Attack Method Analysis Support Device

Abstract

Reduce the amount of work required to analyze cyber-attack methods. [Solution] An attack method analysis support device having a processor and memory, wherein the memory stores a protected asset, which is either a function of a system element constituting an information processing system, data processed by the function of the system element, or a function of software constituting the system element and data processed by the function of the software, in association with an attack method of a cyber attack against the protected asset, and the processor identifies the protected asset to be analyzed based on information received from a user via an input device, calculates the similarity between the protected asset to be analyzed and the protected asset stored in the memory, identifies an attack method against the protected asset to be analyzed from the attack methods associated with the protected assets stored in the memory based on the similarity, and outputs the identified attack method against the protected asset to be analyzed to an output device.

Description

[Technical Field]

[0001] The present invention relates to an attack method analysis support device. [Background technology]

[0002] Cyberattacks on protected assets, including the functions of information processing systems and the data processed by those functions, have become a problem. For example, Patent Document 1 discloses a program that analyzes the location of a cyberattack, the perpetrator of the cyberattack, the timing of the cyberattack, the reason for the cyberattack, and the target of the cyberattack. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-101716 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in recent years, the number of protected assets included in information processing systems has increased, and analyzing the attack methods of cyber attacks has required a great deal of man-hours.

[0005] The present invention has been made in consideration of the above points, and aims to provide an attack method analysis support device that can reduce the amount of work required to analyze attack methods of cyber attacks. [Means for solving the problem]

[0006] The attack method analysis support device of the present invention is an attack method analysis support device comprising a processor and a memory, wherein the memory stores protected assets, which are either functions of system elements constituting an information processing system, data processed by the functions of the system elements, or functions of software constituting the system elements and data processed by the functions of the software, in association with attack methods of cyber attacks against the protected assets, and the processor identifies the protected asset to be analyzed based on information received from a user via an input device, calculates the similarity between the protected asset to be analyzed and the protected asset stored in the memory, identifies an attack method against the protected asset to be analyzed from the attack methods associated with the protected assets stored in the memory based on the similarity, and outputs the identified attack method against the protected asset to be analyzed to an output device. [Effects of the Invention]

[0007] According to the present invention, the number of steps required to analyze the attack methods of cyber attacks can be reduced. Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. In addition, the problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram showing an attack method analysis support device according to an embodiment. [Figure 2] (A) is a diagram showing system elements, and (B) is a diagram showing the protected assets of the software that make up the system elements of (A). [Figure 3] (A) is a table showing the correspondence between functions in Figure 2(B), and (B) is a table showing the correspondence between data in Figure 2(B). [Figure 4] A table showing the protected assets shown in Figures 2(A) and 2(B). [Figure 5] 2(A) and 2(B) are tables showing the correspondence between the protected assets of the system elements and the attack methods. [Figure 6]FIG. 6 is a diagram showing a method of applying the attack method on the protected assets of the system elements in FIG. 5 to the attack method on the protected assets of software. [Figure 7] A table showing the correspondence between the protected assets of the system elements and software included in Figure 5 and attack methods. [Figure 8] 1 is a flowchart illustrating a method for determining similarity based on topic analysis of design documents. [Figure 9] FIG. 10 is a diagram showing a method for selecting protected assets belonging to a lower classification from a higher classification. [Figure 10] FIG. 1 is a diagram showing classification of protected assets by tree-structured nodes. [Figure 11] FIG. 11 is a diagram showing a method for determining the similarity between protected assets using the tree structure of FIG. 10. [Figure 12] 1 is a flowchart showing an overview of the operation of an attack method analysis support device according to an embodiment. [Figure 13] 10 is a flowchart showing the operation of determining a similarity based on the correspondence between the protected assets of a system element and the protected assets of software that constitutes the system element and identifying an attack method. [Figure 14] 10 is a flowchart showing an operation of determining a similarity based on a topic analysis of a design document to identify an attack method. [Figure 15] 10 is a flowchart showing an operation for determining a similarity from the distance between nodes in a tree structure and identifying an attack method. [Figure 16] 10 is a flowchart showing the operation of identifying an attack method based on the first similarity, the second similarity, and the third similarity, and outputting the identified attack method. [Figure 17] FIG. 10 is a sequence diagram showing the operation of analyzing an attack method on a system element from the correspondence between the protected assets of a concept and the protected assets of a system element in the attack method analysis support device according to the embodiment. [Figure 18] FIG. 10 is a sequence diagram showing the operation of analyzing software attack methods from the correspondence between the protected assets of system elements and the protected assets of software in the attack method analysis support device according to the embodiment. [Figure 19]FIG. 10 is a sequence diagram showing the operation of analyzing attack methods on a protected asset to be analyzed that has different system elements in the attack method analysis support device according to the embodiment. [Figure 20] A table showing the degree of similarity between the protected asset being analyzed and the protected asset whose attack method has been analyzed, for each analysis method. [Figure 21] A table showing the protected assets to be analyzed and the attack methods for each analysis method displayed in order of priority. [Figure 22] 10 is a table showing an example of displaying the analysis results of attack methods. [Figure 23] FIG. 10 is a diagram illustrating a concept of analyzing a method of attacking a protected asset according to an embodiment. [Figure 24] FIG. 10 is a diagram illustrating a concept of analyzing a method of attacking a protected asset according to an embodiment. [Figure 25] FIG. 10 is a diagram illustrating the concept of determining whether or not an attack has occurred on a protected asset according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an attack method analysis support device according to the present invention will be described with reference to the drawings.

[0010] 1 is a device for supporting the analysis of cyber-attack methods against protected assets included in an information processing system. The attack method analysis support device 600 provides guidelines on cyber-attack methods to users, such as designers of the information processing system and designers of the security system of the information processing system.

[0011] A protected asset means, for example, the function of the concept that is the highest-level concept of an information processing system, the data processed by the function of the concept, the function of a system element that constitutes an information processing system to realize the concept, the data processed by the function of the system element, the function of software that constitutes a system element, and the data processed by the function of the software.A protected asset of a concept is either the function of a concept or the data processed by the function of the concept.A protected asset of a system element is either the function of a system element or the data processed by the function of the system element.A protected asset of software is either the function of the software or the data processed by the function of the software.

[0012] A cyberattack on a protected asset means, for example, an act of impeding the function of the protected asset, an act of tampering with the function of the protected asset, an act of stealing data from the protected asset, or an act of tampering with data from the protected asset. The attack method of a cyberattack includes, for example, the location of the cyberattack, the perpetrator of the cyberattack, the timing of the cyberattack, the reason for the cyberattack, and information about the protected asset that is the target of the cyberattack.

[0013] The attack method analysis support device 600 includes a processor 100, a memory 200, an input device 300, and an output device 400. The processor 100, the memory 200, the input device 300, and the output device 400 are connected via a network 500. The processor 100 is a computer including a CPU (Central Processing Unit), a ROM (Read Only Memory), and a RAM (Random Access Memory). The processor 100 performs the processing described below by the CPU of the processor 100 executing computer programs stored in the ROM and RAM of the processor 100.

[0014] The memory 200 is an auxiliary storage device such as a hard disk drive (HDD) or a solid state drive (SDD). The processor 100 and the memory 200 are a server connected to a network 500. Note that the term "server" refers to a processing device that can send and receive information to and from a communication device via a communication line or the like, and does not refer to hardware such as a personal computer or an embedded information device.

[0015] The input device 300 is, for example, a keyboard and a mouse of an information processing terminal such as a personal computer operated by a user such as the designer of the information processing system and the designer of a security system for the information processing system. The input device 300 receives an input specifying a protected asset for which an attack method is to be analyzed.

[0016] The output device 400 is, for example, a display of an information processing terminal such as a personal computer operated by a user such as the designer of the information processing system and the designer of a security system for the information processing system. The output device 400 outputs the similarity between the protected asset to be analyzed and the protected asset associated with the attack method of the cyber-attack stored in the memory 200, the attack method against the identified protected asset to be analyzed, and the process of analyzing the attack method.

[0017] The processor 100 includes a control unit 110, a memory 120, a communication unit 130, an analysis target identification unit 140, a protected asset similarity calculation unit 150, and an attack method identification unit 160. The control unit 110 controls the operation of the memory 120, the communication unit 130, the analysis target identification unit 140, the protected asset similarity calculation unit 150, and the attack method identification unit 160 of the processor 100. The control unit 110 causes the output device 400 to output the attack method against the protected asset to be analyzed, which has been identified by the attack method identification unit 160.

[0018] The memory 120 stores a plurality of protected assets and attack methods against the protected assets in association with each other. For example, in order to analyze attack methods against the protected assets, the memory 120 temporarily stores the protected assets and attack methods against the protected assets that are stored in the memory 200 and received via the network 500 and the communication unit 130. The communication unit 130 communicates with the processor 100, the memory 200, the input device 300, and the output device 400 via the network 500.

[0019] The analysis target identification unit 140 identifies a protected asset to be analyzed based on information received from a user via the input device 300. The protected asset similarity calculation unit 150 calculates the similarity between the protected asset to be analyzed and the protected asset stored in the memory 200. The attack method identification unit 160 identifies an attack method against the protected asset to be analyzed from the attack methods associated with the protected assets stored in the memory 200 based on the similarity.

[0020] The memory 200 stores protected asset information 210 and attack method analysis results 220. The protected asset information 210 includes correspondence relationships 211, design documents 212, and hierarchical classifications 213.

[0021] The correspondence relationship 211 includes information on a plurality of protected assets of a concept. The correspondence relationship 211 includes information on a plurality of protected assets of a system element. The correspondence relationship 211 includes information on a plurality of protected assets of software. The correspondence relationship 211 includes information on the correspondence relationship between the protected assets of the concept that is the highest concept of an information processing system, the protected assets of the system elements that constitute the information processing system to realize the concept, and the protected assets of the software that constitutes the system elements.

[0022] 2A, for example, the protected assets of a system element include function α, function β, and data γ of the system element. Data processed by function α in response to an input is data γ.

[0023] As shown in Figure 2(B), the protected assets of the software that constitute function α, which is the protected asset of the system element, include function A, function B, function C, function D, data γ'1, data γ'2, data γ'3, and data γ'4. Data γ'1 is data that is input to function α, processed by function A, and output to function B. Data γ'2 is data that is input to function A, processed by function B, and output to function C.

[0024] Data γ'3 is the data input to function α, processed by function A, and output to function D. Data γ'4 is the data input by function A, processed by function D, and output to function C. Data γ'2 is the data input by function B and data γ'4 is the data input by function D, processed by function C, and output as the output of function α.

[0025] In this embodiment, function α, which is a protected asset of a system element as shown in Fig. 2(B), corresponds to functions A, B, C, and D, which are protected assets of software that constitute the system element, and are the same type of protected asset. Furthermore, among the multiple protected assets stored in memory 200, the similarity between a system element that corresponds to the protected asset to be analyzed and a system element that corresponds to the protected asset stored in memory 200 is set to be the first similarity.

[0026] A protected asset with the first similarity is a protected asset with the highest similarity. In the example of Figure 2 (B), Function A, Function B, Function C, Function D, and Function α are protected assets with the first similarity because they all have Function α, a protected asset of a system element, in common. Data γ'1, Data γ'2, Data γ'3, Data γ'4, and Data γ are protected assets with the first similarity because they all have Data γ, a protected asset of a system element, in common.

[0027] FIG. 3(A) is a table showing correspondence 211 related to the functions in FIG. 2(B). A parent node (function) ID, a function name, and a design document are associated with a node (function) ID. A node (function) ID is the ID of a protected asset of software that constitutes a system element. A parent node (function) ID is the ID of a protected asset of a system element. As shown in FIG. 3(A), correspondence 211 stored in memory 200 includes correspondence between function α of the protected asset of the system element and functions A, B, C, and D of the protected asset of the software. In other words, memory 200 stores function α of the protected asset of the system element in association with functions A, B, C, and D of the protected asset of the software.

[0028] FIG. 3(B) is a table showing correspondence 211 related to the data in FIG. 2(B). A parent data ID, an output node ID, an input node ID, a data name, and a design document are associated with a data ID. A data ID is an ID of data output from a function of a protection asset of software. A parent data ID is an ID of data output from a function of a protection asset of a system element. As shown in FIG. 3(B), the correspondence 211 stored in memory 200 includes a correspondence between data γ of a protection asset of a system element and data γ'1, γ'2, γ'3, and γ'4 of protection assets of software. In other words, memory 200 stores data γ of a protection asset of a system element in association with data γ'1, γ'2, γ'3, and γ'4 of protection assets of software.

[0029] In Figures 3(A) and 3(B), correspondences between function protection assets and between data protection assets are stored, but correspondences between function protection assets and data protection assets may also be stored. Correspondences also hold between concept protection assets, system element protection assets, and software protection assets. In this case, it means the same concept, the same system element, and the same software. The design documents in Figures 3(A) and 3(B) are various text data created to design the protection assets.

[0030] FIG. 4 is a table showing the protected assets shown in FIGS. 2(A) and 2(B). In this embodiment, as shown in FIG. 4, the protected assets shown in FIGS. 2(A) and 2(B) are stored in the memory 200. When attack methods against the protected assets have already been analyzed, attack method analysis result IDs and design information may be associated with protected asset IDs and stored in the memory 200 as shown in FIG. 5. As shown in FIG. 5, for example, with respect to functions α and β and data γ, which are protected assets of a system element, attack methods that have already been analyzed are stored in the correspondence 211 of the memory 200. On the other hand, attack methods have not yet been analyzed for the protected assets of the software that constitute the system elements.

[0031] 6 is a diagram showing a method of applying an attack method on a protected asset of a system element to an attack method on a protected asset of software. As shown in FIG. 6, in this embodiment, the protected asset similarity calculation unit 150 determines that the protected asset of the software constituting the system element has a high similarity to the protected asset of the system element. The protected asset similarity calculation unit 150 of the processor 100 determines, as the highest first similarity, the similarity of a protected asset that is common to a system element corresponding to the protected asset to be analyzed and a system element corresponding to the protected asset stored in the memory 200, among the multiple protected assets stored in the memory 200.

[0032] The attack method identification unit 160 of the processor 100 identifies, among the multiple protected assets stored in the memory 200, an attack method associated with a protected asset with a first similarity as an attack method against the protected asset to be analyzed. In the example of Fig. 6, for function α, which is a protected asset of a system element, an attack method that has already been analyzed by, for example, guide word analysis, is identified as an attack method against functions A, B, C, and D, which are protected assets of software that constitute the system element. Similarly, for data γ, which is a protected asset of the system element, an attack method that has already been analyzed by, for example, guide word analysis, is identified as an attack method against data γ'1, which is a protected asset of software that constitutes the system element.

[0033] Fig. 7 is a table showing the correspondence between the protected assets of system elements and software and the attack methods. In Fig. 7, the attack method analysis result ID and design information indicating the attack method identified by the attack method identification unit 160 are associated with the protected asset ID. As shown in Fig. 7, the attack methods against the protected assets of software identified as described above are stored in the correspondence relationship 211 of the memory 200. The attack methods against the protected assets of the system elements are identified as the attack methods against the protected assets of the software that constitute the system elements.

[0034] In the above example, an attack method against the protected asset of a system element is identified as an attack method against the protected asset of software that constitutes a system element, but similarly, an attack method against the protected asset of a concept may be identified as an attack method against the protected asset of a system element that realizes a concept. Furthermore, as an attack method against the protected asset of software that constitutes a system element, an attack method that has already been identified for the protected asset of software that constitutes the same system element may be identified. Furthermore, as an attack method against the protected asset of a system element that realizes a concept, an attack method that has already been identified for the protected asset of a system element that realizes the same concept may be identified.

[0035] 8 is a flowchart showing a method for determining similarity based on topic analysis of design documents. As described above, the design documents 212 of the protected asset information 210 in the memory 200 shown in FIG. 1 are various text data created for designing protected assets. In this embodiment, the memory 200 stores design documents 212 of multiple protected assets. As shown in FIG. 8, in response to input of a design document 212 relating to a function A to be newly analyzed (S11), the memory 200 stores a design document 212 relating to a function B for which an attack method has been analyzed in the past and a design document 212 relating to a function C for which an attack method has been analyzed in the past (S12, S13).

[0036] The protected asset similarity calculation unit 150 determines the similarity by topic analysis of the design document 212 (S14). The protected asset similarity calculation unit 150 determines as the highest second similarity the similarity of a protected asset among the multiple protected assets stored in the memory 200, which has the smallest difference between the topic composition ratio in the topic analysis of the design document 212 related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document related to the protected asset stored in the memory 200 (S15).

[0037] For topic analysis, methods such as Latent Semantic Indexing (LSI), Probabilistic Latent Semantic Indexing (PLSI), and Latent Dirichlet Allocation (LDA) can be applied. The difference in topic composition ratio can be calculated, for example, by comparing the difference in composition ratio of several topics in descending order of the number of appearances. In the example of FIG. 8, the similarity between function A and function B is calculated to be 80%, and the similarity between function A and function C is calculated to be 20%. The attack method identification unit 160 of the processor 100 identifies, from among the multiple protected assets stored in the memory 200, the attack method associated with the protected asset with the second similarity as the attack method against the protected asset to be analyzed.

[0038] Protected asset information 210 in memory 200 shown in Fig. 1 includes hierarchical classification 213. Hierarchical classification 213 includes classification relationship 214 and configuration information 215. Memory 200 stores, as classification relationship 214, classifications to which each of a plurality of protected assets belongs, which are hierarchically descending from a superordinate concept to a subordinate concept, as shown in Fig. 9.

[0039] 10, the memory 200 stores, as classification relationships 214, a tree structure T in which each of a plurality of protected assets belongs to a classification cl based on any one of nodes N in the tree structure T, and the classifications cl range from higher-level classifications cl to lower-level classifications cl as the hierarchy progresses from higher-level nodes N to lower-level nodes N connected by links L. The attributes ab of the protected assets included in the classification cl are included in the configuration information 215.

[0040] The protected asset similarity calculation unit 150 of the processor 100 determines as the highest third similarity the similarity of a protected asset that has the shortest distance between the node N of the classification cl to which the protected asset to be analyzed belongs and the node N of the classification cl to which the protected asset stored in the memory 200 belongs, among the multiple protected assets stored in the memory 200. The tree structure T and the classification cl based on the tree structure T can be determined arbitrarily. The distance between one node N and another node N can be, for example, the number of links L between one node N and another node N.

[0041] In the example of FIG. 11 , for example, the number of links L between the node N of the TCU (concrete class) including the TCU instance and the node N of Navi including the Navi instance is 2, so the distance between the node N of the TCU (concrete class) and the node N of Navi can be 2. On the other hand, the number of links L between the node N of the TCU (concrete class) including the TCU instance and the node N of the ECU power supply module including the ECU-power supply module instance is 6, so the distance between the node N of the TCU (concrete class) and the node N of the ECU power supply module can be 6.

[0042] Since the distance between the node N of the TCU (concrete class) and the node N of the Navi is shorter than the distance between the node N of the TCU (concrete class) and the node N of the ECU power supply module, the protected asset similarity calculation unit 150 determines that the protected asset of the Navi has a higher similarity to the protected asset of the TCU (concrete class) than the protected asset of the ECU power supply module. In the above manner, the protected asset similarity calculation unit 150 of the processor 100 calculates a third similarity. The attack method identification unit 160 of the processor 100 identifies, from among the multiple protected assets stored in the memory 200, the attack method associated with the protected asset with the third similarity as an attack method against the protected asset to be analyzed.

[0043] The attack method analysis result 220 in the memory 200 shown in FIG. 1 includes an attack method 221 and attack method analysis process information 222. The attack method 221 includes an attack method against a protected asset identified as described above. The attack method analysis process information 222 includes the first similarity, second similarity, third similarity, protected asset of first similarity, protected asset of second similarity, and protected asset of third similarity obtained as described above, and an attack method identified by them. The attack method analysis process information 222 also includes information on modification of the attack method in accordance with a user request. In other words, the attack method analysis process information 222 includes information on the process of analyzing the attack method.

[0044] The operation of the attack method analysis support device 600 of this embodiment will be described below. Fig. 12 is a flowchart showing an outline of the operation of the attack method analysis support device according to the embodiment. As shown in Fig. 12, when the input device 300 receives an input of a data flow diagram to be analyzed and a correction due to the input (S101), the control unit 110 of the processor 100 accepts the input and correction from the input device 300 (S102). The control unit 110 displays the data flow diagram to be analyzed on the output device 400 (S103). When the input of a data flow diagram to be analyzed and a correction due to the input are not received (S101), the processor 100 proceeds to S104.

[0045] The analysis target identification unit 140 selects functions or data in the data flow diagram as protected assets for which attack methods are to be analyzed (S104). The protected asset similarity calculation unit 150 calculates the similarity of the protected assets (S105). The attack method identification unit 160 identifies attack methods against the analyzed protected assets as attack methods against the analyzed protected assets, and the control unit 110 displays the analysis results of the attack methods in order of similarity to the analyzed protected assets (S106). The control unit 110 causes the output device 400 to output the attack methods against the analyzed protected assets identified by the attack method identification unit 160.

[0046] The input device 300 accepts an input from the user to select the analysis result of the attack method (S107). The input device 300 accepts an input from the user to modify the analysis result of the attack method (S108). The control unit 110 stores the protected asset and information about the input and modified attack methods against the protected asset in the memory 200 (S109).

[0047] 13, regarding the calculation of the similarity in S105 and the identification of the attack method in S106, the protected asset similarity calculation unit 150 determines the highest first similarity as the similarity between a protected asset that has a system element corresponding to the protected asset to be analyzed and a system element corresponding to the protected asset stored in the memory 200 in common among the multiple protected assets stored in the memory 200 (S201). The attack method identification unit 160 identifies the attack method associated with the protected asset with the first similarity among the multiple protected assets stored in the memory 200 as the attack method against the protected asset to be analyzed (S202).

[0048] 14, for calculating the similarity in S105 and identifying the attack method in S106, the protected asset similarity calculation unit 150 calculates the topic composition ratio in the topic analysis of the design document 212 related to the protected asset to be analyzed (S301). The protected asset similarity calculation unit 150 calculates the topic composition ratio in the topic analysis of the design document 212 related to the protected asset stored in the memory 200 (S302).

[0049] The protected asset similarity calculation unit 150 determines as the highest second similarity the similarity of a protected asset that has the smallest difference between the topic composition ratio in the topic analysis of the design document 212 related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document 212 related to the protected asset stored in the memory 200 among the multiple protected assets stored in the memory 200. The attack method identification unit 160 identifies the attack method associated with the protected asset of the second similarity as an attack method against the protected asset to be analyzed among the multiple protected assets stored in the memory 200 (S304).

[0050] 15, regarding the calculation of the similarity in S105 and the identification of the attack method in S106, the protected asset similarity calculation unit 150 determines, among the multiple protected assets stored in the memory 200, the similarity of the protected asset having the shortest distance between the node N of the category cl to which the protected asset to be analyzed belongs and the node N of the category cl to which the protected asset stored in the memory 200 belongs, as the third similarity (S401). The attack method identification unit 160 identifies, among the multiple protected assets stored in the memory 200, the attack method associated with the protected asset with the third similarity as the attack method against the protected asset to be analyzed (S402).

[0051] The following describes a method for selectively using protected assets of the first, second, and third similarities. FIG. 16 is a flowchart showing the operation of identifying attack methods using the first, second, and third similarities and outputting the identified attack methods. As shown in FIG. 16, the processor 100 receives information regarding priority from a user via the input device 300 (S501). When there is a protected asset among the multiple protected assets stored in the memory 200 that has a system element corresponding to the protected asset to be analyzed and a system element corresponding to the protected asset stored in the memory 200 in common (S502), the protected asset similarity calculation unit 150 identifies a protected asset of the first similarity as described above (S503). The attack method identification unit 160 identifies an attack method associated with a protected asset of the first similarity among the multiple protected assets stored in the memory 200 as an attack method against the protected asset to be analyzed (S504).

[0052] The protected asset similarity calculation unit 150 identifies protected assets of the second and third similarities as described above (S505). The attack method identification unit 160 identifies, among the multiple protected assets stored in the memory 200, the attack methods associated with the protected assets of the second and third similarities as attack methods against the protected asset to be analyzed (S506). Note that, when there is a protected asset among the multiple protected assets stored in the memory 200 in which the system element corresponding to the protected asset to be analyzed is common to the system element corresponding to the protected asset stored in the memory 200 (S502), the processes of S505 and S506 may be omitted.

[0053] On the other hand, when there is no protected asset among the plurality of protected assets stored in the memory 200 in which the system element corresponding to the protected asset to be analyzed is common to the system element corresponding to the protected asset stored in the memory 200 (S502), the protected asset similarity calculation unit 150 identifies protected assets of the second and third similarities as described above (S507). The attack method identification unit 160 identifies the attack methods associated with protected assets of the second and third similarities among the plurality of protected assets stored in the memory 200 as attack methods against the protected asset to be analyzed (S508).

[0054] The control unit 110 outputs to the output device, in order of priority, an attack method against the protected asset to be analyzed identified from the attack methods associated with the protected asset of the first similarity, an attack method against the protected asset to be analyzed identified from the attack methods associated with the protected asset of the second similarity, and an attack method against the protected asset to be analyzed identified from the attack methods associated with the protected asset of the third similarity.

[0055] The following describes the cooperative operation of the input device 300, output device 400, processor 100, and memory 200 for the user. An example will be described below with reference to Fig. 17 in which attack methods against the protected assets of a concept are stored in the memory 200, and attack methods against the protected assets of a system element that realizes the concept are identified.

[0056] 17 is a sequence diagram showing the operation of analyzing an attack method on a system element from the correspondence between the protected assets of a concept and the protected assets of a system element in an attack method analysis support device according to an embodiment. As shown in FIG. 17, the input device 300 receives input of the protected assets of a concept and the analysis results of the attack methods on the protected assets of the concept from an analyst of an attack method on a new protected asset (S601). The analysis results of the protected assets of the concept and the attack methods on the protected assets of the concept are stored in the memory 200 via the input device 300 and the processor 100 (S602, S603).

[0057] The input device 300 receives an input of a protected asset selection candidate request for a system element from an analyst of attack methods against a new protected asset (S604). The protected asset selection candidate request for a system element is transmitted to the processor 100 via the input device 300 (S605). The processor 100 calls up the protected asset of the system element from the memory 200 (S606). The processor 100 causes the output device 400 to output a list of protected asset selection candidates for the system element called up from the memory 200 (S607, S608, S609).

[0058] The input device 300 receives an input specifying a protected asset of a system element from an analyst of attack methods against a new protected asset (S610). The specification of the protected asset of the system element is transmitted to the processor 100 via the input device 300 (S611). The processor 100 calls up the analysis results of the protected asset of the system element and the attack methods against the protected asset of the system element from the memory 200 (S612). The processor 100 causes the output device 400 to output the analysis results of the protected asset of the system element and the attack methods against the protected asset of the system element that have been called up from the memory 200 (S613, S614, S615).

[0059] The input device 300 receives an input of a request to modify the analysis results of the attack methods from an analyst of attack methods against a new protected asset (S616). The request to modify the analysis results of the attack methods is sent to the processor 100 via the input device 300 (S617). The processor 100 calls up the analysis results of the attack methods against the protected assets of the system elements from the memory 200 (S618). The processor 100 modifies the analysis results of the attack methods against the protected assets of the system elements called up from the memory 200, and outputs them to the output device 400 (S619, S620, S621).

[0060] An example will be described below with reference to Fig. 18, in which attack methods against the protected assets of system elements are stored in memory 200, and attack methods against the protected assets of software constituting the system elements are identified. Fig. 18 is a sequence diagram showing the operation of analyzing attack methods for software from the correspondence between the protected assets of system elements and the protected assets of software in an attack method analysis support device according to an embodiment. As shown in Fig. 18, the concept of Fig. 17 is replaced with system elements, and the system elements are replaced with software, and the processes of S701 to S721, which are similar to the processes of S601 to S621 in Fig. 17, are performed.

[0061] Below, using Figure 19, we will explain an example of identifying an attack method against a protected asset of software when, among multiple protected assets stored in memory 200, there is no protected asset that has a system element that corresponds to the protected asset of the software to be analyzed and a system element that corresponds to the protected asset stored in memory 200 in common.

[0062] 19 is a sequence diagram showing the operation of analyzing attack methods on a protected asset of an analysis target having different system elements in an attack method analysis support device according to an embodiment. As shown in FIG. 19, the input device 300 receives input of the protected asset of the system element and the analysis results of the attack methods on the protected asset of the system element from an analyst of attack methods on the protected asset in the past (S801). The protected asset input by the analyst of attack methods on the protected asset in the past is different from the system elements that correspond to the protected asset that will be analyzed later by an analyst of attack methods on a new protected asset.

[0063] Thereafter, the processes of S802 to S821 are performed, which are similar to the processes of S702 to S721 in Fig. 18. However, in S812, the attack method against the protected asset called by the processor 100 from the memory 200 is the attack method against the protected asset with the second similarity and the third similarity, as described above.

[0064] The analysis results of the attack methods output by the output device 400 are displayed, for example, as shown in FIG. 20. The first similarity, second similarity, and third similarity between the protected asset to be analyzed (new protected asset) and the protected asset for which the attack methods have been analyzed are displayed. Furthermore, as shown in FIG. 21, weightings for the first similarity, second similarity, and third similarity are set, and the priorities of the first similarity, second similarity, and third similarity are specified. In accordance with the priorities, the attack method against the protected asset to be analyzed identified from the attack method associated with the protected asset with the first similarity, the attack method against the protected asset to be analyzed identified from the attack method associated with the protected asset with the second similarity, and the attack method against the protected asset to be analyzed identified from the attack method associated with the protected asset with the third similarity are displayed.

[0065] 22, information about the process of modifying the attack method content included in the attack method analysis process information 222 is displayed together with the analysis result of the attack method and the content of the attack method. A sub-ID is assigned appropriately depending on the content of the modification. The information about the process of modifying the attack method content and the sub-ID can, for example, show the user the analysis result of the attack method and the likelihood of the content of the attack method.

[0066] For example, in order to comply with regulations, automobile manufacturers and parts suppliers to automobile manufacturers must conduct vulnerability analysis in accordance with the international standard ISO / SAE21434, which summarizes the requirements for ensuring vehicle security. Vulnerability analysis involves analyzing and identifying attack methods against the protection assets being analyzed. Vulnerability analysis requires man-hours proportional to the number of protection assets. The more protection assets there are, the more man-hours required to conduct vulnerability analysis. For example, the number of software protection assets will be greater than the number of system element protection assets.

[0067] On the other hand, in this embodiment, the processor 100 calculates the similarity between the protected asset to be analyzed and the protected asset stored in the memory 200. Based on the similarity, the processor 100 identifies an attack method against the protected asset to be analyzed from the attack methods associated with the protected asset stored in the memory 200. Therefore, as shown in FIGS. 23 and 24, attack methods already analyzed for other similar protected assets can be reused to analyze attack methods against a new protected asset to be analyzed, thereby reducing the amount of work required to analyze cyberattacks. Furthermore, the analysis of cyberattack methods can be made non-personal, eliminating the need for specialized knowledge, and improving maintainability. Furthermore, as shown in FIG. 25, the presence or absence of a cyberattack can be determined using attack methods already analyzed for other similar protected assets.

[0068] In this embodiment, the memory 200 stores a correspondence between the protection assets of the system elements and the protection assets of the software constituting the system elements. The processor 100 calculates a similarity based on the correspondence between the protection assets to be analyzed and the correspondence between the protection assets stored in the memory 200. Protection assets of the system elements that have a correspondence between them can be considered to be the same type of protection assets. Attack methods against the same type of protection assets are often the same. Therefore, by reusing attack methods that have already been analyzed for the corresponding protection assets to analyze attack methods against a new protection asset to be analyzed, the amount of work required to analyze attack methods for cyber attacks can be reduced. Furthermore, since the number of protection assets for system elements is smaller than that of software, the amount of work required to analyze attack methods against the larger number of software protection assets can be reduced by using attack methods that have already been analyzed for the protection assets of the system elements.

[0069] Furthermore, in this embodiment, the memory 200 stores the design document 212 of the protected asset. The processor 100 calculates the similarity based on the topic analysis of the design document 212 related to the protected asset to be analyzed and the topic analysis of the design document 212 related to the protected asset stored in the memory 200. A design document for the protected asset always exists. Therefore, for example, even if there is no protected asset in common between a system element corresponding to the protected asset of the software to be analyzed and a system element corresponding to the protected asset stored in the memory 200, the similarity can be calculated.

[0070] Furthermore, in this embodiment, the memory 200 stores a tree structure T in which a protected asset belongs to a classification cl based on any node N in the tree structure T, and the classification cl is from a higher-level classification cl to a lower-level classification cl as the protected asset goes from a higher-level classification cl to a lower-level classification cl connected by a link L from a higher-level node N. The processor 100 calculates a similarity based on the distance between the node N of the classification cl to which the protected asset to be analyzed belongs and the node N of the classification cl to which the protected asset stored in the memory 200 belongs. The tree structure T and the classification cl based on the tree structure T can be determined arbitrarily. Therefore, for example, even if there is no protected asset in common between a system element corresponding to the protected asset of the software to be analyzed and a system element corresponding to the protected asset stored in the memory 200, it is possible to calculate a similarity.

[0071] Furthermore, in this embodiment, the processor 100 calculates the similarity between the protected asset to be analyzed and each of the multiple protected assets stored in the memory 200, and identifies the attack method associated with the protected asset that has the highest similarity to the protected asset to be analyzed among the multiple protected assets stored in the memory 200 as the attack method against the protected asset to be analyzed. Therefore, it is possible to identify the most likely attack method by using attack methods that have already been analyzed for multiple protected assets.

[0072] Furthermore, in this embodiment, the processor 100 maximizes the similarity of a protected asset that has a system element corresponding to the protected asset to be analyzed and a system element corresponding to the protected asset stored in the memory 200, among the multiple protected assets stored in the memory 200. The processor 100 identifies the attack method associated with the protected asset with the highest similarity, among the multiple protected assets stored in the memory 200, as an attack method against the protected asset to be analyzed. Protected assets that have a system element corresponding to the protected asset to be analyzed and a system element corresponding to the protected asset stored in the memory 200 can be considered to be protected assets of the same type. Therefore, by identifying an attack method that has already been analyzed for a protected asset of the same type as an attack method against the protected asset to be analyzed, it is possible to identify an attack method with the highest probability.

[0073] Furthermore, in this embodiment, the processor 100 increases the similarity of a protected asset, among the multiple protected assets stored in the memory 200, that has the smallest difference between the topic composition ratio in the topic analysis of the design document 212 related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document 212 related to the protected asset stored in the memory 200. The processor 100 identifies, as the attack method against the protected asset to be analyzed, the attack method associated with the protected asset with the highest similarity among the multiple protected assets stored in the memory 200. Therefore, even if there is no protected asset in which a system element corresponding to the protected asset of the software to be analyzed is common to a system element corresponding to the protected asset stored in the memory 200, it is possible to calculate the similarity from the design document 212 of the multiple protected assets and identify the most likely attack method.

[0074] Furthermore, in this embodiment, the memory 200 stores a tree structure T in which each of a plurality of protected assets belongs to a classification cl based on any one of nodes N in the tree structure T. The processor 100 maximizes the similarity of a protected asset among the plurality of protected assets stored in the memory 200, the protected asset having the shortest distance between the node N of the classification cl to which the protected asset to be analyzed belongs and the node N of the classification cl to which the protected asset stored in the memory 200 belongs. The processor 100 identifies, as an attack method against the protected asset to be analyzed, an attack method associated with the protected asset having the highest similarity among the plurality of protected assets stored in the memory 200. Therefore, even if there is no protected asset in which a system element corresponding to the protected asset of the software to be analyzed is common to a system element corresponding to the protected asset stored in the memory 200, it is possible to calculate the similarity from the tree structure T of the plurality of protected assets and identify the most likely attack method.

[0075] Furthermore, in this embodiment, the processor 100 specifies the priority order of the first similarity, the second similarity, and the third similarity based on information received from the user via the input device 300. The processor 100 causes the output device 400 to output, in accordance with the priority order, an attack method against the protected asset to be analyzed identified from the attack methods associated with the protected asset of the first similarity, an attack method against the protected asset to be analyzed identified from the attack methods associated with the protected asset of the second similarity, and an attack method against the protected asset to be analyzed identified from the attack methods associated with the protected asset of the third similarity. Thus, the output device 400 can output, in accordance with the priority order input by the user, attack methods against the protected asset to be analyzed identified by various methods.

[0076] Furthermore, in this embodiment, when there is a protected asset among the multiple protected assets stored in the memory 200 in which a system element corresponding to the protected asset to be analyzed is common to a system element corresponding to the protected asset stored in the memory, the processor 100 identifies the attack method associated with the protected asset of the first similarity among the multiple protected assets stored in the memory 200 as the attack method against the protected asset to be analyzed. By identifying the attack method associated with the same type of protected asset as the attack method against the protected asset to be analyzed as described above, it is possible to identify the attack method with the highest probability.

[0077] On the other hand, when there is no protected asset among the multiple protected assets stored in the memory 200 in which a system element corresponding to the protected asset to be analyzed is common to a system element corresponding to the protected asset stored in the memory, the processor 100 identifies, among the multiple protected assets stored in the memory 200, the attack method associated with the protected asset with the second similarity and the attack method associated with the protected asset with the third similarity as the attack method against the protected asset to be analyzed. Therefore, even when there is no protected asset in which a system element corresponding to the protected asset to be analyzed is common to a system element corresponding to the protected asset stored in the memory, it is possible to identify the attack method with the highest probability.

[0078] The present invention is not limited to the above-described embodiments, and various design modifications can be made without departing from the spirit of the present invention as defined in the claims. For example, the above-described embodiments have been described in detail to facilitate understanding of the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configurations of the above-described embodiments with other configurations, and it is also possible to add other configurations to the configurations of the above-described embodiments. It is also possible to add, delete, or replace other configurations with part of the configurations of the above-described embodiments. [Explanation of symbols]

[0079] 100 processors 110 control section 120 memory 130 Communications Department 140 Analysis Target Identification Section 150 Protected asset similarity calculation unit 160 Attack Method Identification Unit 200 memory 210 Protected Asset Information 211 Correspondence 212 Design Documents 213 Hierarchical classification 214 Classification Relationships 215 Configuration Information 220 Attack Method Analysis Results 221 Attack Method 222 Attack Method Analysis Process Information 300 Input Device 400 Output Device 500 Network 600 Attack Method Analysis Support Device T tree structure N-node L Link cl classification ab attribute

Claims

1. An attack method analysis support device including a processor and a memory, The memory a protected asset, which is any one of a function of a system element constituting an information processing system, data processed by the function of the system element, a function of software constituting the system element, and the data processed by the function of the software, and an attack method of a cyber attack against the protected asset, in association with the protected asset; the processor: Identifying the protected asset to be analyzed based on information received from a user via an input device; calculating a similarity between the protected asset to be analyzed and the protected asset stored in the memory; identifying an attack method against the protected asset to be analyzed from the attack methods associated with the protected assets stored in the memory based on the similarity; outputting the identified attack method against the protected asset to be analyzed to an output device; 1. An attack method analysis support device comprising:

2. The memory storing a correspondence between the protected asset of the system element, which is either the function of the system element or the data processed by the function of the system element, and the protected asset of the software, which is either the function of the software constituting the system element or the data processed by the function of the software; the processor: determining the degree of similarity based on the correspondence relationship of the protected asset to be analyzed and the correspondence relationship of the protected asset stored in the memory; 2. The attack method analysis support device according to claim 1.

3. The memory storing a design document of the protected asset; the processor: determining the degree of similarity based on a topic analysis of the design document related to the protected asset to be analyzed and a topic analysis of the design document related to the protected asset stored in the memory; 2. The attack method analysis support device according to claim 1.

4. The memory storing the tree structure in which the protected assets belong to a classification based on any one of the nodes in the tree structure, and the classifications change from higher-level concepts to lower-level concepts as the protected assets are classified from higher-level concepts to lower-level concepts as the protected assets are classified by links from the higher-level nodes to the lower-level nodes; the processor: determining the similarity based on a distance between the node of the classification to which the protected asset to be analyzed belongs and the node of the classification to which the protected asset stored in the memory belongs; 2. The attack method analysis support device according to claim 1.

5. The memory storing a plurality of the protected assets and the attack methods for the plurality of the protected assets in association with each other; the processor: determining the degree of similarity between the protected asset to be analyzed and each of the plurality of protected assets stored in the memory; identifying, among the plurality of protected assets stored in the memory, the attack method associated with the protected asset having the highest similarity to the protected asset being analyzed as the attack method against the protected asset being analyzed; 2. The attack method analysis support device according to claim 1.

6. The memory storing a plurality of the protected assets and the attack methods for the plurality of the protected assets in association with each other; storing the correspondence between the plurality of protected assets of the system element and the protected assets of the software that constitutes the system element; the processor: Among the plurality of protected assets stored in the memory, the similarity of the protected asset that has the same system element corresponding to the protected asset to be analyzed and the system element corresponding to the protected asset stored in the memory is set to be the highest; identifying the attack method associated with the protected asset having the highest similarity among the plurality of protected assets stored in the memory as the attack method against the protected asset being analyzed; 3. The attack method analysis support device according to claim 2.

7. The memory storing a plurality of the protected assets and the attack methods for the plurality of the protected assets in association with each other; storing the design documents of the plurality of protected assets; the processor: Among the plurality of protected assets stored in the memory, the protected asset having the smallest difference between the topic composition ratio in the topic analysis of the design document related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document related to the protected asset stored in the memory is set to the highest similarity; identifying the attack method associated with the protected asset having the highest similarity among the plurality of protected assets stored in the memory as the attack method against the protected asset being analyzed; 4. The attack method analysis support device according to claim 3.

8. The memory storing a plurality of the protected assets and the attack methods for the plurality of the protected assets in association with each other; storing the tree structure in which each of the plurality of protected assets belongs to the classification by any of the nodes in the tree structure; the processor: Among the plurality of protected assets stored in the memory, the similarity of the protected asset having the shortest distance between the node of the classification to which the protected asset to be analyzed belongs and the node of the classification to which the protected asset stored in the memory belongs is set to be the highest; identifying the attack method associated with the protected asset having the highest similarity among the plurality of protected assets stored in the memory as the attack method against the protected asset being analyzed; 5. The attack method analysis support device according to claim 4.

9. The memory storing a plurality of the protected assets and the attack methods for the plurality of the protected assets in association with each other; storing a correspondence between the protected asset of the system element, which is either the function of the system element or the data processed by the function of the system element, and the protected asset of the software, which is either the function of the software constituting the system element or the data processed by the function of the software; storing design documents of a plurality of the protected assets; storing the tree structure in which each of the plurality of protected assets belongs to a classification based on any one of the nodes in the tree structure, and the classifications change from higher-level concepts to lower-level concepts as the nodes connected by links from higher-level nodes are classified; the processor: among the plurality of protected assets stored in the memory, the similarity of the protected assets that have a common system element that is in the corresponding relationship with the protected asset to be analyzed and the system element that is in the corresponding relationship with the protected asset stored in the memory is defined as a first similarity; identifying the attack method associated with the protected asset having the first similarity among the plurality of protected assets stored in the memory as the attack method against the protected asset being analyzed; among the plurality of protected assets stored in the memory, the similarity of the protected asset having the smallest difference between the topic composition ratio in the topic analysis of the design document related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document related to the protected asset stored in the memory is set as a second similarity; identifying the attack method associated with the protected asset having the second similarity among the plurality of protected assets stored in the memory as the attack method against the protected asset being analyzed; a third similarity is set as the similarity of the protected asset having the shortest distance between the node of the classification to which the protected asset to be analyzed belongs and the node of the classification to which the protected asset stored in the memory belongs, among the plurality of protected assets stored in the memory; identifying the attack method associated with the protected asset having the third similarity among the plurality of protected assets stored in the memory as the attack method against the protected asset being analyzed; determining a priority order of the first similarity, the second similarity, and the third similarity based on information received from a user via an input device; outputting, to an output device, the attack method against the protected asset of the analysis target identified from the attack methods associated with the protected asset of the first similarity, the attack method against the protected asset of the analysis target identified from the attack methods associated with the protected asset of the second similarity, and the attack method against the protected asset of the analysis target identified from the attack methods associated with the protected asset of the third similarity, in accordance with the priority order; 2. The attack method analysis support device according to claim 1.

10. The memory storing a plurality of the protected assets and the attack methods for the plurality of the protected assets in association with each other; storing a correspondence between the protected asset of the system element, which is either the function of the system element or the data processed by the function of the system element, and the protected asset of the software, which is either the function of the software constituting the system element or the data processed by the function of the software; storing design documents of a plurality of the protected assets; storing the tree structure in which each of the plurality of protected assets belongs to a classification based on any one of the nodes in the tree structure, and the classifications change from higher-level concepts to lower-level concepts as the nodes connected by links from higher-level nodes are classified; the processor: When there is a protected asset among the plurality of protected assets stored in the memory, the protected asset to be analyzed has a system element in common with the system element in the corresponding relationship with the protected asset stored in the memory, a first similarity is defined as the similarity between the protected asset that is the analysis target and the system element that is in the corresponding relationship with the protected asset stored in the memory, and the system element that is in the corresponding relationship with the protected asset that is the analysis target and the system element that is in the corresponding relationship with the protected asset that is stored in the memory; identifying the attack method associated with the protected asset having the first similarity among the plurality of protected assets stored in the memory as the attack method against the protected asset being analyzed; When there is no protected asset among the plurality of protected assets stored in the memory that has a common system element that is in the corresponding relationship with the protected asset to be analyzed and the system element that is in the corresponding relationship with the protected asset stored in the memory, among the plurality of protected assets stored in the memory, the similarity of the protected asset having the smallest difference between the topic composition ratio in the topic analysis of the design document related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document related to the protected asset stored in the memory is set as a second similarity; a third similarity is set as the similarity of the protected asset having the shortest distance between the node of the classification to which the protected asset to be analyzed belongs and the node of the classification to which the protected asset stored in the memory belongs, among the plurality of protected assets stored in the memory; identifying the attack method associated with the protected asset having either the second similarity or the third similarity among the plurality of protected assets stored in the memory as the attack method against the protected asset being analyzed; 2. The attack method analysis support device according to claim 1.

Images