Information processing device, information processing method, and program

Abstract

To improve the efficiency of log collection from computer systems. [Solution] The information processing device 10 includes a corresponding log selection unit 11 that identifies attack paths related to security alerts in a computer system including a host and identifies logs corresponding to the identified attack paths, and a corresponding log instruction unit 12 that instructs the host handling the identified logs to save the identified logs.

Description

Technical Field

[0001] The present disclosure relates to an information processing apparatus and an information processing method for assisting in the analysis of logs in a computer system, and further relates to a program for realizing these.

Background Art

[0002] In recent years, cyberattacks targeting computer systems of organizations such as companies and government agencies have been increasing. When a cyberattack occurs, malicious programs such as malware illegally intrude into the computer system and execute data theft, destruction, falsification, etc. In order to respond to such cyberattacks, the system administrator needs to analyze the logs collected in the target system. Patent Document 1 discloses an apparatus for assisting in the analysis of logs in a system.

[0003] The apparatus disclosed in Patent Document 1 identifies logs that can detect attacks among the logs collected in the system to be monitored, and generates a combination of the identified logs as a log set. Further, the apparatus disclosed in Patent Document 1 generates a plurality of these log sets, and sets a priority indicating the degree of priority of monitoring for each log set. The system administrator can efficiently respond to targeted attacks by analyzing the logs in order from the log sets with high priority among the logs collected from the system.

[0004] Also, in recent years, since vehicles themselves are often connected to an external network, cyberattacks on in-vehicle networks mounted on vehicles are also a concern. For this reason, Patent Document 2 discloses an apparatus for responding to cyberattacks on in-vehicle networks.

[0005] The device disclosed in Patent Document 2, upon detecting an anomaly in an in-vehicle network, estimates an attack path based on pre-configured candidate attack paths and determines that devices on the estimated attack path are to be analyzed. The device then requests the devices determined to be analyzed to send logs and collects the received logs. Since the collected logs are logs related to the attack, the device disclosed in Patent Document 2 can efficiently analyze cyberattacks on in-vehicle networks. [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Japanese Patent Publication No. 2023-115443 [Patent Document 2] International Publication No. 2022-091754 [Overview of the project] [Problems that the invention aims to solve]

[0007] By the way, the device disclosed in Patent Document 1 has the problem of requiring continuous log collection for the generated log set, which places a heavy processing burden on it. On the other hand, the device disclosed in Patent Document 2 collects logs only when an abnormality is detected, thus eliminating the problem of a heavy processing burden.

[0008] However, the device disclosed in Patent Document 2 is limited in its ability to handle in-vehicle networks. The aforementioned computer system has a different configuration from an in-vehicle network, with multiple host servers and each terminal connected to a host. For this reason, the device disclosed in Patent Document 2 has the problem of being unable to identify attack paths in the aforementioned computer system and to collect logs related to attacks.

[0009] One example of the purpose of this disclosure is to improve the efficiency of log collection from computer systems. [Means for solving the problem]

[0010] To achieve the above objective, the information processing device in one aspect of this disclosure is: A computer system including a host includes a corresponding log selection unit that identifies attack paths related to security alerts and identifies logs corresponding to the identified attack paths, A corresponding log instruction unit instructs the host handling the identified log to save the identified log, It is characterized by having the following features.

[0011] Furthermore, in order to achieve the above objectives, the information processing method in one aspect of this disclosure is: A computer system including a host includes a corresponding log selection step, which involves identifying attack paths related to security alerts and identifying logs corresponding to the identified attack paths, A corresponding log instruction step instructs the host handling the identified log to save the identified log, It is characterized by having the following:

[0012] Furthermore, in order to achieve the above objectives, the program in one aspect of this disclosure is On the computer, A computer system including a host includes a corresponding log selection step, which involves identifying attack paths related to security alerts and identifying logs corresponding to the identified attack paths, A corresponding log instruction step instructs the host handling the identified log to save the identified log, It is characterized by causing the execution of [the specified action]. [Effects of the Invention]

[0013] As described above, this disclosure makes it possible to improve the efficiency of log collection from computer systems.

Brief Description of the Drawings

[0014] [Figure 1] FIG. 1 is a configuration diagram showing a schematic configuration of a first example of an information processing apparatus. [Figure 2] FIG. 2 is a configuration diagram specifically showing the configuration of a first example of an information processing apparatus. [Figure 3] FIG. 3 is a diagram schematically showing a process when a computer system is subjected to a cyber attack. [Figure 4] FIG. 4 is a diagram showing an example of attack path information prepared in advance. [Figure 5] FIG. 5 is a flowchart showing the operation of a first example of an information processing apparatus. [Figure 6] FIG. 6 is a diagram showing an example of an alert output from a computer system and an example of attack path information. [Figure 7] FIG. 7 is a configuration diagram specifically showing the configuration of a second example of an information processing apparatus. [Figure 8] FIG. 8 is a diagram showing an example of information stored in a storage unit in a second example of an information processing apparatus. [Figure 9] FIG. 9 is a flowchart showing the operation of a second example of an information processing apparatus. [Figure 10] FIG. 10 is a diagram showing an example of an alert output from a computer system and an example of information stored in a storage unit. [Figure 11] FIG. 11 is a block diagram showing an example of a computer that realizes the information processing apparatus in Embodiments 1 to 3.

Modes for Carrying Out the Invention

[0015] (Embodiment 1) Hereinafter, an information processing apparatus, an information processing method, and a program in Embodiment 1 will be described with reference to FIGS. 1 to 6.

[0016] [Device Configuration] First, the schematic configuration of the first example of the information processing device will be explained using Figure 1. Figure 1 is a configuration diagram showing the schematic configuration of the first example of the information processing device.

[0017] The information processing device 10 shown in Figure 1 is a log analysis support device for assisting in the analysis of logs in a computer system. As shown in Figure 1, the information processing device 10 includes a corresponding log selection unit 11 and a corresponding log instruction unit 12.

[0018] The corresponding log selection unit 11 first identifies attack paths related to security alerts in the computer system, including the host. Next, the corresponding log selection unit 11 identifies logs corresponding to the identified attack paths. The corresponding log instruction unit 12 instructs the host handling the identified logs to save the identified logs.

[0019] In this way, the information processing device 10 identifies attack paths triggered by security alerts and instructs the saving of corresponding logs, thereby reducing the processing burden associated with log acquisition. Furthermore, since the information processing device 10 can instruct the hosts constituting the computer system to save logs, it is possible to improve the efficiency of log collection from the computer system.

[0020] Furthermore, "security alert" here refers to information indicating the status of an attack. In particular, in Embodiment 1, the security alert is information indicating the possibility of an attack occurring within the computer system. Moreover, the attack path is information indicating the sequence of attack routes or attack procedures from the intrusion into the computer system to the achievement of the attack objective.

[0021] Next, the configuration and functions of the information processing device 10 will be specifically explained using Figures 2 to 4. Figure 2 is a configuration diagram specifically showing the configuration of the first example of the information processing device. Figure 3 is a diagram schematically showing the process when a computer system is subjected to a cyberattack. Figure 4 is a diagram showing an example of pre-prepared attack path information.

[0022] As shown in Figure 2, the information processing device 10 includes, in addition to the corresponding log selection unit 11 and corresponding log instruction unit 12 shown in Figure 1, an alert acquisition unit 13 and a storage unit 14. Also, as shown in Figure 2, the information processing device 10 is connected to the computer system 20 whose logs are to be analyzed via a network or the like, enabling data communication.

[0023] The computer system 20 includes multiple hosts 21, multiple terminals 22, and a security monitoring device 23. In the example shown in Figure 2, the hosts 21 include server devices that provide services to the terminals 22, such as a mail server and a file server. Additionally, an administrator's terminal 24 is connected to the computer system 20.

[0024] The security monitoring device 23 monitors the status and communication content of the host 21 and terminal 22, detects abnormal and suspicious behavior, and generates a security alert based on the detection results. The security monitoring device 23 then outputs the generated security alert to the administrator's terminal 24 of the computer system 20 to notify the administrator. The security alert also includes information indicating the host 21 that was targeted by the attack (e.g., hostname, host identifier, etc.).

[0025] Here, we will explain the operation of the security monitoring device 23 using Figure 3. First, as shown in Figure 3, a cyberattack on the computer system 20 is carried out, for example, by an email with a file containing a malicious macro attached. Then, the mail server host 21 receives the sent email. Next, the user on terminal 22 downloads and opens the email. Furthermore, when the user on terminal 22 opens the attachment and executes the macro, a suspicious process is launched. Subsequently, on terminal 22, the suspicious process searches for other terminals 22 and executes an attack. This initiates the intrusion into other terminals 22.

[0026] In Figure 3, the right side shows an example of logs generated by the host 21 and terminal 22 of the computer system 20. The security monitoring device 23 monitors these logs. For example, if the security monitoring device 23 detects a "file opening / macro execution log in terminal A," it generates and outputs a security alert.

[0027] The alert acquisition unit 13 acquires security alerts output by the security monitoring device 23. Furthermore, if the administrator of the computer system 20 directly sends a security alert to the information processing device 10 via the terminal 24, the alert acquisition unit 13 acquires the transmitted security alert. The alert acquisition unit 13 outputs the acquired security alerts to the corresponding log selection unit 11.

[0028] The memory unit 14 stores attack path information created in advance by the administrator of the computer system 20. As shown in Figure 4, the attack path information consists of information on the attack steps for each attack path assumed by the administrator. The attack step information consists of the attack start point and attack end point for each attack step that constitutes the corresponding attack path. The attack start point and attack end point are usually specified by information indicating the corresponding host.

[0029] In Embodiment 1, the corresponding log selection unit 11 first identifies the host targeted by the attack from the security alert acquired by the alert acquisition unit 13, and then identifies the attack path associated with the identified host.

[0030] Specifically, the response log selection unit 11 first identifies the host 21 that was targeted by the attack based on the information indicating the host 21 included in the security alert. Next, the response log selection unit 11 compares the identified host with the attack path information (see Figure 4) stored in the storage unit 14 to identify the attack path associated with the identified host.

[0031] Next, the corresponding log selection unit 11 identifies the attack steps included in the identified attack path from the attack path information, and for each identified attack step, it identifies the log corresponding to the attack path.

[0032] Specifically, the corresponding log selection unit 11 identifies the host 21 associated with each attack step constituting the identified attack path, i.e., the host that became the attack start point or attack end point, from the attack path information (see Figure 4). Then, the corresponding log selection unit 11 identifies the logs handled by the identified host 21 as the logs corresponding to the identified attack path. Here, the logs handled by the host 21 include not only logs generated by the host 21 but also logs sent to the host 21.

[0033] The corresponding log instruction unit 12 instructs the host 21 that handles logs identified as corresponding to an attack path to save the logs identified as corresponding to an attack path. Specifically, the corresponding log instruction unit 12 instructs the host 21 identified by the corresponding log selection unit 11 to save the logs handled by that host 21. The corresponding log instruction unit 12 can also instruct the host 21 to acquire logs other than those generated by the host 21 itself.

[0034] When the corresponding log instruction unit 12 issues an instruction to the host 21, it sends data to the host 21 that includes the type of log specified and an instruction to save the specified log. Upon receiving this data, the host 21 performs log saving.

[0035] Furthermore, the computer system 20 may have a log management system or a SIEM (Security Information and Event Management) system installed. In such cases, the logs of each host are managed integrally by the log management system or SIEM, so the corresponding log instruction unit 12 can instruct the log management system or SIEM system to save the logs on each host 21.

[0036] [Device operation] Next, the operation of the information processing device 10 will be explained using Figure 5. Figure 5 is a flowchart showing the operation of the first example of the information processing device. In the following explanation, Figures 1 to 4 will be referred to as appropriate. In Embodiment 1, the information processing method is implemented by operating the information processing device 10. Therefore, in Embodiment 1, the explanation of the information processing method will be replaced by the following explanation of the operation of the information processing device 10.

[0037] As shown in Figure 5, first, the alert acquisition unit 13 acquires the security alert output by the security monitoring device 23 (step A1). In step A1, the alert acquisition unit 13 also outputs the acquired security alert to the corresponding log selection unit 11.

[0038] Next, the response log selection unit 11 identifies the host 21 that was targeted by the attack from the security alert and identifies the attack path associated with the identified host 21 (step A2).

[0039] Specifically, in step A2, the response log selection unit 11 identifies the host 21 that was targeted by the attack based on the information indicating the host 21 included in the security alert. The response log selection unit 11 then compares the identified host with the attack path information (see Figure 4) stored in the storage unit 14 to identify the attack path associated with the identified host.

[0040] Next, the corresponding log selection unit 11 identifies the log corresponding to the identified attack path (step A3).

[0041] Specifically, in step A3, the corresponding log selection unit 11 identifies the attack start and end points of each attack step that constitutes the attack path identified in step A2, based on the attack path information (see Figure 4). Then, the corresponding log selection unit 11 identifies the logs handled by the host 21 that is the attack start or end point as the logs corresponding to the identified attack path.

[0042] Next, the corresponding log instruction unit 12 instructs the host handling the log identified in step A3 to save the identified log (step A4).

[0043] Specifically, in step A4, the corresponding log instruction unit 12 instructs the host 21 that handles the logs identified in step A3 to save the logs that host 21 handles.

[0044] In this way, when the computer system 20 outputs a security alert, the information processing device 10 uses it as a trigger to identify the attack path, then identifies the corresponding log, and instructs it to save it. Therefore, the processing burden for acquiring logs is reduced compared to when logs are collected continuously. In addition, since the information processing device 10 can instruct the host 21 that makes up the computer system to save logs, the efficiency of log collection from the computer system can be improved.

[0045] [Specific example] Here, we will explain a specific example of processing in the information processing device 10 using Figure 6. Figure 6 shows an example of an alert output from a computer system and an example of attack path information. The attack path information shown in Figure 6 is the same as the attack path information shown in Figure 4.

[0046] First, let's assume that the alert acquisition unit 13 acquires the alert shown in Figure 6. In this case, the corresponding log selection unit 11 identifies "Host B" as the target host 21 of the attack based on the information indicating the host 21 included in the security alert. Next, the corresponding log selection unit 11 compares "Host B" with the attack path information (see Figure 4) and identifies "Attack Path 1" and "Attack Path 2" as attack paths associated with the identified "Host B".

[0047] Furthermore, the corresponding log selection unit 11 identifies the attack start point and attack end point for each attack step that constitutes the identified "attack path 1" and "attack path 2". In the example in Figure 6, the corresponding log selection unit 11 identifies "host A", "host B", and "host C" from "attack path 1", and "host B" and "host D" from "attack path 2".

[0048] Subsequently, the corresponding log instruction unit 12 instructs "Host A," "Host B," "Host C," and "Host D" to save the logs handled by each host. Thus, when the alert shown in Figure 6 is output, hosts A through D are instructed to save their logs.

[0049] [program] In Embodiment 1, the program is one that causes the computer to execute steps A1 to A4 shown in Figure 5. By installing and executing this program on the computer, the information processing device 10 and the information processing method can be realized. In this case, the computer's processor functions as a corresponding log selection unit 11, a corresponding log instruction unit 12, and an alert acquisition unit 13, and performs the processing.

[0050] The memory unit 14 may be implemented by storing data files in a storage device such as a hard disk provided in the computer, or it may be implemented by a storage device of another computer.

[0051] Furthermore, the program in Embodiment 1 may be executed by a computer system constructed from multiple computers. In this case, for example, each computer may function as either the corresponding log selection unit 11, the corresponding log instruction unit 12, or the alert acquisition unit 13.

[0052] (Embodiment 2) Next, the information processing device, information processing method, and program in Embodiment 2 will be described with reference to Figures 7 to 9.

[0053] [Device configuration] First, the configuration of the second example of the information processing device will be explained using Figure 7. Figure 7 is a configuration diagram that specifically shows the configuration of the second example of the information processing device.

[0054] The information processing device 30 shown in Figure 7 is a log analysis support device for assisting in the analysis of logs in a computer system, similar to the information processing device 10 shown in Figures 1 and 2. As shown in Figure 2, the information processing device 30, like the information processing device 10, includes a corresponding log selection unit 11, a corresponding log instruction unit 12, and an alert acquisition unit 13.

[0055] However, the information processing device 40 differs from the information processing device 10 in that, in addition to the corresponding log selection unit 11, corresponding log instruction unit 12, alert acquisition unit 13, and storage unit 14, it also includes a type identification unit 31. Furthermore, the information stored in the storage unit 14 also differs from that of the information processing device 10. The following will focus on the differences from Embodiment 1.

[0056] First, in Embodiment 2, as in Embodiment 1, the security alert is information indicating the possibility of an attack occurring within the computer system. However, in Embodiment 2, in addition to information indicating the host 21 that was targeted by the attack (for example, the host identifier), the security alert also includes information indicating the type of attack, specifically the alert type. The type identification unit 41 identifies the type of attack from the security alert.

[0057] As shown in Figure 8, the memory unit 14 stores, in addition to the attack path information described in Embodiment 1, alert attack type correspondence information and log correspondence information. Figure 8 is a diagram showing an example of the information stored in the memory unit in the second example of the information processing device.

[0058] As shown in Figure 8, the alert attack type correspondence information is information that shows the correspondence between the alert type included in the security alert and the attack type. By identifying the alert type, the attack type can be identified.

[0059] In the example in Figure 8, the attack path information consists of information on the attack steps for each attack path as assumed by the administrator, etc. However, in the example in Figure 8, the attack step information includes not only the attack start point and attack end point for each attack step, but also the attack type for each attack step.

[0060] Furthermore, in the example in Figure 8, the attack type is indicated by a number set in MITRE ATT&CK®. Specific examples of these numbers are shown below. T1566:Phishing T1204.002:User Execution: Malicious File T1210:Exploitation of Remote Services T1021: Remote Services

[0061] Furthermore, attack types may be indicated at a strategic level, such as "initial access" or "lateral expansion," or at a tactical level, such as "phishing" or "exploitation of remote services." Attack types may also be indicated by the names of tools used in the attack, such as "nmap" or "PowerShell®," the CVE numbers used in the attack, or the names of vulnerabilities. In addition, attack types may be indicated by the identifiers of audit items in security audits.

[0062] Furthermore, as shown in Figure 8, log correspondence information consists of the corresponding log type and the host that stores the corresponding log for each combination of attack origin, attack destination, and attack type. For example, if the attack destination is host A and the attack type is T1566 (Phishing), the corresponding log is the email reception log, and the host that stores it is host A.

[0063] The type identification unit 31 identifies the type of attack from the security alert. Specifically, the type identification unit 31 identifies the alert type from the security alert, and then matches the identified alert type with the alert attack type correspondence information to identify the attack type.

[0064] In Embodiment 2, as in Embodiment 1, the corresponding log selection unit 11 identifies the host 21 that was targeted by the attack based on information indicating the host 21 included in the security alert.

[0065] Next, the corresponding log selection unit 11 identifies the attack path associated with the identified host and the attack type identified by the type identification unit 31, and identifies the associated host and associated log for each step included in the identified attack path.

[0066] Specifically, the corresponding log selection unit 11 compares the identified host and attack type with the attack path information to identify the associated attack path. Next, for each attack step constituting the identified attack path, the corresponding set of attack start point, attack end point, and attack type is identified. Subsequently, the corresponding log selection unit 11 compares the identified set with the log correspondence information to identify the corresponding log type and the host on which the corresponding log is stored.

[0067] The corresponding log instruction unit 12 instructs the identified relevant host to save the identified relevant log. Specifically, the corresponding log instruction unit 12 instructs the host identified from the log correspondence information to save the log of the log type identified from the log correspondence information.

[0068] Furthermore, in Embodiment 2, a log management system or a SIEM (Security Information and Event Management) system may be installed in the computer system 20. In such cases, since the logs of each host are managed integrally by the log management system or SIEM, the corresponding log instruction unit 12 can also instruct the log management system or SIEM system to save the logs on each host 21, even in Embodiment 2.

[0069] [Device operation] Next, the operation of the information processing device 30 will be explained using Figure 9. Figure 9 is a flowchart showing the operation of the second example of the information processing device. In the following explanation, Figures 7 to 8 will be referred to as appropriate. In Embodiment 2, the information processing method is implemented by operating the information processing device 30. Therefore, in Embodiment 2, the explanation of the information processing method will be replaced by the following explanation of the operation of the information processing device 10.

[0070] As shown in Figure 9, first, the alert acquisition unit 13 acquires security alerts output by the security monitoring device 23 (step B1). In step B1, the alert acquisition unit 13 outputs the acquired security alerts to the corresponding log selection unit 11 and the type identification unit 31.

[0071] Next, the type identification unit 31 identifies the type of attack from the security alert (step B2).

[0072] Specifically, the type identification unit 31 identifies the alert type from the security alert, and then matches the identified alert type with the alert attack type correspondence information (see Figure 8) to identify the attack type.

[0073] Next, the response log selection unit 11 identifies the host 21 that was targeted by the attack from the security alert, and identifies the attack path associated with the identified host 21 and the attack type identified in step B2 (step B3).

[0074] Specifically, in step B3, the corresponding log selection unit 11 compares the identified host and attack type with the attack path information to identify the attack path to which they are associated.

[0075] Next, the corresponding log selection unit 11 identifies the relevant host and associated log for each step included in the attack path identified in step B3 (step B4).

[0076] Specifically, in step B4, the corresponding log selection unit 11 uses the attack information to identify a corresponding set of attack start point, attack end point, and attack type for each attack step that constitutes the attack path identified in step B3. Then, the corresponding log selection unit 11 compares the identified set with the log correspondence information to identify the corresponding log type and the host on which the corresponding log is stored.

[0077] Next, the corresponding log instruction unit 12 instructs the relevant host identified in step B4 to save the relevant log identified in step B4 (step B5).

[0078] Specifically, in step B5, the corresponding log instruction unit 12 instructs the host identified from the log correspondence information to save the log of the log type identified from the log correspondence information.

[0079] In this way, similar to the information processing device 10, when a security alert is output by the computer system 20, the information processing device 30 uses that as a trigger to identify the attack path, then identifies the corresponding log, and instructs its saving. Therefore, the processing burden for acquiring logs is reduced compared to when logs are collected continuously. In addition, since the information processing device 10 can instruct the host 21 that constitutes the computer system to save logs, the efficiency of log collection from the computer system can be improved.

[0080] Furthermore, in Embodiment 2, the type of attack can be identified from the security alert, and the type of log to be saved can be selected according to the type of attack. Therefore, Embodiment 2 can further improve the efficiency of log collection.

[0081] Furthermore, if the security alert includes information indicating the log type instead of, or in addition to, information indicating the attack type, the type identification unit 31 can identify the log type from the security alert. In this case, the corresponding log selection unit 11 identifies the attack path associated with the identified host and the log type identified by the type identification unit 31, and identifies the associated host and associated log for each step included in the identified attack path.

[0082] Furthermore, in the above cases, the attack path information, alert attack type response information, and log response information will have a "log type" field instead of, or in addition to, the attack type field.

[0083] [Specific example] Here, we will explain a specific example of processing in the information processing device 30 using Figure 10. Figure 10 shows an example of an alert output from a computer system and an example of information stored in the memory unit. The information shown in Figure 10 is the same as the information shown in Figure 8.

[0084] First, let's assume that the alert acquisition unit 13 acquires the alert shown in Figure 10. In this case, the type identification unit 31 identifies "targeted attack email" as the alert type from the security alert. Then, the type identification unit 31 matches the identified alert type "targeted attack email" with the alert attack type correspondence information and identifies the attack type "T1566".

[0085] Next, the response log selection unit 11 identifies "Host B" as the host 21 targeted by the attack, based on the information indicating the host 21 included in the security alert.

[0086] Next, the corresponding log selection unit 11 compares "Host B" and attack type "T1566" with the attack path information (see Figure 4) to identify "Attack Step 2" of "Attack Path 1" where "Host B" and attack type "T1566" match. Then, the corresponding log selection unit 11 identifies "Attack Path 1," which includes the identified attack step 2, as an attack path associated with "Host B" and attack type "T1566".

[0087] Next, the corresponding log selection unit 11 identifies a corresponding set of attack start point, attack end point, and attack type for each attack step that constitutes the identified attack path 1. In the example in Figure 10, the following sets are identified. Attack Step 1: -, Host A, T1566 Attack Step 2: Host A, Host B, T1566 Attack Step 3: Host B, Host B, T1204.002 Attack Step 4: Host B, Host C, T1210

[0088] Subsequently, the corresponding log selection unit 11 compares the identified sets with the log correspondence information. Specifically, in the set from attack step 1 above, there is no restriction on the attack initiation point, the attack endpoint is host A, and the attack type is T1566, so the log storage target host is host A and the log type is email reception log. Similarly, the log storage target host and log type are identified for the sets from attack steps 2 to 4. As a result, the log storage target host and log type are as follows. Host A: Email reception log Host B: Email reception log Host B: Process execution log Host C: IDS log

[0089] Subsequently, the corresponding log instruction unit 12 instructs "Host A," "Host B," and "Host C" to save the log, specifying the log type. Thus, when the alert shown in Figure 10 is output, hosts A through C are instructed to save the log.

[0090] [program] In Embodiment 2, the program is one that causes the computer to execute steps B1 to B5 shown in Figure 9. By installing and executing this program on the computer, the information processing device 30 and the information processing method can be realized. In this case, the computer's processor functions as the corresponding log selection unit 11, the corresponding log instruction unit 12, the alert acquisition unit 13, and the type identification unit 31, and performs the processing.

[0091] The memory unit 14 may be implemented by storing data files in a storage device such as a hard disk provided in the computer, or it may be implemented by a storage device of another computer.

[0092] Furthermore, the program in Embodiment 2 may be executed by a computer system constructed by multiple computers. In this case, for example, each computer may function as one of the following: the corresponding log selection unit 11, the corresponding log instruction unit 12, the alert acquisition unit 13, and the type identification unit 31.

[0093] (Embodiment 3) Next, the information processing device, information processing method, and program in Embodiment 3 will be described.

[0094] [Device configuration] In Embodiment 3, the information processing device has the same configuration as the information processing device 10 shown in Figures 1 and 2. Therefore, the following will refer to Figures 1 and 2. However, in Embodiment 3, intelligence information provided about cyberattacks is used as a security alert. For this reason, there are differences in the functions of each part compared to Embodiment 1. The following will focus on explaining the differences from Embodiment 1.

[0095] In Embodiment 3, the alert acquisition unit 13 acquires intelligence information from an external source as security alerts, instead of security alerts generated by the security monitoring device 23. This intelligence information may include, for example, threat reports, vulnerability information, and incident reports. The intelligence information may be written in natural language or structured in a format such as STIX (Structured Threat Information eXpression).

[0096] Furthermore, the intelligence information includes information indicating the type of attack. The type of attack may be indicated by a number set in MITRE ATT&CK, as in Embodiment 2. In addition, the type of attack may be indicated at a strategic level such as "initial access" or "lateral expansion," or at a tactical level such as "phishing" or "exploitation of remote services." The type of attack may also be indicated by the name of the tool used in the attack, such as "nmap" or "PowerShell®," the CVE number used in the attack, or the name of the vulnerability. In addition, the type of attack may be indicated by the identifier of the audit item in the security audit.

[0097] The memory unit 14 stores attack path information similar to the attack path information shown in Figure 8. In Embodiment 3, the attack path information is also configured for each attack path. Furthermore, each attack path consists of information for multiple attack steps, and the information for each attack step consists of the attack start point, attack end point, and attack type for each attack step.

[0098] In Embodiment 3, the corresponding log selection unit 11 identifies the type of attack from the security alert and identifies the attack path associated with the identified attack type. Specifically, the corresponding log selection unit 11 compares the identified attack type with the attack path information to identify the matching attack step, and then identifies the attack path having the identified attack step.

[0099] Next, the corresponding log selection unit 11 identifies the host 21 that became the attack start or end point at each attack step that constitutes the identified attack path. Then, the corresponding log selection unit 11 identifies the logs handled by the identified host 21 as the logs corresponding to the identified attack path.

[0100] Furthermore, if the storage unit 14 stores the log correspondence information shown in Figure 8, the corresponding log selection unit 11 can use the log correspondence information to identify the corresponding log type in addition to the host where the log is saved.

[0101] [Device operation] In Embodiment 3, the information processing device operates according to steps A1 to A4 shown in Figure 5. Specifically, the information processing device performs the following: acquisition of security alerts, i.e., intelligence information (step A1), identification of attack paths (step A2), identification of logs corresponding to attack paths (step A3), and instruction to save logs (step A4). Furthermore, the information processing method is implemented by operating the information processing device.

[0102] In Embodiment 3, when intelligence information is transmitted, the information processing device uses it as a trigger to identify an attack path, then identifies the corresponding log, and instructs the device to save it. Therefore, in Embodiment 3 as well, the processing burden for acquiring logs is reduced compared to when logs are collected continuously. In addition, since the information processing device can instruct the host 21 that constitutes the computer system to save the logs, the efficiency of log collection from the computer system can be improved.

[0103] [program] In Embodiment 3, the program is one that causes the computer to execute steps A1 to A4 shown in Figure 5. By installing and executing this program on the computer, an information processing device and an information processing method can be realized. In this case, the computer's processor functions as a corresponding log selection unit 11, a corresponding log instruction unit 12, and an alert acquisition unit 13, and performs the processing.

[0104] The memory unit 14 may be implemented by storing data files in a storage device such as a hard disk provided in the computer, or it may be implemented by a storage device of another computer.

[0105] Furthermore, the program in Embodiment 3 may also be executed by a computer system constructed from multiple computers. In this case, for example, each computer may function as either the corresponding log selection unit 11, the corresponding log instruction unit 12, or the alert acquisition unit 13.

[0106] (modified version) The following describes some common modifications of Embodiments 1 to 3.

[0107] The corresponding log instruction unit 12 can also specify log retention conditions for the host 21 identified by the corresponding log selection unit 11. One of the log retention conditions is the log retention period. The corresponding log instruction unit 12 can specify a retention period longer than the normal retention period. Furthermore, the retention period may be set by an administrator or other designated person.

[0108] Other log retention criteria include the scope of logs to be saved (log level, event ID, facility in syslog), the number of log backups, and the location of log backups (whether remote backups or offline backups are necessary, etc.).

[0109] If the security alert includes information indicating the level of urgency, the response log instruction unit 12 can identify the level of urgency from the security alert and set the log saving conditions described above according to the identified level of urgency.

[0110] Furthermore, the corresponding log instruction unit 12 may, for example, specify a longer retention period or specify that a wider range of logs be saved if the urgency level included in the security alert is above a certain level. In addition, the corresponding log instruction unit 12 may specify that a larger number of log backups be taken or that log backups be saved to a more secure location if the urgency level included in the security alert is above a certain level.

[0111] Furthermore, examples of logs that may be instructed to be saved include authentication logs, access logs, EDR (Endpoint Detection and Response) logs, event logs, command history, syslog, DHCP logs, network connection logs, NDR logs, IDS logs, IPS logs, UTM logs, firewall logs, packet captures, proxy logs, SIEM logs, email sending and receiving logs, email headers, email bodies, email attachments, email filter logs, sandbox logs, artifacts, memory dumps, disk images, files, folders, directories, trash, alternate streams, registry, startup processes, screenshots, configuration files, startup items, cron jobs, browser history, cookies, cache, crash dumps, Master File Table, journals, Recent Files, Jump Lists, Shell Bags, Shortcuts, Prefetches, Office Recent Files, Volume shadows, and accounts. The logs instructed to be saved may also be combinations of these. Moreover, logs other than those listed above may be instructed to be saved; the list is not limited to these.

[0112] Furthermore, the host may be a physical device, a virtual machine, a network, a container, a process, or a combination thereof.

[0113] Furthermore, instead of using the attack path information (see Figure 4) stored in the storage unit 14 to identify the attack path, the corresponding log selection unit 11 can also derive the attack path from the security alert. However, in this case, various techniques for deriving the attack path, such as attack tree analysis and FTA, are used.

[0114] In this disclosure, the computer system 20 subject to log analysis may consist of multiple physical devices connected by a network, or it may be a system in which some or all of its functions are implemented on a cloud computer.

[0115] Furthermore, in the example described above, a security monitoring device 23 constituting the computer system 20 outputs a security alert when it detects suspicious behavior by monitoring communications within the network, but this disclosure is not limited to this form.

[0116] In this disclosure, security alerts may be generated by antivirus software installed on each host or by an EDR (Endpoint Detection and Response). Furthermore, if a log management system is installed on computer system 20, the log management system will collect logs generated on each host and network communication logs, and if it detects suspicious behavior in those logs, it will generate a security alert. Also, if a SIEM (Security Information and Engagement Program) is installed on computer system 20, the SIEM will generate a security alert. Furthermore, security alerts may also be generated manually by the administrator of computer system 20.

[0117] (physical configuration) Here, a computer that implements an information processing device by executing the programs in Embodiments 1 to 3 will be described using Figure 11. Figure 11 is a block diagram showing an example of a computer that implements an information processing device in Embodiments 1 to 3.

[0118] As shown in Figure 11, the computer 110 comprises a CPU (Central Processing Unit) 111, main memory 112, storage device 113, input interface 114, display controller 115, data reader / writer 116, and communication interface 117. Each of these components is connected to the others via a bus 121, enabling data communication.

[0119] Furthermore, the computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to, or instead of, the CPU 111. In this embodiment, the GPU or FPGA can execute the program in the embodiment.

[0120] The CPU 111 loads the program in the embodiment, which consists of a set of codes stored in the storage device 113, into the main memory 112, and performs various calculations by executing each code in a predetermined order. The main memory 112 is typically a volatile storage device such as DRAM (Dynamic Random Access Memory).

[0121] Furthermore, the program in this embodiment is provided stored on a computer-readable recording medium 120. The program in this embodiment may also be distributed over the internet via a communication interface 117.

[0122] Specific examples of the storage device 113 include hard disk drives and semiconductor storage devices such as flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and mouse. The display controller 115 is connected to the display device 119 and controls the display on the display device 119.

[0123] The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, reads programs from the recording medium 120, and writes processing results from the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and other computers.

[0124] Furthermore, specific examples of the recording medium 120 include general-purpose semiconductor memory devices such as CF (Compact Flash®) and SD (Secure Digital), magnetic recording media such as Flexible Disks, or optical recording media such as CD-ROMs (Compact Disk Read Only Memory).

[0125] Furthermore, the information processing in this embodiment can be implemented not only by a computer on which a program is installed, but also by using hardware corresponding to each part, such as electronic circuits. Moreover, the information processing device may be partially implemented by a program and the remaining part by hardware. In this embodiment, the computer is not limited to the computer shown in Figure 11.

[0126] Some or all of the embodiments described above can be expressed by (Appendix 1) to (Appendix 24) described below, but are not limited to the following descriptions.

[0127] (Note 1) A computer system including a host includes a corresponding log selection unit that identifies attack paths related to security alerts and identifies logs corresponding to the identified attack paths, A corresponding log instruction unit instructs the host handling the identified log to save the identified log, An information processing device characterized by having the following features.

[0128] (Note 2) The security alert includes information indicating the host that was targeted by the attack. The corresponding log selection unit identifies the host that was targeted by the attack from the security alert, and identifies the attack path associated with the identified host. The information processing device described in Appendix 1.

[0129] (Note 3) The security alert further includes information indicating the type of attack, The system further includes a type identification unit that identifies the type of attack from the security alert, The corresponding log selection unit identifies an attack path associated with the identified host and the identified attack type, and for each step included in the identified attack path, identifies the associated host and associated log. The corresponding log instruction unit instructs the identified related host to save the identified related log. The information processing device described in Appendix 2.

[0130] (Note 4) The aforementioned security alert is intelligence information provided about a cyberattack, and includes information indicating the type of attack. The corresponding log selection unit identifies the attack type from the security alert and identifies the attack path associated with the identified attack type. The information processing device described in Appendix 1.

[0131] (Note 5) The corresponding log selection unit further identifies the attack steps included in the identified attack path, and for each identified attack step, it identifies the log corresponding to the attack path. The information processing device described in Appendix 1.

[0132] (Note 6) The corresponding log instruction unit further instructs the host on the conditions for saving the log. The information processing device described in Appendix 1.

[0133] (Note 7) The security alert includes information indicating the level of urgency, The corresponding log instruction unit identifies the level from the security alert and sets the log saving conditions according to the identified level. The information processing device described in Appendix 6.

[0134] (Note 8) The corresponding log instruction unit transmits data to the host, including the type of log identified and an instruction to save the identified log. The information processing device described in Appendix 1.

[0135] (Note 9) A computer system including a host includes a corresponding log selection step, which involves identifying attack paths related to security alerts and identifying logs corresponding to the identified attack paths, A corresponding log instruction step instructs the host handling the identified log to save the identified log, An information processing method characterized by having the following:

[0136] (Note 10) The security alert includes information indicating the host that was targeted by the attack. In the corresponding log selection step, the host targeted by the attack is identified from the security alert, and the attack path associated with the identified host is identified. The information processing method described in Appendix 9.

[0137] (Note 11) The security alert further includes information indicating the type of attack, The system further includes a type identification step of identifying the type of attack from the security alert, In the corresponding log selection step, an attack path related to the identified host and the identified attack type is identified, and for each step included in the identified attack path, the associated host and associated log are identified. The corresponding log instruction step instructs the identified related host to save the identified related log. The information processing method described in Appendix 10.

[0138] (Note 12) The aforementioned security alert is intelligence information provided about a cyberattack, and includes information indicating the type of attack. In the corresponding log selection step, the attack type is identified from the security alert, and the attack path related to the identified attack type is identified. The information processing method described in Appendix 9.

[0139] (Note 13) In the corresponding log selection step, further identify the attack steps included in the identified attack path, and for each identified attack step, identify the log corresponding to the attack path. The information processing method described in Appendix 9.

[0140] (Note 14) In the corresponding log instruction step, the host is further instructed on the conditions for saving the log. The information processing method described in Appendix 9.

[0141] (Note 15) The security alert includes information indicating the level of urgency, In the corresponding log instruction step, the level is identified from the security alert, and the log saving conditions are set according to the identified level. The information processing method described in Appendix 14.

[0142] (Note 16) In the corresponding log instruction step, data is sent to the host including the type of log identified and an instruction to save the identified log. The information processing method described in Appendix 9.

[0143] (Note 17) On the computer, A computer system including a host includes a corresponding log selection step, which involves identifying attack paths related to security alerts and identifying logs corresponding to the identified attack paths, A corresponding log instruction step instructs the host handling the identified log to save the identified log, A program that executes something.

[0144] (Note 18) The security alert includes information indicating the host that was targeted by the attack. In the corresponding log selection step, the host targeted by the attack is identified from the security alert, and the attack path associated with the identified host is identified. The program described in Appendix 17.

[0145] (Note 19) The security alert further includes information indicating the type of attack, To the aforementioned computer, From the security alert, a further type identification step is performed to identify the type of attack. In the corresponding log selection step, an attack path related to the identified host and the identified attack type is identified, and for each step included in the identified attack path, the associated host and associated log are identified. The corresponding log instruction step instructs the identified related host to save the identified related log. The program described in Appendix 18.

[0146] (Note 20) The aforementioned security alert is intelligence information provided about a cyberattack, and includes information indicating the type of attack. In the corresponding log selection step, the attack type is identified from the security alert, and the attack path related to the identified attack type is identified. The program described in Appendix 17.

[0147] (Note 21) In the corresponding log selection step, further identify the attack steps included in the identified attack path, and for each identified attack step, identify the log corresponding to the attack path. The program described in Appendix 17.

[0148] (Note 22) In the corresponding log instruction step, the host is further instructed on the conditions for saving the log. The program described in Appendix 17.

[0149] (Note 23) The security alert includes information indicating the level of urgency, In the corresponding log instruction step, the level is identified from the security alert, and the log saving conditions are set according to the identified level. The program described in Appendix 22.

[0150] (Note 24) In the corresponding log instruction step, data is sent to the host including the type of log identified and an instruction to save the identified log. The program described in Appendix 17. [Industrial applicability]

[0151] As described above, this disclosure makes it possible to improve the efficiency of log collection from computer systems. This disclosure is useful for various systems for countering cyberattacks. [Explanation of Symbols]

[0152] 10. Information Processing Device (Embodiment 1) 11. Selecting the appropriate log 12. Corresponding Log Instruction Section 13. Alert Acquisition Unit 14 Storage section 20 Computer Systems 21 Hosts 22 terminals 23 Security monitoring devices 24 Administrator's terminal 30 Information Processing Device (Embodiment 2) 31. Category-Specific Section 110 Computer 111 CPU 112 Main Memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Readers / Writers 117 Communication Interface 118 Input devices 119 Display device 120 recording media 121 Bus

Claims

1. A computer system including a host includes a corresponding log selection unit that identifies attack paths related to security alerts and identifies logs corresponding to the identified attack paths, A corresponding log instruction unit instructs the host handling the identified log to save the identified log, An information processing device characterized by having the following features.

2. The security alert includes information indicating the host that was targeted by the attack. The corresponding log selection unit identifies the host that was targeted by the attack from the security alert, and identifies the attack path associated with the identified host. The information processing apparatus according to claim 1.

3. The security alert further includes information indicating the type of attack, The system further includes a type identification unit that identifies the type of attack from the security alert, The corresponding log selection unit identifies an attack path associated with the identified host and the identified attack type, and for each step included in the identified attack path, identifies the associated host and associated log. The corresponding log instruction unit instructs the identified related host to save the identified related log. The information processing apparatus according to claim 2.

4. The aforementioned security alert is intelligence information provided about a cyberattack, and includes information indicating the type of attack. The corresponding log selection unit identifies the attack type from the security alert and identifies the attack path associated with the identified attack type. The information processing apparatus according to claim 1.

5. The corresponding log selection unit further identifies the attack steps included in the identified attack path, and for each identified attack step, it identifies the log corresponding to the attack path. The information processing apparatus according to claim 1.

6. The corresponding log instruction unit further instructs the host on the conditions for saving the log. The information processing apparatus according to claim 1.

7. The security alert includes information indicating the level of urgency, The corresponding log instruction unit identifies the level from the security alert and sets the log saving conditions according to the identified level. The information processing apparatus according to claim 6.

8. The corresponding log instruction unit transmits data to the host, including the type of log identified and an instruction to save the identified log. The information processing apparatus according to claim 1.

9. A computer system including a host includes a corresponding log selection step, which involves identifying attack paths related to security alerts and identifying logs corresponding to the identified attack paths, A corresponding log instruction step instructs the host handling the identified log to save the identified log, An information processing method characterized by having the following:

10. On the computer, A computer system including a host includes a corresponding log selection step, which involves identifying attack paths related to security alerts and identifying logs corresponding to the identified attack paths, A corresponding log instruction step instructs the host handling the identified log to save the identified log, A program that executes something.

Images