Risk analysis device, risk analysis method, and risk analysis program

Abstract

To provide a risk analysis device, a risk analysis method, and a risk analysis program to analyze which of deceptive elements in target type attack training content a user in the organization was deceived by and to grasp which element the organization is vulnerable to.SOLUTION: A risk analysis device comprises a content structuring part that sets a parameter as an explanatory variable that indicates the presence of a deceptive element in at least source information, subject information, body content, and each of elements in the body of training content used for training against target type attacks, a learning data generation part that generates learning data that is associated with the parameter of the training content and the percentage of users in the organization deceived by the training content as an objective variable, and a learning model generation part that generates a learning model using the learning data.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a risk analysis device, a risk analysis method, and a risk analysis program for analyzing the details of a deception that occurs when a user within an organization is deceived by training content for targeted attacks. [Background technology]

[0002] In recent years, targeted attack emails have become more sophisticated and many damages have been caused. Therefore, it is becoming more important to conduct targeted attack training for users in organizations such as companies and universities using training content, which is a training email for targeted attacks.

[0003] For example, in Non-Patent Documents 1 and 2, training is conducted within an organization in which easy-to-deceive targeted attack training emails are created and sent to users within the organization, as a measure to raise user awareness through this training. In addition, as attacks become more sophisticated, the training content must also be designed to be easily deceived by users. Non-Patent Document 3 proposes a method for automatically generating training email text. By analyzing emails sent to each user, sender addresses and frequently used words are extracted, and by incorporating these, the text of training emails that are easily deceived by users are created. Patent Document 1 provides a mechanism for estimating the skill level of each user based on the response of the user to a training email, and for providing the user with a training email suited to the user's skill level. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2019-160066 A [Non-patent literature]

[0005] [Non-Patent Document 1] Nobuki Matsubara, "Countermeasures against targeted email attacks," Technical Reports by Technical Staff 27 (2019): 23-26. [Non-Patent Document 2] Nobuhisa Onozaki et al., "Targeted Attack Email Response Training at Tohoku University," SENAC: Tohoku University Cyberscience Center Public Relations, 52(1) 40-44, Jan, 2019 [Non-Patent Document 3] Keisuke Ikejiri et al., “Proposal of a system to automatically generate emails to be used in training against targeted attacks,” Proceedings of the 82nd National Conference 2020.1 (2020): 417-418. Summary of the Invention [Problem to be solved by the invention]

[0006] By conducting training, it is possible to grasp the degree of potential risk to an organization (such as the percentage of users who are deceived), and it is expected that by deceiving the subjects, they will gain a better understanding of attacks. However, although there is an accumulation of data sets on the percentage of users who were deceived in the training and the type of information that deceived them, it is not possible to perform detailed analysis. Not only the body of the training email, which can be easily deceived by users, but also header information, etc. must be taken into account. Furthermore, it is not clear whether the personalized body of the email will necessarily be deceptive. Although personalization is possible from the perspective of individual skill levels, it does not take into account whether the content is optimal for the organization.

[0007] The present invention aims to provide a risk analysis device, a risk analysis method, and a risk analysis program that analyze which of the deceptive elements in training content for targeted attacks has deceived users within an organization, and determine which elements the organization is vulnerable to. [Means for solving the problem]

[0008] The risk analysis device of the present invention comprises a content structuring unit that sets parameters indicating the presence or absence of deceptive elements as explanatory variables for at least the sender information, subject information, text content, and elements contained in the text in training content used for training against targeted attacks, a learning data generation unit that generates learning data linking the parameters of the training content with the proportion of users within an organization who were deceived by the training content as an objective variable, and a learning model generation unit that generates a learning model using the learning data.

[0009] The learning model generation unit may apply generalized linear regression analysis to the learning data to generate a regression model as the learning model.

[0010] The risk analysis device may further include an effect prediction unit that inputs the parameters of the created new training content into the learning model and estimates the percentage of users within the organization that will be deceived by the new training content.

[0011] The sender information may include at least one of whether the sender address is forged, whether the sender name is forged, and whether the domain is within the organization.

[0012] The subject information may include at least one of whether or not it includes content urging the user, whether or not it includes content indicating the importance of the training content, and whether or not the subject is in a reply format or a forwarding format.

[0013] The content of the text may include at least one of the following: whether the text uses awkward Japanese, whether the content requests a response from the user, whether it contains urgent content, whether it contains content related to money, whether it contains content related to health, whether it contains content that will attract the user, and whether it contains security-related content.

[0014] The elements included in the text may include any one of whether or not the text includes a URL, and whether or not anchor text in the text matches an actual URL.

[0015] The organization may be at least a company, a government office, a school, a factory, or a hospital facility, or a department included in the facility.

[0016] The risk analysis method of the present invention is carried out by a computer, and includes a content structuring step of setting parameters indicating the presence or absence of deceptive elements as explanatory variables for at least the sender information, subject information, text content, and elements contained in the text in training content used for training against targeted attacks, a learning data generation step of generating learning data linking the parameters of the training content with the proportion of users within an organization who were deceived by the training content as an objective variable, and a learning model generation step of generating a learning model using the learning data.

[0017] A risk analysis program according to the present invention causes a computer to function as the risk analysis device. Effect of the Invention

[0018] According to the present invention, it is possible to analyze which of the deceptive elements in the training content for targeted attacks deceived users within an organization, and to understand which elements the organization is vulnerable to. [Brief description of the drawings]

[0019] [Figure 1] FIG. 2 is a diagram illustrating a functional configuration of a risk analysis device according to an embodiment. [Diagram 2] 10 is a flowchart illustrating a risk analysis process of the risk analysis device in the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0020] An example of an embodiment of the present invention will now be described. In order to analyze which element of the deception techniques set in the training deceived users in the organization, the risk analysis device of this embodiment uses structural data of training content (e.g., email headers, content configuration, etc.) as explanatory variables, and creates a learning model that estimates email response situations in the training (e.g., opening attachments, accessing links, etc.), thereby grasping what structures the organization is vulnerable to. This allows the risk analysis device to utilize the accumulated data as know-how, which can be used to raise awareness to improve attention to real targeted attacks, and to create optimal training content for each organization. In addition, when new training content is created, the risk analysis device of this embodiment creates structured data and inputs it into the learning model, thereby making it possible to estimate the percentage of users who will be deceived in training, and to create training content that is optimal for each organization.

[0021] As an example of training content for targeted attacks, it is assumed that a user is checking e-mail. For example, while the user is checking e-mail, a function for recording a log of whether or not an attachment was opened or whether or not a link was clicked and accessed is implemented in an e-mail application or the like. As a result, the terminal as a risk analysis device can use logs recorded by email applications, etc. to analyze content that users of a company or other organization are likely to be deceived by, and can understand what types of attacks the organization is vulnerable to, and can use this information to raise awareness and consider the next training content.

[0022] FIG. 1 is a diagram showing the functional configuration of a risk analysis device 1 in this embodiment. The risk analysis device 1 is an information processing device (computer) equipped with various data input / output devices, communication devices, etc., in addition to the control unit 10 and the storage unit 20. The risk analysis device 1 is a terminal on which software for generating learning data using the ratio of users deceived by each training content as a target variable in order to set parameters (structured data) by structuring multiple training contents (emails) of targeted attacks previously sent to users in an organization and link the parameters of each training content with the response status of the organization (opening an attachment, accessing a link, etc.), software for generating a learning model based on the learning data, and add-ons for realizing each function of this embodiment are installed.

[0023] The control unit 10 is a part that controls the entire risk analysis device 1, and operates as each functional unit described below by appropriately reading and executing various programs stored in the storage unit 20, thereby realizing each function in this embodiment. The control unit 10 may be a CPU.

[0024] The storage unit 20 is a storage area for various programs for causing the hardware group to function as the risk analysis device 1, various data, and the like, and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), or the like. Specifically, the memory unit 20 stores add-ons (learning model generation programs) for causing the control unit 10 to execute each function of this embodiment, as well as various databases, such as logs that record for each user whether or not an attachment was opened in training content, whether or not a link was accessed, etc.

[0025] The control unit 10 includes a content structuring unit 110 , a learning data generating unit 111 , a learning model generating unit 112 , and an effect predicting unit 113 .

[0026] The content structuring unit 110 sets parameters indicating the presence or absence of deceptive elements as explanatory variables for at least the sender information, subject information, text content, and elements contained in the text in the training content used for training against targeted attacks. Specifically, the content structuring unit 110 acquires, for example, any N pieces of training content (n: 1≦n≦N) that have been used for training in the past and that have been created manually or automatically, and calculates a parameter X indicating the presence or absence of deceptive elements in the sender information, subject information, content of the text, and elements contained in the text of each of the acquired training contents (n). n (=(x n1 , x n2 , ···)), where N is an integer of 2 or more and satisfies 1≦n≦N.

[0027] The sender (From) information of the training content (n) (email) may include, for example, elements of deception, such as how the sender is disguised, how the sender's destination name is disguised, and whether the sender is pretending to be from within the organization (i.e., the domain is within the organization). For example, when the email address described in the From: header of the header information is spoofed (based on SPF or the like), the content structuring unit 110 uses, for example, the parameter X n x n1 On the other hand, if the email address written in the From: header is not forged, the content structuring unit 110 sets the parameter X n x n1 Set it to “0” to indicate no deception. In addition, when the sender name described in the From: header of the header information is spoofed as the sender destination name of the sender (From) information, the content structuring unit 110 may, for example, use a parameter X n x n2 On the other hand, if the sender name written in the From: header is not forged, the content structuring unit 110 sets the parameter Xn x n2 Set it to “0” to indicate no deception. In addition, when the sender (From) information pretends to be from within the organization (that is, the domain is within the organization), the content structuring unit 110 uses, for example, a parameter X n x n3 On the other hand, if the content is not pretending to be from within the organization (i.e., the domain is within the organization), the content structuring unit 110 sets the parameter X n x n3 Set it to “0” to indicate no deception.

[0028] Next, in the subject information, when the subject information includes a certain number (for example, "1") of words such as "urgent", "deadline", "urgent", "by today", etc., the content structuring unit 110, for example, n x n4 On the other hand, if the number of words expressing a rush is less than the predetermined number, the content structuring unit 110 sets the parameter X n x n4 Set it to “0” to indicate no deception. In addition, when the subject information includes a content indicating importance, such as words such as "important," "confirmation required," "confidential," and "warning," the content structuring unit 110 may, for example, use a parameter X n x n5 On the other hand, if the number of words expressing importance is less than the predetermined number, the content structuring unit 110 sets the parameter X n x n5 Set it to “0” to indicate no deception. In addition, in the subject information, when the subject is in the format of a reply form (Re:) or a forwarding form (Fwd:), the content structuring unit 110 may, for example, use a parameter X n x n6On the other hand, if the subject is not in the reply format (Re:) or forwarding format (Fwd:), the content structuring unit 110 sets the parameter X n x n6 Set it to “0” to indicate no deception. In addition, words expressing urgency, such as "urgent," "deadline," "urgent," and "by today," and words expressing importance, such as "important," "must confirm," "confidential," and "warning," may be set in advance as a dictionary and stored in the memory unit 20 of the risk analysis device 1.

[0029] Next, when the content of the text contains unnatural Japanese (e.g., simplified Chinese characters), the content structuring unit 110 may, for example, n x n7 On the other hand, if no strange Japanese is used, the content structuring unit 110 sets the parameter X n x n7 Set it to “0” to indicate no deception. In addition, when the content of the text includes words such as "access" and "confirmation" that require a user's response, the content structuring unit 110 may, for example, use the parameter X n x n8 On the other hand, if the content does not contain a word that requests the user to take action, the content structuring unit 110 sets the parameter X n x n8 Set it to “0” to indicate no deception. In addition, when the content of the text includes a predetermined number (for example, "1") or more of words such as "urgent", "deadline", "urgent", "by today", etc., the content structuring unit 110 may, for example, set a parameter X n x n9 On the other hand, if the number of words expressing a rush is less than a predetermined number (for example, "1"), the content structuring unit 110 sets the parameter X n x n9 Set it to “0” to indicate no deception. In addition, when the content of the text contains a predetermined number (for example, "1") of words related to money, such as "subsidy" or "support money," the content structuring unit 110 may, for example, use a parameter X n x n10 On the other hand, if the number of words related to money is less than a predetermined number (for example, "1"), the content structuring unit 110 sets the parameter X n x n10 Set it to “0” to indicate no deception.

[0030] In addition, when the content of the text includes a predetermined number (for example, "1") of words related to health, such as "influenza," "corona," "infectious disease," and "health," the content structuring unit 110 may, for example, use a parameter X n x n11 On the other hand, if the number of words related to health is less than a certain number (for example, "1"), the content structuring unit 110 sets the parameter X n x n11 Set it to “0” to indicate no deception. In addition, when the content of the text contains a predetermined number (for example, "1") of words that attract users, such as "campaign" or "discount," the content structuring unit 110 may, for example, use a parameter X n x n12 On the other hand, if the number of words in the content that attracts the user is less than a predetermined number (for example, "1"), the content structuring unit 110 sets the parameter X n x n12 Set it to “0” to indicate no deception. In addition, when the content of the text includes security-related content, such as words such as “vulnerability”, “security”, “login”, and “fraud” a predetermined number of times (for example, “1”) or more, the content structuring unit 110 may, for example, use a parameter X n x n13On the other hand, if the number of words related to security is less than a certain number (for example, "1"), the content structuring unit 110 sets the parameter X n x n13 Set it to “0” to indicate no deception.

[0031] In addition, words such as "access" and "confirmation" that request a response from the user, words such as "urgent," "deadline," "urgent," and "by today" that urge content, words such as "subsidy" and "support money" that relate to money, words such as "influenza," "corona," "infectious disease," and "health" that relate to health, words such as "campaign" and "discount" that attract users, and words such as "vulnerability," "security," "login," and "fraud" that relate to security may be set in advance as a dictionary and stored in the memory unit 20 of the risk analysis device 1.

[0032] Next, in the element included in the text, if the text includes a URL, the content structuring unit 110 may, for example, add a parameter X n x n14 On the other hand, if the text does not contain a URL, the content structuring unit 110 sets the parameter X n x n14 Set it to “0” to indicate no deception. In addition, in the case where the anchor text of the main text and the real URL match in the element included in the main text, the content structuring unit 110 may, for example, use the parameter X n x n15 On the other hand, if the anchor text in the main text does not match the real URL, the content structuring unit 110 sets the parameter X n x n15 Set it to “0” to indicate no deception.

[0033] In addition, when a file or the like is attached to the training content (email), the content structuring unit 110 may also structurize the parameter X n x n16Alternatively, the content structuring unit 110 may set x of the parameter Xn to "1" indicating the presence of a deceptive element. n16 may be set to "0" to indicate no deception. Note that the parameter X n x n1 From x n16 However, the present invention is not limited to this and may have 17 or more elements, or may have 15 or less elements.

[0034] The learning data generation unit 111 generates training content parameters X n Training data is generated by linking the percentage of users in the organization who were deceived by the training content with the objective variable. Specifically, the learning data generating unit 111 generates, for example, a parameter X n In order to link the content with the opening status during training, the proportion Y of users in the organization who were deceived for each of the N training contents (n) based on the log stored in the storage unit 20 is calculated. n The learning data shown in the formula (1) is generated with the objective variable being: (X n ,Y n ),n(1≦n≦N) (1)

[0035] The learning model generation unit 112 generates a learning model using the learning data generated by the learning data generation unit 111. Specifically, the learning model generation unit 112 uses, for example, generalized linear regression analysis to calculate the parameters X n From this, the percentage of users in the organization who were deceived Y n A regression model of equation (2) that estimates is generated as a learning model. Y n = a 1 x n1 + a 2 x n2 + +a 16 x n16 (2) In this way, the risk analysis device 1 calculates the weight (coefficient) a in the regression model (learning model) of the formula (2). i Large x ni can reveal the elements of injustice in an organization (where i is an integer between 1 and 16). For example, coefficient a 16 If the value of a is the largest, it means that many users in the organization open attachments such as attachments. 14 When the value is the largest, it is clear that many users in the organization will access the URL in the body of the message.

[0036] The effect prediction unit 113 predicts the parameter X n is input to the learning model, and the percentage of users in the organization who are fooled by the new training content Y n Estimate. Specifically, for example, when a newly created training content (email) is input to the risk analysis device 1, the content structuring unit 110 calculates the parameter X n The effect prediction unit 113 sets the parameter X n The ratio of users in the organization who are deceived is calculated by inputting the above into the regression model (learning model) in equation (2), Y n Estimate. In this way, when creating new training content, the risk analysis device 1 can estimate the percentage of users who will be deceived by the structure of the content created based on the learning model, and can create training content that is optimal for each organization.

[0037] Next, the flow of the risk analysis process of the risk analysis device 1 will be described with reference to FIG. FIG. 2 is a flowchart illustrating the risk analysis process of the risk analysis device 1.

[0038] In step S1, the content structuring unit 110 calculates a parameter X structuring the training contents (n) for each of the N training contents (n) used in training against targeted attacks, the ... used in training against targeted attacks, the parameter X structuring the training contents (n) used in training against n is set as an explanatory variable.

[0039] In step S2, the learning data generation unit 111 calculates the parameters X n and the percentage of users in your organization who were fooled by the training content Y n Generate learning data that links the above as the objective variable.

[0040] In step S3, the learning model generation unit 112 generates a learning model using the learning data generated in step S2.

[0041] In step S4, the effect prediction unit 113 predicts the parameter X n is input to the learning model, and the percentage of users in the organization who are fooled by the new training content Y n Estimate.

[0042] According to this embodiment, the risk analysis device 1 calculates a parameter X indicating the presence or absence of a deceptive element in each of the sender information, the subject information, the contents of the text, and the elements included in the text for each training content (n) used in the training. n The risk analysis device 1 sets the parameters X n In order to link the training content (n) with the opening status during training, the parameter X n and the percentage of users in the organization who were fooled by the training content (n) Y n A learning model is generated using the training data linked to the above as the objective variable. This enables the risk analysis device 1 to analyze which of the deception elements in the training content for targeted attacks has deceived users in the organization, and to grasp which elements the organization is vulnerable to.

[0043] In addition, the risk analysis device 1 calculates the parameter X n is input into the learning model, and the percentage of users in the organization who are deceived is Y n By estimating this, when new training content is created, it is possible to estimate the percentage of users who will be deceived by the structure of the content created based on the learning model, and it is possible to create training content that is optimal for each organization.

[0044] <Variation 1> The risk analysis device 1 is an information processing device (computer) equipped with various data input / output devices and communication devices in addition to the control unit 10 and the storage unit 20, but is not limited to this. For example, a server may be provided with part or all of the control unit 10 and the storage unit 20 of the risk analysis device 1. Furthermore, each function of the risk analysis device 1 may be realized by using a virtual server function on the cloud. Alternatively, the risk analysis device 1 may be a distributed processing system in which the functions of the risk analysis device 1 are appropriately distributed among a plurality of servers.

[0045] <Variation 2> In addition, the organization is a company, a school, etc., and the risk analysis device 1 estimates the ratio of users who will be deceived on an organization basis, but this is not limiting. For example, the risk analysis device 1 may estimate the ratio of users who will be deceived on a department basis, such as "sales" or "personnel" included in the organization.

[0046] This will make it possible to reduce damage caused by targeted attacks, for example, and thereby contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation." Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0047] The risk analysis method by the risk analysis device 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0048] 1 Risk Analysis Device 10 Control section 110 Content Structuring Department 111 Learning Data Generation Unit 112 Learning model generation unit 113 Effect Prediction Department 20 Memory section

Claims

1. a content structuring unit that sets parameters indicating the presence or absence of deceptive elements as explanatory variables for at least sender information, subject information, content of the text, and elements included in the text in training content used for training against targeted attacks; a training data generation unit that generates training data in which the parameters of the training content and a ratio of users in an organization who have been deceived by the training content are linked as a target variable; a learning model generation unit that generates a learning model using the learning data; A risk analysis device comprising:

2. The risk analysis device according to claim 1 , wherein the learning model generation unit applies a generalized linear regression analysis to the learning data to generate a regression model as the learning model.

3. 3. The risk analysis device according to claim 1, further comprising an effect prediction unit that inputs the parameters of the created new training content into the learning model and estimates a percentage of users within the organization who will be deceived by the new training content.

4. 3. The risk analysis device according to claim 1, wherein the sender information includes at least one of whether the sender address is spoofed, whether the sender name is spoofed, and whether the sender is a domain within the organization.

5. 3. The risk analysis device according to claim 1, wherein the subject information includes at least one of: whether or not the subject includes content urging the user, whether or not the subject includes content indicating the importance of the training content, and whether or not the subject is in reply format or forwarding format.

6. The risk analysis device of claim 1 or claim 2, wherein the content of the text includes at least one of the following: whether the text uses awkward Japanese, whether the content requests a response from the user, whether it contains urgent content, whether it contains content related to money, whether it contains content related to health, whether it contains content that will attract the user, and whether it contains security-related content.

7. 3. The risk analysis device according to claim 1, wherein the elements contained in the text include one of: whether or not the text contains a URL; and whether or not anchor text in the text matches an actual URL.

8. 3. The risk analysis device according to claim 1, wherein the organization is at least a company, a government office, a school, a factory, or a hospital facility, or a department within the facility.

9. A content structuring step of setting parameters indicating the presence or absence of deceptive elements as explanatory variables for at least sender information, subject information, content of the text, and elements included in the text in the training content used for training against targeted attacks; a learning data generating step of generating learning data in which the parameters of the training content and a ratio of users in an organization who have been deceived by the training content are linked as a target variable; A risk analysis method executed by a computer, comprising: a learning model generation step of generating a learning model using the learning data.

10. A risk analysis program for causing a computer to function as the risk analysis device according to claim 1 or 2.

Images