Display apparatus, display method and program

Abstract

To provide a display apparatus or the like which can grasp cyber attack trends.SOLUTION: A display apparatus of the present disclosure comprises: acquisition means for acquiring cyber attack information including information on companies affected by plural cyber attack groups using dedicated tools or websites viewable by executing specified setting; and display means for displaying the cyber attack information by the plural cyber attack groups.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a display device, a display method, and a program. [Background technology]

[0002] There are technologies that provide trends related to cyber attacks. For example, Patent Literature 1 discloses a technology that recommends articles about threat information related to cyber attacks to users. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-131715 Summary of the Invention [Problem to be solved by the invention]

[0004] In order to grasp the trend of cyber attacks, quantitative data showing what types of attacks are frequently performed may be required. However, with the invention described in Patent Document 1, it is difficult to compile quantitative data from threat information related to each cyber attack.

[0005] One example of the objective of the present disclosure is to provide a display device etc. that enables trends in cyber attacks to be grasped. [Means for solving the problem]

[0006] A display device in one aspect of the present disclosure includes an acquisition means for acquiring cyber-attack information including information on victim companies by multiple cyber-attack groups using a dedicated tool or a website that can be viewed by configuring specific settings, and a display means for displaying the cyber-attack information by the multiple cyber-attack groups.

[0007] A display method in one aspect of the present disclosure involves a computer using a dedicated tool or a website that can be viewed with specific settings to obtain cyber-attack information including information on companies victimized by multiple cyber-attack groups, and displaying the cyber-attack information by the multiple cyber-attack groups.

[0008] A program in one aspect of the present disclosure uses a dedicated tool or a website that can be viewed by configuring specific settings to obtain cyber attack information including information on companies victimized by multiple cyber attack groups, and displays the cyber attack information by the multiple cyber attack groups. Effect of the Invention

[0009] One example of an effect of the present disclosure is that it is possible to provide a display device that can grasp trends in cyber attacks. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a functional block diagram showing an example of a configuration of a display device according to the present disclosure. [Diagram 2] FIG. 2 is a diagram showing a hardware configuration in which the display device according to the present disclosure is realized by a computer device and its peripheral devices. [Diagram 3] FIG. 3 is an example of a display screen displaying information on cyber attacks by multiple cyber attack groups in this disclosure. [Figure 4] FIG. 4 is a flowchart showing the operation of the display device according to the present disclosure. [Diagram 5] FIG. 5 is a functional block diagram showing an example of a configuration of a display device according to the present disclosure. [Figure 6A] FIG. 6A is an example of a display screen displaying the number of cyber attacks by cyber attack group in this disclosure. [Figure 6B] FIG. 6B is an example of a display screen displaying the number of cyber attacks by cyber attack group in this disclosure. [Figure 7]FIG. 7 is an example of a display screen according to the present disclosure that displays the number of cyber attacks by type of victim company. [Figure 8] FIG. 8 is an example of a display screen according to the present disclosure that displays the number of cyber attacks by type of victim company. [Figure 9] FIG. 9 is a flowchart showing the operation of the display device according to the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, embodiments of a display device, a display method, a program, and a non-transitory recording medium for recording a program according to the present disclosure will be described in detail with reference to the drawings. The present disclosure does not limit the technology.

[0012] [First embodiment] 1 is a functional block diagram showing an example of a configuration of a display device 100 according to the present disclosure. The display device 100 is a device for displaying cyber-attack information of a plurality of cyber-attack groups. Referring to FIG. 1, the display device 100 includes an acquisition unit 101 and a display unit 102.

[0013] A cyber attack group refers to an entity that launches cyber attacks against a company, and there is no limitation on its form. The entity may be an individual or a group. There is no limitation on the method of the cyber attack, but an example of such a method is a cyber attack using ransomware.

[0014] Fig. 2 is a diagram showing an example of a hardware configuration in which the display device 100 according to the present disclosure is realized by a computer device 500 including a processor. As shown in Fig. 2, the display device 100 includes a central processing unit (CPU) 501, memories such as a read only memory (ROM) 502 and a random access memory (RAM) 503, a storage device 505 such as a hard disk for storing a program 504, a communication interface 508 for network connection, and an input / output interface 511 for inputting and outputting data.

[0015] The CPU 501 operates an operating system to control the entire display device 100 according to the present disclosure. The CPU 501 also reads out programs and data from a recording medium 506 mounted in, for example, a drive device 507 into a memory. The CPU 501 also functions as the acquisition unit 101 and the display unit 102 in the present disclosure, or as a part of these, and executes processes or commands in the flowchart shown in FIG. 4, which will be described later, based on the programs.

[0016] The recording medium 506 is, for example, an optical disk, a flexible disk, a magneto-optical disk, an external hard disk, or a semiconductor memory. A recording medium that is a part of the storage device is a non-volatile storage device, and the program is recorded therein. The program may also be downloaded from an external computer (not shown) that is connected to a communication network.

[0017] The input device 509 is realized by, for example, a mouse, a keyboard, built-in key buttons, etc., and is used for input operations. The input device 509 is not limited to a mouse, a keyboard, or built-in key buttons, and may be, for example, a touch panel. The output device 510 is realized by, for example, a display, and is used to check the display.

[0018] As described above, the display device 100 in the present disclosure is realized by the computer hardware shown in FIG. 2. However, the means for realizing each unit of the display device 100 in FIG. 1 is not limited to the configuration described above. The display device 100 may be realized by one physically combined device, or may be realized by two or more physically separated devices connected by wire or wirelessly. The display device 100 may further include a display device such as a display, or may be configured as a system realized by the display device 100 and another device.

[0019] The acquisition unit 101 acquires cyber attack information, including information on companies victimized by multiple cyber attack groups, using a dedicated tool or a website that can be viewed by making specific settings.

[0020] Here, cyberattack information to be monitored in this disclosure will be described. The Internet space is divided into three spaces: the surface web, the deep web, and the dark web. The surface web is a collection of normal websites without anonymity, and is a highly accessible web space that can be searched by a general search engine. The deep web is a web space that exists in a web space without anonymity of the source, but is not displayed in a search engine search, or is a closed, member-only web space whose existence cannot be recognized by a search engine. The dark web is a web space with anonymity of the source, and is a site space separated for each confidential service that cannot be searched by a general search engine. Examples of confidential services include Tor (The Onion Router) and I2P (Invisible Internet Project). In this disclosure, the acquisition unit 101 acquires cyberattack information of threats (exposure-type ransomware) active in the deep web and dark web spaces.

[0021] The acquisition unit 101 acquires cyber-attack information from the deep web and the dark web, for example, by the following method. That is, the acquisition unit 101 acquires cyber-attack information by monitoring and analyzing a specific site or a specific SNS (Telegram) that is set as a monitoring target for the deep web. In this case, the acquisition unit 101 monitors a specific site or SNS using an RSS feed, direct URL access, Telegram app, or the like. The acquisition unit 101 acquires cyber-attack information for the dark web by using a specific tool or setting. The acquisition unit 101 utilizes, for example, browsing using the Tor browser, or web scraping using Tor (Tor.exe) and socks5 proxy setting in Python. The acquisition unit 101 acquires cyber-attack information by monitoring and analyzing a specific site that is set as a monitoring target.

[0022] The acquisition unit 101 acquires cyberattack information from, for example, cyberattack claims posted on the dark web by each cyberattack group. The cyberattack information includes at least the name of the cyberattack group, the date of the attack, and information on the victim company. The cyberattack group name includes not only known group names but also newly emerged group names. The information on the victim company may include the victim company name, industry, location of the company, and the country of the company. In this specification, the country of the company refers to the location of the company's head office. In addition, the acquisition unit 101 may acquire cyberattack information from information other than the claims of responsibility by the cyberattack group, as long as the above-mentioned information on the cyberattack group name, the date of the attack, and the victim company is posted. When the acquisition unit 101 acquires cyberattack information by multiple cyberattack groups, it outputs the information to the display unit 102.

[0023] The display unit 102 is a means for displaying cyber-attack information by a plurality of cyber-attack groups. The display unit 103 displays the cyber-attack information on the output device 510 or the like. The display unit 103 may also generate a screen showing the cyber-attack information and display the generated screen on a device other than the display device 100.

[0024] FIG. 3 is an example of a display screen displaying cyberattack information by multiple cyberattack groups in the present disclosure. As shown in FIG. 3, a list of the attack date, the attack group name, the industry of the victim company, the country name of the victim company, and the victim company name is displayed as each cyberattack information. In FIG. 3, for example, a filtering function may be provided to display only specific cyberattack information. For example, the display unit 102 may receive a selection of information on the attack date, the attack group, and the victim company, and display only the selected cyber company information. In addition, the display unit 102 may change the display mode depending on the size of the victim company. For example, when the size of the victim company is a predetermined size or larger, the display unit 102 may change the color or font of the text to highlight it.

[0025] The operation of the display device 100 configured as above will be described with reference to the flowchart of FIG.

[0026] 4 is a flowchart showing an outline of the operation of the display device 100 according to the present disclosure. Note that the processing according to this flowchart may be executed based on program control by the above-mentioned processor.

[0027] As shown in Fig. 4, first, the acquisition unit 101 acquires cyber-attack information including information on victim companies by multiple cyber-attack groups using a dedicated tool or a website that can be viewed by making specific settings (step S101). Next, the display unit 102 displays the cyber-attack information by the multiple cyber-attack groups (step S102). With this, the display device 100 ends its operation.

[0028] In the display device 100 of the present disclosure, the acquisition unit 101 acquires cyber-attack information including information on victim companies by multiple cyber-attack groups using a dedicated tool or a website that can be viewed by performing specific settings. Then, the display unit 102 displays the cyber-attack information by the multiple cyber-attack groups. In this manner, by displaying the cyber-attack information by the multiple cyber-attack groups, it is possible to grasp the trends of cyber-attacks.

[0029] In particular, on sites that cannot be viewed with a normal browser, such as the dark web, each cyber attack group may individually announce a claim of responsibility. In this case, even if attack information for each cyber attack group is obtained, it is not possible to know which attack group is committing the most cyber attacks on which companies. On the other hand, by displaying cyber attack information by multiple cyber attack groups, as in the display device 100 of the present disclosure, it is possible to understand the trends of cyber attacks and to easily understand cyber attack groups that the company should be aware of and damage information for companies that do business with the company.

[0030] [Second embodiment] Next, the second embodiment will be described in detail with reference to the drawings. Below, the description of the second embodiment will be omitted to the extent that the description of the present embodiment is not unclear. Each component in each embodiment of the present disclosure can be realized not only by hardware but also by a computer device or software based on program control, as in the computer device shown in FIG. 2.

[0031] In this embodiment, the number of cyber attacks is displayed by cyber attack group or type based on the acquired cyber attack information.

[0032] 5 is a functional block diagram showing an example of the configuration of a display device according to the present disclosure. Display device 110 will be described with reference to FIG.

[0033] The display device 110 includes an acquisition unit 111, a counting unit 112, and a display unit 113. The acquisition unit 111 in the display device 110 has the same configuration and function as the acquisition unit 101 in the display device 100, and therefore a description thereof will be omitted here.

[0034] The counting unit 112 is a means for counting the number of cyber attacks by cyber attack group or by type of victim company based on the cyber attack information. The counting unit 112 extracts the cyber attack information acquired by the acquisition unit 111 by cyber attack group or by type of victim company, and counts the extracted number of cyber attacks. Examples of the type of victim company include the industry of the victim company, the country in which the victim company is located, or the country in which the victim company is located (the country in which the head office is located). The number of cyber attacks counted in this manner is output to the display unit 113.

[0035] The display unit 113 displays the number of cyber attacks for each cyber attack group or type. The display method by the display unit 113 is the same as that of the first embodiment. In the display device 110, the counting unit 112 may count the number of cyber attacks for each cyber attack group or type of victim company from a predetermined period ago, and the display unit 113 may display the difference in the number of cyber attacks from the predetermined period ago. In addition, in the display device 110, the counting unit 112 may count the number of cyber attacks for each cyber attack group or type of victim company from each predetermined period, and the display unit 113 may display the number of cyber attacks for each predetermined period. In addition, in the display device 110, the counting unit 112 may count the cumulative number of cyber attacks for each cyber attack group or type from a predetermined time, and the display unit 113 may display the cumulative number.

[0036] Next, the display screen of the number of cyber attacks by attack group and the number of cyber attacks by industry of victim companies will be described with reference to Figs. 6 to 8. Fig. 6 is an example of a display screen displaying the number of cyber attacks by cyber attack group in the present disclosure. However, Fig. 6 is one example of displaying the number of cyber attacks by cyber attack group, and is not limited to the example of Fig. 6. The display screen 20 of the number of cyber attacks in Fig. 6 includes a filtering area 21 for filtering the number of cyber attacks to be displayed, and a display area 22 of the number of cyber attacks.

[0037] 6, the filtering area 21 allows the user to use a pull-down menu to select the number of cyber attacks to be displayed in the display area 22. As shown in Fig. 6, the filtering area 21 displays an associated organization filter, a country filter, and an attack group filter, and in the example of Fig. 6, the display of all the numbers of cyber attacks has been selected.

[0038] The related organization filter is a filter for selecting the country of the victim company, and in the example of Figure 6, a filter for selecting a Japanese company is shown. A Japanese company refers to a company whose head office is in Japan. By filtering the number of cyber attacks displayed by the country of the victim company, for example, if the victim company is an overseas subsidiary of a Japanese company, other Japanese companies that do business with the victim company can easily understand the impact of the cyber attack. In addition, the location country filter is a filter for selecting the country in which the victim company is located. Even if the company is Japanese, its overseas subsidiaries are included in the country in which the subsidiary is located. The attack group filter allows you to display cyber attack information for only the selected groups by selecting each group name.

[0039] 6, the display area 22 displays a pie chart (22A) of the cumulative number of cyber attacks by cyber attack group, a table (22B) of the cumulative number of cyber attacks by cyber attack group, a line graph (22C) of the cumulative number of cyber attacks by cyber attack group, and a line graph (22D) of the monthly number of cyber attacks by cyber attack group. By displaying not only the cumulative number of cyber attacks but also the monthly number, the temporal transition and trend of the number of cyber attacks can be understood.

[0040] In addition, in the example of Figure 6, in the table (22B) of the cumulative number of cyber attacks by cyber attack group, the difference from the cumulative number of each cyber attack group from a predetermined period ago is displayed next to the cumulative number of each cyber attack group. In the example of Figure 6, the difference from the number of cyber attacks from 30 days ago is displayed.

[0041] Fig. 7 is an example of a display screen showing the number of cyber attacks by type of victim company in this disclosure. The example in Fig. 7 shows the number of cyber attacks by industry of the victim company. In Fig. 7, examples of industries include IT, construction and real estate, consulting, retail and wholesale, medical and pharmaceutical, and energy and resources, but the examples of industries are not limited to these classifications.

[0042] In addition, in Fig. 7, the display area 32 displays a pie chart (32A) of the cumulative number of cyber attacks by industry, a table (32B) of the cumulative number of cyber attacks by industry, a line graph (32C) of the cumulative number of cyber attacks by industry, and a line graph (32D) of the monthly number of cyber attacks by industry. In addition, in the table (32B) of the cumulative number of cyber attacks by industry, the difference from the cumulative number of cyber attacks on each industry is displayed next to each of the cumulative numbers. As shown in Fig. 7, by displaying the number of cyber attacks by industry, it is possible to understand the industries targeted by cyber attack groups.

[0043] FIG. 8 is an example of a display screen showing the number of cyber attacks by type of victim company in the present disclosure. The example of FIG. 8 shows the number of cyber attacks by country of the victim company. In FIG. 8, the display area 42 shows a pie chart (42A) of the cumulative number of cyber attacks by country of the victim company, a table (42B) of the cumulative number of cyber attacks by country of the victim company, a line graph (42C) of the cumulative number of cyber attacks by country of the victim company, and a line graph (42D) of the monthly number of cyber attacks by country of the victim company. In addition, in the table (42B) of the cumulative number of cyber attacks by country of the victim company, the difference from 30 days ago is displayed next to the cumulative number of cyber attacks by country of the victim company. As shown in FIG. 8, by showing the number of cyber attacks by country of the victim company, it is possible to grasp the country of the company that is being attacked by the cyber attack group.

[0044] The operation of the display device 110 configured as above will be described with reference to the flowchart of FIG.

[0045] 9 is a flowchart showing an outline of the operation of the display device 110 in the second embodiment. Note that the processing according to this flowchart may be executed based on program control by the above-mentioned processor.

[0046] As shown in Fig. 9, first, the acquisition unit 111 acquires cyberattack information including information on victim companies by multiple cyberattack groups using a dedicated tool or a website that can be viewed by making specific settings (step S201). Next, the counting unit 112 counts the number of cyberattacks for each cyberattack group or for each type of victim company based on the cyberattack information (step S202). Finally, the display unit 113 displays the number of cyberattacks for each cyberattack group or type (step S203). This ends the processing according to the flowchart.

[0047] In the display device 110 of the present disclosure, the counting unit 112 counts the number of cyberattacks for each cyberattack group or for each type of victim company based on the cyberattack information, and the display unit 113 displays the number of cyberattacks for each cyberattack group or for each type. This makes it possible to grasp information on attack groups that have committed many cyberattacks and information on companies that have been the victims of many cyberattacks.

[0048] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above-mentioned embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0049] For example, although a number of operations are described in a sequence in the form of a flowchart, the sequence does not limit the order in which the operations are performed. Therefore, when implementing each embodiment, the sequence of the operations can be changed as long as it does not affect the content.

[0050] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes.

[0051] (Appendix 1) An acquisition means for acquiring cyber attack information, including information on victim companies, by multiple cyber attack groups using a dedicated tool or a website that can be viewed by making specific settings; A display device comprising: a display means for displaying the cyber attack information by the multiple cyber attack groups.

[0052] (Appendix 2) The method further includes a counting means for counting the number of cyber attacks by cyber attack group or by type of victim company based on the cyber attack information, The display device according to claim 1, wherein the display means displays the number of cyber attacks by cyber attack group or by type.

[0053] (Appendix 3) The counting means counts the number of cyber attacks by industry of the victim company, The display device according to claim 2, wherein the display means displays the number of cyber attacks for each industry.

[0054] (Appendix 4) The counting means counts the number of cyber attacks for each country in which the victim company is located, The display device according to claim 2, wherein the display means displays the number of cyber attacks for each country.

[0055] (Appendix 5) The counting means counts the number of cyber attacks for each country in which the victim company's headquarters is located, The display device according to claim 2, wherein the display means displays the number of cyber attacks for each country in which the head office is located.

[0056] (Appendix 6) The counting means counts the number of cyber-attacks by cyber-attack group or by type of victim company during a predetermined period of time, The display device according to any one of appendixes 2 to 5, wherein the display means further displays a difference in the number of cyber attacks from the predetermined period before.

[0057] (Appendix 7) The counting means counts the number of cyber-attacks for each cyber-attack group or each type of victim company for each specified period, The display device according to any one of appendixes 2 to 5, wherein the display means displays the number of cyber attacks for each predetermined period.

[0058] (Appendix 8) The counting means counts the cumulative number of the cyber-attacks for each cyber-attack group or each cyber-attack type from a predetermined time period, 6. The display device according to claim 2, wherein the display means displays the cumulative number.

[0059] (Appendix 9) The computer Using a dedicated tool or a website that can be accessed by configuring specific settings, the company obtains cyberattack information, including information on companies victimized by multiple cyberattack groups, A display method for displaying the cyber attack information by the multiple cyber attack groups.

[0060] (Appendix 10) Based on the cyberattack information, the number of cyberattacks is further counted by cyberattack group or by type of victim company; The display method of claim 9, wherein in the displaying step, the number of cyber attacks is displayed by cyber attack group or by type.

[0061] (Appendix 11) In the counting step, the number of cyber attacks is counted for each industry of the victim company; The display method according to claim 10, wherein in the displaying step, the number of cyber attacks for each industry is displayed.

[0062] (Appendix 12) In the counting step, the number of cyber attacks is counted for each country in which the victim company is located; The display method of claim 10, wherein in the displaying step, the number of cyber attacks is displayed for each country of location.

[0063] (Appendix 13) In the counting step, the number of cyber attacks is counted for each country in which the victim company's headquarters is located; The display method according to claim 10, wherein in the displaying step, the number of cyber attacks is displayed for each country in which the head office is located.

[0064] (Appendix 14) In the counting step, the number of cyber attacks for each cyber attack group or each type of victim company during a predetermined period of time is counted, The display method according to any one of appendices 10 to 13, further comprising displaying a difference in the number of cyber attacks from the specified period before in the display step.

[0065] (Appendix 15) In the counting step, the number of cyber attacks is counted for each cyber attack group or each type of victim company for each predetermined period, The display method according to any one of appendices 10 to 13, wherein in the displaying step, the number of cyber attacks is displayed for each of the specified periods.

[0066] (Appendix 16) In the counting step, a cumulative number of the cyber-attacks is counted for each of the cyber-attack groups or each of the types from a predetermined time period; The display method according to any one of appendices 10 to 13, wherein the display means displays the cumulative number.

[0067] (Appendix 17) On the computer, Using a dedicated tool or a website that can be accessed by configuring specific settings, the company obtains cyberattack information, including information on companies victimized by multiple cyberattack groups, A program that executes the following: displaying the cyber attack information by the multiple cyber attack groups.

[0068] (Appendix 18) Based on the cyberattack information, the number of cyberattacks is further counted by cyberattack group or by type of victim company; The program described in Appendix 17, wherein in the displaying step, the number of cyber attacks is displayed for each cyber attack group or each type.

[0069] (Appendix 19) In the counting step, the number of cyber attacks is counted for each industry of the victim company; 19. The program described in claim 18, wherein in the displaying step, the number of cyber attacks for each industry is displayed.

[0070] (Appendix 20) In the counting step, the number of cyber attacks is counted for each country in which the victim company is located; 19. The program described in claim 18, wherein in the displaying step, the number of cyber attacks is displayed for each country of location.

[0071] (Appendix 21) In the counting step, the number of cyber attacks is counted for each country in which the victim company's headquarters is located; 19. The program described in claim 18, wherein in the displaying step, the number of cyber attacks is displayed for each country in which the head office is located.

[0072] (Appendix 22) In the counting step, the number of cyber attacks for each cyber attack group or each type of victim company during a predetermined period of time is counted, 22. The program according to any one of appendices 18 to 21, wherein in the displaying step, the difference in the number of cyber attacks from the specified period before is further displayed.

[0073] (Appendix 23) In the counting step, the number of cyber attacks is counted for each cyber attack group or each type of victim company for each predetermined period, 22. The program described in any one of appendices 18 to 21, wherein in the displaying step, the number of cyber attacks is displayed for each specified period.

[0074] (Appendix 24) In the counting step, a cumulative number of the cyber-attacks is counted for each of the cyber-attack groups or each of the types from a predetermined time period; 22. The program according to any one of appendices 18 to 21, wherein in the displaying step, the cumulative number is displayed. [Explanation of symbols]

[0075] 100, 110 display device 101, 111 Acquisition Department 102, 113 Display section 112 Counting Department 500 Computer equipment 501 CPU 502 ROM 503 RAM 504 Program 505 Storage device 506 Recording media 507 Drive Unit 508 Communication Interface 511 Input / Output Interface 512 Bus

Claims

1. An acquisition means for acquiring cyber attack information, including information on companies victimized by multiple cyber attack groups, using a dedicated tool or a website that can be viewed by making specific settings; A display device comprising: a display means for displaying the cyber attack information by the multiple cyber attack groups.

2. The method further includes a counting means for counting the number of cyber attacks by cyber attack group or by type of victim company based on the cyber attack information, The display device according to claim 1 , wherein the display means displays the number of cyber-attacks for each cyber-attack group or each cyber-attack type.

3. The counting means counts the number of cyber attacks by industry of the victim company, The display device according to claim 2 , wherein the display means displays the number of cyber attacks for each business type.

4. The counting means counts the number of cyber attacks for each country in which the victim company is located, The display device according to claim 2 , wherein the display means displays the number of cyber attacks for each country.

5. The counting means counts the number of cyber attacks for each country in which the victim company's headquarters is located, The display device according to claim 2 , wherein the display means displays the number of cyber attacks for each country in which the head office is located.

6. The counting means counts the number of cyber-attacks by cyber-attack group or by type of victim company during a predetermined period of time, The display device according to claim 2 , wherein the display means further displays a difference in the number of cyber attacks from the predetermined period before.

7. The counting means counts the number of cyber-attacks for each cyber-attack group or each type of victim company for each specified period, The display device according to claim 2 , wherein the display means displays the number of cyber attacks for each of the predetermined periods.

8. The counting means counts the cumulative number of the cyber-attacks for each cyber-attack group or each cyber-attack type from a predetermined time period, The display device according to claim 2, wherein the display means displays the cumulative number.

9. The computer Using a dedicated tool or a website that can be accessed by configuring specific settings, the company obtains cyberattack information, including information on companies victimized by multiple cyberattack groups, A display method for displaying the cyber attack information by the multiple cyber attack groups.

10. On the computer, Using a dedicated tool or a website that can be accessed by configuring specific settings, the company obtains cyberattack information, including information on companies victimized by multiple cyberattack groups, A program that executes the following: displaying the cyber attack information by the multiple cyber attack groups.

Images