information on the first attack and attack identification information identifying the first attack method, the pseudo-trace generation unit generates pseudo-trace information of the second attack based on trace information of the first attack included in the selected attack trace data and information on the attack method included in the selected attack scenario. The information processing device according to claim 1 .

7. the evaluation target device is a device that acquires communication data flowing through the communication network during an attack, and detects or blocks the attack based on the acquired communication data; The trace information of the first attack is communication data that flows through the communication network at the time of the first attack and is acquired from the communication network. The information processing device according to claim 1 .

8. the trace information of the first attack is a log of an operation acquired by the first device at the time of the first attack, the evaluation target device is a device that detects the attack based on an operation log acquired in the device that is the target of the attack at the time of the attack as the trace information of the attack; The information processing device according to claim 1 .

9. an evaluation unit that receives output information indicating a result of the detection of the second attack based on the pseudo trace information of the second attack from the evaluation target device, and generates an analysis result indicating whether or not the second attack has been detected in the evaluation target device based on the output information; The information processing device according to claim 1 .

10. the pseudo-indication generation unit selects an attack scenario from a plurality of attack scenarios including parameters related to the second attack and attack identification information identifying a method of the second attack, and selects attack indication data including attack identification information matching the attack identification information included in the selected attack scenario from a plurality of attack indication data including the indicator information of the first attack and attack identification information identifying the method of the first attack, the pseudo-trace generation unit generates pseudo-trace information of the second attack based on trace information of the first attack included in the selected attack trace data and the parameters included in the attack scenario; The evaluation unit identifies the attack identification information included in the attack scenario that was the source of generating the pseudo trace information of the second attack, the evaluation unit generates an evaluation result including the analysis result, the output information, and the identified attack identification information, and outputs the evaluation result. The information processing device according to claim 9.

11. The trace information of the first attack is trace information acquired when the first attack is successful. The information processing device according to claim 1 .

12. The trace information of the first attack is trace information acquired when the first attack fails. The information processing device according to claim 1 .

13. generating pseudo trace information of the second attack based on trace information of the first attack acquired at the time of the first attack on the first device in the communication network and information on an attack method of the second attack on the second device; The pseudo trace information of the second attack is transmitted to an evaluation target device that detects the attack based on the trace information of the attack. A computer implemented information processing method.

Images