Incident event cause identifying system and incident event cause identifying method

Abstract

To make it possible to efficiently identify causes of an incident.SOLUTION: An incident event cause identifying system includes: a device log information holding part 32 holding log information on an object device; a causal relation graph holding part 31 holding a causal relation graph associating an incident event with its causal relation; an incident detection processing part detecting an incident in the object device; a necessary log information determination processing part 23 which extracts a causal relation graph of a corresponding type with respect to the incident event detected by the incident detection processing part, and determines device log information necessary for identifying a cause on the basis of the extracted causal relation graph; a necessary log information collection processing part 24 collecting device log information determined by the necessary log information determination processing part 23; and a cause analysis processing part 25 identifying a cause of the incident event by using the device log information collected by the necessary log information collection processing part 24 and the causal relation graph.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an incident event cause identification system and an incident event cause identification method. [Background technology]

[0002] In recent years, there have been many cyber attacks on various control systems. When an incident is detected in a control system, it is important to correctly determine whether the incident is the result of a cyber attack or a malfunction of the system itself. In other words, when a Security Operation Center (SOC) that monitors incidents in control systems detects an incident, it must determine whether the detected incident was caused by cyberattacks or machine failure, and escalate the incident to the appropriate department and take appropriate action. In particular, to prevent the damage and impact of cyberattacks from spreading, it is important to correctly determine the cause of the incident from the beginning.

[0003] Patent Document 1 describes a technology that classifies a group of alerts that are expected to occur when an industrial control system comes under a cyber-attack into a series that corresponds to the temporal phase of the cyber-attack and a series that corresponds to the spatial phase of the assets that have been cyber-attacked, stores one or more attack patterns that are obtained as types, and diagnoses whether or not an industrial control system has been subjected to a cyber-attack based on the correspondence between the group of alerts and the attack patterns. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent Publication No. 2022-86181 Summary of the Invention [Problem to be solved by the invention]

[0005] According to the technology described in Patent Document 1, by defining in advance the chain relationships of alerts as attack patterns and fault patterns, it is possible to determine whether an alert is an attack or a fault. However, in real systems, the amount of information that can be monitored by alert monitoring is often small among the information that devices related to the system can output. In other words, in real systems, not only are there systems with many types of alerts, but there are also systems that do not have enough types of alerts to create chain relationships in advance. In addition, logs from devices that are not monitored cannot be used for analysis, and using those logs for analysis relies on the knowledge of the analyst.

[0006] In view of the above, an object of the present invention is to provide an incident event cause identification system and an incident event cause identification method that are capable of efficiently identifying the cause of an incident. [Means for solving the problem]

[0007] In order to solve the above problems, for example, the configurations described in the claims are adopted. The present application includes multiple means for solving the above-mentioned problems. As an example, an incident event cause identification system includes an apparatus log information holding unit that holds log information output by a target apparatus, a causal relationship graph holding unit that holds a causal relationship graph in which an incident event is previously linked to its cause, an incident detection processing unit that detects an incident event in the target apparatus, a necessary log information determination processing unit that extracts a causal relationship graph of a corresponding type for the incident event detected by the incident detection processing unit and determines apparatus log information necessary for cause identification based on the extracted causal relationship graph, a necessary log information collection processing unit that collects the apparatus log information determined by the necessary log information determination processing unit, a cause analysis processing unit that identifies the cause of the incident event using the apparatus log information collected by the necessary log information collection processing unit and the causal relationship graph, and an output unit that outputs the cause of the incident event identified by the cause analysis processing unit. Effect of the Invention

[0008] According to the present invention, it is possible to extract only the information necessary for an alert from the log information available in the device and identify the cause, thereby shortening the time required for information review and optimizing the storage capacity of information, and enabling efficient identification of the cause of an incident. Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0009] [Figure 1] 1 is a diagram illustrating an example of the overall configuration of an incident event cause identification system according to an embodiment of the present invention. [Diagram 2] 1 is a block diagram showing an example of the configuration of a cause analysis device according to an embodiment of the present invention; [Diagram 3] 4 is a flowchart showing an example of the overall processing of a cause analysis device according to an embodiment of the present invention. [Figure 4] 10 is a flowchart illustrating an example of a cause analysis process according to an embodiment of the present invention. [Diagram 5] 11 is a flowchart illustrating an example of a cause possibility score calculation process according to an embodiment of the present invention. [Figure 6] FIG. 2 is a diagram showing a causal relationship graph (example of attack cause) according to an embodiment of the present invention. [Figure 7] FIG. 2 is a diagram showing a causal relationship graph (an example of a fault cause) according to an embodiment of the present invention. [Figure 8] FIG. 11 is a diagram showing an example of a log information table according to an embodiment of the present invention. [Figure 9] FIG. 11 is a diagram showing an example of a causal relationship graph information table according to an embodiment of the present invention. [Figure 10] FIG. 13 is a diagram showing an example of a causal relationship graph setting screen according to an embodiment of the present invention. [Figure 11] FIG. 13 is a diagram showing an example of a cause analysis result display screen according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an incident event cause identification system and an incident event cause identification method according to one embodiment of the present invention (hereinafter referred to as "this embodiment") will be described with reference to the accompanying drawings.

[0011] [Overall configuration of the incident cause identification system] FIG. 1 shows an example of the overall configuration of the incident event cause identification system of this embodiment. The incident event cause identification system of this example is configured by connecting one or more target devices (A device 2a, B device 2b, . . . , N device 2n: N is any integer) to a cause analysis device 1 via a network. The cause analysis device 1 detects the occurrence of an incident in each of the devices 2a to 2n, collects device log information, and analyzes the cause.

[0012] [Configuration of the cause analysis device] FIG. 2 shows an example of the configuration of the cause analysis device 1. The cause analysis device 1 includes a processing unit 20, a storage unit 30, an input / output unit 40, and a communication unit 50. The processing unit 20 includes a causal graph generation processing unit 21, an incident detection processing unit 22, a necessary log information determination processing unit 23, a necessary log information collection processing unit 24, and a cause analysis processing unit 25. Each of these processing units 21 to 25 is configured on a work memory (not shown) included in the processing unit 20 by the processing unit 20 executing, for example, a program held in the processing unit 20 or the storage unit 30, that is, a program that realizes a method for identifying the cause of an incident event. The processing unit 20 is configured, for example, as an arithmetic device (computer) including a CPU (Central Processing Unit) and the like.

[0013] The causal relationship graph generation processing unit 21 performs processing for generating a causal relationship graph for incidents, which is information linking the relationship between incident events and their causes. Specific examples of causal relationship graphs will be described later, but the causal relationship graph is created by classifying detection nodes and cause nodes, which are events indicating attacks and failures, into multiple categories. Examples of classifications here include the possibility of failure occurring related to commands, the possibility of failure occurring related to device state understanding, and the like.

[0014] Causal graphs can be created in advance by analysts or SOC staff monitoring the incidents who input data via an input terminal, or they can be created automatically by reading publicly available information that summarizes the causes of incidents. In addition, each cause node in the created causal graph and its judgment conditions can be changed as needed by SOC staff, essentially as a parameter tuning part. For example, when a new threat is discovered, SOC staff can add or modify detection nodes or cause nodes.

[0015] The causal graph generated by the causal graph generation processing unit 21 is held in a causal graph holding unit 31 of the storage unit 30. The incident detection processing unit 22 detects the occurrence of an incident in a target device (the A device 2a, the B device 2b, . . . , the N device 2n). Information on the detected incident is transmitted to the necessary log information determination processing unit . The necessary log information determination processing unit 23 acquires a causal relationship graph corresponding to the type of the detected incident, and determines the device logs necessary for analysis.

[0016] The necessary log information collection processing unit 24 collects device logs required for incident analysis from the target devices (A device 2a, B device 2b, . . . , N device 2n). The cause analysis processing unit 25 executes a cause analysis process using the causal relationship graph and the device log information.

[0017] The storage unit 30 includes a causal graph storage unit 31 and an apparatus log information storage unit 32 . The causal graph storage unit 31 performs a causal graph storage process for storing the causal graph generated by the causal graph generation processing unit 21 as a causal table. The causal graph is generated in advance and stored in the causal graph storage unit 31. An example of the causal table will be described later with reference to FIG. 9.

[0018] The device log information holding unit 32 performs a device log information holding process in which log information for each target device is classified by type and held as a log information table. For example, the device log information holding unit 32 has an AA log holding unit 33 that holds the AA log of the A device 2a and an AB log holding unit 33 that holds the AB log of the A device 2a. The device log information holding unit 32 has a BA log holding unit 33 that holds the BA log of the B device 2a, and a BB log holding unit 33 that holds the BB log of the A device 2a. The device log information holding unit 32 sequentially collects and holds device log information. An example of the log information table will be described later with reference to FIG. 8.

[0019] The input / output unit 40 performs output processing of the analysis results from the cause analysis processing unit 25. The output processing performed by the input / output unit 40 includes, for example, processing to display the analysis results on a display. The input / output unit 40 also performs input processing of information necessary for analysis. The communication unit 50 communicates between the cause analysis device 1 and the target devices (A device 2a, B device 2b, . . . , N device 2n). The communication unit 50 also performs a process of transmitting the analysis result to other devices.

[0020] [Example of overall processing by the cause analysis device] FIG. 3 is a flowchart showing the flow of processes performed by each unit of the cause analysis device 1. First, the incident detection processing unit 22 detects the occurrence of an incident in a target device, and transmits information on the detected incident to the necessary log information determination processing unit 23 (step S101). The necessary log information determination processing unit 23, which has received the incident information, acquires a causal graph corresponding to the type of the detected incident from the causal graph storage unit 31 (step S102).

[0021] Then, the necessary log information determination processing unit 23 determines the device logs necessary for the cause analysis from the incident information (step S103). After this determination, the necessary log information collection processing unit 24 collects the necessary device log information from the device log information storage unit 32 (step S104). This collection process becomes the necessary log information collection process. Thereafter, the necessary log information determination processing unit 23 transmits the acquired causal relationship graph and the collected necessary apparatus log information to the cause analysis processing unit 25 (step S105).

[0022] Then, the cause analysis processing unit 25 that has received this information performs cause analysis processing using the received causal relationship graph and apparatus log information (step S106). Then, the cause analysis processing unit 25 sends the analysis processing result of the incident cause to the input / output unit 40 (step S107). The input / output unit 40 executes output processing (display, etc.) of the analysis processing result of the incident cause. An example of displaying the analysis processing result will be described later with reference to FIG.

[0023] [Cause analysis process details] FIG. 4 is a flowchart showing details of the cause analysis process in the cause analysis processing unit 25. The cause analysis processing unit 25 first acquires a causal relationship graph for the detected incident type and a group of device logs that have been collected based on the determination that they are necessary for analysis (step S201). Then, the cause analysis processing unit 25 calculates a score of the possibility of the cause being caused by a failure of the device (step S202). Furthermore, the cause analysis processing unit 25 calculates a score of the possibility of the cause being caused by a cyber attack (step S203). Details of these score calculation processes will be described later with reference to FIG. 5.

[0024] Then, the cause analysis processing unit 25 compares the failure attributable possibility score obtained in step S202 with the cyber-attack attributable possibility score obtained in step S20. In this comparison, the cause analysis processing unit 25 determines whether the failure attributable possibility score is greater than the cyber-attack attributable possibility score (step S204).

[0025] If it is determined in step S204 that the failure-attributable possibility score is greater than the cyber-attack attributable possibility score (Yes in step S204), the cause analysis processing unit 25 determines that the incident is caused by a failure (step S205). If it is determined in step S204 that the failure-attributable possibility score is not greater than the cyber-attack attributable possibility score (No in step S204), the cause analysis processing unit 25 determines that the incident is not caused by a failure (step S206).

[0026] 5 is a flowchart showing details of the calculation of the score of the possibility of being caused by a device failure (step S202 in FIG. 4) and the calculation of the score of the possibility of being caused by a cyber-attack (step S203 in FIG. 4). The calculation of the score of the possibility of being caused by a device failure and the calculation of the score of the possibility of being caused by a cyber-attack are performed in the same processing procedure. First, the cause analysis processing unit 25 acquires a causal relationship graph for the detected incident type and a group of device logs that have been determined to be necessary for analysis and collected (step S301).

[0027] Then, the cause analysis processing unit 25 selects one piece of device log information from the collected device log group, and acquires the corresponding log information group within the specified range (step S302). The range (specified range) from which the log information group is acquired is specified in advance. Alternatively, the specified range may be specified each time a task is performed. The cause analysis processing unit 25 also acquires a judgment condition for the corresponding log information from the acquired causal relationship graph (step S303). After that, the cause analysis processing unit 25 searches for a log that matches the judgment condition from among the corresponding log information group, and calculates the relevance of the causal relationship graph (step S304).

[0028] After the relevance calculation in step S304, the cause analysis processing unit 25 determines whether there is any device log information for which the score has not been calculated (step S305). If there is any device log information for which the score has not been calculated in step S305 (Yes in step S305), the cause analysis processing unit 25 returns to step S302 and performs processing on another device log information. Furthermore, if there is no apparatus log information for which a score has not been calculated in step S305 (No in step S305), the cause analysis processing unit 25 acquires a relation condition (AND / OR) between apparatus log information from the causal relationship graph (step S306).

[0029] Then, the cause analysis processing unit 25 calculates the relevance of the device log information according to the acquired relation condition, and calculates an attributable possibility score (step S307). Here, the attributable possibility score includes a failure attributable possibility score and a cyber-attack attributable possibility score. In the score calculation method here, for example, as a calculation method for the relation condition between device log information, in the case of an AND condition, the minimum value of each relevance is taken as the score. Also, in the case of an OR condition, the maximum value of each relevance is taken as the score.

[0030] [Causal graph example] Figures 6 and 7 show examples of causal graphs. Figure 6 is a causal graph caused by a failure, and Figure 7 is a causal graph caused by a cyber attack. 6, the detection nodes for one type of incident include a failure of the command issuing source 411, a failure of the transmission device 412, a failure of the command receiving device 413, a failure of the command executing device 414, etc. With the OR condition of these events, the cause node is the occurrence of a failure related to command issuance 431, and the issuance of an illegal command 441 is registered above it.

[0031] 6, as detection nodes of another type of incident, there are failure of a device for determining a state 421, failure of a state sensor 422, etc. In the OR condition of these failure events, a cause node is a failure occurrence related to state understanding 432, and an unauthorized terminal state understanding 442 is registered as a higher rank. Furthermore, an incident type “detection of issuance of command inconsistent with terminal state” 400a is registered in the causal graph under the OR condition of issuance of unauthorized command 441 and grasping of unauthorized terminal state 442.

[0032] The causal graph of cyber attacks shown in Fig. 7 has detection nodes for one type of incident, such as function tampering 451, unauthorized authentication 452, malware intrusion 453, etc. With the OR condition of these types of events, the cause node is attempted execution of unauthorized commands 481. In addition, as detection nodes for another type of incident, there are a parameter range scan function 461 for illegal commands, a parameter range scan 462 for sensor values / control values, etc. With the OR condition of these types of events, an attempt to circumvent the functional safety design 482 is formed as a cause node.

[0033] Then, the issuance of an instruction not related to functional safety 491 is obtained as a higher-level cause node of the execution of the illegal instruction 481. Alternatively, execution of an illegal instruction 481 and an attempt to circumvent a functional safety design 482 are ANDed to obtain execution of an instruction related to functional safety 492.

[0034] Further, detection nodes for other types of incidents include intrusion of illegal control values / sensor values ​​into the network (NW) 471, tampering with data that holds the terminal state 472, tampering with sensor functions 473, etc. With the OR condition of these types of events, the cause node is attempted tampering with terminal state 483, and further, tampering with terminal state 493 is obtained as a higher level cause node. Furthermore, an incident type “detection of issuance of a command inconsistent with the terminal state” 400b is registered in the causal graph under the OR condition of issuance of a command unrelated to functional safety 491, execution of a command related to functional safety 492, and tampering with the terminal state 493.

[0035] [Example of a log information table] FIG. 8 shows an example of a log information table stored in the device log information storage unit 32. As shown in FIG. The log information tables are generated for each of the log information holding units 33, 34, 35, and 36 shown in FIG. 2, and have an arbitrary number of AA log information tables 500a to 500Z.

[0036] As shown in FIG. 8, one log information table has a log information table ID 501 , device information 502 , date information 503 , log information 504 , and corresponding department information 505 . The log information table ID 501 is an identification number given to each log information table. The device information 502 is the address of the target device from which the device log information is collected. The date information 503 is the date and time when the device log information was collected.

[0037] Log information 504 is actually collected device log information. Corresponding department information 505 is department information that can be used to make a judgment on the corresponding apparatus log information. By linking and storing the determinable response department information 505 in this manner, the relevant department can make a detailed determination about the incident. For example, when the cause is a malfunction, the department information that can determine the malfunction is recorded, and the malfunction can be dealt with.

[0038] [Example of causal graph information table] FIG. 9 shows an example of a causal graph information table 600 stored in the causal graph storage unit 31. As shown in FIG. The causal relationship graph information table 600 has incident type information 601 , a graph ID 602 ​​, device log information 603 , a log table ID 604 , a judgment condition 605 , and an association degree calculation coefficient 606 .

[0039] The incident type information 601 is an incident type. For example, as shown in Fig. 9, an incident type such as "detection of issuance of a command inconsistent with the terminal state" is stored. The graph ID 602 ​​is an identification number given to each causal relationship graph. The device log information 603 is the log information of the device from which the causal relationship is determined, for example, the log of device A, AB. The log table ID 604 is a log table ID in which the device log information indicated in the device log information 603 is held. The judgment condition 605 indicates the detection parameters necessary for judgment. The relevance calculation coefficient 606 indicates a coefficient value for calculating the relevance. Based on the information in the causal relationship graph information table 600, the causal relationship graphs shown in FIG. 6 and FIG.

[0040] [Example of the causal graph settings screen] FIG. 10 shows an example of a causal relationship graph setting screen 700 displayed on the display unit constituting the input / output unit 40 of the cause analysis device 1 when the causal relationship graph generation processing unit 21 generates a causal relationship graph. As shown on the left side of the screen, the causal relationship graph setting screen 700 has an input field for inputting setting values, such as an input field for the incident name, details of the device log settings, and input fields for the judgment conditions, and the person working on the setting screen 700 (analyst) can input these details.

[0041] Also, as shown on the right side of the causal relationship graph setting screen 700, columns are provided for the person in charge to create the graph, and the person in charge working on this setting screen 700 can input the details of the detection node, the details of the cause node, and the details of the incident type.The person in charge can then input the judgment conditions (AND conditions, OR conditions, etc.) for those nodes and the connection lines showing the connection relationships between the nodes to create the causal relationship graphs shown in Figures 6 and 7.

[0042] At the bottom right of the causal graph setting screen 700 are a “Setting OK” button and a “Cancel” button. When the person in charge selects the “Setting OK” button, the causal graph created on the causal graph setting screen 700 is stored in the causal graph storage unit 31. Furthermore, when the person in charge selects the "Cancel" button, the creation of the causal relationship graph created on the causal relationship graph setting screen 700 is cancelled.

[0043] [Example of the cause analysis result display screen] FIG. 11 shows an example of a cause analysis result screen 800 in the cause analysis processing unit 25 displayed on the display unit constituting the input / output unit 40. In FIG. The cause analysis result screen 800 has a display column for the cause of the detected incident, a display column for a failure-caused score, and a display column for a cyber-attack-caused score. Each score is a score obtained during the cause analysis process in the cause analysis processing unit 25, and the cause of the detected incident (failure-caused or cyber-attack-caused) is displayed in the display column for the cause of the detected incident based on the determination in step S204 of the flowchart in Fig. 4 using the values ​​of both scores.

[0044] The cause analysis result screen 800 also displays the analyzed causal relationship graph used in the analysis (lower left in FIG. 11) and also displays a list of analyzed device logs (lower right in FIG. 11). Note that although the characters in the analyzed causal relationship graph are omitted in FIG. 11, in reality, the details of the analyzed causal relationship graph are displayed in the form shown in FIG. 6 or FIG. 7. A download button is displayed where the analysis causal relationship graph and the list of device logs are displayed. The person in charge can then download the details of the analysis causal relationship graph (e.g., the information shown in FIG. 9) and the details of the device logs (e.g., the information shown in FIG. 8) and display them on the screen. In addition, the cause analysis result screen 800 is provided with a result print button, which allows the person in charge to print the cause analysis results.

[0045] As described above, the incident event cause identification system of this example can extract only the information necessary for an alert from the various log information available in the device and identify the cause. This shortens the time required for information review and optimizes the storage capacity of information, making it possible to efficiently identify the cause of an incident. In addition, it becomes possible to appropriately identify the cause without being affected by the skills of the person in charge (analyst).

[0046] Here, the cause analysis processing unit 25 uses the device log information collected by the necessary log information determination processing unit 23 and the prepared causal relationship graph to calculate a failure-attributable possibility score and an attack-attributable possibility score to identify the cause of the incident event. This makes it possible to appropriately determine whether the cause of the incident event is a failure or a cyber-attack.

[0047] Specifically, when the attack-attributable possibility score is greater than the fault-attributable possibility score, the cause analysis processing unit 25 determines that the cause is not a fault, and when the attack-attributable possibility score is not greater than the fault-attributable possibility score, the cause analysis processing unit 25 determines that the cause is a fault. This makes it possible to appropriately determine the cause from the score value.

[0048] In addition, when the cause analysis processing unit 25 calculates the failure-attributable possibility score and the attack-attributable possibility score, as explained in the flowchart of Fig. 5, it acquires the judgment conditions of the device log information from the causal relationship graph of the detected incident type, searches for the presence or absence of logs matching the judgment conditions from the device logs judged necessary for the analysis and collected, and calculates the relevance specified by the causal relationship graph. This makes it possible to calculate each score appropriately based on the relevance specified by the causal relationship graph, thereby improving the accuracy of cause judgment.

[0049] Furthermore, as explained in Figure 8, the causal graph can be linked to determinable department information, making it possible to determine the department that will handle the relevant incident and quickly deal with the incident.

[0050] Furthermore, by providing a causal relationship graph generation processing unit 21 that generates a causal relationship graph to be held in the causal relationship graph holding unit 31, and by having the generated causal relationship graph held in the causal relationship graph holding unit 31, it is possible to easily create and modify a causal relationship graph. Also, the causal relationship graph can be created in advance by an analyst or SOC staff member by inputting 700 into the causal relationship graph setting screen as shown in FIG. 10, or it can be automatically created by reading publicly available information summarizing the causes of incidents, allowing an appropriate causal relationship graph to be created. Furthermore, the input / output unit 40 outputs a causal relationship graph and necessary log information as the analysis status as shown in FIG. 11, so that the details of the reason for determining the cause can be known.

[0051] [Variations] It should be noted that the embodiment examples described so far have been described in detail in order to explain the present invention in an easily understandable manner, and are not necessarily limited to those having all of the configurations described. For example, in the above-described embodiment, the cause analysis processing unit 25 determines the cause as a cause analysis result and outputs the determination result. In contrast, the cause analysis processing unit 25 may not determine the cause, but may calculate a failure-attributable possibility score and an attack-attributable possibility score and display each score. A person in charge (analyst) who checks this display will be able to infer the cause from the scores.

[0052] In addition, in the configuration diagram of the cause analysis device 1 shown in Fig. 2, only the control lines and information lines that are considered necessary for explanation are shown, and not all the control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all the components are connected to each other. Furthermore, the process flows shown in the flowcharts of FIGS. 3 to 5 are also examples, and as long as the process results are the same, the order of some processes may be changed or multiple processes may be executed simultaneously. The display examples shown in FIG. 10 and FIG. 11 are also merely examples, and the present invention is not limited to these displays.

[0053] In addition, the cause analysis device 1 shown in Figure 2 is also an example in that it is equipped with a processing unit 20, which is a computer on which a program (a program that realizes a method for identifying the cause of an incident event) is implemented, and may be realized by the cause analysis device 1 or other configurations. For example, a part or the whole of the cause analysis device 1 may be realized by dedicated hardware such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC).

[0054] In addition, a part of the configuration of the cause analysis device 1 may be placed in another processing device such as a server connected via a network, and data may be exchanged between the multiple processing devices to perform analysis processing similar to that of the cause analysis device 1. Furthermore, the program for executing the incident cause identification method may be stored in a storage device within the computer, or may be stored in a recording medium such as an external memory, an IC card, an SD card, or an optical disk, and then transferred. [Explanation of symbols]

[0055] 1...cause analysis device, 2a to 2n...device (target device), 20...processing unit, 21...causal relationship graph generation processing unit, 22...incident detection processing unit, 23...necessary log information determination processing unit, 24...necessary log information collection processing unit, 25...cause analysis processing unit, 30...storage unit, 31...causal relationship graph storage unit, 32...device log information storage unit, 40...input / output unit, 50...communication unit

Claims

1. a device log information storage unit for storing log information output by a target device; a causal graph storage unit that stores a causal graph in which incident events and their causes are linked in advance; an incident detection processing unit that detects an incident event in a target device; a necessary log information determination processing unit that extracts the causal relationship graph of a corresponding type for an incident event detected by the incident detection processing unit, and determines apparatus log information necessary for cause identification based on the extracted causal relationship graph; a necessary log information collection processing unit that collects the apparatus log information determined by the necessary log information determination processing unit; a cause analysis processing unit that analyzes a cause of an incident event by using the apparatus log information collected by the necessary log information collection processing unit and the causal relationship graph; An output unit that outputs the cause or analysis status identified by the cause analysis processing unit. Incident event cause identification system.

2. The cause analysis processing unit calculates a failure-attributable possibility score and an attack-attributable possibility score using the device log information collected by the necessary log information determination processing unit and the causal relationship graph, and identifies the cause of the incident event. The incident event cause identification system according to claim 1 .

3. When the cause analysis processing unit calculates the failure-attributable possibility score and the attack-attributable possibility score, the cause analysis processing unit obtains a judgment condition of device log information from a causal relationship graph of the detected incident type, searches for a log matching the judgment condition from a group of device logs that have been judged as necessary for analysis and collected, and calculates the relevance specified by the causal relationship graph. The incident event cause identification system according to claim 2.

4. The cause analysis processing unit determines that the cause is not due to a fault when the attack-attributable possibility score is greater than the fault-attributable possibility score, and determines that the cause is due to a fault when the attack-attributable possibility score is not greater than the fault-attributable possibility score. The incident event cause identification system according to claim 3.

5. The causal graph links department information that can be judged The incident event cause identification system according to claim 1 .

6. The apparatus further includes a causal graph generation processing unit that generates a causal graph to be held by the causal graph holding unit, and causes the generated causal graph to be held in the causal graph holding unit. The incident event cause identification system according to claim 1 .

7. The output unit outputs a causal relationship graph and necessary log information as an analysis status. The incident event cause identification system according to claim 1 .

8. A device log information storage process for storing log information output by a target device; A causal relationship graph storage process for storing a causal relationship graph that links incident events and their causes in advance; an incident detection process for detecting an incident event in a target device; a necessary log information determination process for extracting the causal relationship graph of a corresponding type for an incident event detected by the incident detection process, and determining device log information necessary for cause identification based on the extracted causal relationship graph; a necessary log information collection process for collecting the device log information determined by the necessary log information determination process; a cause analysis process for analyzing a cause of an incident event by using the device log information collected by the necessary log information determination process and the causal relationship graph; and an output process for outputting the cause or analysis status identified by the cause analysis process. How to identify the cause of an incident.

Images