Support program, support method and information processor

Abstract

To reduce the variation in a result of verifying the effectiveness of a security countermeasure.SOLUTION: A support program causes a computer to execute processing for executing a command entered via a user interface shared between multiple terminal devices, extracting target information becoming a target of the next investigation from a result of executing the command, and displaying command candidates related to the target information on the user interface.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an assistance program, an assistance method, and an information processing device. [Background technology]

[0002] Various security measures are being implemented to counter the growing threat of cyber attacks. In this context, a service called "red team operation" is attracting attention. Red team operation is a service in which security experts form a team and launch various attacks against client companies to verify the effectiveness of their security measures. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2011-192036 A [Patent Document 2] Patent Publication No. 2022-041790 [Patent Document 3] Patent Publication No. 2022-080635 Summary of the Invention [Problem to be solved by the invention]

[0004] However, since the members participating in the red team mentioned above have different skill levels, there is a possibility that the verification results of the effectiveness of security measures will vary depending on the composition of the red team members.

[0005] According to one aspect, the present invention has an object to provide an assistance program, an assistance method, and an information processing device that can reduce variation in verification results of the effectiveness of security measures. [Means for solving the problem]

[0006] In one embodiment, the assistance program causes a computer to execute a command input via a user interface shared among multiple terminal devices, extract target information that will be the next target of investigation after the command from the result of executing the command, and display command candidates related to the target information in the user interface. Effect of the Invention

[0007] This reduces variation in the results of verifying the effectiveness of security measures. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram illustrating an example of a functional configuration of a server device. [Diagram 2] FIG. 2 is a diagram illustrating an example of a shared user interface. [Diagram 3] FIG. 3 is a diagram showing a display example in the shared user interface. [Figure 4] FIG. 4 illustrates an example of a directory structure. [Diagram 5] FIG. 5 is a diagram showing an example of keys and data. [Figure 6] FIG. 6 is a diagram showing an example of definitions in the command knowledge DB. [Figure 7] FIG. 7 is a flowchart illustrating a processing procedure of the terminal sharing unit. [Figure 8] FIG. 8 is a flowchart showing the processing procedure of the command execution unit. [Figure 9] FIG. 9 is a diagram showing an example of an output format of the survey target. [Figure 10] FIG. 10 is a flowchart (1) showing the processing procedure of the survey target extraction unit. [Figure 11] FIG. 11 is a flowchart (2) showing the processing procedure of the survey target extraction unit. [Figure 12] FIG. 12 is a diagram showing an example of a survey target extraction script. [Figure 13] FIG. 13 is a diagram showing an example of a command output. [Figure 14] FIG. 14 is a flowchart showing a processing procedure of the survey target selection unit. [Figure 15] FIG. 15 is a flowchart (1) showing the processing procedure of the command candidate extraction unit. [Figure 16] FIG. 16 is a flowchart (2) showing the processing procedure of the command candidate extraction unit. [Figure 17] FIG. 17 is a diagram illustrating an example of the script file. [Figure 18] FIG. 18 is a diagram showing an example of a result of selecting a command candidate and executing the command. [Figure 19] FIG. 19 is a diagram illustrating an example of a hardware configuration. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the support program, support method, and information processing device according to the present application will be described with reference to the attached drawings. Each embodiment merely shows one example or aspect, and the numerical values, range of functions, and usage scenes are not limited by such examples. Each embodiment can be appropriately combined within a range that does not cause contradiction in the processing contents.

[0010] <Example 1> <Overall composition> Fig. 1 is a block diagram showing an example of a functional configuration of a server device 10. The server device 10 shown in Fig. 1 provides a red team support function that supports red team operations in which various attacks are launched to verify the effectiveness of security measures taken by a target organization.

[0011] The server device 10 can be realized as a SaaS (Software as a Service) type application to provide the above-mentioned red team support function as a cloud service. In addition, the server device 10 can be realized as a server that provides the above-mentioned red team support function on-premise.

[0012] As shown in FIG. 1, the server device 10 may be communicably connected to a plurality of terminal devices 30 via a network NW. For example, the network NW may be any type of communication network, such as the Internet or a LAN (Local Area Network), whether wired or wireless. Any number of terminal devices 30 may be connected to the server device 10, and the number of terminal devices connected to the server device 10 may be zero or one. For example, when the server device 10 is started, the number of terminal devices in the server device 10 may be zero or one by default, and then multiple terminal devices 30 may be connected.

[0013] The terminal device 30 corresponds to an example of a computer that receives the above-mentioned red team support function. The terminal device 30 can be used by members participating in the red team. For example, the terminal device 30 may be realized by a desktop or laptop personal computer. Without being limited thereto, the terminal device 30 may be realized by any computer such as a mobile terminal device or a wearable terminal.

[0014] <Red team assessment> In the red team operation described above, attackers simulate attacks and attempt to infiltrate the facilities and systems of the target organization. Examples of facilities include offices, data centers, and warehouses. Examples of systems include publicly available web services and internal systems.

[0015] Targeting these facilities and systems, red team members use social engineering to gather information about employees and users in order to find a way to infiltrate, or look for vulnerabilities in Internet-exposed services to use as an entry point.

[0016] Here, in the red team operation, diagnosis from an intrusion state can be performed assuming not only an external attacker but also an internal crime. From this perspective, the terminal device 30 may be placed outside the facility of the target organization, or may be placed inside the facility of the target organization. Also, a terminal device 30 belonging to an outside of the system of the target organization may be used, or a terminal device 30 belonging to an inside of the system of the target organization may be used.

[0017] <Member Skills> Red team members are required to understand and utilize the attackers' strategies, tactics, procedures, and other attack methods, known as TTPs (Tactics, Techniques, and Procedures). For this reason, the following skills (a) to (f) are required.

[0018] (a) Discovery of system vulnerabilities (both known and unknown) (b) Discovery of attack codes and tools for infiltrating systems (C) Lateral expansion of intrusions into surrounding systems that contain important information (D) Persistence of system intrusion state (e) Searching for important information using commands and tools (F) Acquiring skills through education, CTF (Capture The Flag) competitions, and certification exams

[0019] <One aspect of the issue> As explained in the Background Technology section above, the members who participate in the red teams have different skill levels, so there is a possibility that the verification results of the effectiveness of security measures will vary depending on the composition of the red team members.

[0020] That is, new members have lower skills than experienced members, so they have many unknown commands and tools, and even if they know the commands or tools, many of them are unaware that there are unknown ways to use them. For example, new members often get stuck on vulnerability searches or writing intrusion code, which takes a lot of time. Furthermore, each member is assigned an individual task, so they are concentrating on diagnosis and it is difficult to consult with them. For this reason, it takes time to explain what they have done and where they are stuck and share information. Also, they are unable to understand what other members are doing, and they tend to waste time by duplicating tasks.

[0021] <One aspect of the problem-solving approach> Therefore, the red team support function of this embodiment establishes a cyclical process of executing commands entered via a user interface shared among multiple terminal devices 30, extracting investigation targets from the execution results, and extracting command candidates related to the investigation targets.

[0022] 2 is a diagram showing an example of a shared user interface 20. As shown in FIG. 2, the shared user interface 20 includes a terminal screen 21, a search target screen 23, and a command candidate screen 24.

[0023] The terminal screen 21 is a CLI (Command Line Interface) screen of the terminal device 30 corresponding to the tab 22 currently selected among the tabs 22A to 22C. This terminal screen 21 not only allows the terminal screen 21 to be shared to grasp the situation, but also allows input assistance from a remote location. Furthermore, the situation can be grasped from the command execution history. When the tab 22D with a schematic icon "+" is selected, a new CLI screen of the terminal device 30 can be created.

[0024] The investigation target screen 23 is an area that displays information on the investigation target extracted from the command output input to the terminal screen 21. The command candidate screen 24 is an area that displays commands related to the investigation target currently selected as candidates for the next command to be executed.

[0025] Through such a shared user interface 20, the following cycle is realized. First, a command inputted to the terminal screen 21 is executed, and the command output, which is the execution result, is displayed on the terminal screen 21 (step S1). Next, the next search target extracted from the command output is displayed on the search target screen 23 (step S2). Then, a command related to the search target selected by the user is displayed on the command candidate screen 24 as a candidate to be executed next (step S3). Next, a command selected from the command candidates is inputted to the terminal screen 21 (step S4). After that, the process returns to step S1, and the cyclical process of steps S1 to S4 can be repeated.

[0026] FIG. 3 is a diagram showing a display example in the shared user interface. As shown in the first line of the terminal screen 21 in FIG. 3, when the ip neigh command is input, the ip neigh command is executed. The execution result is displayed as a command output in the second and third lines of the terminal screen 21 in FIG. 3, and the IP address "10.0.1.100" is extracted as the next search target from the command output, for example, the second line of the terminal screen 21. When the IP address "10.0.1.100" is selected on the search target screen 23, three command candidates with the IP address "10.0.1.100" as an argument are displayed on the command candidate screen 24. For example, they are "nmap -Pn -A -T4 10.0.1.100", "nmap -Pn -p- 10.0.1.100", "nmap 10.0.1.100", etc. Of these, when the third command "nmap 10.0.1.100" is selected on the command candidate screen 24, the command "nmap 10.0.1.100" is entered as shown on the fourth line of the terminal screen 21 in FIG.

[0027] This type of cyclical process can provide the following research support, just as one example. That is, since devices connected to a network are susceptible to cyber attacks, find out what devices are connected. For example, run the ip neigh command to collect the IP (Internet Protocol) addresses and MAC (Media Access Control) addresses of the devices. Furthermore, find out what services are provided by the connected devices. For example, run the nmap command with the IP addresses as arguments to collect the port numbers and names of various services. After that, find out whether the software for each service has vulnerabilities. For example, specify the -sV argument to the nmap command to find the software name and version. Furthermore, search for known vulnerabilities in the software. For example, search a vulnerability information site using the software name and version number.

[0028] In this way, even if the members participating in the red team have low skill levels, the quality of the verification of the effectiveness of security measures can be improved by repeating the above cyclical process.

[0029] Therefore, the red team support function according to this embodiment can suppress the variation in the verification results of the effectiveness of security measures. Furthermore, it can realize support for human resource development, such as command input support when acquiring skills, support by team members, and situation sharing and support during CTF competitions.

[0030] <Configuration of Server Device 10> Next, an example of the functional configuration of the server device 10 according to this embodiment will be described. Fig. 1 shows a schematic diagram of blocks related to the red team support function of the server device 10. As shown in Fig. 1, the server device 10 has a communication control unit 11, a storage unit 13, and a control unit 15. Note that Fig. 1 shows only an excerpt of the functional units related to the above-mentioned red team support function, and the server device 10 may be provided with functional units other than those shown in the figure.

[0031] The communication control unit 11 is a functional unit that controls communication with other devices such as the terminal device 30. As just one example, the communication control unit 11 can be realized by a network interface card such as a LAN card.

[0032] As one aspect, the communication control unit 11 accepts command input from the terminal device 30 to the terminal screen 21, a selection operation of a search target on the search target screen 23, a selection operation of a command candidate on the command candidate screen 24, and the like.

[0033] In another aspect, the communication control unit 11 transmits command output to the terminal screen 21, search target output to the search target screen 23, command candidate output to the command candidate screen 24, and the like.

[0034] The storage unit 13 is a functional unit that stores various data. As merely one example, the storage unit 13 is realized by an internal, external, or auxiliary storage of the server device 10.

[0035] Fig. 4 is a diagram showing an example of a directory configuration. As shown in Fig. 4, under the top directory, startup scripts for applications that realize the above-mentioned red team support function, a command knowledge DB (DataBase) 13A, and various services are arranged.

[0036] Of these, the command knowledge DB 13A stores a set of knowledge related to each command. For example, in the example shown in Fig. 4, knowledge related to a plurality of commands, knowledge related to the cat command, knowledge related to the dirb command, and so on are stored. As examples of such knowledge, the command knowledge DB 13A stores a target extraction script that extracts a survey target from a command output, a script in which comments used to extract command candidates related to the survey target are written, or both scripts.

[0037] Here, in the command knowledge DB 13A, keys and data are defined for each command. Fig. 5 is a diagram showing an example of keys and data. As shown in Fig. 5, examples of keys that define the extraction of a survey target include "pattern" and "script". Also, examples of keys that define the extraction and display of command candidates include "name", "template", "condition", and "group".

[0038] Using such keys and data, definition information is written in the form of comments in the target extraction script and the command candidate extraction script.

[0039] Fig. 6 is a diagram showing an example of a definition in the command knowledge DB 13A. Fig. 6 shows an excerpt of a comment portion written in a survey target extraction script with the file name "command_ip_addr.py" from among the scripts shown in Fig. 4.

[0040] As shown in Fig. 6, the definition information corresponds to the comment portion from [BEGIN] to on a line beginning with #. In this example of definition information, it is defined that when the command executed on the terminal screen 21 is ip neigh or ip -4 neigh, the investigation target extraction script with the file name "command_ip_addr.py" is started.

[0041] In addition, while Fig. 6 shows an example in which one definition information is described per file, the present invention is not limited to this example, and multiple definition information may be described per file. An example of a script in which multiple definition information is described in this way is the file name "commands.txt" shown in Fig. 4. In this way, a script in which one definition information is described and a script in which multiple definition information is described may be used together. This allows for flexible response to various conditions, such as the combination and order of arguments.

[0042] Returning to the explanation of FIG. 4, the folders for various services store files such as a command knowledge service, a search target extraction service, a command logging service, a change notification service, a command execution service, a search target acquisition service, and a terminal service.

[0043] In addition, although not shown in the figure, a search target DB 13B in which search targets extracted by the search target extraction script are organized into a database may be placed under the top directory.

[0044] The control unit 15 is a functional unit that performs overall control of the server device 10. For example, the control unit 15 can be realized by a hardware processor. As shown in Fig. 1, the control unit 15 has a terminal sharing unit 15A, a command execution unit 15B, a survey target extraction unit 15C, a survey target selection unit 15D, and a command candidate extraction unit 15E. The control unit 15 may be realized by hardwired logic or the like.

[0045] The terminal sharing unit 15A is a processing unit that causes a plurality of terminal devices 30 to share a user interface.

[0046] Fig. 7 is a flowchart showing the processing procedure of the terminal sharing part 15A. As shown in Fig. 7, the terminal sharing part 15A initializes a terminal number counter to "1" (step S101), and transitions to a state of waiting for a request from the terminal device 30 (step S102).

[0047] Then, when a creation request is received from the terminal device 30 (Yes in step S103), the terminal sharing part 15A executes a terminal creation process to create a terminal screen 21 corresponding to the new terminal device 30 and add a tab corresponding to the terminal screen 21 (step S104). After that, the terminal sharing part 15A increments the terminal number by one (step S105) and proceeds to step S102.

[0048] As just one example, such a creation request can be accepted by operating a tab with a schematic icon "+" on the terminal screen 21 of the shared user interface 20. The shared user interface 20 may be displayed via a browser or the like operating on the terminal device 30 when login to the terminal screen 21 with an account assigned to a member of the red team is successful.

[0049] Also, if a change request is received from the terminal device 30 (Yes in step S106), the terminal sharing part 15A changes the terminal name described in the tab of the terminal screen 21 shown in FIG. 2 in accordance with the change request (step S107), and proceeds to step S102.

[0050] Furthermore, if a list request is received from the terminal device 30 (Yes in step S108), the terminal sharing unit 15A transmits the terminal list generated by listing the names of the terminals for which tabs are being generated on the terminal screen 21 shown in FIG. 2 to the terminal device 30 that made the request (step S109), and proceeds to step S102.

[0051] Moreover, when a log request is received from the terminal device 30 (Yes at step S110), the terminal sharing part 15A transmits a log of the command input / output specified in the log request (step S111), and the process proceeds to step S102.

[0052] As merely one example, such a log request is made from a new terminal device 30 to the server device 10 when the new terminal device 30 successfully logs in to the server device 10. In this case, a log of command input / output for all terminal numbers is requested in order to share all command execution histories on the terminal screen 21 of the shared user interface 20 displayed by the new terminal device 30. As another example, when a character string corresponding to a command input or command output is added on the terminal screen 21 of any of the shared user interfaces 20, the above log request is made from each terminal device 30 to the server device 10 in the case where the change in the command input or command output is requested.

[0053] The terminal sharing unit 15A may have a command string editing function using a control key and a command execution history function.

[0054] Returning to the explanation of FIG. 1, the command execution unit 15B is a processing unit that executes a command input on the terminal screen 21 of the shared user interface 20. As just one example, when executing a command, the command execution unit 15B searches the command knowledge DB 13A for a search target extraction script that corresponds to the character string of the input command and starts it. This automates the extraction and database creation of search targets that was previously performed visually and manually. Furthermore, in order to flexibly respond to changes in command output due to differences in command versions and argument specifications, multiple pairs of command input patterns and search target extraction scripts can be registered, and all search target extraction scripts are operated in parallel.

[0055] Fig. 8 is a flowchart showing the processing procedure of the command execution unit 15B. As shown in Fig. 8, the command execution unit 15B accepts key input data, for example, input data of a character string such as a keyboard key, input from the terminal device 30 via the terminal screen 21 of the shared user interface 20 (step S201).

[0056] Next, the command execution unit 15B edits the command character string based on the key input data accepted in step S201 (step S202). At this time, if a line feed key is included (step S203 Yes), the command execution unit 15B lists the scripts included in the command knowledge DB 13A (step S204).

[0057] If all the scripts included in the command knowledge DB 13A have not been listed (No in step S205), the command execution unit 15B executes the following process: That is, the command execution unit 15B determines whether or not the character string of the command edited in step S202 corresponds to the input pattern defined in the key "pattern" described in the comment of the script listed in step S204 (step S206).

[0058] At this time, if the character string of the command matches the input pattern (Yes in step S206), the command execution unit 15B executes the script listed in step S204, that is, the investigation target extraction script (step S207). This starts up the investigation target extraction script.

[0059] After that, when all the scripts included in the command knowledge DB 13A have been listed (Yes in step S205), the command execution unit 15B starts the command corresponding to the character string of the command edited in step S202 (step S208).

[0060] Then, the command execution unit 15B receives the command output started in step S208 (step S209). At this time, if the command output has not ended (No in step S210), the command execution unit 15B outputs the command output to the terminal device 30 (step S211). As a result, the command output is displayed on the terminal screen 21 of the shared user interface 20. Furthermore, the command execution unit 15B outputs the command output to the investigation target extraction script started in step S207 (step S212).

[0061] Thereafter, when the command output is completed (Yes in step S210), the command execution unit 15B proceeds to the process in step S201.

[0062] This series of processes reduces the workload required when executing a command, such as visually extracting investigation targets from the command output and taking notes of information by copying and pasting using the mouse.

[0063] Returning to the explanation of FIG. 1, the search target extraction unit 15C is a processing unit that extracts a search target from a command output. As an example, the search target extraction unit 15C may be realized by a search target extraction script. This search target extraction script may be started in parallel. For example, the search target extraction unit 15C assigns an information name to the search target and extracts it. At this time, the search target extraction unit 15C extracts search targets related to the extracted search target in a hierarchical structure.

[0064] When a survey target is extracted in this way, the information name (key) and the information value (data) are output as a set. At this time, if hierarchical data exists, the sets are output in descending order of the hierarchical structure.

[0065] FIG. 9 is a diagram showing an example of the output format of the investigation target. FIG. 9 shows an output example of the ip neigh command. As shown in FIG. 9, the pairs of information name and information value are output in the order of the hierarchical structure after being converted into a character string separated by tabs. In the example of the first line, the information name "ipv4", tab, information value "192.168.0.1", tab, information name "mac", tab, information value "00:1d:57:2e:28:8c" are output in this order. In the example of the second line, the information name "ipv4", tab, information value "192.168.0.100", tab, information name "mac", tab, information value "00:50:56:a6:01:e9" are output in this order.

[0066] 10 and 11 are flowcharts (1) and (2) showing the processing procedure of the investigation target extraction unit 15C. As shown in Fig. 10, the investigation target extraction unit 15C generates a list object of an upper layer (step S301). Then, the investigation target extraction unit 15C executes the lower layer processing (upper layer) that has been subroutineized as shown in Fig. 11 (step S302).

[0067] Fig. 11 shows a subroutine of the lower hierarchical level processing (including the upper hierarchical level) of step S302 shown in Fig. 10. As shown in Fig. 11, the survey target extraction unit 15C generates a list object of the current hierarchical level, which is the hierarchical level being processed (step S401). Next, the survey target extraction unit 15C receives one line of character string from the command output output in step S212 shown in Fig. 8 (step S402).

[0068] At this time, if the reception of the command output has not ended and the current hierarchy has not ended (No in step S403 and No in step S404), the investigation target extraction unit 15C executes the following process: That is, the investigation target extraction unit 15C determines whether or not to start searching for investigation targets in a hierarchy lower than the current hierarchy based on the one-line character string received in step S402 (step S405).

[0069] Then, when a search for a survey target in a lower layer of the current layer is started (Yes in step S405), the following process is executed. That is, the survey target extraction unit 15C executes a lower layer process (upper layer + current layer) in which the process procedure shown in this figure is further subroutineized (step S406), and proceeds to the process of step S402.

[0070] On the other hand, if a search for a search target in a lower hierarchy of the current hierarchy is not started (step S405 No), the search target extraction unit 15C determines whether or not a search target exists in the one-line character string received in step S402 (step S407).

[0071] If the investigation target exists (step S407 Yes), the investigation target extraction unit 15C stores the investigation target in the list object of the current hierarchy (step S408). Then, the investigation target extraction unit 15C outputs the investigation targets stored in the list objects of the upper hierarchy and the current hierarchy to the investigation target DB 13B (step S409), and proceeds to the processing of step S402.

[0072] The search targets extracted from the command output according to the processing procedure of the search target extraction script shown in FIGS. 10 and 11 are illustrated.

[0073] Fig. 12 is a diagram showing an example of a search target extraction script. As shown in Fig. 12, the search target extraction script 13A1 is started in step S207 shown in Fig. 8. That is, in the definition information 41 described in the comment in the search target extraction script 13A1, an IPv4 regular expression character string is defined in the key "pattern". Therefore, if the command character string to be compared in step S206 shown in Fig. 8 is ip neigh or ip -4 neigh, the search target extraction script 13A1 is started.

[0074] FIG. 13 is a diagram showing an example of a command output. For example, assume that the command output shown in FIG. 13 is output from the command execution unit 15B to the investigation target extraction script 13A1 in step S212 shown in FIG. 8. In this case, the character string in the frame portion of the command output shown in FIG. 13 is extracted as an investigation target according to the source code 42 of the investigation target extraction script 13A1 shown in FIG. 12. That is, as shown in frame portions 51A and 51B shown in FIG. 13, each pair of the information name "ipv4" and the information value "10.0.1.100" and the information name "mac" and the information value "00:50:56:a5:00:e8" are output in hierarchical order. Furthermore, as shown in frame portions 52A and 52B shown in FIG. 13, each pair of the information name "ipv4" and the information value "10.0.1.1" and the information name "mac" and the information value "00:0d:57:2d:27:8b" are output in hierarchical order.

[0075] Returning to the explanation of FIG. 1, the search target selection unit 15D is a processing unit that selects a search target from among the search targets extracted by the search target extraction unit 15C. As an example only, the search target selection unit 15D displays the search targets extracted by the search target extraction unit 15C in a tree format or a table format on the search target screen 23 shown in FIG. 2. For example, when the search target DB 13B is updated by executing a command via any one of the multiple terminal devices 30, the search target screen 23 of the shared user interface 20 displayed on all the terminal devices 30 is updated to the latest version. At this time, when the search target selection unit 15D accepts the selection of one of the search targets, it notifies the outside of the search target as an event, and command candidates using the search target are extracted.

[0076] Fig. 14 is a flowchart showing a processing procedure of the investigation target selection unit 15D. As shown in Fig. 14, when a change is made to the investigation target DB 13B, for example, when a investigation target is added, the investigation target selection unit 15D receives a change notification of the investigation target DB 13B (step S501).

[0077] Then, the investigation target selection unit 15D displays the investigation target corresponding to the change notification received in step S501 in a tree format or a table format on the investigation target screen 23 shown in FIG. 2 (step S502).

[0078] In this way, by selecting or deselecting one of the search targets displayed in the tree format or table format on the search target screen 23 from the terminal device 30, extraction of command candidates using that search target is executed.

[0079] Returning to the description of FIG. 1, the command candidate extraction unit 15E is a processing unit that extracts command candidates related to the search target selected by the search target selection unit 15D. In one aspect, when the search target has a hierarchical structure, the command candidate extraction unit 15E also lists commands related to the search target corresponding to a higher hierarchy of the search target selected by the search target selection unit 15D as command candidates. In another aspect, even when the search target is not selected or the selection of the search target is canceled, the command candidate extraction unit 15E can extract command candidates executable using the search target for each search target extracted from the command output.

[0080] 15 and 16 are flowcharts (1) and (2) showing the processing procedure of the command candidate extraction unit 15E. As shown in Fig. 15, the command candidate extraction unit 15E waits for the selection of a search target to be accepted by the search target selection unit 15D (step S601).

[0081] Next, the command candidate extraction unit 15E stores the sets of {information name of the search target and information value of the search target} up to the hierarchy of the search target selected by the search target selection unit 15D in the list object of targets (step S602).

[0082] Furthermore, the command candidate extraction unit 15E stores a list of the file names of the scripts included in the command knowledge DB 13A, that is, the scripts arranged under the directory "commands", in a list object of commands (step S603).

[0083] Thereafter, the command candidate extraction unit 15E executes the subroutine command candidate extraction process shown in Fig. 16 (step S604). Then, the command candidate extraction unit 15E displays the command candidates extracted in step S604 on the command candidate screen 24 shown in Fig. 2 (step S605), and ends the process.

[0084] In this way, when a selection of any one of the command candidates displayed on the command candidate screen 24 shown in Fig. 2 is accepted, the character string of the command candidate is input to the terminal screen 21 shown in Fig. 2. As a result, the character string of the command candidate is received by the command execution unit 15B, and the process of step S201 shown in Fig. 8 is started.

[0085] Fig. 16 shows a subroutine of the command candidate extraction process in step S604 shown in Fig. 15. As shown in Fig. 16, the command candidate extraction unit 15E generates a list object of command candidates (step S701).

[0086] Next, command candidate extraction unit 15E repeats the processes of steps S702 to S705 a number of times corresponding to the M (natural number) lines of template described in the comment of the script stored in the list object of commands.

[0087] Furthermore, command candidate extraction unit 15E repeats the process of steps S702 to S703 a number of times corresponding to N (natural number) pairs of {information name of the search target and information value of the search target} stored in the list object of targets.

[0088] That is, if the template has {information name of the research target} (step S702 Yes), the command candidate extraction unit 15E replaces the {information name of the research target} part of the m-th template with {information value of the research target} (step S703). Also, if the template does not have {information name of the research target} (step S702 No), the process of step S703 is skipped. Note that the above "m" may be a loop counter that counts the number of rows in the M-row template.

[0089] By repeating the processes in steps S702 and S703, an attempt is made to extract command candidates of N pairs of {information name of the search target and information value of the search target} for the m-th template.

[0090] Thereafter, if there is no template in which the information value of the search target is stored in the part enclosed in curly brackets {} (No in step S704), command candidate extraction unit 15E executes the following process: That is, command candidate extraction unit 15E adds a template in which the information value of the search target is stored to the list object of command candidates (step S705).

[0091] By repeating the processes of steps S702 to S705, templates that successfully store the information value of the search target among the N pairs of {information name of the search target and information value of the search target} for each of the M templates are extracted as command candidates.

[0092] 17 and 18 show examples of command candidates extracted according to the processing procedure of the command candidate extraction script shown in FIGS. 15 and 16 and the output of the command candidates.

[0093] Fig. 17 is a diagram showing an example of a script file. An excerpt of the comment portion of the nmap command script is shown in Fig. 17. Among the comments written in the nmap command script shown in Fig. 17, the portion enclosed in curly brackets {} in the template line is replaced with the information name of the investigation target and the information value of the investigation target, and the result can be extracted as a command candidate with arguments specified.

[0094] Fig. 18 is a diagram showing an example of the execution result of a command candidate. Fig. 18 shows the execution result when the nmap command shown in Fig. 17 is executed with IPv4 "10.0.1.100" specified as an argument. As shown by the frame in Fig. 18, it can be seen that the name and port number of the service executed on the device to which IPv4 "10.0.1.100" is assigned can be collected by executing the nmap command.

[0095] <One aspect of the effect> As described above, the red team support function according to this embodiment establishes a cyclical process of executing commands input via a user interface shared among multiple terminal devices 30, extracting a survey target from the execution result, and extracting command candidates related to the survey target. Therefore, even if the members participating in the red team have a low skill level, the quality of the verification of the effectiveness of security measures is improved by repeating the above cyclical process. Therefore, according to the red team support function according to this embodiment, the variation in the verification results of the effectiveness of security measures can be suppressed. Furthermore, it is possible to realize support for human resource development, such as command input support when acquiring skills, support by team members, and situation sharing and support during CTF competitions.

[0096] <Example 2> Although the embodiments of the disclosed device have been described above, the present invention may be embodied in various different forms other than the above-described embodiments. Therefore, other embodiments included in the present invention will be described below.

[0097] <Distribution and integration> In addition, each component of each device shown in the figure does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc. For example, the terminal sharing unit 15A, the command execution unit 15B, the survey target extraction unit 15C, the survey target selection unit 15D, or the command candidate extraction unit 15E may be connected via a network as an external device of the server device 10. In addition, the terminal sharing unit 15A, the command execution unit 15B, the survey target extraction unit 15C, the survey target selection unit 15D, or the command candidate extraction unit 15E may be included in another device, and the functions of the server device 10 may be realized by cooperating with each other through a network connection.

[0098] <Hardware configuration> Moreover, the various processes described in the above embodiments can be realized by executing a prepared program on a computer such as a personal computer or a workstation. Therefore, an example of a computer that executes an assistance program having the same functions as those in the first and second embodiments will be described below with reference to FIG.

[0099] Fig. 19 is a diagram showing an example of a hardware configuration. As shown in Fig. 19, the computer 100 has an operation unit 110a, a speaker 110b, a camera 110c, a display 120, and a communication unit 130. Furthermore, the computer 100 has a CPU 150, a ROM 160, a HDD 170, and a RAM 180. These units 110 to 180 are connected via a bus 140.

[0100] As shown in Fig. 19, the HDD 170 stores an assistance program 170a that performs the same functions as the terminal sharing unit 15A, the command execution unit 15B, the investigation target extraction unit 15C, the investigation target selection unit 15D, and the command candidate extraction unit 15E shown in the above-mentioned first embodiment. This assistance program 170a may be integrated or separated like the respective components of the terminal sharing unit 15A, the command execution unit 15B, the investigation target extraction unit 15C, the investigation target selection unit 15D, and the command candidate extraction unit 15E shown in Fig. 1. In other words, the HDD 170 does not necessarily have to store all the data shown in the above-mentioned first embodiment, and it is sufficient that the data used for processing is stored in the HDD 170.

[0101] Under such an environment, the CPU 150 reads out the assistance program 170a from the HDD 170 and loads it in the RAM 180. As a result, the assistance program 170a functions as an assistance process 180a as shown in FIG. 19. The assistance process 180a loads various data read out from the HDD 170 in an area of ​​the storage area of ​​the RAM 180 that is assigned to the assistance process 180a, and executes various processes using the loaded various data. For example, the processes shown in FIG. 7, FIG. 8, FIG. 10, FIG. 11, and FIG. 14 to FIG. 16 may be included as examples of the processes executed by the assistance process 180a. Note that in the CPU 150, it is not necessary for all the processing units shown in the above-mentioned first embodiment to operate, and it is sufficient that the processing units corresponding to the processes to be executed are virtually realized.

[0102] The assistance program 170a does not necessarily have to be stored in the HDD 170 or the ROM 160 from the beginning. For example, the assistance program 170a is stored in a "portable physical medium" such as a flexible disk, a so-called FD, a CD-ROM, a DVD disk, a magneto-optical disk, or an IC card that is inserted into the computer 100. The computer 100 may then obtain and execute the assistance program 170a from such a portable physical medium. The assistance program 170a may also be stored in another computer or a server device connected to the computer 100 via a public line, the Internet, a LAN, a WAN, or the like. The assistance program 170a thus stored may be downloaded to the computer 100 and then executed.

[0103] The following supplementary notes are further disclosed regarding the embodiments including the above examples.

[0104] (Appendix 1) Executing commands entered via a user interface shared among multiple terminal devices; Extracting target information that will be the next target of investigation after the command from the execution result of the command; displaying command candidates related to the target information in the user interface; A support program that causes a computer to execute a process.

[0105] (Appendix 2) The assistance program described in Appendix 1, characterized in that the user interface includes a command line interface that accepts input of the commands from the multiple terminal devices and displays the results of executing the commands, a first component that displays the target information, and a second component that displays the command candidates.

[0106] (Appendix 3) The assistance program according to appendix 2, characterized in that the target information is displayed in the first component in a tree format or a table format.

[0107] (Appendix 4) The assistance program described in Appendix 2, characterized in that command candidates related to target information selected from each of the multiple terminal devices among the target information displayed in the first component are displayed in the second component.

[0108] (Supplementary Note 5) The support program according to Supplementary Note 2, characterized in that a command line interface that is selected from among a plurality of command line interfaces and accepted from each of the plurality of terminal devices is displayed.

[0109] (Supplementary Note 6) The assistance program according to Supplementary Note 1, wherein the command candidates are commands in which the target information is specified as an argument.

[0110] (Appendix 7) Executing commands entered via a user interface shared among multiple terminal devices; Extracting target information that will be the next target of investigation after the command from the execution result of the command; displaying command candidates related to the target information in the user interface; A support method characterized in that the processing is executed by a computer.

[0111] (Appendix 8) The support method described in Appendix 7, characterized in that the user interface includes a command line interface that accepts input of the commands from the multiple terminal devices and displays the results of executing the commands, a first component that displays the target information, and a second component that displays the command candidates.

[0112] (Appendix 9) The support method described in Appendix 8, characterized in that the target information is displayed in the first component in a tree format or a table format.

[0113] (Appendix 10) The support method described in Appendix 8, characterized in that command candidates related to target information selected from each of the multiple terminal devices among the target information displayed in the first component are displayed in the second component.

[0114] (Supplementary Note 11) The support method according to Supplementary Note 8, characterized in that a command line interface that is selected from among a plurality of command line interfaces and accepted from each of the plurality of terminal devices is displayed.

[0115] (Supplementary Note 12) The support method according to Supplementary Note 7, wherein the command candidates are commands in which the target information is specified as an argument.

[0116] (Appendix 13) Executing commands input via a user interface shared among a plurality of terminal devices; Extracting target information that will be the next target of investigation after the command from the execution result of the command; displaying command candidates related to the target information in the user interface; 1. An information processing device comprising: a control unit that executes processing.

[0117] (Appendix 14) The information processing device described in Appendix 13, characterized in that the user interface includes a command line interface that accepts input of the commands from the multiple terminal devices and displays the execution results of the commands, a first component that displays the target information, and a second component that displays the command candidates.

[0118] (Supplementary Note 15) The information processing device according to Supplementary Note 14, characterized in that the target information is displayed in the first component in a tree format or a table format.

[0119] (Appendix 16) The information processing device described in Appendix 14, characterized in that command candidates related to target information displayed in the first component and selected from each of the multiple terminal devices are displayed in the second component.

[0120] (Supplementary Note 17) The information processing device according to Supplementary Note 14, characterized in that a command line interface that is selected from among a plurality of command line interfaces and accepted from each of the plurality of terminal devices is displayed.

[0121] (Supplementary Note 18) The information processing device according to Supplementary Note 13, wherein the command candidates are commands in which the target information is specified as an argument. [Explanation of symbols]

[0122] 10. Server equipment 11 Communication control section 13 Storage section 13A Comment Knowledge DB 13B Survey target DB 15 Control section 15A Terminal sharing section 15B Command Execution Section 15C Survey target extraction section 15D Survey target selection section 15E Command candidate extraction unit 30 Terminal Equipment

Claims

1. Executing commands entered via a user interface shared among a plurality of terminal devices; Extracting target information that will be the next target of investigation after the command from the execution result of the command; displaying command candidates related to the target information in the user interface; A support program that causes a computer to execute a process.

2. The assistance program according to claim 1, characterized in that the user interface includes a command line interface that accepts input of the commands from the multiple terminal devices and displays the execution results of the commands, a first component that displays the target information, and a second component that displays the command candidates.

3. 3. The support program according to claim 2, wherein the target information is displayed in the first component in a tree format or a table format.

4. The assistance program according to claim 2, characterized in that command candidates related to target information selected from each of the plurality of terminal devices among the target information displayed in the first component are displayed in the second component.

5. 3. The support program according to claim 2, wherein a command line interface selected from among a plurality of command line interfaces is displayed from each of the plurality of terminal devices.

6. 6. The support program according to claim 1, wherein the command candidates are commands in which the target information is specified as an argument.

7. Executing commands entered via a user interface shared among a plurality of terminal devices; Extracting target information that will be the next target of investigation after the command from the execution result of the command; displaying command candidates related to the target information in the user interface; A support method characterized in that the processing is executed by a computer.

8. Executing commands entered via a user interface shared among a plurality of terminal devices; Extracting target information that will be the next target of investigation after the command from the execution result of the command; displaying command candidates related to the target information in the user interface; 1. An information processing device comprising: a control unit that executes processing.

Images