Learning system

Abstract

To provide a learning system that allows even beginners with little knowledge pertaining to security to learn and acquire knowledge of attackers.SOLUTION: A learning system comprises a teaching material unit, a virtual environment unit, and a learning unit. The teaching material unit stores a strategy steps file describing strategy steps for attacking servers. The virtual environment unit virtually constructs a server and an attacker computer based on a pre-created image file. The learning unit presents the strategy steps for attacking servers to a user based on the strategy steps file obtained from the teaching material unit. The learning unit sends attack information representing commands executed by the attacker computer to the virtual environment unit in response to operation by a user. The virtual environment unit causes the attacker computer to attack the server according to the attack information and sends the result of the attack to the learning unit. The learning unit presents the attack result to the user.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a learning system for acquiring knowledge related to security technology. [Background technology]

[0002] When considering security measures for computer systems, devices, or various facilities, it is sometimes necessary to have an attacker's perspective or knowledge. For this reason, security courses are being held to gain the knowledge of attackers. In addition, a security inspection device has been proposed that uses a virtual machine that realizes the functions of the system to be security-tested, executes inspection procedures for a security measures learning system, and outputs information indicating the execution results (for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 7380877 Summary of the Invention [Problem to be solved by the invention]

[0004] As mentioned above, there are courses on attacker knowledge, but in most cases they are aimed at participants with a certain level of knowledge (for example, engineers who can think of their own attack methods). In other words, there are few courses suitable for security beginners. Also, it is difficult to gain attacker knowledge by simply demonstrating the steps and results of an attack using a virtual machine.

[0005] An object of one aspect of the present invention is to provide a learning system that enables even a beginner with little knowledge of security to acquire the knowledge of an attacker. [Means for solving the problem]

[0006] A learning system according to one aspect of the present invention includes a learning material unit that stores a first image file for constructing a server, a second image file for constructing an attacker computer that attacks the server, and an attack procedure file that describes an attack procedure for attacking the server; a virtual environment unit that virtually constructs the server and the attacker computer based on the first image file and the second image file; and a learning unit that provides a user interface. The learning unit obtains the attack procedure file from the learning material unit and presents an attack procedure for attacking the server to a user, and transmits to the virtual environment unit attack information indicating commands to be executed by the attacker computer or attack methods to be executed by the attacker computer in response to the user's operation. The virtual environment unit causes the attacker computer to attack the server in accordance with the attack information received from the learning unit, and transmits the results of the attack on the server in accordance with the attack information to the learning unit. The learning unit presents the results of the attack received from the virtual environment unit to the user. [Effects of the Invention]

[0007] According to the above-described aspect, even a beginner with little knowledge about security can learn the knowledge of an attacker. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of a learning system according to an embodiment of the present invention. [Figure 2] FIG. 10 is a diagram illustrating an example of a registration screen used by a curriculum creator. [Figure 3] FIG. 10 is a diagram showing an example of a strategy procedure creation screen used by a curriculum creator. [Figure 4] FIG. 10 is a diagram illustrating an example of a tagging screen. [Figure 5] FIG. 10 is a diagram showing an example of registration information managed by a teaching material section. [Figure 6] FIG. 10 is a diagram showing an example of a list for managing information related to the OWASP Top 10. [Figure 7] 10 is a flowchart illustrating an example of a process for associating OWASP Top 10 categories with learning curricula. [Figure 8] FIG. 10 is a diagram showing an example of an initial learning screen presented to a learner. [Figure 9] FIG. 10 is a diagram showing an example of a learning screen presented to a learner. [Figure 10] FIG. 2 is a diagram illustrating an example of a hardware configuration of a learning system. DETAILED DESCRIPTION OF THE INVENTION

[0009] FIG. 1 shows an example of a learning system according to an embodiment of the present invention. The learning system 1 according to an embodiment of the present invention provides a learning curriculum for users who implement security measures for computer systems, devices, or various facilities to understand the attacker's perspective in relation to penetration testing. In other words, the user can use the learning system 1 to acquire the attacker's knowledge.

[0010] 1, the learning system 1 includes a teaching material section 10, a virtual environment section 20, and a learning section 30. Note that the learning system 1 may further include other functions not shown in FIG.

[0011] The teaching material unit 10 includes a defeated server image file storage unit 11, an attacker PC image file storage unit 12, a strategy file storage unit 13, a registration information storage unit 14, a user interface 15, and a strategy creation unit 16. The teaching material unit 10 may further include other functions not shown in FIG.

[0012] The compromised server image file storage unit 11 stores image files for constructing compromised servers. A compromised server refers to a server computer that is intentionally configured to have various vulnerabilities. In other words, a compromised server is an example of an attacked computer, configured, for example, to make specific ports vulnerable to intrusion. An image file is information obtained by directly copying various folders / files / settings within a computer. Therefore, an image file for constructing a compromised server represents the folders / files / settings of the compromised server to be constructed. In the following description, an image file for constructing a compromised server may be referred to as a "compromised server image file."

[0013] The attacker PC image file storage unit 12 stores an image file for constructing an attacker PC. The attacker PC is a computer that executes attacks on servers. In this embodiment, the attacker PC attacks the compromised server described above. The image file for constructing the attacker PC represents the folders / files / settings of the attacker PC to be constructed. In the following description, the image file for constructing the attacker PC may be referred to as the "attacker PC image file."

[0014] The strategy file storage unit 13 stores strategy files. The strategy file contains information describing the strategy for attacking the defeated server using the attacker's PC. The registration information storage unit 14 stores registration information for each learning curriculum. The registration information includes information indicating the storage location of the defeated server image file, information indicating the storage location of the strategy file, etc.

[0015] The user interface 15 provides an interface with the user. Here, the user of the teaching material unit 10 is the creator of the learning curriculum. In other words, the user interface 15 provides an interface with the creator of the learning curriculum. In the following description, the creator of the learning curriculum may be referred to as the "curriculum creator."

[0016] Strategy creation unit 16 creates a strategy file based on the operation of or instructions from the curriculum creator. At this time, strategy creation unit 16 may provide the curriculum creator with a screen for creating the strategy file via user interface 15.

[0017] The virtual environment unit 20 virtually constructs a defeated server 21 based on the defeated server image file stored in the teaching material unit 10. The virtual environment unit 20 also virtually constructs an attacker PC 22 based on the attacker PC image file stored in the teaching material unit 10.

[0018] The learning unit 30 includes a user interface 31 and an access unit 32. The user interface 31 provides an interface with the user. Here, the user of the learning unit 30 is a learner who uses the learning curriculum provided by the learning system 1. That is, the user interface 31 provides an interface with the learner. Furthermore, the access unit 32 accesses the virtual environment unit 20 in response to the learner's operation.

[0019] In the learning system 1 configured as described above, the curriculum creator stores a defeated server image file and an attacker PC image file in the teaching material section 10. Note that various defeated server image files are publicly available on the Web. Therefore, the curriculum creator may acquire a defeated server image file publicly available on the Web and store it in the teaching material section 10. Alternatively, the curriculum creator may create a defeated server image file and / or an attacker PC image file themselves and store them in the teaching material section 10. Furthermore, the curriculum creator creates a strategy file in cooperation with the strategy creation section 16. The method for creating a strategy file will be described later.

[0020] When a learner takes the learning curriculum of the learning system 1, the teaching material unit 10 provides the defeated server image file and the attacker PC image file to the virtual environment unit 20 in response to instructions from the learning unit 30. As a result, the defeated server 21 and the attacker PC 22 are constructed in the virtual environment unit 20. The teaching material unit 10 also provides a strategy file to the learning unit 30. The strategy described in the strategy file includes multiple attack steps for attacking the defeated server 21. Furthermore, each attack step includes one or more commands for attacking the defeated server 21. Alternatively, each attack step includes information representing one or more attack methods for attacking the defeated server 21. In the following description, each attack step is assumed to include one or more commands for attacking the defeated server 21.

[0021] The learning unit 30 presents the learner with a strategy according to the strategy file acquired from the teaching material unit 10. At this time, the learning unit 30 may present multiple options for the attack method (e.g., command) for each attack step for attacking the defeated server 21. In this case, when the learner selects an attack method, the learning unit 30 transmits attack information corresponding to the selected attack method to the virtual environment unit 20. The attack information indicates the command to be executed by the attacker PC 22 or the attack method to be executed by the attacker PC 22.

[0022] The virtual environment unit 20 causes the attacker PC 22 to attack the defeated server 21 in accordance with the attack information received from the learning unit 30. At this time, the attacker PC 22 attacks the defeated server 21 by executing a command corresponding to the attack information received from the learning unit 30. Then, the attacker PC 22 detects the results of the attack on the defeated server 21. After this, the virtual environment unit 20 transmits the results of the attack on the defeated server 21 to the learning unit 30.

[0023] The learning unit 30 presents the results of the attack on the compromised server 21 received from the virtual environment unit 20 to the learner. This allows the learner to learn what kind of attack results can be obtained by the attack method (for example, a command) that he or she has selected. At this time, the learner carries out an attack on the compromised server 21 by selecting a desired command from the options for the attack method presented by the teaching material unit 10. Therefore, even a beginner with no knowledge of computer security can attack a server computer and obtain the results, and can acquire the knowledge of an attacker.

[0024] 2 shows an example of a registration screen used by a curriculum creator. The registration screen is displayed, for example, by the user interface 15. The curriculum creator then uses this registration screen to register the curriculum name, the image file of the defeat server, the strategy, and the difficulty level of the curriculum in the teaching materials section 10. Specifically, this is as follows:

[0025] The curriculum creator registers a curriculum name of their choice. For example, a curriculum name such as "Learn about DoS attacks" can be entered. If the name of the newly registered curriculum is the same as an already registered name, a message to that effect will be displayed.

[0026] The curriculum creator also registers an image file of the defeated server. In this embodiment, it is assumed that multiple defeated server image files are stored in advance in a predetermined storage device. In this case, the curriculum creator can select the desired defeated server image file by clicking the "Browse button." The selected defeated server image file is then associated with the curriculum name and registered in the teaching material section 10. The defeated server image file may be, for example, a vmdk file. A vmdk file is an image file of a virtual disk and represents the contents of the hard disk of a virtual machine.

[0027] Next, the curriculum creator registers the strategy. In this embodiment, the strategy creation unit 16 is started when the curriculum creator clicks the "start button." The strategy creation unit 16 displays a strategy creation screen. The strategy creation unit 16 also provides a function for creating a flowchart representing the strategy.

[0028] 3 shows an example of a strategy creation screen used by a curriculum creator. The strategy creation screen includes a flowchart description window and an object addition window, and is displayed by the strategy creation unit 16. The object addition window provides a function for adding various objects that make up a flowchart. In this embodiment, this includes "terminals," "explanatory text," "branching," "options," etc.

[0029] When the curriculum creator selects "Terminal," the strategy creation unit 16 places the "Start" or "End" of the flowchart at the specified position in the flowchart description window. When the curriculum creator selects "Description," the strategy creation unit 16 places a box for writing text at the specified position in the flowchart description window. The curriculum creator can enter any text they want into this book.

[0030] When the curriculum creator selects "branch," the strategy creation unit 16 places a branch block at a specified position in the flowchart description window. The curriculum creator can enter text in that block to select a subsequent option. When the curriculum creator selects "option," the strategy creation unit 16 places a box for setting the option at a specified position in the flowchart description window. The curriculum creator can set an attack method or command in this box. Note that one command may be set for one option, or multiple commands may be set for one option. Multiple options may also be combined to set a single command, such as specifying a command in the first option and specifying parameters in the second or subsequent options.

[0031] The curriculum creator completes the flowchart by connecting the objects placed in the flowchart description window with "arrows." This flowchart represents the strategy provided by the learning curriculum. The flowchart may also include objects for calling pre-created subprocesses. By clicking the "File button," the curriculum creator can also refer to flowcharts created in the past. The flowchart is then saved as a strategy file in the strategy file saving unit 13.

[0032] The strategy creation unit 16 has a function of adding related information to the strategy represented by the flowchart described above. Adding related information to a strategy is sometimes called "tagging." In this embodiment, when the "tagging button" shown in FIG. 3 is clicked, the strategy creation unit 16 displays a tagging screen for tagging the strategy with related information.

[0033] Figure 4A shows an example of the tagging screen displayed during tagging processing. In this example, CWE (Common Weakness Enumeration) and CVE (Common Vulnerabilities and Exposures) are used as related information to be assigned to exploitation procedures. CWE indicates the category to which the vulnerability belongs. CVE indicates identification information for centrally managing various vulnerability information.

[0034] The curriculum creator selects a category on the tagging screen. In the example shown in Figure 4A, CWE is selected. In this case, the CWE number and a description of the corresponding content are listed. The curriculum creator then selects the CWE number related to the strategy for the learning curriculum (i.e., the flowchart being created on the strategy creation screen shown in Figure 3) and clicks the "Register" button. The selected CWE number is then tagged to the flowchart. The same applies to CVE numbers.

[0035] To check the registered tags, the curriculum creator clicks the "Registered Tags" button. This allows the creator to view the information that has been previously tagged. In the example shown in Figure 4B, CWE20, CWE287, and CVE2011-2523 are registered.

[0036] Once tagging is complete, the curriculum creator sets the difficulty level of the learning curriculum on the registration screen shown in Figure 2. The difficulty level indicates how easy or difficult the skills to be acquired through the learning curriculum are for the learner. The difficulty level may be subjectively determined by the curriculum creator who creates the curriculum. Alternatively, a predetermined level (five levels in Figure 2) may be specified as the difficulty level by using a mouse or the like.

[0037] After that, when the "Register button" shown in Fig. 2 is clicked, the information specified or entered by the curriculum creator is registered in the teaching materials section 10. This information is stored in the registered information storage section 14 shown in Fig. 1 as registered information for each learning curriculum.

[0038] 5 shows an example of registered information managed by the teaching material unit 10. In this embodiment, the registered information includes a curriculum ID, a curriculum name, a difficulty level, defeat server information, strategy information, and related security information.

[0039] The curriculum ID identifies each learning curriculum. The curriculum name indicates the name of the learning curriculum given by the curriculum creator. The difficulty level indicates the difficulty level of the learning curriculum specified by the curriculum creator. The defeat server information indicates the path that specifies the location where the defeat server image file to be used in each learning curriculum is stored. For example, the defeat server image file used in the curriculum "Anya" is stored in " / XX / Anya.vmdk", and the defeat server image file used in the curriculum "Zako" is stored in " / XX / Zako.vmdk".

[0040] The strategy information represents a path that identifies the location where the strategy file (i.e., a flowchart representing the strategy) to be used in each learning curriculum is stored. For example, the strategy file used in the curriculum "Anya" is stored in " / XXX / YYY," and the strategy file used in the curriculum "Zako" is stored in " / XXX / ZZZ."

[0041] Related security information is information that represents threat categories related to the learning curriculum that are desirable for learners to be aware of. Related security information is not limited to, but could, for example, represent the OWASP (Open Worldwide Application Security Project) Top 10 categories. OWASP is an organization involved in software security, including the web, that conducts security-related research and publishes its findings. The OWASP Top 10 is a report published periodically by OWASP that presents 10 critical categories that require vigilance in web security. For example, the report published in 2021 lists the following 10 categories: A1: Broken access control A2: Encryption failure A3: Injection A4: Unstable design with unconfirmed safety A5: Improper security settings A6: Vulnerable and outdated components A7: Identification and authentication failure A8: Software and data integrity issues A9: Security logging and monitoring failure A10: Server-Side Request Forgery (SSRF)

[0042] Here, the learning system 1 holds a list of the latest OWASP Top 10. This list contains URLs of sites that provide information related to each of the categories A1 to A10, as shown in Figure 6. The strategy creation unit 16 also uses this list to associate the OWASP Top 10 categories with the learning curriculum.

[0043] Figure 7 is a flowchart showing an example of the process of associating learning curricula with OWASP Top 10 categories. It is assumed that the tagging described with reference to Figure 4 has been completed.

[0044] In S1, the strategy creation unit 16 acquires a list of tags assigned to the learning curriculum to be processed. The tag list contains one or more tags (CVE number, CWE number, etc.) assigned to the learning curriculum according to the procedure described with reference to FIG.

[0045] In S2, the exploit procedure creator 16 deletes tags other than CVE numbers or CWE numbers from the tag list, meaning that CVE numbers and CWE numbers remain in the tag list.

[0046] In S3, the strategy creation unit 16 checks whether there are any unprocessed tags remaining in the tag list. That is, the processes of S4 to S6 are executed for each tag (CVE number, CWE number) in the tag list. At this time, the strategy creation unit 16 extracts tags one by one from the tag list and executes the processes of S4 to S6.

[0047] In S4, the exploit procedure creation unit 16 determines whether the extracted tag is a CVE number or a CWE number. If the extracted tag is a CVE number, in S5 the exploit procedure creation unit 16 associates a category related to known vulnerabilities with the learning curriculum to be processed. When using the OWASP Top 10 2021, "A6: Vulnerable and outdated components" is associated with the learning curriculum to be processed.

[0048] If the extracted tag is a CWE number, in S6, the strategy creation unit 16 associates a category corresponding to the CWE number with the learning curriculum to be processed. For example, assume that the learning curriculum to be processed is tagged with "CWE287 (Improper Authentication)." Here, the OWASP Top 10 category corresponding to "Improper Authentication" is, for example, "A7: Identification and Authentication Failure." Therefore, in this case, the strategy creation unit 16 associates "A7: Identification and Authentication Failure" with the learning curriculum to be processed.

[0049] When the strategy creation unit 16 associates an OWASP Top 10 category with the learning curriculum to be processed, it records that fact in the list shown in Fig. 6. The example shown in Fig. 6 indicates that "A2: Encryption Failure" is associated with the learning curriculum to be processed.

[0050] When the processes of S4 to S6 are completed for all tags (CVE numbers, CWE numbers, etc.) in the tag list, the strategy procedure creation unit 16 records the categories associated with the learning curriculum being processed as related security information in the registration information shown in Fig. 5. In the example shown in Fig. 5, for example, "A1: Access Control Deficiency," "A2: Encryption Failure," "A6: Vulnerable and Outdated Component," and "A7: Identification and Authentication Failure" from the OWASP Top 10 are recorded as related security information for the curriculum "Anya." The association process shown in Fig. 7 is executed when a learning curriculum is registered and when the OWASP Top 10 is updated.

[0051] The registration information created as described above and shown in Fig. 5 is stored in the registration information storage unit 14 shown in Fig. 1. This registration information is used when the learner starts the curriculum.

[0052] Next, we will explain the operation when a learner takes a learning curriculum provided by the learning system 1. When starting learning, the learner logs in to the learning system 1 using the user interface 31 of the learning unit 30. Then, the user interface 31 displays an initial learning screen that allows the learner to select a learning curriculum provided by the learning system 1.

[0053] FIG. 8 shows an example of an initial learning screen presented to a learner. The initial learning screen introduces the learning curriculum provided by the learning system 1. At this time, the learning unit 30 may generate the initial learning screen by referring to the registration information stored in the learning material unit 10. In this embodiment, the registration information shown in FIG. 5 is stored in the learning material unit 10, and the initial learning screen introduces the learning curricula "Anya," "Zako," and "Fe PLC."

[0054] The initial learning screen displays the difficulty level of each learning curriculum and the corresponding threat category. The difficulty level and the corresponding threat category are recorded as the registration information described above. In this embodiment, for example, the difficulty level of the curriculum "Zako" is "Easy," and this indicates that the curriculum is related to "A6: Vulnerable and Outdated Components" and "A7: Identification and Authentication Failures" out of the 10 categories listed by OWASP. Therefore, a learner can select an appropriate learning curriculum according to their level of proficiency in security technologies. In addition, a learner can select a learning curriculum related to the category they want to learn or the category in which they are interested.

[0055] When the learner selects a desired learning curriculum via the user interface 31, the learning unit 30 notifies the teaching material unit 10 of the selected learning curriculum. The teaching material unit 10 then references the registration information stored in the registration information storage unit 14 and identifies the defeated server to be used in the learning curriculum selected by the learner. The teaching material unit 10 then obtains the image file of the identified defeated server from the defeated server image file storage unit 11 and transmits it to the virtual environment unit 20. At this time, the teaching material unit 10 also transmits the attacker PC image file to the virtual environment unit 20. Thereafter, the virtual environment unit 20 constructs the defeated server 21 based on the defeated server image file and constructs the attacker PC 22 based on the attacker PC image file.

[0056] Furthermore, the teaching material unit 10 refers to the registration information stored in the registration information storage unit 14 and identifies the strategy for the learning curriculum selected by the learner. Then, the teaching material unit 10 obtains the identified strategy file from the strategy file storage unit 13 and transmits it to the learning unit 30.

[0057] The learning unit 30 presents the strategy to the learner via the user interface 31 in accordance with the strategy file received from the teaching material unit 10. At this time, the learning unit 30 displays a learning screen.

[0058] FIG. 9 shows an example of a learning screen presented to a learner. The learning screen includes a message window and a command execution window. The message window can display the "explanatory text" described with reference to FIG. 3. As described above, the explanatory text is written by the curriculum creator and recorded in the strategy file. The learning unit 30 then displays the corresponding explanatory text according to the progress of the strategy. In the example shown in FIG. 9, the attacker PC 22 in the virtual environment unit 20 identifies open ports on the exploited server 21 and notifies the learning unit 30. The learning unit 30 then retrieves explanatory text corresponding to this notification from the strategy file and displays it in the message window. As a result, an explanatory text is displayed saying, "We have obtained a list of open ports on the target of attack. What should we do? Select a command from the options." At this time, the command execution file displays a list of open ports on the exploited server 21.

[0059] Furthermore, the learning unit 30 displays options in the command execution window to allow the learner to select the attack method (here, commands) to be executed according to the progress of the attack procedure. In this embodiment, three options, "vulnerability scan," "port scan," and "ping," are displayed in synchronization with the above-mentioned explanatory text. As mentioned above, the options are written by the curriculum creator and recorded in the attack procedure file.

[0060] The learner selects an attack method (i.e., a command) that he or she thinks is effective from the options displayed in the command execution window, following the explanation displayed in the message window. The access unit 32 of the learning unit 30 then transmits attack information representing the command selected by the learner to the virtual environment unit 20.

[0061] In the virtual environment unit 20, the attacker PC 22 attacks the victim server 21 in accordance with commands represented by the attack information sent from the learning unit 30. Then, the attacker PC 22 detects the results of the attack on the victim server 21. After this, the virtual environment unit 20 sends the results of the attack on the victim server 21 to the learning unit 30. The function of remotely operating the virtual machines (here, the victim server 21 and the attacker PC 22) built on the virtual environment is realized by known technology such as Telnet or RDP (Remote Desktop Protocol).

[0062] The learning unit 30 presents the results received from the virtual environment unit 20 to the learner. At this time, an explanatory text corresponding to the result of the attack may be displayed in a message window. For example, if the learner selects an appropriate command and the attack is successful, a message urging the learner to proceed to the next step may be displayed. Alternatively, if the learner selects an inappropriate command and the attack is unsuccessful, the correct command may be displayed, or a suggestion or hint to guide the learner to the correct command may be displayed. Note that the explanatory text displayed according to the result of the attack is preferably written by the curriculum creator and recorded in the attack procedure file.

[0063] In this way, the learner can learn what kind of attack results can be obtained by the attack method (command in this case) that he or she has selected. At this time, the learner can execute an attack on the exploit server 21 by selecting the desired command or attack method from the options for attack methods presented by the teaching material section 10. Therefore, even a beginner with no knowledge of computer security can attack a server computer and obtain the results, and can acquire the knowledge of an attacker.

[0064] The learning system 1 according to the embodiment of the present invention is not limited to the above-described example. For example, multiple difficulty levels may be set for one learning curriculum. In this case, the number of options in the attack steps in the strategy may be changed depending on the difficulty level. For example, a strategy file may be created so that two options are set in each attack step for a low difficulty level and four options are set in each attack step for a high difficulty level.

[0065] Furthermore, in cases where the learning system 1 provides multiple learning curricula, the learning system 1 may suggest the next curriculum to be taken depending on which step the learner selected a valid command and which step the learner selected an invalid command. In this case, it is expected that the learner's learning speed will increase.

[0066] <Hardware configuration> 10 shows an example of the hardware configuration of the learning system 1. The learning system 1 is realized by a computer system 100 including a processor system 101, a memory 102, a storage device 103, an input / output device 104, a recording medium reader 105, and a communication interface 106.

[0067] The processor system 101 provides the functions of the learning system 1 by executing a learning control program stored in the storage device 103. The processor system 101 is realized by one or more processors. When the processor system 101 includes multiple processors, the multiple processors may be connected to each other via a network. When the processor system 101 executes the learning control program, the functions of the user interface 15, the strategy creation unit 16, the defeat server 21, the attacker PC 22, the user interface 31, and the access unit 32 shown in FIG. 1 are provided. The memory 102 is used as a work area for the processor system 101. The storage device 103 stores the learning control program and other programs described above.

[0068] The input / output device 104 may include input devices such as a keyboard, a mouse, a touch panel, and a microphone. The input / output device 104 may also include output devices such as a display device and a speaker. The recording medium reader 105 can acquire data and information recorded on the recording medium 110. The recording medium 110 is a removable recording medium that can be attached to or detached from the computer system 100. The recording medium 110 may be realized, for example, by a semiconductor memory, a medium that records signals optically, or a medium that records signals magnetically. The learning control program may be provided to the computer system 100 from the recording medium 110. The communication interface 106 provides a function for connecting to a network. When the learning control program is stored in the program server 120, the computer system 100 may acquire the learning control program from the program server 120. [Explanation of symbols]

[0069] 1. Learning System 10 Teaching Materials Department 11. Server Image File Storage 12 Attacker's PC image file storage section 13 Strategy Procedure File Storage 14 Registration Information Storage Unit 15 User Interface 16 Strategy Guide Creation Department 20 Virtual Environment Department 21 Defeated Server 22 Attacker's PC 30 Learning Department 31 User Interface 32 Access section

Claims

1. a learning material unit that stores a first image file for constructing a server, a second image file for constructing an attacker computer that attacks the server, and an attack procedure file that describes an attack procedure for attacking the server; a virtual environment unit that virtually constructs the server and the attacker computer based on the first image file and the second image file; a learning unit that provides a user interface; The learning unit obtaining the attack procedure file from the educational material section and presenting the attack procedure for attacking the server to the user; sending, to the virtual environment unit, attack information representing a command to be executed by the attacker computer or an attack method to be executed by the attacker computer in response to an operation by the user; The virtual environment unit causing the attacker computer to attack the server in accordance with the attack information received from the learning unit; sending a result of the attack on the server in accordance with the attack information to the learning unit; The learning unit presents the results of the attacks received from the virtual environment unit to the user. A learning system characterized by:

2. The attack procedure includes at least one attack step, the at least one attack step includes a plurality of selectable commands; The learning unit presenting the plurality of selectable commands to the user; Sending the attack information representing the command selected by the user to the virtual environment.

2. The learning system according to claim 1.

3. The attacker computer attacks the server by executing the command indicated by the attack information.

3. The learning system according to claim 2.

4. The attack procedure is described in a flowchart including at least one attack step, In the flowchart, the at least one attack step includes a plurality of options corresponding to a plurality of commands that the attacker computer can execute; The learning unit presents the strategy to the user according to the flowchart and allows the user to select one of the plurality of options.

2. The learning system according to claim 1.

5. information indicating a category of a threat related to a learning curriculum that attacks the server according to the attack procedure is associated with the learning curriculum; The learning unit presents information indicating the threat category to the user when the user takes the learning curriculum.

2. The learning system according to claim 1.

6. information indicating the difficulty of a skill to be acquired through the learning curriculum is associated with the learning curriculum for attacking the server according to the attack procedure; The learning unit presents the level of difficulty to the user when the user takes the learning curriculum.

2. The learning system according to claim 1.

Images