Systems and methods for presenting security measures

Abstract

This system and method provides a security countermeasure presentation system that automatically identifies and presents appropriate measures to users in accordance with various rules such as laws and regulations related to security. [Solution] In the security countermeasure presentation system, the storage device stores rule information including requirements for a target system that represents the system to which security countermeasures are to be applied in the rules relating to security, a kill chain phase representing the execution phase of an attack, an attack technique representing the attack method, and countermeasure information for defending against and / or mitigating the attack technique. The computing device associates the requirements contained in the rule information with countermeasure information that satisfies those requirements, receives the content of the user's input operation from the input device, extracts countermeasures corresponding to the content of the received user's input operation from the countermeasure information associated with the requirements, and transmits the information including the extracted countermeasures as information representing security countermeasures to the display device.

Description

Technical Field

[0001] The present invention relates to a technology for presenting security measures.

Background Art

[0002] In recent years, with the increase in cyberattacks on OT (Operational Technology) systems including critical infrastructure, various rules such as laws and regulations regarding cybersecurity (hereinafter collectively referred to as "security regulations" or "regulations") have been rapidly formulated. For example, in Europe, a bill for the EU (European Union) Cyber Resilience Act, which requires security measures to be taken for all IoT (Internet of Things) devices circulating within the EU except for digital products related to medical, aircraft, defense, and automobiles, was announced in September 2022.

[0003] The implementation of this EU Cyber Resilience Act is being considered by the end of 2025, and after implementation, penalties will be imposed on businesses that violate the EU Cyber Resilience Act. Therefore, for companies dealing with IoT devices, security measures throughout the entire life cycle of the target products are urgently needed.

[0004] Also in Japan, recently, the risk of cyberattacks targeting mainly infrastructure companies has been on the rise. Due to concerns about such a situation, the Act on Promotion of Economic Security was enacted and promulgated in May 2022. Along with this, a system in which the government conducts prior reviews when infrastructure companies introduce important facilities, etc., has been introduced since February 2024 to ensure the stable provision of infrastructure services such as electricity, communication, and finance to infrastructure companies in Japan.

[0005] From the domestic and international trends regarding such security regulations, infrastructure companies are required to comply with rules including security regulations for OT systems and OT products handled by themselves and / or their customers.

[0006] In this context, technologies for managing information asset importance information and vulnerability information are known in order to determine whether information assets such as electronic files are vulnerable to cyberattacks (for example, Patent Document 1). [Prior art documents] [Patent Documents]

[0007] [Patent Document 1] Japanese Patent Publication No. 2012-133584 [Overview of the project] [Problems that the invention aims to solve]

[0008] To ensure sufficiently robust cybersecurity for information assets, it is necessary to implement appropriate measures in accordance with the rules exemplified in the explanation above. For this purpose, if we attempt to accurately interpret the content stipulated in such rules, automatically identify appropriate countermeasures, and present the results to the user, there are accuracy issues regarding the validity of the automatically identified countermeasures.

[0009] In this regard, the technology described in Patent Document 1 merely manages information on the importance of the information asset in question. Therefore, even if one attempts to use the technology described in Patent Document 1 to automatically identify and present appropriate measures in accordance with security regulations to the user, there is no mechanism to support the validity of the automatically identified measures, and thus there is a problem in that it is not possible to automatically identify appropriate measures.

[0010] This invention has been made in view of the above-mentioned problems, and aims to provide a technology that can automatically identify and present to the user appropriate countermeasures in accordance with various rules such as laws and regulations concerning security. [Means for solving the problem]

[0011] The security countermeasure presentation system according to the present invention is a system that presents information representing security countermeasures by displaying it on a display device, and comprises a computer comprising at least a computing device and a storage device, and connected to an external input device and a display device so as to be able to communicate data with each other, the storage device stores rule information which includes at least requirements for a target system which represents the system to which security countermeasures are to be applied and for components included in said target system, a kill chain phase which represents the execution phase of an attack, an attack technique which represents the attack method used in the kill chain phase, and countermeasure information which represents countermeasures to defend against and / or mitigate the attack technique, the computing device associates the requirements included in the rule information with countermeasure information which satisfies said requirements, receives the content of the user's input operation to the input device from said input device, extracts countermeasures from the countermeasure information which is associated with the requirements according to the content of the received user's input operation, and transmits the information including the extracted countermeasures as information representing security countermeasures to the display device. [Effects of the Invention]

[0012] According to the present invention, appropriate measures in accordance with various rules such as laws and regulations concerning security can be automatically identified and presented to the user.

[0013] Further issues disclosed in this application, and methods for solving them, will be made clear in the section on embodiments for carrying out the invention and in the drawings. [Brief explanation of the drawing]

[0014] [Figure 1] This figure shows an example of the overall hardware configuration of the system, including the security countermeasure presentation system related to Examples 1 and 2. [Figure 2] This figure shows an example of a functional block of the security countermeasure presentation system according to Example 1. [Figure 3] This figure shows an example of the structure of the legal database related to Examples 1 and 2. [Figure 4]It is a diagram showing an example of the configuration of the security knowledge database according to Embodiments 1 and 2. [Figure 5] It is a flowchart showing an example of the flow of the feature quantity calculation process in Embodiments 1 and 2. [Figure 6] It is a diagram showing an example of the configuration of the accountable database according to Embodiment 1. [Figure 7] It is a flowchart showing an example of the flow of the countermeasure presentation process in Embodiments 1 and 2. [Figure 8] It is a diagram showing an example of the display screen in Embodiment 1. [Figure 9] It is a diagram showing an example of the functional block of the security countermeasure presentation system according to Embodiment 2. [Figure 10] It is a flowchart showing an example of the flow of data preprocessing in Embodiment 2. [ [Figure 11] It is a diagram showing an example of the configuration of the accountable database according to Embodiment 2. [Figure 12] It is a diagram showing an example of the display screen in Embodiment 2.

Mode for Carrying Out the Invention

[0015] Hereinafter, several embodiments of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to the description content of the following embodiments and modification examples. Examples in which the specific configuration is deformed are also included within the scope not departing from the idea or gist of the present invention. For example, each of the following embodiments describes the present invention in detail, and is not necessarily limited to those having all the configurations included in the description.

[0016] In the configuration of the invention described below, the same parts and / or elements, or parts and / or elements having the same functions are commonly used with the same reference numerals among different drawings, and duplicate explanations may be omitted.

[0017] In addition, when there are a plurality of identical parts and / or elements, or parts and / or elements having similar functions, in order to distinguish the plurality of parts and / or elements, different subscripts may be attached to the same reference numeral for description. On the other hand, when it is not necessary to distinguish the plurality of parts and / or elements, the subscripts may be omitted in the description.

[0018] The notations such as "first", "second", "third", etc. in this specification and the like are attached for identifying components, and do not necessarily limit the number, order, or content thereof. In addition, the characters and numbers for identifying components are used for each context, and the characters and numbers used in one context do not necessarily indicate the same configuration in another context. Also, it does not prevent a component identified by certain characters and numbers from having the functions of a component identified by other characters and numbers.

[0019] The positions, sizes, shapes, ranges, etc. of each configuration shown in this specification and / or the drawings may not represent the actual positions, sizes, shapes, ranges, etc. in order to facilitate the understanding of the invention. Therefore, the present invention is not necessarily limited to the positions, sizes, shapes, ranges, etc. disclosed in this specification and / or the drawings. <s

[0020] In this specification, components represented in the singular form shall include the plural form unless otherwise clearly indicated in the context.

[0021] In addition, in the following description, the "interface device" may be one or more interface devices. The one or more interface devices may be at least one of the following. • One or more input / output interfaces. An input / output interface is an interface device to at least one of the following: an I / O (Input / Output) device and a remote display computer. The input / output interface to the display computer may be a communication interface device. The at least one I / O device may be either a user interface device, such as an input interface device like a keyboard and a pointing device, or an output interface device like a display device. • One or more communication interfaces. One or more communication interfaces may be one or more identical communication interface devices (e.g., one or more NICs (Network Interface Cards)) or two or more different communication interface devices (e.g., a NIC and an HBA (Host Bus Adapter)). The network that the communication interface accesses for communication may be the Internet, a LAN (Local Area Network), a WAN (Wide Area Network), or a mobile phone network, but is not limited to these.

[0022] Furthermore, in the following description, “storage device” includes at least one memory. At least one memory may be volatile or non-volatile memory. In addition to one or more memory, the storage device may include one or more PDEVs. “PDEV” means a physical storage device, which is typically a non-volatile storage device (e.g., auxiliary storage device). PDEVs may be, for example, HDDs (Hard Disk Drives), SSDs (Solid State Drives), NVME (Non-Volatile Memory Express) drives, or SCMs (Storage Class Memory).

[0023] Furthermore, in the following description, "arithmetic unit" refers to one or more processor devices. At least one processor device is typically a microprocessor device such as a CPU (Central Processing Unit), but may include other types of processor devices such as a GPU (Graphics Processing Unit), MPU (Micro Processing Unit), or DSP (Digital Signal Processor). At least one processor device may be single-core or multi-core. At least one processor device may be a processor core. At least one processor device may be a broad-sense processor device such as a hardware circuit that performs some or all of the processing (e.g., an FPGA (Field Programmable Gate Array), CPLD (Complex Programmable Logic Device), or ASIC (Application Specific Integrated Circuit)), or may include such broad-sense processor devices.

[0024] Furthermore, in the following explanation, functions may be described using the expression "xxx section," but a function may be realized by the execution of one or more computer programs (hereinafter also simply referred to as "programs") by an arithmetic unit, by one or more hardware circuits (e.g., FPGA or ASIC), or by a combination thereof. When a function is realized by the execution of a program by an arithmetic unit, the defined processing is carried out using memory devices and / or interface devices as appropriate, so the function may be at least a part of the arithmetic unit. The processing described with a function as the subject may be the processing performed by the arithmetic unit or the system and / or device having the arithmetic unit. Programs may be installed from program source. Program source may be, for example, a program distribution computer or a computer-readable recording medium (e.g., a non-temporary recording medium). The description of each function is an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0025] Furthermore, in the following explanation, the process may be described using "program" as the subject, but the process described using "program" as the subject may also be the process performed by the arithmetic unit or a device or system having such an arithmetic unit. A program may be installed from program source to a device such as a computer. The program source may be, for example, a program distribution server or a computer-readable (e.g., non-temporary) recording medium. Also, in the following explanation, two or more programs may be implemented as a single program, or one program may be implemented as two or more programs.

[0026] Furthermore, in the following explanation, we may use expressions such as "yyy database" and "yyy table" to describe information from which an output is obtained for a given input. This information may be represented by data of any structure (for example, it may be structured data or unstructured data), or it may be a learning model such as a neural network, genetic algorithm, or random forest that generates an output from an input. Therefore, "yyy database" and "yyy table" can be replaced with "yyy information." Also, in the following explanation, the configuration of each database and table is just an example, and one database or table may be divided into two or more databases or tables, or all or part of two or more databases or tables may be a single database or table.

[0027] Furthermore, in the following explanation, "dataset" means data consisting of one or more data elements (a logical block of electronic data), which may be, for example, a record, a file, a key-value pair, or a tuple.

[0028] Furthermore, in the following description, the "security measures presentation system" and the "security measures presentation device" may be a device or system composed of one or more physical computers (for example, an on-premise device or system), or a system implemented on a group of physical computing resources (for example, a cloud infrastructure) (for example, a cloud computing system). The "displaying" of display information by the security measures presentation system and / or security measures presentation device may mean displaying the display information on a display device owned by a computer (security measures presentation system and / or security measures presentation device), or the computer (security measures presentation system and / or security measures presentation device) may transmit the display information to a display computer (display device) (in the latter case, the display information is displayed by the display computer (display device)). [Examples]

[0029] <Example System Configuration> First, an example configuration of the security countermeasure presentation system 1 according to Example 1 (and Example 2 described later) will be explained using Figures 1 and 2.

[0030] Figure 1 is a schematic diagram showing an example of the overall hardware configuration of the system, including the security countermeasure presentation system 1 according to Examples 1 and 2. Figure 2 is a schematic diagram showing an example of the functional blocks of the security countermeasure presentation system 1 according to Example 1.

[0031] (Example of the overall system configuration) The security measures presentation system 1 according to Example 1 (and Example 2 described later) is, in general terms, a computer system capable of automatically determining appropriate security measures required by law for various control systems (OT (Operational Technology) systems) that control critical infrastructure, etc., and various control devices (OT products) that constitute the control systems, in response to user input, and presenting these security measures to the user along with the rationale for the chosen security measures. It is implemented by at least one computer and / or server equipped with each of the configurations described later. That is, the security measures presentation system 1 is a computer system composed of one computer physically, or multiple computers configured logically or physically, and may operate in separate threads on the same computer, or may operate on a virtual computer built on multiple physical computing resources. In this example (and Example 2 described later), the security measures presentation system 1 is described as consisting of one server, but the security measures presentation system 1 may consist of, for example, multiple computers and / or servers.

[0032] As illustrated in Figures 1-2, the servers constituting this security measures presentation system 1 are connected to data servers that store the legal database 2 (details described later) and the security knowledge database 3 (details described later) via an appropriate communication network such as the internet or a dedicated line (hereinafter simply referred to as "the network"), enabling data communication between them. In this embodiment (and Embodiment 2 described later), the data server storing the legal database 2 and the data server storing the security knowledge database 3 are described as separate devices, but the legal database 2 and the security knowledge database 3 may, for example, be stored in the same data server. Furthermore, the servers constituting the security measures presentation system 1, and each data server storing the legal database 2 and / or the security knowledge database 3, and the network are all connected by wire via well-known communication equipment (not shown), but they may also be connected wirelessly.

[0033] Furthermore, as illustrated in Figures 1 and 2, various terminals such as laptop PCs, tablets, and smartphones owned by users of the Security Measures Presentation System 1, such as security consultants, system administrators of companies, and operators of the Security Measures Presentation System 1, are connected to the server constituting this Security Measures Presentation System 1 via a network, enabling data communication between them, each including input devices 4a, 4b, 4c...4n (hereinafter collectively referred to as "Input Device 4" when referring to them collectively or without distinction) and display devices 5a, 5b, 5c...5n (hereinafter collectively referred to as "Display Device 5" when referring to them collectively or without distinction). Of these, the input devices 4 are various input interface devices such as keyboards, pointing devices, and touch panels for receiving input operations from users of the Security Measures Presentation System 1. The display devices 5 are various output interface devices such as liquid crystal displays and touch screens for outputting processing results to users of the Security Measures Presentation System 1 in a format that can be visually confirmed. In this embodiment (and Embodiment 2 described later), the input device 4 and the display device 5 are described as being operated integrally within the same terminal, each performing an input function and an output function, respectively. However, the input device 4 and the display device 5 may be implemented as separate terminals, for example. Also, each input device 4 and / or each display device 5 is connected to the network wirelessly, but they may also be connected by wire. Each user of the security measures presentation system 1 that possesses the input device 4 and / or the display device 5 is assigned a unique ID called a user ID in advance.

[0034] Furthermore, other devices and terminals (hereinafter also simply referred to as "other devices") may be connected to the server constituting this security measures presentation system 1 via a network, enabling them to communicate data with each other. In this case, the other devices and the network may be connected via wired or wireless connections using well-known communication equipment. In this case, the security measures presentation system 1 may also acquire various data from such other devices, for example, to be used in the processes described later.

[0035] In this embodiment, the server constituting the security countermeasures presentation system 1 and various devices such as the data server storing the legal database 2, the data server storing the security knowledge database 3, the input device 4, and the display device 5 were described as separate devices. However, the security countermeasures presentation system 1 and these various devices may be composed of the same device, for example. In this case, the security countermeasures presentation system may be configured as a system including these various devices, for example. Furthermore, the security countermeasures presentation system may be configured to include some or all of the functions performed by these various devices, for example, by pre-storing the legal database 2 and the security knowledge database 3 in its own storage device 14.

[0036] (Example hardware configuration for Security Measures Presentation System 1) Next, an example of the hardware configuration of the security countermeasure presentation system 1 will be explained using Figure 1.

[0037] As described above, the security countermeasure presentation system 1 according to Examples 1 and 2 is implemented by at least one computer and / or server. The following description assumes that the security countermeasure presentation system 1 according to this embodiment (and Example 2 described later) is implemented by a single general-purpose server equipped with one or more arithmetic units 11, a storage device 14 consisting of one or more non-volatile memories 12 and one or more volatile memories 13, one or more communication interfaces (not shown) and one or more input / output interfaces 15 (not shown), and wired or wireless communication lines connecting them.

[0038] In other words, the security countermeasure presentation system 1 includes a storage device 14 containing non-volatile memory 12 and volatile memory 13, an interface device containing a communication interface and an input / output interface 15, and a computing device 11 connected thereto.

[0039] The non-volatile memory 12 mainly includes non-volatile memory elements used as auxiliary storage devices such as flash memory, and non-volatile memory elements used as main storage devices such as ROM (Read Only Memory). Specific examples of non-volatile memory 12 used as auxiliary storage devices include SSDs (Solid State Drives) and HDDs (Hard Disk Drives). The non-volatile memory 12 used as auxiliary storage devices stores at least a security countermeasure suggestion program. The security countermeasure suggestion program is a computer program that implements the necessary functions for the security countermeasure suggestion system 1.

[0040] In other words, when this security countermeasure suggestion program is executed by the arithmetic unit 11, the functions performed by each functional unit of the security countermeasure suggestion system 1, such as the feature calculation unit 6 and the countermeasure suggestion unit 8, and the data preprocessing unit 9 in Example 2, which will be described later, are realized. To put it another way, when the security countermeasure suggestion program is executed by the arithmetic unit 11, various processes are performed, including the processing related to the calculation of features (hereinafter referred to as "feature calculation processing") which will be described later in relation to Figure 5, the processing related to the suggestion of security countermeasures (hereinafter referred to as "countermeasure suggestion processing") which will be described later in relation to Figure 7, and the processing related to data preprocessing (hereinafter referred to as "data preprocessing") which will be described later in relation to Figure 10 in Example 2.

[0041] The security measures suggestion program may also be installed from its program source. The program source may be, for example, a program distribution computer or a computer-readable recording medium. Furthermore, the security measures suggestion program may consist of a device driver, an operating system, various application programs located at a higher layer, and libraries that provide common functions to these programs. Moreover, two or more programs may be implemented as a single security measures suggestion program, or one security measures suggestion program may be implemented as two or more programs.

[0042] Furthermore, as mentioned above, the non-volatile memory 12 includes a non-volatile memory element used as main memory, such as ROM (Read Only Memory). ROM stores immutable programs (for example, BIOS (Basic Input / Output System)).

[0043] In other words, the non-volatile memory 12 is a storage medium (a type of storage device 14) that can read various computer programs, including security countermeasures suggestion programs.

[0044] On the other hand, the volatile memory 13 is a volatile memory element used as a main memory, such as RAM (Random Access Memory). This volatile memory 13 temporarily holds data representing various information read from the non-volatile memory 12, as well as various data and signals acquired via the communication interface and / or input / output interface 15.

[0045] The arithmetic unit 11 is a processor device such as a CPU (Central Processing Unit) and various coprocessors. This arithmetic unit 11 controls the security countermeasure presentation system 1 itself by calling and executing various computer programs, including the security countermeasure presentation program, into the volatile memory 13, and also controls a control unit (not shown) that performs various processing such as calculation processing and judgment processing.

[0046] The interface device includes a communication interface that controls the communication unit described later, and an input / output interface 15 that controls the input and output units described later.

[0047] The communication interface is a communication interface device that connects to a network and controls communication with various other devices such as a data server that stores the legal database 2, a data server that stores the security knowledge database 3, an input device 4, and a display device 5, according to a predetermined protocol.

[0048] The input / output interface 15 is an input / output interface device that receives various input operations performed by the user of the security countermeasure presentation system 1 on the input device 4 via the network, and displays the results of various processes performed by the security countermeasure presentation system 1 on the display device 5 via the network.

[0049] The security countermeasures presentation system 1 may be implemented by a standalone device or by an embedded device.

[0050] (Example of a functional block for the security countermeasure presentation system 1 according to Example 1) Next, an example of the various functional blocks provided by the security countermeasure presentation system 1 according to Embodiment 1 will be explained using Figure 2. Note that the blocks described below represent functional blocks, not hardware-level configurations.

[0051] The security countermeasure presentation system 1 is comprised of functional blocks including a control unit, a storage unit, and a communication unit, and a user interface unit consisting of an input unit and an output unit (none of which are shown).

[0052] The control unit performs various data processing based on the programs and data stored in the memory unit and the data acquired by the communication unit. The control unit also performs various processes such as the feature calculation process (details will be described later in relation to Figure 5) and the countermeasure suggestion process (details will be described later in relation to Figure 7). The control unit also functions as an interface between the memory unit and the communication unit.

[0053] As illustrated in Figure 2, the control unit has functional blocks for feature calculation 6 and countermeasure suggestion 8.

[0054] The feature calculation unit 6 executes feature calculation processing. This feature calculation processing broadly involves extracting text data from data such as legal requirements (hereinafter also referred to as "requirements" or "conditions") recorded in the legal database 2 and data such as attack techniques and countermeasures (hereinafter also referred to as "defense measures" or "mitigation measures") recorded in the security knowledge database 3, and then calculating their features. Here, features refer to quantitative representations of the importance and rarity of words within the text. The feature calculation unit 6 obtains topic distributions (details described later) for each of these values, measures the similarity between topic distributions, and stores the measurement results in the accountable database 7. This similarity between topic distributions is an indicator representing the degree of appropriateness of the countermeasures that the security countermeasure presentation system 1 automatically identifies and presents to the user. The appropriateness (validity) of these countermeasures is ensured by the security countermeasure presentation system 1 automatically identifying the countermeasures to present to the user based on this similarity between topic distributions. Details of the feature extraction process will be described later in relation to Figure 5.

[0055] Furthermore, the countermeasure suggestion unit 8 executes a countermeasure suggestion process. In general terms, this countermeasure suggestion process involves extracting relevant data from the accountable database 7 according to the content of the user's input operation received via the input device 4, sending it to the display device 5, and presenting it as a security measure. At this time, the relevant data is extracted from the accountable database 7 based on its similarity to the input information. In other words, the countermeasure suggestion unit 8 operates according to the accountable database 7 deployed in the volatile memory 13. Details of the countermeasure suggestion process will be described later in relation to Figure 7.

[0056] The control unit is configured using the arithmetic unit 11, and these functional blocks can be realized by executing a predetermined security countermeasure suggestion program. The arithmetic unit 11 may also be configured using logic circuits such as an ASIC (application-specific integrated circuit) or an FPGA (Field Programmable Gate Array).

[0057] The memory unit is configured, for example, using a storage device 14 consisting of a non-volatile memory 12 and a volatile memory 13, and stores a program that supplies various processing instructions to the control unit, and data representing various information used in the processing executed by the control unit.

[0058] The memory unit stores, for example, at least an accountable database 7. This accountable database 7, in general terms, records data extracted from the legal database 2 and data extracted from the security knowledge database 3, linked together based on the similarity between the data calculated by feature analysis (for example, the similarity between legal requirements and corresponding attack techniques). Details of the accountable database 7 will be described later in relation to Figure 6.

[0059] The control unit can read and write this information to the memory unit, thereby executing various processes such as the feature calculation process (described in detail later in relation to Figure 5) and the countermeasure suggestion process (described in detail later in relation to Figure 7).

[0060] The communications unit is responsible for communication processing with various other devices, such as data servers that store the legal database 2, data servers that store the security knowledge database 3, input devices 4, and display devices 5, via the internet (an example of a network). The communications unit is configured using, for example, a NIC (Network Interface Card) and an HBA (Host Bus Adapter).

[0061] The user interface section is composed of functional blocks including an input section and an output section.

[0062] The input unit is responsible for processing related to the user interface, including receiving input operations from the user via the input device 4. The input device 4 is composed of various input interface devices such as a keyboard, pointing device, and touch panel, and detects various operations from the user. The input unit converts data input signals received from the input device 4, as well as signals input from the legal database 2 and the security knowledge database 3, into data in a format that can be processed by the arithmetic unit 11.

[0063] The output unit is responsible for processing related to the user interface, including output processing such as displaying various screens on the display device 5 and outputting audio. The display device 5 is configured using at least various output interface devices, such as a liquid crystal display, a touchscreen, or a printer. The output unit generates an output signal according to the calculation result of the arithmetic unit 11 and outputs that signal to the display device 5.

[0064] In other words, each component of the security countermeasure presentation system 1 is realized through the cooperation of hardware, including an arithmetic unit 11, storage devices 14 such as non-volatile memory 12 and volatile memory 13, interface devices such as a communication interface and an input / output interface 15, and wired or wireless communication lines connecting them, and software stored in the storage device 14 that supplies processing instructions to the arithmetic unit.

[0065] In this embodiment, each function of the security countermeasure presentation system 1 is described as being integrated and implemented by a single server. However, each of these functions of the security countermeasure presentation system 1 may be implemented by multiple interconnected computers and / or servers. Furthermore, the security countermeasure presentation system 1 may include a general-purpose computer such as a laptop PC and a web browser installed thereon, or it may include various portable devices.

[0066] Furthermore, the security measures presentation system 1 may have additional functions in addition to the various functions described above.

[0067] <Example Database Configuration> Next, an example of the configuration of the legal database 2 and the security knowledge database 3, which are sources of various data for the security countermeasure presentation system 1, will be explained using Figures 3 and 4.

[0068] (Example of the structure of legal database 2) Figure 3 shows an example of the configuration of the legal database 2 related to Examples 1 and 2.

[0069] Legal Database 2 is a database for managing information about laws and regulations concerning cybersecurity. Records in Legal Database 2 include, for example, a Legal Name column 30 that holds information representing the name of a cybersecurity law, a Category column 31 that holds information representing a macro category within the law, an ID column 32 that holds an ID that uniquely identifies the requirements within the category, and a Requirements column 33 that holds information representing the requirements within the category. The laws and regulations (security laws and regulations) managed by Legal Database 2 in this embodiment (and Embodiment 2 described later) refer collectively to various rules concerning cybersecurity for organizations, systems, products (an example of a component), etc., including not only national and international laws concerning cybersecurity in each country, but also domestic and international rules, industry rules, company rules, domestic standards, international standards, industry standards, company standards, domestic and international precedents and court cases, etc., including soft law. In other words, the legal database 2 manages cybersecurity rule information by legal name by linking and recording the information held in the legal name column 30, category column 31, ID column 32, and requirements column 33 for each record.

[0070] The EU Cyber ​​Resilience Act and international standards for control system security, including IEC (International Electrotechnical Commission) 62443, are both examples of security legislation. IEC 62443-3-3 categorizes system security requirements into seven categories, while IEC 62443-4-2 categorizes component security requirements into seven categories.

[0071] As shown in the example in Figure 3, category [System integrity] is one of the seven categories and relates to the integrity of the system. In [System integrity], [ID:1] requires [Communication integrity], that is, that the component has a function to verify the integrity of information. In the requirements section 33, in addition to [Communication integrity], a description of how to implement it is also included.

[0072] (Example configuration of Security Knowledge Database 3) Figure 4 shows an example of the configuration of the security knowledge database 3 related to Examples 1 and 2.

[0073] Security Knowledge Database 3 is a table for managing information about cybersecurity knowledge. Records in Security Knowledge Database 3 include, for example, a Cyber ​​Kill Chain (hereinafter also simply referred to as "Kill Chain") Phase column 40, which describes the steps an attacker takes when carrying out an attack on an information system or control system, an ID column 41, and Attack Technique columns 42 and Countermeasure columns 43 associated with each phase. There are many ways of dividing the phases in Kill Chain Phase column 40, including those that are publicly available. Among these, those specific to control systems include each of the nine phases from Initial Access to Impact. Attack techniques managed in Attack Technique column 42 summarize the attack methods expected in each phase of the kill chain. For example, in the case of Initial Access, [Drive by Compromise] and [Exploit Public-Facing Application] are known. In response to this, the countermeasures section 43 lists application isolation and sandboxing, and exploit protection as countermeasures (defense measures, mitigation measures). The attack technique section 42 and the countermeasures section 43 are assumed to contain not only the attack technique name and countermeasure name as described above, but also explanatory documents for them. In other words, the security knowledge database 3 manages information about cybersecurity knowledge for each phase of the kill chain by linking and recording the information held in the kill chain phase section 40, ID section 41, attack technique section 42, and countermeasures section 43 for each record.

[0074] Furthermore, the information used by the security countermeasure presentation system 1 according to this embodiment (and Embodiment 2 described later), including the information stored in the legal database 2 and the security knowledge database 3, is independent of the data structure and may be represented in any data structure. For example, a data structure appropriately selected from tables, lists, databases, or queues can store the information.

[0075] <Example of system operation> Next, we will explain each process performed by the security countermeasure presentation system 1 according to Example 1 (and Example 2, which will be described later) with reference to Figures 5 to 8.

[0076] (Feature calculation process) Figure 5 is a flowchart 500 showing an example of the flow of feature calculation processing performed in the security countermeasure presentation system 1 according to Examples 1 and 2.

[0077] In step S51, the control unit of the security countermeasure presentation system 1 uses the feature calculation unit 6 to automatically extract and obtain the category names of laws and regulations from the law database 2 and the attack technique names from the security knowledge database 3. For example, text data such as [System Integrity] in the category column 31 of the law database 2 as exemplified in Figure 3, and [Drive by Compromise] in the attack technique column 42 of the security knowledge database 3 as exemplified in Figure 4, are the targets for extraction. Note that there may be multiple data servers storing the law database 2 and the security knowledge database 3 on the network. Also, there may be multiple types of law databases 2 and security knowledge databases 3 on the network. In such cases, the control unit of the security countermeasure presentation system 1 may use the feature calculation unit 6 to automatically select the law database 2 from which to obtain the category names of laws and regulations and the security knowledge database 3 from which to obtain the attack technique names, or it may accept a selection operation from the user to specify the law database 2 and security knowledge database 3 from which to obtain the data. As a result, the category name of the legal regulation is automatically retrieved from the legal regulation database 2, and the attack technique name is automatically retrieved from the security knowledge database 3. When the processing in step S51 is completed, the control unit of the security countermeasure presentation system 1 proceeds to step S52.

[0078] In step S52, the control unit of the security countermeasure presentation system 1 uses the feature calculation unit 6 to calculate the feature quantities for the legal category names and attack technique names extracted in step S51, and then performs a process of vectorizing them. Here, feature quantities refer to the importance and rarity of text data. For example, one index that quantitatively evaluates these values ​​is TF-IDF (Term Frequency-Inverse Document Frequency). This is a value calculated as follows, where tf(t, d) is the number of occurrences of word t in document d, and df(t) is the number of documents containing word t in the entire DOCS document set.

[0079] If the text data representing the category name of a legal regulation stored in the category column 31 of the legal regulations database 2 is denoted as req, then its feature quantity can be expressed as tf(t, req) = count(t, req) / |req|. Similarly, if the text data representing the name of an attack technique stored in the attack technique column 42 of the security knowledge database 3 is denoted as att, then its feature quantity can be expressed as tf(t, att) = count(t, att) / |att|.

[0080] Furthermore, since idf(t) is expressed as idf(t)=log(|REQ|+|ATT| / 1+d), the TF-IDF value (hereinafter also referred to as "TF-IDF value") is calculated for each of the legal category names and attack technique names according to the above. This quantitatively represents the frequency and rarity of words in all text data, which are then vectorized. Note that the method for calculating the features of the text data is not limited to TF-IDF, and various methods can be used.

[0081] The process performed in step S52 vectorizes the TF-IDF values ​​representing the features of the category name and the attack technique name, respectively. Once the processing in step S52 is complete, the control unit of the security countermeasure presentation system 1 proceeds to step S53.

[0082] In step S53, the control unit of the security countermeasure presentation system 1 executes a process to generate a distribution (hereinafter also referred to as the "topic distribution") for each of the values ​​representing the feature quantities of the legal category name and attack technique name, which were calculated in step S52 and then vectorized by the feature calculation unit 6. In this embodiment (and embodiment 2 described later), the topic distribution is generated by the feature calculation unit 6 for each of the vectorized TF-IDF values ​​of the legal category name and attack technique name. The generation of this topic distribution in step S53 is carried out, for example, by performing a distribution transformation using LDA (Latent Dicreri Allocation). The purpose of this is to efficiently extract information by identifying important words in the text using TF-IDF and then extracting the topic (meaning) of the text using LDA. LDA is a method that excels at extracting common topics or themes from multiple documents, and is based on the idea that each document consists of multiple topics, and each topic is represented by a specific set of words. Therefore, it becomes possible to extract the intent, attacks, and characteristics of legal requirements from the legal category and the content of the attack technique. As a result, a topic distribution is generated for each of the feature quantities (TF-IDF values) of the legal category name and attack technique name, which are calculated in step S52 and then vectorized. When the processing in step S53 is completed, the control unit of the security countermeasure presentation system 1 proceeds to step S54.

[0083] In step S54, the control unit of the security countermeasure presentation system 1 uses the feature calculation unit 6 to perform a process to identify the similarity between the topic distributions generated in step S53. This process in step S54 is performed to measure the distance between the legal categories and the attack techniques. For example, cosine similarity or Euclidean distance can be used to measure similarity. Of these, cosine similarity calculates the cosine of the angle between the two distributions, and the closer the value is to 1, the closer the two are. This identifies the similarity between the topic distributions generated in step S53. Once the process in step S54 is complete, the control unit of the security countermeasure presentation system 1 proceeds to step S55.

[0084] In step S55, the control unit of the security countermeasure presentation system 1 uses the feature calculation unit 6 to identify the most similar attack technique for each category name based on the similarity identified in step S54, and then centralizes the countermeasures (defense measures, mitigation measures) associated with that attack technique from the security knowledge database 3 and stores them in the accountable database 7 in the manner illustrated in Figure 6 (and Figure 11).

[0085] (Example configuration of Accountable Database 7) Figure 6 shows an example of the configuration of the accountable database 7 according to Example 1.

[0086] As described above, the accountable database 7 is a database that records data extracted from the legal database 2 and data extracted from the security knowledge database 3, linked together based on the similarity between topic distributions identified in step S54. The records in the accountable database 7 according to Example 1 include, for example, a category column 31, an ID column 32, and a requirements column 33 that hold data obtained from the legal database 2, a kill chain phase column 40, an attack technique column 42, and a countermeasure column 43 that hold data obtained from the security knowledge database 3, and a similarity column 60 that represents the similarity between them. Of these, the contents of the category column 31, an ID column 32, and a requirements column 33 that hold data obtained from the legal database 2, and the contents of the kill chain phase column 40, an attack technique column 42, and a countermeasure column 43 that hold data obtained from the security knowledge database 3 are the same as the contents in the legal database 2 or the security knowledge database 3.

[0087] For example, as a threat related to the legal requirement [Communication Integrity] for the category [System Integrity], an attacker may execute [Program upload] as an attack technique during the information collection phase [Collection]. In this case, it is preferable for the system administrator of the system to implement access management and authentication strengthening as countermeasures. This is because the similarity between the content of the legal requirement [Communication Integrity] and the content of the attack technique [Program upload] is extremely high at 0.99. In addition to this, the accountable database 7 stores other items with high similarity in descending order. Note that in Example 1, the accountable database 7 stores the three items with the highest similarity in descending order.

[0088] As a result, based on the similarity identified in step S54, the most similar attack technique for each category name is identified, and countermeasures associated with that attack technique are collected from the security knowledge database 3 and stored in the accountable database 7. When the processing in step S55 is completed, the control unit of the security countermeasure presentation system 1 terminates the feature calculation process shown in the flowchart 500 of Figure 5.

[0089] (Process for suggesting countermeasures) Figure 7 is a flowchart 700 showing an example of the flow of the countermeasure suggestion process executed in the security countermeasure suggestion system 1 according to Examples 1 and 2.

[0090] In step S71, the control unit of the security countermeasure presentation system 1 receives text data (hereinafter also referred to as "input data") entered by the user into the input device 4 via the input unit, i.e., the input / output interface 15, and then performs a process of vectorizing it using the countermeasure presentation unit 8. The input data referred to here is text data that represents content such as "What countermeasures satisfy legal requirement ID 1?", "What are the threats to legal requirement XXX?", and "At what phase do threats to legal requirement XXX occur?" as exemplified in Figure 8. Furthermore, external resources utilizing, for example, the Embedding API (Application Programming Interface) can be used to vectorize such input data. As a result, the input data is received via the input unit, i.e., the input / output interface 15, and then vectorized by the countermeasure presentation unit 8. Once the processing in step S71 is completed, the control unit of the security countermeasure presentation system 1 proceeds to step S72.

[0091] In step S72, the control unit of the security countermeasure suggestion system 1 uses the countermeasure suggestion unit 8 to calculate the similarity between the input data vectorized in step S71 and the data in the accountable database 7, and extracts data with high similarity from the accountable database 7. As mentioned above, the similarity is calculated using cosine similarity or Euclidean distance. As a result, data that is close to the content of the input operation performed by the user on the input device 4 is extracted from the accountable database 7 based on the similarity. Once the processing in step S72 is completed, the control unit of the security countermeasure suggestion system 1 proceeds to step S73.

[0092] In step S73, the control unit of the security countermeasure suggestion system 1, using the countermeasure suggestion unit 8, executes a process to send the data extracted from the accountable database 7 in step S72, along with its similarity to the input data, to the display device 5. As a result, the data is sent to the display device 5 along with its similarity to the input data.

[0093] In other words, the control unit of the security countermeasure presentation system 1, using the countermeasure presentation unit 8, refers to the accountable database 7 based on the text data entered by the user via the input device 4, and outputs appropriate countermeasures to the display device 5, thereby informing the user of the contents. Although this method is based on the premise of using generation AI, conventional classical search methods may also be used to inform the user about the data search method, etc.

[0094] The data transmitted to the display device 5 in step S73, along with its similarity to the input data, is displayed on the display device 5, for example, in the manner shown in Figure 8. Figure 8 is a diagram showing an example of the screen displayed on the display device 5 in Embodiment 1 (hereinafter also referred to as the "display screen").

[0095] As illustrated in Figure 8, this display screen includes a regulation selection area 81, a regulation change button 82, a system display area 80, an interactive chat area 83, and a generation AI collaboration button 84.

[0096] The legal selection area 81 is where users select the legal regulations that need to be addressed for their organization, system, and components. Examples of such regulations include the EU Cyber ​​Resilience Act and various other regulations such as IEC 62443. When a user of the security measures presentation system 1 selects any of the regulations in the legal selection area 81, the display in the system display area 80 changes to reflect the content corresponding to that regulation.

[0097] The regulation change button 82 is used when you want to change the scope of security regulations, such as changing from the EU Cyber ​​Resilience Act to IEC 62443.

[0098] The system display area 80 is the area where the requirements of the applicable laws and regulations and their details are displayed. When the user presses the generated AI integration button 84, a chatbot is launched in the interactive chat area 83.

[0099] For example, if a user wants to know about measures that satisfy the requirement [Communication Integrity] of the already displayed category [System Integrity], they can ask, "What measures can be taken to achieve the legal requirement [Communication Integrity]?" The control unit of the security measures suggestion system 1 will then use the measures suggestion unit 8 to refer to the accountable database 7 and output [Access management] and [Authorization Enforcement] in order of similarity, along with their similarity scores. Therefore, when the security measures suggestion system 1 outputs measures corresponding to the content of the text data entered by the user to the display device 5, it outputs the similarity score between the measures and the input data, thereby making the validity of the measures visible. Furthermore, since the effectiveness of the suggested measures is supported by the high similarity score, users of the security measures suggestion system 1 can implement the most optimal measures by taking those measures.

[0100] When the processing in step S73 is completed, the control unit of the security countermeasure suggestion system 1 terminates the countermeasure suggestion process shown in the flowchart 700 of Figure 7.

[0101] The security countermeasure suggestion system 1 according to Example 1 can link kill chain phases, attack techniques, and countermeasures to legal requirements from the legal database 2 and security knowledge database 3, taking into account the features in the text. Furthermore, by referring to the accountable database 7 that stores this information, the security countermeasure suggestion system 1 can output countermeasure proposals in response to user questions, along with their similarity scores, and notify the user, enabling the rapid selection of appropriate countermeasure proposals. As a result, the security countermeasure suggestion system 1 can reduce the amount of work required of the user to comply with security regulations.

[0102] The security countermeasure presentation system 1 according to Example 1 has been described above. [Examples]

[0103] Next, the security countermeasure presentation system 1 according to Example 2 will be explained using Figures 9 to 12, focusing on the differences from the security countermeasure presentation system 1 according to Example 1.

[0104] <Example System Configuration> First, an example of the configuration of the security countermeasure presentation system 1 according to Example 2 will be explained using Figures 1 and 9. Figure 9 is a diagram showing an example of the functional blocks of the security countermeasure presentation system 1 according to Example 2.

[0105] (Example of the overall system configuration) The overall system configuration of the security countermeasures presentation system 1 according to Example 2 is the same as the example of the overall system configuration of the security countermeasures presentation system 1 according to Example 1, as described above with reference to Figure 1, so the explanation will be omitted.

[0106] (Example hardware configuration for Security Measures Presentation System 1) Furthermore, the hardware configuration of the security countermeasure presentation system 1 according to Example 2 is the same as the example of the hardware configuration of the security countermeasure presentation system 1 according to Example 1, as described above with reference to Figure 1, so its explanation will be omitted.

[0107] (Example of a functional block for the security countermeasure presentation system 1 according to Example 2) Next, an example of the various functional blocks provided by the security countermeasure presentation system 1 according to Embodiment 2 will be explained using Figure 9. Note that the blocks described below represent functional blocks, not hardware-based configurations.

[0108] As shown in Figure 9, the security countermeasure presentation system 1 according to Example 2 has the following differences in the configuration of each functional block of the control unit and the storage unit compared to the security countermeasure presentation system 1 according to Example 1. Since the other configurations of the security countermeasure presentation system 1 according to Example 2 are the same as those of the security countermeasure presentation system 1 according to Example 1, only these differences will be explained here.

[0109] In the security countermeasure suggestion system 1 according to Embodiment 2, the control unit has the functional blocks of a feature calculation unit 6, a countermeasure suggestion unit 8, and a data preprocessing unit 9, as illustrated in Figure 9. In other words, the control unit of the security countermeasure suggestion system 1 according to Embodiment 2 further includes the data preprocessing unit 9 compared to the control unit of the security countermeasure suggestion system 1 according to Embodiment 1.

[0110] The data preprocessing unit 9 performs data preprocessing (details will be described later in relation to Figure 10).

[0111] Furthermore, in the security countermeasure presentation system 1 according to Example 2, as shown in Figure 9, the accountable database 7 stored in the memory unit is configured to include a similarity column 110. The similarity column 110 of the accountable database 7 in the security countermeasure presentation system 1 according to Example 2 differs from the similarity column 60 of the accountable database 7 in the security countermeasure presentation system 1 according to Example 1 in that, for example, the variability of the stored data is different (details will be described later in relation to Figure 11).

[0112] Furthermore, in Example 2, the content of the interactive chat area 120 on the display screen shown by the display device 5 is different from the content of the interactive chat area 83 on the display screen shown by the display device 5 in Example 1 (details will be described later in relation to Figure 12).

[0113] <Example of system operation> Next, we will explain each process performed by the security countermeasure presentation system 1 according to Example 2, with reference to Figures 10 to 12.

[0114] (Data preprocessing) Figure 10 is a flowchart 1000 showing an example of the data preprocessing flow performed in the security countermeasure presentation system 1 according to Example 2. As illustrated in Figure 9, this data preprocessing is performed by the data preprocessing unit 9 as a preliminary step to the feature calculation process explained in Example 1 using the flowchart 500 in Figure 5.

[0115] In step S101, the control unit of the security countermeasure presentation system 1 uses the data preprocessing unit 9 to retrieve text data representing legal category names and their contents from the legal database 2, and text data representing attack technique names and their contents from the security knowledge database 3. As a result, text data representing legal category names and their contents are retrieved from the legal database 2, and text data representing attack technique names and their contents are retrieved from the security knowledge database 3. If, for example, there are multiple legal databases 2 and security knowledge databases 3 from which the text data is retrieved, and as a result the retrieved text data contains multiple languages, the control unit of the security countermeasure presentation system 1 may use the data preprocessing unit 9 to translate the retrieved text data as appropriate, thereby automatically unifying all retrieved text data into English. Once the processing in step S101 is complete, the control unit of the security countermeasure presentation system 1 proceeds to step S102.

[0116] In step S102, the control unit of the security countermeasure presentation system 1, using the data preprocessing unit 9, executes a process to unify the text data obtained in step S101 by converting uppercase letters to lowercase letters if the same item is written in both uppercase and lowercase letters. This unifies the text data if it contains a mix of uppercase and lowercase letters, by converting the uppercase letters to lowercase. In this embodiment, all letters are unified to lowercase, but for example, the situation where the same item is written in both uppercase and lowercase letters could be resolved by unifying all letters to uppercase. Once the processing in step S102 is complete, the control unit of the security countermeasure presentation system 1 proceeds to step S103.

[0117] In step S103, the control unit of the security countermeasure presentation system 1 performs a process by the data preprocessing unit 9 to determine whether or not the text data, which was standardized to all lowercase in step S102, contains at least one of a stop word, a special character, or a number. If it is determined that the text data contains a top word, a special character, or a number (step S103: YES), the process proceeds to step S104 to delete the top word, special character, or number from the text data. On the other hand, if it is determined that the text data does not contain any top word, special character, or number (step S103: NO), the process proceeds directly to step S105.

[0118] In step S104, the control unit of the security countermeasure presentation system 1 executes a process by the data preprocessing unit 9 to delete the top word, special character, and / or number from the text data that was determined in step S103 to contain the top word, special character, and / or number (step S103: YES). As a result, the top word, special character, and / or number are removed from the text data. Once the processing in step S104 is complete, the control unit of the security countermeasure presentation system 1 proceeds to step S105.

[0119] In step S105, the control unit of the security countermeasure presentation system 1 uses the data preprocessing unit 9 to determine whether or not the text data contains a description of a cited document (hereinafter also simply referred to as "cited document"). If it is determined that the text data contains a cited document (step S105: YES), the process proceeds to step S106 to delete the cited document from the text data. On the other hand, if it is determined that the text data does not contain a cited document (step S105: NO), the data preprocessing shown in flowchart 1000 of Figure 10 is terminated.

[0120] In step S106, the control unit of the security countermeasure presentation system 1 uses the data preprocessing unit 9 to perform a process to remove the cited document from the text data. This process in step S106 is performed, for example, by deleting the text after "Citation". As a result, the cited document is removed from the text data, and text data is constructed that contains only the explanatory text about the legal category and the explanatory text about the attack technique. Once the process in step S106 is completed, the control unit of the security countermeasure presentation system 1 terminates the data preprocessing shown in flowchart 1000 of Figure 10.

[0121] The security countermeasure presentation system 1 according to Example 2, after performing the data preprocessing shown in flowchart 1000 of Figure 10, performs the feature calculation process explained using flowchart 500 of Figure 5 in Example 1, and by identifying the similarity between topic distributions, it can construct an accountable database 7 as illustrated in Figure 11.

[0122] In this example, the accountable database 7 in Example 2, as illustrated in Figure 11, indicates that, as a threat under the legal requirement [Communication Integrity] in the category [System Integrity], an attacker may execute [Supply chain compromise] as an attack technique against the target system during the initial access phase. In response, the administrator of the system, who is a user of the security countermeasure presentation system 1, can accurately grasp that they need to perform software updates and vulnerability scanning as countermeasures against this attack, thanks to the accountable database 7 in Example 2, which is constructed as illustrated in Figure 11.

[0123] In Example 1, different countermeasures were presented for the same requirements. The reason for this is that the security countermeasure presentation system 1 in Example 1 does not have a data preprocessing unit 9, and therefore data preprocessing is not performed before the feature calculation process is executed. As a result, the accuracy of text semantic analysis is relatively lower compared to the security countermeasure presentation system 1 in Example 2. In contrast, the security countermeasure presentation system 1 in Example 2 further includes a data preprocessing unit 9, which allows for data preprocessing before the feature calculation process is executed. This improves the accuracy of the similarity calculated for the categories of laws, attack techniques, and countermeasures stored in the accountable database 7. In fact, as illustrated in Figure 11, the values ​​stored in the similarity column 110 of the accountable database 7 in Example 2 show a greater variation compared to the values ​​stored in the similarity column 60 of the accountable database 7 in Example 1, as illustrated in Figure 6.

[0124] Figure 12 shows an example of the screen (display screen) displayed on the display device 5 in Example 2. As mentioned above, in Example 2, the content of the interactive chat area 120 on the display screen displayed by the display device 5 is different from the content of the interactive chat area 83 on the display screen in Example 1, as illustrated in Figure 8, as shown in Figure 12. This is because, as described above, the accountable database 7 in Example 2 and the accountable database 7 in Example 1 store different countermeasures and similarity levels, so even if the user asks the same question as in Example 1, the data referenced on the accountable database 7 will be different.

[0125] The security countermeasure presentation system 1 according to Example 2 has been described above.

[0126] Each embodiment of the present invention described above can be summarized as follows.

[0127] (1) The security countermeasure presentation system 1 is a system that presents information representing security countermeasures by displaying it on a display device 5, and consists of a computer that comprises at least a computing device 11 and a storage device 14, and is connected to an external input device 4 and a display device 5 so as to be able to communicate data with each other, the storage device 14 stores rule information which includes at least a target system which represents the system to which security countermeasures are to be applied and requirements for components included in the target system, a kill chain phase which represents the execution phase of an attack, an attack technique which represents the attack method used in the kill chain phase, and countermeasure information which represents countermeasures to defend against and / or mitigate the attack technique, the computing device 11 associates the requirements included in the rule information with countermeasure information which satisfies the requirements, receives the content of the user's input operation to the input device 4 from the input device 4, extracts countermeasures from the countermeasure information which is associated with the requirements according to the content of the received user's input operation, and transmits the information including the extracted countermeasures to the display device 5 as information representing security countermeasures. In this way, the security countermeasure suggestion system 1 can automatically identify and present appropriate countermeasures to the user in accordance with various rules such as laws and regulations related to security.

[0128] (2) The computing device 11 transmits the extracted countermeasures, along with a similarity score which is an indicator representing the degree to which the countermeasures are linked to the requirements, to the display device 5 as information representing security countermeasures.

[0129] (3) The arithmetic unit 11 calculates the feature quantities of the text data containing the requirements according to the importance and rarity of the words contained in the text data containing the attack techniques, calculates the similarity between the feature quantities of the text data containing the requirements and the feature quantities of the text data containing the attack techniques, stores the requirements, the attack techniques, and the countermeasure information associated with the requirements and attack techniques in the storage device 14 based on the calculated similarity, calculates the similarity between the content of the input operation received by the user and the countermeasure information, and transmits the countermeasure information to the display device 5 as information representing security measures based on the calculated similarity.

[0130] (4) The arithmetic unit 11 converts the feature quantities of the text data containing the requirements and the feature quantities of the text data containing the attack techniques into vector forms, generates topic distributions for the vectors representing the feature quantities of the text data containing the requirements and the vectors representing the feature quantities of the text data containing the attack techniques, and calculates the similarity between the generated topic distributions.

[0131] (5) The text data representing the requirements stored in the storage device 14 includes the category name of the security rule and its content, and the text data representing the attack technique stored in the storage device 14 includes the name of the attack technique and its content. The arithmetic unit 11 calculates the similarity between the text data representing the requirements and the text data representing the attack technique.

[0132] (6) Before calculating the feature quantities of the text data containing the requirements and / or the text data containing the attack techniques, the arithmetic unit 11 performs predetermined preprocessing on the text data.

[0133] (7) The arithmetic unit 11 converts the data stored in the storage device 14 into natural language and infers security information to be sent to the display device 5 as information representing security measures based on the similarity between the data converted into natural language and the content of the user's input operation received.

[0134] It should be noted that the present invention is not limited to the above embodiments, and can be implemented using any components without departing from the spirit of the invention.

[0135] For example, the systems targeted by Security Measures Presentation System 1 for security measures are not limited to various control systems (OT systems), but may be any system, such as IT (Information Technology) systems.

[0136] The above embodiments and modifications are merely examples, and the present invention is not limited to these, as long as the features of the invention are not impaired. Furthermore, although various embodiments and modifications have been described above, the present invention is not limited to these. Other embodiments conceivable within the scope of the technical idea of ​​the present invention are also included within the scope of the present invention.

[0137] In the diagrams above, the control lines and information lines shown are those deemed necessary for explanation and do not necessarily represent all control lines and information lines in actual implementation. For example, it can be assumed that almost all components are interconnected in practice.

[0138] Furthermore, the arrangement of each functional component of the security countermeasure presentation system 1 described above is merely an example. The arrangement of each functional component can be changed to the optimal arrangement from the perspective of the performance, processing efficiency, and communication efficiency of the hardware and software provided by the security countermeasure presentation system 1.

[0139] Furthermore, each of the aforementioned configurations, functions, processing units, and processing means may be implemented in hardware, for example, by designing them as integrated circuits, or they may be implemented in software by having the arithmetic unit 11 interpret and execute programs that realize each of these functions. [Explanation of symbols]

[0140] 1: Security measures presentation system

Claims

1. A security measures presentation system that presents information representing security measures by displaying it on a display device, It consists of a computer comprising at least an arithmetic unit and a memory device, and connected to external input devices and display devices in a manner that enables data communication between them. The aforementioned storage device is Rule information that includes at least the target system, which represents the system to which security measures are to be applied, and the requirements for the components included in said target system, in a security rule, A kill chain phase representing the execution phase of an attack, an attack technique representing the attack method used in the kill chain phase, and countermeasure information representing measures to defend against and / or mitigate the attack technique. Remember this, The aforementioned computing device is The requirements included in the aforementioned rule information are associated with the aforementioned countermeasure information that satisfies those requirements. The system receives the content of the user's input operation to the input device from the input device. From the countermeasure information associated with the aforementioned requirements, countermeasures corresponding to the content of the user's input received are extracted. The information including the extracted countermeasures is transmitted to the display device as information representing the security measures. Security measures presentation system.

2. A security measures presentation system according to claim 1, The aforementioned computing device is Along with the extracted countermeasures, a similarity index, which represents the degree to which the countermeasures are linked to the requirements, is transmitted to the display device as information representing the security countermeasures. Security measures presentation system.

3. A security measures presentation system according to claim 1, The aforementioned computing device is The features of the text data containing the aforementioned requirements are calculated according to the importance and rarity of the words in the text data. The feature quantities of the text data containing the aforementioned attack techniques are calculated according to the importance and rarity of the words in the text data. The similarity between the feature quantities of the text data containing the aforementioned requirements and the feature quantities of the text data containing the aforementioned attack techniques is calculated. Based on the similarity results calculated above, the requirements, the attack techniques, and the countermeasures information associated with the requirements and attack techniques are stored in a storage device. Based on the content of the user's input operation received, the similarity between the content of the input operation and the countermeasure information is calculated. Based on the calculated similarity, the countermeasure information is transmitted to the display device as information representing the security measures. Security measures presentation system.

4. A security measures presentation system according to claim 3, The aforementioned computing device is The feature quantities of the text data containing the aforementioned requirements and the feature quantities of the text data containing the aforementioned attack techniques are each converted into vector format. A topic distribution is generated for each of the vectors representing the features of the text data containing the aforementioned requirements and the vector representing the features of the text data containing the aforementioned attack techniques. The similarity between the generated topic distributions is calculated. Security measures presentation system.

5. A security measures presentation system according to claim 1, The text data representing the requirements stored in the storage device includes the category name and content of the security rule, The text data representing the attack technique stored in the aforementioned storage device includes the name of the attack technique and its contents. The calculation device calculates the similarity between the text data representing the requirements and the text data representing the attack technique. Security measures presentation system.

6. A security measures presentation system according to claim 3, The aforementioned computing device is Before calculating the feature quantities of the text data containing the aforementioned requirements and / or the text data containing the aforementioned attack techniques, the text data is subjected to a predetermined preprocessing step. Security measures presentation system.

7. A security measures presentation system according to claim 3, The aforementioned computing device is The data stored in the aforementioned memory device is converted into natural language, Based on the similarity between the data converted into natural language and the content of the user's input operation received, the system infers the security measures information to be transmitted to the display device as information representing the security measures. Security measures presentation system.

8. A method for presenting security measures, which involves displaying information representing security measures on a display device, This is performed using a computer that includes at least a computing unit and a memory device, and is connected to external input devices and display devices in a manner that enables data communication between them. The aforementioned storage device is Rule information that includes at least the target system, which represents the system to which security measures are to be applied, and the requirements for the components included in said target system, in a security rule, A kill chain phase representing the execution phase of an attack, an attack technique representing the attack method used in the kill chain phase, and countermeasure information representing measures to defend against and / or mitigate the attack technique. Remember this, The aforementioned computing device is The requirements included in the aforementioned rule information are associated with the aforementioned countermeasure information that satisfies those requirements. The system receives the content of the user's input operation to the input device from the input device. From the countermeasure information associated with the aforementioned requirements, countermeasures corresponding to the content of the user's input received are extracted. The information including the extracted countermeasures is transmitted to the display device as information representing the security measures. Methods for presenting security measures.

Images